ML14058A037

Email from M. Galloway, NRR to J. Mitman, NRR and L. James, NRR Revised Adequate Protection Backfit Documented Evaluation

ML14058A037
Person / Time
Site:	Oconee
Issue date:	01/06/2010
From:	Galloway M Division of License Renewal
To:	Lois James, Jeffrey Mitman Division of License Renewal
Shared Package
ML14055A421	List: ML090570117 ML090680737 ML091620669 ML092020480 ML092940769 ML100280954 ML101750619 ML101890803 ML102990064 ML103410042 ML12268A404 ML14055A410 ML14055A411 ML14055A474 ML14058A015 ML14058A016 ML14058A017 ML14058A018 ML14058A019 ML14058A020 ML14058A021 ML14058A022 ML14058A023 ML14058A024 ML14058A025 ML14058A026 ML14058A027 ML14058A028 ML14058A029 ML14058A030 ML14058A031 ML14058A032 ML14058A033 ML14058A034 ML14058A035 ML14058A036 ML14058A037 ML14058A038 ML14058A039 ML14058A040 ML14058A042 ML14058A043 ML14058A044 ML14058A045 ML14058A046 ML14058A047 ML14058A048 ML14058A049 ML14058A050 ML14058A051 ... further results
References
FOIA/PA-2012-0325
Download: ML14058A037 (12)

Text

Mitman, Jeffrey,/

From: Galloway, Melanie Sent: Wednesday, January 06, 2010 4:02 PM To: Mitman, Jeffrey; James, Lois

Subject:

RE: Revised Adequate Protection Backfit Documented Evaluation Thanks for getting this in the timeframe requested, Jeff.

I have read quickly and will need to spend a bit more time but I was surprised at some things so I wanted to pass that on.

I think there might have been some misunderstanding. When I talk in my comment three below about "The probability discussion needs to be expanded when discussing dam failure. We need to add why it's appropriate and correct to discuss all failure modes as part of this number.", I am talking about the 10-4 as being "this number" and discussing why, in calculating it, as we discussed with and without Mark, we need to make the case that all failure modes need to be considered in calculating that number. I didn't mean to actually discuss the failure modes, in this comment.

In fact, I am confused in the writeup by the argument, early on, that overtopping is not an issue and then later on, it is. This appears internally inconsistent and needs to be worked out.

Also, in my first approach option, I did not suggest that we actually include the can't get overtopping argument, but that we leave a blank for DE to try to make that case. And I thought you were going to take approach 2 in any case.

Lastly, at this juncture, your response 2 below is not an accurate characterization of what transpired earlier nor our followup conversations.

I will review more thoroughly and attempt to make more substantive comments.

Thanks for your input.

From: Mitman, Jeffrey \CC V Sent: Tuesday, January 05, 2010 10:18 PM To: Galloway, Melanie; James, Lois

Subject:

Revised Adequate Protection Backfit Documented Evaluation Melanie and Lois, I've revised the OFI Backfit Documented Evaluation considering DE's suggested changes, new information obtain since the last revision and your required modifications. The changes are shown in Word revision marks. Most of DE's suggested changes were justifying why overtopping and seismic issues were not concerns. This documented evaluation is not the place to make those arguments. The arguments should be made elsewhere and ifthe staff concludes that these issues are not a concern then the corresponding language should be removed from the documented evaluation. As this conclusion has not been agreed to, the original language remains.

Address Melanie's points one by one:

1) I concur that writing a generic documented evaluation is not the appropriate approach at this time. To my knowledge, no one has concluded that other plants have a backfit issue yet. In addition, if a site has a backfit issue for this documented evaluation to be applicable, the backfit issue at the other site would have to be determined to be an adequate protection issue. Finally, per MD 8.4 ifthere is a generic issue then MD 8.4 does not apply and instead the staff is to use the CRGR Charter. I have not reviewed this charter.

1

2) I have not incorporated your concerns regarding failure to meet "regulatory requirements." To my knowledge all previous discussions and analysis have characterized this issue as an adequate protection issue. The Backfit Rule does provide for a separate "backfit exclusion" for non-compliance with existing requirements. However, we have not used this argument. We have repeatedly analyzed the existing regulation (SRPs, RGs, NUREGs, standards, etc.) to show how ONS does not meet the existing requirements if it was being licensed today. However, Duke is not required to meet the current regulation, they are only required to meet the regulation at the time they were licensed (their licensing basis) or subsequent requirements that have met the Backfit Rule Regulatory Analysis process. My reading of the Backfit Rule indicates that to force Duke to meet the current regulation would require that we write a Regulatory Analysis which includes a cost-benefit analysis. I have not done this cost-benefit analysis, without it I do not know whether it would be cost justified.

3) I have expanded the risk argument to strengthen it and to address all failure modes. However, as indicated in my preliminary remarks, I believe that this backfit documented analysis is not the place to make these arguments. The arguments should be made external to this analysis and the conclusions incorporated here.

4) The purpose of this Backfit Documented Evaluation is to document why an adequate protection backfit exclusion is the appropriate mechanism for requiring a change to the ONS as per LIC-202 and MD 8.4. In the introductory paragraph, I've incorporated what I believe is the appropriate requirement of the proposed Order.

That is, 1) Duke should modify ONS so that it can withstand floods caused by external sources including a failure of the Jocassee Dam. 2) To increase the level of protection from that flood so that the ONS has defense in depth. 3) Modify the ONS licenses accordingly. If contrary to this document we are requiring additional information under 10CFR50.54(f) or some other rule, then this backfit adequate protection documented evaluation is not required.

Potential Approaches:

The organization of this document evaluation follows the requirements of LIC 202 and MD 8.4. In general it adheres to your second approach. That is it addresses external flooding from all sources. (With the exception that I have intended to remove any specific requirement to defend ONS from seismic failures.) I considered whether to include language specifying those failures mechanisms that need to be protected against.

However, because I'm concerned that by enumerating specific failure modes, I may inadvertently miss one or more, thus allowing Duke to ignore some failure modes. However, if you want an enumeration, I can add it.

I still need to prepare a document that describes why I believe overtopping has not been adequately address.

This document will also address why Jocassee Reservoir levels higher that 1110 also need to be evaluated.

Jeff From: Galloway, Melanie Sent: Thursday, December 24, 2009 11:46 AM To: James, Lois; Mitman, Jeffrey

Subject:

Thoughts on how to synthesize our discussions on Oconee flooding and adequate protection Lois and Jeff, I offer the following thoughts as my attempt to provide some structure on our completion of the adequate protection writeup to support an Order to Duke by Jan. 30, 2010.

1. In a discussion with Mark he had suggested that we write the AP writeup with generic applications in mind as this may need to be applied to other plants in the future. While a nice goal, I would like to suggest that we not focus on this at this time given the time-sensitive nature of the Oconee issue.

2. The AP writeup needs to clearly state, and then discuss each, the reasons why we have an AP issue. [note that while these are discussed, they are not structured this way so that the reader knows and can name them as our basis] The reasons are: a. complete lack of defense in depth and b. failure to meet our regulatory 2

requirements regarding protecting the plant from flooding. And then overlaid both of these is that the issue, when assessing a. and b., represents a significant risk.

Again, this needs to be clearly stated and each point supported as the basis for the AP argument. Headings in the writup may help with this structuring.

3. The probability discussion needs to be expanded when discussing dam failure. We need to add why it's appropriate and correct to discuss all failure modes as part of this number.

4. We need to work in what we believe needs to be included in the Order. For example, the licensee must submit to us a sensitivity assessment of the reservoir water level, up to their calculation of the PMF level. This discussion would tie with the guidance which describes assessing dam failure at the most severe water level.

Are their other items we believe Duke should submit? Include the case for them in the AP writeup.

Next, I give 2 approaches for the AP writeup. I am now tending toward the first but am not wedded to it.

First approach: Start out with external flooding as issue, initiating event frequency which includes all modes, then winnow out modes not to consider, so...

1. Include a robust technical discussion which defines why we do not consider seismic an AP issue--include Selim's assessment as the basis for that conclusion. We will need to leave a blank for DE to include the evalution of why liquefaction as raised by 2007 fragility study is not an issue.

2. Leave a space for DE to provide a robust technical discussion of why OT is not an AP issue. They will need to refer to Rex's assessment and include it. [the seismic writeup will serve as an example of what needs to be included]

3. Include a background document to the AP writeup which includes our contrary views to item 2 above so decision makers have ready access to it when considering the AP piece. Note that our contrary views on OT would have to include a discussion of the PMF and conditional probability of dam failure noting given the dependency between the two, the conditional probability is fairly high.

Second approach: Start out with external flooding as issue, inititiating event frequency which includes all modes but then only focus on random failures in the AP discussion so ...

1. Discussion of OT and seismic would be included only in the background document for decision makers consideration.

Lastly, we also need to begin to engage DE. There needs to be thought on what we need to convey. For instance, I think we need to define for them the big picture issues from the Nov. 30 Duke submittal that may include items (needs for additional information) for the Order (see above).

Our goal should be to have a revised writeup and to engage DE by Tuesday, Jan. 5.

Comments on my points above?

Melanie 3

Dconee Adequate Protection Backfil Documented Evaluation Draft S.doc ....- - Formatted: Font: Not Bold, Do not check la FIEB- F [' spelling or grammar 01-F-ICIAL USE ONY DRAFT Oconee Nuclear Site Adequate Protection Backfit Documented Evaluation BACKGROUND AND OBJECTIVES OF THE MODIFICATION Duke Energy Carolinas, LLC, the licensee of the Oconee Nuclear Station (ONS) has not demonstrated that the site has adequate protection against external floods from all sources including dam failure. These floods include failures of the Jocassee Dam which inundates the ONS. The objective of this documented evaluation (as required by MD 8.41 and LIC-2022) is to justify a backfit exception (under 10CFR50.109 (a) (4) (ii)) to modify the ONS licenses to ensure that the ONS has adequate protection against external floods and to maintain defense-in-depth.

Duke should enhance the ONS defense-in-depth such that all electrical power and means of cooling the core and maintaining containment integrity are not lost due to a failure of the Jocassee Dam.

REASON FOR THE LICENSE MODIFICATION This evaluation is a backfit exception which is defined in 10 CFR 50.109 (a) (4) (ii) as, "That regulatory action is necessary to ensure that the facility provides adequate protection to the health and safety of the public and is in accord with the common defense and security." To ensure adequate protection, the ONS is required to have n..'eeds 4toemoeialeat-,h,,

QNS-has-conservatism in its design and operation and a defense-in-depth approach to prevent accidents and mitigate their consequences.

NRC Directive 8.4. "Management ofFacility-specific Backfitting and Information Collection," October 28, 2004.

'NRC LIC-202 Revision I, "'Managing Plant-Specific Backlits and 50.54(t) Information Requests," December 20, 2006.

- C.;r;.AtL GE*OW C'l 9*"Ci""-IELATEO INFDRIV* 1M i DRAFT The licensee performed an inundation study3 in 1992 to meet a Federal Enermy Reaulatorv Commission (FERC) requirement for formulating an emergency action plan should the Jocassee Dam fail. In 2009 Duke in response to a 10 CFR 50.54(f) request for information dated Auaust 15. 20084.5 conducted additional (one- and for the first time two-dimensional) inundation analysis'. These studies indicated that the resultant flood would exceed the flood protection barrier height at the ONS. In rponco t- 10 FR 0..() request for info ti dated Auguct 15,j.. 8-.,the licensee reiterated, in their response to the 10 CFR 50.54(f) letter that this e.t.rnal floec hhinundate the standby sh,.dow facility'SSF) will lead W directlyto early core damage and loss of spent fuel pool cooling at all three units. Thus, if the ONS floods from a Jocassee Dam failure, three units have no defense in depth to prevent core damaqe. The remaining intact element of defense-in-depth of containment integrity will be severely challenged, if unmitigated, making the potential for radionuclide release highly probable. Th*, *i.ee. e porfarmod an inunation studVy in 1992 to meet a Fedoral Energy Regulator; CammFiccion (FERC) FogUircmcnet for forcmulating an em;:ergency action plan chould the Jon..cae Dam fail. This study indircatod that the ;r-ut"ant flood hoight would exr.ad the then current flood protection barrir height lcading to a p+tcnial .ore dam-agc.vn... Theseis results has-have led the NRC to conclude that the ONS lacks qsestieen-the-defense-in-depth, and therefore adequate protection ef-the-QNS-against such floods.

Ac dccr.ibod in the 1992 .nundatl,:e 'tudy, an external flood at the Oconee site is expected to render both the switchyard and Keowee Dam unavailable which are the sources of offsite and emergency onsite ac power, respectively. This will disable all ac driven equipment on site.

Emergency feedwater pump turbines for all three units will also be unavailable due to inundation. The SSF was designed as an alternative means to achieve and maintain Mode 3 following postulated fire, sabotage or internal flooding events and is also credited during station blackout events. It achieves these requirements by being a source of reactor coolant makeup, decay heat removal, and associated power to shut all three Oconee units down.

Though the SSF is not credited in the FSAR to protect against external floods, the entrances to the-S26- it were protected by a 5-foot wall, raised to 7.5 feet in February 2009. This wall is the only means to protect the SSF from onsite flooding from external sources. One such source of ONS inundation is from failure of the Jocassee Dam. The Jocassee Dam is a pumped storage hydro-electric facility located approximately 11 miles upstream of the site. Potential Mmechanisms that can cause failures of the Jocassee Dam include overtopping, seismic, probable maximum flood (PMF) events, and "sunny day" failures. The 1992 inundation study took into consideration rupture of the dam due to random sunny day failure and PMF only.

Previous to this analysis, Duke had excluded, as described in the ONS FSAR, both overtopping and seismic events. The 1992 inundation study reiterated that the Jocassee Dam would not overtop. The predicted resultant water levels from the inundation study, ranging from 12.5 feet to 16.8 feet at SSF grade, were found to be in excess of the existing flood mitigation barrier wall I"Jocassee Hydro Project, Dam Failure inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.

Letter to D.Baxter of Duke Energy Carolinas, LLC, dated August 15, 2008. Information Request Pursuant to 10 CFR 50.54(f) Related to Extemral Flooding, Including Failure of the Jocassee Dam at ONS, (ML0816402440).

Letter from D. Baxter of Duke Energy Carolinas. LLC, to US NRC, dated September 26, 2008.

See Duke presentation to NRC dated October 28, 2009.

Letter to D.Baxter of Duke Energy Carolinas. LLC, dated August 15, 2008, Information Request Pursuant to 10 CFR 50.54(f) Related to External Flooding, Including Failure of the Jocassee Dam at ONS, (ML0816402440).

KLetter from 0. Baxter of Duke Energy Carolinas, LLC, to US NRC, dated September 26. 2008.

' "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.

Paoe Wge-2

OFFI;IAL U9E ONLY7- --- - -KILA I u DRAFT height for the SSF. The new 2009 analysis currently indicate a flood height of about 18.5 feet.

Floodwater entering the SSF will overwhelm existing sump pumps, and due to the low critical flood heights, render the mitigation equipment in the facility non-functional. The failure of the SSF, based on current analyses and without further mitigation, will lead to failure of the only means to shut down and maintain all three Oconee units in a Mode 3 condition. The NRC I became aware of the 1992 study shortly after it was completed in 1992 but took no action at that time, Several sources of new Information were obtained over the last two years. They include:

l_.Lebt*_F-following an April 2006 Reactor Oversight Process (ROP) evaluation, when the evaluation questioned the licensee's maintenance of the SSF flood protection barrier. During the subsequent ROP Significance Determination Process (SDP), the NRC identified that the licensee had incorrectly calculated the Jocassee Dam failure frequency. Also, at this time the NRC recognized that the licensee had not adequately addressed the potential consequences of flood heights predicted at the Oconee site based on the 1992 inundation study. Additional new information was received when the licensee submitted a revised Jocassee Dam seismic fragility study10 in 2007. This new analysis raises questions about potential liquefaction at the Jocassee Dam during a seismic event. A final source of new information also occurred during the subsequent follow-up to the SDP, when the NRC recognized that, inconsistent with best practices, the 1992 inundation study did not take into consideration an antecedent storm as part of PMF evaluation as is directed by National Oceanic and Atmospheric Administration (NOAA)

Hydrometeorological Report Numbers 5111 and 5212 as is discussed in Regulatory Guides 1.5913 and 1.10214. This antecedent storm scenario could lead to an overtopping of the Jocassee Dam in a manner that might lead to more severe inundation at the ONS.

Subsequently, the staff indeoendently concluded that overtopping of the Jocassee Dam is not an issue. The computer generated Jocassee inflow hydrograph was used by the staff to evaluate various assumptions of turbine flow using the FERC approved antecedent moisture condition. Increasing the ordinates by 10%, approximates a more conservative antecedent moisture condition (Curve Number 74) as recommended by staff. The staff performed a calculation and determined that Jocassee Dam does not overtop even with the increased runoff from a curve number of 74 although freeboard is decreased (the computed water level was over a foot below the crest of the dam using the US Army HEC-1 computer program but above the low chord of the spillway bridge). Because the computed water level is slightly above the low chord of the bridqe over the spillway (1123.5 ft msl), the spillway rating curve was extended above 1123.5 ft assuming orifice flow through the bridge section.

The staff also independently concluded that seismicity is also not an issue for the Jocassee Dam. AEC had approved the seismic design of the Jocassee dam (based on its consultant's review of the ONS licensee's submittal.) FERC licensed the Jocassee dam had licensed the

') Duke Energy Carolinas, LLC Contract NE 23546 - "Letter Report and Transmittal of Supporting Data,"

January 29, 2007.

" Hydrometeorological Report No. 51, "Probable Maximum Precipitation Estimates, US East of the 105th Meridian," U.S. Department of Commerce, NOAA, June 1978.

12 Hydrometeorological Report No. 52, "Application of Probable Maximum Precipitation Estimates - US East of the 105th Meridian," U.S. Department of Commerce, NOAA, August 1982.

13 Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev. 2) August 1977.

14Regulatory Guide 1.102, "Flood Protection for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev. 1) September 1976.

Pae Page-3

• "-~tLUS*ULT - Or',-- RLAT NFOýR 4 DRAFT hydrooower oroject after satisfying itself about the seismic sgfety, As stated earlier, the liquefaction potential for well compacted saturated sands within the dam is low. Rock-fill dams have high resistance to seismic loads. The NRC staff has verified that the original construction data includina the compaction data were reviewed and aporoved at the time of construction.

The licensee's monitoring of monuments and piezometers inthe Jocassee Dam core and abutments indicates no significant movement of the dam, either inthe vertical or inthe horizontal direction even thouqh the dam has experienced several seismic events during its life time.. Rock-fill dams have high resistance to seismic loads. The current healthy condition of the dam has been confirmed by FERC's 2004 Failure Mode Analysis (PFMA) Reoort and its subsequent annual inspection reports. The seismic hazard for western South Carolina, where Jocassee Dam is located, has been reduced from 0.197 Qto <0.1 q.

As a result, the NRC expressed via the aforementioned 10CFR50.54 (f)letter, a concern that Duke has not demonstrated "... overall adequacy of the flood protection of Oconee given the Jocassee Hydro Project... Specifically, the NRC is seeking information ... whether Oconee lacks appropriate and adequate compensating engineering safeguards for such an event."

Subsequent to Duke's response to the 10CFR50.54 (f)letter, the NRC inits April 20, 2009, letter15 stated, inpart, "the NRC staff remains concerned that Duke has not demonstrated that Oconee will be adequately protected inthe long term from external flooding events."

By letter dated November 30. 2009, Duke submitted its response to the staffs 10 CFR 50.54(f) letter, which included its Case 2 parameters and sensitivity analysis. Duke's Case 2 inundation analysis results envelooe the breach size that the NRC staff calculated usinq the Froelich equation. The results of Case 2 identified a flood height of 18 ft at the SSF. which is greater than the flood level identified from the 1992 inundation study (ranging from 12.5 feet to 16.8 feet at SSF grade). Itshould be noted, however, that the staff is currently assessing the Case 2 analysis for the Jocassee earthwork structures. Duke also provided its repair plans and schedules inits corrective action plan. Duke indicated that itolans to submit interim corrective measures by March 31, 2010, and will finalize its constructability and feasibility assessment by October 2010 and submit its modification design and implementation schedule by November 2010. The staff remains concerned regarding the timeliness of the interim corrective measures as well as the final repairs based on the fact that the Case 2 inundation analysis has identified a flood height of 18 ft at the SSF.

BASIS FOR INVOKING BACKFIT EXCEPTION The NRC believes this situation qualifies for an adequate protection exception to the backfit rule under 10 CFR50.109 (a) (4) (ii). As discussed previously, if the Jocassee Dam fails and the SSF is inundated, the Oconee site has no defense-in-depth to prevent core damage and the containments are expected to subsequently fail. Following a Jocassee Dam failure which inundates the SSF, without defense-in-depth Duke has not shown that the public is adequately protected.

The following discusses the relevant flooding requirements, Duke's position on those requirements and the NRC's perspective on whether ONS meets those requirements.

1. To account for external flood protection, Oconee is licensed to a draft General Design Criterion (GDC) 2 which states:

IS Letter to D. Baxter. Evaluation of Duke Energy Carolinas. LLC. September 26, 2008. Response to NRC letter Dated August 15, 20081Related to External Flooding at ONS (ML0905707791).

ELPa0e-4

r DRAFT Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) appropriate consideration for the most severe of these natural phenomena that have been recorded for the site and the surrounding areas and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.

2. To establish the licensing basis for the ONS compliance on external flood, the Oconee UFSAR 1 6 further states in Section 9.6.3.1 on the SSF:

Flood studies show that Lake Keowee and Jocassee are designed with adequate margins to contain and control floods. The first is a general flooding of the rivers and reservoirs in the area due to a rainfall in excess of the Probable Maximum Precipitation (PMP). The FSAR addresses Oconee's location as on a ridgeline 100' above maximum known floods. Therefore, external flooding due to rainfall affecting rivers and reservoirs is not a problem. The SSF is within the site boundary and, therefore, is not subject to flooding from lake waters. The grade level entrance of the SSF is 797.0 feet above mean sea level (msl). In the event of flooding due to a break in the non-seismic condenser circulating water (CCW) system piping located in the Turbine Building, the maximum expected water level within the site boundary is 796.5 ft. Since the maximum expected water level is below the elevation of the grade level entrance to the SSF, the structure will not be flooded by such an incident. The SSF will stabilize the plant at mode 3 with an average Reactor Coolant temperature of 525°F. As a PRA enhancement the SSF is provided with a five foot external flood wall which is equipped with a water tight door near the south entrance of the SSF. A stairway over the wall provides access to the north entrance. The yard elevation at both the north and the south entrance to the SSF is 796.0 feet above mean sea level (msl). Based on the as-built configuration of the 5' flood wall provided at the north entrance and a flood wall at the south entrance to the SSF, SSF external flood protection is provided for flooding that does not exceed 801 feet above mean sea level. [801 feet above mean sea level corresponds to 5 feet above SSF entrance grade level].

And in USFAR Section 2.4.4 on the Oconee Site hydrology:

Duke has designed the Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike, and the Intake Canal Submerged Weir based on sound Civil Engineering methods and criteria. These designs have been reviewed by a board of consultants and reviewed and approved by the Federal Power Commission in accordance with the license issued by that agency. The Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike, and the Intake Canal Submerged Weir have also been designed to have an adequate factor of safety under the same conditions of seismic loading as used for design of Oconee. The construction, maintenance, and inspection of the dams are consistent with their functions as major hydro projects. The safety of such structures is the major Duke Energy Company Updated Final Safety Analysis Report. Revision 17. December 31, 2007.

PFcie ae-5

o;-F;CiAL U;3."E eL' - oECURITY-RELATED INFORMAI' DRAFT objective of Duke's designers and builders, with or without the presence of the nuclear station.

The UFSAR sections are substantially unchanged from the previous version. The licensee does not directly address the failure of Jocassee Dam in the UFSAR nor does the UFSAR address the 1992 inundation study. Duke concludes that: 1) the Jocassee Dam ceana-not fail due to overtopping as the Jocassee Reservoir will never fill to the top of the dam, and 2) the Jocassee and the Keowee Dams will not fail seismically due to their design. As discussed above, the staff has verified that these conclusions are non-credible events for the Jocassee Dam.

[I need help here.., can we iust discuss random sunny day failure and not discuss overtopping and seismic?l However., Though this or. not new- information, bcau.e of the currRnt :loe ScrUtiF1y- of the j0C3U~~tAl pin.,ut~onr o rr~o.torr~1.i

-Ao u urn~3 Mr~Wr to.g... Y:.ith there o.n.lul.ons w.thout

, urthr* information Or @nalyicwr from the licnscee.

Absent updated .i.nfrmation to the o.ntra.y, the NR. hac concludedthat-.. ch failures could F-ormatted: Font color: Red bea.crqediblbe events for damswhich are well-documented in industy failure data on dams. -Formatted: Font color: Red The frequency of rupture of similarly constructed dams from all causes, estimated to be Formatted: Font Color. Red approximately 104 events per year, places a Jocassee Dam failure in the frequency range of other limiting fault events considered in the Oconee accident analyses and licensing basis. For those other limiting fault events, there is mitigation capability which reduces the likelihood of core damage and radionuclide release. However, in the case of a SSF inundation flood, no mitigation of core damage is possible within the design basis.

In the Oconee licensing basis, the licensee specifically cites that protection be provided against natural phenomena and flooding events. The NRC clarified the regulatory position on external flooding in Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants." The regulatory position of dam failure states in part, "Where upstream dams or other features that provide flood protection are present, in addition to the analyses of the most severe floods that may be induced by either hydrometeorological or seismic mechanisms, reasonable combinations of less-severe flood conditions and seismic events should also be considered to the extent needed for a consistent level of conservatism. The effect of such combinations on the flood conditions at the plant site should be evaluated in cases where the probability of such combinations occurring at the same time and having significant consequences is at least comparable to the probability associated with the most severe hydrometeorological or seismically induced flood." This illustrates that Duke must address protection against events such as overtopping due to precipitation and seismically-induced failures. The current licensing basis of ONS clearly requires that the licensee must be able to protect against floods without regard to source, due to natural phenomena.--------------------------------- - -_ - Formatted: Font color: Red The 1992 inundation study has gone beyond concentrating on natural phenomena-caused failures of the Jocassee Dam to demonstrate that a PMF could also be the result of a random "sunny day" failure of the dam producing an Oconee site flood beyond the current flood mitigation capability of the SSF. As a logical conclusion, the NRC has ascertained that the ONS licensing basis should not be limited to floods caused by natural phenomena alone but, should include the impact of all credible sources of flood such as those arising from a random "sunny day" failure of the dam. As with the current licensing basis, the assessment of all potential sources of flood, including those arising from randorr% overtoppng and seismic failues, must_ - tted: Font color: Red include the most severe case with margin to properly account for uncertainties. The 1992 Page Reg-6

DRAFT inundation study clearly concludes that a flood with a maximum height of 16.8 feet will exceed the 7.5-foot SSF grade level flood protection. More recently. Duke's Case 2 inundation analysis results identified a flood height of 18 ft at the SSF.A ,nc- draft in-dýti,, i, ac yct n,,cuc'ic m; th is'-rs.ee Therefore, the site currently has not demonstrated that adequate protection against flood is provided. To correct this, the NRC has statutory authority to impose additional condition(s) on the license in order to ensure that the licensee provides adequate protection against the effect of external floods, regardless of source. The basis for this authority has been established and communicated to the industry when evaluating licensing amendment requests as part of RIS-2001-02 which states:

When a license amendment request complies with the regulations and other license requirements, there is a presumption by the Commission of adequate protection of public health and safety (Maine Yankee, ALAB-161, 6 AEC 1003 (1973)). However, circumstances may arise in which new information reveals an unforeseen hazard or a substantially greater potential for a known hazard to occur, such as identification of a design vulnerability or an issue that substantially increases risk. In such situations, the NRC has the statutory authority to require licensee action above and beyond existing regulations to maintain the level of protection necessary to avoid undue risk to public health and safety. Section 182.a of the Atomic Energy Act of 1954, as amended, and as implemented by 10 CFR 2.102, gives the NRC the authority to require the submittal of information in connection with a license amendment request if NRC has reason to question adequate protection of public health and safety.

ASSESSMENT OF SAFETY SIGNIFICANCE An evaluation of the impact on public safety of invoking this proposed addition to the license was performed. Two cases were developed and compared to estimate the potential decrease in risk. The first case assumes the current licensing basis which does not take into account failure of Jocassee Dam. In this case, a rupture of the dam will directly result in loss of the SSF following with core damage and potential radionuclide release. The second case models a proposed SSF modification, hardening it against external floods by installation of watertight doors at the entrances and associated re-engineering of ventilation and exhaust lines above calculated flood height. Other solutions to increase adequate protection are possible, for example raising the Keowee Dam and intake canal dike heights. This example analyzes only one possible approach.

Pa.e 93ge-7

ýO ý- ýLATED INFORý DRAFT

1. Current licensing basis not meeting adequate protection.

Under the current licensing basis, should an external flood exceeding the height of flood protection occur, it will fail the Oconee switchyard, the Keowee Dam, and the SSF with a conditional core damage probability (CCDP) of unity (1.0). Spent fuel pool cooling will also be lost. At the onset of core damage, containment integrity will be the only remaining initially intact defense-in-depth barrier. This barrier will be severely challenged under these conditions due a lack of power to cool containment. In addition, boil-off of the spent fuel pools is assumed to occur regardless of containment status resulting in an immediate radionuclide release as the spent fuel pools are outside containment. The attempt to recover reactor building and spent fuel pool heat removal after floodwater recession to mitigate a release will be at best difficult to accomplish due to accumulated debris and surrounding infrastructure damage. NRC has estimated that the failure frequency of Jocassee Dam based on industry data for rockfill dams is 2.0 x 104 per year. This is the dam initiating event frequency (IEF). The resultant core damage frequency for this case is the product of the dam rupture frequency and the conditional core damage probability, or CDF 1 = IEF x CCDP 1

= (2.0 x 104) x 1.0

= 2.0 x 104 per year for each unit

2. Proposed change to licensing basis to include mitigation of external flood.

The proposed change would provide additional mitigation capability by improving the flood protection of the SSF from a Jocassee Dam failure. This proposed passive modification for external flood protection involves installing watertight doors at the SSF entrances and performing associated engineering to relocate lines in order to clear the highest computed flood height. In this modification, the probability of watertight door failure is estimated to be 7.4 x 10i3 per demand1 7. The licensee has computed that the random probability of failure of the SSF is 0.2718. Therefore, the resultant core damage frequency of this case is:

CDFý = IEF x CCDP 2

= (2.0 x 10"4) x (7.4 x 10-3 + 0.27)

= 5.4 x 10.5 per year for each unit The calcu~ited decrease in core damage frequency is:

ACDF = CDF 1 - CDF 2

= (2.0 x 10.A) - (5.4 x 10-5)

= 1.5 x 104 per year for each unit This calcu iarion shows that a significant decrease in risk can be achieved with the proposed modification. The licensee believes that the dam failure frequency is somewhat lower than the value used in these calculations. A lower frequency will lower the risk reduction proportionately.

2 US NRC-RES/EPRI, "Fire PRA Methodology for Nuclear Power Facilities", NUREG/CR-6850, Rev. 0, 11/2005, Table 11-3.

"3Duke Power Company, "IPEEE Submittal", December 21, 1995. The quanlified unavailability is due mostly to human error probabilities arising from several manual operator actions that need to be completed inorder for the SSF to be successful to Mode 3.

PaE~e Paeg8

OF-F,~lef USE4OIWY - SE I yiiL.m~ rrr1T DRAFT Regardless of the precise value of dam failure frequency and therefore, the risk reduction, Duke has not demonstrated the Oconee has appropriate conservatism in its design and operation and an adequate defense-in-depth approach to prevent accidents and mitigate their consequences.

In February 2009, the licensee developed and submitted a procedure" to address failure of Jocassee Dam with consequential failure of the SSF. This procedure involves adapting an existing B.5.b mitigating strategy to provide decay heat removal through steam generators and spent fuel pool cooling during the period of inundation. The NRC staff has evaluated this procedure. It relies on many licensee operator actions to accomplish this goal. From a PRA perspective, any reduction in core damage frequency gained from this procedure is minimal.

Therefore, credit for using this procedure was not included in the above risk assessment.

CONCLUSION As described above, Duke has not demonstrated that the ONS is adequately protected against external floods from all sources including dam ruptures.

', Duke Energy ONS "Evaluations by Station Management in the TSC - Beyond Design Basis Mitigation Strategies for Jocassee Dam Failure," EM 5.3 Revision 0.

Page PaWe9