ML15023A076
| ML15023A076 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 01/22/2015 |
| From: | Dapas M NRC Region 4 |
| To: | Jeremy G. Browning Entergy Operations |
| Lantz R | |
| References | |
| IR 2014010 EA-14-088 | |
| Download: ML15023A076 (22) | |
See also: IR 05000313/2014010
Text
UNITED STATES
NUCLEAR REGULATORY COMMISSION
REGION IV
1600 E LAMAR BLVD
ARLINGTON, TX 76011-4511
January 22, 2015
Jeremy Browning, Site Vice President
Entergy Operations, Inc.
Arkansas Nuclear One
1448 SR 333
Russellville, AR 72802-0967
SUBJECT: ARKANSAS NUCLEAR ONE, UNITS 1 AND 2 - FINAL SIGNIFICANCE
DETERMINATION OF YELLOW FINDING AND NOTICE OF VIOLATION;
NRC INSPECTION REPORT 05000313/2014010 AND 05000368/2014010
Dear Mr. Browning:
This letter provides you the final significance determination of the preliminary Yellow finding
identified in NRC Inspection Report 05000313/2014009; 05000368/2014009 (ML14253A122),
dated September 9, 2014. A detailed description of the finding is contained in Section 1R01 of
that report. The finding was associated with the failure to design, construct, and maintain the
Unit 1 and Unit 2 auxiliary building and emergency diesel fuel storage building flood barriers so
that they could protect safety-related equipment from flooding.
At your request, a Regulatory Conference was held on October 28, 2014, to further discuss your
views on these findings. A copy of your presentation provided at this meeting is attached to the
summary of the Regulatory Conference (ML14329B209), dated November 25, 2014. In your
presentation on the risk significance of the finding, you discussed methodologies used by
Entergy to develop a probable maximum precipitation and probable maximum flood for the
Arkansas Nuclear One site, including development of an annual exceedance probability for the
probable maximum flood. You also described mitigation strategies/recovery actions that could
have been implemented prior to and in the event of flooding at the site to limit the consequences
of the flooding performance deficiencies. Specifically, you presented mitigating strategies to
protect site structures and equipment from flood waters, such as installation of an aqua-berm
and sandbagging. You also discussed two methods for maintaining reactor core heat removal
by providing feedwater to the steam generators from either the service water system or from a
portable diesel-driven pump.
Based on your staff's evaluation of the probability of success of implementing those mitigating
strategies/recovery actions, as well as your staffs estimated initiating event frequencies for
external flooding events that would result in flood water elevations above a site grade level of
354 feet Mean Sea Level (MSL) and 356 feet MSL, your staff concluded that the change in core
damage frequency from external flooding would be 7.99 x 10-7/yr for Unit 1 and Unit 2. Your
staff also determined that there would be additional risk for Unit 2 from an internal flooding
event, and minimal additional risk for Unit 1 from internal flooding. With the implementation of
J. Browning -2-
similar mitigating strategies/recovery actions, your staff determined that the change in core
damage frequency from external and internal flooding events would be 1.36 x 10-6/yr for Unit 2.
As a result, you concluded that the inspection finding should be characterized as Green, or very
low safety significance, for Unit 1, and White, or low-to-moderate safety significance, for Unit 2.
After thoroughly considering the information developed during our inspections and the
information you provided at the Regulatory Conference, we have concluded that the significance
of this finding is most appropriately determined using Inspection Manual Chapter 0609,
Appendix M, Significance Determination Process Using Qualitative Criteria. We concluded
that the safety significance for the finding involving flooding deficiencies for Unit 1 and Unit 2 is
Yellow, a finding having substantial safety significance. This determination was based on
qualitative factors due to the high degree of uncertainty that is associated with the estimation of
the frequency of an external flooding event. In addition, following the Regulatory Conference,
NRC inspectors identified that the mitigation strategies/recovery actions were more complicated
or would not work as you presented. We have concluded that some recovery credit is
warranted; however, the amount of recovery credit is less than you proposed during the
Regulatory Conference. Details regarding our evaluation of the risk significance of the finding
are provided in Enclosure 2 of this letter.
You have 30 calendar days from the date of this letter to appeal the staffs determination of
significance for the identified Yellow findings. Such appeals will be considered to have merit
only if they meet the criteria provided in Inspection Manual Chapter 0609, Significance
Determination Process, Attachment 2. An appeal must be sent in writing to the Regional
Administrator, Region IV, 1600 E. Lamar Blvd., Arlington, TX 76011-4511.
The NRC has also determined that the failure to design, construct, and maintain the Unit 1 and
Unit 2 auxiliary building and emergency diesel fuel storage building flood barriers so that they
would protect safety-related equipment from flooding, is a violation of Title 10 of the Code of
Federal Regulations (CFR) Part 50, Appendix B, Criterion III, Design Control, and Criterion V,
Instructions, Procedures, and Drawings, as cited in the attached Notice of Violation (Notice).
The circumstances surrounding the violations were described in detail in NRC Inspection Report 05000313/2014009; 05000368/2014009. In accordance with the NRCs Enforcement Policy,
NRC issuance of this Notice is considered escalated enforcement action because it is
associated with a Yellow finding.
You are required to respond to this letter and should follow the instructions specified in the
enclosed Notice when preparing your response. If you have additional information that you
believe the NRC should consider, you may provide it in your response to the Notice. The NRCs
review of your response to the Notice will also determine whether further enforcement action is
necessary to ensure compliance with regulatory requirements.
Because plant performance at the Arkansas Nuclear One facility has been determined to be
beyond the "Licensee Response Column" of the NRCs Reactor Oversight Process Action
Matrix, as a result of Yellow significance findings for Units 1 and 2, the NRC will use the Action
Matrix to determine the most appropriate NRC response to the findings' significance. We will
notify you, by separate correspondence, of that determination.
J. Browning -3-
In accordance with 10 CFR 2.390 of the NRC's "Rules of Practice and Procedure," a copy of
this letter, its enclosures, and your response will be made available electronically for public
inspection in the NRCs Public Document Room or from the NRCs Agencywide Documents
Access and Management System (ADAMS), accessible from the NRC website at
http://www.nrc.gov/reading-rm/adams.html. To the extent possible, your response should not
include any personal privacy, proprietary, or safeguards information so that it can be made
available to the Public without redaction.
Sincerely,
/RA/
Marc L. Dapas
Regional Administrator
Dockets: 50-313; 50-368
Enclosures:
1. Notice of Violation
2. Final Significance Determination
Letter to Jeremy Browning from Marc L. Dapas dated January 22, 2015
SUBJECT: ARKANSAS NUCLEAR ONE, UNITS 1 AND 2 - FINAL SIGNIFICANCE
DETERMINATION OF YELLOW FINDING AND NOTICE OF VIOLATION; NRC
INSPECTION REPORT 05000313/2014010 AND 05000368/2014010
Distribution
RidsOpaMail Resource; RidsOeMailCenter Resource; OEWEB Resource;
RidsSecyMailCenter Resource; RidsOcaMailCenter Resource; RidsOgcMailCenter Resource;
RidsEdoMailCenter Resource; EDO_Managers; RidsOigMailCenter Resource;
RidsOiMailCenter Resource; RidsRgn1MailCenter Resource; RidsOcfoMailCenter Resource;
RidsRgn2MailCenter Resource; RidsRgn3MailCenter Resource; NRREnforcement.Resource;
RidsNrrDirsEnforcement Resource;
Marc.Dapas@nrc.gov; Karla.Fuller@nrc.gov; Roy.Zimmerman@nrc.gov;
Anton.Vegel@nrc.gov; Bill.Maier@nrc.gov; Nick.Hilton@nrc.gov;
Kriss.Kennedy@nrc.gov; Jeff.Clark@nrc.gov ; John.Wray@nrc.gov;
Troy.Pruett@nrc.gov; Geoffrey.Miller@nrc.gov; Vivian.Campbell@nrc.gov;;
Rachel.Browder@nrc.gov Gerald.Gulla@nrc.gov; Lauren.Casey@nrc.gov;
Christi.Maier@nrc.gov; Victor.Dricks@nrc.gov; Robert.Carpenter@nrc.gov;
Marisa.Herrera@nrc.gov; Lara.Uselding@nrc.gov; Robert.Fretz@nrc.gov;
R4Enforcement; Jeffrey.Clark@nrc.gov; Brian.Tindell@nrc.gov;
Jenny.Weil@nrc.gov; Matt.Young@nrc.gov; Fernando.Ferrante@nrc.gov;
Greg.Werner@nrc.gov; Cale.Young@nrc.gov; Gloria.Hatfield@nrc.gov;
Cayetano.Santos@nrc.gov; Jim.Melfi@nrc.gov;
Andrea.George@nrc.gov; Lorretta.Williams@nrc.gov;
Electronic Distribution via Listserv for Arkansas Nuclear One, Units 1 and 2
NOTICE OF VIOLATION
Entergy Operations, Inc. Dockets: 50-313, 50-368
Arkansas Nuclear One, Units 1 and 2 Licenses: DRP-51, NPF-6
During an NRC inspection conducted between February 10, 2014, and August 1, 2014, two
violations of NRC requirements were identified. In accordance with the NRC Enforcement
Policy, the violations are listed below:
A. 10 CFR Part 50, Appendix B, Criterion Ill, "Design Control," states, in part, that
measures shall be established to assure that applicable regulatory requirements and the
design basis, as defined in § 50.2 and as specified in the license application, for those
structures, systems, and components to which this appendix applies, are correctly
translated into specifications, drawings, procedures, and instructions. Design changes
shall be subject to design control measures commensurate with those applied to the
original design.
Unit 1, Safety Analysis Report (SAR), Amendment 26, Section 5.1.6, "Flooding," defined
the design basis and stated, in part, that seismic class 1 structures are designed for the
maximum probable flood level at elevation 361 feet above Mean Sea Level (MSL). The
Unit 1 SAR further stated that all seismic class 1 systems and equipment are either
located on floors above elevation 361 feet or protected. Sections 5.3.2 and 5.3.5.2 of
the SAR indicated that the auxiliary building and emergency diesel fuel storage vault,
both quality-related, are seismic class 1 structures.
Unit 2, Safety Analysis Report, Amendment 25, Section 3.4.4, "Flood Protection,"
defined the design basis and stated, in part, that seismic category 1 structures were
designed for the probable maximum flood. The Unit 2 SAR further stated that all
category 1 systems and equipment are either located on floors above elevation 369 feet,
or protected. Table 3.2-2, "Seismic Categories of Systems, Components, and
Structures," of the Unit 2 SAR indicated that the auxiliary building and emergency diesel
fuel storage vault, both quality-related, are seismic class 1 structures.
Unit 1, Safety Analysis Report, Amendment 26, Section 5.3.2, "Auxiliary Building,"
stated, in part, that the floor area at elevation 317 feet containing engineered safeguards
equipment, was partitioned into separate rooms to provide protection in the event of
flooding due to a pipe rupture.
Contrary to the above, as of March 31, 2013, the licensee failed to assure that applicable
regulatory requirements and the design basis were correctly translated into
specifications, drawings, procedures, and instructions and that design changes were
subject to design control measures commensurate with those applied to the original
design. Specifically, the licensee failed to assure that safety-related equipment below
the design flood level was protected in the following examples:
a. The licensee failed to include a procedural step to install a blind flange in a
ventilation duct that penetrated the Unit 1 auxiliary building below the design
flood level.
Enclosure 1
b. The licensee failed to design the floor drain system with isolation capability so
that the drain piping from the turbine building and radwaste storage building,
which are non-flood protected structures, would not allow water to drain into the
Unit 1 auxiliary building in the event of a flood.
c. The licensee failed to design the Unit 1 Hatch 522 and Unit 2 Door 253, which
allow access to the area between the auxiliary buildings and containment
buildings, to prevent water intrusion during a design basis flood event.
d. The licensee failed to seal open penetrations into the Unit 1 auxiliary building
below the design flood level that were created when the licensee abandoned
portions of the waste solidification system.
e. The licensee failed to assure that the Unit 1 decay heat vault drain valves were
specified as safety-related, as required to maintain the vaults watertight.
B. 10 CFR Part 50, Appendix B, Criterion V, "Instructions, Procedures, and Drawings,"
states, in part, that activities affecting quality shall be prescribed by documented
instructions, procedures, or drawings of a type appropriate to the circumstances and
shall be accomplished in accordance with these instructions, procedures, or drawings.
Unit 1 Quality Drawing A-304, Sheet 1, "Wall and Floor Penetrations Key Plan,"
Revision 1, and Unit 2, Quality Drawings A-2002, "Architectural Schematic, Fire and
Flood Protection Plans and Sections," Revision 10, prescribed walls, ceilings, and floors
as flood barriers that required seals.
Unit 1, Quality Drawing A-337, "Wall and Floor Penetrations Enclosure Details,"
Revision 9, and Unit 2 Quality Drawing Series E-2073, "Electrical Penetration Sealing
Details," Revision 3, prescribed conduit seal installation details that would act as a
barrier to flood water. Unit 2 Quality Drawing Series A-2600, "Fire Barrier Penetration
Seal Details," Revision 5, prescribed pipe penetration seal details that would act as a
barrier to flood water.
Contrary to the above, as of March 31, 2013, the licensee did not accomplish activities
affecting quality in accordance with documented instructions, procedures, or drawings.
Specifically, the licensee failed to assure that safety-related equipment below the design
flood level was protected in the following examples:
a. The licensee failed to install seals in conduits that penetrated flood barriers for
the Unit 1 and Unit 2 auxiliary and emergency diesel fuel storage buildings.
b. The licensee failed to install seals in piping that penetrated flood barriers for the
Unit 2 auxiliary building extension.
c. For the Unit 1 and Unit 2 auxiliary building hatches and building expansion joints
between the building and containment, the licensee failed to provide appropriate
seal inspection criteria, establish a replacement frequency for the seals, and
-2-
develop post-maintenance test procedures to verify the effectiveness of the seals
after they were reinstalled.
These violations are associated with a Yellow Significance Determination Process finding for
Units 1 and 2.
Pursuant to the provisions of 10 CFR 2.201, Entergy Operations, Inc., is hereby required to
submit a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN:
Document Control Desk, Washington, DC 20555-0001 with a copy to the Regional
Administrator, Region IV, and a copy to the NRC Resident Inspector at Arkansas Nuclear One,
within 30 days of the date of the letter transmitting this Notice of Violation (Notice). This reply
should be clearly marked as a "Reply to a Notice of Violation; EA-14-088" and should include for
each violation: (1) the reason for the violation, or, if contested, the basis for disputing the
violation or severity level; (2) the corrective steps that have been taken and the results
achieved; (3) the corrective steps that will be taken; and (4) the date when full compliance will
be restored.
Your response may reference or include previous docketed correspondence, if the
correspondence adequately addresses the required response. If an adequate reply is not
received within the time specified in this Notice, an order or a Demand for Information may be
issued as to why the license should not be modified, suspended, or revoked, or why such other
action as may be proper should not be taken. Where good cause is shown, consideration will
be given to extending the response time.
If you contest this enforcement action, you should also provide a copy of your response, with
the basis for your denial, to the Director, Office of Enforcement, United States Nuclear
Regulatory Commission, Washington, DC 20555-0001.
Because your response will be made available electronically for public inspection in the NRC
Public Document Room or from the NRCs document system (ADAMS), accessible from the
NRC Web site at http://www.nrc.gov/reading-rm/adams.html, to the extent possible, it should not
include any personal privacy, proprietary, or safeguards information so that it can be made
available to the public without redaction. If personal privacy or proprietary information is
necessary to provide an acceptable response, then please provide a bracketed copy of your
response that identifies the information that should be protected and a redacted copy of your
response that deletes such information.
If you request withholding of such material, you must specifically identify the portions of your
response that you seek to have withheld and provide in detail the bases for your claim of
withholding (e.g., explain why the disclosure of information will create an unwarranted invasion
of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request
for withholding confidential commercial or financial information). If safeguards information is
necessary to provide an acceptable response, please provide the level of protection described
in 10 CFR 73.21.
Dated this 22nd day of January 2015
-3-
ARKANSAS NUCLEAR ONE
Final Significance Determination
Unit 1 and Unit 2 Flooding Deficiencies
As described in NRC inspection report 05000313/2014009; 05000368/2014009 (ADAMS
ML14253A122), the NRC used Inspection Manual Chapter (IMC) 0609, Appendix M,
Significance Determination Process Using Qualitative Criteria, Table 4.1, Qualitative
Decision-Making Attributes for NRC Management Review, to determine the preliminary risk
significance for the finding associated with the flooding deficiencies at ANO, Units 1 and 2. The
NRC concluded that the preliminary risk significance for the subject flooding deficiencies should
be characterized as Yellow, meaning a finding of substantial risk. During the Regulatory
Conference held on October 28, 2014, the licensee provided additional information concerning
the frequency of significant flooding at ANO, and mitigating startegies/recovery actions that
could be taken prior to, and during, a site flooding event. The licensee concluded, based on its
extensive analysis, that the risk significance for Unit 1 should be characterized as Green (very
low safety significance), and for Unit 2, it should be characterized as White (low to moderate
safety significance).
The NRC thoroughly reviewed the information provided by the licensee during the Regulatory
Conference and completed additional inspections to validate proposed mitigation
strategies/recovery actions. The NRC concluded that a final significance determination of
substantial risk (Yellow) for the flooding deficiencies on Unit 1 and Unit 2 is appropriate. The
following sections of this enclosure discuss the NRCs evaluation of the information presented
by the licensee and provide the basis for the NRCs final risk determination.
A. ANALYSIS OF LICENSEE INFORMATION USING IM 0609, APPENDIX M CRITERIA
1. Bounding Risk Evaluation
The current licensing bases for ANO is a Probable Maximum Flood (PMF) event coincident
with a failure of the upstream Ozark Dam, requiring protection of the Seismic Category I
structures from a flood elevation of 361 feet above Mean Sea Level (MSL), which is 7 feet
above the site grade level of 354 feet MSL. Note that all elevations in this enclosure are
referenced to MSL. As part of its analysis in developing a response to the NRCs 10 CFR
50.54(f) letter pertaining to the Fukushima Lessons-Learned Near-Term Task Force (NTTF)
Recommendation 2.1 for flooding reevaluation, the licensee derived preliminary results for
site flood elevations for a PMF based on current approaches and state-of-the-art
methodologies. During the Regulatory Conference, the licensee provided a number of
different estimates to establish the likelihood of severe flooding at ANO. It is the NRCs
understanding that these preliminary results and supporting calculations will be submitted to
the NRC for full review as part of the licensees flooding reevaluation in connection with the
10 CFR 50.54(f) letter response. Consideration of the information presented by the licensee
relative to the NRCs final significance determination should not be interpreted as
acceptance or rejection of the flooding reevaluation associated with the licensees
10 CFR 50.54(f) response. But rather, this information has been evaluated in the context of
making a risk-informed enforcement decision on flood protection related performance
deficiencies at ANO. Subsequent evaluation of this information under the NRCs formal
Enclosure 2
review process for the licensee submitted flooding reevaluation may or may not result in
changes to the ANO flood elevation estimates.
The licensee presented information to highlight perceived conservatisms associated with the
current licensing basis. The licensee stated that the assumptions which provide a basis for
the current licensing basis flood elevation of 361 feet could not be exactly reproduced;
therefore, the impact on the Annual Exceedance Probability (AEP) with regard to those
original assumptions was not explicitly factored into the NRCs final risk significance
determination.
The licensees reevaluated flood modeling assumptions resulted in a PMF elevation of 353.8
feet. The NRCs final significance determination result of Yellow is not based on approval or
rejection of the licensees reevaluated PMF elevation of 353.8 feet, but rather on the overall
risk insights provided by the associated analyses. In making the final significance
determination, the NRC recognized that precise estimates for extreme flooding events are
not available, that there are limitations on the credibility of flood extrapolation approaches,
and that there are significant ranges of uncertainty associated with the results in both the
PMF elevations and AEP estimates.
The challenges in extrapolating flood frequencies were discussed in a workshop on state-of-
the-art probabilistic flood analyses (reference NUREG/CP-0302, Proceeding of the
Workshop on Probabilistic Flood Hazard Assessment (PFHA): Held at the U.S. Nuclear
Regulatory Commission Headquarters, Rockville, MD, January 29-31, 2013) for extreme
events such as the PMF and were mentioned in the NRCs preliminary significance
determination letter. The insights from this workshop reaffirmed the NRCs use of qualitative
criteria as prescribed by IMC 0609, Appendix M, to conduct significance determination
process (SDP) evaluations involving extreme flooding events.
At the Regulatory Conference and in documents provided to the NRC prior to the
Conference, the licensee presented multiple flood evaluation methods, including flow-based
and precipitation-based approaches, to estimate the ANO flood hazard. The licensee
indicated that the AEP associated with a relevant Probable Maximum Precipitation (PMP)
depth of 6.93 inches producing a flood elevation of 354 feet (i.e., all floods exceeding site
grade elevation) would have a 95 percent confidence level value of 1.44x10-5/year (or
69,444-year return period) with a best estimate median of 1.15x10-6/year (or 869,565-year
return period). In addition, the licensee stated that the PMP precipitation depth of 7.27
inches associated with flooding events exceeding a flood elevation of 356 feet at ANO
(i.e., exceeding site grade level by 2 feet) would have a 95 percent confidence level AEP of
1.05x10-5/year (or 95,238-year return period) with a best estimate median AEP of
7.94x10-7/year (or 1,259,445-year return period). The licensee indicated that the use of
multiple methods provided additional justification for extrapolation of flood frequencies for
use in the SDP. In addition, other assumptions and considerations from the hydrologic and
hydraulic modeling used by the licensee were characterized as providing additional
conservatism in the insights presented.
As noted above, the licensee used multiple evaluation methods in its analyses to determine
the AEP or flood frequency for PMP events that would cause flooding at or above site grade
level. Those analyses, as well as other methods that are equally applicable, led the NRC to
conclude that flood frequencies greater than 1x10-4/year may be conservative for the ANO
-2-
site based on available information. By the same token, the NRC concluded that flood
frequencies less than 1x10-5/year (100,000-year or greater return period) could not be
established with sufficient confidence in best estimate results for the purposes of this SDP
evaluation.
The NRC noted that the licensee made reference to aspects of each methodology
presented by the licensee having been used by other Federal agencies as well as in
published literature. As discussed in the workshop held at the NRC in January 2013, the
NRC has not approved methods for extrapolating the frequency of extreme events such as
the PMF. While some state-of-the-art approaches were discussed in this workshop and
have been used in certain applications (e.g., such as the stochastic-based modeling of
flooding phenomena for specific watersheds as opposed to more extrapolation-focused
techniques), the NRC also noted that: (1) the methods presented by the licensee for ANO
are extrapolation-based, and therefore still include significant uncertainty (whether
accounted for explicitly or implicitly), and (2) the estimates provided are beyond the typical
limits of extrapolation considered as credible in the current state-of-the-art methodologies.
For example, the licensees flow-based extrapolation uses an approach described in
Bulletin 17-B, Guidelines for Determining Flood Flow Frequency published by the
Department of Interior. The applicability of Bulletin 17-B was intended to be limited. This
bulletin was designed for applications such as levee and floodplain management, and was
not intended for extending estimates to 1-in-10,000 events. It is recognized that the
applicability of this method is limited to AEPs in the ranges closer to the available historical
record. As stated during the January 2013 workshop held at the NRC, the applicability of
such a method was not intended for AEPs in the range of 1x10-4/year (or 10,000-year return
period) or less likely events. Similarly, as discussed in the U.S. Department of Interior,
Bureau of Reclamation Report DSO-04-08, Hydrologic Hazard Curve Estimating
Procedures, there is a relationship between the quality and quantity of data available and
the limit on credible extrapolation flood estimates. This includes some of the methods used
in the licensees precipitation-based approaches (e.g., L-moments), as well as other
methods not included in the ANO estimates (e.g., paleoflood information). Even when
combined with optimal information, a limit of 1x10-4/year (or 10,000-year return period) for
credible information is acknowledged. As stated in Bulletin 17-B, with regard to regional
precipitation data, a similar limit [1x10-4/year] is imposed because of the difficulty in
collecting sufficient station-years of clearly independent precipitation records While this
bulletin focuses on areas in the Western U.S., the discussions in the workshop held at the
NRC in 2013 indicated the challenges described above exist when dealing with limited
information, as is the case at ANO. The analyses the licensee presented at the Regulatory
Conference attempted to use as much of the available information as possible (e.g., over
3,000 years of equivalent record was added via the L-moments approach), however, without
additional stochastic physical modeling or relevant at-site paleoflood data, extrapolation of
flood frequencies beyond the level of confidence currently assessed by the community of
expert practitioners (10,000 year return period) carries significant uncertainty.
While the consideration of multiple extrapolation approaches and the consistency in the
results of each of the precipitation-based analysis methodologies do provide additional
confidence that AEPs greater than 1x10-4/year (10,000 year or less return period) would be
overly conservative for consideration in the final significance determination of these findings,
the NRC concluded that AEPs of less than 1x10-5/year (100,000-year or greater return
-3-
period) could not be established with sufficient certainty for the purposes of this SDP
evaluation. The NRC recognizes that additional uncertainty not captured by the
extrapolated results could impact the bounding results in this assessment and that any
extrapolated estimate may involve uncertainty bounds of several orders of magnitude.
For example, the flow-based extrapolations developed by the NRC and licensee indicated
an upper bound closer to the 1x10-4/year threshold.
In summary, the analyses provided by the licensee indicates that, even with a preliminary
reevaluated flood hazard analysis (i.e., PMP of 6.93 inches and PMF of 353.8 feet), the
resulting 95 percent confidence level AEP does exceed the 1x10-5/year threshold, and that
sufficient justification for reliance on a more precise value is not currently available, as these
estimates include several orders of magnitude of uncertainty. The NRC concluded that the
information provided supports an SDP approach that considers qualitative attributes to
determine the significance of the finding in conjunction with the insights associated with the
uncertainty and confidence limits provided by the licensee in the flow-based and
precipitation-based analyses.
2. Defense in Depth
The licensees presentation categorized some of the recovery actions as defense-in-depth
elements. However, the licensee agreed that normal plant equipment and system
alignments for reactor coolant system inventory control, reactor core heat removal, and
containment pressure control functions would not be available to mitigate flooding events.
The licensee did present proposed mitigating actions to recover safety functions for flood
levels above plant grade level. Those recovery actions are discussed in Section B below.
3. Reduction in Safety Margin
As stated in the NRCs preliminary significance determination letter, the current design basis
flood elevation is 361 feet. Flood water above plant grade level of 354 feet could result in
the loss of all reactor makeup and cooling pumps, potentially leading to core damage without
mitigating actions. The licensee stated that safety would be challenged with flood waters
above plant grade level and that the revised PMF elevation of 353.8 feet was below the
plant grade level. The licensee presented proposed actions to recover safety functions for
flood levels above the plant grade level.
4. Effect on Other Equipment
The licensee acknowledged that failure of the subject flood barriers could result in failure of
the emergency feedwater pumps, high pressure injection pumps, spent fuel pool cooling
pumps, emergency diesel generators, decay heat removal pumps, and reactor building
spray.
5. Degree of Degradation
The licensee acknowledged that equipment damaged due to submergence in water could
not be recovered.
-4-
6. Exposure Time; Previous Identification Opportunities
The licensee acknowledged that the performance deficiency has existed since construction.
The only exceptions were a plant modification in 2002 that resulted in unsealed abandoned
equipment and inadequate preventive maintenance activities that caused degradation of
flooding seals over time. All quantitative assessment considerations were performed using
the one-year assessment period limit in the SDP. The licensee acknowledged that previous
identification opportunities for the degraded flood barriers had existed.
7. Recovery Actions
The NRCs preliminary significance determination did not credit alternative mitigating
strategies. During the Regulatory Conference, the licensee provided information related to
mitigation strategies to protect the turbine building from flooding by using a temporary flood
barrier, and recovery actions to maintain or recover reactor core heat removal functions for
both units by establishing water injection to the steam generators from either the service
water system or portable pumps. The licensee did not provide long-term recovery actions
for restoration of the reactor coolant inventory control function, nor the containment pressure
control function. The NRCs evaluation of the licensees proposed mitigation
strategies/recovery actions is provided below.
8. Additional Circumstances
The licensee stated that its revised PMF is below plant grade level and that conservatisms
exist in the PMP/PMF estimates to reduce the 95 percent confidence level risk by an order
of magnitude. The NRC reviewed the licensees calculations and presentation related to the
PMP/PMF as described in Section A.1, Bounding Risk Evaluation, above. The NRC also
observed that the licensees risk estimates were based on extrapolations with limited
consideration of modeling uncertainty. For estimates of extreme events, information
available from the community of experts indicates that considerable modeling uncertainty
would be involved. The NRC noted that inclusion of such uncertainty (consideration of
which was limited in the licensees upper bound estimates) would increase the 95 percent
confidence level value.
B. EVALUATION OF THE LICENSEES PROPOSED MITIGATION AND RECOVERY
ACTIONS
During the Regulatory Conference, the licensee presented five mitigation strategies in the
event of a postulated flood above plant grade level. The licensee proposed recovery credit
based, in part, on human error probabilities derived from the SHARP1 human reliability
analysis (HRA) methodology. The NRC noted that the licensees model reflected human
error probabilities assuming typical plant conditions, which are different than plant conditions
that may be encountered during a flooding event. The NRC noted that the SHARP1 method
did not account for an evaluation of operator diagnostic actions in the absence of procedural
guidance, when multiple, competing mitigation strategies/recovery actions are plausible.
Based on an evaluation of circumstances under which the operators may be prompted to
implement recovery actions, the NRC concluded that failure to diagnose the need to
implement recovery actions could be substantially high for a number of the recovery actions.
-5-
The NRC recognizes that human reliability analysis methods for evaluating actions under
extreme conditions are limited. The NRC used the SPAR-H HRA method (NUREG/CR-
6883) to estimate the human error probabilities associated with potential recovery actions.
The SPAR-H method provides an estimate that accounts for timeliness, ergonomics, quality
of procedures, and stress while diagnosing and performing tasks. The NRC also included
insights gained through direct inspection efforts following the Regulatory Conference.
The results of the licensees AEP analysis presented at the Regulatory Conference
suggested that approximately 70 percent of flooding events with water level above site
grade of 354 feet would also exceed 356 feet. Based on consideration of these estimates,
in addition to corresponding information from the 100,000-year return PMP hazard curve
developed by the NRCs analysts as part of the preliminary significance determination, the
NRC determined that almost half of above-site-grade level flooding events at ANO would
also exceed the 356-foot level. The licensee stated that the implementation of the
temporary dam mitigation strategy discussed below would not provide mitigation for a
flooding event above 356 feet, and that the implementation of the portable pump mitigating
strategy discussed below could be more difficult to accomplish for a flood above 356 feet.
1. Site Preparation for Flooding
During the Regulatory Conference, the licensee presented mitigating actions that could be
taken after notification of an impending flood, yet prior to the arrival of flood waters on site.
As stated in the NRCs preliminary significance determination letter, the Startup
Transformer 02 would be modified before flood waters arrived to permit continued operation
and availability of offsite power during the flooding event. In addition, procedural guidance
required plant operators to consider moving portable pumps to a staging area in the training
center parking lot prior to flood waters arriving onsite, to protect the pumps.
During the Regulatory Conference, the licensee stated that upon notification of an
impending flood, actions could be taken to protect the turbine building up to a flood elevation
of 356 feet. According to the licensee, those actions would be prompted by a corporate-
level severe weather procedure that directs corporate assets to be protected from flooding.
The licensee proposed a 30 percent failure probability that the site emergency response
organization would implement measures to protect the turbine building from postulated
floods up to a flood elevation of 356 feet. For flood levels above 356 feet, the licensee
agreed the failure probability would approach 100 percent for these site preparation actions.
The licensee presented pre-flood preparations that included a water-filled temporary dam,
sandbagging, concrete barriers, welding steel barriers over doors, and sealing underground
penetrations. The NRC determined that the licensee had not verified that the materials were
physically available and could be installed before flood waters exceeded the plant grade
level. In addition, the dam, sandbagging, and barriers are temporary equipment and
subject to potential failure mechanisms. For example, experience at other sites shows the
dam could be punctured during installation or use, or installed over permeable surfaces
(gravel) and rendered ineffective. The NRC also concluded that a corporate-level procedure
providing a checklist to indicate that temporary flood barriers should be considered does not
provide clear planning guidance as described in the preliminary risk determination. Given
the non-specific procedural guidance, likely operator mindset that the reactor plant was
protected from flooding, and the number of unknown flood deficiencies at ANO, the NRC
-6-
assigned a high (90 percent) failure probability for the installation of temporary flood
barriers. In the context of a sensitivity analysis, the NRC also determined what the SDP
result would be with an assumed lower failure probability of 50 percent. The results of this
sensitivity analysis are discussed in Section C. No mitigation credit was given for flood
levels above 356 feet.
2. Decay Heat Removal Recovery Using Feed to Steam Generators
The licensee presented information that would indicate that decay heat removal could be
maintained by initiating actions to feed the steam generators by either of two methods.
First, the service water system could be used to feed the steam generators through the
submerged and idled emergency feedwater system pumps, which required opening of
service water to emergency feedwater cross-connect valves. Second, an alternative
mitigation strategy, portable diesel-driven pump (portable pump) could be used to supply
water to the steam generators. Either of these strategies could be performed first,
depending on the diagnosis and choices made by the plant operators. The licensee
assumed a nominal combined failure probability of five percent for feeding the steam
generators using these strategies. After the Regulatory Conference, NRC inspectors
identified several problems with these strategies that were not identified by the licensee
which complicated the actions and resulted in the NRCs determination that the failure
probabilities assumed by the licensee for these strategies were unrealistic.
a. Unit 2 Service Water System Recovery
The success of this strategy would require operators to diagnose the need to open
service water cross-connect valves to the suction of the emergency feedwater pumps,
while the reactor continued to be cooled by the decay heat removal system. Following
diagnosis that decay heat removal may be challenged, operators must open the service
water supply to emergency feedwater pump suction valves before flooding in the
auxiliary building caused a loss of remote operation capability. The NRC determined
that adequate time existed for operators to diagnose and align the service water system.
Operators would not be able to verify decay heat vault flooding alarm accuracy nor
actual water level in the decay heat removal vaults because access to the vaults would
be blocked by flood waters. Additionally, there is a single annunciator for all three vaults
in Unit 2, and therefore, given flooding in the auxiliary building, operators would be
unable to confirm if one or multiple vaults were flooding. Though operators would likely
recognize that a flood alarm would be associated with water intrusion from the site
flooding event, the combination of the inability to validate the alarm, the lack of
indications for individual vaults, and the likely belief by operators that the vaults would
not flood since the vaults were thought to be watertight, supported the use of poor
ergonomics in the SPAR-H model for human reliability analysis.
While emergency operating procedures address using service water as an alternative
suction source for the emergency feedwater system, the entry conditions to use
emergency operating procedures would not have been met at the time this action would
have been required. In addition, pumping service water through an idle emergency
feedwater system had not been proceduralized, and therefore the associated actions
had not been demonstrated nor had operators been trained on these actions. The NRC
-7-
determined that opening of the service water to emergency feedwater cross-tie valves is
feasible; however, pre-existing procedures were not available to support diagnosis, the
viability of this contingency strategy had not been demonstrated nor had operators
trained on it, and the recovery had to be accomplished prior to flooding of the service
water valves. Consequently, the NRC determined there was a high (83.5 percent)
failure probability to reposition service water valves prior to their submergence.
Furthermore, the operators had to initiate feed to the steam generators with service
water via the emergency feedwater system with idle feedwater pumps. The licensees
evaluation indicated that a service water system pressure of 76 psig was available to
provide flow through the emergency feedwater system based on the results of a
surveillance test conducted while the system was aligned to the emergency cooling
pond. After the Regulatory Conference, NRC inspectors determined that the service
water system pressure could be 60 psig based on a review of plant data that
represented the conditions and system alignment that would exist for an external
flooding event. In addition, the NRC identified that Valve 2CV-1460, a backpressure
control valve, could fail open upon a loss of control power, which may reduce system
pressure by as much as five psig. Valve 2CV-1460 is at 335 feet in the auxiliary building
general area and would be submerged during a flooding event. With service water
pressure at approximately 55 psig, the system pressure would be lower than that
required to overcome the steam generator pressure and static head of the emergency
feedwater system. The NRC determined that the proposed mitigation strategy/recovery
action may not result in adequate flow to the steam generators without further operator
diagnosis and action.
Following the NRCs identification of the possible failure of this proposed mitigation
strategy, the licensee provided additional information suggesting that operators could
diagnose the system condition and raise service water pressure by starting a third
service water pump and isolating the non-safety related, auxiliary cooling water portion
of the service water system.
The NRC determined that this recovery action would require a moderately complex
diagnosis. Multiple variables would need to be evaluated including service water system
alignment, unique system configurations, and pump failures in order to diagnose the lack
of adequate flow to the steam generators. The ability to evaluate the service water
system configuration could be impacted by flood waters throughout the buildings. No
procedures existed to diagnose the need to realign valves to increase system pressure.
In addition, the diagnosis would also involve re-evaluation of operator actions that were
taken to align service water to emergency feedwater, since those actions did not result in
feed to the steam generators as expected.
Restoration of service water pressure to provide for service water flow to the steam
generators is feasible, however, the NRC noted that procedures governing this evolution
were not available to support diagnosis, the viability of the actions to restore service
water system pressure had not been demonstrated or trained on, and the mitigation
strategy/recovery actions had to be accomplished before the loss of natural recirculation
in the reactor coolant system. Consequently, the NRC determined that there was a 29
percent failure probability for restoring service water pressure such that service water
flow to the steam generators could be established. This failure probability also
-8-
accounted for the dependency of the recovery diagnosis and actions on the preceding
initial failure to establish sufficient service water pressure.
In summary, the NRC determined that the use of service water to feed the Unit 2 steam
generators to provide for decay heat removal, had a very high failure probability
(approaching 100 percent), due to the multiple diagnosis efforts and actions involved,
including the diagnosis and recovery from the initial failure to establish service water
flow; as well as the lack of, or limited, procedural guidance, and time constraints that
would exist. In the context of a sensitivity analysis, the NRC also determined what the
SDP result would be with an assumed lower failure probability of 50 percent. The results
of this sensitivity analysis are discussed in Section C.
b. Unit 1 Service Water System Recovery
The licensee presented information during the Regulatory Conference that the service
water system could be used to feed the Unit 1 steam generators through the submerged
and idled emergency feedwater system pumps, similar to the alignment described for
Unit 2 above.
The licensee stated that Unit 1 operators would have two hours to diagnose and take
action between the time of the first control room alarm notifying operators of water in the
decay heat removal vaults, and the time when the service water recovery action would
not be available due to submergence of the motor-operated service water to emergency
feedwater cross-connect valves. The licensee stated that a second vault alarm would
annunciate 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> before service water valve submergence, providing a second cue.
The licensee noted that operators would require approximately one hour to diagnose
and take the action to open the service water valves.
Following the Regulatory Conference, NRC inspectors determined that the licensee
used assumptions in its decay heat vault flooding analysis that were non-conservative.
Specifically, the licensee calculated flows into the vaults assuming empty electrical
conduits even though the conduits could be up to 20 percent full of wires. The licensee
assumed up to 10 outlets per conduit even though it could be as few as two. The
licensee assumed that the conduit high points were at the observed junction boxes even
though construction photographs indicated they could be as much as one foot higher
than the connection at the junction boxes. The NRC inspectors recalculated the time
available between receipt of the decay heat vault alarm and submergence of the service
water valves using more realistic assumptions, and determined that the operators would
have approximately one hour to diagnose and take action to implement this recovery
strategy between the first vault alarm and submergence of the valves. The inspectors
determined that the second vaults alarm would annunciate at approximately the same
time the service water valves would become submerged, so the operators would have to
diagnose the condition with only one vault in an alarm condition. The NRC determined
that not enough time existed to diagnose and initiate this service water recovery strategy
because with a single vault alarm, operators would have to anticipate both vaults
flooding and anticipate that pumping service water through an idled emergency
feedwater system would be necessary before decay heat removal failed.
-9-
Therefore, due to the time constraints and lack of cues to indicate the challenge to decay
heat removal, the NRC assigned a high failure probability (approaching 100 percent) for
the use of service water to feed the Unit 1 steam generators to provide for decay heat
removal. In the context of a sensitivity analysis, the NRC also determined what the SDP
result would be with an assumed lower failure probability of 50 percent. The results of
this sensitivity analysis are discussed in Section C.
c. Alternative Mitigation Pump Recovery Strategy
The licensee presented information that an alternative mitigation strategy, portable
diesel-driven pump (portable pump) could be used to supply water to the steam
generators in Unit 1 and Unit 2. Although operators are trained on using the pump in
restoring steam generator levels upon loss of a wide range of plant equipment, the
alternative mitigating strategies procedure was not intended for a flooding event.
The licensees external flooding procedure directed personnel to consider moving the
portable pump to higher ground (training center off-site parking lot) prior to flooding
onsite to protect the portable pump from flood water. Although contrary to the guidance
in this procedure, the NRC considered as a potential action that operators could
anticipate the potential for a loss of all core cooling due to flooding and decide to move
the pump onto the site, on an elevated platform, such that it was staged and ready if
needed as a potential decay heat removal recovery strategy, before significant flood
waters arrived onsite. The NRC concluded that it was much more likely the pump would
be moved off-site and protected from flooding, until some other plant indication of
potential loss of decay heat removal prompted a diagnosis that the portable pump
should be deployed, at which point the pump would need to be moved to the site through
existing flood waters.
The licensee presented a one-hour timeline for this recovery strategy based on a
walkthrough of required actions on dry ground. The NRC determined this did not
account for challenges that could be imposed from flooding onsite. The road between
the training center and the plant is one foot lower than plant grade level. The NRC noted
that electrical equipment on the pump skid could be submerged at flood levels of 355
feet or higher during transportation on the normal trailer. Therefore, the NRC
determined that the licensee could likely take several hours to load the pump onto
another trailer in order to avoid submerging the pump during transport. The NRC also
noted that when the road is covered by flood water, the edges of the road will be
obscured to the driver, and the driver may need to use spotters at a slow walking speed.
Once the portable pump was at the proper location, several actions would need to be
accomplished to align the portable pump to supply water to the steam generators.
These would potentially be performed in flood waters and include:
Connecting the suction of the pump to a fire hydrant while working in flood water
Standing in flood waters to cut piping (Unit 2)
Refueling the pump every 12 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in flowing flood waters, and
- 10 -
Potentially isolating transformer fire deluge valves that actuate due to
submergence, to maintain fire protection system pressure
While the licensee presented a one-hour time to transport and align the portable pump,
the NRC determined that the transport and system alignment time could be greater than
seven hours. Although operators are trained on using the pump in restoring steam
generator levels upon loss of a wide range of plant equipment, the implementation of
these actions is not contained in a procedure used for a flooding event.
Unit 2 Specific Information
In Unit 2, the recovery strategy presented by the licensee would involve pressurizing a
startup and blowdown demineralizer header and then using the pressurized header to
backfeed into the main feedwater header. Following the Regulatory Conference, NRC
inspectors identified that pressure control valves on this demineralizer header could fail
open during a flooding scenario due to loss of instrument air pressure. NRC inspectors
determined that portable pump flow would be diverted away from the steam generators
through the open pressure control valves unless the licensee had closed the valves
during demineralizer realignment for full flow secondary cleanup during plant cooldown
prior to the arrival of flood water onsite. The decision to perform the demineralizer
alignment depended upon available operations resources, the recommendations from
chemistry personnel, and the availability of a fresh demineralizer resin load. The NRC
assigned a failure probability of 50 percent for the demineralizer realignment. This
demineralizer realignment would need to be accomplished in addition to successful
portable pump transport and fire protection system alignment for the alternative
mitigation pump recovery strategy to be effective. In addition to the factors discussed
above, the Unit 2 procedures for implementing this mitigation strategy were incomplete
because isolation valves would need to be opened that were not listed, relief valves
requiring gags would be under water, and alternate methods to throttle flow were not
included.
The NRC determined that use of the alternative mitigation pump recovery strategy for
Unit 2 appeared to be feasible, if the shutdown activities resulted in the secondary
system being placed in the cleanup configuration. The recovery strategy could be
impacted by incomplete procedures and environmental conditions related to flood waters
onsite. The NRC assigned a high (85 percent) failure probability for use of the portable
pump on Unit 2. In the context of a sensitivity analysis, the NRC also determined what
the SDP result would be with an assumed lower failure probability of 37 percent. The
results of this sensitivity analysis are discussed in Section C.
Unit 1 Specific Information
With respect to Unit 1, similar challenges existed for the success of the alternative
mitigation pump recovery strategy as compared to Unit 2, with two significant
exceptions: (1) the flow diversion issues described above were not applicable to Unit 1;
and (2) Unit 1 procedures included the necessary valve alignments. The NRC assigned
a 37 percent failure probability for use of the portable pump with respect to Unit 1. In the
context of a sensitivity analysis, the NRC also determined what the SDP result would be
- 11 -
with an assumed lower failure probability of 25 percent. The results of this sensitivity
analysis are discussed in Section C.
3. Additional Qualitative Factors Influencing the Risk Assessment
As documented in the NRCs preliminary risk determination letter, the NRC concluded
that internal flooding events pose additional risk significance for the flooding-related
performance deficiencies. Failure of expansion boots in the Unit 1 and Unit 2 circulating
water system is the highest contributor to risk for internal flooding in both Units. The
licensee agreed that internal flooding was an important contributor to the overall risk of
flooding. The licensee stated that the initiating event frequency for internal flooding for
Unit 1 was minimal, and for Unit 2 was 9.03x10-5/year. With respect to internal flooding,
the NRC assigned the same recovery credit for mitigation strategies as described in
Section B.2 for external flooding, except that the Unit 2 portable pump recovery strategy
would not work because the secondary system would not be aligned in the cleanup
configuration. The Unit 2 high initiating event frequency for internal flooding coupled
with reduced recovery credit was a significant contributor to the final significance
determination for Unit 2, in that the risk contribution from internal flooding events alone
was Yellow for Unit 2. The NRC agreed that the failure frequency of the circulating
water system was lower for Unit 1 than for Unit 2; however, because the circulating
water expansion joints in Unit 1 had a metallic component and were not all hard piping
as assumed in the licensees failure probability model, the NRC determined that a more
appropriate model of the Unit 1 expansion joints would provide a higher failure frequency
for the circulating water system than provided by the licensee. As documented in the
NRCs preliminary significance determination letter, the contribution to risk for Unit 1
from internal flooding was qualitatively assessed as Greater-than-Green. This risk
contribution would be added to the significance determination results from external
flooding events to determine an overall flooding SDP result for Unit 1.
The licensee stated at the Regulatory Conference that it would have enough time to
perform an orderly shutdown and cooldown in the event of a flood. The licensee stated
that both units steam generators would be placed in wet layup, which would provide for
additional time to respond to, and recover from, a subsequent loss of decay heat
removal. However, according to the operations managers for both units, if the licensee
anticipates a short outage and chooses to maintain condenser vacuum, the steam
generators would not be placed in wet layup. Therefore, Unit 1 operators would have
approximately 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> from a loss of decay heat removal to a loss of natural circulation
cooling for the reactor, and Unit 2 operators would have several hours. This is different
than the information in the timeline presented by the licensee in the Regulatory
Conference. Although the NRC did not explicitly use the shorter timeline associated with
the steam generators not being in a wet layup condition, if the NRC had included that
assumption in the SDP analysis it would result in additional risk to the qualitative
assessment.
The NRC identified that the need to establish and maintain a method of long-term
reactor coolant system inventory makeup and control is an important risk consideration
that could represent additional risk significance for a flooding event in light of the
performance deficiencies. The preliminary significance determination stated that all
- 12 -
reactor coolant system makeup pumps were below the postulated flood levels of
concern and would fail given a flood at or above the site grade of 354 feet. The licensee
presented a strategy of using manual control of the core flood tanks (Unit 1) or safety
injection tanks (Unit 2) to maintain sufficient inventory in the reactor coolant system to
support adequate core cooling capability for a short period of time (up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />). The
licensee did not present a strategy beyond 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for long-term reactor coolant system
inventory control.
C. CONCLUSIONS
Based on its extensive evaluation, including careful consideration of the information provided by
the licensee, the NRC determined that no change to the preliminary risk significance
determination result of Yellow for both Unit 1 and Unit 2 is warranted.
The licensee used a range of evaluation methods, including flow-based and precipitation-based
approaches, to determine the AEP or flood frequency for PMP events that would cause flooding
at or above site grade level. These methods are extrapolation-based, and therefore include
significant uncertainty, and the resulting estimates provided by the licensee are beyond the
typical limits of extrapolation considered credible in the current state-of-the-art methodologies
for determining the frequency of extreme events. While the consideration of multiple
extrapolation approaches and the consistency in the results of each of the precipitation-based
analysis methodologies do provide additional confidence that AEPs greater than 1x10-4/year
(10,000 year or less return period) would be overly conservative for consideration in the final
significance determination of these findings, the NRC concluded that AEPs of less than
1x10-5/year (100,000-year or greater return period) could not be established with sufficient
certainty for the purposes of this SDP evaluation.
The NRC concluded that several of the mitigation and recovery strategies proposed by the
licensee would likely not have succeeded due to unrecognized system alignment issues that
were identified by NRC inspectors. In addition, the NRC concluded that the licensee
underestimated the complexity and environmental challenges that would be faced by the
operators in diagnosing and implementing these strategies. Consequently, the NRCs final risk
determination reflects significantly less mitigation credit than proposed by the licensee.
While the NRC concluded that reliance on a more precise value between the thresholds of
1x10-5/year to 1x10-4/year for the AEP or flood frequency of PMP/PMF events cannot be
justified, given the credible limits of extrapolation in the current state-of-the-art methodologies
for determining the frequency of extreme events, the NRC performed a quantitative analysis
using the licensees 95 percent confidence level AEP of 1.44x10-5/year as an initiating event
frequency. As discussed above, the NRC did not consider AEPs of less than 1x10-5/year to be
credible. Consequently, the NRC concluded that use of the licensees best estimate value for
AEP of 1.15x10-6/year would not provide meaningful risk insights. Using the AEP value of
1.44x10-5/year, the NRC then applied what it considered to be appropriate credit for the
mitigation and recovery strategies as described in Sections A and B of Enclosure 2. The results
for Unit 1 and Unit 2 were as follows:
For Unit 1, after application of the failure probabilities for external flooding mitigation
strategies as described in Sections B.1, B.2.b, and B.2.c, the SDP result for Unit 1 was
White. In the context of a sensitivity analysis, the NRC applied overly optimistic failure
- 13 -
probabilities for external flooding mitigation strategies as described in Sections B.1,
B.2.b, and B.2.c, and the SDP result remained White.
For Unit 2, as stated in Section B.3, the risk from internal flooding alone resulted in an
SDP result of Yellow. In the context of a sensitivity analysis, the NRC applied an overly
optimistic failure probability of 10 percent for the service water mitigation strategy for
internal flooding, as well as overly optimistic failure probabilities for external flooding
mitigation strategies as described in Sections B.1, B.2.a, and B.2.c. The SDP result for
this Unit 2 sensitivity analysis remained Yellow.
Given the current lack of confidence in a definitive approach to establish initiating event
frequency best estimates for consideration in extreme flooding events, IMC 0609 Appendix M
provides the appropriate method for determining the final significance. Notwithstanding, the
quantitative analysis described above was conducted to provide risk insights to the Appendix M
qualitative assessment. As described in the NRCs preliminary risk determination letter,
Appendix M specifies that a bounding, i.e., worst case, analysis should be conducted using the
best available information, followed by the consideration of appropriate qualitative factors in
determining the significance of the associated finding. With respect to the bounding analysis,
the NRC determined that the upper bound AEP was less than 1x10-4/year, therefore, the upper
bound risk assessment per Appendix M is Yellow.
With respect to the consideration of appropriate qualitative factors in determining the
significance of the associated finding, the NRCs assessment of those qualitative factors and
corresponding results, are described in Section A.1-8. In summary, for Unit 2, the significant
additional risk contribution due to internal flooding and limited credit for external flooding
mitigation and recovery strategies, results in a final significance determination of Yellow. For
Unit 1, the risk profile is less severe than for Unit 2, both in the failure probability of the portable
pump mitigation strategy and the contribution from internal flooding. However, based primarily
on flood frequency uncertainties and the lack of long-term recovery actions for restoration of the
reactor coolant inventory control function and the containment pressure control function, the
NRC determined that a final significance determination of Yellow was appropriate for Unit 1.
- 14 -