ML14058A034
| ML14058A034 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 12/03/2009 |
| From: | Jeffrey Mitman NRC/NRR/DRA |
| To: | Meena Khanna Plant Licensing Branch 1 |
| Shared Package | |
| ML14055A421 | List:
|
| References | |
| FOIA/PA-2012-0325 | |
| Download: ML14058A034 (8) | |
Text
Mitman, Jeffrey From:
Sent:
To:
Subject:
Attachments:
Mitman, Jeffrey
ý.,
Thursday, December 03, 2009 3:01 PM Khanna, Meena Adequate Protection Backfit Documented Evaluation Oconee Adequate Protection Backfit Documented Evaluation Draft 7.doc Meena, here is the Word version of the requested document. This version (in Word format) is also on the SharePoint site in the "NRC working papers and documents" folder.
Jeff
Oconee Adequate Protection Backfit Documented Evaluation Draft 7 (2).doc DRAFT Oconee Nuclear Site Adequate Protection Backfit Documented Evaluation BACKGROUND AND OBJECTIVES OF THE MODIFICATION Duke Energy Carolinas, LLC, the licensee of the Oconee Nuclear Station (ONS) has not demonstrated that the site has adequate protection against external floods from all sources including dam failure. These floods include failures of the Jocassee Dam which inundates the ONS. The objective of this documented evaluation (as required by MD 8.41 and LIC-202 2) is to justify a backfit exception (under 10CFR50.109 (a) (4) (ii)) to modify the ONS licenses to ensure that the ONS has adequate protection against external floods and to maintain defense-in-depth.
Duke should enhance the ONS defense-in-depth such that all electrical power and means of cooling the core and maintaining containment integrity are not lost due to a failure of the Jocassee Dam.
REASON FOR THE LICENSE MODIFICATION This evaluation is a backfit exception which is defined in 10 CFR 50.109 (a) (4) (ii) as, "That regulatory action is necessary to ensure that the facility provides adequate protection to the health and safety of the public and is in accord with the common defense and security." To ensure adequate protection, Duke needs to demonstrate that the ONS has conservatism in its design and operation and a defense-in-depth approach to prevent accidents and mitigate their consequences.
In response to a 10 CFR 50.54(f) request for information dated August 15, 2008 ', the licensee reiterated that external floods which inundate the standby shutdown facility (SSF) will lead to early core damage and loss of spent fuel pool cooling at all three units. The remaining intact element of defense-in-depth of containment integrity will be severely challenged, if unmitigated, making the potential for radionuclide release highly probable. The licensee performed an inundation study5 in 1992 to meet a Federal Energy Regulatory Commission (FERC) requirement for formulating an emergency action plan should the Jocassee Dam fail. This study indicated that the resultant flood height would exceed the then current flood protection barrier height leading to a potential core damage event. This result has led the NRC to question the defense-in-depth and adequate protection of the ONS against such floods.
As described in the 1992 inundation study, an external flood at the Oconee site is expected to render both the switchyard and Keowee Dam unavailable which are the sources of offsite and emergency onsite ac power, respectively. Emergency feedwater pump turbines for all three units will also be unavailable due to inundation. The SSF was designed as an alternative 1 NRC Directive 8.4, "Management of Facility-specific Backfitting and Information Collection," October 28, 2004.
2 NRC LIC-202 Revision 1, "Managing Plant-Specific Backfits and 50.54(f) Information Requests," December 20, 2006.
3 Letter to D. Baxter of Duke Energy Carolinas, LLC, dated August 15, 2008, Information Request Pursuant to 10 CFR 50.54(f) Related to External Flooding, Including Failure of the Jocassee Dam at ONS, (ML0816402440).
4 Letter from D. Baxter of Duke Energy Carolinas, LLC, to US NRC, dated September 26, 2008.
5 "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.
DRAFT means to achieve and maintain Mode 3 following postulated fire, sabotage or internal flooding events and is also credited during station blackout events. It achieves these requirements by being a source of reactor coolant makeup, decay heat removal, and associated power to shut all three Oconee units down.
Though not credited in the FSAR to protect against external floods, the entrances to the SSF were protected by a 5-foot wall, raised to 7.5 feet in February 2009. This wall is the only means to protect the SSF from onsite flooding. One such source of ONS inundation is from failure of the Jocassee Dam. The Jocassee Dam is a pumped storage hydro-electric facility located approximately 11 miles upstream of the site. Mechanisms that can cause failures of the Jocassee Dam include overtopping, seismic, probable maximum flood (PMF) events, and "sunny day" failures. The 1992 inundation study took into consideration rupture of the dam due to random sunny day failure and PMF only. Previous to this analysis, Duke had excluded, as described in the ONS FSAR, both overtopping and seismic events. The 1992 inundation study reiterated that the Jocassee Dam would not overtop. The predicted resultant water levels from the inundation study, ranging from 12.5 feet to 16.8 feet at SSF grade, were found to be in excess of the existing flood mitigation barrier wall height for the SSF. Floodwater entering the SSF will overwhelm existing sump pumps, and due to the low critical flood heights, render the mitigation equipment in the facility non-functional. The failure of the SSF, based on current analyses and without further mitigation, will lead to failure of the only means to shut down and maintain all three Oconee units in a Mode 3 condition. The NRC became aware of the study shortly after it was completed in 1992 but took no action at that time.
New information was obtained following an April 2006 Reactor Oversight Process (ROP) evaluation, when the evaluation questioned the licensee's maintenance of the SSF flood protection barrier. During the subsequent ROP Significance Determination Process (SDP), the NRC identified that the licensee had incorrectly calculated the Jocassee Dam failure frequency.
Also, at this time the NRC recognized that the licensee had not adequately addressed the potential consequences of flood heights predicted at the Oconee site based on the 1992 inundation study. Additional new information was received when the licensee submitted a revised Jocassee Dam seismic fragility study6 in 2007. This new analysis raises questions bout potential liquifaction at the Jocassee Dam during a seismic event. A final source of new information also occurred during the subsequent follow-up to the SDP, when the NRC recognized that, inconsistent with best practices, the 1992 inundation study did not take into consideration an antecedent storm as part of PMF evaluation as is directed by National Oceanic and Atmospheric Administration (NOAA) Hydrometeorological Report Numbers 517 and 528 as is discussed in Regulatory Guides 1.599 and 1.10210. This antecedent storm scenario could lead to an overtopping of the Jocassee Dam in a manner that might lead to more severe inundation at the ONS.
6 Duke Energy Carolinas, LLC Contract NE 23546 - "Letter Report and Transmittal of Supporting Data,"
January 29, 2007.
7 Hydrometeorological Report No. 51, "Probable Maximum Precipitation Estimates, US East of the 105th Meridian," U.S. Department of Commerce, NOAA, June 1978.
8 Hydrometeorological Report No. 52, "Application of Probable Maximum Precipitation Estimates - US East of the 105th Meridian," U.S. Department of Commerce, NOAA, August 1982.
9 Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev. 2) August 1977.
10 Regulatory Guide 1.102, "Flood Protection for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev. 1) September 1976.
Page 2
DRAFT As a result, the NRC expressed via the aforementioned 10CFR50.54 (f) letter, a concern that Duke has not demonstrated "...overall adequacy of the flood protection of Oconee given the Jocassee Hydro Project... Specifically, the NRC is seeking information... whether Oconee lacks appropriate and adequate compensating engineering safeguards for such an event."
Subsequent to Duke's response to the 1 OCFR50.54 (f) letter, the NRC in its April 20, 2009, letter11 stated in part "the NRC staff remains concerned that Duke has not demonstrated that Oconee will be adequately protected in the long term from external flooding events."
BASIS FOR INVOKING BACKFIT EXCEPTION The NRC believes this situation qualifies for an adequate protection exception to the backfit rule under 10 CFR50.109 (a) (4) (ii). As discussed previously, if the Jocassee Dam fails and the SSF is inundated, the Oconee site has no defense-in-depth to prevent core damage and the containments are expected to subsequently fail. Following a Jocassee Dam failure which inundates the SSF, without defense-in-depth Duke has not shown that the public is adequately protected.
The following discusses the relevant flooding requirements, Duke's position on those requirements and the NRC's perspective on whether ONS meets those requirements.
- 1. To account for external flood protection, Oconee is licensed to a draft General Design Criterion (GDC) 2 which states:
Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) appropriate consideration for the most severe of these natural phenomena that have been recorded for the site and the surrounding areas and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.
- 2. To establish the licensing basis for the ONS compliance on external flood, the Oconee UFSAR 12 further states in Section 9.6.3.1 on the SSF:
Flood studies show that Lake Keowee and Jocassee are designed with adequate margins to contain and control floods. The first is a general flooding of the rivers and reservoirs in the area due to a rainfall in excess of the Probable Maximum Precipitation (PMP). The FSAR addresses Oconee's location as on a ridgeline 100' above maximum known floods. Therefore, external flooding due to rainfall affecting rivers and reservoirs is not a problem. The SSF is within the site boundary and, therefore, is not subject to flooding from lake waters. The grade level entrance of the SSF is 797.0 feet above mean sea level (msl). In the event of flooding due to a break in the non-seismic condenser circulating water (CCW) system piping located in the Turbine Building, the maximum expected water level within the site boundary is 796.5 ft. Since the maximum "Letter to D. Baxter, Evaluation of Duke Energy Carolinas, LLC, September 26, 2008, Response to NRC letter Dated August 15, 2008 Related to External Flooding at ONS (ML090570779 1).
12 Duke Energy Company Updated Final Safety Analysis Report, Revision 17, December 31, 2007.
Page 3
DRAFT expected water level is below the elevation of the grade level entrance to the SSF, the structure will not be flooded by such an incident. The SSF will stabilize the plant at mode 3 with an average Reactor Coolant temperature of 525°F. As a PRA enhancement the SSF is provided with a five foot external flood wall which is equipped with a water tight door near the south entrance of the SSF. A stairway over the wall provides access to the north entrance. The yard elevation at both the north and the south entrance to the SSF is 796.0 feet above mean sea level (msl). Based on the as-built configuration of the 5' flood wall provided at the north entrance and a flood wall at the south entrance to the SSF, SSF external flood protection is provided for flooding that does not exceed 801 feet above mean sea level. [801 feet above mean sea level corresponds to 5 feet above SSF entrance grade level].
And in USFAR Section 2.4.4 on the Oconee Site hydrology:
Duke has designed the Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike, and the Intake Canal Submerged Weir based on sound Civil Engineering methods and criteria. These designs have been reviewed by a board of consultants and reviewed and approved by the Federal Power Commission in accordance with the license issued by that agency. The Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike, and the Intake Canal Submerged Weir have also been designed to have an adequate factor of safety under the same conditions of seismic loading as used for design of Oconee. The construction, maintenance, and inspection of the dams are consistent with their functions as major hydro projects. The safety of such structures is the major objective of Duke's designers and builders, with or without the presence of the nuclear station.
The UFSAR sections are substantially unchanged from the previous version. The licensee does not directly address the failure of Jocassee Dam in the UFSAR nor does the UFSAR address the 1992 inundation study. Duke concludes that: 1) the Jocassee Dam can not fail due to overtopping as the Jocassee Reservoir will never fill to the top of the dam, and 2) the Jocassee and the Keowee Dams will not fail seismically due to their design. Though this is not new information, because of the current close scrutiny of the Jocassee Dam and SSF designs, and the other new information, the NRC is not currently able to agree with these conclusions without further information or analysis from the licensee. Absent updated information to the contrary, the NRC has concluded that such failures are credible events which are well-documented in industry failure data on dams. The frequency of rupture of similarly constructed dams from all causes, estimated to be approximately 10-4 events per year, places a Jocassee Dam failure in the frequency range of other limiting fault events considered in the Oconee accident analyses and licensing basis. For those other limiting fault events, there is mitigation capability which reduces the likelihood of core damage and radionuclide release. However, in the case of a SSF inundation flood, no mitigation of core damage is possible within the design basis.
In the Oconee licensing basis, the licensee specifically cites that protection be provided against natural phenomena and flooding events. The NRC clarified the regulatory position on external flooding in Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants." The regulatory position of dam failure states in part, "Where upstream dams or other features that provide flood protection are present, in addition to the analyses of the most severe floods that may be induced by either hydrometeorological or seismic mechanisms, reasonable combinations of less-severe flood conditions and seismic events should also be considered to the extent needed for a consistent level of conservatism. The effect of such combinations on Page 4
DRAFT the flood conditions at the plant site should be evaluated in cases where the probability of such combinations occurring at the same time and having significant consequences is at least comparable to the probability associated with the most severe hydrometeorological or seismically induced flood." This illustrates that Duke must address protection against events such as overtopping due to precipitation and seismically-induced failures. The current licensing basis of ONS clearly requires that the licensee must be able to protect against floods without regard to source, due to natural phenomena.
The 1992 inundation study has gone beyond concentrating on natural phenomena-caused failures of the Jocassee Dam to demonstrate that a PMF could also be the result of a random "sunny day" failure of the dam producing an Oconee site flood beyond the current flood mitigation capability of the SSF. As a logical conclusion, the NRC has ascertained that the ONS licensing basis should not be limited to floods caused by natural phenomena alone but, should include the impact of all credible sources of flood such as those arising from a random "sunny day" failure of the dam. As with the current licensing basis, the assessment of all potential sources of flood, including those arising from random, overtopping, and seismic failures, must include the most severe case with margin to properly account for uncertainties. The 1992 inundation study clearly concludes that a flood with a maximum height of 16.8 feet will exceed the 7.5-foot SSF grade level flood protection. A new draft inundation is as yet inconclusive on this issue. Therefore, the site currently has not demonstrated that adequate protection against flood is provided. To correct this, the NRC has statutory authority to impose additional condition(s) on the license in order to ensure that the licensee provides adequate protection against the effect of external floods, regardless of source. The basis for this authority has been established and communicated to the industry when evaluating licensing amendment requests as part of RIS-2001-02 which states:
When a license amendment request complies with the regulations and other license requirements, there is a presumption by the Commission of adequate protection of public health and safety (Maine Yankee, ALAB-161, 6 AEC 1003 (1973)). However, circumstances may arise in which new information reveals an unforeseen hazard or a substantially greater potential for a known hazard to occur, such as identification of a design vulnerability or an issue that substantially increases risk. In such situations, the NRC has the statutory authority to require licensee action above and beyond existing regulations to maintain the level of protection necessary to avoid undue risk to public health and safety. Section 182.a of the Atomic Energy Act of 1954, as amended, and as implemented by 10 CFR 2.102, gives the NRC the authority to require the submittal of information in connection with a license amendment request if NRC has reason to question adequate protection of public health and safety.
Page 5
DRAFT ASSESSMENT OF SAFETY SIGNIFICANCE An evaluation of the impact on public safety of invoking this proposed addition to the license was performed. Two cases were developed and compared to estimate the potential decrease in risk. The first case assumes the current licensing basis which does not take into account failure of Jocassee Dam. In this case, a rupture of the dam will directly result in loss of the SSF following with core damage and potential radionuclide release. The second case models a proposed SSF modification, hardening it against external floods by installation of watertight doors at the entrances and associated re-engineering of ventilation and exhaust lines above calculated flood height. Other solutions to increase adequate protection are possible, for example raising the Keowee Dam and intake canal dike heights. This example analyzes only one possible approach.
- 1. Current licensing basis not meeting adequate protection.
Under the current licensing basis, should an external flood exceeding the height of flood protection occur, it will fail the Oconee switchyard, the Keowee Dam, and the SSF with a conditional core damage probability (CCDP) of unity (1.0). Spent fuel pool cooling will also be lost. At the onset of core damage, containment integrity will be the only remaining initially intact defense-in-depth barrier. This barrier will be severely challenged under these conditions due a lack of power to cool containment. In addition, boil-off of the spent fuel pools is assumed to occur regardless of containment status resulting in an immediate radionuclide release as the spent fuel pools are outside containment. The attempt to recover reactor building and spent fuel pool heat removal after floodwater recession to mitigate a release will be at best difficult to accomplish due to accumulated debris and surrounding infrastructure damage. NRC has estimated that the failure frequency of Jocassee Dam based on industry data for rockfill dams is 2.0 x 104 per year. This is the dam initiating event frequency (IEF). The resultant core damage frequency for this case is the product of the dam rupture frequency and the conditional core damage probability, or CDF1
= IEF x CCDP1
= (2.0 x 104) x 1.0
= 2.0 x 104 per year for each unit
- 2. Proposed change to licensing basis to include mitigation of external flood.
The proposed change would provide additional mitigation capability by improving the flood protection of the SSF from a Jocassee Dam failure. This proposed passive modification for external flood protection involves installing watertight doors at the SSF entrances and performing associated engineering to relocate lines in order to clear the highest computed flood height. In this modification, the probability of watertight door failure is estimated to be 7.4 x 10-3 per demand 13. The licensee has computed that the random probability of failure of the SSF is 0.2714. Therefore, the resultant core damage frequency of this case is:
12 US NRC-RES/EPRI, "Fire PRA Methodology for Nuclear Power Facilities", NUREG/CR-6850, Rev. 0, 11/2005, Table 11-3.
" Duke Power Company, "IPEEE Submittal", December 21, 1995. The quantified unavailability is due mostly to human error probabilities arising from several manual operator actions that need to be completed in order for the SSF to be successful to Mode 3.
Page 6
DRAFT CDF 2 = IEF x CCDP2
= (2.0 x 104) x (7.4 x 10.' + 0.27)
= 5.4 x 10s per year for each unit The calculated decrease in core damage frequency is:
ACDF
= CDF1 - CDF 2
= (2.0 x 10'4) - (5.4 x 105 )
= 1.5 x 104 per year for each unit This calculation shows that a significant decrease in risk can be achieved with the proposed modification. The licensee believes that the dam failure frequency is somewhat lower than the value used in these calculations. A lower frequency will lower the risk reduction proportionately.
Regardless of the precise value of dam failure frequency and therefore, the risk reduction, Duke has not demonstrated the Oconee has appropriate conservatism in its design and operation and an adequate defense-in-depth approach to prevent accidents and mitigate their consequences.
In February 2009, the licensee developed and submitted a procedure15 to address failure of Jocassee Dam with consequential failure of the SSF. This procedure involves adapting an existing B.5.b mitigating strategy to provide decay heat removal through steam generators and spent fuel pool cooling during the period of inundation. The NRC staff has evaluated this procedure. It relies on many licensee operator actions to accomplish this goal. From a PRA perspective, any reduction in core damage frequency gained from this procedure is minimal.
Therefore, credit for using this procedure was not included in the above risk assessment.
CONCLUSION As described above, Duke has not demonstrated that the ONS is adequately protected against external floods from all sources including dam ruptures.
'5 Duke Energy ONS "Evaluations by Station Management in the TSC - Beyond Design Basis Mitigation Strategies for Jocassee Dam Failure," EM 5.3 Revision 0.
Page 7