ML14058A061
| ML14058A061 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 04/13/2010 |
| From: | Office of Information Services |
| To: | |
| Shared Package | |
| ML14055A421 | List:
|
| References | |
| FOIA/PA-2012-0325 | |
| Download: ML14058A061 (8) | |
Text
. ' ... ,;SCo , * -O . ' ,.;,
-EL\,
3 ',OI
- t...*.
- i~~iiA US OUX- SC~I~Y-RELATBED WWF0MA+RA~i DRAFT (April 13, 2010)
Oconee Nuclear Site Adequate Protection Backfit Documented Evaluation
SUMMARY
Duke Energy Carolinas, LLC, the licensee of the Oconee Nuclear Station (ONS) has not demonstrated that the ONS has adequate protection against external floods from all sources including a random failure of the Jocassee Dam. Based on this evaluation, the NRC staff concludes that this situation constitutes an adequate protection exception to the backfit rule under 10 CFR 50.109 (a)(4)(ii). As discussed below, if the Jocassee Dam fails and the Safe Shutdown Facility (SSF) is inundated, then the ONS will sastain core damage with a probability of 1.0 and containment failure with a probability of one.,IU should be noted that to our knowledge, neither Duke nor the staff has calculated ia probability of either spent fuel pool boiling or fuel damage. However, without spent fueiLpool cooling, given sufficient time, the water in the spent fuel pools will boil off and the spent.fuel will be damaged. It should also be noted that the Oconee spent fuel pools are located in the auxiliary building, outside of containment. Duke has not shown that inundation of the SSF is at a sufficiently low probability with respect to this external hazard to offset the extremely high.probability of core damage, spent fuel damage, and containment failure. Accordingly, the lic-ensee has not demonstrated that the public is adequately protected from external floods at the ONS site.
BACKGROUND Description of ONS Section 2.1.1.1, "Specification of Location," of the Updated Final Safety Analysis Report (UFSAR) describes the geographic.locatipn of ONS. ONS is located in eastern Oconee County, South Carolina, approximately'Z mniles~nortfeast of Seneca, South Carolina, at latitude 34o-47'-
38.2"N and longitude 82o-53'-55A.1,'W. Duke Power Company's Lake Keowee occupies the area immediately north and west fothe site. The Corps of Engineer's Hartwell Reservoir is south of the site. Duke's Lake Jocassee'lies approximately 11 miles to the north of the site.
Section 2.4.1.1, "Site and Facilities," of the UFSAR describes the hydrologic description. The yard grade is 796 feet (ft.) main sea level (msl.). The mezzanine floor elevation in the turbine, auxiliary, and service buildings is 796.5 ft. msl. The exterior accesses to these buildings are also at an elevation of 796.5 ft. msl. All of the man-made dikes and dams forming the Keowee reservoir rise to an elevation of 815 ft. msl., including the intake channel dike. The crest of the submerged weir in the intake canal is at an elevation of 770 ft. msl.
Regulatory Requirements and Guidance 10 CFR 50, Appendix A, General Design Criteria (GDC) 2, "Design Bases for protection against natural phenomena," states, "Systems Structures and Components (SSCs) important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, foods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these SSCs shall reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and
OFFICIAL Ub~ LJrILY ~cu"~rry- RELATED lr~ronr.,.'~r'oj~'
the surrounding area, with sufficient margin for the limited accuracy, quantity and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed."
The four sections in Chapter 2 of Standard Review Plan (SRP) NUREG-0800' that are directly related to the issue of external flooding are: (i) SRP Section 2.4.2, Rev.4, "Floods," (ii) SRP Section 2.4.3, Rev.4, "Probable Maximum Flood (PMF) on Streams and Rivers," (lii) SRP Section 2.4.4, Rev.3, "Potential Dam Failures," and (iv) SRP Section 2.4.10, Rev.3, "Flooding Protection Requirements." All four SRP Sections, above, make reference to ANSI/ANS-2.8-1992. Although the summary, below, primarily considers potential considerations for dam failures related to non-tidal stream flooding, it should be noted that SRP 2.4.5, Rev. 5, "Probable Maximum Surge and Seiche Flooding," also refers to ANSI(ANS-2.8-1992.
SRP Section 2.4.2, "Floods," provides guidance in performing safety reviews of historical flooding bases with respect to individual types of flood-producing phenomena.and combinations thereof. Guidance related to dam failure includes consideration of stream flooding with review of the PMF with coincident wind-induced waves due to dam failure potentially arising.,from (i) inadequate dam capacity, (ii) inadequate flood-discharge capability, or (iii) an existing physical condition. For seismically-induced dam failures, specific combinations of earthquake levels and flood characteristics for review are provided.
SRP Section 2.4.3, *Probable Maximum Fl'o'od PMF) on Streams and Rivers," provides guidance on the review of the hydro-meteorologicajldesign bases with respect to the extent of any flood protection required for safety-related SSCs, including applicable drainage area and runoff response characteristics. Figure 2.4.3-1 provides a schematic approach for the review of PMF that includes considerations for exit and proposed reservoirs in the region from information available from the US Corps of Engineers and the National Inventory of Dams.
SRP Section 2.4.4, "Potential Dam Failures," deals directly with guidance on the review of potential failures of onsite, upstream, and downstream water control structures. Specific areas identified with.respect to dam failure include dynamic effects (flood waves), cascading failures, and failure of :lisite water control or storage structures. SRP 2.4.4 also leaves open the possibijit, of consideringrother site-related evaluation criteria, specifically: 'The potential effects of seismiC,and non-seismic information on the postulated design bases and how they relate to dam failures in the vicinity of the site and the site region." Note: Although no specific guidance regarding the dam breach parameters (such as breach width and time to failure) is given in the body of the SRPI, references to technical literature dealing with dam breach are given in Section VI, "References," of the SRP, Duke is performing a revised flood inundation analysis using the computer code HEC-RAS, which is mentioned in Reference 9, "HEC-RAS River Analysis System," in this SRP.
SRP Section 2.4.10, "Flooding Protection Requirements," provides guidance on the comparison between the information reviewed in previous sections regarding the design-basis flood conditions and the potential effects on safety-related facilities for a given location and elevation.
Also included in the guidance are considerations of types of flood protection (e.g., "hardened facilities," sandbags, bulkhead, etc.) and emergency procedures, as outlined in RG 1.102.
Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants; LWR Edition (NUREG-0800) 2
Regulatory Guide (RG) 1.59, "Design Basis Floods for Nuclear Power Plants," references
.nGDC2a-d des-cribes acceptable me-tsoT-dte--fmring desigi-_ ass -fl-oods, while RG 1.102, "Flood Protection for Nuclear Power Plants," provides guidance on acceptable design requirements for flood protection. RG 1.59 references the American National Standards Institute (ANSI) Standard N170-1976 (ANSI 2.8), "Standards for Determining Design Basis Flooding at Power Reactor Sites," almost in its entirety as the source for estimating Probable Maximum Floods (PMF), with the exception of specific portions related to the evaluation of erosion failure.
In fact, ANS N170-1976 is used as a replacement for previous text included in Appendix A of RG 1.59, whereas Appendices B and C include simplified alternatives for estimating the PMF for non-tidal streams and the Probable Maximum Surge (PMS) for hurricanes at open-coast sites, respectively.
Oconee Licensing Basis Oconee's UFSAR Section 3.1.2, "Criterion 2 - Performance Standards (Category A)," describes how it accounts for external flood protection. Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shallbe desi"ed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) appropriate consideration for the most severe of these natural phenomena that have been recorded for the site and the surrounding areas and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.",
Section 2.4.2.1, "Flood Hi'stor'" Since Oconee is located near the ridgeline between the Keowee and the Little River valleys, or more than 100 ft. above the maximum known flood in either valley, the records of past floods are not directly applicable to siting considerations.
Section 2.4.2.2, "Flood Design Consideration:" Flood studies show that Keowee Dam and Jocassee Dam are designed with adequate marins to contain and control floods. These floods include general flooding of the rivers and reservoirs in the area due to a rainfall in excess of the Probable Maximum Precipitation (PMP). Therefore, external flooding due to rainfall affecting rivers and reservoirs is not a problem., 1n summary, flood studies show that the Lakes Keowee and Jocassee are designed with adequate margins to contain and control floods.
Section 2.4.4, "Potential Dam Failures, Seismically Induced:" The Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike, and the Intake Canal Submerged Weir have also been designed to have an adequate factor of safety under the same conditions of seismic loading as used for the design of Oconee.
The Jocassee Dam was evaluated for potential overtopping and seismic failures. After Duke concluded that the dam would not fail due to overtopping or a design based seismic event, the flooding scenario associated with the reservoir of water in Jocassee Lake was not included in their external flooding analysis.
History Duke performed an inundation study' in 1992 to meet a Federal Energy Regulatory Commission (FERC) requirement for formulating an emergency action plan in the event that the Jocassee Dam failed. This study showed that approximately 16.5 ft. of water would inundate the site.
In April 2006, while performing a Reactor Oversight Process (ROP) evaluation, the NRC staff questioned the licensee's maintenance of the SSF flood protection barrier. During the subsequent ROP Significance Determination Process (SDP), the NRC identified that the licensee had incorrectly calculated the Jocassee Dam failure frequency and had not adequately addressed the potential consequences of flood heights predicted at the Oconee site, based on the 1992 inundation study. The NRC staff also recognized that Duke's 1992 inundation stud ,
did not follow the guidelines for the PMF evaluation, as described in Regulatory Guides 1.59 and 1.1024.
The NRC sent a 10 CFR 50.54 (f) request for information on August 15, 20085.6. In response to this letter, in 2009, Duke conducted additional inundation analyses 7 consisting of one- and two-dimensional studies. These studies indicated that theresultaritýfood, which results in approximately 18.5 feet of water on the site, would cause the site to be inundated with flood waters. Duke, in its response to the 10 CFR 50.54 (f) letter, stated that the inundation will lead to core damage, containment failure, and the loss of spent fuel pool cooling at all three units.
Thus, if a flooding event from a Jocassee Dam failure occurred at the ONS, all three units have no defense-in-depth to prevent core damage. The remaining intact element of defense-in-depth of containment integrity will be severely challenged, if unmitigated, resulting in the potential for radionuclide release to be highly probable. These results have led the NRC to conclude that Duke lacks defense-in-depth to ensure that there is adequate protection at the ONS site against such floods.
As a result, the NRCexpressed, via the aforementioned 10 CFR 50.54(f) letter, a concern that Duke has not demonstrated ".. overall adequacy of the flood protection of Oconee given the Jocassee Hydro Project... Specifically, the NRC is .seeking information ... whether Oconee lacks appropriate and adequate compensating engineering safeguards for such an event."
Subsequent to Duke's response to the 10 CFR 50.54(f) letter, the NRC, in its April 20, 2009, letter8 stated, in part, "the NRC staff remains concerned that Duke has not demonstrated that Oconee will be adequately protected in the long term from external flooding events."
2 "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.
3 Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, JRev. 2) August 1977.
Regulatory Guide 1.102, "Flood Protection for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev.
- 1) September 1976.
5 Letter to D. Baxter of Duke Energy Carolinas, LLC, dated August 15, 2008, Information Request Pursuant to 10 CFR 50.54(f) related to External Flooding, Including Failure of the Jocassee Dam at ONS, (ML0816402440).
B Letter from D. Baxter of Duke Energy Carolinas, LLC, to US NRC, dated September 26, 2008.
7 See Duke's presentation to NRC dated October 28, 2009.
8 Letter to D. Baxter, Evaluation of Duke Energy Carolinas, LLC, September 26. 2008 Response to NRC Letter Dated August 15, 2008 Related to External Flooding at ONS (ML0905707791).
4
OrF:CIAL ~ ONLY - SECURITY~ REL~TID lill-URMA By letter dated January 15, 20109, Duke submitted a letter to the NRC which provided its interim compensatory measures (ICMs) to ensure that ONS will be adequately protected from external flooding events until the final mitigating strategies have been implemented and all site modifications have been completed. The NRC staff plans to perform a further review of the ICMs and will perform a future inspection.
Then, by letter dated January 29, 2010,1' the staff issued its response to Duke regarding its November 30, 2009 response to the NRC letter dated April 30, 2009, related to external flooding at ONS. The staff indicated that although Duke provided a more accurate estimate of the flooding caused by a failure of the Jocassee Dam, the staff found that additional information was needed. The information was needed for the staff to determine if the analyses performed to date will demonstrate, for the entire Jocassee earthen works, that ONS will be adequately protected from external flooding events. Duke submitted a preliminary set of responses to the staff's questions by letter dated March 5, 201011. The staff is currentlyreviewing Duke's responses to those questions, and expects Duke's supplemental response from Duke in June 2010.
ADEQUATE PROTECTION DETERMINATION TJ ua ý5 as required by MD 8.4 12 and LIC-202' 3) provides the basis for invoking the
("compliance" exdeption in 10 CFR 50.109 (a)(4)(ii). Under the Backfit Rule, the NRC may
"--- .ae a-btr*jdt, without preparation of a backfit analysis, if the NRC demonstrates, in a f 0=ocumented evaluation," that "regulatory action is necessary to ensure that the facility provides adequate protection to the health and safety of the:public and is in accord with the common defense and security.
Risk Evaluation of Flooding at ONS Due to Jocassee Dam Failure A generic failure rate evaluation was performed for the Jocassee Dam (ML100780084). Under the current licensing basis, should an external flood~exceed the height of flood protection, it will causelthe Oconee switchyard, the Keowee Dam, and the SSF all to fail resulting in a conditional core damage probability (CCDP) of unity (1.0). Spent fuel pool cooling will also be lost. At the onset of core damage,.containment integrity will be the only remaining initially intact defense-in-depth barrier. This barrier will be-severely challenged under these conditions due to a lack of power'to-,cool c;ontainmient-F t t -e _1(7(F accumulated debris and surrounding infrastructure damage, the attempt to recover the reactor building and spent.fuel pool heat removal will be at best difficult to accomplish. NRC has estimated that the failure frequency of Jocassee Dam based on industry data for rockfill dams is 9 Letter from D. Baxter of Duke Energy Corolinas, LLC, to US NRC. dated January 15, 2010 that addresses the Interim Compensatory Measures at ONS.
10 Letrer to D. Baxter of Duke Energy Carolinas, LLC, dated January 29, 2010, Evaluation of Duke's Response to NRC Letter Dated April 30, 2009 Related to External Flooding at ONS (ML100271591).
1"Letter from D. Baxter of Duke Energy Corolinas, LLC, to US NRC, dated March 5, 2010, Partial Response to NRC RAI dated February 3, 2010, Related to External Flooding at ONS.
12 NRC Directive 8.4, "Management of Facility-Specific Backfitting and Information Collection," October 28, 2004.
13NRC LIC-202 Revision 1, "Managing Plant-Specific Backfils and 50.54(f) Information Requests," December 20, 2006.
.5
-O.'=F*"- LA.L U-QF~AL4
.~nl , - LJ~IP ~f;I IL-Ij.n.
-. VI *mVW*T;,314*
1111 2.0 x 104 per year. This is the dam initiating event frequency (IEF). The resultant core damage frequency for this case is the product of the dam initiating event frequency and the conditional core damage probability, or CDF, = IEF x CCDP 1
= (2.0 x 10"4) x 1.0
= 2.0 x 104 per year for each unit uT Key importance to the staffs evaluation is that the inundation of the SSF at ONS will result in core melt, containment failure, and offsite releases with a probability of 1.0 This is unlike any other nuclear power plant currently in operation today, in which an external flood does not result in such a sequence withia probability of 1.0 This is because all other nuclear power plants provide some additional efense in d*.pth, thereby reducing the conditional core damage probability to something lessihan 1.0 However, in the case of a SSF inundation flood at ONS, no mitigation of core damage is pobsiole within the design ýbasis because there is no defense in depth for this particular failure sequence. The failure of ONS to provide defense in depth to address flooding, and the high level of risk for the plant due to flooding, lead the NRC staff to conclude that the ONS does not provide reasonable assurance of adequate protection against flooding attributable to failure of the Jocassee Dam.
Failure of the Jocassee Dam Based on the Probable Failure Mode Analysis (PFMA) for the Jocassee Dam, the most probable failure would result from excessive leakage in the left (east) abutment, resulting in a piping failure. The random sunny day failure commences with a piping failure from the left abutment. If a piping failure occurs in the left abutment, the licensee has estimated that the Jocassee Dam would potentially fail in approximately 2.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The flood waters from the Jocassee Dam breach would thenltravel down to the Keowee Dam, West Saddle Dam, and the Oconee Intake Dike. Tiis results in the Keowee Dam, West Saddle Dam, and the Oconee Intake Dike being overtopped. TheJicensee has estimated that the Keowee Dam would potentially fail approximatey' 2.8 ho"urs:,following the overtopping scenario; the West Saddle Dam would potentially fail approximately 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following the overtopping scenario; and the Oconee Intake Dike would potentially fail approximately 0.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the overtopping scenario.
The licensee does not directly address the failure of Jocassee Dam in the UFSAR for ONS, nor does the UFSAR address the 1992 inundation study. However, dams do fail and such failures are credible events. The industry failure rate on dams is well-documented14. The frequency of rupture of similarly constructed dams from all causes is estimated to be approximately 2.0 X104 events per year (ML100760108). This failure frequency places a Jocassee Dam failure in the frequency range of other limiting fault events considered in the Oconee accident analyses and licensing basis.
14 Baecher, G.B., M.E. Pate, and R. De Neulville (1980), 'Risk of Dam Failure in Benefit-Cost Analysis, Water Resource Research, 16(3), 449-456.
6
,I
- A
- G*Fl e -f E C'NL'v- CECURi i ' RELATED INFORMKATtG Flood Effects on ONS Based on the most current information that Duke has provided to the NRC 15, the breach of the Jocassee, Keowee, and West Saddle Dams and the Oconee Intake Dike would result in an inundation of the site with flood waters at an estimated 18.5 ft. of water. The site inundation will also result in several pieces of equipment being unavailable for accident mitigation. In the flooding scenario, the Keowee Dam will overtop and fail, resulting in the loss of the hydro-generators, located inside the Keowee Dam, which are the emergency Alternating Current (AC) onsite power supplies. The event will also render the switchyard, which is the offsite AC power source, unavailable. This drastically affects the normal mitigation methods, rendering all pumps and valves with AC motors, unavailable. The flood waters will also inundate the turbine building basement, where the emergency feedwater pump turbines are located for all three units, making them unavailable. The normal and alternate methods for providing reactor coolant makeup, decay heat removal, and associated power to shutdown all three Oconee units are unavailable.
This will leave only the SSF to mitigate the flooding event., The SSF was designed as an alternative means to achieve and maintain Mode 3 following postulated fire, sabotage or internal flooding events and is also credited during station blackout events. It achieves these requirements by being a source of reactor coolant makeup, decay heat removal, and associated power to shutdown all three Oconee units. Based on the aforementioned information that Duke has provided to the NRC, this will also be lost, due to the flooding waters of approximately 18.5 ft., since it is presently only protected by a 7.5 ft. wall. With the loss of the above mitigation equipment, this flooding inundation will lead to core damage, containment failure, and the loss of spent fuel pool cooling at all three units. Thus, if a flooding event from a Jocassee Dam failure occurred at the ONS, all three units have no defense-in-depth to prevent core damage.
Evaluation of Decay Heat Removal by Steam Generators and Spent Fuel Pool Cooling In February 2009, the licensee developed and submitted a procedure1" to address failure of Jocassee Dam with consequential failure of the SSF. This procedure involves adapting an existing B.5.b mitigating strategy to provide decay heat removal through steam generators and spent fuel pool cooling during.the period-of inundation. The NRC staff evaluated Engineering Manual (EM) ,5..3tusirg the SPAR-H HRA ('The SPAR-H Human Reliability Analysis Method,'
NUREG/CR 68 83,-August 2005):methodology to obtain a rough estimate of the human error probability (HEP) for thist'procedure. A rigorous analysis was not performed. SPAR-H was usedt'-*bet a sense of the probabilityoffailure. The human failure event was defined, success criteria stipulated, cues identified and performance shaping factors evaluated. The overall human error probability from this process was high, giving a result close to one. Due to the complexity of the mitigation strategy, the lack of rigor in the evaluation and the conservative nature of the SPAR-H methodology, no greater accuracy should be construed from this analysis. A more rigorous analysis may lower the failure probability somewhat, but the final result is anticipated to be between 0.1 and 1.0. From a PRA perspective, any reduction in core damage frequency gained from this procedure is minimal. The use of the licensee-proposed procedure would only minimally reduce the risk from flooding caused by failure of the Jocassee Dam. Therefore, a licensee commitment to implement the procedure would not alter the staff's determination that the ONS does not provide adequate protection against flooding due to failure of the Jocassee Dam.
1 See Duke's presentation to NRC dated October 28, 2009.
s Duke Energy ONS "Evaluations by Station Management in the TSC - Beyond Design Basis Mitigation Strategies for Jocassee Dam Failure," EM 5.3 Revision 0.
7
Ai.'
CONCLUSION The ONS licensee has not demonstrated that the ONS is adequately protected against external floods from failure of the Jocassee Dam. Backfitting of the ONS to require that the station be protected against flooding due to such failures, will provide defense in depth against external flooding. Accordingly, the staff concludes that such backfitting of the ONS is necessary to provide adequate protection to public he Jety and is justified under the adequate protection exception of 10 CFR 50.10Pr(a)(4)(ii)). "
The ONS licensee must enhance the OWS2ef nse-in-depth to ensure that there is a means of cooling the core, cooling spent fuel in the spen fuel pool, and maintaining containment integrity due to flooding resulting from failure of the Jo assee Dam.
V' SC ~ IL--- -
I K~-; ~Ct 8