ML14058A017
Text
ý(2.
MEMORANDUM TO: Eric J. Leeds, Director Office of Nuclear Reactor Regulation FROM: Mark A. Cunningham, Director Division of Risk Assessment Office of Nuclear Reactor Regulation Patrick L. Hiland, Director Division of Engineering Office of Nuclear Reactor Regulation Joseph G. Gitter, Director Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation
SUBJECT:
OCONEE FLOOD PROTECTION AND THE JOCASSEE DAM HAZARD BASIS FOR NRC ALLOWING CONTINUED OPERATION The purpose of this memorandum is to document the basis for NRC allowing continued operation of the Oconee Nuclear Station through November 2010 (as conveyed to Duke in a management meeting on November 5, 2008) for a porFid f 2 ,yea'r to resolve issues related to their Standby Shutdown Facility (SSF) and potential vulnerabilities due to external floods. The basis was formed on current dam conditions and the risk associated with operating the site for the-ReA-2 years from the November meeting date.
Continued operation during this time period is not inimical to the public health and safety, safety; therefore, we recommend that you approve and concur on this basis for NRC allowing continued operation.
Please sign below to indicate your approval. If you have any questions, please contact one of us.
Approved: Date:
Eric J. Leeds, Director Office of the Nuclear Reactor Regulation
Enclosures:
- 1. Oconee Flood Protection and the Jocassee Dam Hazard Basis for NRC Allowing Continued Operation Through November 2010.
OFFIRIA JEO r- CRrREi L NOMlmF
Oconee Flood Protection and the Jocassee Dam Hazard Basis for NRC Allowing Continued Operation Through November 2010 exte*nal flooding VUlFrability at QNS, including fa*lUre of the I*,.Gsee Dam. The issue r*elye6, arou,- , he aeuryoth Stonfiaea decI le ""Fe~
ietht th asurrenRt tef '8d hclght exeeeds the existing flood protection found around the SSF combi~ned with NRC's discoveyw of a calculat ~ena error a~ssocated with damR failure. The "Joca~sco HydrO Project, Damn Failure inundation Study," postula d flood levels of the Oconee site which Would FRnder the SSF inGepable and would G.ompromised the capr i4fty of the station to mpaintain needed residual heat remoeval and spent fuel peol cooling functions. The calcaulational error roculted in an order of m~agnitude inrGeare in dam failure.
The NRC has concluded that an immediate shutdown of the Oconee units is not warranted because the joc~accee Darn is,not likely to rsuffer a catastrophic failure duFrig the neod 2 years, and accident cogquencE NtmeJTitee nteGdFe ar.G~'udee~tG U*qti i~ ed nt4 _
Mark Cunningham NRR~QRA 041P 4 Director Apprevcd Date -_____
Me-~ieGalieway NRR#QRA3045214 Deputy Director Approved Date jeff Mi4naA NRRDRNAPOB 94523 SeniorF Reliabiýly&
Rick AnalySt Reviewed Date ____
ARNtoSo ZoUlics NR!DRANAPB RikAn~alyst- Preparer Datce_____________________
AIDAMS AccessionF No.
1.
- ONLY ~-SECURITY RELA'UJF
PURPOSE The purpose of this assessment is to document the basis for NRC allowing continued operation of the Oconee Nuclear Station (ONS) fe.--2-yeaFethrough November 2010 to allow issues related to external flooding of the Standby Shutdown Facility (SSF) to be adequately addressed.
- 2. BACKGROUND On August 15, 2008, the NRC issued a request pursuant to 10 CFR 50.54(f) for information regarding the external flooding vulnerability at ONS, including failure of the Jocassee Dam. The issue revolves around the adequacy of the SSF to mitigate an external flood given that the current assessment of the flood height exceeds the existing flood protection found around the SSF cOm.binod with NRs,, dico'*,,..y of a alcrulational orror ai.oclatod with dam failuro. The "Jocassee Hydro Project, Dam Failure Inundation Study1 ," postulated flood levels of the Oconee site which would render the SSF inoperable and would compromised the capability of the station to maintain needed residual heat removal and spent fuel pool cooling functions. In addition, T-hea calculational error discovered by the staff resulted in an order of magnitude increase in dam failure.
The SSF provides capability to shutdown the Oconee units from outside the control room in the event of a fire, flood, or sabotage-related emergency. Under loss of offsite power conditions, the Keowee Dam provides backup AC power. The SSF is credited as the alternate AC (AAC) power source and the source of decay heat removal required to demonstrate safe shutdown during the required station blackout coping duration. It provides additional "defense-in-depth" by serving as a backup to safety-related systems. -The SSF has the capability of maintaining Mode 3 in all three units for approximately three days following a loss of normal AC power. It is designed to maintain reactor coolant system (RCS) inventory, maintain RCS pressure, remove decay heat, and maintain shutdown margin. The SSF requires manual activation and would be activated under adverse fire, flooding or sabotage conditions when existing redundant emergency systems are not available.2 In April of 2006 the Nuclear Regulatory Commission (NRC) concluded that the licensee failed to effectively control maintenance activities associated with removing a fire suppression refill access cover (a passive NRC-committed flood protection barrier) in the SSF south wall to facilitate installation of temporary electrical power cables. The staff identified the issue during a periodic risk-informed flood inspection under the NRC's Reactor Oversight Process (ROP).
Using the ROP Significance Determination Process, the staff discovered that the licensee did not adequately address the potential consequences of flood heights predicted at the Oconee site based on the 1992 Duke Hydro/FERC Inundation Study.
The inundation study analyzed two dam failure scenarios:
- sunny day dam failure - assumes that the reservoir is at normal operating levels (determined by reviewing historical reservoir levels approximately 17 feet below the top level of the dam) and a catastrophic failure of the dam occurs
" probable maximum flood (PMF) dam failure - assumes that the reservoir is at 3 feet below the top level of the dam and a catastrophic failure of the dam occurs (piping breach).
1 "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.
2 UFSAR Revision 15, Oconee Nuclear Station, December 2005, Chapter 9 Section 9.6.1.
2 FF1-
The dam failures under these scenarios assumed that the flood waters would also fail the Keowee Dam. The Keowee Dam is assumed to fail as the direct result of the water forces cutting a breach in the homogeneous earth fill. Given the postulated break size and the subsequent failure of the Keowee Dam, the flood levels at ONS were calculated to be 12.5 feet and 16.8 feet for the sunny day and PMF dam failures, respectively. Flood heights of this magnitude would submerge the SSF and render it inoperable and unavailable to perform its mitigating functions. Without mitigating actions, Gcore damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the dam break, and containment failure would occur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />. When containment failure occurs, significant dose to the public would result.
In 2007, the staff conducted an independent review of the Jocassee Dam failure frequency that Duke had used in the Oconee Probabilistic Risk Assessment (PRA). From that review, the staff concluded that a higher frequency estimate of Jocassee Dam failure was more accurate and that the licensee's estimate was not adequately supported by operating experience and actual performance data of similar rock-filled dam structures. The licensee excluded failure data related to earthen dams while including the dam years related to those dams thus reducing the failure probability by an order of magnitude inappropriately.
- 3. EVALUATION Deterministic Assessment The SSF provides capability to shut down the nuclear reactors from outside the control room in the event of a fire, flood, or sabotage-related emergency. The SSF is also credited as the alternate AC (AAC) power source and the source of decay heat removal required to demonstrate safe shutdown during the required station blackout coping duration. It provides additional "defense-in-depth" by serving as a backup to safety-related systems. The SSF has the capability of maintaining Mode 3 in all three units for approximately three days following a loss of normal AC power. It is designed to maintain reactor coolant system (RCS) inventory, maintain RCS pressure, remove decay heat, and maintain shutdown margin. The SSF requires manual activation and would be activated under adverse fire, flooding or sabotage conditions when existing redundant emergency systems are not available.
If the postulated flood renders the SSF inoperable, the site loses its last and only line of defense to mitigate the flood and to prevent both core damage and containment failure. The flood leads to an increased vulnerability to failure of multiple components. The site does not have the ability to provide emergency power to Emergency Core Cooling Systems (ECCS), thus rendering the site without core cooling. Without core cooling, there is no method to remove decay heat and prevent core damage. Without mitigating actions, Gcore damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the dam break and containment failure would occur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />. When containment failu"r occ.ur, significant d*se to the public would reul*t.
Risk Assessment When cctimating parameters6 for probabilhstiG Fisk ascoemonet (PRA), the Bayesian approach *6 the methed Of choice. Firs, data from: roliable equipment are typically cparso, with feW or even Zero obscrwod failure. in such caeM,, it i6 reasonablo to draw on other 6oUrGes .nFoaten.
of The Bayesin ;prah provideG a m~echanism for incrGFporating SUch 50nfmatlen froM prior 6ucocosocG -and- filulres. Second, the Bayesian framneWork allows Gtraightf9Foard propagation of 3
FIIL-ECURITY R A'TEDlPOR 'TT?
basic event uncertainties through a logical modal, to p -n u...n
-oducc On the frequenc.y t n..rtainty the unde6i.*b*, end state. T, do thi.,, It a*siRn,- a probability di*i bution to each of the unkn.ow pa.r*a,.teor, draws a random sample ftom aach, and contructs the co,4spending6lample for the frequency of the undesirable and state.
A Baye*..a analy6is of dam failu.res usin th.The staff used the National Performance of Dams Program Database developed and maintained by Stanford University in conjunction with the Army Corps of Engineers Dam Database was pe.foRred, Table !)to calculate the probability of rockfill dam failures. The calculation consisted of reviewing historical failure data and past operating history of rockfill dams to develop an updated failure probability. The failure probability reflects the current population of similar dams to the Jocassee dam. The mean dam failure frequency is on the order of 1.OE-04 failure/dam-year. As we stated in the deterministic assessment, a flood exceeding the height of the SSF flood protection would render the SSF inoperable. In this case, the failure of the SSF is 1.0. Given the frequency of the dam failure, this results in a conditional core damage probability of 1.OE-04. The data is breken down by various damn types greater than 50 feet, their failures, operating histor; (DamR yearci), a mnean, and the 5%, 50%, ad 095% cf4iden.e leve.l.
Table 1 Dam1-Va!e ne-of~pams GrOator Than 60ft All Failureo ye mean "0 60% WA%
BO'tMcBz Dam O-r 60 Ft Hgh 9 48 207-E04 4-440-0 366-04 4-487E-04 Arch DamS OOr 50 FOWt Hgh - 66W 2.703E04 !.GIBE-04 2,686E-04 .480E-04 Cor.csrto Dme _ O*F .. 6 F Hrgh 0 1024 8.197-E-06 1-404-6-6 7092E-O6 44WE-0 Earth DEame O'.ar 60Fea Hi66 444849 3.7-70E-04 2.997-E04 3.7-49E-Q4 4,6417Z-04 I-Graydty; Dama, GY F60 Foet High 7 1.9642 3E73604 4493E-.04 3.061 E 04 &,.04.4&04 MacO-RF" DomS OQcr 60 Feet High 0 W 40600 !.721E 4 4-466-94
....'" Arch DOFm O'-F 50 =c, 7-7 34362&-04 64006- 2-0446-E04 &n3&04 Rockfll Dams 0Or 6 fat ig 4 4-96 2-4306E04 9.63E 06 2.0216E04 3.k68f4E0 Fete 69 24307-4 12-304 62306g- 2-0459--4 6336-04 It is im*po~r.tte tote that th.e MRa dam failure frequencies are on the order of 1._E 01 failure/dam year. As we stated in the deterMinictic assessment, a flood eXceedin~g the height Of the SSF= flood protectien would render the SSF= inoperable. Therefore, the failure of the SSF is 1.0. Given the frequency of the damR failure, this reBultS in a coenditional core damage probability The Joca..ee Dam is deigned for seismicG ground acceler8atio equal to Orgreater than those used in the design of ONS'. GiveR the dam location, the likelihood of a large..eismic eventis*
1.GE 060yf.
Acc~iden~t 6equence progression; timelines for the subsequent containment failure Would be 9n the order of .days.
.re damage would ocur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the damH break and rentainmqent failure would eoccur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br /> without mnitigation. Additional strategfies under consideration incalude use Of fire tFruks to maintain Spent Fuel Pool levels-,
controlled4 ventin~g of the reactor bufildinge to mnaintain integrity, stationing and use of portable pumping equipment to spray the containm~ent Structu~res, and securin~g additional equipment fot
--# .,. f -,, . :. A
+. , .. ,, . . -, , , + : +, ,, ,-,
"i Va Orr-ab rvv v 7 12 0 TWVFU !3 va "10 Itto "IF 0 writ it a a to MWEIRSeRGY Action Plan and evacuate the people inthe surrFounding vicinity. Furthermoroe, it is assumned, this addfitinal time could allow recover,' of flooded roadways after flood recession andth 4
-U,'J~ALiJ.
t*'* -*EJRIT-Y*LAE* l'FR.':r/l0*
potential for alternate water GOUree o cqipnt to mitigate the accident. in addition, Dk has committed to augment itS Se;.:re Acc;ýid~ntt Management Guidolinoc (SAMGr,) by FobrUarF' 2000 to include potential bers of tho 9SF duo to eXtoRnal fleod The ability of the NRC to accept a low likelihood of dam failure in the Rext 2 yoarc through November 2010 is supported by the current apparent health of the dam and the regular monitoring of its condition:
" Duke has a diverse program of constant surveillance of the performance of the dam by means of on-site cameras and also offsite monitoring of the observed data from its headquarters office.
- Duke is performing biweekly inspection and monitoring of the condition of the dam, as required by FERC.
" FERC personnel inspect the dam annually, and the 2007 inspection did not identify any adverse trends in the condition of the dam.
In addition, the level of the dam is continuously monitored and is currently approximately 23 feet below the lake's full pond level due to drought conditions. Under current drought conditions, the loading that is imposed on the dam is reduced.
The continuing monitoring of the dams provides the licensee the ability to determine dam health.
Given this level of reliability, and the short duration in which the licensse is allowed to operate, the conditional core damage probability is low. and the time available to Which any needed actiOne could be taken Or. extended.
Accident Sequence Progression Accident sequence progression timelines for the subsequent containment failure would be on the order of days. Without mitigating actions, core damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the dam break and containment failure would occur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />.
Additional strategies under consideration by the licensee include use of fire trucks to maintain Spent Fuel Pool levels, controlled venting of the reactor buildings to maintain integrity, stationing and use of portable pumping equipment to spray the containment structures, and securing additional equipment for mitigation as directed by the Emergency Response Organizaiont (ERO). This would give ONS time to implement the site Emergency Action Plan and evacuate the people in the surrounding vicinity. Furthermore, it is assumed, this additional time could allow recovery of flooded roadways after flood recession and the potential for alternate water sources or equipment to mitigate the accident. Duke has committed to augment its Severe Accident Management Guidelines (SAMGs) by February 2009 to include potential loss of the SSF due to external floods.
- 4. CONCLUSIONS The NRC staff believes that the Jocassee Dam is unlikely to suffer a catastrophic failure duwi~g through November 201 0the ne42 yea~s for the following reasons:
5 OFFICI,-AL 11 ONLY SC"R" RELATEC IN'3RMATIGI*
GnGWO§ý ý ý ý ý ATIO0
- The initiating event frequency, supported by ongoing FERC and Duke monitoring and inspection of the dam, is relatively low.
- The initiating event frequency for a random failure is on the order of 1E-4/yr and for a large Seiclicv event iS lE 5W .
The present level of the Jocassee Lake is about 23 feet below the lake's full pond level due to the drought conditions. This reduces the loading that is imposed on the dam.
- Duke has a diverse program of constant surveillance of the performance of the dam by means of on-site cameras and also offsite monitoring of the observed data from its headquarters office.
- Duke is performing biweekly inspection and monitoring of the condition of the dam, as required by FERC.
, FERC personnel inspect the dam annually, and the 2007 inspection did not identify any adverse trends in the condition of the dam.
" Accident sequence progression timelines to containment breach and/or fuel pool boil off at Oconee are on the order of days, allowing time to implement onsite mitigating actions and offsite emergency response actions.
" The staff assumes that recovery of flooded roadways after floodwater recession will allow for providing an alternate source of water for containment and spent fuel pool cooling.
" Duke has committed to augmenting its Severe Accident Management Guidelines (SAMGs) in February 2009 to include potential loss of the SSF due to external flood.
-The current drought leve! of the lake providec additional time within Which any needed actioncS could be taken.
The NRC has concluded that an immediate shutdown of the Oconee units is not warranted because the Jocassee Dam is not likely to suffer a catastrophic failure dU'-;9theR'Xq"-2 yeaFethrough November 2010, and accident sequence progression timelines are on the order of days. Continued operation during this time period is not inimical to the public health and safety.
6 SUSEO0