ML16067A104
| ML16067A104 | |
| Person / Time | |
|---|---|
| Issue date: | 07/30/2019 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Reed T | |
| References | |
| 80 FR 70609, NRC-2014-0240, RIN 3150-AJ49 | |
| Download: ML16067A104 (5) | |
Text
PR 10 CFR Parts 50 and 52 80FR70609 11 February 11, 2016 Annette L. Vietti-Cook, Secretary U. S. Nuclear Regulatory Commission Washington, DC 20555-0001 Attn: Rulemakings and Adjudications Staff
SUBJECT:
Comments on Mitigation of Beyond-Design-Basis Events Proposed Rule (Docket ID NRC-2014-0240)
Dear Ms. Vietti-Cook:
In response to the notice about the subject proposed rule published in the Federal Register on November 13, 2015 (Vol. 80, No. 219, pp. 70610-70647), we submit the attached comments on behalf of the Union of Concerned Scientists.
Sincerely, Edwin S. Lyman, Ph.D. David A. Lochbaum Senior Staff Scientist Director, Nuclear Safety Project UCS Comments on Proposed MBDBE Rulemaking
[Three-Phase Mitigation Approach Section IV.A.1 of the proposed rule stated that the regulatory objective of the rulemaking is to Make the requirements in Order EA-12-049 and Order EA-12-051 generically applicable, giving consideration to lessons learned from implementation of the orders. But the proposed rule replaces the three-phase mitigation approach (i.e., Phase One limited to permanently installed equipment, Phase Two allowing temporary equipment already onsite, and Phase Three allowing offsite resources) recommended by the NRCs Near Term Task Force with higher level, performance-based requirements.
It is important to maintain a three-phase structure so that licensees are required to demonstrate at a minimum that they can cope with the installed equipment until the FLEX equipment is operable, and that the site can be self-sufficient until off-site resources are available.
The substitution of higher level, performance-based requirements reduces confidence that the MBDBE measures will be successful if needed. The nuclear industry and the NRC have consistently disagreed on what constitutes appropriate compensatory measures and associated administrative controls. Among numerous examples is the disagreement regarding the March 31, 2013, stator drop event at Arkansas Nuclear One Unit 1. According the NRC (ML1417A832), the licensees evaluation of the event concluded the reactor water would begin boiling in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and the reactor core would be uncovered in 115 hours0.00133 days <br />0.0319 hours <br />1.901455e-4 weeks <br />4.37575e-5 months <br />; the NRCs evaluation concluded 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> and 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />, respectively. The licensees evaluated concluded there was a 97% probability that workers would re-power the switchyard and in-plant safety buses; the NRCs evaluation concluded that the probability was 90%.
The higher level, performance-based requirements are essentially the reactor core cooling and power restoration objectives pursued in the licensee and NRC staff assessments of the Arkansas Nuclear One event. Despite the common criteria, the evaluations produced widely disparate results.
The final MBDBE rule must be as explicit as possible to narrow the wide gulf between what licensees perceive as acceptable and what the NRC determines to be acceptable. The three-phase structure provides clearer definition of what is expected, better enabling licensees to meet those expectations and NRC inspectors to independently verify this desired outcome has been achieved. UCS-1]
[Severe Accident Management Guidelines The final MBDBE rule must ensure that licensees develop, maintain, and administer Severe Accident Management Guidelines (SAMGs) that can effectively guide workers to the successful selection and deployment of response measures mandated by the suite of the NRCs post-Fukushima directives.
The nuclear industry developed the SAMGs to accompany the Emergency Procedure Guidelines (EPGs) developed following the Three Mile Island accident. The EPGs guide workers in responding to design basis accidents. The EPGs are regulatory requirements and the NRC inspects EPGs periodically to gain reasonable assurance that the response to design basis accidents will be within results from applicable safety studies. No regulatory requirement imposes SAMGSlicensees voluntarily committed to NRC to have them.
Shortly after the Fukushima accident, the NRC audited the implementation of SAMGs at every U.S. nuclear power plant (ML113210459). The NRCs audit confirmed that SAMGs had been developed for every nuclear plant. But the audit revealed that SAMGs were not available in the control rooms for over 10% of the reactors. Workers at 8% of the reactors were never trained on using the SAMGs. Workers at 23% of the reactors never received periodic re-training on using the SAMGs. At 25% of the reactors, the SAMGs were not required to be updated to reflect modifications to the plant. [For example, the SAMGs for the Watts Bar Unit 1 reactor directed operators to use hydrogen recombiners to control hydrogen buildup inside containmentbut a modification years earlier had permanently removed the hydrogen recombiners from service.] The NRCs audit examined 11 attributes such as configuration management and training. Only five U.S. reactors satisfied all 11 attributes. The average reactor only satisfied 80% of the attributes.
Commissioner Baran questioned Michael Johnson, Deputy Executive Director for Operations, and Bill Dean, Director of the Office of Nuclear Reactor Regulation, about SAMGs during a July 9, 2015, Commission briefing (transcript available at ML15194A400). One of the questions and its responses:
Commissioner Baran: If NRC doesnt require SAMGs, can we be confident that they will be maintained and effective at every plant in the event that theyre needed?
Bill Dean: So, my simple answer would be no, but with a caveat. It really, in my mind, as somebody that has some foundation in inspection activities, that if it isnt something that the NRC is going to look at, the likelihood that its going to lose focus. So absent, I think, an appropriate regulatory framework that allows us to continue to focus on a particular area that we feel is important, I think it makes it difficult to provide absolute assurance that theyre going to be maintained.
Michael Johnson: TEPCO had SAMGs on the day of March 11 when the [Fukushima] accident happened. It turns out there were problems with those SAMGs and the staff couldnt implement those SAMGs given the conditions they had.
The proposed rules §50.155(b) would require licensees to develop, implement, and maintain Extensive Damage Mitigation Guidelines (EDMGs) and FLEX Support Guidelines. The former were mandated following the 9/11 attacks to lessen nuclear plant vulnerabilities to explosions and fires from suicide aircraft. The latter were developed by the nuclear industry following the Fukushima accident to lessen nuclear plant vulnerabilities to natural hazards. The SAMGs were developed following the severe accident at Three Mile Island to lessen nuclear plant vulnerabilities to events other than suicide aircraft and natural hazards. It makes no sense to require EDMGs and FSGs to be integrated into emergency operating procedures (EOPs) but allow SAMGs to remain non-integrated. We are aware that the staff removed a provision
requiring SAMGS from the proposed rule at the direction of the Commission but UCS believes this was the wrong decision and expect that it will be reversed in the future. UCS-2]
[Change Control The proposed rule specifically solicited public comment on change control. The proposed
§50.155(b) requires licensees to develop, implement, and maintain an integrated response capability. The maintain provision would seem to require change control measures.
The proposed rule is deficient in two ways. First, it contains neither a threshold defining when prior NRC review and approval is required nor a requirement for periodically informing the NRC about changes made to integrated response capabilities. Second, it would allow licensees to evaluate MBDBE changes separately from evaluations conducted of safety (10 CFR 50.59) and security changes (10 CFR 73.58).
The NRC reviewed licensees submittals outlining their intentions for achieving compliance with the NRCs post-Fukushima orders, which are being codified by this rulemaking. The NRC asked many questions of licensees about their plans, sometimes resulting in changes in what the licensees intended to do or how they planned to do it. These interactions demonstrated that it took an iterative process for the NRC and its licensees to reach a common understanding of what constituted acceptable measures. The record is very clear that licensees have not clearly understood when they can make safety changes to their plants and procedures under 10 CFR 50.59 without prior NRC review and approval (see ML13094A257 for a 68-page listing of NRC sanctions for 50.59 violations.) The final rule must contain a threshold defining when prior NRC approval is required before licensees can change their MBDBE measures. U C S - 3 ] Licensees are required to periodically notify the NRC about changes to commitments (RIS 2000-017) and safety (10 CFR 50.59(d)(2)). The final rule must require licensees to periodically notify the NRC about changes to its MBDBE measures. UCS-4]
Among the upgrades taken in response to 9/11, the NRC revised its regulations to integrate evaluations conducted for safety changes with those conducted for security changes (see Regulatory Guide 5.74 at ML091690036). This integration sought to avoid a safety change from inadvertently undermining security measures and vice-versa. The final MBDBE rule must integrate evaluations of proposed MBDBE changes with safety and security changes. UCS-5]
[To illustrate the need for integrated evaluations, consider an example where a licensee evaluates a proposed change that removes a check valve from a makeup line or modifies a motor-operated valve in the line to fail-open on loss of power. The evaluation conducted under 50.59 and 73.58 concludes that the proposed change does not undermine safety or security.
But consider if the location of the valve is upstream of the connection point for FLEX equipment intended to provide makeup water to the reactor vessel during a beyond design basis event. The change might create a pathway for water supplied by FLEX to flow places other than the reactor vessel.
As a minimum, the final rule must require that licensees include MDBDE items in design control checklists (see ML993340213 for example) that review proposed modifications for potential adverse impacts on areas like high energy line break analyses, ALARA, fire protection, ISI programs, station blackout, etc.
The nuclear industry and the NRC have expended considerable resources upgrading response capabilities for beyond design basis events. Change control measures are prudent to ensure these investments are not undermined or eroded unintentionally by future changes. The NRC imposed requirements on its licensees as a result of Fukushimas accident and its lessons. Change control is essential in ensuring these mandated measures remain as effective in the future as they are today. UCS-6]
[External Hazard Re-evaluations As part of the develop, implement, and maintain provision, the final rule needs to explicitly address the NRCs expectations for re-evaluating external hazards. The Fukushima fixes mandated by the NRC via the orders and the MBDBE rulemaking can be eroded by either
internal means (e.g., modifications to the plant that render connection points unusable) or external factors (e.g., natural events being larger than previously understood).
As an illustrative straw man, the final rule could include a requirement that applications for operating reactor license renewals include external hazard re-evaluations. The current license renewal rule requires that applications address aging management for passive systems, structures, and components with safety roles to perform during design basis events. The final MBDBE rule could expand this scope to require that license renewal applications address systems, structures, and components that protect the plant from external hazards, both from the perspective of ensuring that aging management does not compromise their effectiveness and from the perspective that emerging knowledge about external hazards has not suggested that existing protections are insufficient. UCS-7
[FLEX Shortcomings The final rule must address lessons learned such as those from the implementation of the orders at the Pilgrim nuclear plant. The NRCs report (ML15147A412) from its special inspection into a January 2015 storm event at Pilgrim documented an implementation problem. Specifically, the licensee relied upon a diesel air compressor as part of its FLEX complement of equipment for responding to beyond design basis events. When the storm plunged Pilgrim into a loss of offsite power (LOOP) condition, workers installed the FLEX diesel air compressor about 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> into the event to restore the instrument air system to operation. But the FLEX diesel air compressor only pressurized the instrument air system to 80 psig, below the systems design pressure of approximately 100 psig. Workers procured another temporary air compressor and installed in about 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> later to get instrument air pressure to 100 psig.
The NRCs special inspection report concluded the The loss of instrument air procedure did not identify any temporary air compressor contingencies and The lack of adequate instructions in the procedure adversely affected several operator actions and plant equipment on January 27, 2015, during the LOOP and loss of instrument air.
Pilgrims licensee included a diesel air compressor among its FLEX equipment for mitigating beyond design basis events. But the FLEX diesel air compressor did not develop sufficient pressure for it to be useful and effective as a mitigating measure. Similarly, the instrument air system procedures had not been revised to provide adequate guidance to workers.
The NRC issued order EA-12-051 (ML12056A044) requiring that licensee install instrumentation to monitor the water level in spent fuel pools. The order stemmed from recommendation 7 by the NRCs Near Term Task Force report on the Fukushima accident and its lessons. As stated in the order, The lack of information on the condition of the spent fuel pools contributed to a poor understanding of possible radiation releases and adversely impacted effective prioritization of emergency response actions by decisions makers. The order sought to avoid distracting workers so they could focus their attention and efforts on productive, effective mitigation of events.
But the FLEX diesel air compressor implementation problem at Pilgrim involved an equally distracting, non-productive effort by workers to mitigate that event. The final rule needs to contain provisions to ensure that mitigation strategies and tactics for beyond design basis events can aid the response rather than constituting a different way to adversely impact effective prioritization of emergency response actions.
Another Fukushima-inspired order issued by the NRC further illustrates this need. On June 6, 2013, the NRC issued order EA-13-109 (ML13144A321) to licensees requiring that reliable hardened containment venting systems be installed at boiling water reactors (BWRs) with Mark I and Mark II containment designs. On September 1, 1989, the NRC had directed (Generic Letter 89-16) licensees operating BWRs with Mark I containment designs to install a hardened
containment venting system. A hardened containment venting system had been installed at Fukushima, but the station blackout condition rendered the installed system inoperable.
Consequently, the NRC had to back up its 1989 directive to install hardened containment vent systems 24 years later with a supplemental directive to make those installed systems reliable.
The final MBDBE rule needs to contain provisions that ensure that the mandated measures are reliable now, rather than waiting several years to overlay the reliable attribute. UCS-8]
[Drills and Exercises Proposed §50.155(e) would require licensees conduct initial drills and exercises and to subsequently conduct drills and exercises at least once every eight years. The final rule should require initial and recurring drills and exercises. The eight-year interval seems too long. Also, the exercises should be comprehensive, as realistic as possible and involve personnel and equipment performance testing to the extent feasible.
In the 1990s, the NRC began conducting force-on-force tests of physical protection (i.e., security) plans at each nuclear plant once every eight years. After the 9/11 attacks, the NRC changed the testing interval to at least once every three years. The original eight-year interval was found by the NRC to be too infrequent to prevent saw-tooth declines in capability between tests. [Basically, NRC determined that licensees would significantly ramp up physical protection capabilities shortly before the force-on-force test and capabilities would steadily decline over time until the next pre-test step change.]
Since the March 2011 earthquake/tsunami that caused the Fukushima accident, Browns Ferry experienced a tornado (April 2011), North Anna experienced an earthquake that caused ground motion more than its design basis earthquake levels (August 2011), and Pilgrim experienced a severe winter storm causing a loss of offsite power event with complications (January 2015).
Given the relatively high frequency of extreme nature events and the potentially high consequences, the final rule must require an exercise interval no longer than that used for force-on-force security testing. UCS-9]
[Training Proposed §50.155(d) would require licensees to provide for the training and qualification of personnel that perform activities in accordance with the strategies and guidelines. Unlike
§50.155(e), the proposed language does not explicitly define requirements for initial training and retraining. The final rule must define the NRCs requirements as clearly and completely as possible or be accompanied by a Regulatory Guide that more fully explains what the NRC seeks by the training provision in the rule. For example, the final rule and/or guidance must answer questions like:
If the mitigation strategy for an external event specifies that multiple workers will take FLEX equipment and install it, must all workers be trained and qualified for these tasks or is it sufficient to only train and qualify one worker per team?
Are the training and qualification provided for a worker at site x on the use of FLEX equipment transferrable to use of that equipment at site y?
How often must workers receive re-training on the integrated response capabilities outlined in
§50.155(b)? UCS-10]