ML18151A442

OpESS 2007/02 Rev 3 Analysis of Flooding Vulnerabilities

ML18151A442
Person / Time
Issue date:	09/11/2018
From:	Eric Thomas NRC/NRR/DIRS/IOEB
To:
Thomas E, NRR/DIRS, 415-6772
Shared Package
Ml18169A104, ML18254A122	List:
References
CN 18-031, DC 18-013
Download: ML18151A442 (12)

Text

NRC INSPECTION MANUAL IOEB OPERATING EXPERIENCE SMART SAMPLE (OpESS) 2007/02 Revision 3 ANALYSIS OF FLOODING VULNERABILITIES Effective Date: 09/01/2018 CORNERSTONE: INITIATING EVENTS MITIGATING SYSTEMS BARRIER INTEGRITY APPLICABILITY:

This OpESS applies to all licensed operating commercial nuclear reactors.

Supplements sample selection for Inspection Procedure (IP) 71111.01, Adverse Weather Protection, IP 71111.06, Flood Protection Measures, and IP 71111.19, Post-Maintenance Testing.

Performance of this OpESS is voluntary.

OpESS 2007/02-01 OBJECTIVES 01.01 Assist NRC inspectors in identifying issues that could adversely impact a licensees flood protection and mitigation strategies.

01.02 Assist inspectors with verifying adequacy of licensees flood protection, flood mitigation strategies, and applicable procedures.

OpESS 2007/02-02 BACKGROUND 02.01 Design Overview General Design Criterion (GDC) 2 in Appendix A of 10 CFR Part 50 states, in part, that Structures, Systems, and Components (SSCs) important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. GDC 2 requires licensees to consider historically reported natural phenomena for the site and surrounding area, and to design SSCs with sufficient safety margins.

This OpESS focuses on the following:

Design and maintenance of physical protection features such as flood barriers that protect vital plant equipment from internal and external sources of flood water The ability of a licensee to effectively implement abnormal operating procedures to mitigate the effects of external flooding Issue Date: 09/11/18 1 2007/02 Rev 3

The accuracy of analyses that are used to determine design bases flooding elevations and flood water inundation times 02.02 Operating Experience Overview Nuclear power plant designs include considerations for probable maximum flood and storm surge levels from sources such as hurricanes, tidal surges, rainfall, seiches, and rising river or lake levels. Flooding can also initiate from internal sources such as ruptured piping or expansion joints. For external flood sources, historical information is used to determine the likelihood of water reaching certain elevations, and the design flood level for the site is derived from this information. Plant equipment and fixtures that are needed to protect safety related SSCs from design static water levels and dynamic effects include but are not limited to drains; penetration seals; water tight doors and hatches; and pumping systems with their associated piping and valves. These various water ingress pathways can lead to flooding from either external or internal water sources.

Flood mitigation equipment failure can be caused by:

Material degradation Failure of as-built systems to meet the design Failure of the licensee to document and correct the impacts of system modifications or system de-activation (such as cutting a pipe and creating a flooding pathway between 2 rooms that is not documented in the plant design)

Reliance on implementing procedures to configure flood mitigation systems prior to the onset of flooding that are unrealistic or cannot be implemented by licensee personnel When flood mitigation systems and procedures are not able to adequately perform their design functions, the design flood levels of the plant may no longer be conservative.

Following the Fukushima Dai-ichi Accident in Japan in 2011, NRC defined the term cliff-edge effects related to flooding in its Near-Term Task Force Report. Cliff-edge effects refer to the point at which a small increase in flood level can have devastating impacts on plant protective equipment and safety-related SSCs. Cliff-edge effects are also discussed in the industry guidance document for flooding vulnerability walkdowns (NEI 12-07, Guidelines for Performing Verification Walkdowns of Plant Flood Protection Features). When flood waters reach levels at which cliff-edge effects occur, the probability of an accident becoming unrecoverable and leading to core damage can rapidly approach a conditional core damage probability (CCDP) of 1.0. Therefore, the core damage frequency (CDF) essentially becomes equal to the probability of the site experiencing flood levels at or above the level where cliff-edge effects occur.

02.03 Purpose of this Smart Sample IP 71111.01, 71111.06, and 71111.19 provide ample guidance and inspection sample opportunities for inspectors to effectively evaluate a licensees ability to protect vital plant equipment from internal and external flooding threats. This document informs inspectors of recent operating experience that should be considered when evaluating licensee performance in this area, and recommends strategies that can be used when carrying out these baseline procedures.

Issue Date: 09/11/18 2 2007/02 Rev 3

02.04 NRC and Industry Activities Addressing Flood Vulnerabilities In 2005, NRC staff issued Information Notice (IN) 2005-30, Safe Shutdown Potentially Challenged by Unanalyzed Internal Flooding Events and Inadequate Design. This IN describes design vulnerabilities at Kewaunee Nuclear Station that were similar to those identified at ANO in 2013. At Kewaunee, flooding in the turbine building could have adversely affected the auxiliary building and EDG building through non-watertight penetrations and a floor drain system.

In 2007, NRC staff issued IN 2007-01, Recent Operating Experience Concerning Hydrostatic Barriers, which described three events where water from either internal or external sources leaked through hydrostatic barriers and impacted safety-related SSCs. In each case, water either penetrated through barriers whose hydrostatic seals had failed or degraded, or penetrated through openings that were either not properly sealed or not sealed at all.

NRC staff issued OpESS 2007/02 Revision 0, which advised inspectors to review licensees actions in response to IN 2005-30, and to evaluate licensees preventive maintenance practices for hydrostatic seals as well as their corrective actions following any liquid spills.

Following the Fukushima Dai-ichi accident in 2011, the NRC and industry required plant walkdowns to verify functionality of flood barriers and seals along with proper staging of required equipment and materials to mitigate internal and external flooding. Licensees also had to show that mitigating actions that would be relied upon prior to the onset of flooding could be accomplished as designed and in a timely fashion. Plant walkdowns occurred in 2012, and results were verified during NRC follow-up inspections under Temporary Inspection (TI) 2515/187, Inspection of Near-Term Task Force Recommendations 2.3, Flooding Walkdowns.

The Nuclear Energy Institute (NEI) provided a guidance document, NEI 12-07, Guidelines for Performing Verification Walkdowns of Plant Flood Protection Features, for these activities. The NRC endorsed NEIs guidance.

In 2015, the NRC OpE staff aggregated several of the more significant flooding events and inspection findings related to flood vulnerabilities from the 2011-2014 time period in IN 2015-01, Degraded Ability to Mitigate Flooding Events. This IN includes both licensee and NRC-identified findings discovered during the post-Fukushima walkdowns and inspection activities.

The IN also highlights issues that occurred during this time period where plant events or environmental conditions led to flooding conditions and revealed seals, doors, hatches and other barriers that did not function as designed to keep water away from safety-related equipment. This IN also includes information about the March 31, 2013, event at Arkansas Nuclear One (ANO) in which a heavy load drop of the main turbine stator occurred that resulted in a firemain rupture and exposed problems with a handful of flood seals.

OpESS 2007/02-03 INSPECTION GUIDANCE The following inspection guidance may be applied as appropriate to support baseline inspection activities. Inspector judgement should be used when determining the extent to which this OpESS should be used to inform inspection activities under the applicable baseline IP. The recommended inspection activities described below support IP 71111.01, Adverse Weather Protection, IP 71111.06, Flood Protection Measures, and IP 71111.19, Post-Maintenance Testing. The purpose of this guidance is to ensure inspector awareness of:

Issue Date: 09/11/18 3 2007/02 Rev 3

Additional inspection concerns that were part of the post-Fukushima flooding walkdowns and could be included as samples under IP 71111.01, 71111.06, and 71111.19.

Lessons learned from operating experience at ANO and other sites which show both equipment and design vulnerabilities for internal and external flooding which were overlooked during post-Fukushima flooding walkdowns. These lessons learned could be applicable to other sites.

03.01 Additional Considerations for Exterior Passive Flood Protection Features (IP 71111.01 and NUREG 1801, Generic Aging Lessons Learned Report)

a. Verify and review the licensees calculation of Available Physical Margin (APM) as defined in NEI 12-07. Note that this value can change based on the complexity and uncertainty of the existing licensing basis flood evaluation, and the flood evaluation may need to be challenged or re-evaluated following introduction of new hydrographic analysis information, or as a result of vulnerabilities discovered during inspection or actual events.

b. If a passive flood protection feature is subject to a preventive maintenance (PM) or other monitoring program to provide reasonable assurance of continued functionality, evaluate the effectiveness of the licensees programs. This could include reviewing records from previous PM activities performed by the licensee under the program.

c. If a passive flood protection feature is not subject to a PM or other monitoring program to provide reasonable assurance of continued functionality, evaluate the licensees basis for this decision and whether it is acceptable.

03.02 Additional Considerations Where Operator Actions are Credited for Flood Mitigation (IP 71111,01 and IP 71111.06)

a. Verify that all equipment, tools, and consumables necessary for carrying out operator actions are properly staged, accessible, and in good working order.

b. Review any licensee training programs and training records associated with credited operator actions.

c. If the licensee does not hold periodic training to ensure operators can carry out required flood mitigation actions, evaluate whether this is acceptable.

03.03 Additional Considerations for Conduits, Hatch Seals, Water Tight Doors, Floor Penetrations, Floor Drains, and Abandoned Equipment (IP 71111.19)

a. During system walkdowns and procedure reviews, ensure the licensee has a robust process for identifying flood barriers and that site personnel are trained on the system/plant design and the processes that exist for flooding prevention.

b. Maintain a questioning attitude when areas containing flood barriers are classified as inaccessible by the licensee. Such classifications should strike an appropriate balance between protecting personnel from plant hazards and allowing maximum access to verify the integrity of flood barriers.

Issue Date: 09/11/18 4 2007/02 Rev 3

c. Determine how the licensees PM and post-maintenance testing (PMT) programs provide reasonable assurance that a flood boundary/penetration is capable of performing its design function. Lessons learned from ANO and other sites indicate that, even after verifying that a penetration is equipped with the correct sealing materials and configuration called for in the plant design, there is still a potential that the penetration will not perform its design function. This can be the result of inadequate design of the barrier, or other factors such as mis-alignment of sealing material during assembly or operation. IP 71111.19 provides guidance for selecting PMT activities to inspect.

Inspectors should consider including systems with flooding barriers in their quarterly samples. Some methods for testing barriers include:

1. Smoke test

2. Pressure test

3. Static water test

4. Visual (flashlight) test

d. Verify a sample of the plants flood seal drawings to ensure that drawings accurately reflect the plant design. This can assist in identifying unknown pathways for water ingress into vital systems and components.

e. Ensure licensee personnel account for flooding vulnerabilities that may be created by intersystem connections. An example would be when the piping from one system is or has the potential to be hydraulically connected to a system that is vented to atmosphere.

Such connections have the potential to create unanticipated flooding vulnerabilities.

f. Review the licensees administrative controls to mitigate flooding vulnerabilities that may be introduced during maintenance. During certain maintenance evolutions such as large component replacement, the necessary openings created for equipment removal may also create additional flood barriers. Licensees should be aware of these vulnerabilities and have compensatory measures established to prevent inadvertent flooding.

OpESS 2007/02-04 REFERENCES 04.01 Title 10 of the Code of Federal Regulations (10 CFR) Part 50

a. Appendix A, General Design Criteria for Nuclear Power Plants, Criterion 2, Design bases for protection against natural phenomena, requires that SSCs important to safety be designed to withstand the effects of tornados without loss of their ability to perform their safety function. Appendix A, General Design Criteria for Nuclear Power Plants, Criterion 4, Environmental and dynamic effects design bases, requires that SSCs important to safety shall be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including loss-of-coolant accidents.

b. Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, Criterion 3, Design control, requires that regulatory requirements are correctly translated into specifications, drawings, procedures, and instructions.

Issue Date: 09/11/18 5 2007/02 Rev 3

04.02 Regulatory Documents Associated with Post-Fukushima Activities

a. NRC 10 CFR 50.54(f) Letter, Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3, and 9.3 of the Near-Term Task Force Review of Insights From the Fukushima Dai-ichi Accident

b. NEI 12-07, Guidelines for Performing Verification Walkdowns of Plant Flood Protection Features - This document provides guidance for assessing External Flood Protection and Mitigation Capabilities in accordance with the NRC recommendation in item 2.3 of SECY 11-0137 and enclosure 4 of the March 12, 2012, Fukushima accident near term activities 10CFR50.54(f) letter.

c. Temporary Instruction (TI) 2515/187, Inspection of Near Term Task Force Recommendation 2.3 Flooding Walkdowns - The objective of this TI is to independently verify that the licensees external flood protection walkdown activities were conducted using walkdown methodology endorsed by the NRC.

04.03 Selected Inspection Findings Related to Flooding.

The following findings were identified either as the result of actual flooding conditions onsite, during Post-Fukushima walkdowns conducted under NEI 12-07, or as part of NRCs follow-up to these inspections under TI 2515/187. In each case, licensees received one or more findings of White or Yellow safety significance. The NRC summarized many of these issues in IN 2015-01.

a. Arkansas Nuclear One - NRC Inspection Report 05000313/2014009 and 05000368/2014009 - On March 31, 2013, ANO experienced an initiating event (heavy load drop of the main turbine stator) that resulted in a firemain rupture. Water from a fire pump that continued to pressurize the ruptured firemain piping flowed into the turbine building train bay, and subsequently into the auxiliary building which contains safety-related SSCs and provides pathways to other vulnerable spaces. Water entered the auxiliary building from the turbine bay through leaking hatches whose design function is to prevent flood water from entering the auxiliary building. The unexpected water intrusion experienced during this event exposed problems with a handful of flood seals, and these issues were corrected by the licensee (see Attachment 1 for examples).

Following the event, more detailed inspections by the NRC and the licensee identified over 130 degraded flood protection features that had not been identified or addressed during Post-Fukushima accident flooding walkdowns.

The ANO Safety Analysis Reports state that a maximum probable flood would take at least two days to develop, and that the auxiliary building and emergency diesel generator fuel storage building can withstand flooding up to a level of 361 above mean sea level (MSL). Extent of condition reviews by the licensee following the stator drop event revealed that any flooding at or above site grade (354 MSL) would have resulted in a cliff-edge effect, inundating the auxiliary buildings and flooding the EDG fuel storage building at a rate beyond the capacity of the building sump pump. Flooding would have rendered enough safety systems inoperable that core damage would have been unavoidable. This increased risk of core damage resulted in a performance deficiency and a Yellow inspection finding at ANO.

Issue Date: 09/11/18 6 2007/02 Rev 3

b. Saint Lucie - NRC Inspection Report 05000335/2014009 and 05000389/2014009 - This report includes the flooding of Saint Lucies reactor auxiliary building (RAB) during a heavy rain event on January 9, 2014. Approximately 50,000 gallons of water entered the RAB through conduits that were missing internal flood barriers. Plant operators were able to successfully re-direct the water away from vital plant equipment until the storm passed. Follow-up inspection revealed a total of six conduits that penetrated the RAB below the plants design basis flood elevation and were missing internal flood barriers (conduit seals). During a design basis external flood event water would have entered the Unit 1 RAB and potentially impact both trains of high head and low head ECCS pumps. This event led to a White inspection finding under Appendix B Criterion III, and a Severity Level III violation of 10 CFR 50.9 for failing to accurately characterize the safety significance of the missing seals in a 2012 licensee event report, and in its response to NRCs 10 CFR 50.54(f) letter for flooding walkdowns.

c. Sequoyah Nuclear Plant - NRC Inspection Report 05000327/2013010, 05000328/2013010 - In this case, the Post-Fukushima walkdowns identified a vulnerability where the licensees Emergency Raw Water Cooling (ERWC) Pumping Station had inadequately sealed penetrations that would not be able to prevent damage to the equipment within during a design flooding event. Design requirements were not adequately translated to the field, and further investigation revealed damaged and missing penetration seals. Loss of the equipment in the ERWC Pumping Station would have led to failure of the sites emergency diesel generators. The licensee received a White finding under Appendix B Criterion III.

d. Watts Bar Unit 1 Nuclear Plant - Final Significance Determination of Yellow Finding, White Finding and Notices of Violations; Assessment Follow-up Letter; Inspection Report No. 05000390/2013009 - The White finding resulting from this inspection dealt with the licensees non-conservative analysis of the potential for a maximum precipitation event to cause water levels that would overtop the earthen dam protecting the site and result in inundation of safety-related systems. The Yellow finding was more applicable to this smart sample in that it dealt with insufficient abnormal operating instructions for reconfiguring and realigning plant systems prior to the onset of flooding conditions. For instance, equipment needed to carry out procedures was missing, mislabeled, or did not fit up properly because of piping interferences and the lack of suitable rigging locations.

In addition, the time required to carry out the instructions was under-estimated.

e. R.E. Ginna Nuclear Power Plant, LLC - NRC Integrated Inspection Report 05000244/2013005 - The licensee discovered previously unanalyzed flooding vulnerabilities on May 29, 2013, during walkdowns associated with NEI 12-07. As part of its Systematic Evaluation Process (SEP) in 1983, the licensee had revised its design basis height for external floods to an elevation above plant grade. The new level introduced a flooding pathway where floodwaters could enter a manhole and subsequently flood two battery rooms through unsealed penetrations and a non-watertight fire door. The penetrations were left unsealed because the licensee did not evaluate for flooding through the manhole. The NRC issued a White finding under Appendix B Criterion XVI for failure to fix a significant condition adverse to quality.

f. Monticello Nuclear Generating Plant, NRC Inspection Report 05000263/2013008 - This Yellow finding was related to the licensees non-conservative assumptions for how long it would take to carry out the procedure for constructing flood barriers around vulnerable portions of the plant prior to the onset of external flooding. During plant walkdowns Issue Date: 09/11/18 7 2007/02 Rev 3

associated with TI 2515/187, NRC inspectors questioned the licensees assumptions and logistics processes, and realized the time allotted was not sufficient based on procedures, manpower, and materials requirements.

g. Point Beach Nuclear Plant, Units 1 and 2 NRC Integrated Inspection Report 05000266/2013002 and 05000301/2013002 - Point Beach received a White finding under similar circumstances to the Monticello situation discussed above. The site had a plan and procedure in place to install jersey barriers to protect the turbine building and pump house from external wave run-up and flooding. However, the licensee discovered that they did not have enough barriers to effectively cover the area that needed protection, the procedure did not consider the length of time that would be needed to place the barriers, and the licensee did not account for the gaps that would remain between and under the jersey barriers. These issues were discovered during TI 2515/187 walkdowns.

h. Dresden Nuclear Power Station, Units 2 and 3, Integrated Inspection Report 05000237/2013002, 05000249/2013002 - The licensees procedure for maintaining reactor water level above the top of active fuel was determined to be lacking in scope.

The licensee assumed that pumping equipment required to provide makeup water would be unavailable during a probably maximum flood event. However, they only accounted for water losses related to unidentified leakage, and therefore assumed pumping equipment would become available prior to a significant loss in reactor water level.

Following walkdowns associated with NEI 12-07, NRC inspectors pointed out that the licensees analysis and procedure did not account for unidentified leakage, and determined that additional actions were required to ensure water level did not drop below the top of active fuel. Dresden received a White finding for this performance deficiency.

i. Three Mile Island Unit 1, Integrated Inspection Report 05000289/2012005 - During external flood barrier walkdowns, the licensee failed to identify that electrical cable conduit couplings in the Unit 1 Air Intake Tunnel were not sealed, as designed, to maintain the integrity of the external flood barrier system. This issue was discovered during TI 2515/187 walkdowns. NRC issued a White inspection finding under Appendix B Criterion XVI.

04.04 Generic Communications

a. IN 2005-30, Safe Shutdown Potentially Challenged by Unanalyzed Internal Flooding Events and Inadequate Design - Licensee discovered open pipe connection through a bulkhead, inadequately designed floor drains, and non-watertight doors that could have allowed water from the turbine building to flood the auxiliary building.

b. IN 2007-01, Recent Operating Experience Concerning Hydrostatic Barriers -

Discusses three events from 2006 where water leaked through hydrostatic barriers and impacted operability of safety-related equipment.

c. IN 2015-01, Degraded Ability to Mitigate Flooding Events - Discusses external flood protection where deficiencies with equipment, procedures, and analyses relied on to either prevent or mitigate the effects of external flooding at licensed facilities resulted in degraded ability to mitigate flooding events.

Issue Date: 09/11/18 8 2007/02 Rev 3

04.05 Inspection Procedures

a. IP 71111.01, Adverse Weather Protection - Provides inspection guidance for severe weather events including external flooding.

b. IP 71111.06, Flood Protection Measures - Provides inspection guidance for flood mitigation plans, equipment, internal flood barriers, and design requirements.

c. IP 71111.19, Post-Maintenance Testing - Provides inspection guidance to ensure PMT procedures adequately verify system operability and functional capability.

04.06 Other Documents

a. NUREG 1801, Generic Aging Lessons Learned Report - NRC staffs evaluation of existing plant programs and their effectiveness to manage the effect of aging.

OpESS 2007/02-05 REPORTING RESULTS/TIME CHARGES/ADDITIONAL ISSUES If information from this OpESS is used to inform a baseline inspection sample, reference the OpESS number in the scope section of the report.

In addition, if any findings or violations are identified in conjunction with this OpESS, include a statement similar to the following in the description section of the finding write-up:

This finding was identified in connection with a review of Operating Experience Smart Sample (OpESS) 2007/02.

Inspection time for this OpESS is to be charged to the normal baseline procedure under which it is being used.

OpESS 2007/02-06 CONTACTS For technical support regarding the performance of this OpESS and emergent issues, contact Eric Thomas (NRR/DIRS/IOEB) at (301)415-6772 or Eric.Thomas@nrc.gov, or Steve Jones (NRR/DSS/SBPB) at (301) 415-2712 or Steve.Jones@nrc.gov.

For administrative, reporting, or documentation questions, contact Bridget Curran (NRR/DIRS/IRGB) at (301) 415-1003 or Bridget.Curran@nrc.gov.

Issue Date: 09/11/18 9 2007/02 Rev 3

Attachment 1 Images of Flooding Vulnerabilities Identified and Corrected at ANO-1 As-found (top) and As-left (bottom) condition of embedded 6.9kV conduits which penetrate the Turbine and Auxiliary Building at ANO-1.

Some of the penetrations are in floors or walls that are flood boundaries.

Issue Date: 09/11/18 Att1-1 2007/02 Rev 3

Above, pipes in the as-found images were cut and abandoned in place. They provided a potential pathway for flood water to flow into a flood-protected space underneath this room.

Below, the same pipes are shown in the as-left condition, properly capped and labeled.

Issue Date: 09/11/18 Att1-2 2007/02 Rev 3

Attachment 2Revision History for OpESS 2007/02 Commitment Accession Description of Change Description of Comment Resolution and Tracking Number Training Closed Feedback Form Number Issue Date Required and Accession Number (Pre-Change Notice Completion decisional, Non-public Date Information)

ML13316B174 Initial issuance of the OpESS following NRC IN 2005-30, None N/A. Initial issuance of 12/20/06 which highlighted flooding vulnerabilities at Kewaunee. OpESS Three additional flooding events involving deficient hydrostatic barriers occurred in 2006, and resulted in IN 2007-01.

Revision 1 - Draft revision None N/A ML13316C037 Revision 2 - created for FY 2007 None N/A 12/20/06 ML18151A442 Revision 3 - Document updated to match IMC 0040 None ML18169A110 09/11/18 OpESS format CN 18-031 Document revised to include post-Fukushima flooding walkdown lessons learned, and to include recent events and associated findings from IN 2015-01. This revision was made in response to recommendations from the ANO-1 Lessons Learned report (ML17160A290)

Issue Date: 09/11/18 Att 2-1 2007/02