ML14058A036
| ML14058A036 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 12/14/2009 |
| From: | Khanna M K Plant Licensing Branch 1 |
| To: | Mitman J T NRC/NRR/DRA |
| Shared Package | |
| ML14055A421 | List:
|
| References | |
| FOIA/PA-2012-0325 | |
| Download: ML14058A036 (9) | |
Text
-,_ ':,Mitman, JeffreyFrom:Sent:To:Cc:
Subject:
Attachments:
Khanna, Meena I .Monday, December 14, 2009 8:55 PMMitman, JeffreyWilson, GeorgeOconee Adequate Protection Backfit Documented Evaluation
-DraftOconee Adequate Protection Backfit Documented Evaluation Draft 7.docJeff, could we pls discuss...
Your writeup was great...
thanks. I just updated a few sections.
- However, I need to talk to you and Georgeabout the items in red font, basically how we want to address overtopping and seismicity...
I included our basisfor taking then off the table, but not sure how that impacts the risk agreement.
Thanks,Meena DRAFTOconee Nuclear SiteAdequate Protection BackfitDocumented Evaluation BACKGROUND AND OBJECTIVES OF THE MODIFICATION Duke Energy Carolinas, LLC, the licensee of the Oconee Nuclear Station (ONS) has notdemonstrated that the site has adequate protection against external floods from all a sunny dayrandom failure.
These floods include failures of the Jocassee Dam which inundates the ONS.The objective of this documented evaluation (as required by MD 8.41 and LIC-2022) is to justifya backfit exception (under 1OCFR50.109 (a) (4) (ii)) to modify the ONS licenses to ensure thatthe ONS has adequate protection against external floods and to maintain defense-in-depth.
Duke should enhance the ONS defense-in-depth such that all electrical power and means ofcooling the core and maintaining containment integrity are not lost due to a failure of theJocassee Dam.REASON FOR THE LICENSE MODIFICATION This evaluation is a backfit exception which is defined in 10 CFR 50.109 (a) (4) (ii) as, "Thatregulatory action is necessary to ensure that the facility provides adequate protection to thehealth and safety of the public and is in accord with the common defense and security."
Toensure adequate protection, Duke needs to demonstrate that the ONS has conservatism in itsdesign and operation and a defense-in-depth approach to prevent accidents and mitigate theirconsequences.
In response to a 10 CFR 50.54(f) request for information dated August 15, 20083-4, the licenseereiterated that external floods which inundate the standby shutdown facility (SSF) will lead toearly core damage and loss of spent fuel pool cooling at all three units. The remaining intactelement of defense-in-depth of containment integrity will be severely challenged, if unmitigated, making the potential for radionuclide release highly probable.
The licensee performed aninundation study5 in 1992. to meet a Federal Energy Regulatory Commission (FERC)requirement for formulating an emergency action plan should the Jocassee Dam fail. This studyindicated that the resultant flood height would exceed the then current flood protection barrierheight leading to a potential core damage event. This result has led the NRC to question thedefense-in-depth and adequate protection of the ONS against such floods.As described in the 1992 inundation study, an external flood at the Oconee site is expected torender both the switchyard and Keowee Dam unavailable which are the sources of offsite andemergency onsite ac power, respectively.
Emergency feedwater pump turbines for all threeunits will also be unavailable due to inundation.
The SSF was designed as an alternative means to achieve and maintain Mode 3 following postulated fire, sabotage or internal flooding1 NRC Directive 8.4, "Management of Facility-specific Backfitting and Information Collection,"
October 28, 2004.2 NRC LIC-202 Revision 1, "Managing Plant-Specific Backfits and 50.54(f)
Information Requests,"
December 20,2006.3 Letter to D. Baxter of Duke Energy Carolinas, LLC, dated August 15, 2008, Information Request Pursuant to10 CFR 50.54(f)
Related to External
- Flooding, Including Failure of the Jocassee Dam at ONS, (ML0816402440).
4 Letter from D. Baxter of Duke Energy Carolinas, LLC, to US NRC, dated September 26, 2008.5 "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) ProjectsNo. 2503, December 1992.
DRAFTevents and is also credited during station blackout events. It achieves these requirements bybeing a source of reactor coolant makeup, decay heat removal, and associated power to shut allthree Oconee units down.Though not credited in the FSAR to protect against external floods, the entrances to the SSFwere protected by a 5-foot wall, raised to 7.5 feet in February 2009. This wall is the only meansto protect the SSF from onsite flooding.
One such source of ONS inundation is from failure ofthe Jocassee Dam. The Jocassee Dam is a pumped storage hydro-electric facility locatedapproximately 11 miles upstream of the site. Mechanisms that can cause failures of theJocassee Dam include overtopping,
- seismic, probable maximum flood (PMF) events, and"sunny day" failures.
The 1992 inundation study took into consideration rupture of the dam dueto random sunny day failure and PMF only. Previous to this analysis, Duke had excluded, asdescribed in the ONS FSAR, both overtopping and seismic events. The 1992 inundation studyreiterated that the Jocassee Dam would not overtop.
The predicted resultant water levels fromthe inundation study, ranging from 12.5 feet to 16.8 feet at SSF grade, were found to be inexcess of the existing flood mitigation barrier wall height for the SSF. Floodwater entering theSSF will overwhelm existing sump pumps, and due to the low critical flood heights, render themitigation equipment in the facility non-functional.
The failure of the SSF, based on currentanalyses and without further mitigation, will lead to failure of the only means to shut down andmaintain all three Oconee units in a Mode 3 condition.
The NRC became aware of the studyshortly after it was completed in 1992 but took no action at that time.Information was obtained following an April 2006 Reactor Oversight Process (ROP) evaluation, when the evaluation questioned the licensee's maintenance of the SSF flood protection barrier.During the subsequent ROP Significance Determination Process (SDP), the NRC identified thatthe licensee had incorrectly calculated the Jocassee Dam failure frequency.
Also, at this timethe NRC recognized that the licensee had not adequately addressed the potential consequences of flood heights predicted at the Oconee site based on the 1992 inundation study. Additional new information was received when the licensee submitted a revisedJocassee Dam seismic fragility study6 in 2007. This new analysis raises questions aboutpotential liquefaction at the Jocassee Dam during a seismic event. A final source of newinformation also occurred during the subsequent follow-up to the SDP, when the NRCrecognized that, inconsistent with best practices, the 1992 inundation study did not take intoconsideration an antecedent storm as part of PMF evaluation as is directed by National Oceanicand Atmospheric Administration (NOAA) Hydrometeorological Report Numbers 517 and 528 asis discussed in Regulatory Guides 1.599 and 1.10210.
This antecedent storm scenario couldlead to an overtopping of the Jocassee Dam in a manner that might lead to more severeinundation at the ONS.6 Duke Energy Carolinas, LLC Contract NE 23546 -"Letter Report and Transmittal of Supporting Data,"January 29, 2007.7 Hydrometeorological Report No. 51, "Probable Maximum Precipitation Estimates, US East of the 105thMeridian,"
U.S. Department of Commerce, NOAA, June 1978.8 Hydrometeorological Report No. 52, "Application of Probable Maximum Precipitation Estimates
-USEast of the 105th Meridian,"
U.S. Department of Commerce, NOAA, August 1982.9 Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants,"
U.S. Nuclear Regulatory Commission, (Rev. 2) August 1977.10 Regulatory Guide 1.102, "Flood Protection for Nuclear Power Plants,"
U.S. Nuclear Regulatory Commission, (Rev. 1) September 1976.Page 2 DRAFTSubsequently, the staff independently concluded that overtopping of the Jocassee Dam is notan issue. The computer generated Jocassee inflow hydrograph was used by the staff toevaluate various assumptions of turbine flow using the FERC approved antecedent moisturecondition.
Increasing the ordinates by 10%, approximates a more conservative antecedent moisture condition (Curve Number 74) as recommended by staff. The staff performed acalculation and determined that Jocassee Dam does not overtop even with the increased runofffrom a curve number of 74 although freeboard is decreased (the computed water level was overa foot below the crest of the dam using the US Army HEC-1 computer program but above thelow chord of the spillway bridge).
Because the computed water level is slightly above the lowchord of the bridge over the spillway (1123.5 ft msl), the spillway rating curve was extendedabove 1123.5 ft assuming orifice flow through the bridge section.The staff also independently concluded that seismicity is also not an issue for the JocasseeDam. AEC had approved the seismic design of the Jocassee dam (based on its consultant's review of the ONS licensee's submittal.)
FERC licensed the Jocassee dam had licensed thehydropower project after satisfying itself about the seismic safety. As stated earlier, theliquefaction potential for well compacted saturated sands within the dam is low. Rock-fill damshave high resistance to seismic loads. The NRC staff has verified that the original construction data including the compaction data were reviewed and approved at the time of construction.
The licensee's monitoring of monuments and piezometers in the Jocassee Dam core andabutments indicates no significant movement of the dam, either in the vertical or in thehorizontal direction even though the dam has experienced several seismic events during its lifetime.. Rock-fill dams have high resistance to seismic loads. The current healthy condition ofthe dam has been confirmed by FERC's 2004 Failure Mode Analysis (PFMA) Report and itssubsequent annual inspection reports.
The seismic hazard for western South Carolina, whereJocassee Dam is located, has been reduced from 0.197 g to <0.1 g.As a result, the NRC expressed via the aforementioned 10 CFR50.54 (f) letter, a concern thatDuke has not demonstrated
"...overall adequacy of the flood protection of Oconee given theJocassee Hydro Project...
Specifically, the NRC is seeking information
... whether Oconeelacks appropriate and adequate compensating engineering safeguards for such an event."Subsequent to Duke's response to the 10CFR50.54 (f letter, the NRC in its April 20, 2009,letter11 stated, in part, "the NRC staff remains concerned that Duke has not demonstrated thatOconee will be adequately protected in the long term from external flooding events."By letter dated November 30, 2009, Duke submitted its response to the staff's 10 CFR 50.54(f)letter, which included its Case 2 parameters and sensitivity analysis.
Duke's Case 2 inundation analysis results envelope the breach size that the NRC staff calculated using the Froelichequation.
The results of Case 2 identified a flood height of 18 ft at the SSF, which is greaterthan the flood level identified from the 1992 inundation study (ranging from 12.5 feet to 16.8 feetat SSF grade). It should be noted, however, that the staff is currently assessing the Case 2analysis for the Jocassee earthwork structures.
Duke also provided its repair plans andschedules in its corrective action plan. Duke indicated that it plans to submit interim corrective measures by March 31, 2010, and will finalize its constructability and feasibility assessment byOctober 2010 and submit its modification design and implementation schedule by November2010. The staff remains concerned regarding the timeliness of the interim corrective measuresas well as the final repairs based on the fact that the Case 2 inundation analysis has identified aflood height of 18 ft at the SSF.'1 Letter to D. Baxter, Evaluation of Duke Energy Carolinas, LLC, September 26, 2008, Response to NRC letterDated August 15, 2008.Related to External Flooding at ONS (ML0905707791).
Page 3 DRAFTBASIS FOR INVOKING BACKFIT EXCEPTION The NRC believes this situation qualifies for an adequate protection exception to the backfit ruleunder 10 CFR50.109 (a) (4) (ii). As discussed previously, if the Jocassee Dam fails and theSSF is inundated, the Oconee site has no defense-in-depth to prevent core damage and thecontainments are expected to subsequently fail. Following a Jocassee Dam failure whichinundates the SSF, without defense-in-depth Duke has not shown that the public is adequately protected.
The following discusses the relevant flooding requirements, Duke's position on thoserequirements and the NRC's perspective on whether ONS meets those requirements.
- 1. To account for external flood protection, Oconee is licensed to a draft General DesignCriterion (GDC) 2 which states:Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of theirconsequences shall be designed, fabricated, and erected to performance standards thatwill enable the facility to withstand, without loss of the capability to protect the public, theadditional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects.
The design basesso established shall reflect:
(a) appropriate consideration for the most severe of thesenatural phenomena that have been recorded for the site and the surrounding areas and(b) an appropriate margin for withstanding forces greater than those recorded to reflectuncertainties about the historical data and their suitability as a basis for design.2. To establish the licensing basis for the ONS compliance on external flood, the OconeeUFSAR12 further states in Section 9.6.3.1 on the SSF:Flood studies show that Lake Keowee and Jocassee are designed with adequatemargins to contain and control floods. The first is a general flooding of the rivers andreservoirs in the area due to a rainfall in excess of the Probable Maximum Precipitation (PMP). The FSAR addresses Oconee's location as on a ridgeline 100' above maximumknown floods. Therefore, external flooding due to rainfall affecting rivers and reservoirs is not a problem.
The SSF is within the site boundary and, therefore, is not subject toflooding from lake waters. The grade level entrance of the SSF is 797.0 feet abovemean sea level (msl). In the event of flooding due to a break in the non-seismic condenser circulating water (CCW) system piping located in the Turbine Building, themaximum expected water level within the site boundary is 796.5 ft. Since the maximumexpected water level is below the elevation of the grade level entrance to the SSF, thestructure will not be flooded by such an incident.
The SSF will stabilize the plant atmode 3 with an average Reactor Coolant temperature of 525°F. As a PRAenhancement the SSF is provided with a five foot external flood wall which is equippedwith a water tight door near the south entrance of the SSF. A stairway over the wallprovides access to the north entrance.
The yard elevation at both the north and thesouth entrance to the SSF is 796.0 feet above mean sea level (msl). Based on the as-built configuration of the 5' flood wall provided at the north entrance and a flood wall atthe south entrance to the SSF, SSF external flood protection is provided for flooding that12 Duke Energy Company Updated Final Safety Analysis Report, Revision 17, December 3 I, 2007.Page 4 DRAFTdoes not exceed 801 feet above mean sea level. [801 feet above mean sea levelcorresponds to 5 feet above SSF entrance grade level].And in USFAR Section 2.4.4 on the Oconee Site hydrology:
Duke has designed the Keowee Dam, Little River Dam, Jocassee Dam, Intake CanalDike, and the Intake Canal Submerged Weir based on sound Civil Engineering methodsand criteria.
These designs have been reviewed by a board of consultants and reviewedand approved by the Federal Power Commission in accordance with the license issuedby that agency. The Keowee Dam, Little River Dam, Jocassee Dam, Intake Canal Dike,and the Intake Canal Submerged Weir have also been designed to have an adequatefactor of safety under the same conditions of seismic loading as used for design ofOconee. The construction, maintenance, and inspection of the dams are consistent withtheir functions as major hydro projects.
The safety of such structures is the majorobjective of Duke's designers and builders, with or without the presence of the nuclearstation.The UFSAR sections are substantially unchanged from the previous version.
The licensee doesnot directly address the failure of Jocassee Dam in the UFSAR nor does the UFSAR addressthe 1992 inundation study. Duke concludes that: 1) the Jocassee Dam cannot fail due toovertopping as the Jocassee Reservoir will never fill to the top of the dam, and 2) the Jocasseeand the Keowee Dams will not fail seismically due to their design. As discussed above, the staffhas verified that these conclusions are non-credible events for the Jocassee Dam.[I need help here... can we just discuss random sunny day failure and not discuss overtopping and seismic?}
- However, such failures could be credible events for dams, which are well-documented inindustry failure data on dams. The frequency of rupture of similarly constructed dams from allcauses, estimated to be approximately 104 events per year, places a Jocassee Dam failure inthe frequency range of other limiting fault events considered in the Oconee accident analysesand licensing basis. For those other limiting fault events, there is mitigation capability whichreduces the likelihood of core damage and radionuclide release.
- However, in the case of a SSFinundation flood, no mitigation of core damage is possible within the design basis.In the Oconee licensing basis, the licensee specifically cites that protection be provided againstnatural phenomena and flooding events. The NRC clarified the regulatory position on externalflooding in Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants."
Theregulatory position of dam failure states in part, "Where upstream dams or other features thatprovide flood protection are present, in addition to the analyses of the most severe floods thatmay be induced by either hydrometeorological or seismic mechanisms, reasonable combinations of less-severe flood conditions and seismic events should also be considered tothe extent needed for a consistent level of conservatism.
The effect of such combinations onthe flood conditions at the plant site should be evaluated in cases where the probability of suchcombinations occurring at the same time and having significant consequences is at leastcomparable to the probability associated with the most severe hydrometeorological orseismically induced flood." This illustrates that Duke must address protection against eventssuch as overtoppingdue to precipitation and seismically-induced failures.
The current licensing basis of ONS clearly requires that the licensee must be able to protect against floods withoutregard to source, due to natural phenomena.
Page 5 DRAFTThe 1992 inundation study has gone beyond concentrating on natural phenomena-caused failures of the Jocassee Dam to demonstrate that a PMF could also be the result of a random"sunny day" failure of the dam producing an Oconee site flood beyond the current floodmitigation capability of the SSF. As a logical conclusion, the NRC has ascertained that the ONSlicensing basis should not be limited to floods caused by natural phenomena alone but, shouldinclude the impact of all credible sources of flood such as those arising from a random "sunnyday" failure of the dam. As with the current licensing basis, the assessment of all potential sources of flood, including those arising from random, overtopping, and seismic failures, mustinclude the most severe case with margin to properly account for uncertainties.
The 1992inundation study clearly concludes that a flood with a maximum height of 16.8 feet will exceedthe 7.5-foot SSF grade level flood protection.
More recently, Duke's Case 2 inundation analysisresults identified a flood height of 18 ft at the SSF. Therefore, the site currently has notdemonstrated that adequate protection against flood is provided.
To correct this, the NRC hasstatutory authority to impose additional condition(s) on the license in order to ensure that thelicensee provides adequate protection against the effect of external floods, regardless of source.The basis for this authority has been established and communicated to the industry whenevaluating licensing amendment requests as part of RIS-2001-02 which states:When a license amendment request complies with the regulations and other licenserequirements, there is a presumption by the Commission of adequate protection ofpublic health and safety (Maine Yankee, ALAB-161, 6 AEC 1003 (1973)).
However,circumstances may arise in which new information reveals an unforeseen hazard or asubstantially greater potential for a known hazard to occur, such as identification of adesign vulnerability or an issue that substantially increases risk. In such situations, theNRC has the statutory authority to require licensee action above and beyond existingregulations to maintain the level of protection necessary to avoid undue risk to publichealth and safety. Section 182.a of the Atomic Energy Act of 1954, as amended, and asimplemented by 10 CFR 2.102, gives the NRC the authority to require the submittal ofinformation in connection with a license amendment request if NRC has reason toquestion adequate protection of public health and safety.ASSESSMENT OF SAFETY SIGNIFICANCE An evaluation of the impact on public safety of invoking this proposed addition to the licensewas performed.
Two cases were developed and compared to estimate the potential decreasein risk. The first case assumes the current licensing basis which does not take into accountfailure of Jocassee Dam. In this case, a rupture of the dam will directly result in loss of the SSFfollowing with core damage and potential radionuclide release.
The second case models aproposed SSF modification, hardening it against external floods by installation of watertight doors at the entrances and associated re-engineering of ventilation and exhaust lines abovecalculated flood height. Other solutions to increase adequate protection are possible, forexample raising the Keowee Dam and intake canal dike heights.
This example analyzes onlyone possible approach.
Page 6 DRAFT1. Current licensing basis not meeting adequate protection.
Under the current licensing basis, should an external flood exceeding the height of floodprotection occur, it will fail the Oconee switchyard, the Keowee Dam, and the SSF with aconditional core damage probability (CCDP) of unity (1.0). Spent fuel pool cooling will also belost. At the onset of core damage, containment integrity will be the only remaining initially intactdefense-in-depth barrier.
This barrier will be severely challenged under these conditions due alack of power to cool containment.
In addition, boil-off of the spent fuel pools is assumed tooccur regardless of containment status resulting in an immediate radionuclide release as thespent fuel pools are outside containment.
The attempt to recover reactor building and spent fuelpool heat removal after floodwater recession to mitigate a release will be at best difficult toaccomplish due to accumulated debris and surrounding infrastructure damage. NRC hasestimated that the failure frequency of Jocassee Dam based on industry data for rockfill dams is2.0 x 104 per year. This is the dam initiating event frequency (IEF). The resultant core damagefrequency for this case is the product of the dam rupture frequency and the conditional coredamage probability, orCDF1 = IEF x CCDP1= (2.0 x 104) x 1.0= 2.0 x 10-4 per year for each unit2. Proposed change to licensing basis to include mitigation of external flood.The proposed change would provide additional mitigation capability by improving the floodprotection of the SSF from a Jocassee Dam failure.
This proposed passive modification forexternal flood protection involves installing watertight doors at the SSF entrances andperforming associated engineering to relocate lines in order to clear the highest computed floodheight. In this modification, the probability of watertight door failure is estimated to be 7.4 x 10.3per demand13.The licensee has computed that the random probability of failure of the SSF is0.2714. Therefore, the resultant core damage frequency of this case is:CDF2 = IEFxCCDP2= (2.0 x 104) x (7.4 x 10'3 + 0.27)= 5.4 x 10-5 per year for each unitThe calculated decrease in core damage frequency is:ACDF = CDF1 -CDF2= (2.0 x 104) -(5.4 x 105)= 1.5 x 104 per year for each unitThis calculation shows that a significant decrease in risk can be achieved with the proposedmodification.
The licensee believes that the dam failure frequency is somewhat lower than thevalue used in these calculations.
A lower frequency will lower the risk reduction proportionately.
2 US NRC-RESIEPRI, "Fire PRA Methodology for Nuclear Power Facilities",
NUREG/CR-6850, Rev. 0,11/2005, Table 11-3." Duke Power Company,
'IPEEE Submittal",
December 21, 1995. The quantified unavailability is duemostly to human error probabilities arising from several manual operator actions that need to becompleted in order for the SSF to be successful to Mode 3.Page 7
=41, ra"'r.-V OMIT',]VB U I g DRAFTRegardless of the precise value of dam failure frequency and therefore, the risk reduction, Dukehas not demonstrated the Oconee has appropriate conservatism in its design and operation andan adequate defense-in-depth approach to prevent accidents and mitigate their consequences.
In February 2009, the licensee developed and submitted a procedure 15 to address failure ofJocassee Dam with consequential failure of the SSF. This procedure involves adapting anexisting B.5.b mitigating strategy to provide decay heat removal through steam generators andspent fuel pool cooling during the period of inundation.
The NRC staff has evaluated thisprocedure.
It relies on many licensee operator actions to accomplish this goal. From a PRAperspective, any reduction in core damage frequency gained from this procedure is minimal.Therefore, credit for using this procedure was not included in the above risk assessment.
CONCLUSION As described above, Duke has not demonstrated that the ONS is adequately protected againstexternal floods from all sources including dam ruptures.
15 Duke Energy ONS "Evaluations by Station Management in the TSC -Beyond Design Basis Mitigation Strategies for Jocassee Dam Failure,"
EM 5.3 Revision 0.Page 8