Resolution of Generic Safety Issues: ISSUE 204: FLOODING OF NUCLEAR POWER PLANT SITES FOLLOWING UPSTREAM DAM FAILURES ( NUREG-0933, Main Report with Supplements 1–35 )

Note: Due to the sensitive nature of some information in this analysis, redactions are necessary in this public version. The Nuclear Regulatory Commission (NRC) has coordinated with other Federal agencies (Department of Homeland Security, Federal Energy Regulatory Commission, and U.S Army Corps of Engineers) on the sensitivity of the redacted information.

EXECUTIVE SUMMARY OF SCREENING ANALYSIS

This analysis of upstream dam flooding leads the staff to conclude that the issue deserves further evaluation to determine what else the NRC might need to do. No immediate safety concerns were identified during the preparation of the analysis. The NRC conducted this analysis as part of the third, or screening, stage of the agency’s five-stage Generic Issues (GI) Program. The NRC staff conducts this screening solely to determine, based on readily available information, whether an issue requires more detailed evaluation within the GI program. This analysis says nothing about whether existing nuclear power plant (NPP) licensing bases, design requirements, or regulations are adequate, nor whether plants comply with those standards. Although the analysis discusses some current regulatory actions regarding flooding issues at specific plant sites, it is silent regarding the performance of those or any other licensees. Plant performance is judged by other regulatory processes, primarily the reactor oversight program (ROP). Finally, this analysis reaches no regulatory conclusion about dam reliability or the likelihood of beyond-design-basis failure events. Those decisions are addressed in subsequent stages of the GI Program to determine the need for, and strength of, additional NRC regulatory actions.

Such future actions could go all the way to changing the licensing basis for an NPP through Orders or new rules. The NRC sets out licensing bases to ensure NPPs are designed and operated to resist a credible range of internal and external events and provide adequate protection of public health and safety. Ongoing NRC inspections and oversight programs, such as the ROP, continually check whether NPPs meet important aspects of these licensing bases as long as the plants operate. The GI Program can apply a risk-informed assessment of the adequacy of a regulatory requirement. In cases where NRC determines that licensing bases should be strengthened, it can impose new requirements through rulemaking, issuing orders to licensees based on redefining the standard of adequate protection, or by applying the Backfit Rule, Title 10 of Code of Federal Regulations (CFR) Part 50.109, to impose safety-significant improvements where benefits exceed costs.

The screening analysis highlights the Oconee Nuclear Station in South Carolina and the Fort Calhoun Station in Nebraska. ROP inspections at these plants identified significant findings regarding the adequacy of each licensee’s implementation of their licensing basis for flooding protection. The NRC then took enforcement actions that resulted in licensee actions being taken to restore compliance with their licensing basis and NRC regulations.

This issue is similar to GI-199 dealing with seismic hazards, in that the NRC was examining both issues prior to the accidents in Japan. Both issues will also be addressed as part of the NRC’s response to the recommendations of the NRC’s Near Term Task Force (NTTF) Review of Insights from the Fukushima Dai-ichi Accident. The NTTF’s work incorporated several insights from this screening analysis, which contributed to the task force’s recommendations regarding flooding. The NRC response to these recommendations will address flooding issues broadly, even beyond the issue represented in this screening analysis, at all U.S. NPPs. Again, this screening analysis did not identify an immediate safety concern, since it did not identify any case where a NPP does not meet their current licensing basis. It did, however, confirm that questions about the potential impact of upstream dam failure warrant further evaluation.

Finally, as NPP flooding issues are being addressed, the NRC has maintained a healthy dialog regarding all the regulatory aspects of potential dam failures. Regardless of how a dam might fail, any estimate of potential consequences will be influenced by many assumptions. These include how a given dam is constructed and maintained, how much water it stores, the topography of the downstream terrain, and the design of the NPP and its site. Public health and safety risk from a dam failure also depends on estimates of the likelihood and severity of such failures from both natural and human causes. The NRC continues to conclude that NPPs protect public health and safety under existing licensing bases. Effective regulation, however, requires the questioning approach demonstrated by the GI program and the post-Fukushima response. This screening analysis relied on information readily available to the NRC staff regarding potential consequences of flooding at NPP sites, including analyses of varying rigor and methodology as expressed in documents such as licensee Individual Plant Examination of External Events (IPEEE). More detailed analyses are needed and work is planned to understand both the consequences and risk for applicable nuclear facility sites.

As part of NRC’s response to the post-Fukushima NTTF recommendations, the NRC is planning to request licensees of NPPs to review their site-specific seismic and flooding hazards and to compare their designs to current regulatory standards for licensing new NPPs. The information and analyses gained from these and other NTTF initiatives will ensure the NRC takes whatever action may be appropriate to oversee the continued safe operation of its licensees.

Table of Contents

Executive Summary of Screening Analysis

1. Introduction

Description

2. Implications of Recent Regulatory Activity

Fort Calhoun Station

Oconee Nuclear Station

Prairie Island Nuclear Generating Plant

Watts Bar Nuclear Plant

Applicability of Proposed Generic Issue to Multiple Plants

Available Margin

3. Regulatory Background

Title 10 of the Code of Federal Regulations Part 50

Regulatory Guides

ANSI Standard

Standard Review Plan

Implications of Regulatory Framework

4. Conclusions of Screening Analysis

5. Activities associated with GI-204 while in Stage 3, Regulatory Office Implementation

1. Introduction

This analysis report is provided as part of the Generic Issue Program screening stage for a proposed Generic Issue related to flooding of nuclear power sites following upstream dam failures. The proposed issue was accepted into the Generic Issues Program on August 9, 2010. A screening analysis was conducted per Management Directive 6.4, “Generic Issues Program,” and considered these seven criteria below:

Criterion 1. The issue affects public health and safety, the common defense and security, or the environment.

Criterion 2. The issue applies to two or more facilities and/or licensees/certificate holders, or holders of other regulatory approvals.

Criterion 3. The issue cannot be readily addressed through other regulatory programs and processes; existing regulations, policies, or guidance; or voluntary industry initiatives.

Criterion 4. The issue can be resolved by new or revised regulation, policy, or guidance.

Criterion 5. The issue's risk or safety significance can be adequately determined (i.e., it does not involve phenomena or other uncertainties that would require long-term studies and/or experimental research to establish the risk or safety significance).

Criterion 6. The issue is well-defined, discrete, and technical.

Criterion 7. Resolution of the issue may potentially involve review, analysis, or action by the affected licensees, certificate holders, or holders of other regulatory approvals.

For the proposed issue to be recommended as a formal GI, the issue must have the potential to meet all seven of the above criteria. As explained in Management Directive (MD) 6.4, "Generic Issues Program," the screening review is not required to argue that the issue decisively meets the criteria. Rather, the screening analysis is intended to determine whether a reasonable possibility exists that the criteria are met and whether continued evaluation of the issue under the program is warranted. With this guidance in mind, the staff must provide a recommendation to either accept or reject the issue as a GI.

The scope of the review is not limited by the content of the original issue proposal, but the proposal serves as the basis for the review. The proposal lists currently operating sites where the issue is suggested to be a factor. All of the sites are potentially affected by upstream (flooding) or downstream (loss of ultimate heat sink) dam failures. The scope of this screening analysis was limited to external flooding due to upstream dam failures. As part of the screening analysis, the NRC staff reviewed the existing regulatory framework addressing flood hazard. Plant-specific documents were reviewed, including Final Safety Analysis Reports (FSARs), IPEEE submittals, and regulatory enforcement documents.

Of the 20 potentially affected sites listed, the staff performed an indepth evaluation of two sites, Oconee Nuclear Station and Fort Calhoun Station, and a brief overview of Watts Bar and Praire Island nuclear stations. Hence, the screen analysis includes regulatory activity related to flooding and dam failure analysis recently occurring at these sites.

With regard to Oconee Nuclear Station, recent estimates of the resulting flood levels from failure of the upstream dam have increased substantially relative to previous estimates. The site may experience a total station blackout due to loss of offsite and station power.

The NRC issued a yellow finding to Fort Calhoun Station for failure to maintain external flooding procedures. The finding indicated that it was not clear that the procedures could be readily executed if required during a flooding scenario. Upstream dam failures would exacerbate the current flooding issue. Therefore, under certain flood conditions, procedures call for the placement of sandbags and other pre-fabricated flood barriers to protect critical equipment from floodwaters up to 1,014 feet (ft) above mean sea level (MSL).

Knowledge gained from the review of plant-specific documents suggests that comparable conditions may exist at other sites with similar physical characteristics. Section 3 of the screening evaluation describes the existing NRC regulatory framework as it applies to flooding because of upstream dam failure. It also describes the evolution of regulations and the implications of these changes. Section 4 of the evaluation provides a recommendation regarding the placement of this issue in the GI Program.

An NRC staff analysis of upstream dam flooding lead the staff to conclude that there may be a safety issue requiring further evaluations. No immediate safety concerns were identified during the preparation of the analysis. The staff conducted this analysis as part of the screening stage of the agency's five-stage GI Program. The staff conducted this screening solely to determine, based on readily available information, whether an issue requires more detailed evaluation. The analysis says nothing about whether existing NPP licensing bases, design requirements, or regulations are adequate, nor whether plants comply with those standards.  Although the analysis discusses some current regulatory actions regarding flooding issues at specific plant sites, it is silent regarding the performance of those or any other licensees.  Plant performance is judged by other regulatory processes, primarily the ROP. Finally, the analysis reached no regulatory conclusion about dam reliability or the likelihood of beyond-design-basis failure events. Those decisions are addressed in subsequent stages of the GI Program to determine the need for additional NRC regulatory actions.

Additional NRC regulatory actions could involve changing the licensing basis for a NPP through orders or new rules. The NRC reviews and approves licensing bases to ensure NPPs are designed and operated to resist a credible range of internal and external events in order to provide adequate protection of public health and safety. NRC inspections and oversight programs, such as the ROP, continually check whether NPPs meet important aspects of these licensing bases as long as the plants operate. The GI Program can apply a risk-informed assessment of the adequacy of a regulatory requirement. In cases where NRC determines that licensing bases should be strengthened, it can impose new requirements through rulemaking, issuing orders to licensees based on redefining the standard of adequate protection, or by applying the Backfit Rule (10 CFR 50.109) to impose safety-significant improvements where benefits exceed costs.

This screening analysis highlights the Oconee Nuclear Station in South Carolina and the Fort Calhoun Station in Nebraska. ROP inspections at these plants identified significant findings regarding the adequacy of each licensee's implementation of their licensing basis for flooding protection. The NRC took enforcement actions that resulted in licensee actions being taken to restore compliance with their licensing basis and NRC regulations.

This issue is similar to GI-199 dealing with seismic hazards, in that the NRC was examining both issues prior to the nuclear accident in Fukushima, Japan. Both issues are being addressed as part of the NRC’s response to the recommendations of the NRC’s NTTF review of insights from the Fukushima Dai-ichi accident. The NTTF’s work incorporated several insights from this screening analysis, which contributed to the task force’s recommendations regarding flooding. The NRC response to the NTTF recommendations will address flooding issues broadly, beyond the issue represented in this screening analysis, at all U.S. NPPs. Again, this screening analysis did not identify any immediate safety concerns. It did not identify any case where a NPP does not meet their current licensing basis. However, it did confirm that questions about the potential impact of upstream dam failures warrant further evaluation.

As NPP flooding issues are being addressed, the NRC has maintained updated communications with stakeholders regarding all the regulatory aspects of potential dam failures. Regardless of how a dam might fail, estimates of potential consequences will be influenced by many assumptions. These include how a given dam is constructed and maintained, how much water it stores, the topography of the downstream terrain, and the design of the NPP and its site. Risk to public health and safety from a potential dam failure also depends on estimates of the likelihood and severity of such failures from both natural and human causes. The NRC maintains its position that NPPs protect public health and safety under existing licensing bases. However, effective regulation requires a questioning approach demonstrated by the GI program and the post-Fukushima response.

This screening analysis was based upon information readily available to the NRC staff regarding the potential consequences of flooding at NPP sites, including analyses of varying rigor and methodology as expressed in documents, such as licensee IPEEE. More detailed analyses are needed. Future work is needed to understand both the consequences and risk for applicable nuclear facility sites. As part of NRC’s response to the post-Fukushima NTTF recommendations, the NRC requested licensees of NPPs to review their site-specific seismic and flooding hazards and to compare their designs to current regulatory standards for licensing new NPPs. The information and analyses gained from these and other NTTF initiatives will ensure the NRC takes whatever action may be appropriate to oversee the continued safe operation of its licensees.

Description

This analysis report is provided as part of the GI Program screening stage for a proposed GI related to flooding of nuclear power sites following upstream dam failures. The proposed issue was accepted on August 9, 2010. Analysis was conducted per NRC MD 6.4.

For the proposed issue to be recommended as a formal GI, the issue must have the potential to meet all seven screening criteria described above. As explained in MD 6.4, the screening review is not required to argue that the issue decisively meets the criteria. Rather, the screening analysis is intended to determine whether a reasonable possibility exists that the criteria are met and whether continued evaluation of the issue under the program is warranted. With this guidance in mind, the staff must provide a recommendation to either accept or reject the issue as a GI.

The scope of the review is not limited by the content of the original issue proposal but the proposal serves as the basis for the review. The proposal lists 20 currently operating sites where the issue is suggested to be a factor. All of the sites are potentially affected by upstream (flooding) or downstream (loss of ultimate heat sink) dam failures. The scope of this screening analysis is limited to external flooding due to upstream dam failures. Of the 20 sites listed, the proposal provides indepth discussion of two sites: Oconee Nuclear Station and Fort Calhoun Station, and an overview of Watts Bar and Praire Island stations. Regulatory activity related to flooding and/or dam failure analysis recently occurred at these stations.

With regard to Oconee Nuclear Station, recent estimates of the resulting flood levels from failure of the upstream dam have increased substantially relative to previous estimates, and the site is theorized to enter station blackout due to loss of offsite and station power.

Fort Calhoun Station was issued a yellow finding for failure to maintain external flooding procedures. Under certain flood conditions, procedures call for the placement of sandbags and other pre-fabricated flood barriers to protect critical equipment from floodwaters up to 1,014 feet (ft) above mean sea level (MSL). However, the finding indicated that it was not clear that the procedures could be readily executed if required during a flooding scenario. Upstream dam failures would exacerbate the current flooding issue.

As part of the screening analysis, a review was performed of the existing NRC regulatory framework addressing flood hazard. Plant-specific documents were reviewed including Final Safety Analysis Reports (FSARs), IPEEE submittals, and regulatory enforcement documents. These documents are referenced and discussed throughout the report. Knowledge gained from the review of plant-specific documents suggests that comparable conditions may exist at other sites with similar physical characteristics. In addition, the report describes the evolution of regulations and the implications of these changes.

2. Implications of Recent Regulatory Activity

Fort Calhoun Station

 Fort Calhoun Station is located on the west bank of the Missouri River, 19 miles north of Omaha. Figure 1 shows an aerial photograph of Fort Calhoun Station relative to the adjacent river. The base plant elevation (1,004ft MSL) is not substantially higher than normal river levels. The Updated Safety Analysis Report (USAR) specifies that the design flood elevation is 1,006ft MSL. In 1993, the U.S. Army Corps of Engineers estimated the probable maximum flood (absent upstream dam failure) to be 1,009.3ft MSL. Without special provisions, safety-related components at the plant are protected from flooding by hardened features up to an elevation of 1,007ft MSL. Floodgates permanently mounted adjacent to openings can be installed to provide further flood protection of most components up to an elevation of 1,009.5ft MSL. The intake structure is located at an elevation of 1,007.5ft MSL. Protection of the intake structure to an elevation of 1,009.5ft MSL is accomplished through a combination of both floodgates and sandbags. The licensee has indicated that it will use sandbags, temporary earth levees, and other methods to allow safe shutdown up to an elevation of 1,013ft MSL. Based on more recent information, the NRC has questioned the accuracy of existing flood estimates included in plant specific documents. Figure 2 illustrates the flood water levels for a variety of flood events (based on estimates produced by different agencies, as indicated in plant specific documents) as well as flood protection elevations.

Inspectors have identified an apparent violation of Technical Specification 5.8.1 at Fort Calhoun Station for failure to maintain adequate procedures to protect the intake structure and auxiliary building during external flooding events. It was determined that it is not sufficient to stack and/or drape sandbags on floodgates to protect the aforementioned structures up to an elevation of 1,013ft MSL (as credited in the USAR and in station operating procedures). The flat surface on the top of the floodgates is too narrow to support a stacked sandbag configuration capable of retaining 4 feet static head of water. Moreover, the required actions pose a safety risk to plant personnel.

The Significance Determination Process has resulted in the issuance of a yellow finding regarding this apparent violation. The Significance Determination Process results described above are based on consideration of external flooding due to events that exclude dam failures. The flood level is in excess of the flood elevation reported in the USAR. The flood levels projected in the IPEEE submittal will overtop all permanent and temporary barriers, though the distance between the dams and the site provides warning time. As illustrated above, recent regulatory activity suggests that Fort Calhoun Station may not have been protected from a large flood event. The resulting finding was of yellow significance, which was determined without factoring dam failures into the performance deficiency. Details about the ongoing activities at Fort Calhoun Station in response to the above yellow finding can be found in a letter from Omaha Public Power District to NRC.

Oconee Nuclear Station

Oconee Nuclear Station (ONS) is located about 30 miles west of Greenville, South Carolina. The site is downstream from Jocassee Dam and adjacent to Keowee Dam. The full pond elevation of the water retained by Jocassee Dam is about 300 feet above Lake Keowee, which is retained by Keowee Dam. The Oconee Nuclear Station has a yard grade that is a few feet below the full pond level of Lake Keowee.

The original licensing basis for Oconee Nuclear Station did not include the impact of failure of Jocassee Dam when calculating potential flood levels at the site. A sudden catastrophic failure of the Jocassee Dam is postulated to result in a flood wave that would overtop Keowee Dam as well as overtop the Oconee intake dike and would flood the nuclear plant site. Flooding of the plant yard is expected to inundate the switchyard, eliminating both offsite and station power. The licensee developed an action plan and began physical modification at the Oconee Nuclear Station site to mitigate the consequences of a potential Jocassee Dam failure. In 1983, the licensee, Duke Energy Corporation, evaluated external flooding effects at Oconee Nuclear Station for risk assessment purposes

In 1992, Duke Energy Corporation performed an inundation study at the request of the Federal Energy Regulatory Commission. The goal of the study was to evaluate the downstream effects of failure of Jocassee Dam under the "worst possible conditions" for inclusion in the emergency action plans of the hydroelectric facilities located downstream of Jocassee Dam. The conditions assumed under the 1992 study resulted in postulated flood heights in the station yard in excess of the 5 feet estimated under the 1983 study and consequently above the flood protection elevation of the Standby Shutdown Facility (SSF). Studies that are more recent have also computed flood heights that exceed the flood protection elevation of the SSF. Based on results of the 1992 study, the licensee estimates that the conditional core damage frequency resulting from flooding due to failure of the Jocassee Dam is 7.0 E-6 / year. The contribution to core damage frequency from precipitation induced external flooding is considered negligible. The licensee notes that this external flood core-damage frequency is of the same magnitude as other severe accident events (e.g., earthquakes, fires). Consequently, in the IPEEE, the licensee concluded that external flooding does not pose severe accident vulnerability.

The aforementioned estimate of conditional core-damage frequency is based on an estimate (made by the licensee) that the probability of a random failure of Jocassee Dam is 1.3 E-5 / year. This failure rate includes failures due to seepage, embankment slides, and structural failure of the foundation or abutments. It does not include failures due to earthquakes (not deemed credible) or overtopping. This NRC estimate is an order of magnitude larger than the estimate reported in the Oconee Nuclear Station IPEEE submittal. The database used by NRC staff to calculate the estimated failure rate includes failures due to overtopping, internal erosion, and settlement. Due to a lack of earthquake- induced failures affecting dams with characteristics similar to Jocassee Dam, the database does not contain failures due to seismic events.

Several uncertainties exist with regard to the risk posed to Oconee Nuclear Station due to upstream dam failure. In particular, uncertainty exists about the flood levels at the site that would result from failure of Jocassee Dam. Moreover, hazard due to external flooding was "screened out" in the IPEEE based on a sufficiently small contribution to core damage frequency as calculated at the time. Uncertainty exists in assigning the appropriate probability of dam failure that should be used in computing the contribution of external flooding to core damage frequency, as shown by separate analyses differing by an order of magnitude in estimating the probability of failure of Jocassee Dam.

Figure shows an aerial photograph of ONS relative to the Keowee Lake.

Figure below shows the Jocasse Dam.

Prairie Island Nuclear Generating Plant

While this screening assessment did not identify any immediate safety concerns, inspections and NRC reviews at other individual plants have led to those plants taking actions regarding flooding scenarios on site-specific basis. GI 204 has been subsumed as part of the implementation of the recommendations from the agency’s Japan NTTF, which was assembled in response to the earthquake/tsunami and reactor accident at the Fukushima Dai-ichi site.

While the NTTF used preliminary information from the screening assessment and discussed flooding in its July 2011 report, the issue related to flooding from the upstream dam failure came to the staff’s attention long before the earthquake/tsunami and reactor accident at the Fukushima Dai-ichi site. New sources of information on this issue have accumulated over the past few years. This information includes inspections of flood protection and related procedures, as well as recent re-evaluations of dam failure frequencies and possible flood heights at some U.S. nuclear power plants, suggesting that flooding effects in some cases may be greater than previously expected.

The NTTF’s review of the Fukushima accident led to recommendations regarding the potential for flooding from all hazard mechanisms at operating reactors. In March 2012, letters were sent by the NRC to holders of operating licenses and construction permits, which requested the reevaluation of all floods hazards (including dam failures) using present-day guidance and methodologies. Sites undergoing decommissioning, which are part of the generic issue, are not included in the NRC’s activities related to reevaluation of flood hazards.

NPP designs include protection against serious but very rare flooding events, including flooding from dam failure scenarios. Dam failures can occur as a consequence of earthquakes, overtopping, and other mechanisms such as internal erosion and operational failures. A dam failure could potentially cause flooding at a NPP site depending on a number of factors including the location of the dam, reservoir volume, dam properties, flood routing and site characteristics.

In July 2011, the staff completed the screening analysis using guidance contained in MD 6.4 and SECY-07-0022, “Status Report on Proposed Improvements to the Generic Issues Program,” dated January 30, 2007. On March 6, 2012, the Director of the Office of Nuclear Regulatory Research (RES) transferred responsibility for resolution of GI-204 to the Japan Lessons Learned Project Directorate (JLD) in the Office of Nuclear Reactor Regulation (NRR). Therefore the issue did not proceed through the safety/risk assessment stage of the GI process. The staff dispositioned GI-204 as not passing all the seven GI screening criteria, specifically, the third criterion which states, “The issue cannot be readily addressed through other regulatory programs and processes; existing regulations, policies, or guidance; or voluntary industry initiatives.” Since the Agency actions in response to the NTTF recommendations will address flooding at operating reactors, including flooding from postulated dam failures, the third criterion is no longer met. MD 6.4 states that a proposed GI or a GI that does not meet any of these criteria at any time will not be processed further by the GI Program. However, the GI was not closed; management elected to keep GI-204 open status in order to track the issue to closure.

At Prairie Island Nuclear Generating Plant, the difference in normal pool elevation across the dam is 12.2ft. The USAR indicates “[t]here is no flood hazard resulting from a dam break at Lock and Dam #2.” This conclusion is based on an analysis of stable water elevations at a dam located about 1.5 miles downstream of the plant site (Lock and Dam #3) when a sustained flow of water from Lock and Dam #2 is caused by the loss of 10 tainter gates. Given this sustained flow, the USAR concludes that a steady state upper pool elevation will be reached at Lock and Dam #3 consistent with a steady flow through the 10 spillway gates. The result of these conditions is a river level of 684.5 feet MSL in the lower pool of Lock and Dam #2 and 676.5 feet MSL in the upper pool of Lock and Dam #3. Consequently, the flood level at Prairie Island Nuclear Generating Plant resulting from this postulated scenario is in the range 676 to 685 feet MSL. These levels are substantially below the stated flood protection elevation at about 705 ft MSL. The USAR does not explicitly describe the postulated antecedent conditions for this dam failure scenario; however, it appears the analysis is based on a breach under normal operating conditions. The USAR states: "The various locks and dams along the river have a negligible effect on the stage of a major flood. With all gates open the fall through the dam is generally less than a foot and for the probable maximum flood the embankments at the dams would be submerged." Prairie Island Nuclear Generating Plant currently has protective procedures in place that require placement of the unit in Mode 3, Hot Standby when flood levels exceed 692 ft MSL13.

The excerpt above is general in nature. Additional information is needed to determine the correlation between overtopping and possible failure of various locks, dam, embankments, and gates; and the contribution to downstream flood levels. Furthermore, the fall height through the various locks and dams may or may not correlate to similar flood level contributions at a downstream site since terrain and flow characteristics must be considered. The effect of cascading failures is not addressed above, nor is the effect of a sudden opening of gates releasing retained water during a large flood event.

Under the probable maximum flood (PMF) affecting Prairie Island Nuclear Generating Plant, the estimated flood elevation at the site is 703.6ft MSL. Thus, under a probable maximum flood, excluding the effects of waves, Prairie Island Nuclear Generating Plant has a small margin between flood levels and flood protection elevation (<1.5 ft). By including wave effects, the water level increases to 706.7ft MSL and the margin becomes negative. This situation would be exacerbated if the flood event is augmented by the flood volume resulting from an upstream dam breach, though the amount of water that would be superimposed on the flood levels at the site is not known.

Watts Bar Nuclear Plant

Figure below shows an aerial photograph of Watts Bar Dam

The maximum assessed flood for Watts Bar Nuclear Plant is caused by the probable maximum precipitation PMP) event, critically centered on the watershed and results in a flood elevation of 738.8 ft MSL (and 741.2 ft MSL including wave run up). The license indicates that, in the storm contributing to the PMF, “the West Saddle Dike at Watts Bar Dam would be overtopped and breached. No other [dam] failure would occur.” The licensee indicates that “all safety related facilities, systems, and equipment are housed in structures which provide flood protection up to plant grade at Elevation 728ft MSL.” This elevation is substantially below the design basis flood elevation. Consequently, the plant is required to be shutdown whenever floodwaters exceed this elevation. The licensee indicates that “[f]lood warning criteria and forecasting techniques have been developed to assure that there will always be adequate time to shut the plant down and be ready for floodwaters above plant grade.” The licensee also indicates that the facilities, systems, and equipment located in the containment structure (protected by the shield building, which has accesses/penetrations that are watertight) and the diesel generator building (located above critical flood level) are both protected during a flood event. The turbine, control, and auxiliary buildings are postulated to flood, but the licensee indicates that equipment required to maintain plant safety during a flood – and for 100 days following the flood – is “designed to operate submerged, is located above the maximum flood level, or otherwise protected.”

The design basis flood described above does not include an upstream dam failure (other than the overtopping/breach of the West Saddle Dike at Watts Bar Dam) although seismic dam failures coincident with smaller floods were considered in establishing it. The licensee specifies that “dam safety modifications have eliminated the potential of a PMF at upstream tributary dams to cause maximum site flood levels,” with the exception of the West Saddle Dike at Watts Bar Dam. There are 12 major dams upstream from Watts Bar Nuclear Plant. In the plant UFSAR, seismically-induced dam failure is considered under the operating basis earthquake coincident with one-half the PMF as well as during a safe-shutdown earthquake coincident with a 25- year storm.

In light of the concern about potentially high flood levels at Oconee Nuclear Station resulting from the failure of Jocassee Dam, it may be reasonable to understand the consequences of high flood events at Watts Bar Nuclear Plant resulting from failure of Watts Bar Dam and other upstream dams during an extreme precipitation event. Watts Bar Nuclear Plant is flood protected up to an elevation of 728ft and requires plant shutdown for flood elevations above this level. The safety-related systems and components necessary for the maintenance of safe shutdown are protected up to the aforementioned design-basis flood level, which does not include a dam failure event (other than the West Saddle Dike at Watts Bar Dam).

Revised flood estimates at nuclear power plants operated by the Tennessee Valley Authority (i.e., Watts Bar Nuclear Plant, Sequoyah Nuclear Plant, and Browns Ferry Nuclear Plant) have resulted in increased PMF elevations that may require permanent modification of flood protection at the sites (pending the outcome of rigorous analyses to verify increases in the PMF elevation). In conjunction with the increases in precipitation-induced flooding, the Tennessee Valley Authority is currently performing finite element analyses to demonstrate dam stability. If analysis results are unfavorable, steps will be taken to modify the dams.

Applicability of Proposed Generic Issue to Multiple Plants

It is notable that an exclusive review of FSAR and IPEEE submittals would not necessarily indicate a potential problem due to external flooding hazard in either of the above-described cases (i.e., Fort Calhoun Station or Oconee Nuclear Station). Problems at Fort Calhoun Station were recognized because of an NRC inspection that identified an apparent violation of Technical Specification 5.8.1.a for failure to maintain adequate procedures to protect the plant during external flooding events. At Oconee Nuclear Station, attention was drawn to the elevated consequence from external flooding after staff identified a performance deficiency during maintenance activities that involved the installation of temporary electrical cables through an opening in the flood protection wall. This performance deficiency was of particular concern when coupled with flooding estimates that are significantly higher than previously assumed. Thus, in these two cases, identification of flood-related issues resulted from particular scrutiny and analysis of flood protection preparations, assumptions, and procedures. It is unlikely that concerns related to dam- failure flooding at these two sites would have stood out based on the FSAR and IPEEE documents alone.

For other plants listed in the Generic Issue proposal, sufficient additional information is not readily available to the staff reviewers to support a conclusive assessment regarding risks posed by external flooding due to dam failure. Without detailed study and interaction with licensees, available information related to external flooding for these sites is generally limited to the FSARs and IPEEE submittals. As described above, exclusive consideration of these documents may not readily indicate a problem exists related to external flooding because of upstream dam failure. Consequently, it is useful to identify characteristics of Oconee Nuclear Station and Fort Calhoun Station that may make them susceptible to risks of flooding that are higher than initially estimated. Such characteristics can serve as indicators for identifying other plants that also may have external flood risks that are higher than originally estimated or assumed. This argument serves to demonstrate the applicability of the Proposed Generic Issue to multiple sites, which is an important component of passing a Proposed Generic Issue through the screening stage.

A significant contributor to the elevated risk at Fort Calhoun Station comes from its reliance on the placement of temporary barriers to protect the plant during a large external flood event. These protective measures require significant physical actions on the part of plant personnel. Consequently, a nontrivial probability exists that the procedures will be unsuccessful. In the case of Fort Calhoun Station, the physical characteristics of certain plant structures make it difficult to place the temporary barriers . Fort Calhoun Station is not the only plant to rely on the placement of temporary protective measures. For example, Cooper Nuclear Station, Vermont Yankee Nuclear Power Station, and Arkansas Nuclear One, rely on the placement of temporary barriers or connections such as sandbags, wood planks, and temporary power cables. Three Mile Island Nuclear Station is another example of a plant that requires actions on the part of plant personnel (e.g., installation of flood gates and plugging of openings). In addition, a subset of plants have technical specifications in place that require plant shutdown (or placement of the plant in hot standby) when floodwaters reach a predefined threshold. Examples of such plants include Prairie Island Nuclear Generating Plant, Beaver Valley Power Station, Sequoyah Nuclear Plant, and Watts Bar Nuclear Plant. Maintenance of the shutdown or standby state is required for the duration of the flood event. Because it is necessary to consider the capability to maintain core cooling for the duration of a flood event, evaluation of plant safety must include factors such as the availability of site access given high floodwaters, integrity of compromised components (e.g., due to the effects of submergence, debris, sediment, and hydrodynamic forces), continuity of electricity, and the presence of electrical hazards. These factors are important even if the reactor is shutdown in response to anticipated flooding. Based on the documents reviewed for the screening assessment, it was not clear that the above factors were comprehensively and consistently considered for all plants.

In the cases of Oconee Nuclear Station and Fort Calhoun Station, it was additional data and analysis, beyond that provided in the FSAR and IPEEE documents that allowed more substantive safety questions to be identified and articulated regarding both the licensee response to — and site consequence from — upstream dam failures. The question raised about the viability of procedures in place at Fort Calhoun Station and the additional insight gained during the assessment of Oconee Nuclear Station suggests value in systematically investigating existing procedures at other similar sites with the benefit of more accurate and detailed information including evaluation of whether the licensee can maintain the plant in a safe shutdown condition throughout the duration of a flood event. This would provide a better quantification of the likelihood that established procedures will succeed (or fail) in protecting critical safety equipment.

In addition to the reliability of temporary protection procedures (described above), it is also necessary to evaluate the reliability of hardened protective features including dikes/levees, flood doors, submarine hatches, water stops at construction joints, and pipe penetration seals. At most nuclear power plants, flood protection dikes, levees, doors, and other features have not been tested against a flood. These features are all susceptible to failure and, consequently, such features should not be assumed to have a success probability of 1.0. The importance of considering the performance of hardened protective features was demonstrated during a flood at the Blayais Nuclear Power Plant (France) in 1999. During the flood event, protection of underground rooms containing safety equipment was insufficient and dikes were found to have insufficient height and shape. Units 1 and 2 at the site were severely affected by the floodwaters. For example, an essential service water pump was lost due to the immersion of the motors. Utility galleries, the bottom of the fuel handling building, and rooms containing electrical equipment were also flooded. Moreover, the flood warning system was inadequate and detection of water in affected rooms was difficult.

A major factor in the uncertainty associated with reliance on non-passive protective procedures is the amount of time available to take action following notification of a dam breach. The closer the dam is located to a site, the shorter the available response time following a dam breach. A “rule of thumb” is that a flood wave travels downstream at about 3-4 miles/hour. This is a rough estimate and will vary based on the topography of the intervening river basin. However, using this rule, it is estimated that about a day of warning time exists for a dam that is about 100 miles upstream of a site. Many dams are operated by organizations other than the plant operator. Consequently, communication strategies and agreements between the operator of the dam and the nuclear power plant are necessary to maximize warning time and to optimize the quality of transmitted information. Variability in the rigor of these arrangements will affect the overall risk exposure to the plant, particularly if a given amount of lead-time is required to implement protective procedures. Regulatory Guides 1.102 and 1.59 address the use of temporary barriers and other procedures to provide protection of nuclear power plants during flood events. Subsequent sections of this report describe both documents.

It is notable that an exclusive review of FSAR and IPEEE submittals would not necessarily indicate a potential problem due to external flooding hazard in either of the above-described cases (i.e., Fort Calhoun Station or Oconee Nuclear Station). Problems at Fort Calhoun Station were recognized because of an NRC inspection that identified an apparent violation of Technical Specification 5.8.1.a for failure to maintain adequate procedures to protect the plant during external flooding events. At Oconee Nuclear Station, attention was drawn to the elevated consequence from external flooding after staff identified a performance deficiency during maintenance activities that involved the installation of temporary electrical cables through an opening in the flood protection wall. This performance deficiency was of particular concern when coupled with flooding estimates that are significantly higher than previously assumed. Thus, in these two cases, identification of flood-related issues resulted from particular scrutiny and analysis of flood protection preparations, assumptions, and procedures. It is unlikely that concerns related to dam-failure flooding at these two sites would have stood out based on the FSAR and IPEEE documents alone.

For other plants listed in the GI, sufficient additional information is not readily available to the staff reviewers to support a conclusive assessment regarding risks posed by external flooding due to dam failure. Without detailed study and interaction with licensees, available information related to external flooding for these sites is generally limited to the FSARs and IPEEE submittals. As described above, exclusive consideration of these documents may not readily indicate a problem exists related to external flooding because of upstream dam failure. Consequently, it is useful to identify characteristics of Oconee Nuclear Station and Fort Calhoun Station that may make them susceptible to risks of flooding that are higher than initially estimated. Such characteristics can serve as indicators for identifying other plants that also may have external flood risks that are higher than originally estimated or assumed. This argument serves to demonstrate the applicability of the GI to multiple sites, which is an important component of passing a GI through the screening stage.

A significant contributor to the elevated risk at Fort Calhoun Station comes from its reliance on the placement of temporary barriers to protect the plant during a large external flood event. These protective measures require significant physical actions on the part of plant personnel. Consequently, a nontrivial probability exists that the procedures will be unsuccessful. In the case of Fort Calhoun Station, the physical characteristics of certain plant structures make it difficult to place the temporary barriers. Fort Calhoun Station is not the only plant to rely on the placement of temporary protective measures. For example, Cooper Nuclear Station, Vermont Yankee Nuclear Power Station, and Arkansas Nuclear One rely on the placement of temporary barriers or connections such as sandbags, wood planks, and temporary power cables. Three Mile Island Nuclear Station is another example of a plant that requires actions on the part of plant personnel (e.g., installation of flood gates and plugging of openings). In addition, a subset of plants have technical specifications in place that require plant shutdown (or placement of the plant in hot standby) when floodwaters reach a predefined threshold. Examples of such plants include Prairie Island Nuclear Generating Plant, Beaver Valley Power Station, Sequoyah Nuclear Plant, and Watts Bar Nuclear Plant. Maintenance of the shutdown or standby state is required for the duration of the flood event. Because it is necessary to consider the capability to maintain core cooling for the duration of a flood event, evaluation of plant safety must include factors such as the availability of site access given high floodwaters, integrity of compromised components (e.g., due to the effects of submergence, debris, sediment, and hydrodynamic forces), continuity of electricity, and the presence of electrical hazards. These factors are important even if the reactor is shutdown in response to anticipated flooding. Based on the documents reviewed for the screening assessment, it was not clear that the above factors were comprehensively and consistently considered for all plants.

In the cases of Oconee Nuclear Station and Fort Calhoun Station, it was additional data and analysis, beyond that provided in the FSAR and IPEEE documents that allowed more substantive safety questions to be identified and articulated regarding both the licensee response to — and site consequence from — upstream dam failures. The question raised about the viability of procedures in place at Fort Calhoun Station and the additional insight gained during the assessment of Oconee Nuclear Station suggests value in systematically investigating existing procedures at other similar sites with the benefit of more accurate and detailed information including evaluation of whether the licensee can maintain the plant in a safe shutdown condition throughout the duration of a flood event. This would provide a better quantification of the likelihood that established procedures will succeed (or fail) in protecting critical safety equipment.

In addition to the reliability of temporary protection procedures (described above), it is also necessary to evaluate the reliability of hardened protective features including dikes/levees, flood doors, submarine hatches, water stops at construction joints, and pipe penetration seals. At most nuclear power plants, flood protection dikes, levees, doors, and other features have not been tested against a flood. These features are all susceptible to failure and, consequently, such features should not be assumed to have a success probability of 1.0. The importance of considering the performance of hardened protective features was demonstrated during a flood at the Blayais Nuclear Power Plant (France) in 1999. During the flood event, protection of underground rooms containing safety equipment was insufficient and dikes were found to have insufficient height and shape. Units 1 and 2 at the site were severely affected by the floodwaters. For example, an essential service water pump was lost due to the immersion of the motors. Utility galleries, the bottom of the fuel handling building, and rooms containing electrical equipment were also flooded. Moreover, the flood warning system was inadequate and detection of water in affected rooms was difficult.

A major factor in the uncertainty associated with reliance on non-passive protective procedures is the amount of time available to take action following notification of a dam breach. The closer the dam is located to a site, the shorter the available response time following a dam breach. A "rule of thumb" is that a flood wave travels downstream at about 3-4 miles/hour. This is a rough estimate and will vary based on the topography of the intervening river basin. However, using this rule, it is estimated that about a day of warning time exists for a dam that is about 100 miles upstream of a site. Many dams are operated by organizations other than the plant operator. Consequently, communication strategies and agreements between the operator of the dam and the nuclear power plant are necessary to maximize warning time and to optimize the quality of transmitted information. Variability in the rigor of these arrangements will affect the overall risk exposure to the plant, particularly if a given amount of lead-time is required to implement protective procedures. Regulatory Guides 1.102 and 1.59 address the use of temporary barriers and other procedures to provide protection of nuclear power plants during flood events. Subsequent sections of this report describe both documents.

Several nuclear sites are located on rivers having large upstream storage volumes. These rivers have a set of dams located upstream and subject to the same upstream dam failure events. However, due to the delay in time flood waters reach the downstream plant, the effects of a failure of these dams are less extreme. Licensees have operating procedures to protect the plant in the event of a large flood event. However, further evaluation of the plant's response is necessary to determine any adverse effects. Thus, the probability of failure associated with each dam may differ due to different structural classification and there may be significant differences in the potential consequences of failure. Prairie Island Nuclear Generating Plant and Watts Bar Nuclear Plant (further described below) illustrate the divergent nature of the sites and associated upstream dams, including the consequences of failure. The design of dams vary. The Jocassee Dam is a large rock fill dam. The Watts Bar Dam is an earth and concrete gravity structure, and Lock and Dam #2 has earth and concrete sections.

Available Margin

At Oconee Nuclear Station and Fort Calhoun Station, increased flood estimates have led to ongoing regulatory activity. Like many sites in the U.S. inventory of nuclear power plants, flood levels at these two stations were based on relatively outdated flood estimation methods and/or probable precipitation estimates. The evolution of hydrological modeling — including dam break analysis — and the availability of updated meteorological data are likely to yield flooding estimates that are different than those considered during the initial licensing reviews or IPEEE studies. In addition to changes in estimation methods, changes in regional land use and land cover (e.g., urban expansion and sprawl) may have a significant impact on the watershed of sites and dams. The National Oceanic and Atmospheric Administration’s (NOAA) National Weather Service has historically produced hydro-meteorological reports that provide estimates of probable maximum precipitation for different regions in the United States. However, NOAA’s National Weather Service has discontinued probable maximum precipitation activities and NOAA has not updated Hydro-meteorological Report 51 (which covers most of the U.S. east of the 105th meridian) in over 30 years. Precipitation induced flood estimates for some plants have been based on these older estimates. A recent NRC project will provide NRC staff with an update to NOAA’s existing National Weather Service hydro-meteorological reports for a pilot region in North Carolina and South Carolina.

The staff compared possible margins at selected plants under flood events, and based on certain assumptions regarding the performance of features (as stated below) prepared a graph (shown below).

The x-axis corresponds to margin under the flood caused by the maximum considered precipitation-induced event (excluding wave effects in most though not all cases), which may include floods due to weather-related phenomena such as the probable maximum flood and hurricanes.

The y-axis shows computed margins under the flood caused by the maximum considered dam failure event (excluding wave effects in most though not all cases), coincident with a concurrent flood (as indicated by shapes around numbers).

In this report, margins are computed using the best numerical information that could be located in the FSAR and IPEEE submittals. In general, margins are computed relative to the minimum flood protection elevation of safety-related facilities, structures, systems, and equipment/components. The flood protection elevation of individual critical facilities, structures, systems, and components may be higher. Moreover, margins are generally computed crediting hardened features such as floodwalls and hatches/doors but not temporary barriers such as sandbags. In this report, the computed margin does not generally take into account components that are designed to operate submerged (e.g., see Watts Bar and Sequoyah Nuclear Power Plant FSARs). When conflicting information is found, the margin is computed using the lowest flood protection elevation and highest static water level available in existing documents (e.g., see FSAR and IPEEE submittals for Arkansas Nuclear One). Flood levels that result from events that were “screened out” in the IPEEE due to low probability of occurrence, if reported in the licensee’s IPEEE submittal, are considered when computing available margin (e.g., see Fort Calhoun and Cooper IPEEE submittals).

The graph also demonstrates whether dam failure was considered under the PMF or a lesser flood as indicated by shapes. A square around a number indicates the dam failure event was considered coincident with a PMF, a circle indicates that the dam failure event was considered with a different (typically smaller) flood, and a diamond indicates that it was not clear what flood conditions were considered coincident with dam failure. The screening analysis report contains Table 1, which gives the sources for data used to construct the graph. In cases where a flood less than the PMF is considered, several plants indicate that the dam is designed such that a PMF event will not fail the dam.

Sites plotted in the upper right quadrant of the graph have a positive margin under both the maximum precipitation and dam failure events. However, several of the sites do not consider failure of the dam under a PMF event and thus the magnitude and sign of this margin may change if dam failure coincident with the larger flood is considered. Sites plotted in the lower left quadrant have a negative margin under both precipitation and dam failure events. However, as noted in Regulatory Guides 1.102 and 1.59, this negative margin is acceptable if the plant can be shut down before floodwaters reach the site and safely maintained throughout the duration of the flood event. Sites plotted in the lower right quadrant have a positive margin under precipitation events but a negative margin under a dam failure event. These sites are controlled by flooding due to dam failure. Sites plotted in the upper left quadrant have a positive margin under dam failure events but a negative margin under precipitation events. Sites plotted in this quadrant consider a flood less than the PMF coincident with dam failure. These sites may have a lower (or negative) margin under dam failure if a large precipitation event (i.e., PMF) is considered coincident with dam failure.

Because of the extremely diverse methods used and disparate level of detail provided in plant documentation (i.e., FSAR and IPEEE submittals), care should be given to drawing strong conclusions from the graph because it does not capture important distinctions and subtleties between the sites and the definitions used in plant-specific documentation. Because of the important differences between the sites and the estimation methods used, the original data source referenced in Table 1 should be consulted before drawing conclusions based on the numerical values. However, despite the disparate nature of the data, this graph serves to demonstrate that, for many plants, the reported margin between flood levels and flood protection is small for dam failure and/or precipitation and related weather events. This margin is further reduced when accounting for the effects of wind-generated waves and run up. Moreover, several sites do not consider dam failure coincident with a PMF event and, therefore, the available margin may degrade further if dam failure coincident the larger precipitation event is considered. The necessity of considering dam failure coincident with such extreme events is an area warranting further study.

3. Regulatory Background

10 CFR 50, Appendix A, General Design Criteria-2 requires:

Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these structures, systems, and components shall reflect: (1) Appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena and (3) the importance of the safety functions to be performed.

Existing NRC regulatory guidance related to the definition of external design basis floods and flood protection requirements are contained primarily in Regulatory Guides and the Standard Review Plan (NUREG 0800). The first publication of Regulatory Guide 1.59, “Design Basis Floods for Nuclear Power Plants,” occurred in 1973. The Standard Review Plan (Section 2.4) and Regulatory Guide 1.102, “Flood Protection for Nuclear Power Plants,” were first published in 1975. Many of the 20 plants listed in the GI were first licensed before these three documents became available for use by licensees and NRC staff in evaluating the risks posed to nuclear power plants due to external flooding.

The screen analysis report provides the following timeline of operating dates of the plants listed in the GI as well as the dates of significant NRC publications (including revisions) addressing external flooding of nuclear power plants.

Many of these documents are described briefly in the forthcoming sections. The review of these documents indicates that regulatory and staff guidance related to external flooding from upstream dam failures has evolved. However, existing plants have not been systematically reviewed against the updated criteria.

Descriptions contained in this report focus primarily on the portions of the aforementioned documents addressing external flooding of sites located along streams and rivers, with a particular emphasis on events associated with upstream dam failure. Consequently, for brevity, this report does not include a discussion of the portions of the regulatory documents addressing flooding along seashores and lakes not impacted by dam failure (e.g., due to storm surge, tsunami).

Regulatory Guide 1.59

Regulatory Guide 1.59 discusses the “design basis floods that nuclear power plants should be designed to withstand without loss of capability for cold shutdown and maintenance thereof.” The guide also addresses the acceptability of using alternatives to hardened facilities for flood protection. Regulatory Guide 1.59 was originally published in 1973, with revisions in 1976 and 1977 (with Errata added in 1980). Regulatory Guide 1.59 outlines four regulatory positions that are described below. The description contained herein is based on the 1977 version (revision 2) of Regulatory Guide 1.59.

Regulatory Position 1 of Regulatory Guide 1.59 specifies that safety-related structures, systems, and components identified in Regulatory Guide 1.2916 should be designed to resist the worst flood probable at the site due to a range of phenomena including PMF, seismically-induced flood, hurricane, seiche, surge, and heavy local precipitation. These hazards should be considered coincident with attendant wind-generated wave activity.

For sites located along streams and rivers, the PMF generally provides the design basis flood event. Appendices A and B of Regulatory Guide 1.59 provide an “acceptable level of conservatism for estimating the flood levels caused by severe hydro-meteorological conditions.” Appendix B provides alternative methods for estimating precipitation-induced flooding on streams and rivers that are less laborious but more conservative than the methods in Appendix A. Appendix A of the 1977 revision of Regulatory Guide 1.59 replaces material contained in previous versions of Regulatory Guide 1.59 with a reference to an NRC-endorsed standard produced by the American National Standards Institute (ANSI): ANSI Standard N170-1976, “Standards for Determining Design Basis Flooding at Power Reactor Sites.” A brief description of an update to ANSI Standard N170-1976 is included in a subsequent section of this report. The content of Appendix A of Regulatory Guide 1.59 prior to the 1977 revision is not known because copies of older versions of the document have not been located by the screening analysis group. Regulatory Position 1 of Regulatory Guide 1.59 contains no explicit discussion of flooding due to dam failures from extreme hydro-meteorological events. However, ANSI Standard N170-1976, which is referenced in Appendix A, does address dam failure due to hydrological mechanisms.

Regulatory Position 1 of Regulatory Guide 1.59 explicitly specifies that “[f]lood conditions that could be caused by dam failures from earthquakes should also be considered in establishing the design basis flood.” The guide notes that, along streams and estuaries, seismically induced floods may be produced by dam failures or landslides. Consideration of seismically induced flooding should be based on seismic events in “the same range” as the events considered for design of the nuclear power plant. Moreover, Regulatory Guide 1.59 specifies that an evaluation should be performed of flood waves that may be caused by cascading dam failures triggered by a seismically induced failure of a critically located dam. Appendix A (through reference to ANSI Standard N170-1976) provides acceptable techniques for evaluating hydrological effects of seismically induced dam failures.

Regulatory position 2 of Regulatory Guide 1.59 permits an alternative to designing hardened protection for all safety-related structures, systems, and components requiring protection under Regulatory Position 1 if the following criteria are met:

(1) Sufficient warning time is shown to be available to shut down the plant and implement adequate emergency procedures.

(2) All safety-related structures, systems, and components are designed to withstand and remain functional during the flood conditions resulting from the Standard Project Flood (about 40-60 percent of the PMF) including wind-generated wave activity that may be produced during the worst winds of record.

(3) In addition to (2), reasonable combinations of less-severe flood conditions are considered to the extent needed for a consistent level of conservatism

(4) In addition to (2), at least those structures, systems, and components necessary for cold shutdown, and maintenance thereof, are designed with hardened protective features to remain functional while withstanding the entire range of flood conditions up to and including the worst site-related flood probable (e.g., PMF, seismically-induced flood, hurricane, surge, seiche, heavy local precipitation) with coincident wind-generated wave action as discussed in Regulatory Position 1.

Regulatory Position 3 of Regulatory Guide 1.59 requires that significantly adverse changes to the site environment, that may affect the design basis flood, be identified and used as the basis to develop or modify emergency operating procedures to mitigate potential effects of increased floods.

Regulatory Position 4 of Regulatory Guide 1.59 permits deviation from the methods outlined in Appendices B-C of Regulatory Guide 1.59 if there is adequate verification and pending approval of NRC staff.

Regulatory Guide 1.102

Regulatory Guide 1.102 describes the “types of flood protection acceptable to NRC staff for safety- related structures, systems, and components identified in Regulatory Guide 1.29.” Regulatory Guide 1.102 documents three methods of flood protection:

• Dry site. The plant is built above the design basis flood level and therefore safety-related structures, systems, and components are not affected by flooding. A dry site may be accomplished through natural terrain or engineered fills.

• Exterior barrier. Safety-related structures, systems, and components are protected from inundation and associated static and dynamic forces by engineered features that are external to the immediate plant area. Examples include levees, sea/floodwalls, bulkheads, revetments, and breakwaters.

• Incorporated barrier. Safety-related structures, systems, and components are protected from inundation and associated static and dynamic forces by engineered features at the structure/environment interface. Examples include reinforced walls designed to resist the static and dynamic forces associated with the design basis flood, water stops at construction joints, sealed pipe penetrations, and submarine doors/hatches.

Regulatory Guide 1.102 specifies that, in general, temporary flood barriers that must be installed prior to the design basis flood (e.g., sandbags, plastic sheeting, and portable panels) are not acceptable for issuance of a construction permit. However, unusual circumstances with strong justification (e.g., post- construction changes in flood-producing characteristics of the area) may warrant consideration/acceptance of temporary barriers.

ANSI Standard N170-1976 and ANSI/ANS-2.8-1992

ANSI Standard N170-1976 (“American National Standard for Determining Design Basis Flooding at Power Reactor Sites”) was published in 1976 to specify criteria for determining design basis flooding at power reactor sites (ANSI 1976). NRC endorsed ANSI Standard N170-1976 in Regulatory Guide 1.59 as an acceptable method of defining probable maximum and seismically induced floods on streams.

An update to ANSI Standard N170-1976 was published in 1992 (ANSI 1992). The publisher withdrew ANS/ANSI-2.8-1992 in 2002. This report will refer to the updated Standard as ANSI/ANS-2.8-1992.

A brief review of the portions of the 1976 and 1992 standards related to dam failures indicates that few substantial differences exist between the two versions with regard to the portions of the documents described here. As a result, the document description and associated references contained in this report are based on the 1992 revision (even though Regulatory Guide 1.59 references the 1976 version). Any substantial differences observed between the 1976 and 1992 versions of the standard with regard to the topics discussed in the forthcoming description are noted.

ANSI/ANS-2.8-1992 addresses dam failures due to hydrologic and seismic events as well as other mechanisms. Section 5.5 of ANSI/ANS-2.8-1992 addresses hydrological dam failures. It specifies that potentially critical dams should be analytically subjected to the PMF from the contributing watershed of the dam. If it is shown that the dam can withstand this flood, then no further hydrological failure analysis is required. If hydrologic failure is likely, then the assessment must continue and ANSI/ANS-2.8-1992 offers guidance on performing the requisite failure analyses. In the case that an upstream dam is likely to fail under the PMF on its watershed, the degree and mode of failure should be estimated and the resulting flood wave, combined with the downstream flows that would prevail in this flood, should be routed to the plant site. The dam also shall be tested in the PMF applicable to the total plant watershed. Again, the resulting flood levels at the site must be calculated.

The above load conditions are consistent between the 1976 and 1992 versions of the standard; however the 1992 revision of the standard includes an additional load condition not contained in the 1976 version: “If a significant portion of the plant site watershed lies below the dam, then the probable maximum precipitation centered over the intervening area should be combined with the dam failure wave from the same storm centering.” The resulting flood levels at the site shall again be calculated. The critical flood level is selected as the most severe of the above three load conditions. ANSI/ANS-2.8-1992 also notes that a dam that is safe under its own PMF might fail when the flood is augmented by flood waves from a dam failure further upstream. Thus, when a dam is anticipated to fail under its own PMF, all downstream dams must be analyzed under the demands of the flood wave resulting from the failed dam. Unless safety from failure can be documented, failure of downstream dams shall be postulated and the resulting surge routed to the plant site.

Section 6 of ANSI/ANS-2.8-1992 addresses non-hydrological dam failures. Potential non-hydrological hazards include dam failures resulting from deterioration, settlement, cracking, erosion, leakage, landslides, and mechanical/electrical breakdown of spillway gates as well as dam failures resulting from seismic mechanisms.

The treatment of non-hydrological, non-seismic dam failures in ANSI/ANS-2.8-1992 is terse when compared to the treatment of the hydrological and seismic mechanisms. ANSI/ANS-2.8-1992 generically specifies the following for failure analysis due to non-seismic, non-hydrological mechanisms:

For any upstream dam, available records should be evaluated to appraise the likelihood of failure. If dam safety cannot be so ensured for the normal life of the nuclear plant, the dam shall be postulated to fail in a severe yet credible manner and the resulting flood wave should be routed to the plant site. Routing must accommodate induced failures of other dams on the path of the failure flood wave.

With regard to load combinations related to non-seismic, non-hydrological failures, the following is stated in Section 9.2.4 (Section 9 provides load combinations for severe events19):

No specific guidance or specific event combinations are provided in this standard because of uncertainty in postulating a realistic dam failure from non-hydrologic and non-seismic causes (ANSI 1992, p. 33).

Section 6.2 provides guidance on considering dam failure due to seismic events. Specific seismic load combinations that must be considered are contained in Section 9 (“Combined Events Criteria”) of ANSI/ANS-2.8-1992. Section 9.2.1.2 specifies that the most severe of the following combinations provides an adequate design basis for consideration of seismic dam failures:

Alternative 1:

25-year flood

Dam failure caused by the safe shutdown earthquake (SSE) coincident with the peak of the flood 2 -year wind speed applied in the critical direction

Alternative 2:

One-half the PMF or 500-year flood, whichever is less (The 1976 version of the standard does not include the option of using the 500-year flood in this load combination).

Dam failure caused by the operating basis earthquake (OBE) coincident with the peak of the flood 2-year wind speed applied in the critical direction

As shown above, there is a difference in the level of detail with which dam failures from hydrological, seismic, and other mechanisms are treated in existing regulatory documentation, particularly with regard to the explicit definition of load combinations. As expected, consistent with regulatory guidance existing at the time, there is a similar difference in the treatment of dam failure mechanisms in plant- specific submittals (i.e., FSAR and IPEEE submittals). Often, emphasis is placed on dam failures coincident with seismic events.

Standard Review Plan (NUREG 0800)

The Standard Review Plan (SRP) has been prepared to establish criteria that the NRC staff responsible for the review of applications to construct and operate nuclear power plants intends to use in evaluating whether an applicant/licensee meets NRC's regulations. Both the 1975 and 1980 versions of Section 2.4.4 of the Standard Review Plan emphasize dam failures under seismic mechanisms (both in section title and in content) coincident with floods less than the PMF. NRC revised the Standard Review Plan and renamed it NUREG-0800 in 1981. In the 1981 and newer versions of the Standard Review Plan (including the most recent 2007 revision), the treatment of dam failures in Section 2.4.4 is not limited to seismically induced failures and the title of the section is revised to reflect this change. In the 1981 and 2007 revisions of the Standard Review Plan, Section 2.4.4 is titled “Potential Dam Failures” without reference to seismic events. The most recent versions of Section 2.4.4 explicitly require consideration of nonseismic mechanisms. For example, the 1981 and 2007 revisions specify the following as a required area of review: “Hydraulic failure as a result of overtopping for any reason.” Moreover, the 2007 revision requires consideration of the “[e]ffects of sediment deposition or erosion during dam failure-induced flood waves that may result in blockage or loss of function of SSC important to safety.” Thus, the revision of Section 2.4.4 represents an update in both content and emphasis. No requirement exists to reevaluate plants under the updated Standard Review Plans.

Section 2.4 of the SRP focuses on site hydrology. Pertinent to the proposed GI are Sections 2.4.2 – 2.4.4 and Section 2.4.10. The portions of the SRP applicable to the proposed GI were first published in 1975 in NUREG-75/087. These sections were subsequently revised in 1978, 1981, and 2007. A subset of the applicable sections (2.4.2 and 2.4.3) also was revised in 1989. Figure 13 of the analysis report shows that many of the plants listed in the GI were granted operating licenses before 1975 and consequently before publication of the Standard Review Plan. Overviews of Sections 2.4.2-2.4.4 are provided below. The descriptions contained in this report are based primarily on the 1975 version of the Standard Review Plan; however, several comments are provided relative to the revisions made in more recent versions.

Section 2.4.2 (titled “Floods”) of the SRP summarizes and identifies the individual (or combinations of) flood- producing phenomena that should be considered in establishing the flood-design bases for safety- related plant features. With regard to stream flooding, Section 2.4.2 of the 1975 Standard Review Plan states that the following condition should be considered in establishing possible flood levels on a stream at the location of a nuclear power plant site: “Probable maximum flood (PMF) with coincident wind-induced waves, considering dam failure potential due to inadequate capacity, inadequate flood- discharge capability, or existing physical condition.” In Section 2.4.2 of the 1975 Standard Review Plan, no additional guidance beyond this statement is provided relative to hydrologically-induced dam failures. The most recent version of Section 2.4.2, published in 2007, provides a similar statement and specifies the following with regard to hydrological dam failures:

In order to establish the design-basis floodwater elevation, the staff evaluates several severe flooding scenarios, which may include: (a) PMF coincident with upstream dam failure (single or multiple failures including cascading failures due to hydrological causes) and wind-induced waves….

With regard to seismic mechanisms, Section 2.4.2 of the 1975 Standard Review Plan states that the following should be considered when specifying possible flood levels at a site: Seismically-induced dam failures (or breaches), and maximum water level at site from: Failure of dam (or dams) during safe shutdown earthquake (SSE) coincident with 25-year flood.

Section 2.4.3 of the SRP, titled “Probable Maximum Flood (PMF) on Streams and Rivers,” addresses specification of the probable maximum flood on streams and rivers. There is no explicit discussion of dam failures in Section 2.4.3 with the exception of a reference to Regulatory Guide 1.59. Specifically, Section 2.4.3 of the 1975 Standard Review Plan specifies: "The probable maximum flood as defined in Regulatory Guide 1.59 has been adopted as one of the conditions to be evaluated in establishing the applicable stream and river flooding design basis referred to in General Design Criterion 2, Appendix A, 10 CFR Part 50."

The analysis group is unable to locate the content of Regulatory Guide 1.59 at the time the 1975 Standard Review Plan was published. Therefore, it cannot be ascertained if the above reference required consideration of dam failures when specifying the PMF at a site. However, after the revision of Regulatory Guide 1.59 in 1977 (errata 1980), it is known that Appendix A of Regulatory Guide 1.59 references ANSI Standard N170-1976 that addresses dam failures from a variety of mechanisms. In addition, more recent versions of the Standard Review Plan make similar references to Regulatory Guide 1.59.

Section 2.4.4 of the 1975 version of the SRP, titled “Potential Dam Failures (Seismically Induced),” addresses dam failures due to seismic events. The following statement was taken from Section 2.4.4 of the 1975 Standard Review Plan: "The acceptable "worst conditions" to be postulated for analysis of upstream failures in lieu of substantiation of seismic resistance capability are:

1. A 25-year flood on a full reservoir coincident with the dam-site equivalent of the [safe-shutdown earthquake], and
2. A standard project flood (a flood about half the severity of a PMF) on a full reservoir coincident with the dam site equivalent of the [operating basis earthquake].

Thus, the 1975 version of Section 2.4.4 of the Standard Review Plan requires consideration of dam failure under a seismic event coincident with a 25-year flood or standard project flood. The events should be considered with full flood control reservoirs. The 1978 revision (1980 publication) of Section 2.4.4 of the Standard Review Plan modifies the above statement slightly: "The acceptable "worst conditions" to be postulated for analysis of upstream failures are:

1. Dam able to withstand [safe-shutdown earthquake] (equivalent to seismic Category I structures)--assume no failures;
2. Dam failure caused by [safe-shutdown earthquake]-- assume dam failure coincident with 25-year flood and 2-year extreme wind speed at the site; and
3. Dam failure caused by [operating basis earthquake]--assume dam failure coincident with SPF and 2-year extreme wind speed at the site.

The above statement indicates that, if a dam can be shown to withstand the safe shutdown earthquake, then no failure analysis of the dam coincident with a flood is necessary.

Implications of Regulatory Framework

NRC regulatory documents described above focus most heavily on dam failures due to seismic mechanisms, particularly when considering the versions of the documents available at the time most nuclear power plants were licensed. It has been established in recent NRC studies that actuarial data do not provide a basis for placing an unbalanced emphasis on dam failures due to seismic events. Hydrological failures (e.g., due to overtopping because of an extreme precipitation event) as well as other failures (e.g., failures due to internal erosion or mechanical/operational deficiencies) are statistically more common than seismically induced failures. The rarity of large seismic events has a strong influence on this statistic and, consequently, statistical data should not be used to conclude that seismic dam failures are not important. Dam failure modes can generally be grouped into the following categories:

• Overtopping occurs when the level of the retained reservoir exceeds the capacity/height of the dam. Typically, overtopping is the result of a rapid rise in water level without substantial warning (e.g., during flash floods or following collapse of an upstream dam). About 30-40 percent of all dam failures are caused by overtopping or other weather-related phenomena.

• Foundation defects and internal erosion are responsible for about half of all dam failures. Foundation defects can cause a dam to settle unevenly and jeopardize the structural integrity. Piping and seepage occur when water seeps/leaks through the structure of a dam. This internal erosion weakens the structure of the dam and can lead to failure. Seepage often occurs around pipes, spillways, or other hydraulic structures. However, biological causes (e.g., animal burrows, vegetation) as well as cracking can lead to internal erosion.

• Miscellaneous/other dam failure causes include failures due to poor design and construction, inadequate materials, or lack of maintenance. Such deficiencies can result in loss of structural integrity and consequent dam failure. Seismic failures also fall under this category.

Dam failure incidents are common. Directly using data available in the National Performance of Dams Program Dam Incident Database, historically over 1000 dam incidents have been classified as failure (i.e., uncontrolled release of water) in the United States. The National Performance of Dams Program Dam Incident Database contains over 700 dam incidents classified as failure that have occurred since 1975. The database includes diverse failure events associated with a wide variety of dams, many of which are small and associated with insubstantial consequences. A study performed by NRC found that 148 large dam (dams with heights 40 ft or higher) failures have occurred in the United States. Of these failures, a subset is classified as events involving catastrophic large dam failure. For the set of larger dams that have failed, the data indicates that the dominant causes of failure are about the same as those for the entire population of dams. This creates some uncertainty regarding whether the regulatory guidance forming the licensing basis of most existing nuclear power plants comprehensively addressed the statistically most common dam failure modes.

The evolution of regulatory framework since the 1975 Standard Review Plan has implications beyond provision of the design basis for nuclear power plants. The IPEEE screening criteria, for high winds, floods, and transportation and nearby facility accidents, utilize the guidance contained in the 1975 version of the Standard Review Plan as the basis for “screening out” hazards. The IPEEE screening approach as specified as NUREG-1407 consists of the following steps:

1. Review of plant-specific hazard data and licensing bases

2. Identification of significant changes since the operating license was issued

3. Determination if the plant and facilities meets the 1975 SRP criteria

If the 1975 Standard Review Plan criteria are not satisfied, more extensive evaluations are needed. The following figure from NUREG-1407 provides a graphical representation of the IPEEE screening methodology.

NUREG-1407 specifies that meeting the 1975 Standard Review Plan ensures that the contribution from a flood to core damage frequency is less than 10-6 per year: 'All licensees should compare the information obtained from the review discussed in Sections 5.2.1 [Review Plant-Specific Hazard Data and Licensing Basis] and 5.2.2 [Identify Significant Changes Since OL Issuance] for conformance to 1975 SRP criteria and perform a confirmatory walk down of the plant. If the comparison indicates that the plant conforms to the 1975 SRP criteria and the walkdown reveals no potential vulnerabilities not included in the original design basis analysis, it is judged that the contribution from that hazard to core damage frequency is less than 10-6 per year and the IPEEE screening criterion is met.

With regard to external flooding, the assurance of core damage frequency below 10 E-6 per year is based on a previous study by Chery (1985), which is referenced earlier in NUREG-1407:

For plants designed against current criteria as described in Regulatory Guide 1.59 and applicable Standard Review Plan sections, particularly Section 2.4, floods pose no significant threat of a severe accident because the exceedance frequency of the design basis flood, excluding floods due to failure of upstream dams, is judged to be less than 10 E-5 per year, and the conditional core damage frequency for a design basis flood is judged to be less than 10 E-1. Thus, core damage frequencies are estimated to be less than 10 E-6 per year for a plant designed against NRC's current criteria.

The above conclusion regarding contribution of external flooding to core damage frequency is based on a study that excludes floods due to upstream dam failures.

The IPEEE submittals tended to treat the assessment of hazard due to external flooding as a qualitative screening against the 1975 SRP rather than quantifying plant-specific risk. Based on the excerpts provided above, it is unclear if the basis for screening out hazards due to external flooding based on the 1975 SRP considered risks associated with upstream dam failure due to all applicable mechanisms. Moreover, Section 2.4.4 of the 1975 SRP emphasized dam failures due to seismic events. The treatment of other failure mechanisms in the 1975 SRP is primarily through nested references to ANSI Standard N170-1976 that (as illustrated previously) treats hydraulic failures deterministically and provides limited guidance related to non- seismic, non-hydrologic failure mechanisms. Given available data, it is unclear if meeting the 1975 SRP assures that the contribution of external flooding hazard core damage frequency, when accounting for upstream dam failure, is less than 10 E-6 per year.

Since the last revision of most of the aforementioned regulatory documents, significant advances have occurred in the area of flood estimation resulting from the availability of larger and more accurate datasets, geographical information systems, and new analysis techniques. Consequently, NRC is currently in the process of revising Regulatory Guide 1.59 to more accurately reflect current state of practice. NUREG/CR-7046, titled “Design-Basis Flood Estimation for Site Characterization at Nuclear Power Plants in the United States,” addresses a technical basis for revising Regulatory Guide 1.59. The report describes a hierarchical hazard assessment approach in which the licensee uses progressively refined analyses to demonstrate plant safety against flooding. Under the approach, the licensee uses the least intensive method available to demonstrate safety, i.e., the most demanding and accurate approaches are only used when simpler and more conservative approaches are not sufficient to demonstrate safety. With regard to dam failures, NUREG/CR-7046 specifies that the simplest and most conservative approach is to assume that all upstream dams fail under the PMF (regardless of their design capacity) and the peak discharge for all dams arrives simultaneously at the site. If safety against the flood resulting from this scenario (including wind-wave effects) can be demonstrated, no additional dam failure flood analysis is needed. However, if safety cannot be assured, site-specific data may be used to perform more refined failure analyses. For example, the number of failed upstream dams (and consequently volume of floodwaters routed to the site) may be reduced if strong justification is given to show that some upstream dams will not fail under PMF scenarios. NUREG/CR-7046 emphasizes failure assessment under PMF events rather than seismic events. Consistent with this emphasis, NUREG/CR-7046 provides an example case study in which the initiating event is a dam breach resulting from overtopping during a PMF event.

4. Conclusion of Screening Analysis

The reviewers recommend that the proposed issue related to nuclear power plant site flooding, caused or exacerbated by upstream dam failure, be designated as a GI in NRC's GI Program. In the opinion of the reviewers, the issue meets the criteria specified in MD 6.4. The following summary statements address each of those criteria one by one:

Criterion 1. The issue affects public health and safety, the common defense and security, or the environment. Failure of one or more dams upstream from a nuclear power plant may result in flood levels at a site that render essential safety systems inoperable. For example, high floodwaters may fail all available power sources (e.g., offsite, emergency diesel, auxiliary), hinder operations, and damage other infrastructure resulting in station blackout and higher than acceptable risk. Moreover, safety-related components may be collocated and simultaneously inundated when floodwaters reach a critical elevation. This correlation in demands on collocated components results in a reduction in redundancy and an elevated risk of system failure. The totality of information analyzed in this report suggests that external flooding due to upstream dam failure poses a larger than expected risk to plants and public safety with a probability and consequence sufficient to warrant a GI evaluation.

Criterion 2. The issue applies to two or more facilities and/or licensees/certificate holders, or holders of other regulatory approvals. This scenario is plausible at multiple nuclear power plant sites, as discussed.

Criterion 3. The issue cannot be readily addressed through other regulatory programs and processes; existing regulations, policies, or guidance; or voluntary industry initiatives. NRC regulatory/staff guidance and requirements related to upstream dam failure have evolved since the earlier licensing of U.S. nuclear power plants. A review of the old and new guidance against the plant data covered in this report suggests that additional analysis of external flooding caused or exacerbated by upstream dam failure is warranted and likely to be beneficial. It is important to note that ongoing regulatory actions regarding Fort Calhoun Station do not consider any flood contribution from upstream dam failure(s).

Criterion 4. The issue can be resolved by new or revised regulation, policy, or guidance. It is possible to develop regulations, policy, or guidance that require appropriate analysis of hazard due to upstream dam failure(s) (particularly coincident with large precipitation events) and, if required, mitigation of the associated risks.

Criterion 5. The issue’s risk or safety significance can be adequately determined. Flooding from upstream dam failure(s) can be analyzed and modeled. The impact of potential flooding scenarios can be analyzed and risk significance can be determined. The issue does not involve phenomena or other uncertainties that would require long-term studies or experimental research to establish the risk or safety significance.

Criterion 6. The issue is well defined, discrete, and involves a radiological safety, security, or environmental matter. The issue proposes a specific event and a logical and plausible condition of increased risk. The risk involves a plausible consequence of an uncontrolled release of radiologic material at levels hazardous to the public due to loss of safety-related equipment because of inundation by floodwaters.

Criterion 7. The resolution of the issue may potentially involve review, analysis, or action by the affected licensees, certificate holders or holders of other regulatory approvals. If further analysis results in a conclusion of higher than acceptable risk due to external flooding as a result of upstream dam failure, it may be necessary to require licensees to reevaluate flood risk using refined analysis methods or to take action to mitigate flood risk through the installation of cost- justified backfits.

A significant contributing factor to the screening analysis recommendation is the fact that the initial regulatory approach to this specific issue has evolved considerably and in a manner that addresses weaknesses in the previous approach. The prescribed standard review process is now more comprehensive and rigorous with regard to consideration of upstream dam failure(s) than it was at the time of the issuance of the original licenses for many nuclear power plants. This reflects a deliberate desire to improve the evaluation of the issue as it applies to safety. Moreover, a capability to make more accurate flood projections and risk-informed determinations is readily available. It is the opinion of the review group that reevaluation of a subset of currently operating nuclear power plants using modern review processes and techniques is warranted and is likely to be beneficial.

Active investigations at the Oconee and Fort Calhoun sites have resulted in a much better understanding of the issue as it applies to those sites. NRC’s perception of relevant factors and associated potential risks has significantly improved over what it was prior to the investigations. As a result, further analysis and action addressing flooding is underway with regulatory or procedural changes likely. It is significant that the need for these actions was not obvious until after the prior investigation was performed. Based on the analysis documented in this report, the screening analysis group concludes that a similar evaluation of a subset of U.S. nuclear power plant sites is warranted because these sites may have similar deficiencies not likely to be identified and characterized until an appropriate evaluation is conducted. It is the analysis group’s opinion that the likelihood of significant and beneficial discovery justifies the formal evaluation that would be performed if this issue were classified as a Generic Issue under the program defined in NRC Management Directive 6.4.

On March 6, 2012, the RES Office Director signed a memorandum²¹⁰² transferring responsibility for subsequent GI-204 actions to NRR for regulatory office implementation (i.e., obtain information and develop methods, as needed, to complete plant-specific value/impact analyses of potential backfits to reduce seismic risk).

5. Activities associated with GI-204 while in Stage 3, Regulatory Office Implementation

Specific Actions to address nuclear facilities within the scope of GI-204 were incorporated into activities associated with Recommendation 2.1 documented in SECY-11-0093²¹⁰³ with Enclosure²¹⁰⁴, titled “Recommendations for Enhancing Reactor Safety in the 21st Century, the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident,” dated July 12, 2011. These recommendations were enhanced by the NRC staff following interactions with stakeholders. Documentation of the staff's efforts is contained in SECY-11-0124²¹⁰⁵ with Enclosure 1²¹⁰⁶, dated September 9, 2011; and SECY-11-0137²¹⁰⁷ with Enclosure²¹⁰⁸, dated October 3, 2011.

On March 12, 2012, the NRC issued a request for information²¹⁰⁹ pursuant to 10 CFR Part 50, Section 54(f) to all power reactor licensees and holders of construction permits in active or deferred status. The purpose of the request was to gather sufficient information to enable the NRC staff to determine whether the nuclear plant licenses should be modified, suspended, or revoked.  Enclosure 2 to that letter directed the reevaluation of flooding hazards at operating reactor sites.  The required response section of Enclosure 2 indicated that a "Hazard Reevaluation Report" would be due within one to three years from the date of the letter.  Further, it specified that NRC would provide a prioritization plan, indicating deadlines for individual plants to complete the reevaluations.²⁰⁰⁸

For plants where the reevaluated hazard exceeds the plant's design basis, the licensee was to conduct an integrated assessment. The information gathering is considered to be Phase 1 and was requested to support Phase 2 decision-making and determine whether available or planned measures provide sufficient protection and mitigation capabilities or if further regulatory action should be pursued in the areas of seismic and flooding design, and emergency preparedness. In a letter dated May 11, 2012, the NRC provided the prioritization plan ²¹¹¹and the resultant list of due dates for all sites.

In COMSECY-14-0037, "Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards," dated November 21, 2014²¹¹², the NRC staff requested that the Commission review and approve changes to revise the Recommendation 2.1 flooding assessments and integrate the Phase 2 decision-making into the development and implementation of mitigating strategies in accordance with Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events,"²²³⁸ and the related Mitigation of Beyond-Design-Basis Events rulemaking. In SRM-COMSECY-14-0037, dated March 30, 2015,²¹¹⁴ the Commission instructed the staff to develop a closure plan for the flooding reevaluation activities and to reassess the existing guidance for performing a Phase 1 integrated assessment in order to focus on those plants with the most potential for safety benefits.

In COMSECY-15-0019, "Closure Plan for the Reevaluation of Flooding Hazards for Operating Nuclear Power Plants," dated June 30, 2015,²¹¹⁵ with Enclosure, "Mitigating Strategies and Flooding Hazard Reevaluation Action Plan," ²¹¹⁶, the staff provided revised guidance for performing a Phase 1 integrated assessment and described a modified process for identifying the list of plants that would be required to perform an integrated assessment. The process proposed by the staff included the development of a graded, risk-informed and performance-based approach consistent with Commission direction to focus on those plants with the greatest potential need for safety enhancements. Specifically, the process included consideration and evaluation of local intense precipitation by performing a focused evaluation of the impact of the hazard and implementing any necessary programmatic, procedural, or plant modifications to address the hazard, taking into account available warning time. The process also considered flood protection and available physical margin, where licensees will confirm the capability of existing flood protection to address the hazard exceedance by performing a focused evaluation. For licensees where the reevaluated hazard cannot be addressed via existing or planned flood protection, the process also includes the performance of an integrated assessment, using revised guidance, in order to conduct more detailed evaluations of plant response capability. This revised integrated assessment will capture, among other information, quantitative characteristics about the reliability of various aspects of plant response (e.g., reliability of equipment and manual actions), and risk insights with a focus on cliff-edge effects. The results will be used by the NRC to determine whether additional regulatory action, such as a plant-specific backfit, are warranted.

In SRM-COMSECY-15-0019, dated July 28, 2015,²¹¹³ the Commission also approved the staff's plans to modify the approach for integrated assessments to implement a graded approach for determining the need for, and prioritization and scope of, plant-specific integrated assessments. As discussed in COMSECY-15-0019, the majority of sites with reevaluated flooding hazards exceeding the design-basis flood are expected to screen out from the integrated assessment process. The licensees will instead provide focused evaluations to ensure appropriate actions are taken and that these actions are effective and reasonable.

On April 12, 2016, the Nuclear Energy Institute (NEI) submitted guidance NEI 16-05,"External Flooding Assessment Guidelines, ²¹¹⁷ The guidance is an industry-developed methodology that describes the flooding impact assessment process, which is intended to meet the requested information of an integrated assessment, as described in the document titled, “Request for Information Pursuant to 10 CFR 50.54(f) Regarding Recommendations 2.1, 2.3, and 9.3, of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident,” issued July 2011,²²⁴⁰ and to incorporate the changes described in COMSECY-15-0019.

On April 15, 2016, the NRC staff issued ISG JLD ISG 2016-01, "Guidance for Activities Related to Near-Term Task Force Recommendation 2.1, Flooding Hazard Reevaluation; Focused Evaluation and Integrated Assessment,"²¹¹⁸ describing to stakeholder's methods acceptable to the staff for performance of the focused evaluations and revised integrated assessments and describe some exceptions and clarifications to NEI 16-05, Revision 0. This guidance is not intended for use in design-basis applications or in regulatory activities beyond the scope of performing the focused evaluations and integrated assessment part of NTTF Recommendation 2.1 flooding activities. Compliance with the ISG was not mandatory, it was guidance. Together, COMSECY-15-0019 and JLD-ISG-2016-01, outline a revised process for addressing cases in which the reevaluated flood hazard is not bounded by the plant’s CDB. The revised process describes an approach in which licensees with a LIP hazard exceeding their CDB flood will not be required to complete an integrated assessment, but instead perform a focused evaluation. As part of the focused evaluation, licensees will assess the impact of the LIP hazard on their site and then evaluate and implement any necessary programmatic, procedural, or plant modifications to address this hazard exceedance. For other flood hazard mechanisms that exceed the CDB, licensees can assess the impact of these reevaluated hazards on their site by performing either a focused evaluation or a revised integrated assessment. For those plants that performed a flooding integrated assessment, the Phase 2 decision-making process (as described in a letter dated September 16, 2016, letter²¹¹⁹ and Enclosure²¹²⁰ would determine whether additional plant specific regulatory actions were necessary. If the reevaluated flood hazard is bounded by the CDB flood hazard for each flood-causing mechanism at the site, licensees are not required to perform any additional flooding evaluations.

A key guidance document that was used by the staff to evaluate flooding MSAs was Appendix G of NEI 12-06, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide," Revision 4, issued December 2016,²¹²¹ The NRC’s endorsement of NEI 12-06, Revision 4 is described in Japan Lessons-Learned Division (JLD) Interim Staff Guidance (ISG) JLD-ISG-2012-01, Revision 2,²¹²⁴ "Compliance with Order EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond- Design-Basis External Events.”²²³⁸ Appendices G and H were first introduced in Revision 2 of NEI 12-06, endorsed by revision 1 of the ISG.²²⁴²

Section 6 of JLD-ISG-2012-01, Revision 2, provides guidance regarding the treatment of reevaluated flood hazard information in mitigation strategies developed in response to Order EA-12-049, “Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events."

The draft final MBDBE rule SECY-16-0142²¹²³ contained provisions that would have required mitigation strategies to address the reevaluated seismic and flood hazard information on a generic basis. However, these provisions were removed from the approved final MBDBE rule as the Commission determined that the generic MSA requirements did not meet the requirements of 10 CFR 50.109, “Backfitting,” and 52.98, “Finality of combined licenses; information requests.” As a result, Section 6 of JLD-ISG-2012-01, Revision 2²¹²⁴ is no longer consistent with the direction provided by the Commission in the SRM²¹⁴⁴ with details in with Enclosure 2²¹⁴⁵ dated January 24, 2019. The SRM directs the staff to use the 50.54(f) process to ensure that the agency and its licensees will take the needed actions, if any, to ensure that each plant is able to withstand the effects of the reevaluated flooding and seismic hazards on a site-specific basis.

On February 28, 2019, NRC held a public meeting²¹³⁴ to discuss with stakeholders the process that the staff will use to complete the 50.54(f) process in light of the approved MBDBE rule. In support of the meeting, the staff issued a discussion paper titled, "NRC Staff Preliminary Process for Treatment of Reevaluated Seismic and Flooding Hazard Information in Backfit Determinations," issued February 2019.²¹³⁵ Staff is finalizing the path forward and expects to complete the 50.54(f) process within the previously established timelines.

The flooding reevaluated hazards information provided in response to the 50.54(f) letter and reviewed by the staff includes the following licensee submittals:

1. Flooding hazard reevaluation reports (FHRR),
2. Flooding mitigation strategies assessments (MSAs); and
3. Flooding focused evaluations (FE) or integrated assessments (IA)

As of 2019, all licensees have submitted their Flood Hazard Reevaluation Reports (FHRRs) describing whether the flooding hazard exceeds current design basis and whether the plant will submit a focused or integrated assessment. The NRC staff completed their review and issued staff assessments (SAs) for all FHRRs submitted. The SA documents the staff’s review of the reevaluated hazards at each site and documents that the evaluation is suitable input for further flooding assessments.

On September 15, 2020, the Office of Nuclear Reactor Regulation (NRR) sent RES a memorandum recommending closure of GI-204 204.²²¹² This recommendation is based on the completion of the risk-informed reevaluation of the flooding hazards, including upstream dam failures, for operating power reactor plants in response to the lessons-learned from the reactor accident at the Fukushima Dai-ichi site. In addition, staff from the Office of Nuclear Material Safety and Safeguards (NMSS) and NRR completed an analysis of the applicability of these lessons-learned to facilities other than operating power reactors. The associated facilities included decommissioning reactors with spent fuel stored in spent fuel pools (SFP), and Independent Spent Fuel Storage Installations (ISFSIs).

This recommendation is aligned with the NRC’s Principles of Good Regulation, particularly the principles of Openness, Efficiency, Clarity and Reliability. The associated activities have resulted in voluntary safety enhancements which improved many site’s capabilities to protect and mitigate the impacts of all flood hazards, including dam failure events. Moreover, the associated activities have greatly increased the NRC’s level of knowledge and risk insights in the area concerning present-day flood hazards. As such, any additional use of NRC resources on GI-204 would only provide marginal benefits to safety.

In addition to the hazard reevaluation work completed as noted above, the NRC has implemented a process for the ongoing assessment of natural hazards information (POANHI). The process enhancements are described in SECY-16-0144, dated December 29, 2016.²²¹⁴ Guidance in NRR Office Instruction LIC-208, “Process for the Ongoing Assessment of Natural Hazards Information,” institutionalizes a defined structure and procedures to implement this process. Using the enhanced process, the staff can proactively seek out new hazard information and assess its potential impacts on site safety by comparing updated information to existing hazard evaluations for the fleet or individual plants, as appropriate.

Conclusions

Since March 2012, all operating power reactor licensees have reevaluated the flood hazards applicable to their sites, including the effects of postulated upstream dam failure. These reevaluations used present-day, modern techniques and information to determine the flood hazards applicable to each site. The NRC staff reviewed each licensees’ submittals and evaluations. Using a graded, risk-informed approach, the NRC staff used that information to determine if any further regulatory actions would be warranted under the NRC’s backfit rule. Based on the completion of flood reevaluation activities related to the lessons-learned from the Fukushima Dai-ichi accident, the staff has determined that there are no additional regulatory actions that are needed to address flood hazards at operating power reactor sites. This includes flood hazards associated with upstream dam failures.

In addition to flood hazards applicable to operating power reactor sites, the NRC staff performed a detailed evaluation of the need to apply any of the NTTF recommendations to non-operating power reactors, non-power reactors, and non-reactor facilities. The NRC staff concluded that, except for some additional follow-up activities for fuel cycle facilities and higher-power research reactors, the NRC staff has determined that further assessments are not needed based on Fukushima lessons learned and that the existing regulatory requirements and processes ensure adequate protection of public health and safety. The limited follow up actions have been completed. Therefore, no additional regulatory actions were needed to address non-operating power reactors (i.e., decommissioning facilities and ISFSIs).

Although not directly related to the resolution of GI-204, POANHI has enhanced the existing NRC processes such that the staff proactively and systematically reviews new natural hazard information and assess its impact on site safety by comparing updated information to existing hazard evaluations for the fleet or individual plants, as appropriate. Any future issues that may be similar in nature to GI-204 would be assessed by this new, improved, and enhanced process.

The full scope of GI-204 has been addressed through the NRC response to the Fukushima Lessons-Learned. All agency actions associated with GI-204 are complete, including implementation and verification activities by the regulatory office. The NRC staff has determined that no additional evaluations or regulatory activities are necessary.

Closure

Based upon NRR's memorandum, RES issued a memorandum on September 22, 2020,²²¹³ stating that GI-204 was officially closed in accordance with U.S. NRC Management Directive (MD) 6.4 "Generic Issues Program." The MD states that a GI is closed when "A generic issue for which all agency actions associated with the GI are complete, including implementation and verification activities by the regulatory office."

REFERENCES

2008. Memorandum for All Power Reactor Licensees and Holders of Construction Permits in Active or Deferred Status from E. Leeds, “Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3, and 9.3, of the Near-Term Task Force Review of Insights From the Fukushima Dai-Ichi Accident.” March 12, 2012. [ML12053A340] 2102. Memo from B. Sheron to E. Leeds Re: Transfer of Generic Issue 204 for Regulatory Office Implementation. [ML120261155] 2103. SECY-11-0093 - Near-Term Report and Recommendations for Agency Actions Following the Events in Japan [ML11186A959] 2104. SECY-11-0093 - Enclosure: The Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident. [ML111861807] 2105. SECY-11-0124 - Recommended Actions To Be Taken Without Delay From The Near-Term Task Force Report. [ML11245A127] 2106. SECY-11-0124 - Enclosure 1 Recommended Actions To Be Taken Without Delay From The Near-Term Task Force Report. [ML11245A144] 2107. SECY-11-0137 - Prioritization of Recommended Actions to Be Taken in Response to Fukushima Lessons Learned [ML11269A204] 2108. SECY-11-0137 - Enclosure: Staff Assessment and Prioritization of NTTF Recommendations [ML11272A203] 2109. Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3, and 9.3, of the Near-Term Task Force Review of Insights From the Fukushima Dai-Ichi Accident. [ML12053A340] 2111. Prioritization Of Response Due Dates For Request For Information Pursuant To 10 CFR 50.54(f) Regarding Flooding Hazard Reevaluations For Recommendation 2.1 Of The Near-Term Task Force Review Of Insights From The Fukushima Dai-ichi Accident. [ML12097A509] 2112. COMSECY-14-0037: Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards [ML14238A616] 2113. SRM-COMSECY-15-0019: Closure Plan for the Reevaluation of Flooding Hazards for Operating Nuclear Power Plants. [ML15209A682] 2114. SRM-COMSECY-14-0037: Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards. [ML15089A236] 2115. COMSECY-15-0019: Closure Plan for the Reevaluation of Flooding Hazards For Operating Nuclear Power Plants. [ML15153A105] 2116. COMSECY-15-0019: Enclosure 1 - Mitigating Strategies and Flooding Hazard Re-Evaluation Action Plan. [ML15153A110] 2117. Nuclear Energy Institute Draft Guidance NEI 16-05 "External Flooding Assessment Guidelines," Rev 0 - April 12, 2016. [ML16105A327] 2118. JLD-ISG-2016-01 "Guidance for Activities Related to Near-Term Task Force Recommendation 2.1, Flooding Hazard Reevaluation; Focused Evaluation and Integrated Assessment" Interim Staff Guidance Draft Revision 0. [ML16090A140] 2119. Regulatory Decision-Making For Reevaluated Flooding And Seismic Hazards For Operating Nuclear Power Plants. [ML16237A108] 2120. Enclosure - Regulatory Decision-Making for Reevaluated Flooding and Seismic Hazards for Operating Nuclear Power Plants. [ML16237A114] 2121. NEI 12-06, Rev 4, "Diverse and Flexible Coping Strategies (Flex) Implementation Guide." [ML16354B421] 2123. SRM-M190124A: Affirmation Session-SECY-16-0142: Final Rule: Mitigation of Beyond-Design-Basis Events (RIN 3150-AJ49) [ML19024A073] 2124. JLD-ISG-2012-01, Revision 2, Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events. [ML17005A188] 2134. 02/28/2019 Category 3 Public Meeting to Discuss Staff's Preliminary Process for Treatment of Reevaluated Seismic and Flooding Hazard Information in Backfit Determinations [ML19052A511] 2135. Discussion Paper - Treatment of Reevaluated Seismic and Flood Hazards Information in Backfit Analysis. [ML19037A443] 2144. SRM-M190124A: Affirmation Session-SECY-16-0142: Final Rule: Mitigation of Beyond-Design-Basis Events (RIN 3150-AJ49) [ML19024A073] 2145. SRM-M190124A: Affirmation Session-SECY-16-0142: Final Rule: Mitigation of Beyond-Design-Basis Events (RIN 3150-AJ49) Enclosure 2 - Final Rule [ML19023A041] 2212. Closure Recommendation for Generic Issue 204, "Flooding of Nuclear Sites Due to Upstream Dam Failure" [ML20230A216] 2213. Close out of Generic Issue 204, Flooding of Nuclear Sites Due to Upstream Dam Failure [ML20260H122] 2214. SECY-16-0144: Proposed Plan for Closing Remaining Fukushima Tier 2 and 3 Recommendations [ML16286A586] 2238. Order Modifying Licenses With Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events. [ML12056A045] 2240. SECY-11-0093 - Enclosure: The Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident. [ML111861807] 2242. JLD-ISG-2012-01, Revision 1, Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events. [ML15357A163]