ML14058A068

Email from M. Khanna, NRR to J. Mitman, NRR on Ouo/Sri Oconee Adequate Protection Backfit Documented Evaluation April 12, 2010

ML14058A068
Person / Time
Site:	Oconee
Issue date:	12/17/2010
From:	Meena Khanna Plant Licensing Branch 1
To:	Jeffrey Mitman NRC/NRR/DRA
Shared Package
ML14055A421	List: ML090570117 ML090680737 ML091620669 ML092020480 ML092940769 ML100280954 ML101750619 ML101890803 ML102990064 ML103410042 ML12268A404 ML14055A410 ML14055A411 ML14055A474 ML14058A015 ML14058A016 ML14058A017 ML14058A018 ML14058A019 ML14058A020 ML14058A021 ML14058A022 ML14058A023 ML14058A024 ML14058A025 ML14058A026 ML14058A027 ML14058A028 ML14058A029 ML14058A030 ML14058A031 ML14058A032 ML14058A033 ML14058A034 ML14058A035 ML14058A036 ML14058A037 ML14058A038 ML14058A039 ML14058A040 ML14058A042 ML14058A043 ML14058A044 ML14058A045 ML14058A046 ML14058A047 ML14058A048 ML14058A049 ML14058A050 ML14058A051 ... further results
References
FOIA/PA-2012-0325
Download: ML14058A068 (9)

Text

',1, Mitman, Jeffrey . Ld I From: Khanna, Meena .f\ý Sent: Friday, December 17, 2010 8:12 PM To: Mitman, Jeffrey

Subject:

OUO/SRI-Oconee Adequate Protection Backfit Documented Evaluation April 12 2010 (3)

(2).doc Attachments: Oconee Adequate Protection Backfit Documented Evaluation April 12 2010 (3) (2).doc Jeff, seems like this is the latest version. .not too many changes from the last version. thanks L 2--,ý

.... CIAL USE ONiLY - SEOUR;Tf- RELATED w.L'rC*F*Aiu*N DRAFT (Apil 1-4,June 14, 2010)

Oconee Nuclear Site Adequate Protection Backfit Documented Evaluation

SUMMARY

Duke Energy Carolinas, LLC, the licensee of the Oconee Nuclear Station (ONS) has not demonstrated that the ONS has adequate protection against external floods from all sources including a random failure of the Jocassee Dam. Based on this evaluation, the NRC staff concludes that this situation constitutes an adequate protection exception to the backfit rule under 10 CFR 50.109 (a)(4)(ii). As discussed below, if the Jocassee Dam fails and the Safe Shutdown Facility (SSF) is inundated, then the ONS will sustain core damage with a probability of 1.0 and containment failure with a probability of oree1 .0. It should be noted that to euthe staff's knowledge, neither Duke nor the staff has calculated a probability of either spent fuel pool boiling or fuel damage. However, without spent fuel pool cooling, given sufficient time, the water in the spent fuel pools will boil off and the spent fuel will be damaged. It should also be noted that the Oconee spent fuel pools are located in the auxiliary building, outside of containment. Duke has not shown that inundation of the SSF is at a sufficiently low probability with respect to this external hazard to offset the extremely high probability of core damage, spent fuel damage, and containment failure. Accordingly, the licensee has not demonstrated that the public is adequately protected from external floods at the ONS site.

BACKGROUND Description of ONS Section 2.1.1.1, "Specification of Location," of the Updated Final Safety Analysis Report (UFSAR) describes the geographic location of ONS. ONS is located in eastern Oconee County, South Carolina, approximately 8 miles northeast of Seneca, South Carolina, at latitude 34o-47'-

38.2"N and longitude 82o-53'-55.4'W. Duke Power Company's Lake Keowee occupies the area immediately north and west of the site. The Corps of Engineer's Hartwell Reservoir is south of the site. Duke's Lake Jocassee lies approximately 11 miles to the north of the site.

Section 2.4.1.1, "Site and Facilities," of the UFSAR describes the hydrologic description. The yard grade is 796 feet (ft.) main sea level (msl.). The mezzanine floor elevation in the turbine, auxiliary, and service buildings is 796.5 ft. msl. The exterior accesses to these buildings are also at an elevation of 796.5 ft. msl. All of the man-made dikes and dams forming the Keowee reservoir rise to an elevation of 815 ft. msl., including the intake channel dike. The crest of the submerged weir in the intake canal is at an elevation of 770 ft. msl.

Regulatory Requirements and Guidance 10 CFR 50, Appendix A, General Design Criteria (GDC) 2, "Design Bases for protection against natural phenomena," states, "Systems Structures and Components (SSCs) important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, foods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these SSCs shall reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and

0 - mAED INFOKIA--*-

the surrounding area, with sufficient margin for the limited accuracy, quantity and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed."

The four sections in Chapter 2 of Standard Review Plan (SRP) NUREG-0800 1 that are directly related to the issue of external flooding are: (i) SRP Section 2.4.2, Rev.4, "Floods," (ii) SRP Section 2.4.3, Rev.4, "Probable Maximum Flood (PMF) on Streams and Rivers," (iii) SRP Section 2.4.4, Rev.3, "Potential Dam Failures," and (iv) SRP Section 2.4.10, Rev.3, "Flooding Protection Requirements." All four SRP Sections, above, make reference to ANSI/ANS-2.8-1992. Although the summary, below, primarily considers potential considerations for dam failures related to non-tidal stream flooding, it should be noted that SRP 2.4.5, Rev. 5, "Probable Maximum Surge and Seiche Flooding," also refers to ANSI/ANS-2.8-1992.

SRP Section 2.4.2, "Floods," provides guidance in performing safety reviews of historical flooding bases with respect to individual types of flood-producing phenomena and combinations thereof. Guidance related to dam failure includes consideration of stream flooding with review of the PMF with coincident wind-induced waves due to dam failure potentially arising from (i) inadequate dam capacity, (ii) inadequate flood-discharge capability, or (iii) an existing physical condition. For seismically-induced dam failures, specific combinations of earthquake levels and flood characteristics for review are provided.

SRP Section 2.4.3, "Probable Maximum Flood (PMF) on Streams and Rivers," provides guidance on the review of the hydro-meteorological design bases with respect to the extent of any flood protection required for safety-related SSCs, Including applicable drainage area and runoff response characteristics. Figure 2.4.3-1 provides a schematic approach for the review of PMF that includes considerations for exit and proposed reservoirs in the region from information available from the US Corps of Engineers and the National Inventory of Dams.

SRP Section 2.4.4, "Potential Dam Failures," deals directly with guidance on the review of potential failures of onsite, upstream, and downstream water control structures. Specific areas identified with respect to dam failure include dynamic effects (flood waves), cascading failures, and failure of onsite water control or storage structures. SRP 2.4.4 also leaves open the possibility of considering other site-related evaluation criteria, specifically: "The potentialeffects of seismic and non-seismic information on the postulated design bases and how they relate to dam failures in the vicinity of the site and the site region." Note: Although no specific guidance regarding the dam breach parameters (such as breach width and time to failure) is given in the body of the SRP, references to technical literature dealing with dam breach are given in Section VI, "References," of the SRP. Duke is performing a revised flood inundation analysis using the computer code HEC-RAS, which is mentioned in Reference 9, "HEC-RAS River Analysis System," in this SRP.

SRP Section 2.4.10, "Flooding Protection Requirements," provides guidance on the comparison between the information reviewed in previous sections regarding the design-basis flood conditions and the potential effects on safety-related facilities for a given location and elevation.

Also included in the guidance are considerations of types of flood protection (e.g., "hardened facilities," sandbags, bulkhead, etc.) and emergency procedures, as outlined in RG 1.102, "Flood Protection for Nuclear Power Plants."

1Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants; LWR Edition (NUREG-0800) 2

Regulatory Guide (RG) 1.59, "Design Basis Floods for Nuclear Power Plants," references G DC 2, and describes acceptable methods of determining design basis floods, while RG 1.102; "Flood Protction for N*uleaFr Po'weFr Pnt," provides guidance on acceptable design requirements for flood protection. RG 1.59 references the American National Standards Institute (ANSI) Standard N170-1976 (ANSI 2.8), "Standards for Determining Design Basis Flooding at Power Reactor Sites," almost in its entirety as the source for estimating Probable Maximum Floods (PMF), with the exception of specific portions related to the evaluation of erosion failure.

In fact, ANS N170-1976 is used as a replacement for previous text included in Appendix A of RG 1.59, whereas Appendices B and C include simplified alternatives for estimating the PMF for non-tidal streams and the Probable Maximum Surge (PMS) for hurricanes at open-coast sites, respectively.

Oconee Licensing Basis Oconee's UFSAR Section 3.1.2, "Criterion 2- Performance Standards (Category A)," describes how itthe licensee accounts for external flood protection. Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) "appropriate consideration for the most severe of these natural phenomena that have been recorded for the site and the surrounding areas and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design."

Section 2.4.2.1, "Flood History:" Since Oconee is located near the ridgeline between the Keowee and the Little River valleys, or more than 100 ft. above the maximum known flood in either valley, the records of past floods are not directly applicable to siting considerations.

Section 2.4.2.2, "Flood Design Consideration:" Flood studies show that Keowee Dam and Jocassee Dam are designed with adequate margins to contain and control floods. These floods include general flooding of the rivers and reservoirs in the area due to a rainfall in excess of the Probable Maximum Precipitation (PMP). Therefore, external flooding due to rainfall affecting rivers and reservoirs is not a problem. In summary, flood studies show that the Lakes Keowee and Jocassee are designed with adequate margins to contain and control floods.

Section 2.4.4, "Potential Dam Failures, Seismically Induced:" The Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike, and the Intake Canal Submerged Weir have also been designed to have an adequate factor of safety under the same conditions of seismic loading as used for the design of Oconee.

The Jocassee Dam was evaluated for potential overtopping and seismic failures. After Duke concluded that the dam would not fail due to overtopping or a design based seismic event, the flooding scenario associated with the reservoir of water in Jocassee Lake was not included in their external flooding analysis.

3

Ol-riCIAL u~aE ONLY SECURW' RELATED IWF~MAT1ON History Duke performed an inundation study2 in 1992 to meet a Federal Energy Regulatory Commission (FERC) requirement for formulating an emergency action plan in the event that the Jocassee Dam failed. This study showed that approximately 16.5 ft. of water would inundate the site.

In April 2006, while performing a Reactor Oversight Process (ROP) evaluation, the NRC staff questioned the licensee's maintenance of the SSF flood protection barrier. During the subsequent ROP Significance Determination Process (SDP), the NRC identified that the licensee had incorrectly calculated the Jocassee Dam failure frequency and had not adequately addressed the potential consequences of flood heights predicted at the Oconee site, based on the 1992 inundation study. The NRC staff also recognized that Duke's 1992 inundation stud, did not follow the guidelines for the PMF evaluation, as described in Regulatory Guides 1.59 and 1.1024.

The NRC sent a 10 CFR 50.54 (f) request for information on August 15, 2 0 0 8 5-6. In response to this letter, in 2009, Duke conducted additional inundation analyses7 consisting of one- and two-dimensional studies. These studies indicated that the resultant flood, which results in approximately 18.5 feet of water on the site, would cause the site to be inundated with flood waters. Duke, in its response to the 10 CFR 50.54 (f) letter, stated that the inundation will lead to core damage, containment failure, and the loss of spent fuel pool cooling at all three units.

Thus, if a flooding event from a Jocassee Dam failure occurred at the ONS, all three units have no defense-in-depth to prevent core damage. The remaining intact element of defense-in-depth of containment integrity will be severely challenged, if unmitigated, resulting in the potential for radionuclide release to be highly probable. These results have led the NRC to conclude that Duke lacks defense-in-depth to ensure that there is adequate protection at the ONS site against such floods.

As a result, the NRC expressed, via the aforementioned 10 CFR 50.54(f) letter, a concern that Duke has not demonstrated "...overall adequacy of the flood protection of Oconee given the Jocassee Hydro Project... Specifically, the NRC is seeking information ... whether Oconee lacks appropriate and adequate compensating engineering safeguards for such an event."

Subsequent to Duke's response to the 10 CFR 50.54(f) letter, the NRC, in its April 20, 2009, letter8 stated, in part, "the NRC staff remains concerned that Duke has not demonstrated that Oconee will be adequately protected in the long term from external flooding events."

2 .Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.

3 Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants," U.S. Nuclear Regulatory Commission,

ýRev. 2) August 1977.

Regulatory Guide 1.102, "Flood Protection for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev.

1) September 1976.

Letter to D. Baxter of Duke Energy Carolinas, LLC, dated August 15, 2008, Information Request Pursuant to 10 CFR 50.54(f) related to External Flooding, Including Failure of the Jocassee Dam at ONS, (ML0816402440).

6 Letter from D. Baxter of Duke Energy Carolinas, LLC, to US NRC, dated September 26, 2008.

7 See Duke's presentation to NRC dated October 28, 2009.

8 Letter to D. Baxter, Evaluation of Duke Energy Carolinas, LLC, September 26, 2008 Response to NRC Letter Dated August 15, 2008 Related to External Flooding at ONS (ML0905707791).

4

-effCael U3 of-jrdLY imff-S~T-RFerAY-E-D-IFtRIMATIMh By letter dated January 15, 20109, Duke submitted a letter to the NRC which provided its interim compensatory measures (ICMs) to ensure that ONS will be adequately protected from external flooding events until the final mitigating strategies have been implemented and all site modifications have been completed. The NRC staff plans to perform a further review of the ICMs and will perform a future inspection.

Then, by letter dated January 29, 2010,10 the staff issued its response to Duke regarding its November 30, 2009 response to the NRC letter dated April 30, 2009, related to external flooding at ONS. The staff indicated that although Duke provided a more accurate estimate of the flooding caused by a failure of the Jocassee Dam, the staff found that additional information was needed. The information was needed for the staff to determine if the analyses performed to date will demonstrate, for the entire Jocassee earthen works, that ONS will be adequately protected from external flooding events. Duke submitted a preliminary set of responses to the staff's questions by letter dated March 5, 201011. The staff is currently reviewing Duke's responses to those questions, and expects Duke's supplemental response from Duke in June 2010.

ADEQUATE PROTECTION DETERMINATION This evaluation (as required by MD 8.412 and LIC-202' 3) provides the basis for invoking the "compliance" exception in 10 CFR 50.109 (a)(4)(ii). Under the Backfit Rule, the NRC may impose a backfit, without preparation of a backfit analysis, if the NRC demonstrates, in a "documented evaluation," that "regulatory action is necessary to ensure that the facility provides adequate protection to the health and safety of the public and is in accord with the common defense and security.

Risk Evaluation of Flooding at ONS Due to Jocassee Dam Failure A generic failure rate evaluation was performed for the Jocassee Dam (ML100780084). Under the cLtpnt licensing basis, should an external flood exceed the height of flood protection, it will causa Ye Oconee switchyard, the Keowee Dam, and the SSF all to fail resulting in P r~nditional core damage probability (CCDP) of unity (1.0). Spent fuel pool cooling will also be ; ,At the onset of core damage, containment integrity will be the only remaining initially intact ael~nse-in-depth barrier. This barrier ýW be severely challengqed under these conditions due to a lack of power to cool containment. (b)(7)(F) uet h accumulated debris and surrounding infrastrucure amage, e atemp o r r the reactor building and spent fuel pool heat removal will be at best difficult to accomplish. NRC has estimated that the failure frequency of Jocassee Dam based on industry data for rockfill dams is Letter from D. Baxter of Duke Energy Corolinas, LLC, to US NRC, dated January 15, 2010 that addresses the Interim Compensatory Measures at ONS.

10Letter to D. Baxter of Duke Energy Carolinas, LLC, dated January 29, 2010, Evaluation of Duke's Response to NRC Letter Dated April 30, 2009 Related to External Flooding at ONS (ML100271591).

11Letter from D. Baxter of Duke Energy Corolinas, LLC, to US NRC, dated March 5, 2010, Partial Response to NRC RAI dated February 3, 2010, Related to External Flooding at ONS.

12 NRC Directive 8.4, "Management of Facility-Specific Backfitting and Information Collection," October 28, 2004.

13 NRC LIC-202 Revision 1, "Managing Plant-Specific Backfits and 50.54(f) Information Requests," December 20, 2006.

5

OFPiciAL USE ONLY - SEUM fVRELATED INFO0_RýýATJN 2.0 x-104 per year. This is the dam initiating event frequency (IEF). The resultant core damage frequency for this case is the product of the dam initiating event frequency and the conditional core damage probability, or CDF 1 = IEF x CCDP1

= (2.0 x 10.) x 1.0

= 2.0 x 10. per year for each unit Of key importance to the staffs evaluation is that the inundation of the Sat ONS will result in core melt, containment failure, and offsite releases witha,probability of 1.P2ý.This is unlike any other nuclear power plaotcurrently in opert'ion today, ir, which an external flood does not result in such a sequence withla probability of 1 .Q-This is because all other nuclear power plants provide some additionaPetfe~se in depth, thereby reducing the conditional core damage probability to something lessitlan 1.0d-However, in the case of a SSF inundation flood at ONS, no mitigation of core damage is possible within the design basis because there is no defense in depth for this particular failure sequence. The failure of ONS to provide defense in depth to address flooding, and the high level of risk for the plant due to flooding, lead the NRC staff to conclude that the ONS does not provide reasonable assurance of adequate protection against flooding attributable to failure of the Jocassee Dam.

Failure of the Jocassee Dam Based on the Probable Failure Mode Analysis (PFMA) for the Jocassee Dam, the most probable failure would result from excessive leakage in the left (east) abutment, resulting in a piping failure. The random sunny day failure commences with a piping failure from the left abutment. If a piping failure occurs in the left abutment, the licensee has estimated that the Jocassee Dam would potentially fail in approximately 2.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The flood waters from the Jocassee Dam breach would then travel down to the Keowee Dam, West Saddle Dam, and the Oconee Intake Dike. This results in the Keowee Dam, West Saddle Dam, and the Oconee Intake Dike being overtopped. The licensee has estimated that the Keowee Dam would potentially fail approximately 2.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the overtopping scenario; the West Saddle Dam would potentially fail approximately 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the overtopping scenario; and the Oconee Intake Dike would potentially fail approximately 0.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the overtopping scenario.

The licensee does not directly address the failure of Jocassee Dam in the UFSAR for ONS, nor does the UFSAR address the 1992 inundation study. However, dams do fail and such failures are credible events. The industry failure rate on dams is well-documented 14 . The frequency of rupture of similarly constructed dams from all causes is estimated to be approximately 2.0 X10.

events per year (ML100760108). This failure frequency places a Jocassee Dam failure in the frequency range of other limiting fault events considered in the Oconee accident analyses and licensing basis.

14 Baecher, G.B., M.E. Pate, and R. De Neufville (1980), 'Risk of Dam Failure in Benefit-Cost Analysis," Water Resource Research, 16(3), 449-456.

6

• NLY *EC*'iT'-REL*L0 Flood Effects on ONS 5

Based on the most current information that Duke has provided to the NRC' , the breach of the Jocassee, Keowee, and West Saddle Dams and the Oconee Intake Dike would result in an inundation of the site with flood waters at an estimated 18.5 ft. of water. The site inundation will also result in several pieces of equipment being unavailable for accident mitigation. In the flooding scenario, the Keowee Dam will overtop and fail, resulting in the loss of the hydro-generators, located inside the Keowee Dam, which are the emergency Alternating Current (AC) onsite power supplies. The event will also render the switchyard, which is the offsite AC power source, unavailable. This drastically affects the normal mitigation methods, rendering all pumps and valves with AC motors, unavailable. The flood waters will also inundate the turbine building basement, where the emergency feedwater pump turbines are located for all three units, making them unavailable. The normal and alternate methods for providing reactor coolant makeup, decay heat removal, and associated power to shutdown all three Oconee units are unavailable.

This will leave only the SSF to mitigate the flooding event. The SSF was designed as an alternative means to achieve and maintain Mode 3 following postulated fire, sabotage or internal flooding events and is also credited during station blackout events. It achieves these requirements by being a source of reactor coolant makeup, decay heat removal, and associated power to shutdown all three Oconee units. Based on the aforementioned information that Duke has provided to the NRC, this will also be lost, due to the flooding waters of approximately 18.5 ft., since it is presently only protected by a 7.5 ft. wall. With the loss of the above mitigation equipment, this flooding inundation will lead to core damage, containment failure, and the loss of spent fuel pool cooling at all three units. Thus, if a flooding event from a Jocassee Dam failure occurred at the ONS, all three units have no defense-in-depth to prevent core damage.

Evaluation of Decay Heat Removal by Steam Generators and Spent Fuel Pool Cooling In February 2009, the licensee developed and submitted a procedure' 6 to address failure of Jocassee Dam with consequential failure of the SSF. This procedure involves adapting an existing B.5.b mitigating strategy to provide decay heat removal through steam generators and spent fuel pool cooling during the period of inundation. The NRC staff evaluated Engineering Manual (EM) 5.3 using the SPAR-H HRA ('The SPAR-H Human Reliability Analysis Method,'

NUREG/CR-6883, August 2005) methodology to obtain a rough estimate of the human error probability (HEP) for this procedure. A rigorous analysis was not performed. SPAR-H was used to get a sense of the probability of failure. The human failure event was defined, success criteria stipulated, cues identified and performance shaping factors evaluated. The overall human error probability from this process was high, giving a result close to one. Due to the complexity of the mitigation strategy, the lack of rigor in the evaluation and the conservative nature of the SPAR-H methodology, no greater accuracy should be construed from this analysis. A more rigorous analysis may lower the failure probability somewhat, but the final result is anticipated to be between 0.1 and 1.0. From a PRA perspective, any reduction in core damage frequency gained from this procedure is minimal. The use of the licensee-proposed procedure would only minimally reduce the risk from flooding caused by failure of the Jocassee Dam. Therefore, a licensee commitment to implement the procedure would not alter the staffs determination that the ONS does not provide adequate protection against flooding due to failure of the Jocassee Dam.

15See Duke's presentation to NRC dated October 28, 2009.

18 Duke Energy ONS "Evaluations by Station Management in the TSC - Beyond Design Basis Mitigation Strategies for Jocassee Dam Failure," EM 5.3 Revision 0.

7

"OrT',uiI USE ONLY - SEC - TD I ATI CONCLUSION The ONS licensee has not demonstrated that the ONS is adequately protected against external floods from failure of the Jocassee Dam. Backfitting of the ONS to require that the station be protected against flooding due to such failures, will provide defense in depth against external flooding. Accordingly, the staff concludes that such backfitting of the ONS is necessary to provide adequate protection to public health and safety and is justified under the adequate protection exception of 10 CFR 50.109 (a)(4)(ii)).

The ONS licensee must enhance the ONS defense-in-depth to ensure that there is a means of cooling the core, cooling spent fuel in the spent fuel pool, and maintaining containment integrity due to flooding resulting from failure of the Jocassee Dam.

8