ML14058A036
| ML14058A036 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 12/14/2009 |
| From: | Meena Khanna Plant Licensing Branch 1 |
| To: | Jeffrey Mitman NRC/NRR/DRA |
| Shared Package | |
| ML14055A421 | List:
|
| References | |
| FOIA/PA-2012-0325 | |
| Download: ML14058A036 (9) | |
Text
-,_ ':,
Mitman, Jeffrey From: Khanna, Meena I .
Sent: Monday, December 14, 2009 8:55 PM To: Mitman, Jeffrey Cc: Wilson, George
Subject:
Oconee Adequate Protection Backfit Documented Evaluation - Draft Attachments: Oconee Adequate Protection Backfit Documented Evaluation Draft 7.doc Jeff, could we pls discuss...
Your writeup was great... thanks. I just updated a few sections. However, I need to talk to you and George about the items in red font, basically how we want to address overtopping and seismicity... I included our basis for taking then off the table, but not sure how that impacts the risk agreement.
Thanks, Meena
DRAFT Oconee Nuclear Site Adequate Protection Backfit Documented Evaluation BACKGROUND AND OBJECTIVES OF THE MODIFICATION Duke Energy Carolinas, LLC, the licensee of the Oconee Nuclear Station (ONS) has not demonstrated that the site has adequate protection against external floods from all a sunny day random failure. These floods include failures of the Jocassee Dam which inundates the ONS.
The objective of this documented evaluation (as required by MD 8.41 and LIC-202 2) is to justify a backfit exception (under 10CFR50.109 (a) (4) (ii)) to modify the ONS licenses to ensure that the ONS has adequate protection against external floods and to maintain defense-in-depth.
Duke should enhance the ONS defense-in-depth such that all electrical power and means of cooling the core and maintaining containment integrity are not lost due to a failure of the Jocassee Dam.
REASON FOR THE LICENSE MODIFICATION This evaluation is a backfit exception which is defined in 10 CFR 50.109 (a) (4) (ii) as, "That regulatory action is necessary to ensure that the facility provides adequate protection to the health and safety of the public and is in accord with the common defense and security." To ensure adequate protection, Duke needs to demonstrate that the ONS has conservatism in its design and operation and a defense-in-depth approach to prevent accidents and mitigate their consequences.
In response to a 10 CFR 50.54(f) request for information dated August 15, 20083-4, the licensee reiterated that external floods which inundate the standby shutdown facility (SSF) will lead to early core damage and loss of spent fuel pool cooling at all three units. The remaining intact element of defense-in-depth of containment integrity will be severely challenged, if unmitigated, making the potential for radionuclide release highly probable. The licensee performed an inundation study 5 in 1992. to meet a Federal Energy Regulatory Commission (FERC) requirement for formulating an emergency action plan should the Jocassee Dam fail. This study indicated that the resultant flood height would exceed the then current flood protection barrier height leading to a potential core damage event. This result has led the NRC to question the defense-in-depth and adequate protection of the ONS against such floods.
As described in the 1992 inundation study, an external flood at the Oconee site is expected to render both the switchyard and Keowee Dam unavailable which are the sources of offsite and emergency onsite ac power, respectively. Emergency feedwater pump turbines for all three units will also be unavailable due to inundation. The SSF was designed as an alternative means to achieve and maintain Mode 3 following postulated fire, sabotage or internal flooding 1NRC Directive 8.4, "Management of Facility-specific Backfitting and Information Collection," October 28, 2004.
2 NRC LIC-202 Revision 1, "Managing Plant-Specific Backfits and 50.54(f) Information Requests," December 20, 2006.
3 Letter to D. Baxter of Duke Energy Carolinas, LLC, dated August 15, 2008, Information Request Pursuant to 10 CFR 50.54(f) Related to External Flooding, Including Failure of the Jocassee Dam at ONS, (ML0816402440).
4 Letter from D. Baxter of Duke Energy Carolinas, LLC, to US NRC, dated September 26, 2008.
5 "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.
DRAFT events and is also credited during station blackout events. It achieves these requirements by being a source of reactor coolant makeup, decay heat removal, and associated power to shut all three Oconee units down.
Though not credited in the FSAR to protect against external floods, the entrances to the SSF were protected by a 5-foot wall, raised to 7.5 feet in February 2009. This wall is the only means to protect the SSF from onsite flooding. One such source of ONS inundation is from failure of the Jocassee Dam. The Jocassee Dam is a pumped storage hydro-electric facility located approximately 11 miles upstream of the site. Mechanisms that can cause failures of the Jocassee Dam include overtopping, seismic, probable maximum flood (PMF) events, and "sunny day" failures. The 1992 inundation study took into consideration rupture of the dam due to random sunny day failure and PMF only. Previous to this analysis, Duke had excluded, as described in the ONS FSAR, both overtopping and seismic events. The 1992 inundation study reiterated that the Jocassee Dam would not overtop. The predicted resultant water levels from the inundation study, ranging from 12.5 feet to 16.8 feet at SSF grade, were found to be in excess of the existing flood mitigation barrier wall height for the SSF. Floodwater entering the SSF will overwhelm existing sump pumps, and due to the low critical flood heights, render the mitigation equipment in the facility non-functional. The failure of the SSF, based on current analyses and without further mitigation, will lead to failure of the only means to shut down and maintain all three Oconee units in a Mode 3 condition. The NRC became aware of the study shortly after it was completed in 1992 but took no action at that time.
Information was obtained following an April 2006 Reactor Oversight Process (ROP) evaluation, when the evaluation questioned the licensee's maintenance of the SSF flood protection barrier.
During the subsequent ROP Significance Determination Process (SDP), the NRC identified that the licensee had incorrectly calculated the Jocassee Dam failure frequency. Also, at this time the NRC recognized that the licensee had not adequately addressed the potential consequences of flood heights predicted at the Oconee site based on the 1992 inundation study. Additional new information was received when the licensee submitted a revised Jocassee Dam seismic fragility study6 in 2007. This new analysis raises questions about potential liquefaction at the Jocassee Dam during a seismic event. A final source of new information also occurred during the subsequent follow-up to the SDP, when the NRC recognized that, inconsistent with best practices, the 1992 inundation study did not take into consideration an antecedent storm as part of PMF evaluation as is directed by National Oceanic and Atmospheric Administration (NOAA) Hydrometeorological Report Numbers 517 and 528 as is discussed in Regulatory Guides 1.599 and 1.10210. This antecedent storm scenario could lead to an overtopping of the Jocassee Dam in a manner that might lead to more severe inundation at the ONS.
6 Duke Energy Carolinas, LLC Contract NE 23546 - "Letter Report and Transmittal of Supporting Data,"
January 29, 2007.
7 Hydrometeorological Report No. 51, "Probable Maximum Precipitation Estimates, US East of the 105th Meridian," U.S. Department of Commerce, NOAA, June 1978.
8 Hydrometeorological Report No. 52, "Application of Probable Maximum Precipitation Estimates - US East of the 105th Meridian," U.S. Department of Commerce, NOAA, August 1982.
9 Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev. 2) August 1977.
10 Regulatory Guide 1.102, "Flood Protection for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev. 1) September 1976.
Page 2
DRAFT Subsequently, the staff independently concluded that overtopping of the Jocassee Dam is not an issue. The computer generated Jocassee inflow hydrograph was used by the staff to evaluate various assumptions of turbine flow using the FERC approved antecedent moisture condition. Increasing the ordinates by 10%, approximates a more conservative antecedent moisture condition (Curve Number 74) as recommended by staff. The staff performed a calculation and determined that Jocassee Dam does not overtop even with the increased runoff from a curve number of 74 although freeboard is decreased (the computed water level was over a foot below the crest of the dam using the US Army HEC-1 computer program but above the low chord of the spillway bridge). Because the computed water level is slightly above the low chord of the bridge over the spillway (1123.5 ft msl), the spillway rating curve was extended above 1123.5 ft assuming orifice flow through the bridge section.
The staff also independently concluded that seismicity is also not an issue for the Jocassee Dam. AEC had approved the seismic design of the Jocassee dam (based on its consultant's review of the ONS licensee's submittal.) FERC licensed the Jocassee dam had licensed the hydropower project after satisfying itself about the seismic safety. As stated earlier, the liquefaction potential for well compacted saturated sands within the dam is low. Rock-fill dams have high resistance to seismic loads. The NRC staff has verified that the original construction data including the compaction data were reviewed and approved at the time of construction.
The licensee's monitoring of monuments and piezometers in the Jocassee Dam core and abutments indicates no significant movement of the dam, either in the vertical or in the horizontal direction even though the dam has experienced several seismic events during its life time.. Rock-fill dams have high resistance to seismic loads. The current healthy condition of the dam has been confirmed by FERC's 2004 Failure Mode Analysis (PFMA) Report and its subsequent annual inspection reports. The seismic hazard for western South Carolina, where Jocassee Dam is located, has been reduced from 0.197 g to <0.1 g.
As a result, the NRC expressed via the aforementioned 10 CFR50.54 (f) letter, a concern that Duke has not demonstrated "...overall adequacy of the flood protection of Oconee given the Jocassee Hydro Project... Specifically, the NRC is seeking information ... whether Oconee lacks appropriate and adequate compensating engineering safeguards for such an event."
Subsequent to Duke's response to the 10CFR50.54 (f letter, the NRC in its April 20, 2009, letter11 stated, in part, "the NRC staff remains concerned that Duke has not demonstrated that Oconee will be adequately protected in the long term from external flooding events."
By letter dated November 30, 2009, Duke submitted its response to the staff's 10 CFR 50.54(f) letter, which included its Case 2 parameters and sensitivity analysis. Duke's Case 2 inundation analysis results envelope the breach size that the NRC staff calculated using the Froelich equation. The results of Case 2 identified a flood height of 18 ft at the SSF, which is greater than the flood level identified from the 1992 inundation study (ranging from 12.5 feet to 16.8 feet at SSF grade). It should be noted, however, that the staff is currently assessing the Case 2 analysis for the Jocassee earthwork structures. Duke also provided its repair plans and schedules in its corrective action plan. Duke indicated that it plans to submit interim corrective measures by March 31, 2010, and will finalize its constructability and feasibility assessment by October 2010 and submit its modification design and implementation schedule by November 2010. The staff remains concerned regarding the timeliness of the interim corrective measures as well as the final repairs based on the fact that the Case 2 inundation analysis has identified a flood height of 18 ft at the SSF.
'1Letter to D. Baxter, Evaluation of Duke Energy Carolinas, LLC, September 26, 2008, Response to NRC letter Dated August 15, 2008.Related to External Flooding at ONS (ML0905707791).
Page 3
DRAFT BASIS FOR INVOKING BACKFIT EXCEPTION The NRC believes this situation qualifies for an adequate protection exception to the backfit rule under 10 CFR50.109 (a) (4) (ii). As discussed previously, ifthe Jocassee Dam fails and the SSF is inundated, the Oconee site has no defense-in-depth to prevent core damage and the containments are expected to subsequently fail. Following a Jocassee Dam failure which inundates the SSF, without defense-in-depth Duke has not shown that the public is adequately protected.
The following discusses the relevant flooding requirements, Duke's position on those requirements and the NRC's perspective on whether ONS meets those requirements.
- 1. To account for external flood protection, Oconee is licensed to a draft General Design Criterion (GDC) 2 which states:
Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) appropriate consideration for the most severe of these natural phenomena that have been recorded for the site and the surrounding areas and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.
- 2. To establish the licensing basis for the ONS compliance on external flood, the Oconee UFSAR12 further states in Section 9.6.3.1 on the SSF:
Flood studies show that Lake Keowee and Jocassee are designed with adequate margins to contain and control floods. The first is a general flooding of the rivers and reservoirs in the area due to a rainfall in excess of the Probable Maximum Precipitation (PMP). The FSAR addresses Oconee's location as on a ridgeline 100' above maximum known floods. Therefore, external flooding due to rainfall affecting rivers and reservoirs is not a problem. The SSF is within the site boundary and, therefore, is not subject to flooding from lake waters. The grade level entrance of the SSF is 797.0 feet above mean sea level (msl). In the event of flooding due to a break in the non-seismic condenser circulating water (CCW) system piping located in the Turbine Building, the maximum expected water level within the site boundary is 796.5 ft. Since the maximum expected water level is below the elevation of the grade level entrance to the SSF, the structure will not be flooded by such an incident. The SSF will stabilize the plant at mode 3 with an average Reactor Coolant temperature of 525°F. As a PRA enhancement the SSF is provided with a five foot external flood wall which is equipped with a water tight door near the south entrance of the SSF. A stairway over the wall provides access to the north entrance. The yard elevation at both the north and the south entrance to the SSF is 796.0 feet above mean sea level (msl). Based on the as-built configuration of the 5' flood wall provided at the north entrance and a flood wall at the south entrance to the SSF, SSF external flood protection is provided for flooding that 12 Duke Energy Company Updated Final Safety Analysis Report, Revision 17, December 3 I, 2007.
Page 4
DRAFT does not exceed 801 feet above mean sea level. [801 feet above mean sea level corresponds to 5 feet above SSF entrance grade level].
And in USFAR Section 2.4.4 on the Oconee Site hydrology:
Duke has designed the Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike, and the Intake Canal Submerged Weir based on sound Civil Engineering methods and criteria. These designs have been reviewed by a board of consultants and reviewed and approved by the Federal Power Commission in accordance with the license issued by that agency. The Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike, and the Intake Canal Submerged Weir have also been designed to have an adequate factor of safety under the same conditions of seismic loading as used for design of Oconee. The construction, maintenance, and inspection of the dams are consistent with their functions as major hydro projects. The safety of such structures is the major objective of Duke's designers and builders, with or without the presence of the nuclear station.
The UFSAR sections are substantially unchanged from the previous version. The licensee does not directly address the failure of Jocassee Dam in the UFSAR nor does the UFSAR address the 1992 inundation study. Duke concludes that: 1) the Jocassee Dam cannot fail due to overtopping as the Jocassee Reservoir will never fill to the top of the dam, and 2) the Jocassee and the Keowee Dams will not fail seismically due to their design. As discussed above, the staff has verified that these conclusions are non-credible events for the Jocassee Dam.
[I need help here... can we just discuss random sunny day failure and not discuss overtopping and seismic?}
However, such failures could be credible events for dams, which are well-documented in industry failure data on dams. The frequency of rupture of similarly constructed dams from all causes, estimated to be approximately 104 events per year, places a Jocassee Dam failure in the frequency range of other limiting fault events considered in the Oconee accident analyses and licensing basis. For those other limiting fault events, there is mitigation capability which reduces the likelihood of core damage and radionuclide release. However, in the case of a SSF inundation flood, no mitigation of core damage is possible within the design basis.
In the Oconee licensing basis, the licensee specifically cites that protection be provided against natural phenomena and flooding events. The NRC clarified the regulatory position on external flooding in Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants." The regulatory position of dam failure states in part, "Where upstream dams or other features that provide flood protection are present, in addition to the analyses of the most severe floods that may be induced by either hydrometeorological or seismic mechanisms, reasonable combinations of less-severe flood conditions and seismic events should also be considered to the extent needed for a consistent level of conservatism. The effect of such combinations on the flood conditions at the plant site should be evaluated in cases where the probability of such combinations occurring at the same time and having significant consequences is at least comparable to the probability associated with the most severe hydrometeorological or seismically induced flood." This illustrates that Duke must address protection against events such as overtoppingdue to precipitation and seismically-induced failures. The current licensing basis of ONS clearly requires that the licensee must be able to protect against floods without regard to source, due to natural phenomena.
Page 5
DRAFT The 1992 inundation study has gone beyond concentrating on natural phenomena-caused failures of the Jocassee Dam to demonstrate that a PMF could also be the result of a random "sunny day" failure of the dam producing an Oconee site flood beyond the current flood mitigation capability of the SSF. As a logical conclusion, the NRC has ascertained that the ONS licensing basis should not be limited to floods caused by natural phenomena alone but, should include the impact of all credible sources of flood such as those arising from a random "sunny day" failure of the dam. As with the current licensing basis, the assessment of all potential sources of flood, including those arising from random, overtopping, and seismic failures, must include the most severe case with margin to properly account for uncertainties. The 1992 inundation study clearly concludes that a flood with a maximum height of 16.8 feet will exceed the 7.5-foot SSF grade level flood protection. More recently, Duke's Case 2 inundation analysis results identified a flood height of 18 ft at the SSF. Therefore, the site currently has not demonstrated that adequate protection against flood is provided. To correct this, the NRC has statutory authority to impose additional condition(s) on the license in order to ensure that the licensee provides adequate protection against the effect of external floods, regardless of source.
The basis for this authority has been established and communicated to the industry when evaluating licensing amendment requests as part of RIS-2001-02 which states:
When a license amendment request complies with the regulations and other license requirements, there is a presumption by the Commission of adequate protection of public health and safety (Maine Yankee, ALAB-161, 6 AEC 1003 (1973)). However, circumstances may arise in which new information reveals an unforeseen hazard or a substantially greater potential for a known hazard to occur, such as identification of a design vulnerability or an issue that substantially increases risk. In such situations, the NRC has the statutory authority to require licensee action above and beyond existing regulations to maintain the level of protection necessary to avoid undue risk to public health and safety. Section 182.a of the Atomic Energy Act of 1954, as amended, and as implemented by 10 CFR 2.102, gives the NRC the authority to require the submittal of information in connection with a license amendment request if NRC has reason to question adequate protection of public health and safety.
ASSESSMENT OF SAFETY SIGNIFICANCE An evaluation of the impact on public safety of invoking this proposed addition to the license was performed. Two cases were developed and compared to estimate the potential decrease in risk. The first case assumes the current licensing basis which does not take into account failure of Jocassee Dam. In this case, a rupture of the dam will directly result in loss of the SSF following with core damage and potential radionuclide release. The second case models a proposed SSF modification, hardening it against external floods by installation of watertight doors at the entrances and associated re-engineering of ventilation and exhaust lines above calculated flood height. Other solutions to increase adequate protection are possible, for example raising the Keowee Dam and intake canal dike heights. This example analyzes only one possible approach.
Page 6
DRAFT
- 1. Current licensing basis not meeting adequate protection.
Under the current licensing basis, should an external flood exceeding the height of flood protection occur, it will fail the Oconee switchyard, the Keowee Dam, and the SSF with a conditional core damage probability (CCDP) of unity (1.0). Spent fuel pool cooling will also be lost. At the onset of core damage, containment integrity will be the only remaining initially intact defense-in-depth barrier. This barrier will be severely challenged under these conditions due a lack of power to cool containment. In addition, boil-off of the spent fuel pools is assumed to occur regardless of containment status resulting in an immediate radionuclide release as the spent fuel pools are outside containment. The attempt to recover reactor building and spent fuel pool heat removal after floodwater recession to mitigate a release will be at best difficult to accomplish due to accumulated debris and surrounding infrastructure damage. NRC has estimated that the failure frequency of Jocassee Dam based on industry data for rockfill dams is 2.0 x 104 per year. This is the dam initiating event frequency (IEF). The resultant core damage frequency for this case is the product of the dam rupture frequency and the conditional core damage probability, or CDF 1 = IEF x CCDP1
= (2.0 x 104) x 1.0
= 2.0 x 10-4 per year for each unit
- 2. Proposed change to licensing basis to include mitigation of external flood.
The proposed change would provide additional mitigation capability by improving the flood protection of the SSF from a Jocassee Dam failure. This proposed passive modification for external flood protection involves installing watertight doors at the SSF entrances and performing associated engineering to relocate lines in order to clear the highest computed flood height. In this modification, the probability of watertight door failure is estimated to be 7.4 x 10.3 per demand 13. The licensee has computed that the random probability of failure of the SSF is 0.2714. Therefore, the resultant core damage frequency of this case is:
CDF 2 = IEFxCCDP 2
= (2.0 x 104) x (7.4 x 10'3 + 0.27)
= 5.4 x 10-5 per year for each unit The calculated decrease in core damage frequency is:
ACDF = CDF 1 -CDF 2
= (2.0 x 104) - (5.4 x 105)
= 1.5 x 104 per year for each unit This calculation shows that a significant decrease in risk can be achieved with the proposed modification. The licensee believes that the dam failure frequency is somewhat lower than the value used in these calculations. A lower frequency will lower the risk reduction proportionately.
2 US NRC-RESIEPRI, "Fire PRA Methodology for Nuclear Power Facilities", NUREG/CR-6850, Rev. 0, 11/2005, Table 11-3.
" Duke Power Company, 'IPEEE Submittal", December 21, 1995. The quantified unavailability is due mostly to human error probabilities arising from several manual operator actions that need to be completed in order for the SSF to be successful to Mode 3.
Page 7
VB U iVB* *V*
=41,ra"'r.-VI gOMIT',]
gV'*
DRAFT Regardless of the precise value of dam failure frequency and therefore, the risk reduction, Duke has not demonstrated the Oconee has appropriate conservatism in its design and operation and an adequate defense-in-depth approach to prevent accidents and mitigate their consequences.
In February 2009, the licensee developed and submitted a procedure1 5 to address failure of Jocassee Dam with consequential failure of the SSF. This procedure involves adapting an existing B.5.b mitigating strategy to provide decay heat removal through steam generators and spent fuel pool cooling during the period of inundation. The NRC staff has evaluated this procedure. It relies on many licensee operator actions to accomplish this goal. From a PRA perspective, any reduction in core damage frequency gained from this procedure is minimal.
Therefore, credit for using this procedure was not included in the above risk assessment.
CONCLUSION As described above, Duke has not demonstrated that the ONS is adequately protected against external floods from all sources including dam ruptures.
15Duke Energy ONS "Evaluations by Station Management in the TSC - Beyond Design Basis Mitigation Strategies for Jocassee Dam Failure," EM 5.3 Revision 0.
Page 8