ML12115A080

Memo 042412 TIA 2012-07 for Point Beach EDG Tornado Missiles

ML12115A080
Person / Time
Site:	Point Beach
Issue date:	04/24/2012
From:	O'Brien K Division of Reactor Safety II
To:	Nelson R Division of Policy and Rulemaking
References
TIA 2012-07
Download: ML12115A080 (14)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION REGION III 2443 WARRENVILLE ROAD, SUITE 210 LISLE, IL 60532-4352 April 24, 2012 MEMORANDUM TO: Robert A. Nelson, Deputy Director Division of Policy and Rulemaking Office of Nuclear Reactor Regulation FROM: Kenneth G, OBrien, Deputy Director /RA/

Division of Reactor Safety Region III

SUBJECT:

TASK INTERFACE AGREEMENT - APPLICABILITY OF GDC REQUIREMENTS IN OPERABILITY DETERMINATIONS AND ASSESSMENT OF THE POINT BEACH OPERABILITY DETERMINATION FOR EMERGENCY DIESEL GENERATORS WITH RESPECT TO TORNADO MISSILES (TIA 2012-07)

INTRODUCTION This Task Interface Agreement (TIA) documents the NRC staffs position that the definition of OPERABLE requires the Point Beach Nuclear Plant (PBNP) emergency diesel generators (EDGs) to continue to fulfill their safety function following external events such as tornados. In addition, this TIA documents the results of the NRC staffs review of the licensees Prompt Operability Determination (POD), Condition Report (CR) 1678709, NRC Issues Position on Missile Protection for G-01/02 Exhaust. The staff of Region III has worked closely with members from the Office of Nuclear Reactor Regulation (NRR) in developing this position, which was subsequently communicated via this document using the Concurrence Method as described in NRR Office Instruction COM-106, Control of Task Interface Agreements, Revision 3. This TIA was developed with significant contributions from NRR.

BACKGROUND During the Component Design Bases Inspection (CDBI) completed on October 3, 2006, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML063200093), the inspectors reviewed the design and configuration of the G-01 and G-02 EDGs. These EDGs are considered one train for both Unit 1 and Unit 2 while the other EDGs (G-03 and G-04) are considered another train. The inspectors identified a concern with respect to the impact of tornado missiles on the exhaust stacks for G-01 and G-02. This concern was the subject of the Final - Task Interface Agreement (TIA) - Evaluation of Point Beach Nuclear Plant Tornado Missile Protection Licensing Basis (TIA 2011-011), dated August 16, 2011, (Reference 4).

CONTACT: Benny Jose, DRS/Region III (630) 829-9756

R. Nelson In TIA 2011-011, the NRR staff concluded the licensing basis for PBNP requires the EDG exhaust stacks to be protected from tornado missiles. The licensees proposed use of the IPEEE, other non-licensing basis documentation, and judgments of low probability to demonstrate compliance with the licensing basis were not acceptable without submitting this material for NRC staff review and inclusion in the Final Safety Analysis Report (FSAR). The Bechtel topical report referenced in the FSAR did not address the issue on what components are required to be protected from tornado missiles. The Region documented a non-cited violation against 10 CFR 50, Appendix B, Criterion III and, although the NRC staff had the above concerns, concluded the EDGs were operable but non-conforming based on a perceived tornado season.

In February 2012, the Regional staff engaged the licensee since tornado season was approaching. Additional discussions with NRR prompted a correction that tornadoes or high winds can be considered to occur at any time of the year and as such, there should be no consideration for a defined tornado season. On March 27, 2012, the licensee issued Revision 4 to the POD (Reference 1). While the staff was reviewing this document and preparing the NRC position, the licensee issued Revision 5 to the POD (Reference 2). While the licensee defines the non-conformance differently in these revisions, the licensee concludes both G-01 and G-02 are operable but non-conforming with respect to the exhaust stacks. The licensees key points and the NRC staffs evaluation of these points are provided below.

LICENSEE'S POSITION As noted above, the staff reviewed Revisions 4 and 5 of the POD. Although Revision 5 reflects the most current position, applicable points raised in Revision 4 are also included below.

• Lack of Applicable Performance Standard for Exhaust Stacks In Revision 5, the licensee concludes the non-conforming condition relates to the station not having an applicable performance standard for equipment important to safety located outside of Class I structures. The licensee bases this conclusion on an interpretation of PBNP General Design Criteria (GDC) 2, which states:

Those systems and components of reactor facilities which are essential to the prevention or to the mitigation of the consequences of nuclear accidents which could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to the performance standards that enable such systems and components to withstand, without undue risk to the health and safety of the public, the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomena such as earthquake, tornado, flooding condition, high wind, or heavy ice. The design bases so established shall reflect: (a) appropriate consideration of the most severe of these natural phenomena that have been officially recorded for the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.

The licensee states the standard which demonstrated compliance with the PBNP GDC 2 was Bechtel Topical Report B-TOP-3, "Design Criteria for Nuclear Power Plants Against

R. Nelson Tornadoes," dated March 12, 1970, and this standard meets the intent of the GDC by enclosing equipment in thick reinforced concrete structures. The licensee reasons that since the exhaust stacks are located outside [Emphasis added] these structures, B-TOP-3 cannot be applied. Therefore, the station does not have a standard for equipment located outside Class I structures and this condition is non-conforming.

• Tornado Missiles Are Not Discussed in License Documents The licensee lists several sections of the FSAR and Technical Specification (TS) and concludes performance standards beyond the GDC were not established for equipment external to Class I structures such as the EDG exhaust stacks. The licensee also states missile protection for the exhaust stacks was not questioned during the licensing of the plant and since the exhaust stacks are located outside of a Class I structure, a missile impact was either deemed non-credible or overlooked in error. The licensee also concluded the licensing bases do not require the EDGs be capable of supporting either a simultaneous or subsequent design bases accident (DBA) or other events described in Chapter 14 of the FSAR. The licensee specifically states the occurrence of an external event such as a tornado is not discussed or described as an initiating event for the anticipated operational occurrences (loss of offsite power, for example) and external events are not analyzed accidents or transients.

[In Revision 5, the licensee did not describe supporting details on their thought process which led to these conclusions; however, additional insights were provided in Revision 4.

These are provided below.]

• (Revision 4) Use of Specified Safety Function and Safety Function On page 9 of Revision 4, the licensee defines the specified safety function of the emergency diesel generators (for which the exhaust stacks are supporting equipment) is to start, automatically load safe shutdown and/or emergency loads, and to continue to supply those loads as long as necessary to maintain safe shutdown or mitigate the consequences of analyzed accidents and transients described in Chapter 14 of the FSAR.

The licensee contends that a postulated external event (including a tornado) is not a specified event in Chapters 6 or 14 of the FSAR, and therefore not a "specified safety function." Rather, the functioning of the EDGs in support of a tornado event is a function implied by PBNP GDC 2 and is therefore a "specified function." As described in the correspondence with the NRC (Atomic Energy Commission (AEC)) pertaining to tornado protection, and consistent with later approved regulatory guidance, the specified function of the EDGs in the event of a tornado is to support reaching "safe shutdown" conditions.

Therefore, the licensee position is that the specified function of the EDGs is the operational requirement that needs to be evaluated in the context of this concern which, for the EDGs, is to automatically start and carry the connected loads. Although not specified in the current licensing bases (CLB), the design bases include the loads necessary to mitigate a tornado induced steam line break (i.e., a break occurring outside of the containment). These are bounded by the maximum load required to be carried in the event of a combination DBA loss of coolant accident on one unit, and hot shutdown loads on the other unit, with only one EDG in operation.

R. Nelson * (Revision 4) Relationship Between General Design Criteria, Technical Specification, and Operability On page 2 of Revision 4, the licensee acknowledges the relationship between the GDCs and TS is discussed in Appendix C.l, Relationship Between the General Design Criteria and Technical Specifications, of Inspection Manual (IM) Part 9900 (Technical Guidance) under "Operability Determinations & Functionality Assessments for Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety." The licensees position is based on a statement contained in this guidance, specifically, Failure to meet a GDC in the CLB should be treated as a degraded or nonconforming condition and; therefore, the technical guidance in this document is applicable." The licensee concludes, while the requirement to provide tornado missile protection for the EDG exhaust stacks is part of the license basis criteria for the design of the plant, it does not, in and of itself, constitute a necessary requirement for OPERABILITY.

• (Revision 4) Criteria for Inclusion in Technical Specification On page 4 of Revision 4, the licensee references the Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors which elaborates on the four criteria of 10 CFR 50.36. The licensee states tornados and tornado protection are not included in the Chapter 6 or 14 analyses contained in the FSAR and that tornados and tornado protection are not a Condition II, III, or IV event per ANSI 18.2. The licensee concludes Criterion 2 and 3 are not applicable to the tornado event.

The licensee also contends that if a structure, system or components (SSCs) only function was an initial condition or mitigation assumed for a tornado or tornado missile, that SSC would not be included as a limiting condition for operation (LCO) in the TS. A function that would not result in an SSC being included in an LCO cannot result in an LCO not being met.

A function required for OPERABILITY must, by definition, satisfy the criteria for inclusion in the TSs. Therefore, the licensee reasoned unless tornado protection is a function that satisfies Criterion 2, 3, or 4, it is not subject to TS OPERABILITY requirements.

• Relevant Licensing Correspondence Regarding Safe Shutdown Requirements and Tornados On page 5 of Revision 5, the licensee references a series of questions developed by the Agency during the initial licensing of PBNP. The responses to the questions became a part of the license bases for PBNP. The responses were incorporated into the text of the Final Facility Description and Safety Analysis Report (FFDSAR), and subsequent revisions of the site Safety Analyses Report retained the information, though often in abridged form. The licensee focused on portions of a question requesting additional information pertaining to design features to withstand a tornado. Specifically:

"Structures which should be included and discussed individually are the containment building, the primary auxiliary building, including that portion enclosing the spent fuel storage pit and the control room, the diesel generator housing, the intake structure and pump house and any other equipment or structure required for safe shutdown of the units." [Emphasis added]

The licensee concludes that this established a safe shutdown listing of structures as the criterion needed to be supported following a tornado, and does not discuss supporting a DBA event. The licensee states the focus of the question is on "equipment or structure[s]

required for safe shutdown;" therefore, protection of equipment necessary to mitigate the

R. Nelson consequences of design basis accidents (as might be implied by the general wording of the PBNP GDC) was not in question.

• Tornado Missile Strike is Not a Credible Consequential Failure On page 7 of Revision 5, the licensee describes their bases for concluding a tornado missile strike which impacts both EDGs is not credible. Based on Appendix C.6 of IM Part 9900, the licensee concludes it is appropriate to assume a tornado event may occur. The licensee then states given that a tornado occurs, failure of an EDG exhaust stack due to being struck from a tornado generated missile would be a consequential failure. From Appendix C.3, the licensee concludes, to affect OPERABILITY, consequential failures must be credible. Credibility is a function of probability, and therefore probabilistic approaches are appropriate for assessing whether there is a credible undue risk to the public health and safety. The licensee continues by stating missile protection for the exhaust stacks were not questioned during the licensing of the plant and that this indicates that missile induced failure of the exhaust stacks was not considered credible at that time. The licensee also concludes new credible consequential failure modes have not occurred and in addition, there are no examples of actual instances of failures of comparable large diameter standard weight piping being crushed from tornado-induced missiles.

In addition, the licensee asserts the results of NUREG/CR 4458, Shutdown Decay Heat Removal Analysis of a Westinghouse 2-Loop Pressurized Water Reactor, further supports the unprotected exhaust stacks do not represent undue risk to the public. The licensee states the NUREG/CR concluded the risk of failure of a single EDG due to missile impact was about 0.0002, or once in 5,000 occurrences. The licensee concludes this estimated frequency of occurrence fails to meet the credibility test for consequential failures. The licensee further states this is supported as evidenced by the acceptance of a higher failure rate (i.e., an EDG reliability rating of 97.5 percent.)

• Ability of Exhaust Stacks to Withstand Tornado Missiles Strikes On page 9 of Revision 5, the licensee discusses the ability of the exhaust stacks to withstand missile strikes by referencing NUREG/CR-4458 and using probabilistic risk values for core damage from failure of the exhaust stacks contained in the NUREG. The risk is quoted as 6.5E-5/year without reinforced exhaust stack supports and 1E-8/year for missiles only without considering wind overload factors. The licensee further references a recent study (Belcan Project #348-1496, October 20, 2011) that analyzes the single impact of a wood plank. Based on this study, the licensee states the resulting damage to the exhaust stack is minimal and the EDG would continue to be capable of carrying at least 99.5 percent of its full rated load. The licensee states the maximum load required during a DBA LOCA on one unit and hot shutdown loads on the other unit with only one EDG in operation is 95.4 percent.

The licensee also provides a subjective discussion, stating a car missile impact is bounded by the plank for the following reasons:

- Automobiles and missiles typified by automobiles are crushable, except for the engine block which is fully surrounded by energy absorbing structures.

- Automobiles travel at a significantly lower speed than the plank.

R. Nelson - The impact area for the automobile is larger so the impact energy is distributed over a larger area, which reduces the impulse energy.

- Automobiles generally roll along the ground, and the functional bottom of the exhaust stacks are about 14 above the ground.

- The missile barrier covering the EDG room intakes (and adjacent to the base of the exhaust stacks) would significantly protect the exhaust stack and limit the extent of crushing to the exhaust stack.

Based on the information provided, the licensee concludes even with a maximally damaged exhaust stack, there is a high degree of confidence the EDG would remain capable of carrying the necessary connected loads.

In conclusion, the licensee believes G-01 and G-02 are OPERABLE but have a non-conforming condition with respect to the lack of a performance standard for the exhaust stacks.

NRC STAFF EVALUATION NRC staff from Region III and NRR participated in several discussions with the licensee to ensure understanding of their position and to communicate the NRC position. The NRC staff reviewed the licensees Prompt Operability Determinations and identified several significant concerns with the licensees position and justification.

Below is our analysis of the licensees positions:

• Lack of Applicable Performance Standard for Exhaust stacks The NRC staff disagrees that the non-conforming condition relates to the lack of performance standards for equipment located outside of Class I structures. The performance standard for the PBNP GDC 2 is specifically described within the GDC text itself.

The design bases so established shall reflect: (a) appropriate consideration of the most severe of these natural phenomena that have been officially recorded for the site and the surrounding area; and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.

The Bechtel Report B-TOP-3 cited by the license, describes the basis for how the standard, the licensees GDC 2, is met inside of Class I structures. The licensee fails to describe why their GDC 2 is not applicable to SSCs located outside Class I structures.

Contrary to POD Revision 5, the staff views the EDG exhaust stacks to be an integral part of the EDG engines, not a support system of the EDG. Inspection Manual Part 9900, Operability Determination Process, states when considering the OPERABILITY of a TS SSC, The operability requirements for an SSC encompass all necessary support systems (per the TS definition of OPERABLE) regardless of whether the TSs explicitly specify operability requirements for the support functions. Per PBNP TSs, the definition of OPERABILITY is:

A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety function(s) and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication, and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s).

R. Nelson The EDG exhaust stack is an integral component of the EDG engine, without which, the ability of the EDG to perform its specified safety function as the EDG is designed, tested and maintained, would be called into question. Therefore, similar to the EDGs, the exhaust stacks must be protected against natural phenomena to satisfy PBNP GDC 2.

The requirement to protect the exhaust stacks is in the current licensing bases as indicated in the resolution of Unresolved Item 05000266/2006006-08; 05000301/2006006-08, Safety-Related Equipment Not Protected from Tornado Missiles. Specifically, in TIA 2011-011, the NRR staff concluded the PBNP licensing basis requires the EDG exhaust stacks to be protected from tornado missiles. As a result, on November 2, 2011, Region III issued a non-cited violation in POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2, NRC INTEGRATED INSPECTION REPORT 05000266/2011004; 05000301/2011004, (Reference 5) for the failure to meet 10 CFR Part 50, Appendix B, Criterion III, Design Control. Specifically, since both Units commenced operation in the early 1970s, the licensees design control measures failed to meet the Class I design basis requirements for the EDGs G-01 and G-02 exhaust stacks. The licensee failed to incorporate tornado missile protection for their EDGs G-01 and G-02 exhaust stacks, which are Class I components.

• Tornado Missiles Are Not Discussed in License Documents The NRC staff disagrees with the licensees conclusion regarding the applicability of external events and the relationship to the license bases documents presented.

As discussed previously, in TIA 2011-011, the NRR staff concluded the licensing basis for PBNP requires the EDG exhaust stacks to be protected from tornado missiles. Specifically, the NRC [AEC] 1970 safety evaluation report for PBNP issued for the provisional licensee for the facility under the section titled Comments on Adequacy of Design, in Section D under the subsection titled Class I Equipment and Structures in Other than Class I Structures, states:

No mention was noted in the FFDSAR of the provisions made for protecting Class I equipment that might be located in other than Class I buildings. The applicant has advised that no Class I equipment necessary for safe shutdown is contained in structures that do not have Class I capability to resist earthquakes.

Therefore, the licensees assertion that a potential for consequential failure was either not considered credible or overlooked is incorrect. The NRC required Class I SSCs to be protected against seismic, wind, and tornado effects, and the licensee stated all equipment necessary to be protected is housed inside [Emphasis added] Class I structures.

As stated above, additional insights which led to the licensees conclusions were provided in Revision 4 of the POD. The assessment of these insights is provided below:

• (Revision 4) Use of Specified Safety Function and Safety Function As the licensee indicated, the ability to withstand a tornado event is not a specified safety function of the EDG. PBNP GDC 2 merely requires the EDGs to be designed, fabricated and erected to withstand tornado forces, i.e, maintain the capability to perform their specified safety function. This design requirement is applicable whenever the facility is operating in an applicable MODE or other specified condition required by the EDG TSs.

The functioning of the EDGs in support of a tornado event is not implied or required by GDC 2.

Furthermore, IM Part 9900, Operability Determination Process, Section 3.10 defines Specified Function/Specified Safety Function. Specifically, it states:

R. Nelson Specified Function/Specified Safety Function: The specified function(s) of the system, subsystem, train, component or device (hereafter referred to as system) is that specified safety function(s) in the CLB for the facility. In addition to providing the specified safety function, a system is expected to perform as designed, tested and maintained. When system capability is degraded to a point where it cannot perform with reasonable expectation or reliability, the system should be judged inoperable, even if at this instantaneous point in time the system could provide the specified safety function.

Contrary to the licensees position, the IM Part 9900 Definition 3.10 states, In addition to providing the specified safety function, a system is expected to perform as designed, tested and maintained. The EDG design requirement to withstand tornado forces assures the necessary facility capability is maintained to shut down the reactor and maintain integrity of containment and essential decay heat removal systems before, during, and following a tornado which may traverse the site. It should also be noted as discussed in Regulatory Information Summary (RIS) 2001-09, Control of Hazard Barriers, losses of margin or quality are subject to an operability determination.

• (Revision 4) Relationship Between General Design Criteria, Technical Specification, and Operability The NRC staff disagrees with the licensees interpretation of, Failure to meet a GDC in the CLB should be treated as a degraded or nonconforming condition and; therefore, the technical guidance in this document is applicable."

Although PBNP was licensed before the GDCs were published in 1971, PBNP FSAR does include plant-specific GDCs under which the plant was licensed. One of those GDCs, PBNP GDC 2, is very similar to the current GDC 2 in 10 CFR 50, Appendix A.

The PBNP GDC 2 specifically requires, Those systems and components of reactor facilities which are essential to the prevention or to the mitigation of the consequences of nuclear accidents which could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to the performance standards that enable such systems and components to withstand, without undue risk to the health and safety of the public, the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomena such as earthquake, tornado, flooding condition, high wind, or heavy ice Per Section 3.8 of IM Part 9900, In order to be considered operable, an SSC must be capable of performing the safety functions specified by its design, within the required range of design physical conditions, initiation times, and mission times. [Emphasis added] Thus, GDC 2 specifies part of the required range of design physical conditions for which a safety system must be designed in order to be operable. It is important to note the GDCs (or their plant specific equivalent) generally set forth requirements for the design of nuclear power reactors, while TSs generally relate to the requirements for operating a nuclear power reactor. It is incorrect to assert that if a design requirement for the plant is not included in TSs, it cannot have a potential impact on structures, systems and components required by 10 CFR 50.36 to be operable or have operability.

R. Nelson The relationship between GDC 2 and TS requirements is described in a memorandum dated January 24, 1994, from Thomas R. Murley, Director, Office of Nuclear Reactor Regulation, to all NRR employees, entitled, Relationship Between the General Design Criteria and Technical Specifications, (Reference 3) 1. As shown in the memorandum, although GDC 2 is not explicitly included in TSs, applicable natural phenomena are inherently considered in the operability of safety-related SSCs that satisfy the criteria for inclusion in TS. Therefore, although non-conformance with the GDC, by itself, does not automatically constitute rendering a safety system inoperable, failure to meet a design requirement can cause an SSC required by TSs to be unable to meet its specified safety function.

Operability must be assessed when a nonconformance with a GDC is identified. In addition, it is important to understand that the supporting basis for the reasonable expectation of SSC operability should provide a high degree of confidence that the SSCs remain operable. It should be noted the standard of reasonable expectation is a high standard, and that there is no such thing as an indeterminate state of operability; an SSC is either operable or inoperable. Therefore, in order for the G-01 and G-02 to be considered OPERABLE, but non-conforming, the determination must demonstrate the basis for concluding there is reasonable expectation that the SSC in question is still capable of performing its safety functions specified by its design, within the required range of design physical conditions, initiation times, and mission times while operating within an applicable operational MODE or other specified condition required by TSs.

• (Revision 4) Criteria for Inclusion in Technical Specification The licensees assertion that tornado protection must be included in TSs in order for it to be subject to OPERABILITY requirements is inconsistent with their licensing basis. The NRC staff agrees that tornados are not events to be mitigated by the EDG. Tornado protection is not a specified safety function of the EDGs and is not what is being assessed for OPERABILITY.

However, Chapter 14 events do include loss-of-AC power to station auxiliaries and loss of external load. FSAR Appendix A.1, Station Blackout, makes an assumption that high winds will directly result in the loss of offsite power (LOOP). Aside from this assumption, there is industry precedent related to tornado damage and the effect(s) on the electrical grid. A tornado that impacts the plant environs has the potential to degrade either the incoming and/or the outgoing feed from the station. This natural phenomenon can thereby become the initiator for the Chapter 14 events discussed above and can require the need for a reliable stand-by power source (the EDGs). If a tornado were to cause a LOOP, the EDGs are required to be able to mitigate that abnormal occurrence.

However, if they are not adequately protected from the tornado effects, then it calls into question the OPERABILITY of the EDG in that circumstance. In other words, the EDGs need to be assessed for OPERABILTY because it has not been protected from the effects of tornado forces.

The POD fails to recognize the difference between a function of the system, and a design capability of the system. Protection from tornado forces is not a specified safety function of the EDGs (i.e., they are not required to mitigate a tornado.) Rather, the 1

The NRC staff confirmed the Office of General Counsel had reviewed the internal memorandum from Dr. Murley and had no legal objections to its release for the purpose of the Agencys position on GDC 2.

R. Nelson EDGs are expected to survive a tornado with the capability to perform their safety functions intact. Per the PBNP licensing basis, as described in their FSAR, tornados are part of the required range of design physical conditions in which the EDGs must be able to operate.

• Relevant Licensing Correspondence Regarding Safe Shutdown Requirements and Tornados The NRC staff disagrees with the licensees assertion that the referenced Request for Additional Information (RAI) somehow changed their licensing basis. The RAI referenced by the licensee only asked for additional details about how certain structures were protected from the effects of a tornado. The desired scope of the question was related to equipment and structures necessary for safe shutdown. However, the question makes no statement and does not imply the licensing basis for tornado protection should be limited to only those systems and structures described by the RAI.

The question does not change the requirement to protect both mitigation systems and those needed for safe shutdown from tornados. While the RAI may not request information about mitigation systems; the PBNP GDC 2 requires mitigation systems to be designed, fabricated and tested to withstand tornados. Specifically PBNP GDC 2 requires:

Those systems and components of reactor facilities which are essential to the prevention or to the mitigation of the consequences of nuclear accidents which could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to the performance standards that enable such systems and components to withstand, without undue risk to the health and safety of the public, the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomena such as earthquake, tornado, flooding condition, high wind, or heavy ice [Emphasis added].

The licensee has not provided any documentation that shows the PBNP GDC 2 licensing basis for tornado protection has been changed. In addition, because the EDGs are required for bringing either or both plants to a safe shutdown condition, the EDGs are within the scope of PBNP GDC 2.

• Tornado Missile Strike is Not a Credible Consequential Failure The NRC staff disagrees with the licensees position. As indicated in TIA 2011-011, the NRR staff concluded the licensing basis for PBNP requires the EDG exhaust stacks to be protected from tornado missiles. This requirement for protection affirms the credibility of a tornado missile potentially damaging the exhaust stacks resulting in an inoperative EDG.

The licensees statement given that a tornado occurs, failure of an EDG exhaust stack due to being struck from a tornado generated missile would be a consequential failure, is not appropriate. An example of a credible consequential failure considered in the facility design would be a barrier erected in a room to protect safety equipment from a postulated high energy line break. For this circumstance, if the barrier is found to be degraded or non-conforming the operability determination should assess if a reasonable expectation of operability still exists for the credible consequential failure of the protected pump that was previously considered in the design.

In addition, the licensees conclusion that a potential for consequential failures was either not considered credible or overlooked is incorrect. The licensee was required to assess both credible missiles and automobiles as part of the design requirements for the facility.

The fact that both historically and currently, the NRC [or the AEC] required assessment of wind loading and missiles of a specific magnitude and that related guidance supports this

R. Nelson requirement, it is concluded missiles and wind loadings of a specific magnitude were considered both integral and consequential to the related natural phenomena (wind and tornadoes).

• Ability of Exhaust Stacks to Withstand Tornado Missiles Strikes The NRC staff previously evaluated the licensees compliance with their CLB in TIA 2011-11, and concluded the licensing bases for PBNP requires the EDG exhaust stacks be protected from tornado missiles. In TIA 2011-11, the NRC staff noted the following:

The performance standards for electrical systems are the same in both the FFDSAR

[Final Facility Description and Safety Analysis Report] and the CLB. Both require components which are essential to the prevention and mitigation of the consequences of nuclear accidents which could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to performance standards that enable such systems and components to withstand, without undue risk to the health and safety of the public, the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomena such as earthquake, tornado This indicates the licensee intended to have all components protected from tornadoes, which includes tornado missiles. The statement, the operating license SE [safety evaluation] only identifies structures as being designed to withstand the consequences of tornado missiles, does not replace the commitment contained in the FFDSAR or the CLB.

It appears the licensee failed to fully evaluate and identify components required to withstand the forces exerted by natural phenomena located outside of structures that are designed to withstand tornado missiles.

This position is supported by FFDSAR Overall Plant Requirements (GDC 1 - GDC 5),

which states, Similar measures are taken in the plant design to protect against high winds, flooding, and other natural phenomena where natural phenomena includes tornadoes and tornado missiles.

Further, the NRC staff concluded the licensees use of documentation and judgments of low probability to demonstrate compliance with the licensing bases were not acceptable. The NRC staff stated in TIA 2011-11:

The use of probability to justify compliance with a plants licensing basis for tornado missile protection is permitted with NRC approval. The NRC staff clarified its position on the use of probability for tornado missile evaluations in a memorandum dated November 7, 1983, (ADAMS Accession No. ML080870287). The memorandum states:

Based on the guidance in SRP [Standard Review Plan] Sections 3.5.1.4 and 2.2.3, we plan to permit applicants and licensees to use risk assessments for tornado and other high wind missile and to judge their acceptability against a numerical criterion which is as follows While this statement clearly states the NRC will accept probability analysis for tornado missile protection evaluations, it also is clear that the NRC intends to review the analysis by stating the NRC staff will judge their acceptability Therefore, any use of probability analysis for tornado missile evaluations must be initially approved by the NRC and included in a plants licensing basis. Criteria regarding the use of probability for assessment of tornado missile protection are provided in RIS 2008-14.

R. Nelson The NRC staff reviewed the PBNP FSAR and could find no discussion of probability analysis in discussions of tornado missile protection. Thus, the licensee cannot use probability as a justification for the current plant design.

As a result of the NRC staff conclusion in TIA 2011-11, as described earlier, Region III issued a non-cited violation for the failure to meet 10 CFR Part 50, Appendix B, Criterion III, Design Control.

Although the Revision 5 information regarding analysis of tornado missile impact was not available when TIA 2011-11 was written, the information provided in the POD is not acceptable to the NRC staff for the following reasons:

- As concluded by the NRC staff in TIA 2011-011, the NCV issued on November 2, 2011, and discussed in this TIA, the licensing bases for PBNP requires the EDG exhaust stacks to be protected from tornado missiles.

- The licensees reference to FSAR discussion of historical occurrences and probability of a tornado strike at the site do not alter the PBNP CLB requirements for the protection of the EDG exhaust stacks from tornado missiles.

- The use of risk analysis requires a submittal and prior approval by the NRC.

- The POD 5 referenced studies were not inclusive of tornado missiles considered during the initial or current licensing bases analysis.

- The subjective treatment of automobile damage outcomes is not supported by validated analysis.

CONCLUSION Based on the above, the NRC staff concludes POD (CR 1678709), Revision 5 and the supporting information contained in Revision 4 are inadequate to provide reasonable expectation of operability. The POD must take into account the full licensing basis for the EDG exhaust stacks in accordance with both the GDCs and TSs in determining operability and compensatory measures for the non-conforming condition (EDG exhaust stacks not being fully protected from tornado missiles). The licensee must reassess the operability of the EDGs and inform the NRC of their conclusions, proposed actions, and the timeline for any actions.

In addition, the licensee identified other equipment potentially not protected from tornado missile strikes in their extent of condition review for the EDG exhaust stack issue. The licensee must also reassess operability for this equipment.

With respect to the licensees compensatory measures, the NRC staff determined licensees actions were not adequate to establish conditions that would compensate for the nonconforming condition such that the EDGs would be operable. In addition, the licensees limiting of compensatory actions to the months of April through September is unsupported as tornadoes can (and have) occurred at any time of the year.

REFERENCES

1. Prompt Operability Determination (POD), CR 1678709, Revision 4, NRC Issues Position on Missile Protection for G-01/2 Exhaust, dated March 27, 2012 (ADAMS Accession No. ML12114A271)

2. Prompt Operability Determination (POD), CR 1678709, Revision 5, NRC Issues Position on Missile Protection for G-01/2 Exhaust, dated April 16, 2012 (ADAMS Accession No. ML12114A278)

3. Memorandum to All NRR Employees from Thomas R. Murley, Director, Office of Nuclear Reactor Regulation, Relationship between the General Design Criteria (GDC) and Technical Specifications, dated January 24, 1994 (ADAMS Accession No. ML12115A279)

R. Nelson 4. Final - Task Interface Agreement (TIA) - Evaluation of Point Beach Nuclear Plant Tornado Missile Protection Licensing Basis (TIA 2011-011), dated August 16, 2011 (ADAMS Accession No. ML11228A257)

5. Point Beach Nuclear Plant, Units 1 and 2, NRC Integrated Inspection Report 05000266/2011004; 05000301/2011004, (ADAMS Accession No. ML11306A264)

Docket No. 50-266 and 50-301

Enclosures:

1. Prompt Operability Determination (POD), CR 1678709, Revision 4, NRC Issues Position on Missile Protection for G-01/2 Exhaust, dated March 27, 2012 (ADAMS Accession No. ML12114A271)

2. Prompt Operability Determination (POD), CR 1678709, Revision 5, NRC Issues Position on Missile Protection for G-01/2 Exhaust, dated April 16, 2012 (ADAMS Accession No. ML12114A278)

3. Memorandum to All NRR Employees from Thomas R. Murley, Director, Office of Nuclear Reactor Regulation, Relationship between the General Design Criteria (GDC) and Technical Specifications, dated January 24, 1994 (ADAMS Accession No. ML12115A279)

R. Nelson Memo to Robert Nelson from Kenneth OBrien dated April 24, 2012

SUBJECT:

TASK INTERFACE AGREEMENT - APPLICABILITY OF GDC REQUIREMENTS IN OPERABILITY DETERMINATIONS AND ASSESSMENT OF THE POINT BEACH OPERABILITY DETERMINATION FOR EMERGENCY DIESEL GENERATORS WITH RESPECT TO TORNADO MISSILES (TIA 2012-07)

DISTRIBUTION:

cc w/encl: Steven West, DRP Gary Shear, DRP Steven Reynolds, DRS Kenneth G. OBrien, DRS Michael Kunowski, RIII Ann Marie Stone, RIII Robert Elliott, NRR Greg Casto, NRR Carl Schulten, NRR Terry Beltz, Project Manager Holly Cruz, TIA Project Manager Benny Jose, RIII Carey Brown, RIII Stephen Burton, RIII Meghan Thorpe-Kavanaugh, RIII RidsOgcMailCenter RidsNrrDss RidsNrrDpr RidsNrrDssSbpb RidsNrrDssStsb RidsNrrDprPlpb RidsRgn1MailCenter RidsRgn2MailCenter RidsRgn3MailCenter RidsRgn4MailCenter RidsNrrPMPointBeach RidsNrrDorl RidsNrrMailCenter Barry Miller, NRR Shawn Williams, OEDO (RIII)

ADAMS Accession Number ML12115A080 *Concurrence by email OFFICE RIII:DRS/EB2 RIII:DRS/EB2 RIII: DRP:Br5 RIII:DRS NRR:DSS/SBPB NAME AMStone for AStone MKunowski KOBrien GCasto

• BJose DATE 04/23/2012 04/23/2012 04/23/2012 04/24/2012 04/23/2012 OFFICE NRR:DSS/STSB NRR:DORL NRR:DPR/PLPB NRR:DPR/PLPB NRR:DPR:DD NAME RElliott* TBeltz* HCruz* JJolicoeur* RNelson*

DATE 04/23/2012 04/23/2012 04/23/2012 04/23/2012 04/23/2012 OFFICIAL RECORD COPY