ML14058A018
Text
.4 P SECUONL AIE- FR~ORM 07MEMORANDUM TO: Eric J. Leeds, DirectorOffice of Nuclear Reactor Regulation FROM: Mark A. Cunningham, DirectorDivision of Risk Assessment Office of Nuclear Reactor Regulation Patrick L. Hiland, DirectorDivision of Engineering Office of Nuclear Reactor Regulation Joseph G. Gitter, DirectorDivision of Operating Reactor Licensing Office of Nuclear Reactor Regulation
SUBJECT:
OCONEE FLOOD PROTECTION AND THE JOCASSEE DAMHAZARD BASIS FOR NRC ALLOWING CONTINUED OPERATION The purpose of this memorandum is to document the basis for NRC allowing continued operation of the Oconee Nuclear Station for a period of two years to resolve issues related totheir Safe Standby Facility (SSF) and potential vulnerabilities due to external floods. The basiswas formed on current dam conditions, compensatory measures (Circle and Wrote none? Donot understand comment) taken by the licensee and the risk associated with operating the sitefor the next two years.Continued operation during this time period is not inimical to the public health and safety.Therefore, we recommemd that you approve and concur on this basis for continued operation.
Please sign below to indicate your approval.
If you have any questions, please contact one ofus.Approved:
Date:Eric J. Leeds, DirectorOffice of the Nuclear Reactor Regulation
Enclosures:
- 1. Basis for Continued Operation of the Oconee Nuclear Station~irriLiAL USE ONLY -S5XURITY RE' ATED NF~i~ivit~
nON O -R I.TDIN .P--T!Oconee Flood Protection and the Jocassee Dam HazardBasis for NRC Allowing Continued Operation Through December 2010Summary Description of Issue:It has come to the attention of the agency that the Oconee Nuclear Station does not appear to have adequateprotection in part due to lack of defense-in-depth to meet the requirements of General Design Criteria 2"Design Bases for Protection Against Natural Phenomena,"
such as external
- flooding, including a flood fromthe Jocassee Dam. Specifically, available information from the "Jocassee Hydro Project, Dam FailureInundation Study," regarding postulated flood levels at the Standby Shutdown Facility (SSF) of the Oconeesite suggests that the capability of the station to maintain needed residual heat removal and spent fuel poolcooling functions would be compromised.
The NRC has concluded that an immediate shutdown of theOconee units is not warranted because the Jocassee Dam is not likely to suffer a catastrophic failure duringthe next 2 years and accident sequence progression timelines are on the order of days. Although the presentconfiguration does not afford adequate protection, continued operation during this time period is not inimicalto the public health and safety.Name/Title Organization Telephone Mark Cunningham NRR/DRA 301-415-2884 Director Approved DateMelanie Galloway NRR/DRA 301-415-2884 Deputy Director Approved DateJeff Mitman NRR/DRAIAPOB 301-415-2843 Senior Reliability
&Risk Analyst Reviewed DateAntonios Zoulis NRR/DRA/APOB 301-415-1209 Reliability
&Risk Analyst Preparer DateADAMS Accession No.OFFICIAL USt ~NLY ~FCUPT~ ~ w IN~U~ivi~
~UN
- 1. PURPOSEThe purpose of this assessment is to document the basis for NRC allowing continued operation of the Oconee Nuclear Station (ONS) until issues related to external flooding of the StandbyShutdown Facility (SSF) are adequately addressed.
- 2. BACKGROUND it hac come to the attention of the agen. y that On August 15, 2008, the NRC issued a requestpursuant to 10 CFR 50.54(f) for information regarding the external flooding vulnerability at ONS,including failure of the Jocassee Dam.The issue revolves around the adequacy of the SSF to mitigate an external flood given the floodheight exceeds the existing flood protection found around the SSF. the Ococo, Nuclear Stationdoes not appoar to have adequatoptecto inWWRO part duo to lack of defense in depth to mooet thercquiremnentc of Genoral Design Criteria 2 "Design Bases for Protectio Against NatuiralPhenomena,"
SUch as oenFal flooding, including a flood from tFhehe Joca.ec Dam. Speci-ficaly, available information from tThe "Jocassee Hydro Project, Dam Failure Inundation Study7l,"'(,-1--)
FegaFd4F§postulated flood levels at the Standby Shutdown Facility
(.SF) of the Oconee sitesuggest which would render the SSF inoperable and would compromised that-thethe capability of the station to maintain needed residual heat removal and spent fuel pool cooling functions would be ompromied.
The SSF provides capability to shutdown the nuclear reactors from outside the control room inthe event of a fire, flood, or sabotage-related emergency.
The SSF is also credited as thealternate AC (AAC) power source and the source of decay heat removal required todemonstrate safe shutdown during the required station blackout coping duration.
It providesadditional "defense-in-depth" by serving as a backup to safety-related systems.
The SSF hasthe capability of maintaining Mode 3 in all three units for approximately three days following aloss of normal AC power. It is designed to maintain reactor coolant system (RCS) inventory, maintain RCS pressure, remove decay heat, and maintain shutdown margin, The SSF requiresmanual activation and would be activated under adverse fire, flooding or sabotage conditions when existing redundant emergency systems are not available
.In April of 2006 the Nuclear Regulatory Commission (NRC) concluded that the licensee failed toeffectively control maintenance activities associated with removing a fire suppression refillaccess cover (a passive NRC committed flood protection barrier) in the SSF south wall tofacilitate installation of temporary electrical power cables. The staff identified the issue during aperiodic risk-informed flood inspection under the NRC's Reactor Oversight Process (ROP).Using the ROP Significance Determination
- Process, the staff discovered that the licensee maydid not have-adequately addressed the potential consequences of flood heights predicted at theOconee site based on the 1992 Duke Hydro/FERC Inundation Study.The inundation study analyzed two dam failure scenarios:
1 "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) ProjectsNo. 2503, December 1992.2 UFSAR Revision 15, Oconee Nuclear Station, December 2005, Chapter 9 Section 9.6.1.2uz'iiUAL USE ONLY -S~Z1JRITY RELATW iaF~R~iAiRr; flrrh;A;.
II~F O~L~' -~ITIIIIIT~'
~IELAT~D INtuviATi
- Ssunny dDay dDam fFailure
-assumes that the reservoir is at normal (this is what isindicated in the actual study) operating levels and a catastrophic failure of the dam occurs* PFebable probable mMaximum fF-Iood (PMF) Dadam F-failure
-assumes that the reservoir isat its highest levels and a catastrophic failure of the dam occurs.(Piping breach)The Odam failures under these scenarios assumed that the flood waters would also fail theKeowee Dam; ai--this assumption was nothich is not made in any other Duke analysis and eewhGhgreatly impacts the results.
The Keowee Dam is assumed to fail as the direct result of theovertopping water forces cutting a breach in the homogeneous earth fill.- Given the postulated break size and the subsequent failure of the Keowee Dam, the flood levels at ONS werecalculated to be 12.54- feet and 16.8 2-ifeet for the Ssunny Pday and PMF dEaam fWailures, respectively.
Flood heights of this magnitude would submerge The predicted flood wouldreach ONS at Which time the 8SF walls ar, Tthe SSF and render it inoperable andunavailable to perform its mitigating functions iG a..umed to fail following the flood le.. lexceeding the height of the SSF w.. Core damage would occur in approximately 8 to 9 hour1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />sfollowing the dam break, and containment failure would occur in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />. Whencontainment failure occurs, significant dose to the public would result.In 2007, the staff conducted an independent review of the Jocassee Dam failure frequency thatDuke had used in the Oconee Probabilistic Risk Assessment (PRA). From that review, the staffconcluded that a higher frequency estimate of Jocassee Dam failure was more accurate and that the licensee's estimate was not adequately supported by operating experience and actual performance data of similar rock-filled dam structures.
The licenseeexcluded failure data related to earthen dams while including the dam years related to thosedams thus reducing the failure probability inappropriately.
It has come to the attention of the agency that the Oconee Nuclear Station does not appear tohave adequate protection in part due to lack of defense-in-depth to meet the requirements ofGeneral Design Criteria 2 "Design Bases for Protection Against Natural Phenomena,"
such asexternal
- flooding, including a flood from the Jocassee DamThe Atomic Energy Act Section 182a3-(-2-) provides the primary statutory standard relating to theCommission's mandate to ensure the safe operation of nuclear power plants. That sectionrequires the Commission to ensure that "the utilization or production of special nuclear materialwill ... provide adequate protection to the health and safety of the public,"
42 U.S.C. Sec.2232(a).
Based on this standard, and supported by the Atomic Safety and Licensing AppealBoard case of 1973(443),
there is a presumption by the Commission of adequate protection ofpublic health and safety when a licensee is in compliance with the regulations and other licenserequirements 5-(4). One such requirement is General Design Criteria 2 "Design Bases forProtection Against Natural Phenomena,"
which was developed to protect the public foraccidents resulting from flood, earthquake, and other natural phenomenon endemic to the site.However, circumstances may arise in which new information reveals an unforeseen hazard or asubstantially greater potential for a known hazard to occur, such as identification of an issue thatThe Atomic Energy Act of 1954. Pub. L. 83 -703, 68 Stat. 919 (1954).Maine Yankee Atomic Power Company (Maine Yankee Nuclear Power Plant, Unit 2). ALAB-161, 6 AEC 1003. USAtomic Energy Commission:
Washington, DC. 1973.5 NUREG-0800, "Standard Review Plan for the Review of Safety Analyses for Nuclear Power Plants, Section 19.2Appendix D, Use of Risk Information in Review of Non-risk-informed License Amendment Requests,"
June 2007.3LA substantially increases risk. In such situations, the NRC has the statutory authority to requirelicensee action above and beyond existing regulations to maintain the level of protection necessary to avoid undue risk to public health and safety.3. EVALUATION Defense-in-Depth The issue related to the SSF and external floods results in an increased vulnerability to failure ofmultiple components and degrades multiple barriers.
The predicted flood would reach ONS atwhich time the SSF walls are overtopped.
The SSF is assumed to fail following the flood levelexceeding the height of the SSF wall. The flood will render emergency core cooling systemsinoperable due to the loss of onsite and offsite power. Without a SSF to mitigate the externalflood there is no defense-in-depth to prevent core damage and a large release to theenvironment.
Core damage would occur in approximately 8 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> following the dam breakand containment failure in about 59 to 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br />. When containment failure occurs, significant dose to the public would result.Risk Assessment A Bayesian analysis of dam failures using the National Performance of Dams ProgramDatabase developed and maintained by Stanford University in conjunction with the Army Coreof Engineers Dam Database shows most dam failure frequencies are on the order of 1.QE-04failures per dam year:Dam-Failures years apost bpost Mean 5% 50% 95%1 All Arch Dams 2 9101 2.5 12134 2.060E-04 4.720E-05 1.793E-04 4.562E-04 2 All Buttress Dams 2 9819 2.5 12852 1.945E-04 4.456E-05 1.693E-04 4.307E-04 3 All Concrete Dams 10 110227 10.5 113260 9.271E-05 5.117E-05 8.978E-05 1.442E-04 4 All Earth Dams 366 2233693 366.5 2236726 1.639E-04 1.500E-04 1.637E-04 1.782E-04 5 All Gravity Dams 28 122798 28.5 125831 2.265E-04 1.615E-04 2.239E-04 3.005E-04 6 All Masonry Dams 5 21692 5.5 24725 2.224E-04 9.251E-05 2.091E-04 3.979E-04 7 All Multi-Arch Dams 0 240 0.5 3273 1.528E-04 6.006E-07 6.949E-05 5.868E-04 8 All Rockfill Dams 7 55872 7.5 58905 1.273E-04 6.163E-05 1.217E-04 2.122E-04 9 All Stone Dams 2 11365 2.5 14398 1.736E-04 3.978E-05 1.511 E-04 3.844E-04 10 All Timber Crib Dams 3 6536 3.5 9569 3.658E-04 1.132E-04 3.316E-04 7.350E-04 T Total 425 2581343 0.5 3033 1.648E-04 6.482E-07 7.499E-05 6.332E-04 4~rrICIAL USE ONUT -SECURITY RE~ lED INFoRM~TI3N 0FFiL I RITYRFurther review of dams above 50 ft provides similar results:Dam-Failures years apost bpost Mean 5% 50% 95%1 Buttress Dams Over 50 Feet High 0 1876 2.4026 11971 2.007E-04 4.410E-05 1.736E-04 4.497E-04 2 Arch Dams Over 50 Feet High 2 5667 4.4026 15762 2.793E-04 1.01 8E-04 2.585E-04 5.280E-04 3 Concrete Dams Over 50 Feet High 0 19215 2.4026 29310 8.197E-05 1.801E-05 7.092E-05 1.837E-04 4 Earth Dams Over 50 Feet High 56 .144810 58.4026 154905 3.770E-04 2.997E-04 3.749E-04 4.617E-04 5 Gravity Dams Over 50 Feet High 7 19542 9.4026 29637 3.173E-04 1.683E-04 3.061E-04 5.044E-04 6 Masonry Dams Over 50 Feet High 0 1987 2.4026 12082 1.989E-04 4.370E-05 1.721E-04 4.456E-04 7 Multi-Arch Dams Over 50 Feet High 0 77 2.4026 10172 2.362E-04 5.190E-05 2.044E-04 5.293E-04 8 Rockfill Dams Over 50 feet high 4 19900 6.4026 29995 2.135E-04 9.603E-05 2.025E-04 3.684E-04 T Total 69 213074 2.4026 10095 2.380E-04 5.230E-05 2.059E-04 5.333E-04 Given this analysis and the lack of redundant safety equipment to mitigate the external flood,the risk to core damage from an external event is above 1.OE-05 which is of substantial safetysignificance.
Accident sequence progression timelines for the subsequent containment failure would be inorder of days. This would give ONS time to implement the site Emergency Action Plan tomitigate the impact on the people in the surrounding vicinity.
Furthermore, this additional timewould allow recovery of flooded roadways after flood recession and the potential for alternate water sources or equipment to mitigate the accident.
In addition, Duke has committed toaugment its Severe Accident Management Guidelines (SAMGs) by February 2009 to includepotential loss of the SSF due to external floods.Performance Measurement ONS continually monitors the dam as follows:* Duke has a diverse program of constant surveillance of the performance of the dam bymeans of on-site cameras and also offsite monitoring of the observed data from itsheadquarters office.* Duke is performing biweekly inspection and monitoring of the condition of the dam, asrequired by FERC.* FERC personnel inspect the dam annually, and the 2007 inspection did not identify anyadverse trends in the condition of the dam.The monitoring helps in determining the health of the dam.4. CONCLUSIONS The NRC staff believes that the Jocassee Dam is unlikely to suffer a catastrophic failure duringthe next two years for the following reasons:The initiating event frequency, supported by ongoing FERC and Duke monitoring andinspection of the dam, is relatively low.* The initiating event frequency for a random failure is on the order of 1 E-4/yr and for alarge seismic event is 1E-5/yr.5-I TEDIN I0N
" The present level of the Jocassee Lake is about 23 feet below the lake's full pondlevel due to the drought conditions.
This reduces the loading that is imposed on thedam." Duke has a diverse program of constant surveillance of the performance of the damby means of on-site cameras and also offsite monitoring of the observed data fromits headquarters office." Duke is performing biweekly inspection and monitoring of the condition of the dam,as required by FERC." FERC personnel inspect the dam annually, and the 2007 inspection did not identifyany adverse trends in the condition of the dam.Accident sequence progression timelines to containment breach and/or fuel pool boil off atOconee are on the order of days, allowing time to implement onsite mitigating actions andoffsite emergency response actions." The staff assumes that recovery of flooded roadways after floodwater recession willallow for providing an alternate source of water for containment and spent fuel poolcooling." Duke has committed to augmenting its Severe Accident Management Guidelines (SAMGs) in February 2009 to include potential loss of the SSF due to external flood." The current drought level of the lake provides additional time within which anyneeded actions could be taken.The NRC has concluded that an immediate shutdown of the Oconee units is not warranted because the Jocassee Dam is not likely to suffer a catastrophic failure during the next two yearsand accident sequence progression timelines are on the order of days. Although the presentconfiguration does not afford adequate protection, continued operation during this time period isnot inimical to the public health and safety.6OFOFFICIAL USE UINLY -..~LLUtIi ~ ItLL'~ULU INUUhivui Iur~
O~fCIA US ONy SE~rnc1'PI~TE INR~I~iNREFERENCES
- 1. "Jocassee Hydro Project, Dam Failure Inundation Study," Federal Energy Regulatory Commission (FERC) Projects No. 2503, December 1992.2. The Atomic Energy Act of 1954. Pub. L. 83 -703, 68 Stat. 919 (1954).3. Maine Yankee Atomic Power Company (Maine Yankee Nuclear Power Plant, Unit 2). ALAB-161, 6 AEC 1003. US Atomic Energy Commission:
Washington, DC. 1973.4. NUREG-0800, "Standard Review Plan for the Review of Safety Analyses for Nuclear PowerPlants, Section 19.2 Appendix D, Use of Risk Information in Review of Non-risk-informed License Amendment Requests,"
June 2007.5. U.S. Nuclear Regulatory Commission, "An Approach for Using Probabilistic RiskAssessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"Regulatory Guide 1.174, Revision 1, November 2002.7