ML14058A018
Text
.4 P SECUONL AIE- FR~ORM 07 MEMORANDUM TO: Eric J. Leeds, Director Office of Nuclear Reactor Regulation FROM: Mark A. Cunningham, Director Division of Risk Assessment Office of Nuclear Reactor Regulation Patrick L. Hiland, Director Division of Engineering Office of Nuclear Reactor Regulation Joseph G. Gitter, Director Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation
SUBJECT:
OCONEE FLOOD PROTECTION AND THE JOCASSEE DAM HAZARD BASIS FOR NRC ALLOWING CONTINUED OPERATION The purpose of this memorandum is to document the basis for NRC allowing continued operation of the Oconee Nuclear Station for a period of two years to resolve issues related to their Safe Standby Facility (SSF) and potential vulnerabilities due to external floods. The basis was formed on current dam conditions, compensatory measures (Circle and Wrote none? Do not understand comment) taken by the licensee and the risk associated with operating the site for the next two years.
Continued operation during this time period is not inimical to the public health and safety.
Therefore, we recommemd that you approve and concur on this basis for continued operation.
Please sign below to indicate your approval. If you have any questions, please contact one of us.
Approved: Date:
Eric J. Leeds, Director Office of the Nuclear Reactor Regulation
Enclosures:
- 1. Basis for Continued Operation of the Oconee Nuclear Station
~irriLiAL USE ONLY - S5 XURITY RE' ATED NF~i~ivit~ nON
O - R I.TDIN .P--T!
Oconee Flood Protection and the Jocassee Dam Hazard Basis for NRC Allowing Continued Operation Through December 2010 Summary Description of Issue:
It has come to the attention of the agency that the Oconee Nuclear Station does not appear to have adequate protection in part due to lack of defense-in-depth to meet the requirements of General Design Criteria 2 "Design Bases for Protection Against Natural Phenomena," such as external flooding, including a flood from the Jocassee Dam. Specifically, available information from the "Jocassee Hydro Project, Dam Failure Inundation Study," regarding postulated flood levels at the Standby Shutdown Facility (SSF) of the Oconee site suggests that the capability of the station to maintain needed residual heat removal and spent fuel pool cooling functions would be compromised. The NRC has concluded that an immediate shutdown of the Oconee units is not warranted because the Jocassee Dam is not likely to suffer a catastrophic failure during the next 2 years and accident sequence progression timelines are on the order of days. Although the present configuration does not afford adequate protection, continued operation during this time period is not inimical to the public health and safety.
Name/Title Organization Telephone Mark Cunningham NRR/DRA 301-415-2884 Director Approved Date Melanie Galloway NRR/DRA 301-415-2884 Deputy Director Approved Date Jeff Mitman NRR/DRAIAPOB 301-415-2843 Senior Reliability &
Risk Analyst Reviewed Date Antonios Zoulis NRR/DRA/APOB 301-415-1209 Reliability &
Risk Analyst Preparer Date ADAMS Accession No.
OFFICIAL USt ~NLY ~FCUPT~ ~ w IN~U~ivi~ ~UN
- 1. PURPOSE The purpose of this assessment is to document the basis for NRC allowing continued operation of the Oconee Nuclear Station (ONS) until issues related to external flooding of the Standby Shutdown Facility (SSF) are adequately addressed.
- 2. BACKGROUND it hac come to the attention of the agen. y that On August 15, 2008, the NRC issued a request pursuant to 10 CFR 50.54(f) for information regarding the external flooding vulnerability at ONS, including failure of the Jocassee Dam.
The issue revolves around the adequacy of the SSF to mitigate an external flood given the flood height exceeds the existing flood protection found around the SSF. the Ococo, Nuclear Station does not appoar to have adequatoptecto inWWRO part duo to lack of defense in depth to mooet the rcquiremnentc of Genoral Design Criteria 2 "Design Bases for Protectio Against Natuiral Phenomena," SUch as oenFal flooding, including tFhehea flood from Joca.ec Dam. Speci-ficaly, available information from tThe "Jocassee Hydro Project, Dam Failure Inundation Study 7 l,"'(,-1--)
FegaFd4F§postulated flood levels at the Standby Shutdown Facility (.SF) of the Oconee site suggest which would render the SSF inoperable and would compromised that-thethe capability of the station to maintain needed residual heat removal and spent fuel pool cooling functions would be ompromied.
The SSF provides capability to shutdown the nuclear reactors from outside the control room in the event of a fire, flood, or sabotage-related emergency. The SSF is also credited as the alternate AC (AAC) power source and the source of decay heat removal required to demonstrate safe shutdown during the required station blackout coping duration. It provides additional "defense-in-depth" by serving as a backup to safety-related systems. The SSF has the capability of maintaining Mode 3 in all three units for approximately three days following a loss of normal AC power. It is designed to maintain reactor coolant system (RCS) inventory, maintain RCS pressure, remove decay heat, and maintain shutdown margin, The SSF requires manual activation and would be activated under adverse fire, flooding or sabotage conditions when existing redundant emergency systems are not available .
In April of 2006 the Nuclear Regulatory Commission (NRC) concluded that the licensee failed to effectively control maintenance activities associated with removing a fire suppression refill access cover (a passive NRC committed flood protection barrier) in the SSF south wall to facilitate installation of temporary electrical power cables. The staff identified the issue during a periodic risk-informed flood inspection under the NRC's Reactor Oversight Process (ROP).
Using the ROP Significance Determination Process, the staff discovered that the licensee may did not have-adequately addressed the potential consequences of flood heights predicted at the Oconee site based on the 1992 Duke Hydro/FERC Inundation Study.
The inundation study analyzed two dam failure scenarios:
1 "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.
2 UFSAR Revision 15, Oconee Nuclear Station, December 2005, Chapter 9 Section 9.6.1.
2 uz'iiUAL USE ONLY S~Z1JRITY RELATW iaF~R~iAiRr;
flrrh;A;. II~F O~L~' ~ITIIIIIT~' ~IELAT~D INtuviATi
- Ssunny dDay dDam fFailure - assumes that the reservoir is at normal (this is what is indicated in the actual study) operating levels and a catastrophic failure of the dam occurs
- PFebable probable mMaximum fF-Iood (PMF) Dadam F-failure - assumes that the reservoir is at its highest levels and a catastrophic failure of the dam occurs.(Piping breach)
The Odam failures under these scenarios assumed that the flood waters would also fail the Keowee Dam; ai--this assumption was nothich is not made in any other Duke analysis and ee whGhgreatly impacts the results. The Keowee Dam is assumed to fail as the direct result of the overtopping water forces cutting a breach in the homogeneous earth fill.- Given the postulated break size and the subsequent failure of the Keowee Dam, the flood levels at ONS were calculated to be 12.54- feet and 16.8 2-ifeet for the Ssunny Pday and PMF dEaam fWailures, respectively. Flood heights of this magnitude would submerge The predicted flood would reach ONS at Which time the 8SF walls ar, overo*pped. Tthe SSF and render it inoperable and unavailable to perform its mitigating functions iGa..umed to fail following the flood le.. l exceeding the height of the SSF w.. Core damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the dam break, and containment failure would occur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />. When containment failure occurs, significant dose to the public would result.
In 2007, the staff conducted an independent review of the Jocassee Dam failure frequency that Duke had used in the Oconee Probabilistic Risk Assessment (PRA). From that review, the staff concluded that a higher frequency estimate of Jocassee Dam failure was more app.epFi*te accurate and that the licensee's estimate was not adequately supported by operating experience and actual performance data of similar rock-filled dam structures. The licensee excluded failure data related to earthen dams while including the dam years related to those dams thus reducing the failure probability inappropriately.
It has come to the attention of the agency that the Oconee Nuclear Station does not appear to have adequate protection in part due to lack of defense-in-depth to meet the requirements of General Design Criteria 2 "Design Bases for Protection Against Natural Phenomena," such as external flooding, including a flood from the Jocassee Dam The Atomic Energy Act Section 182a 3 -(-2-) provides the primary statutory standard relating to the Commission's mandate to ensure the safe operation of nuclear power plants. That section requires the Commission to ensure that "the utilization or production of special nuclear material will ... provide adequate protection to the health and safety of the public," 42 U.S.C. Sec. 2232(a). Based on this standard, and supported by the Atomic Safety and Licensing Appeal Board case of 1973(443), there is a presumption by the Commission of adequate protection of public health and safety when a licensee is in compliance with the regulations and other license requirements5 -(4). One such requirement is General Design Criteria 2 "Design Bases for Protection Against Natural Phenomena," which was developed to protect the public for accidents resulting from flood, earthquake, and other natural phenomenon endemic to the site.
However, circumstances may arise in which new information reveals an unforeseen hazard or a substantially greater potential for a known hazard to occur, such as identification of an issue that The Atomic Energy Act of 1954. Pub. L. 83 - 703, 68 Stat. 919 (1954).
Maine Yankee Atomic Power Company (Maine Yankee Nuclear Power Plant, Unit 2). ALAB-161, 6 AEC 1003. US Atomic Energy Commission: Washington, DC. 1973.
5 NUREG-0800, "Standard Review Plan for the Review of Safety Analyses for Nuclear Power Plants, Section 19.2 Appendix D, Use of Risk Information in Review of Non-risk-informed License Amendment Requests," June 2007.
3 LA
substantially increases risk. In such situations, the NRC has the statutory authority to require licensee action above and beyond existing regulations to maintain the level of protection necessary to avoid undue risk to public health and safety.
- 3. EVALUATION Defense-in-Depth The issue related to the SSF and external floods results in an increased vulnerability to failure of multiple components and degrades multiple barriers. The predicted flood would reach ONS at which time the SSF walls are overtopped. The SSF is assumed to fail following the flood level exceeding the height of the SSF wall. The flood will render emergency core cooling systems inoperable due to the loss of onsite and offsite power. Without a SSF to mitigate the external flood there is no defense-in-depth to prevent core damage and a large release to the environment. Core damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the dam break and containment failure in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />. When containment failure occurs, significant dose to the public would result.
Risk Assessment A Bayesian analysis of dam failures using the National Performance of Dams Program Database developed and maintained by Stanford University in conjunction with the Army Core of Engineers Dam Database shows most dam failure frequencies are on the order of 1.QE-04 failures per dam year:
Dam-Failures years apost bpost Mean 5% 50% 95%
1 All Arch Dams 2 9101 2.5 12134 2.060E-04 4.720E-05 1.793E-04 4.562E-04 2 All Buttress Dams 2 9819 2.5 12852 1.945E-04 4.456E-05 1.693E-04 4.307E-04 3 All Concrete Dams 10 110227 10.5 113260 9.271E-05 5.117E-05 8.978E-05 1.442E-04 4 All Earth Dams 366 2233693 366.5 2236726 1.639E-04 1.500E-04 1.637E-04 1.782E-04 5 All Gravity Dams 28 122798 28.5 125831 2.265E-04 1.615E-04 2.239E-04 3.005E-04 6 All Masonry Dams 5 21692 5.5 24725 2.224E-04 9.251E-05 2.091E-04 3.979E-04 7 All Multi-Arch Dams 0 240 0.5 3273 1.528E-04 6.006E-07 6.949E-05 5.868E-04 8 All Rockfill Dams 7 55872 7.5 58905 1.273E-04 6.163E-05 1.217E-04 2.122E-04 9 All Stone Dams 2 11365 2.5 14398 1.736E-04 3.978E-05 1.511 E-04 3.844E-04 10 All Timber Crib Dams 3 6536 3.5 9569 3.658E-04 1.132E-04 3.316E-04 7.350E-04 T Total 425 2581343 0.5 3033 1.648E-04 6.482E-07 7.499E-05 6.332E-04 4
~rrICIAL USE ONUT SECURITY RE~ lED INFoRM~TI3N
0FFiL I RITYR Further review of dams above 50 ft provides similar results:
Dam-Failures years apost bpost Mean 5% 50% 95%
1 Buttress Dams Over 50 Feet High 0 1876 2.4026 11971 2.007E-04 4.410E-05 1.736E-04 4.497E-04 2 Arch Dams Over 50 Feet High 2 5667 4.4026 15762 2.793E-04 1.01 8E-04 2.585E-04 5.280E-04 3 Concrete Dams Over 50 Feet High 0 19215 2.4026 29310 8.197E-05 1.801E-05 7.092E-05 1.837E-04 4 Earth Dams Over 50 Feet High 56 .144810 58.4026 154905 3.770E-04 2.997E-04 3.749E-04 4.617E-04 5 Gravity Dams Over 50 Feet High 7 19542 9.4026 29637 3.173E-04 1.683E-04 3.061E-04 5.044E-04 6 Masonry Dams Over 50 Feet High 0 1987 2.4026 12082 1.989E-04 4.370E-05 1.721E-04 4.456E-04 7 Multi-Arch Dams Over 50 Feet High 0 77 2.4026 10172 2.362E-04 5.190E-05 2.044E-04 5.293E-04 8 Rockfill Dams Over 50 feet high 4 19900 6.4026 29995 2.135E-04 9.603E-05 2.025E-04 3.684E-04 T Total 69 213074 2.4026 10095 2.380E-04 5.230E-05 2.059E-04 5.333E-04 Given this analysis and the lack of redundant safety equipment to mitigate the external flood, the risk to core damage from an external event is above 1.OE-05 which is of substantial safety significance.
Accident sequence progression timelines for the subsequent containment failure would be in order of days. This would give ONS time to implement the site Emergency Action Plan to mitigate the impact on the people in the surrounding vicinity. Furthermore, this additional time would allow recovery of flooded roadways after flood recession and the potential for alternate water sources or equipment to mitigate the accident. In addition, Duke has committed to augment its Severe Accident Management Guidelines (SAMGs) by February 2009 to include potential loss of the SSF due to external floods.
Performance Measurement ONS continually monitors the dam as follows:
- Duke has a diverse program of constant surveillance of the performance of the dam by means of on-site cameras and also offsite monitoring of the observed data from its headquarters office.
- Duke is performing biweekly inspection and monitoring of the condition of the dam, as required by FERC.
- FERC personnel inspect the dam annually, and the 2007 inspection did not identify any adverse trends in the condition of the dam.
The monitoring helps in determining the health of the dam.
- 4. CONCLUSIONS The NRC staff believes that the Jocassee Dam is unlikely to suffer a catastrophic failure during the next two years for the following reasons:
The initiating event frequency, supported by ongoing FERC and Duke monitoring and inspection of the dam, is relatively low.
- The initiating event frequency for a random failure is on the order of 1E-4/yr and for a large seismic event is 1E-5/yr.
5
- I TEDIN I0N
" The present level of the Jocassee Lake is about 23 feet below the lake's full pond level due to the drought conditions. This reduces the loading that is imposed on the dam.
" Duke has a diverse program of constant surveillance of the performance of the dam by means of on-site cameras and also offsite monitoring of the observed data from its headquarters office.
" Duke is performing biweekly inspection and monitoring of the condition of the dam, as required by FERC.
" FERC personnel inspect the dam annually, and the 2007 inspection did not identify any adverse trends in the condition of the dam.
Accident sequence progression timelines to containment breach and/or fuel pool boil off at Oconee are on the order of days, allowing time to implement onsite mitigating actions and offsite emergency response actions.
" The staff assumes that recovery of flooded roadways after floodwater recession will allow for providing an alternate source of water for containment and spent fuel pool cooling.
" Duke has committed to augmenting its Severe Accident Management Guidelines (SAMGs) in February 2009 to include potential loss of the SSF due to external flood.
" The current drought level of the lake provides additional time within which any needed actions could be taken.
The NRC has concluded that an immediate shutdown of the Oconee units is not warranted because the Jocassee Dam is not likely to suffer a catastrophic failure during the next two years and accident sequence progression timelines are on the order of days. Although the present configuration does not afford adequate protection, continued operation during this time period is not inimical to the public health and safety.
6 OF OFFICIAL USE
.. ~LLUtIi ~ ItLL'~ULU INUUhivui Iur~
UINLY-
O~fCIA ONy SE~rnc US 1'PI~TE INR~I~iN REFERENCES
- 1. "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.
- 2. The Atomic Energy Act of 1954. Pub. L. 83 -703, 68 Stat. 919 (1954).
- 3. Maine Yankee Atomic Power Company (Maine Yankee Nuclear Power Plant, Unit 2). ALAB-161, 6 AEC 1003. US Atomic Energy Commission: Washington, DC. 1973.
- 4. NUREG-0800, "Standard Review Plan for the Review of Safety Analyses for Nuclear Power Plants, Section 19.2 Appendix D, Use of Risk Information in Review of Non-risk-informed License Amendment Requests," June 2007.
- 5. U.S. Nuclear Regulatory Commission, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"
Regulatory Guide 1.174, Revision 1, November 2002.
7