EGM 15-02, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance

Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance

• June 10, 2015 - Rev 0

ML15111A269

• February 7, 2017 - Rev 1

ML15111A269

Text - from rev 1

February 7, 2017 EGM 15-002, Rev. 1 MEMORANDUM TO: Daniel H. Dorman, Regional Administrator, Region I Catherine Haney, Regional Administrator, Region II Cynthia D. Pederson, Regional Administrator, Region III Kriss M. Kennedy, Regional Administrator, Region IV William M. Dean, Director, Office of Nuclear Reactor Regulation Brian E. Holian, Director, Office of Nuclear Security and Incident Response FROM: Patricia K. Holahan, Director /RA/ Office of Enforcement SUBJECT: ENFORCEMENT GUIDANCE MEMORANDUM 15-002, REVISION 1: ENFORCEMENT DISCRETION FOR TORNADOGENERATED MISSILE PROTECTION NON-COMPLIANCE

PURPOSE:

This enforcement guidance memorandum (EGM) provides guidance to exercise enforcement discretion for tornado-generated missile non-compliances and is applicable to operating power reactor licensees. This revision incorporates lessons learned during the implementation of revision 0 and allows licensees, on a case-by-case basis, to request an extension to its applicable enforcement discretion timeframe.

CONTACTS: Gerry Gulla, OE/EB 301-287-9143 James Hickey, NRR/DSS 301-415-2180

BACKGROUND:

Nuclear power plants are designed to ensure that structures, systems, and components (SSCs) needed to maintain the facility in a safe condition will be available to mitigate the effects of natural phenomena, including tornadoes and tornado-generated missiles. The U.S. Nuclear Regulatory Commission (NRC) regulations requiring protection from tornado missiles are Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Appendix A, Criterion 2, “Design Bases for Protection Against Natural Phenomena,” and Criterion 4, “Environmental and Dynamic Effects Design Bases.” Methods acceptable to the NRC to comply with the aforementioned regulations are described in Regulatory Guides 1.76 and 1.117, and NUREG0800 Section 3.5.1.4, “Missiles Generated by Natural Phenomena.”

Typically, licensees include a description in their facility’s Final Safety Analysis Report or Updated Final Safety Analysis Report of how compliance with regulatory requirements is achieved. Most facilities use deterministic methods when evaluating protection from tornadogenerated missiles and as a basis for complying with these regulations. However, some licensees utilized an alternative approach by incorporating the NRC-approved, Electric Power Research Institute-developed TORMIS methodology, or other NRC-approved probabilistic risk assessment methodology via the license amendment process.

Over the past several years, licensees and the NRC have identified facilities that have not conformed to their licensing basis for tornado-generated missile protection and are therefore not in compliance with applicable regulations. These non-compliances have been documented in NRC inspection reports and have resulted in license amendment requests (LARs). Some of the non-complying SSCs included technical specification (TS)-required equipment (e.g., emergency diesel generator exhaust header/ductwork, pipe risers, fan motors, etc.), which required an operability determination. In cases where the licensee concluded that the TS-required SSC was inoperable, the licensee was required to complete the actions specified by the TS until the limiting condition for operation (LCO) was met.

Depending on the details of the site-specific issue, licensees may or may not be able to restore the affected equipment to an operable status within the completion time mandated by TS.

Restoring compliance depends on the number of non-complying SSCs and the extent to which their function is affected.

Failure to meet the required TS LCO(s) or restore compliance with the tornado-generated missile protection licensing basis may require a reactor shutdown or operational mode change.

Resumption of reactor operation would not be permitted until the TS LCO is met.

To ensure the widest dissemination of this issue, the staff issued regulatory issue summary (RIS) 2015-06, “Tornado Missile Protection,” (ADAMS Accession No. ML15020A419) to (1) remind licensees of the need to conform their facility to the current, site-specific licensing basis for tornado-generated missile protection, (2) provide examples of failures to conform with a plant’s tornado-generated missile licensing basis, and (3) remind licensees that their systematic evaluation program and/or individual plant examination of external events results do not constitute regulatory requirements, and are not part of the plant-specific tornado-generated missile licensing basis, unless the NRC or licensee took action to specifically amend the licensing basis.

Upon reviewing the above-noted RIS, some licensees may discover that a TS-controlled SSC at their facility does not comply with the plant’s current licensing basis (CLB) and that an operability determination (or functional assessment) will be necessary. If the licensee’s operability determination concludes that the TS SSC is non-complying but operable, or the necessary and related support function is non-complying but functional, it is appropriate for the licensee to address the non-complying condition through their corrective action program.

If the licensee concludes that the TS-required SSC is inoperable, the licensee must follow any required action(s) of the applicable TS LCO(s). Licensees may use compensatory measures to restore an inoperable SSC to an operable but degraded or non-complying status. If the licensee successfully implements compensatory measures to restore the inoperable SSC to an operable but non-complying status, then the licensee can use their corrective action program to restore the SSC’s compliance with the CLB. However, if the licensee cannot perform the LCO required action(s) or restore compliance within the completion time mandated by the LCO, the licensee would be required to shut down the reactor or place the reactor in a mode or other specified condition that is not applicable to the LCO.

Basis for Granting Enforcement Discretion In general, tornado missile scenarios do not represent an immediate safety concern because their risk is bounded by the initiating event frequency and safety-related SSCs are typically designed to withstand the effects of tornados. For a tornado missile induced scenario to occur, a tornado would have to touch down at the site and result in the generation of missiles that would hit and fail vulnerable, unprotected safety-related equipment and/or unprotected safetyrelated subcomponents in a manner that is non-repairable and non-recoverable. For example, the emergency diesel generator exhaust stack would have to be crimped in a manner that would prevent the exhaust of combustion products; if it were sheared off completely, the EDG would likely remain operable. In addition, because plants are designed with redundancy and diversity, the tornado missiles would have to affect multiple trains of safety systems and/or means of achieving safe shutdown.

The Office of Nuclear Reactor Regulation (NRR), Division of Risk Assessment (DRA) has completed a generic risk analysis of potential tornado missile protection non-compliances to examine the risk significance of these scenarios. This assessment (ADAMS Accession No. ML14114A556) documents a conservative, bounding-type analysis of the risk significance for plant facilities that may not be in compliance with their tornado missile protection licensing basis. It used tornado hazard curves provided in NUREG/CR-4461, “Tornado Climatology of the Contiguous United States,” (ADAMS Accession No. ML 070810400) and Regulatory Guide 1.76, “Design-Basis Tornado and Tornado Missile for Nuclear Power Plants,” (ADAMS Accession No. ML100541776). The generic nature of this analysis did not afford the staff the capability to assess plant-specific tornado missile protections which likely exist at many reactors in accordance with their CLB, and that would result in lower risk determinations. It also did not consider the plant-specific nature of the non-compliances or the redundancies of SSCs. The generic analysis assumed that core damage would occur if a tornado hit a plant located in the most active tornado region in the country and that it caused a tornado-generated missile to fail all emergency core cooling equipment at the plant with no ability to recover. Given this conservative assumption, the core-damage frequency (CDF) was calculated to be 4E-5 per year, which is more than an order of magnitude below the 1E-3 per year threshold provided in the NRR Office Instruction LIC-504, “Integrated Risk-Informed Decision-Making Process for Emergent Issues.” Per LIC-504, 1E-3 per year provides a guideline that can be used to determine whether additional regulatory actions should be considered to place a plant in a safe condition. Consequently, the staff’s study established that the CDF associated with tornado missile related non-compliances is well below a CDF requiring immediate regulatory action.

The estimated bounding CDF does not account for a number of conservatisms since the staff could not factor in plant-specific characteristics that could lower the CDF estimate, potentially by as much as one or more orders of magnitude. For example, whereas the study assumed the failure of redundant systems due to tornado-generated missiles, actual spatial configurations of redundant systems at a plant could lower the probability of complete system failures as a result of tornado-generated missiles. Additionally, some tornado-generated missiles may not cause system failures at all or may cause failures that are repairable or recoverable.

It should also be noted that some licensees have sought and received approval of license amendments to accept tornado missile non-compliances based on computer simulations that showed a very small annual probability of a tornado missile strike on any non-complying SSCs (i.e., less than 1E-6 per year). While one must be careful extrapolating from such cases to the entire population of nuclear power plants with non-complying SSCs, these studies support the conclusions used in the staff’s generic analysis.

While the results of the analysis indicate that the CDF associated with tornado missile related non-compliances are well below CDFs requiring immediate regulatory action, the staff concluded that a graded approach to addressing this issue was appropriate. For plants with a higher tornado missile risk (Group A Plants, see enclosure), the staff determined that an enforcement discretion period of three years was appropriate. Plants with a lower tornado missile risk (Group B Plants, see enclosure) were allowed up to five years.

In summary, the generic bounding risk analysis performed by DRA concluded that tornado missile scenarios do not represent an immediate safety concern because their risk is within the LIC-504 risk acceptance guidelines. Therefore, based on this conservative analysis, broad enforcement discretion of up to five years, accounting for differences in initiating event frequency based on geographical location of the plants, will not impose significant additional risk to public health and safety.

Actions:

This EGM applies specifically to an SSC that is determined to be inoperable for tornadogenerated missile protection. The staff should ensure that any inspection effort for these issues be commensurate with the likely minimal risk significance of the issue. For further NRR guidance see “Reactor Oversight Process Application of EGM 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance,” ADAMS Accession No. ML15162A578 and DSS-ISG-2016-01 “Clarification of Licensee Actions in Receipt of Enforcement Discretion per Enforcement Guidance Memorandum EGM 15-002, Enforcement Discretion for Tornado-Generated Missile Protection Noncompliance,” ADAMS Accession No. ML15348A202.

This EGM will allow staff to exercise enforcement discretion for a finding that is not of high safety significance (i.e., Red) and its associated violation, and permit a licensee to continue reactor operation even if the licensee cannot meet the TS LCO required action(s) or restore compliance within the completion time mandated by the LCO. The staff should ensure that the identified items are reviewed sufficiently to determine if they are a condition adverse to quality and if so, verify that the licensee complies with its corrective action program.

After the first tornado missile 10 CFR 50.72 “Immediate notification requirements for operating nuclear power reactors” notification, the staff will exercise enforcement discretion for any subsequent tornado missile 10 CFR 50.72 notifications so long as the associated initial compensatory measures are, or soon (not to exceed the expiration of the time mandated by the corresponding LCO) will be, in place and the licensee reports any additional tornado missile non-compliances in accordance with 10 CFR 50.73 “License event report system.” The staff will exercise this enforcement discretion only when a licensee implements, prior to the expiration of the time mandated by the LCO, initial compensatory measures that provide additional protection such that the likelihood of tornado missile effects are lessened. Licensees are expected to follow these initial compensatory measures with more comprehensive compensatory measures within approximately 60 days of issue discovery. The comprehensive measures should remain in place until permanent repairs are completed, or until the NRC dispositions the non-compliance in accordance with a method acceptable to the NRC such that discretion is no longer needed. Examples of potential compensatory measures the licensee may consider are the following:

a) Development and implementation of procedures and conduct of training for plant staff in performing compensatory and mitigating actions related to tornado missile impact effects on identified safety-related SSCs,

b) Actions to be taken if a tornado watch is predicted or issued for the area to secure potential missiles, protect equipment that could affect safety-related SSC operation, cease maintenance activities in progress on equipment that could affect availability of SSCs, repair/restore SSCs if undergoing maintenance, stage equipment necessary for mitigative actions in protected but promptly accessible locations, and : c) Actions to be taken if a tornado warning is issued for the area (e.g., pre-staging of plant staff at safe, strategic locations to promptly implement mitigative actions, and alerting plant staff necessary for prompt mitigative actions of preparation for response following severe weather conditions).

This enforcement discretion will expire on June 10, 2018, for plants of a higher tornado missile risk (Group A Plants) and June 10, 2020, for plants of a lower tornado missile risk (Group B Plants). The enclosure to this EGM includes all operating reactors grouped according to the DRA analysis. Since the analysis performed by DRA was a conservative, bounding-type analysis that did not afford the staff the capability to assess plant-specific tornado missile protection, licensees may request an extension to their respective expiration date if proper justification is provided. This extension will be granted on a case-by-case basis and compensatory measures should remain in place until compliance is achieved.

A licensee could establish compliance by either installing a plant modification, or by employing a methodology for addressing tornado missile non-compliances acceptable to the NRC. If a licensee chooses to submit an LAR, the LAR should be submitted and found to be acceptable for review in accordance with LIC-109, “Acceptance Review Procedures,” (ADAMS Accession No. ML091810088), within the applicable timeframe established in the enclosure or by the NRC-approved extension timeframe. Enforcement discretion will continue to be in place until the NRC dispositions the licensee’s LAR.

A licensee may receive this enforcement discretion for identified non-compliances on more than one affected SSC. These may include previous NRC-identified unresolved items, as well as any new NRC- or licensee-identified non-compliance. If any affected SSC is not returned to an operable status within the applicable timeframe, or if a licensee fails to submit an acceptable LAR for review within the applicable timeframe, the affected SSC will no longer be eligible for this enforcement discretion. The licensee will be required to follow the applicable TS action statement.

If a licensee’s reactor is, or will be, in a shutdown condition at a point during the applicable timeframe, and is, or will be, in a TS shutdown action statement or required mode change that resulted from tornado missile non-compliance, this enforcement discretion will allow a licensee to restart the reactor.

Through its generic analysis, NRR has concluded that issues associated with the inoperability of an SSC due to tornado-generated missiles, within the applicability of this EGM at nuclear power plants, do not represent an immediate safety concern. Since these issues appear to meet the general philosophy described in the NRC Enforcement Policy Section 3.2, “Violations Involving Old Design Issues,” the staff should disposition the violation with enforcement discretion and refrain from processing the related inspection finding through the Significance Determination Process and into the Reactor Oversight Process Action Matrix. Both the finding and violation should be documented in an inspection report and reference this EGM. The regional offices should consult with both NRR and the Office of Enforcement for a tornado missile violation that is potentially associated with a finding of high safety significance (i.e., Red) as defined in Inspection Manual Chapter 0609, “Significance Determination Process.”

Further, as a part of implementing this enforcement discretion, an enforcement action (EA) tracking number will be assigned and be documented in an inspection report. Subsequent identified issues can be documented using that same EA number. An enforcement panel is not required unless a site specific issue warrants further evaluation; in this case another EA number would be required. The cover letter to the inspection report that discusses the finding and violation should include the following or similar language:

“A finding and an associated violation of [state the regulation, e.g., the licensee’s current site-specific licensing basis for tornado-generated missile protection, 10 CFR Part 50, Appendix A, Criterion 2, 10 CFR Part 50, Appendix A, Criterion 4, etc.] was identified. Because this finding and violation was identified during the discretion period covered by Enforcement Guidance Memorandum 15-002 Rev 1, “Enforcement Discretion for Tornado Missile Protection Non-compliance” and because the licensee was implementing compensatory measures, the NRC is exercising enforcement discretion by not issuing an enforcement action and is allowing continued reactor operation.” This EGM will only apply to operating power reactor licensees.

Enclosure:

Nuclear Power Plants Grouped by Tornado Initiating Event Frequencies cc: V. McCree, EDO M. Weber, Acting DEDM M. Johnson, DEDR R. Lewis, AO V. Ordaz, Acting NRO M. Dapas, NMSS SECY D. Dorman, et al. -7-

Further, as a part of implementing this enforcement discretion, an enforcement action (EA) tracking number will be assigned and be documented in an inspection report. Subsequent identified issues can be documented using that same EA number. An enforcement panel is not required unless a site specific issue warrants further evaluation; in this case another EA number would be required. The cover letter to the inspection report that discusses the finding and violation should include the following or similar language:

“A finding and an associated violation of [state the regulation, e.g., the licensee’s current site-specific licensing basis for tornado-generated missile protection, 10 CFR Part 50, Appendix A, Criterion 2, 10 CFR Part 50, Appendix A, Criterion 4, etc.] was identified. Because this finding and violation was identified during the discretion period covered by Enforcement Guidance Memorandum 15-002 Rev 1, “Enforcement Discretion for Tornado Missile Protection Non-compliance” and because the licensee was implementing compensatory measures, the NRC is exercising enforcement discretion by not issuing an enforcement action and is allowing continued reactor operation.” This EGM will only apply to operating power reactor licensees.

Enclosure:

Nuclear Power Plants Grouped by Tornado Initiating Event Frequencies cc: V. McCree, EDO M. Weber, Acting DEDM M. Johnson, DEDR R. Lewis, AO V. Ordaz, Acting NRO M. Dapas, NMSS SECY DISTRIBUTION:

RidsEdoMailCenter OE Distribution OE-Web (3 days after issuance) EGM File Binder Regional Enforcement Coordinators, NMSS, NSIR and NRO OE R/F ADAMS Accession No: ML16355A286 *Via E-mail OFFICE OE:EB OE:BC NRR/D RI RII NAME GGulla RFretz WDean* DDorman* Chaney* DATE 1/13/17 1/18/17 1/26/17 1/24/17 1/24/17 OFFICE RIII RIV OGC/MLE OE NAME CPederson* KKennedy* LBaer* PHolahan DATE 1/25/17 1/24/17 2/6/17 2/7/17 OFFICIAL RECORD COPY Enclosure Nuclear Power Plants Grouped by Tornado Initiating Event Frequencies Group A Plants – Higher Tornado Missile Risk Arkansas Nuclear One 1 & 2 Quad Cities 1 & 2 Beaver Valley 1 & 2 River Bend Braidwood 1 & 2 Robinson 2 Browns Ferry 1, 2 & 3 Sequoyah 1 & 2 Brunswick 1 & 2 Summer Byron 1 & 2 Susquehanna 1 & 2 Callaway Vogtle 1 & 2 Catawba 1 & 2 Waterford 3 Clinton Watts Bar 1 & 2 Comanche Peak 1 & 2 Wolf Creek Cooper D.C. Cook 1 & 2 Group B Plants – Lower Davis-Besse Calvert Cliffs 1 & 2 Dresden 2 & 3 Columbia Duane Arnold Diablo Canyon 1 & 2 Farley 1 & 2 Hope Creek Fermi 2 Indian Point 2 & 3 FitzPatrick Limerick 1 & 2 Ginna Millstone 2 & 3 Grand Gulf North Anna 1 & 2 Harris Oyster Creek Hatch 1 & 2 Palo Verde 1, 2 & 3 LaSalle 1 & 2 Peach Bottom 2 & 3 McGuire 1 & 2 Pilgrim Monticello Salem 1 & 2 Nine Mile Point 1 & 2 Seabrook Oconee 1, 2 & 3 South Texas Project 1 & 2 Palisades St. Lucie 1 & 2 Perry Surry 1 & 2 Point Beach 1 & 2 Three Mile Island Prairie Island 1 & 2 Turkey Point 3 & 4

Reference:

NUREG/CR-4461, “Tornado Climatology of the Contiguous United States,” Revision 2