ML17363A072
Text
B'WR DAEC RCS BARRIER THRESHOLDS:
NEI 99 0 I (Revision 6)
November 2012 The RCS Barrier is the reactor coolant system pressure boundary and includes the RPV and all reactor coolant system piping up to and including the isolation valves.
- 1.
Primary Containment PressureConditions Loss I.A The (site specific value) primary containment2 psig pressure is the drywell high pressure scram setpoint which indicates a LOCA by automatically initiating the-ECCS or equivalent makeup system..,_
There is no Potential Loss threshold associated with Primary Containment Pressure.
DeYeleper Netes:
- 2.
RPV Water Level Loss 2.A This v,rater l+ 15 inches e-vel-corresponds to the top of active fuel (T AF) and is used in the EOPs to indicate challenge to core cooling.
The RPV water level threshold is the same as Fuel Clad barrier Potential Loss threshold 2.A. Thus, this threshold indicates a Loss of the RCS barrier and Potential Loss of the Fuel Clad barrier and that appropriately escalates the emergency classification level to a Site Area Emergency.
This threshold is considered to be exceeded when, as specified in the site specific EOPs, RPV water cannot be restored and maintained above the specified level following depressurization of the RPV (either manually, automatically or by failure of the RCS barrier) or when procedural guidance or a lack of low pressure RPV injection sources preclude Emergency RPV depressurization EOPs allow the operator a wide choice of RPV injection sources to consider when restoring RPV water level to within prescribed limits. EOPs also specify depressurization of the RPV in order to facilitate RPV water level control with low-pressure injection sources. In some events, elevated RPV pressure may prevent restoration of RPV water level until pressure drops below the shutoff heads of available injection sources. Therefore, this RCS barrier Loss is met only after either: 1) the RPV has been depressurized, or required emergency RPV depressurization has been attempted, giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available, precluding RPV depressurization in an attempt to minimize loss of RPV inventory.
133
BWR DA.EC RCS BARRIER THRESHOLDS:
NEJ 99 01 (Re,*isioR 6)
No*1eFRber 2012 The term, "cannot be restored and maintained above," means the value of RPV water level is not able to be brought above the specified limit (top of active fuel). The determination requires an evaluation of system performance and availability in relation to the RPV water level value and trend. A threshold prescribing declaration when a threshold value cannot be restored and maintained above a specified limit does not require immediate action simply because the current value is below the top of active fuel, but does not permit extended operation beyond the limit; the threshold must be considered reached as soon as it is apparent that the top of active fuel cannot be attained.
134
DAEC RCS BARRIER THRESHOLDS {cont.):
NEI 99 0 I (Revision 6)
- Jl,Jovemeer 2012 In high-power A TWS/failure to scram events, EOPs may direct the operator to deliberately lower RPV water level to the top of active fuel in order to reduce reactor power. RPV water level is then controlled between the top of active fuel and the Minimum Steam Cooling RPV Water Level (MSCRWL). Although such action is a challenge to core cooling and the Fuel Clad barrier, the immediate need to reduce reactor power is the higher priority. For such events, ICs SAS or SS5 will dictate the need for emergency classification.
There is no RCS Potential Loss threshold associated with RPV Water Level.
- 3.
RCS Leak Rate Loss Threshold 3.A Large high-energy lines that rupture outside primary containment can discharge significant amounts of inventory and jeopardize the pressure-retaining capability of the RCS until they are isolated. If it is determined that the ruptured line cannot be promptly isolated from the Control Room, the RCS barrier Loss threshold is met.
Loss Threshold 3.B Emergency RPV Depressurization in accordance with the EOPs is indicative of a loss of the RCS barrier. If Emergency RPV Depressurization is performed, the plant operators are directed to open safety relief valves (SR Vs) and keep them open. Even though the RCS is being vented into the suppression pool, a Loss of the RCS barrier exists due to the diminished effectiveness of the RCS to retain fission products within its boundary.
Potential Loss Threshold 3.A Potential loss of RCS based on primary system leakage outside the primary containment is determined from EOP temperature or radiation Max Normal Operating values in areas such as main steam line tunnel, RCIC, HPCI, etc., which indicate a direct path from the RCS to areas outside primary containment.
A Max Normal Operating Limit (MNOL) value is the highest value of the identified parameter expected to occur during normal plant operating conditions with all directly associated support and control systems functioning properly.
135
BWR DAEC RCS BARRIER THRESHOLDS:
}lei 99 QI (Re'>'ision 6)
}fo*,cember 2012 The indicators reaching the threshold barriers and confirmed to be caused by RCS leakage from a primary system warrant an Alert classification. A primary system is defined to be the pipes, valves, and other equipment which connect directly to the RPV such that a reduction in RPV pressure will effect a decrease in the steam or water being discharged through an unisolated break in the system.
An UNISOLABLE leak which is indicated by Max }formal OperatingMNOL values escalates to a Site Area Emergency when combined with Containment Barrier Loss threshold 3.A (after a containment isolation) and a General Emergency when the Fuel Clad Barrier criteria is also exceeded.
DAEC RCS BARRIER THRESHOLDS (cont.):
De¥eleper Netes:
Loss Threshold 3.l*..
The list of systems included in this threshold should be the high energy lines vmich, if ruptUred and remain uni so lated, can rapidly depressurize the RPV. These lines are typically isolated by actuation of the Leak Detection system.
Large high energy line breaks such as Main Steam Line (MSL), High Pressure Coolant Injection (HPCI), Feed1.vater, Reactor Water Cleanup (RWCU), Isolation Condenser (IC) or Reactor Core Isolation Cooling (RCIC) that are illHSOLABLE represent a significant loss of the RCS barrier.
- 4.
Primary Containment Radiation Loss 4.A The Drywellradiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the primary containment, assuming that reactor coolant activity equals Technical Specification allowable limits. This value is lower than that specified for Fuel Clad Barrier Loss threshold 4.A since it indicates a loss of the RCS Barrier only.
There is no Potential Loss threshold associated with Primary Containment Radiation.
Develeper Netes:
The reading should be determined assuming the instantaneous release and dispersal of the reactor coolant noble gas and iodine inventory, with RCS activity at Tech.'1:ical Specification allowable limits, into the primary containment atmosphere. Using RCS activity at Technical Specification allov,rable limits aligns this threshold v,ith IC SU3. Also, RCS activity at this level *.vill typically result in primary containment 136
llWR RCS BARRIER THRESHOLDS:
Jl.+eJ 99 0 I (RevisioR 6)
November 2012 In some cases, the site specific physical location and sensitivity of the primary containment radiation monitor(s) may be such that radiation from a cloud of released RC8 gases cannot be distinguished from radiation emanating from piping and components containing elevated reactor coolant activity. If so, refer to the Developer Guidance for Loss/Potential Loss 5.A and determine if an alternate indication is available.
- 5.
Other Indications There are no Loss or Potential Loss thresholds associated with Other Indications.
Developer Notes:
Loss and/or Potential Loss 5.A Developers should determine if other reliable indicators exist to evaluate the status of this fission product barrier ( e.g., review accident analyses described in the site Final Safety Analysis Report, as updated). The goal is to identify any unique or site-specific indications that will promote timely and accurate assessment of barrier status.
Any added thresholds should represent approximately the same relative threat to the barrier as the other thresholds in this column. Basis information for the other thresholds may be used to gauge the relative barrier threat level.
- 6.
Emergency Director Judgment Loss 6.A This threshold addresses any other factors that are to be used by the Emergency Director in determining whether the RCS barrier is lost.
Potential Loss 6.A This threshold addresses any other factors that may be used by the Emergency Director in determining whether the RCS Barrier is potentially lost. The Emergency Director should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.
Develeper Netes:
138
BWR DAEC CONTAINMENT BARRIER THRESHOLDS:
NET 99 0 I (RevisioR a)
- November 2012 The Primary Containment Barrier includes the drywell, the wetwell, their respective interconnecting paths, and other connections up to and including the outermost containment isolation valves. Containment Barrier thresholds are used as criteria for escalation of the ECL from Alert to a Site Area Emergency or a General Emergency.
- 1.
Primary Containment Conditions Loss 1.A and 1.B Rapid UNPLANNED loss of primary containment drywell pressure (i.e., not attributable to drywell spray or condensation effects) following an initial pressure increase indicates a loss of primary contairunentdrywell integrity. Primary containmentDrywell pressure should increase as a result of mass and energy release into the primary containment from a LOCA. Thus, primary containmentdrywell pressure not increasing under these conditions indicates a loss of primary containment integrity.
These thresholds rely on operator recognition of an unexpected response for the condition and therefore a specific value is not assigned. The unexpected (UNPLANNED) response is important because it is the indicator for a containment bypass condition.
Loss l.C The use of the modifier "direct" in defining the release path discriminates against release paths through interfacing liquid systems or minor release pathways, such as instrument lines, not protected by the Primary Containment Isolation System (PCIS).
The existence of a filter is not considered in the threshold assessment. Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to iodine and/or particulate loading beyond design limits (i.e., retention ability has been exceeded) or water saturation from steam/high humidity in the release stream.
Following the leakage of RCS mass into primary containment and a rise in primary containment pressure, there may be minor radiological releases associated with allowable primary containment leakage through various penetrations or system components. Minor releases may also occur if a primary containment isolation valve(s) fails to close but the primary containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of primary containment but should be evaluated using the Recognition Category RI Cs.
139
DAEC CONTAINMENT BARRIER THRESHOLDS:
Loss l.D
}ffil 99 0 l (ReYisioR i)
}fovember 2012 EOPs may direct primary containment isolation valve logic(s) to be intentionally bypassed. even if offsite radioactivity release rate limits will be exceeded. Under these conditions with a valid primary containment isolation signal, the containment should also be considered lost if primary containment venting is actually performed.
Intentional venting of primary containment for primary containment pressure or combustible gas control to the secondary containment and/or the environment is a Loss of the Containment. Venting for primary containment pressure control when not in an accident situation (e.g.. to control pressure below the drywell high pressure scram setpoint) does not meet the threshold condition.
DAEC CONTAINMENT BARRIER THRESHOLDS (cont.):
DAEC CONTA~l(ENT BARRIER THRESHOLDS:
Potential Loss 1.A The threshold pressure is the primary containmentTorus internal design pressure. Structural acceptance testing demonstrates the capability of the primary containment to resist pressures greater than the internal design pressure. A pressure of this magnitude is greater than those expected to result from any design basis accident and, thus, represent a Potential Loss of the Containment barrier.
Potential Loss l.B If hydrogen concentration reaches or exceeds the lower flammability limit, as defined in plant EOPs, in an oxygen rich environment, a potentially explosive mixture exists. If the combustible mixture ignites inside the primary containment, loss of the Containment barrier could occur.
Potential Loss l.C The Heat Capacity Temperature Limit (HC+L) is the highest suppression pool temperature from which Emergency RPV Depressurization will not raise:
Suppression chamber temperature above the maximum temperature capability of the suppression chamber and equipment within the suppression chamber which may be required to operate when the RPV is pressurized, OR 140
BWR CONTAINMENT BARRIER THRESHOLDS:
}ffil 99 0 I (Revision 6)
Noyember 2012
--Suppression chamber pressure above Primary Containment Pressure Limit A, while the rate of energy transfer from the RPV to the containment is greater than the capacity of the containment vent.
The HCTL is a function of RPV pressure, suppression pool temperature and suppression pool water level. It is utilized to preclude failure of the containment and equipment in the containment necessary for the safe shutdown of the plant and therefore, the inability to maintain plant parameters below the limit constitutes a potential loss of containment.
141
DAEC CONTAINMENT BARRIER THRESHOLDS (cont.):1-Develeper Netes:
Potential Loss 1.B 1'1"EI 99 0 I (Revision 6)
November 20 I?
BWR EPGs/8,,\\Gs specifically define the limits associated v,ith eJcplosive miJctures in terms of deflagration concentrations of hydrogen and oxygen. For ~4k VII containments the deflagration limits are "6% hydrogen and 5% oxygen in the drywell or suppression chamber". For ~4k III containments, the limit is the "Hydrogen Deflagration Overpressure Limit". The threshold term "explosive miJcture" is synonymous v,rith the EPG/8l.1.G "deflagration limits".
Potential Loss 1.C Since the HCTL is defined assuming a range of suppression pool 'Nater levels as low as the elevation of the downcomer openings in ~4k I/II containments, or 2 feet above the elevation of the horizontal vents in a ~4k III containment, it is unnecessary to consider separate Containment barrier Loss or Potential Loss thresholds for abnormal suppression pool water level conditions. If desired, developers may include a separate Containment Potential Loss threshold based on the inability to maintain suppression pool water level above the downcomer openings in ~
I/II containments, or 2 feet above the elevation of the horizontal vents in a Mk III containment with RPV pressure above the minimum decay heat removal pressure, if it 'Nill simplify the assessment of the suppression pool level component of the HCTL.
- 2.
RPV Water Level There is no Loss threshold associated with RPV Water Level.
Potential Loss 2.A The Potential Loss threshold is identical to the Fuel Clad Loss RPV Water Level threshold 2.A. The Potential Loss requirement for Primary Containment Flooding indicates adequate core cooling cannot be restored and maintained and that core damage is possible. BWR EPGs/SAGs specify the conditions that require primary containment flooding. When primary containment flooding is required, the EPGs are exited and SAGs are entered. Entry into SA Gs is a logical escalation in response to the inability to restore and maintain adequate core cooling.
142
BWR CONTA.INMENT BARRIER THRESHOLDS:
l'>IBI 99 01 (Revision 6)
November 2012 PRA studies indicate that the condition of this Potential Loss threshold could be a core melt sequence which, if not corrected, could lead to RPV failure and increased potential for primary containment failure. In conjunction with the RPV water level Loss thresholds in the Fuel Clad and RCS barrier columns, this threshold results in the declaration of a General Emergency.
DeYelopeF Notes:
The phrase, "Primary containment flooding required," should be modified to agree 1.vith the site specific EOP phrase indicating e>cit from all EOPs and entry to the SA.Gs (e.g., dr)'\\vell flooding required, etc.).
- 3.
PFima11' Containment Isolation FailuFeRCS Leak Rate These thresholds address incomplete containment isolation that allows an UNISOLABLE direct release to the environment.
Loss 3.A.
The use of the modifier "direct" in defining the release path discriminates against release paths through interfacing liquid systems or minor release path>.vays, such as instrument lines, not protected by the Primary Containment Isolation System (PCIS).
The e>cistence of a filter is not considered in the threshold assessment. Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to iodine and/or particulate loading beyond design limits (i.e., retention ability has been e>eceeded) or,.vater saturation from steam/high humidity in the release stream.
Following the leakage of RCS mass into primary containment and a rise in primary containment pressure, there may be minor radiological releases associated with allov,zable primary containment leakage through various penetrations or system components. Minor releases may also occur if a primary containment isolation valve(s) fails to close but the primary containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of primary containment but should be evaluated using the Recognition Category A ICs.
Loss 3.B EOPs may direct primary containment isolation valve logic(s) to be intentionally bypassed, even if offsite radioactivity release rate limits will be e>rneeded. Under these conditions with a valid primary containment isolation signal, the contair..rnent should also be considered lost if primary containment venting is actually performed.
Intentional venting of primary containment for primary containment pressure or combustible gas control to the secondary containment and/or the environment is a Loss of the Containment. Venting for primary containment pressure control 1.vhen not in an accident situation (e.g., to control pressure belov,r the drywell high pressure scram setpoint) does not meet the threshold condition.
143
Loss 3.GA NET 99 01 (Revision 6)
November 2012 The Max Safe Operating Limit (MSOL) for Temperature and the Max Safe Operating Radiation Level are each the highest value of these parameters at which neither: (1) equipment necessary for the safe shutdown of the plant will fail, nor (2) personnel access necessary for the safe shutdown of the plant will be precluded. EOPs utilize these temperatures and radiation levels to establish conditions under which RPV depressurization is required.
B,¥R CONTAINMENT BARRIER THRESHOLDS:
The temperatures and radiation levels should be confirmed to be caused by RCS leakage from a primary system. A primary system is defined to be the pipes, valves, and other equipment which connect directly to the RPV such that a reduction in RPV pressure will effect a decrease in the steam or water being discharged through an unisolated break in the system.
In combination with RCS potential loss 3.A this threshold would result in a Site Area Emergency.
There is no Potential Loss threshold associated with Primary Containment Isolation Failm:eRCS Leak Rate.
144
DAEC CONTAINMENT BARRIER THRESHOLDS {cont.):t Develeper Netes:
Loss 3.B NEI 99 0 I (RevisioR 6)
NoYember 2012 Consideration may be given to specifying the specific procedural step i.vithin the Primary Containment Control EOP that defines intentional venting of the Primary Containment regardless of offsite radioactivity release rate.
- 4.
Primary Containment Radiation There is no Loss threshold associated with Primary Containment Radiation.
Potential Loss 4.A The drywell radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the primary containmentdrywell, assuming that 20% of the fuel cladding has failed. The radiation monitor reading for the torus corresponds to an instantaneous release of all reactor coolant mass directly into the torus. assuming that 20% of the fuel cladding has failed. This level of fuel clad failure is well above that used to determine the analogous Fuel Clad Barrier Loss and RCS Barrier Loss thresholds.
NUREG-1228, Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents, indicates the fuel clad failure must be greater than approximately 20% in order for there to be a major release of radioactivity requiring offsite protective actions. For this condition to exist, there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. It is therefore prudent to treat this condition as a potential loss of containment which would then escalate the emergency classification level to a General Emergency.
De1,rel0per Netes:
1'HJREG 1?28, Source Estimations During Incident Response to Se*;ere Nuclear Pmver Ph:mt Accidents, provides the basis for using the 20%
fuel cladding failure value. Unless there is a site specific analysis justifying a different value, the reading should be determined assuming the instantaneous release and dispersal of the reactor coolant noble gas and iodine inventory associated with ?0% fuel clad failure into the primary containment atmosphere.
B\\¥R CONTAINMENT BARRIER THRESHOLDS:
- 5.
Other Indications There is no Loss threshold associated with Other Indications Loss and/or Potential Loss 5.A 145
J!.lEI 99 QI (RevisioR e)
J!.loYember 2012 Results obtained from procedure PASAP 7.2, Fuel Damage Assessment, indicate at least 25% fuel clad damage. This subcategory addresses other site specific thresholds that may be included to indicate loss or potential loss of the Containment barrier based on plant specific design characteristics not considered in the generic guidance. PASAP 7.2 only shows whether fuel damage is greater than or less than 25%, thus this indication is not likely to be declared before containment barrier potential loss 4.A which indicates 20% fuel damage. However, this potential loss threshold adds an additional layer of diversity to the scheme.
146
De*,relaper Notes:
Loss and/or Potential Loss 5.A l>IEJ 99 0 I (RevisioA e)
November 2012 Developers should determine if other reliable indicators exist to evaluate the status of this fission product barrier (e.g., review accident analyses described in the site Final Safety Analysis Report, as updated). The goal is to identify any uruque or site specific indications that 1.vill promote timely and accurate assessment of barrier status.
1\\ny added thresholds should represent apprmcimately the same relative threat to the barrier as the other thresholds in this column. Basis information for the other thresholds may be used to gauge the relative barrier threat level.
- 6.
Emergency Director Judgment Loss 6.A This threshold addresses any other factors that are to be used by the Emergency Director in determining whether the Containment barrier is lost.
Potential Loss 6.A This threshold addresses any other factors that may be used by the Emergency Director in determining whether the Containment Barrier is potentially lost. The Emergency Director should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.
147
00
'<:t"
1 HI l1 Hu. ~ * : ilt J
1i1itlf 11
.L. : ilt I ilf t t lf 1 lf lf *.
<t 0
V)
-~-------
Jtlh~ IH!1 tln~Ht-* iii* 11 l. Iii t - - - t - - - - -
~
0
- J 11 ll: jJ11I *
- t I~* ll
.11 J itl
1~
- u
§ ii
PWR FUEL CLAD BARRIER THRESHOLDS:
The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets.
RCS OF SC Tube Leakage There is no Loss threshold associated vlith Reg or gG Tube Leakage.
Potential Loss I.A NEI 99 01 (RevisioR 6) 1'fovember 2012 This reading indicates a redaction in reactor vessel water level sufficient to allow the onset of heat induced cladding damage.
DevelopeF Notes:
Potential Loss I.A Enter the site specific reactor vessel water level value(s) used by EOPs to identify a degraded core cooling condition (e.g., requires prompt restoration action). The reactor vessel level that corresponds to apprmcimately the top of active fuel may also be used.
For plants that have implemented Westinghouse Owners Group Emergency Response Guidelines, enter the reactor vessel level(s) used for the Core Cooling Orange Path (including dependencies upon the status ofRCPs, if applicable).
Vlestinghouse ERG Plants Developers should consider including a threshold the same as, or similar to, "Core Cooling Orange entry conditions met" in accordance with the guidance at the front of this section. In accordance with EOPs, there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not warranted.
P'\\\\'R FUEL CLAD BARRIER THRESHOLDS:
Meeting this threshold results in a gite Area Emergency because this threshold is identical to Reg Barrier Potential Loss threshold 2.A; both will be met. This condition warrants a gite Area Emergency declaration because inadequate Reg heat removal may result in fuel heat up sufficient to damage the cladding and increase Reg pressure to the point 'Nhere mass,.vill be lost from the system.Potential Loss I.A.
This reading indicates a reduction in reactor vessel water level sufficient to allow the onset of heat induced cladding damage.
DevelopeF Notes:
Potential Loss I.A Enter the site specific reactor vessel,.vater level value(s) used by EOPs to identify a degraded core cooling condition (e.g., requires prompt restoration action). The reactor vessel level that corresponds to apprmcimately the top of active fuel may also be used.
For plants that have implemented Westinghouse Owners Group Emergency Response Guidelines, enter the reactor vessel level(s) used for the Core Cooling Orange Path (including dependencies upon the status ofRCPs, if applicable).
Westinghouse ERG Plants Developers should consider including a threshold the same as, or similar to, "Core Cooling Orange entry conditions met" in accordance with the guidance at the front of this section. In accordance with EOPs, there may be unusual accident conditions during \\Vhich operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not
,.varranted.
Devel0peF Notes:
155
00 V) -
P~'R CONTAINl\\llENT BARRIER THRESHOLDS:
NEI 99 0 I (Revision 6)
November 2012 The Containment Barrier includes the containment building and connections up to and including the outermost containment isolation valves.
This barrier also includes the main steam, feedwater, and blowdovm line e)ctensions outside the containment building up to and including the outermost secondary side isolation valve. Containment Barrier thresholds are used as criteria for escalation of the EGL from Alert to a Site A.rea Emergency or a General Emergency.
RCS or SC Tube Leakage Loss 1.A This threshold addresses a leaking or RUPTURED Steam Generator (SG) that is also FAULTED outside of containment. The condition of the SG, v.'hether leaking or RUPTURED, is determined in accordance with the thresholds for RCS Barrier Potential Loss l.A and Loss 1.A, respectively. This condition represents a bypass of the containment barrier.
FAULTED is a defined term within the NEI 99 01 methodology; this determination is not necessarily dependent upon entry into, or diagnostic steps within, an EOP. For eJcample, if the pressure in a steam generator is decreasing uncontrollably [plrt oftlw FA ULT ED definition] and the faulted steam generator isolation procedure is not entered because EOP user rules are dictating implementation of another procedure to address a higher priority condition, the steam generator is still considered FAULTED for emergency classification purposes.
The FAULTED criterion establishes an appropriate lower bound on the size of a steam release that may require an emergency classification.
Steam releases of this size are readily observable vlith normal Control Room indications. The lower bound for this aspect of the containment barrier is analogous to the lower bound criteria specified in IC SU3 for the fuel clad barrier (i.e., RCS activity values) and IC SU4 for the RCS barrier (i.e., RCS leak rate values).
This threshold also applies to prolonged steam releases necessitated by operational considerations such as the forced steaming of a leaking or RUPTURED steam generator directly to atmosphere to cooldovm the plant, or to drive an auxiliary (emergency) feed water pump. These types of conditions will result in a significant and sustained release of radioactive steam to the environment (and are thus similar to a FAULTED condition). The inability to isolate the steam flov.1 1.vithout an adverse effect on plant cooldown meets the intent of a loss of containment.
Steam releases associated with the eJcpected operation of a SG pmver operated relief valve or safety relief valve do not meet the intent of this threshold. Such releases may occur intermittently for a short period of time follmving a reactor trip as operators process through emergency operating procedures to bring the plant to a stable condition and prepare to initiate a plant cooldown. Steam releases associated vlith the unexpected operation of a valve (e.g., a stuck open safety valve) do meet this threshold.
163
l/)
l,O
l
OLI S!SU8_ "UUinfOO S!ql U!
o asn aq,(um sp1oqsann iaqio aqi lOJ uo!1uuu~:
a umoou puu,(1am11 a1omo1d II!JA s1 i1m1ua. qons su uoos su 1am aq PJROm'1.
a 1** o1d sampaoo1d i1m1mado ' oua 1am:
.. Mi)H*~ Jlf'IWU!"l"O;) '+/-NffNIWWI.
. * ~ 0,.... Ul."' )H0-08 "'IJJO ~- *Oj P.n
',., ss~1 f!HJlf'IIOd 10fPU13 sso1 Pl'*!S*.Rll ss91 e '""'!!OJ O!'fd-o ~Y!)HOni!l J v
- se101s.!8doJ*""O o1 suapuroqo UiJlSap O!J!Oads 1uu1d uo pasuq
,eureq )HOWY!"l"O;) "'11 JO SSOf f'l-O SUOll'JOIJJYI ""'llO Ul fl <:: '°'q1 qlv* oouun1ooou m "1a U 90UUfH~.,~'I'
+"ll"'
t'
- aouun1niJ ouauaiJ aqi lf! pa.1ap!suoo 1ou s.l.d o11s 1oq10 *sassa1ppu AJOiJa1Uoqns S!lli r.
oq5'>"fl 9!JIOO-s *,
01 d JO SSOf a1001pm 01 papnfOU! aq,(um lUql Spf
- vg SSO'J fU!lU9l0d 10/PUU ss
- Ulllfl sse1 ""'1 MOIJ MlJds Jlf'IRIY"'I""" * ~ ~ op,ad ~ado oq PJR<>qs 1"'11 jQOQ!d111h"f'1'81GhS '. r o<l,os 8.!Rsseld omoeds "I!' *'!1 **1",-1 SI )H!O<l,os 0JRSS01d )H8WY!"l"09 "'lJ J!
!S HSS<>.!d )HBWYl!JlYOB S8jl)Hj9ll IB'fl Ollf'ln I"!
- ). p SSO'j f'l!l"O!OJ
"'IJ.-.1"~ OSJV *(A!,1ds )H8WY!")H08 '*~*e) SUlOjS>\\S j"'!"OO "1
'!H091!
~ l!JlYO;) 'OI.!!lfRHIS 10 5" e S!Pj:
sum11puoo AJIU* P"11 Jlf'IWU~
"'11 01
- !'!'l**tdda !OH '! PIOifS""ll -:,
- allisop (1M!I) 1019""1f ""0d heYO!lflfOn,-j S fl
- (<,Hf!M, "!"j.!00 d,
p.:i:I *paqoua1 uo1 m u0111puoo O!J!Oa s pa1!sa
- r
,. *a a1a1ua aq OSfU uuo san{UA 1a1aurorod su qons suo!r.Po~ uo~ *amssa1d 1uauru!u1uoo O!J!Oads 9l!S
- , r *EJiml{ UOl}Uli1UtJ9P g (
URHU;uoo 1uannouoo v+..
l a n om aq,(um u011uJ1uaouoo ua dW 1ua mru1m eqi Jatua,(um s1ado1aAaQ Cl Oc JeqweAON:
(9 UO!S!A.l~) IQ 66 fill{
Figure 9 F 4: P"'R Containment Integrity er Bypass Examples Inside Containment Damper RCP Seal Cooling Auxiliary Building Damper AGE IS LEFT BL I
I Process '
172 I
Area
- Monitor :
'-- --- -- - --- 1
}IBI 99 0 I (RevisioR 6)
November 2012
NEI 99 01 (Revision 6)
- November 2012 10 HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY ICS/EALS 173
NEI 99 01 (ReYision 6)
}aloYember 2012 Table H 1: Reeegnitien Category "H" Initiating Ceeditiee Matrix UNUSUAL EVENT HUl Confirmed SECURITY CONDITION or threatc Op. A/odes: All HU2 Seismic event greater than OBE levels.
Op. Modes: All HU3 Hazardous eveffi:-
Op. 1\\/odes: All HU4 FIRE potentially degrading the level of safety of the plant.
Op. },/odes: All ALERT HAl HOSTILE
,i\\,CTION within the OW1'1ER CONTROLLED A,REA. or airborne attack threat within 30 minutes.
Op. A/odes: All HAS Gaseous release impeding access to equipment necessary for normal plant operations, cooldovm or shutdovm.
Op. A1edes: All SITE},.REA.
EMERGENCY HS1 HOSTILE ACTION \\Vithin the PROTECTED l\\REl\\.
Op. 1',wdes: All HA6 Control Room HS6 Inability to evacuation resulting control a key safety in transfer of plant function from outside control to alternate the Control Room.
locations.
n A,,,1 4 11 vp. ureotes: 1 tt Op. },lodes: All 174 GENERAL EMERGENCY HGl HOSTILE A.CTION resulting in loss of physical control of the facility.
Op. }.fedes: All
, Table iRteRded for 1:1se by
, EAL developers.
- lnclusioR iR licensee I
,J
,J
, uocumeRts 1s Rot requ1reu.
1 L------------------*
UNUSUAL EVENT HU7 Other conditions e)cist which in the judgment of the Emergency Director warrant declaration of a(NO)UE.
Op. }.fades: All ALERT HA7 Other conditions exist which in the judgment of the Emergency Director 1,varrant declaration of an Alert.
Op. },fed-es: All ECL: Notification of Unusual Event SITE AREA KMERCENCY HS7 Other conditions exist which in the judgment of the Emergency Director warrant declaration of a Site Area Emergency.
Op. },fades: All Initiating Condition: Confirmed SECURJTY CONDITION or threat.
Operating Mode Applicability: All Emergency Action Levels:
NEI 99 0 I (Revision 6)
~Joyemeer 2012 CENERi<\\L EMERGENCY HC7 Other conditions exist which in the judgment of the Emergency Director warrant declaration of a General Emergency.
Op. }.fades: All HU1 Example Emergency Action Levels:
(1 or 2 or 3)
A SECURJTY CONDITION that does not involve a HOSTILE ACTION as reported by the (site specific security shift supervision).DAEC Security Shift Supervision.
Notification of a credible security threat directed at the siteDAEC.
A validated notification from the NRC providing information of an aircraft threat.
Definitions:
SECURITY CONDITION: Any Security Event as listed in the approved security contingency plan that constitutes a threat/compromise to site security, threat/risk to site personnel, or a potential degradation to the level of safety of the plant. A SECURITY CONDITION does not involve a HOSTILE ACTION.
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOST AGES, and/or intimidate the licensee to achieve an end.
This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-
-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
175
l>lEl 99 0 I (RevisieA 6) l>J eYember 2012 SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including theincluding the ECCS. These systems are classified as safety-related.
Basis:
This IC addresses events that pose a threat to plant personnel or SAFETY SYSTEM equipment, and thus represent a potential degradation in the level of plant safety. Security events which do not meet one of these EALs are adequately addressed by the requirements of 10 CFR -§--73.71 or 10_-CFR--§ 50.72. Security events assessed as HOSTILE ACTIONS are classifiable under ICs HAI, HSI and HGl.
Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. Classification of these events will initiate appropriate threat-related notifications to plant personnel and GR:Goffsite response organizations.
176
NEl 99 01 (Revision 6)
~loYember 2012 Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.
177
NEI 99 0 l (Revision 6)
November 2012 EAL HUI.1 references (site specific security shift supervision)DAEC Security Shift Supervision because these are the individuals trained to confirm that a security event is occurring or has occurred. Training on security event confirmation and classification is controlled due to the nature of Safeguards and 10 CFR § 2.39.Q information.
EAL HUl.2 addresses the receipt of a credible security threat. The credibility of the threat is assessed in accordance with Abnormal Operating Procedure (AOP) 914, Security Events. fsite-specific procedare).
EAL HUI.3 addresses the threat from the impact of an aircraft on the plant. The NRC Headquarters Operations Officer (HOO) will commw1icate to the licensee if the threat involves an aircraft. The status and size of the plane may also be provided by NORAD through the NRC.
Validation of the threat is performed in accordance with (site specific procedure) Abnormal Operating Procedure (AOP) 914, Security Events..
Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should beis contained in non public documents such as the Security Plan.
Escalation of the emergency classification level would be via IC HAI.
Devel0peF Notes:
The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force.
The (site specific procedure) is the procedure(s) used by Control Room and/or Secarity personnel to determine if a security threat is credible, and to validate receipt of aircraft threat information.
Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan.
With due consideration given to the above developer note, EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures. Such references should not contain a recognizable description of the event. For eJcarnple, an EAL may be worded as "Security event #2, #5 or #9 is reported by the (site specific security shift supervision)."
EGL Assignment Attributes: 3.1.1.A 178
NEI 99 01 (Revision 6)
~J oyember 2012 ECL: Notification of Unusual Event Initiating Condition: Seismic event greater than OBE levels.
Operating Mode Applicability: All Example Emergency Action Levels:
Seismic event greater than Operating Basis Earthquake (OBE) as indicated by.;.
HU2
-+---- receipt of the Amber Operating Basis Earthquake Light and the wailing seismic alarm on 1C35.
Definitions:
DESIGN BASIS EARTHQUAKE (DBE): A DBE is vibratory ground motion for which certain (generally, safety-related) structures, systems, and components must be designed to remain functional.
OPERATING BASIS EARTHQUAKE (OBE): An OBE is vibratory ground motion for which those features of a nuclear power plant necessary for continued operation without undue risk to the health and safety of the public will remain functional.
Basis:
This IC addresses a seismic event that results in accelerations at the plant site greater than those specified for an Operating Basis Earthquake (OBEt An earthquake greater than an OBE but less than a Safe ShutdownDesign Basis Earthquake (8-SBDBE);! should have no significant impact on safety-related systems, structures and components; however, some time may be required for the plant staff to ascertain the actual post-event condition of the plant (e.g., performs walk-downs and post-event inspections). Given the time necessary to perform walk-downs and inspections, and fully understand any impacts, this event represents a potential degradation of the level of safety of the plant.
Event verification with external sources should not be necessary during or following an OBE.
Earthquakes of this magnitude should be readily felt by on-site personnel and recognized as a seismic event (e.g., typical lateral accelerations are in mrness of 0.08g). The Shift Manager or Emergency Director may seek external verification if deemed appropriate ( e.g., a call to the
+ Afl QBE is vibratory gro,rnd motion for which those feat1:1res of a fl1:1elear power 13lant necessary for continued 013eration without und1:1e risk to the health and safety of the p1:1blic will remain functional.
i! An 88E is vibratory gro1:1nd motion for *r,rhich certain (generally, safety related) strnctures, S)'Sterns, and co1fl13onents must be designed to remain functional.
179
NEI 99 01 (Revision 6)
J>lo't'emser 2012 USGS, check internet news sources, etc.); however, the verification action must not preclude a timely emergency declaration.
OBE events are detected in accordance with AOP 901. The OBE is associated with a peak horizontal acceleration of +/- 0.06g.
Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or,SA9SA8.
DevelepeF Netes:
This "site specific indication that a seismic event met or exceeded QBE limits" should be based on the indications, alarms and displays of site specific seismic monitoring equipment.
Indications described in the EAL should be limited to those that are immediately available to Control Room persormel and which can be readily assessed. Indications available outside the Control Room and/or which require lengthy times to assess (e.g., processing of scratch plates or recorded data) should not be used. The goal is to specify indications that can be assessed within 15 minutes of the actual or suspected seismic event.
For sites that do not have readily assessable QBE indications within the Control Room, developers should use the follmving alternate EAL (or similar wording).
(1)
- a.
- b.
Control Room personnel feel an actual or potential seismic event.
AND The occurrence of a seismic event is confirmed in manner deemed appropriate by the 8hift Manager or Emergency Director.
The EA *.L l.b statement is included to ensure that a declaration does not result from felt vibrations caused by a non seismic source (e.g., a dropped heavy load). The 8hift Manager or Emergency Director may seek e)(ternal verification if deemed appropriate (e.g., a call to the U8G8, check internet news sources, etc.); however, the verification action must not preclude a timely emergency declaration. It is recognized that this alternate EAL 1.vording may cause a site to declare an Unusual Event 1.vhile another site, similarly affected but with readily assessable QBE indications in the Control Room, may not.
The above alternate wording may also be used to develop a compensatory EAL for use during periods when a seismic monitoring system capable of detecting an QBE is out of service for maintenance or repair.
EGL Assignment Attributes: 3.1.1. A, 180
NEI 99 01 (ReYision 6)
NoYember 2012 HU3 ECL: Notification of Unusual Event Initiating Condition: Hazardous event~
Operating Mode Applicability: All Emergency Action Levels:
Example EmeFgeney Aetion Levels: (1 or 2 or 3 or 4 or 5 or 6)
Note: EAL HU3.4 does not apply to routine traffic impediments such as fog, snow, ice, or vehicle breakdowns or accidents.
~
1
~
2 HLJ3.3 H[J3.4 A tornado strike within the PROTECTED AREA.
Internal room or area flooding of a magnitude sufficient to require manual or automatic electrical isolation of a SAFETY SYSTEM component needed for the current operating mode.
Movement of personnel within the PROTECTED AREA is impeded due to an offsite event involving hazardous materials (e.g., an offsite chemical spill or toxic gas release).
A hazardous event that results in on-site conditions sufficient to prohibit the plant staff from accessing the site via personal vehicles.
(£ite specific list of natural or technological hazard events)LakeRiver-level above 757 feet.
River Water Supply (RWS) pit low level alarm.
Definitions:
PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan.
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety--
related.
Basis:
This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant.
EAL HU3. l addresses a tornado striking (touching down) within the Protected Area.
EAL HU3.2 addresses flooding of a building room or area that results in operators isolating power to a SAFETY SYSTEM component due to water level or other wetting concerns.
Classification is also required if the water level or related wetting causes an automatic isolation 181
NEI 99 Gl (Re¥isioR 6)
No>rember 2G 12 of a SAFETY SYSTEM component from its power source (e.g., a breaker or relay trip). To warrant classification, operability of the affected component must be required by Technical Specifications for the current operating mode.
EAL HU3.3 addresses a hazardous materials event originating at an off site location and of sufficient magnitude to impede the movement of personnel within the PROTECTED AREA.
EAL HU3.4 addresses a hazardous event that causes an on-site impediment to vehicle movement and significant enough to prohibit the plant staff from accessing the site using personal vehicles.
Examples of such an event include site flooding caused by a hurricane, heavy rains, up-river water releases, dam failure, etc., or an on-site train derailment blocking the access road.
This EAL is not intended apply to routine impediments such as fog, snow, ice, or vehicle breakdowns or accidents, but rather to more significant conditions such as the Hurricane Andrew strike on Turkey Point in 1992, the flooding arow1d the Cooper Station during the Midwest floods of 1993, or the flooding around Ft. Calhoun Station in 2011.
EAL HU3.5 addresses the observed effects of flooding in accordance with AOP 902 (Flood).
Plant site finished grade is at elevation 757.0 feet. Personnel doors and railroad and truck openings at or near grade would require protection in the event of a flood above elevation 757.0 feet. Therefore, EAL 6 uses a threshold of flood water levels above 757.0 feet. (site specific description).
EAL HU3.6 addresses the effects of loss ofriver water make-up capability. The intake structure for the safety-related water supply systems (river water, RHR service water, and emergency service water) is located on the west bank of the Cedar River. River levels below the intake structure inlet or a blockage of the intake would result in a loss of the ability to provide make-up water for safety-related systems. The overflow weir is at elevation 724 feet 6 inches. River level at or below this elevation will result in all river flow being diverted to the safety related water supply systems. The top of the intake structure around the pwnp wells is at elevation 724 feet. If the river water level dropped to this level, the pwnp suction would have no continuous supply.
Blockages of the intake structure may result from debris, ice, or aquatic life. A loss of flow into the intake structure, due to a blockage or low river level, will result in the pit level lowering to the alarm setpoint (723.0 feet) and a resulting alarm in the Control Room. Therefore, this EAL uses a threshold of low pit level as a potential substantial degradation of the ultimate heat sink capability.-:
Escalation of the emergency classification level would be based on I Cs in Recognition Categories AR, F, S or C.
De"leloper Notes:
The "Site specific list of natural or technological hazard events" should include other events that may be a precursor to a more significant event or condition, and that are appropriate to the site location and characteristics.
Notwithstanding the events specifically included as EALs above, a "Site specific list of natural or technological hazard events" need not include short lived events for vrhich the extent of the damage and the resulting consequences can be determined within a relatively short time frame.
In these cases, a damage assessment can be performed soon after the event, and the plant staff 1.vill be able to identify potential or actual impacts to plant systems and structures. This will 182
NEI 99 QI (Re¥isioR 6)
~foyember 2Q I 2 enable prompt definition and implementation of compensatory or corrective measures with no appreciable increase in risk to the public.
To the e)ctent that a short lived event does cause immediate and significant damage to plant systems and structures, it will be classifiable under the Recognition Category F, Sand C !Cs and EALs. Events of lesser impact v,'ould be expected to cause only small and localized damage.
The consequences from these types of events are adequately assessed and addressed in accordance 1.vith Technical Specifications. In addition, the occmTence or effects of the event may be reportable under the requirements of 10 CFR 50.72.
EGL Assignment Attributes: 3.1. l.i\\. and 3.1.1. C 183
1-Jel 99 01 (Revision 6) 1-lovemeer 2012 ECL: Notification of Unusual Event Initiating Condition: FIRE potentially degrading the level of safety of the plant.
Operating Mode Applicability: All Emergency Action Levels:
Example Emergeney Aetien LeYels: (1 or 2 or 3 or 4)
Note~:
HU4 The Emergency Director should declare the Unusual Event promptly upon determining that the applicable time has been exceeded, or will likely be exceeded.
HLJ4.1
- a.
- b.
- a.
- b.
A FIRE is NOT extinguished within 15-minutes of ANY of the following FIRE detection indications:
Report from the field (i.e., visual observation)
Receipt of multiple (more than 1) fire alarms or indications Field verification of a single fire alarm AND The FIRE is located within ANY of the followingTable H-1 plant rooms or areas:-
(site specific list of plant rooms or areas)
Receipt of a single fire alarm ~with no other indications of a FIRE}.
AND The FIRE is located within ANY of the followingTable H-1 plant rooms or areas (site specific list of plant rooms or areas)
AND
- c.
The existence of a FIRE is not verified within 30-minutes of alarm receipt.
A FIRE within the plant or ISFSI [fer plants v. 1ith an ISFSI outside the plant Protected Area] PROTECTED AREA not extinguished within 60-minutes of the initial report, alarm or indication.
A FIRE within the plant or ISFSI [fer plants with a19 ISFSJ o'bltside the plant Protected A-re-a]--PROTECTED AREA that requires firefighting support by an offsite fire response agency to extinguish.
Table H-1 Safe ShutdownNital Areas Cate!!orv Area Electrical Power 1G31 DG and Day Tank Rooms, 1G21 DG and Day Tank Rooms, Battery Rooms, Essential Switchgear Rooms, Cable S12reading Room Heat Sink/
Torus Room, Intake Structure, Pum12house Coolant Sunnlv 184
Containment Emergency Systems Other Drvwell. Torus "Jl,JEI 99 01 (RevisieA 6)
"Jloleyem.ber 2012 NE, NW. SE Corner Rooms, HPCI Room, RCIC Room, RHR Valve Room, North CRD Area. South CRD Area, CSTs Control Building, Remote Shutdown Panel 1C388 Area, Panel 1 C55/56 Area, SBGT Room 185
Definitions:
l>IEI 99 01 (Re11ision 6) l>lo>,*emeer 2012 FIRE: Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is prefe1Ted but is NOT required if large quantities of smoke and heat are observed.
PROTECTED AREA: The area under continuous access monitoring and controL and armed protection as described in the site Security Plan.
Basis:
This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.
EAL HU4.1 The intent of the 15-minute duration is to size the FIRE and to discriminate against small FIRES that are readily extinguished (e.g., smoldering waste paper basket). In addition to alarms, other indications of a FIRE could be a drop in fire main pressure, automatic activation of a suppression system, etc.
Upon receipt, operators will take prompt actions to confirm the validity of an initial fire alarm, indication, or report. For EAL assessment purposes, the emergency declaration clock starts at the time that the initial alann, indication, or report was received, and not the time that a subsequent verification action was performed. Similarly, the fire duration clock also starts at the time of receipt of the initial alarm, indication or report.
EAL HU4.2 This EAL addresses receipt of a single fire alarm, and the existence of a FIRE is not verified (i.e., proved or disproved) within 30-minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire alarm. For EAL assessment purposes, the 30-minute clock starts at the time that the initial alarm was received, and not the time that a subsequent verification action was performed.
A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipment failure or a spurious activation, and not an actual FIRE. For this reason, additional time is allowed to verify the validity of the alarm. The 30-minute period is a reasonable amount of time to determine if an actual FIRE exists; however, after that time, and absent information to the contrary, it is assumed that an actual FIRE is in progress.
186
l>lel 99 01 (Revision 6)
November 2012 If an actual FIRE is verified by a report from the field, then EAL HU4.1 is immediately applicable, and the emergency must be declared if the FIRE is not extinguished within 15-minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation, and this verification occurs within 30-minutes of the receipt of the alarm, then this EAL is not applicable and no emergency declaration is warranted.
EAL HU4.3 In addition to a FIRE addressed by EAL HU4.1 or EAL HU4.2, a FIRE within the plant or ISFSI PROTECTED AREA not extinguished within 60-minutes may also potentially degrade the level of plant safety. This basis extends to a FIRE occuning within the PROTECTED AREA of an ISFSI located outside the plant PROTECTED AREA. [£entence for plants with an I8F£I outside the plant Protected Area]
EAL HU4.4 If a FIRE within the plant or ISFSI [ferpl:1nts with In ISFS! outside thepfant Protected Area]
PROTECTED AREA is of sufficient size to require a response by an offsite firefighting agency (e.g., a local town Fire Department), then the level of plant safety is potentially degraded. The dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts because the fire is beyond the capability of the Fire Brigade to extinguish. Declaration is not necessary if the agency resources are placed on stand-by, or supporting post-extinguishrnent recovery or investigation actions.
Basis-Related Requirements from Appendix Rand NFPA-805 Criterion 3 of Appendix A to 10 CFR 50 states in part that "structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions."
The Nuclear Safety Goal ("NSG") in NFPA 805, Section 1.3.1 states, "The nuclear safety goal is to provide reasonable assurance that a fire during any operational mode and plant configuration will not prevent the plant from achieving and maintaining the fuel in a safe and stable condition."
When considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance because a safe shutdown success path, free of fire damage, must be available to meet the nuclear safety goals, objectives and performance criteria for a fire under any plant operational mode or configuration.
Because fire may affect safe shutdown systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post-fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents.
187
Nel 99 01 (Revision 6)
~lovember 2012 In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of I-hour fire barriers for the enclosure of cable and equipment and associated non-safety circuits of one redundant train (G.2.c). Even though DAEC has adopted the alternate approach provided by NFPA-805 in lieu of the deterministic requirements of Appendix R, the 30-minutes to verify a single alarm as used in EAL HU4.2 is considered a reasonable amount of time to determine if an actual FIRE exists without presenting a challenge to the nuclear safety performance criteria.Basis Related Requirements from Appendix R Appendi)£ R to IO CFR 50, states in part:
Criterion 3 of Appendix,o.._ to this part specifies that "Structures, systems, and components important to safety shall be designed and located to minimize, consistent v1ith other safety requirements, the probability and effect of fires and e)(plosions."
'.Vhen considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance to safety because damage to them can lead to core damage resulting from loss of coolant through boil off.
Because fire may affect safe shutdovm systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire dan1age to those systems required to mitigate the consequences of design basis accidents.
In addition, Appendix R to IO CFR 50, requires, among other considerations, the use of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barriers for the enclosure of cable and equipment and associated non safety circuits of one redundant train (G.2.c). /\\s used in EAL #2, the 30 minutes to verify a single alarm is well within this worst case 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> time period.
Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or,SA9SA8.
De¥elapeF Notes:
The "site specific list of plant rooms or areas" should specify those rooms or areas that contain SAFETY SYSTEM equipment.
As noted in the EA.Ls and Basis section, include the term ISFSI if the site has an ISFSI outside the plant Protected Area.
EGL Assignment Attributes: 3.1.1.A 188
ECL: Notification of Unusual Event l>Jel 99 o I (RevisioR e) 1'/oyember 2012 HU-76 Initiating Condition: Other conditions exist which in the judgment of the Emergency Director warrant declaration of a fN0 1UE.
Operating Mode Applicability: All l
EHmple Emergency Action Levels:
1 Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated.
No releases ofradioactive material requiring offsite response or monitoring are expected unless further degradation of SAFETY SYSTEMS safety systems occurs.
Definitions:
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety--
related.
Basis:
This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a NOUE.
189
NEJ 99 01 (Re11ision 6)
}lovember 2012 HA1 ECL: Alert Initiating Condition: HOSTILE ACTION within the OWNER CONTROLLED AREA or airborne attack threat within 30 minutes.
Operating Mode Applicability: All Examf)le Emergency Action Levels.:.: (1 or 2)
A HOSTILE ACTION is occurring or has occurred within the OWNER CONTROLLED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision.
A validated notification from NRC of an aircraft attack threat within 30 minutes of the site.
Definitions:
HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
OWNER CONTROLLED AREA: The site property owned by or otherwise under the control of the licensee.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
Basis:
This IC addresses the occurrence of a HOSTILE ACTION within the OWNER CONTROLLED AREA or notification of an aircraft attack threat. This event will require rapid response and assistance due to the possibility of the attack progressing to the PROTECTED AREA, or the need to prepare the plant and staff for a potential aircraft impact.
Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event.
Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program].
190
NE! 99 0 I (R1wisioA 6)
}foyember 2012 As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures ( e.g., evacuation, dispersal or sheltering).
The Alert declaration will also heighten the awareness of Offsite Response Organizations, allowing them to be better prepared should it be necessary to consider further actions.
This IC does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical disputes between employees, etc.
Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR f-73.71 or 10 CFR f-50.72.
EAL HAI.1 is applicable for any HOSTILE ACTION occurring, or that has occurred, in the OWNER CONTROLLED AREA. This includes any action directed against a:a-the ISFSI that which is located outside the plant PROTECTED AREA.
EAL HAI.2 addresses the threat from the impact of an aircraft on the plant, and the anticipated arrival time is within 30 minutes. The intent of this EAL is to ensure that threat-related notifications are made in a timely manner so that plant personnel and GRGoffsite response organizations are in a heightened state ofreadiness. This EAL is met when the threat-related information has been validated in accordance with ~Abnormal Operating Procedure (AOP) 914, Security Events site specific procedure)..§.:.
The NRC Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft. The status and size of the plane may be provided by NORAD through the NRC.
In some cases, it may not be readily apparent if an aircraft impact within the OWNER CONTROLLED AREA was intentional (i.e., a HOSTILE ACTION). It is expected, although not certain, that notification by an appropriate Federal agency to the site would clarify this point.
In this case, the appropriate federal agency is intended to be NORAD, FBI, FAA or NRC. The emergency declaration, including one based on other ICs/EALs, should not be unduly delayed while awaiting notification by a Federal agency.
Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be is contained in non public documents such as the Security Plan.
Escalation of the emergency classification level would be via IC HS 1.
DeYelefJeF Netes:
The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force.
Emergency plans and implementing procedures m*e public documents; therefore, EALs should not incorporate Security sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan.
191
ECL: Alert NEI 99 01 (Revision 6)
- November 2012 HA5HA3 Initiating Condition: Gaseous release impeding access to equipment necessary for normal plant operations, cooldown, or shutdown.
Operating Mode Applicability: All Example Emergency Action Levels:
Note: If the equipment in the listed room or area was already inoperable or out-of-service before the event occurred, then no emergency classification is warranted.
Hv\\,~3.1
- a.
AND Release of a toxic, corrosive, asphyxiant or flammable gas into ~ANY of the following plant rooms or areas:
BUILDING ROOM MODE Reactor Building HPCIRoom 1,2,or3 Reactor Building RCIC Room L 2, or 3 Reactor Building SE or NW Comer Rooms 3 or 4 Reactor Building Pump House ESW I RHRSW Pump Room 3 or 4
---_(site specific list of plant rooms or areas with entry related mode applicability identified)
- b.
Entry into the room or area is prohibited or impeded.
Definitions:
Basis:
This IC addresses an event involving a release of a hazardous gas that precludes or impedes access to equipment necessary to maintain normal plant operation, or required for a normal plant cooldown and shutdown. This condition represents an actual or potential substantial degradation of the level of safety of the plant.
An Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the gaseous release. The emergency classification is not contingent upon whether entry is actually necessary at the time of the release.
193
"NE! 99 01 (Re11ision 6)
N011ember 20 12 Evaluation of the IC and EAL do not require atmospheric sampling; it only requires the Emergency Director's judgment that the gas concentration in the affected room/area is sufficient to preclude or significantly impede procedurally required access. This judgment may be based on a variety of factors including an existing job hazard analysis, report of ill effects on personnel, advice from a subject matter expert or operating experience with the same or similar hazards.
Access should be considered as impeded if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area ( e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).
An emergency declaration is not warranted if any of the following conditions apply.
The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the gaseous release). For example, the plant is in Mode 1 when the gaseous release occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the affected room until Mode 4.
The gas release is a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area ( e.g., fire suppression system testing).
The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine inspections).
The access control measures are of a conservative or precautionary nature, and would not actually prevent or impede a required action.
An asphyxiant is a gas capable of reducing the level of oxygen in the body to dangerous levels.
Most commonly, asphyxiants work by merely displacing air in an enclosed environment. _This reduces the concentration of oxygen below the normal level of around 19%, which can lead to breathing difficulties, unconsciousness, or even death.
The list of plant rooms or areas in EAL HA~3.1 was generated from a step-by-step review of IPOI-3, Power Operations (35% - 100% Rated Power) and IPOI-4, Shutdown.
This EAL does not apply to firefighting activities that automatically or manually activate a fire suppression system in an area, or to intentional inerting of containment (RWR only).
Escalation of the emergency classification level would be via Recognition Category AR, C or F ICs.
DeYelaf)eF Notes:
The "site specific list of plant rooms or areas v-,*ith entry related mode applicability identified" should specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation, cooldown and shutdown.
Do not include rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off normal or emergency condition such as emergency repairs, corrective measures or emergency operations). In addition, the list should specify the plant mode(s) during which entry would be required for each room or area.
The list should not include rooms or areas for 1.vhich entry is required solely to perform actions of an administrative or record keeping nature (e.g., normal rounds or routine inspections).
194
NEl 99 01 (Revision 6) l-10 1,em:ber 2012 The list need not include the Control Room if adequate engineered safety/design features are in place to preclude a Control Room evacuation due to the release of a hazardous gas. Such features may include, but are not limited to, capability to draw air from multiple air intakes at different and separate locations, inner and outer atmospheric boundaries, or the capability to acquire and maintain positive pressure within the Control Room envelope.
If the equipment in the listed room or area was already inoperable, or out of service, before the event occurred, then no emergency should be declared since the event v1ill have no adverse impact beyond that already allowed by Technical Specifications at the time of the event.
EGL A.ssignment Attributes: 3.1.2.B 195
196 NEI 99 01 (RevisioH e) 1-Joyember 2012
ECL: Alert NEI 99 01 (Revision 6)
November 2012 HA6HA5 Initiating Condition: Control Room evacuation resulting in transfer of plant control to alternate locations.
Operating Mode Applicability: All Example Emergency Action Levels:
H 65.1 An event has resulted in plant control being transferred from the Control Room to fsite-specific remote shutdown panels and local control stations)the Remote Shutdown Panel (1C388).
Definitions:
Basis:
This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations outside the Control Room. The loss of the ability to control the plant from the Control Room is considered to be a potential substantial degradation in the level of plant safety.
Following a Control Room evacuation, control of the plant will be transferred to alternate shutdown locations. The necessity to control a plant shutdown from outside the Control Room, in addition to responding to the event that required the evacuation of the Control Room, will present challenges to plant operators and other on-shift personnel. Activation of the ERO and emergency response facilities will assist in responding to these challenges.
Escalation of the emergency classification level would be via IC HS62_.
De;.*elepeF Netes:
The "site specific remote shutdown panels and local control stations" are the panels and control stations referenced in plant procedures used to cooldown and shutdovm the plant from a location(s) outside the Control Room.
EGL Assignment i\\.ttributes: 3.1.2.B 197
ECL: Alert NE! 99 01 (Revision 6)
Jl,lo 11ember 2012 HA7HA6 Initiating Condition: Other conditions exist which in the judgment of the Emergency Director warrant declaration of an Alert.
Operating Mode Applicability: All l
Example Eme,geeeyEmergency Action Levels:
1 Other conditions exist which, in the judgment of the Emergency Director, indicate that events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOST AGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
HOST AGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
Basis:
This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for an Alert.
198
ECL: Site Area Emergency Initiating Condition: HOSTILE ACTION within the PROTECTED AREA.
Operating Mode Applicability: All Example EmeFgeeeyEmergencv Action Levels:
NEI 99 01 (Revision 6) l'lovemaer 2012 HS1 HSI.I A HOSTILE ACTION is occurring or has occuned within the PROTECTED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land. or water using guns, explosives, PROJECTILEs.
vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
HOSTILE FORCE: One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan.
Basis:
This IC addresses the occurrence of a HOSTILE ACTION within the PROTECTED AREA.
This event will require rapid response and assistance due to the possibility for damage to plant equipment.
Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event.
Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.
199
NEI 99 01 (Revision 6)
November 2012 As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures ( e.g., evacuation, dispersal or sheltering).
The Site Area Emergency declaration will mobilize GR:Goffsite response organization resources and have them available to develop and implement public protective actions in the unlikely event that the attack is successful in impairing multiple safety functions.
This IC does not apply to a HOSTILE ACTION directed at an-the ISFSI PROTECTED AREA which is located outside the plant PROTECTED AREA; such an attack should be assessed using IC HAI. It also does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical disputes between employees, etc. Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR -§-73.71 or 10 CFR -§-50.72.
Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should beis contained in non public documents such as the Security Plan.
Escalation of the emergency classification level would be via IC HG 1.
Develeper Netes:
The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force.
Emergency plans and implementing procedures are public documents; therefore, EA.Ls should not incorporate Security sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan.
With due consideration given to the above developer note, EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures. Such references should not contain a recogniz;able description of the event. For mmmple, an EAL may be worded as "Security event #2, #5 or #9 is reported by the (site specific security shift supervision)."
See the related Developer Note in AppendiJc B, Definitions, for guidance on the development of a scheme definition for the PROTECTED AREA.
EGL Assigrnnent Attributes: 3.1.3.D 200
NEI 99 01 (Revision 6)
"NoYel'l'leer 2012 HS6HS5 ECL: Site Area Emergency Initiating Condition: Inability to control a key safety function from outside the Control Room.
Operating Mode Applicability: All Example Emergency Action Levels:
Note: The Emergency Director should declare the Site Area Emergency promptly upon determining that (site specific number of20 minutesj has been exceeded, or will likely be exceeded.
- a.
- b.
Definitions:
Basis:
An event has resulted in plant control being transferred from the Control Room to (site specific remote shutdown panels and_control stations) the Remote Shutdown Panel (1 C388).
AND Control of ANY of the following key safety functions is not reestablished within (site specific number of20 minutesj.
Reactivity control Core cooling [PWR] I RPV water level [BWR]
RCS heat removal This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations, and the control of a key safety function cannot be reestablished in a timely manner. The failure to gain control of a key safety function following a transfer of plant control to alternate locations is a precursor to a challenge to one or more fission product barriers within a relatively short period of time.
The determination of whether or not "control" is established at the remote safe shutdown location(s)Remote Shutdown Panel (1C388-tsm based on Emergency Director judgment. The Emergency Director is expected to make a reasonable, informed judgment within (the site specific time for transfer) ~20 minutes whether or not the operating staff has control of key safety functions from the remote safe shutdown location(s).
AOP 915, "Shutdown Outside Control Room" provides the following CAUTION - "For Control Room evacuation as the result ofa fire, transfer of control at panels JC388. JC389. JC390.
JC391. JC392and JC392 is required to be completed within 20 minutes."
Escalation of the emergency classification level would be via IC FG 1 or CG 1.
201
Devela~eF Notes:
1-lEI 99 01 (Revision 6) 1-lovember 2012 The "site specific remote shutdovm panels and local control stations" are the panels and control stations referenced in plant procedures used to cooldovm and shutdovm the plant from a location(s) outside the Control Room.
The "site specific number of minutes" is the time in which plant control must be (or is e)cpected to be) reestablished at an alternate location as described in the site specific fire response analyses. i\\bsent a basis in the site specific analyses, 15 minutes should be used. Another time period may be used with appropriate basis/justification.
EGL A,ssignment Attributes: 3.1.3.B 202
ECL: Site Area Emergency NB! 99 01 (Revision 6)
November 2012 HS7HS6 Initiating Condition: Other conditions exist which in the judgment of the Emergency Director warrant declaration of a Site Area Emergency.
Operating Mode Applicability: All
~ Exemple Emergency Action Levels:
1 Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts, (1) toward site personnel or equipment that could lead to the likely failure of or, (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA Protective Action Guideline exposure levels beyond the site boundary.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOST AGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
HOST AGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
Basis:
This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a Site Area Emergency.
203
1-J.el 99 01 (ReYision 6) 1-loYember 2012 HG1 ECL: General Emergency Initiating Condition: HOSTILE ACTION resulting in loss of physical control of the facility.
Operating Mode Applicability: All Example Emergency Action Levels:
- a.
A HOSTILE ACTION is occurring or has occurred within the PROTECTED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision.
AND
- b.
EITHER of the following has occurred:
- 1.
ANY of the following safety functions cannot be controlled or maintained.
Reactivity control Core cooling [PWR] I RPV water level [BWR]
- 2.
Damage to spent fuel has occurred or is IMMINENT.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end.
This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
HOSTILE FORCE: One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming. or causing destruction.
IMMINENT: The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.
204
NEI 99 01 (Revision 6)
November 2012 PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan.
205
Basis:
206 NEI 99 01 (Revision 6) l>lo;rember 2012
NE! 99 01 (ReYision 6)
- November 2012 This IC addresses an event in which a HOSTILE FORCE has taken physical control of the facility to the extent that the plant staff can no longer operate equipment necessary to maintain key safety functions. It also addresses a HOSTILE ACTION leading to a loss of physical control that results in actual or IMMINENT damage to spent fuel due to 1) damage to a spent fuel pool cooling system (e.g., pumps, heat exchangers, controls, etc.) or, 2) loss of spent fuel pool integrity such that sufficient water level cannot be maintained.
Timely and accurate communications between the DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event.
Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.
Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should beis contained in non public documents such as the Security Plan.
207
N 0
00
ECL: General Emergency NEI 99 01 (Revision 6)
November 2012 HG7HG6 Initiating Condition: Other conditions exist which in the judgment of the Emergency Director warrant declaration of a General Emergency.
Operating Mode Applicability: All 6
Example Emergency Action Levels:
1 Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occun-ed which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOST AGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
HOST AGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
IMMINENT: The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
Basis:
This IC addresses unanticipated conditions not addressed explicitly elsewhere but that wan-ant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a General Emergency.
209
11 SYSTEM MALFUNCTION ICS/EALS Nel 99 0 I (RevisieA 6)
N evember 2012 Table 8 1: Reeogeition Category "8" Ieitiatieg Condition Matrix UNUSUAL EVENT SUl Loss of all offsite AC power capability to emergeAcy buses for 15 miAutes or longer.
Op. l,ledes: 1. 2, 3. !/Power Operltion, St1rlll-JJ, Hot Stlndhy, Hat Shutdewn SUl UNPLA}l1'1ED loss of CoAtrol Room indications for 15 miAutes or loAger.
Op.,~ledes: Power Operltion, Sl11*tup, Hot St11uiby, Hot Shtttde;1*11L...1..
3, 4 SUJ Reactor coolaAt activity greater thaA TechAical SpecificatioA allowable limits.
Op. l',ledes: 1, 2, 3, !/Power 0perltion, St11*tll-JJ, Hot St1nc/.hy*, Hot Sht1tdawn SU4 RCS leakage for 15 miAutes or loAger.
Op. },ledes: 1, 2, 3, !/Power Opel'ltio19, St1rlll-JJ, Ha:
St1ndby, Hat Slnttdewn SUS Automatic or manual (trip [PWRl /
scram [BWRl) fails to shutdown the reactor.
Op.,\\lodes:
Power Operation,]
ALERT SAl Loss of all but oAe AC power source to emergeAey b1:1ses for 15 mim1tes or loAger.
Op. },ledes: LJ.,_l,_
j_Power Operltion, St1rtup, Hat Standby, Hot Slw:down SAl UNPLA}l1'1ED loss of Control Room iAdieatioAs for 15 miAutes or longer 1Nith a sigt1ifieaAt traAsieAt iA progress.
Op. Mades: 1, 2, 3, 4 Power Operation, Stlrtup, Hat Stlndhy, Hat Shutdown SAS A.utomatic or manual (trip [PWR] I scram [BWR]) fails to shutdo1.vn the reactor, and subsequent manual actions taken at the reactor control consoles are not successful in shutting dovm the reactor.
Op. }.fades: Power Operation{
SS1 SITE AREA EMERGENCY Loss of al I offsite aAd all oAsite AC power to emergeAey buses for 15 minutes or loAger.
Op.,~ledes: 1, 2, 3, !/Power Operation, S:arlll-JJ, Hot St1ndhy, Hat S!mtdown 885 Inability to shutdovm the reactor causing a challenge to (core cooling [PWR] I RPV water level [B WR])
or RC8 heat removal.
Op. Aledes: Po-wer Operltion1 210 GENERAL EMERGENCY SGl ProloAged loss of all offsite aAd all oAsite AC povter to emergeAey buses.
Op.,~ledes: 1, 2, 3, !/Power Operation, St1rtup, Hat Stand-hy*, Hot SlwtdowJ1 1 Table iAtenaea for use by 1
I 1 EAL developers.
- JAcl1:1sioA iA lieeAsee I d
,J 1
oeuments 1s Rot requ1reu. 1 L------------------'
UNUSUAL EVENT SU6 Loss of all onsite or offsite eommunications capabilities.
Op. },fades: l. 2. 3. 4Pewer 0pa6ltien, Stctrtblf), Hat Stffl'ldhy, Hat ShMtdawn SU7 Failure to isolate containment or loss of eontainment pressure control. [PWR]
Op. },1edes: 1. 2. 3.
1:. Pewer Ope:r6ltien, Sl:6lrtup, Hat Stctndby, Hat S!nlldewn ALERT SITE AREA EMERGENCY NEI 99 01 (ReYisian 6)
}foyember 2012 GENERAL EMERGENCY SS8 Loss of all Vital DC SGS Loss of all AC and Si".. 9 Hazardous event affecting a SAFETY SYSTEM needed for the eurrent operating mode.
Op. },1edes: 1. 2. 3. 4.Pewer Ope:r6ltien, Sl:61rtblf), Hat Sl:6lndby, Hat S1n1tdewn pov,*er for 15 minutes or longer.
Op.,".fades: 1. 2. 3. 4Pewe1*
Oper6ltien, St61Ftblf), Hat Slct1ldby*, Hat Shutdewn 211 Vital DC power sources for 15 minutes or longer.
Op. },1edes: 1. 2. 3. 4Pewer 0pe:r6ltien, S1:61Fh1J3, Hat Sl61ndby*, Hat Shutdewn 1 Table intended for use by I
1 EAL developers.
- Inclusion in licensee I d
. d 1
ocuments 1s not require.
~------------------*
ECL: Notification of Unusual Event Nel YY u 1 (Ke*,1s10R e)
November 2012 SU1 Initiating Condition: Loss of all-ALL offsite AC power capability to emergency essential buses for 15 _-minutes or longer.
Operating Mode Applicability: Power Operation, £tartup, Hot £tandby, Hot £hutdown.L..LJ Example Emergency Action Levels:
Note: The Emergency Director should declare the Unusual Event promptly upon determining that 15 minutes has been exceeded, or will likely be exceeded.
S 1.1 Loss of ALL offsite AC power capability to (site specific emergency buses)1A3 AND 1A4 for 15 minutes or longer.
Definitions:
Basis:
This IC addresses a prolonged loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emergency essential buses-..,_ This condition represents a potential reduction in the level of safety of the plant.
The intent of this EAL is to declare an Notification of Unusual Event when offsite power has been lost and both of the emergency diesel generators have successfully started and energized their respective 4kv essential bus.
For emergency classification purposes, "capability" means that an offsite AC power source(s) is available to the emergeney essential buses, whether or not the buses are powered from it.
Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power.
Escalation of the emergency classification level would be via IC SAl.
Develeper Netes:
The "site specific emergency buses" are the buses fed by offsite or emergeney AC power sources that supply pov,rer to the electrical distribution system that powers £AFETY £Y£TEM£. There is typically 1 emergenc::,* bus per train of £AFETY £Y£TEM£.
At multi unit stations, the EALs may credit eompensatory measures that are proceduralized and can be implemented vrithin 15 minutes. Consider capabilities such as power source cross ties, "swing" generators, other power sources described in abnormal or emergency operating procedures, etc. Plants that have a proceduralized capability to supply offsite AC po1.ver to an 212
provided that the p ru.ne
- 1... tes* 3.1.1.A t 6ttnuu EGL Assign.men,
"l lcil 99 0 l (Ke'iJSJOR a)
J>foyember 2012
- the EAL
. h" O"'er source m uon unit may cred1~ t us p w f 10 CFR 50.63.
213
ECL: Notification of Unusual Event
)1.,lbl yy u I lKeYISIOH o)
Jl.loYernber 2012 SU2SU3 Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdovm.L_l,_]_
Example Emergency Action Levels:
Note: The Emergency Director should declare the Unusual Event promptly upon determining that 15 minutes has been exceeded, or will likely be exceeded.
An UNPLANNED event results in the inability to monitor one or more of the -------following parameters from within the Control Room for 15 minutes or longer.
S 3.1
- a.
Reactor Power RPV Water -Level RPV Pressure Primary Containment Pressure Suppression Pool Level Suppression Pool Temperature r DTH D -
, ];_,,
r DTH D J; _,,
,~
.&.\\..,... -
I Reaetor Power Reaetor Po1.11*er RP¥ Water be,,cel RGS be1vel RP¥ PressUFe RGS Pressure Primary Gontainment Pressure T-0 T'.:.. 'T'
.~.--
Suppression Pool bevel bevels in at least Esite speeifie numbefj steam generators Suppression Pool +emperature Steam Generator Au~filiary or
~
T'
,..J '" T
'C'l -..
~ *-
Definitions:
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety-related.
UNPLANNED: A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.
Basis:
This IC addresses the difficulty associated with monitoring normal plant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant.
214
Nl:H ~Al Ul (:KeYISJOH 6) l>J OYember 2012 As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). _For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.
215
Nl:il IJIJ UJ (Kev1s1on 6)
- November 2012.
An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.
This EAL is focused on a selected subset of plant parameters associated with the key safety functions ofreactivity control, core cooling [PWR] I RPV level [BWR] and RCS heat removal.
The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [P'NRJ / RPV water level [B'NR] cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.
Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.
Escalation of the emergency classification level would be via IC SAlJ.
Devel0peF Notes:
In the PVlR parameter list column, the "site specific number" should reflect the minimum number of steam generators necessary for plant cooldown and shutdown. This criterion may also specify \\Vhether the level value should be wide range, narrov,r range or both, depending upon the monitoring requirements in emergency operating procedures.
Developers may specify either pressurizer or reactor vessel level in the PWR parameter column entry for RCS Level.
The number, type, location and layout of Control Room indications, and the range of possible failure modes, can challenge the ability of an operator to accurately determine, within the time period available for emergency classification assessments, if a specific percentage of indications have been lost. The approach used in this EAL facilitates prompt and accurate emergency classification assessments by focusing on the indications for a selected subset of parameters.
By focusing on the availability of the specified parameter values, instead of the sources of those values, the EAL recognizes and accommodates the v<'ide variety of indications in nuclear power plant Control Rooms. Indication types and sources may be analog or digital, safety related or not, primary or alternate, individual meter value or computer group display, etc.
A loss of plant annunciators will be evaluated for reportability in accordance with 10 CFR 50.72 (and the associated guidance in NUREG 1022), and reported if it significantly impairs the capability to perform emergency assessments. Compensatory measures for a loss of annunciation can be readily implemented and may include increased monitoring of main control boards and more frequent plant rounds by non licensed operators. Their alerting function notwithstanding, annunciators do not provide the parameter values or specific component status information used to operate the plant, or process through AOPs or EOPs. Based on these 216
Ne! 99 o I (Kev1s1on 6)
~lovember 2Q 12 considerations, a loss of annunciation is considered to be adequately addressed by reportability criteria, and therefore not included in this IC and EAL.
With respect to establishing event severity, the response to a loss of radiation monitoring data (e.g., process or effluent monitor values) is considered to be adequately bounded by the requirements of 10 CFR 50.72 (and associated guidance in l'JUREG 1022). The reporting of this event 1.vill ensure adequate plant staff and NRG awareness, and drive the establishment of appropriate compensatory measures and corrective actions. In addition, a loss of radiation monitoring data, by itself, is not a precursor to a more significant event.
Personnel at sites that have a Failure Modes and Effects Analysis (FMEl... ) included within the design basis of a digital I&C system should consider the FMEl... information when developing their site specific EALs.
Due to changes in the configurations of SAFETY SYSTEMS, including associated instrumentation and indications, during the cold shutdovm, refueling, and defueled modes, no analogous IC is included for these modes of operation.
EGL Assignment Attributes: 3.1.1.l...
217
2 N el 99 U l (KeVISIOR 6)
~loyemeer 2012 SU3SU4 ECL: Notification of Unusual Event Initiating Condition: Reactor coolant activity greater than Technical Specification allowable limits.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdown.L.1..,_]
Example Emergency Action Levels: (1 or 2)
(Site specific radiation monitor) reading greater than (site specific value). Pretreatment Offgas System (RM-4104) Hi-Hi Radiation Alarm.
Sample analysis indicates that reactor coolant specific activity is greater than 2.0 µCi/gm dose equivalent I-131 for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or longerSample analysis indicates that a reactor coolant activity value is greater than an allowable limit specified in Technical Specifications.:.-:-
Definitions:
Basis:
This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.
For EAL SU4.1, RM-4104 Hi-Hi Radiation Alarm has been chosen because it is operationally significant, is readily recognizable by the Control Room Operations Staff, and is set at a level corresponding to noble gas release rate, after 30-minute delay and decay of 1 Ci/sec.
For EAL SU4.2, coolant samples exceeding the 2.0 µCi/gm dose equivalent 1-131 concentration require prompt action by DAEC Technical Specifications and are representative of minor fuel cladding degradation.
Escalation of the emergency classification level would be via ICs FAI or the Recognition Category A-R I Cs.
DeYelepeF Netes:
For EAL #1 Enter the radiation monitor(s) that may be used to readily identify when RCS activity levels exceed Technical Specification allowable limits. This EAL may be developed using different methods and sites should use e)dsting capabilities to address it (e.g., development of new capabilities is not required). E>mmples of e)cisting methods/capabilities include:
An installed radiation monitor on the letdovm system or air ejector.
218
f'lel 99 U I (K.eYISIOH e)
NoYember 2012
/'.. hand held monitor or deployed detector reading with pre calculated conversion values or readily implementable conversion calculation capability.
The monitor reading values should correspond to an RCS activity level apprmcimately at Technical Specification allowable limits.
If there is no existing method/capability for determining this EAL, then it should not be included.
IC evaluation 1.vill be based on EAL #2.
For EAL#2 Developers may reword the EAL to include the reactor coolant activity parameter(s) specified in Tech.'lical Specifications and the associated allowable limit(s) (e.g.,
values for dose equivalent I 131 and gross activity, time dependent or transient values, etc.). If this approach is selected, all RCS activity allowable limits should be included.
EGL Assignment Attributes: 3.1.1.A and 3.1.1.B 219
Nel 99 u l (Ke*11s10R a) l>Jovember 2012 SU4SU5 ECL: Notification of Unusual Event Initiating Condition: RCS leakage for 15 minutes or longer.
Operating Mode Applicability: Power Operation, 8truiup, Hot 8tandby, Hot 8hutdown.L._U Example Emergency Action Levels: (1 or 2 or 3)
Note: The Emergency Director should declare the Unusual Event promptly upon determining that 15 minutes has been exceeded, or will likely be exceeded.
~
1
$ 2
~
3 RCS unidentified or pressure boundary leakage greater than (site specific value) 10 gpm for 15 minutes or longer.
RCS identified leakage greater than (site specific value)25 gpm for 15 minutes or longer.
Leakage from the RCS to a location outside containment greater than 25 gpm for 15 minutes or longer.
Definitions:
UNISOLABLE: An open or breached system line that cannot be isolated, remotely or locally.
Basis:
This IC addresses RCS leakage which may be a precursor to a more significant event. In this case, RCS leakage has been detected and operators, following applicable procedures, have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant.
EAL SUS.I and EAL SU5.2 are focused on a loss of mass from the RCS due to "unidentified leakage", "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications).
EAL SU5.3 addresses a RCS mass loss caused by an UNISOLABLE leak through an interfacing system. These EALs thus apply to leakage into the containment, a secondary-side system~
steam generator tube leakage in a PWR) or a location outside of containment.
The leak rate values for each EAL were selected because they are usually observable with normal Control Room indications. Lesser values typically require time-consuming calculations to determine (e.g., a mass balance calculation). EAL SUS.I uses a lower value that reflects the greater significance of unidentified or pressure boundary leakage.
220
Nhl 99 U l (KeYJSJOR o)
}lovemeer 2012 The release of mass from the RCS due to the as-designed/expected operation of a relief valve does not warrant an emergency classification. For PWRs, an emergency classification would be required if a mass loss is caused by a relief valve that is not functioning as designed/expected (e.g., a relief valve sticks open and the line flov,r cannot be isolated). For BV/Rs, aA stuck-open Safety Relief Valve (SRV) or SRV leakage is not considered either identified or unidentified leakage by Technical Specifications and, therefore, is not applicable to this EAL.
221
f>J.el YY U I (Kev1s1on 6) 1'-lo't'ember 2012 The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage, if possible.
Escalation of the emergency classification level would be via I Cs of Recognition Category A-R orF.
Developer Notes:
EAL # 1 For the site specific leak rate value, enter the higher of 10 gpm or the value specified in the site's Technical Specifications for this type of leakage.
EAL #2 For the site specific leak rate value, enter the higher of 25 gpm or the value specified in the site's Tech..'l:ical Specifications for this type of leakage.
For sites that have Technical Specifications that do not specify a leakage type for steam generator tube leakage, developers should include an EAL for tube leakage greater than 25 gpm for 15 minutes or longer.
EGL Assignment i\\.ttributes: 3.1.1.A 222
N el YY u l (Kev1s10n 6)
N011ember 2012 SU5SU6 ECL: Notification of Unusual Event Initiating Condition: Automatic or manual (trip [PWRJ / scram [B\\l/R]) fails to shutdown the reactor.
Operating Mode Applicability: Pov,rer OperationU Nate: A manual action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.
Example Emergency Action Levels: (1 or 2)
Note: A manual action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.
SU6. 1
- a. An automatic (trip [PWRJ / scran1 [B'NR]) did not shutdown the reactor.
S 6.2 AND
- b.
ANY of the following manual actions taken at 1C05 are successful in lowering reactor power below 5% power
- a.
Manual Scram Pushbuttons Mode Switch to Shutdown Alternate Rod Insertion (ARI)A subsequent manual action taken at the reactor control consoles (1C05) is successful in shutting down the reactor.
A manual trip ([PWRJ / scram [BVlR]) did not shutdown the reactor.
AND
- b.
EITHER of the following:
- 1. -ANY of the following subsequent manual actions taken at 1C05 are successful in lowering reactor power below 5% power Manual Scram Pushbuttons Mode Switch to Shutdown Alternate Rod Insertion (ARI)A subsequent manual action taken at the reactor control console (1 C05)s is successful in shutting down the reactor.
---__ OR 224
Definitions:
Basis:
JI-lei yy OJ (KeYISIOR 6) 1>1011emeer 2012
- 2.
- A subsequent automatic (trip [PWR] / scram [RWR]) is successful in shutting down the reactor.
This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ttriP
[PWR] I scram [BWR]) that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic (trip [PWR] I scram [BWR])
is successful in shutting down the reactor. _This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.
Following the failure on an automatic reactor (trip [PWR] I scram [BWR]), operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor ( e.g.,
initiate a manual reactor ttrip [PWR] I scram [BWR])). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.
225
Nb! 99 U l (Ke\\'ISIOA 6) l>l oyemeer 2012 If an initial manual reactor (trip [PWR] I scram [BWR]) is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor (trip [PWR] I scram [BWR])) using a different switch). Depending upon several factors, the initial or subsequent effort to manually (trip [PWR] I scram [BWR]) the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor ftrip
[PWR] I scram [BWR]) signal. If a subsequent manual or automatic (trip [PWR] I scram [BWR])
is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.
A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core ( e.g., initiating a manual reactor ftrip
[PWR] I scram [BWR])). This action does not include manually driving in control rods or implementation of boron injection strategies. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".
Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.
[BWR]
The plant response to the failure of an automatic or manual reactor (trip [P\\VR] / scram [B\\VR])
will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC SA~§.. Depending upon the plant response, escalation is also possible via IC F Al. Absent the plant conditions needed to meet either IC SA~§. or F Al, an Unusual Event declaration is appropriate for this event.
The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).A reactor shutdovm is determined in accordance 1.vith applicable Emergency Operating Procedure criteria.
Should a reactor (trip [P'.VR] / scram [BWR]) signal be generated as a result of plant work ( e.g.,
RPS setpoint testing), the following classification guidance should be applied.
I
- If the signal causes a plant transient that should have included an automatic reactor ftrip
[P\\VR] I scram [BWR]) and the RPS fails to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated.
If the signal does not cause a plant transient and the (trip [PWR] / scram [BWR]) failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.
DfY.*eleper Netes:
This IC is applicable in any Mode in which the actual reactor power level could e>cceed the power level at which the reactor is considered shutdovm. A PWR 1,vith a shutdown reactor power level that is less than or equal to the reactor power level which defines the lower bound of Power Operation (Mode 1) will need to include Startup (Mode 2) in the Operating Mode Applicability. For example, if the reactor is considered to be shutdovm at 3% and Pov;er Operation stmis at >5%, then the IC is also applicable in Startup Mode.
226
,"JlH 99 U l (K.eYJSIOH 6)
- November 2012 Developers may include site specific EOP criteria indicative of a successful reactor shutdovm in an EAL statement, the Basis or both (e.g., a reactor power level).
The term "reactor control consoles" may be replaced with the appropriate site specific term (e.g., main control boards).
EGL Assignment Attributes: 3.1.1.A 227
Nel yy u l (K.e*,'ISIOR a)
}JoYeffieer 2() J 2 SU6SU7 ECL: Notification of Unusual Event Initiating Condition: Loss of all-ALL onsite or offsite communications capabilities.
Operating Mode Applicability: Power Operation, 8tartup, Hot 8tandby, Hot 8hutdown.L._U Example Emergency Action Levels: (1 or 2 or 3)
S 7.1 fillL2 S 7.3 Basis:
Loss of ALL of the following onsite communication methods:
_* _(site specific list of communications methods) Plant Operations Radio System In-Plant Phone System Plant Paging System (Gaitronics)
Loss of ALL of the following GROoffsite response organization communications methods:
_* _(site specific list of communications methods) DAEC All-Call phone All telephone lines (PBX and commercial)
Cell Phones (including fixed cell phone system)
Control Room fixed satellite phone system FTS Phone system Loss of ALL of the following NRC communications methods:
_* _(site specific list of communications methods) FTS Phone system All telephone lines (PBX and commercial)
Cell Phones (including fixed cell phone system)
Control Room fixed satellite phone system This IC addresses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to GROoffsite response organizations and the NRC.
This IC should be assessed only when extraordinary means are being utilized to make communications possible ( e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).
229
Nel W O I (KeYIS10A e)
NeYemaer 2012 EAL SU7.1 addresses a total loss of the communications methods used in support of routine plant operations.
EAL SU7.2 addresses a total loss of the communications methods used to notify all GRGoffsite response organizations of an emergency declaration. The GRGoffsite response organizations referred to here are-the State of Iowa, Linn County. and Benton County (see Developer Notes).
---EAL SU7.3 addresses a total loss of the communications methods used to notify the NRC of an emergency declaration.
DeYelapeF Nates:
EAL #1 The "site specific list of communications methods" should include all communications methods used for routine plant communications (e.g., commercial or site telephones, page party systems, radios, etc.). This listing should include installed plant equipment and components, and not items owned and maintained by individuals.
EA.L #2 The "site specific list of communications methods" should include all communications methods used to perform initial emergency notifications to OROs as described in the site Emergency Plan. The listing should include installed plant equipment and components, and not items ovmed and maintained by individuals. Example methods are ring dovm/dedicated telephone lines, commercial telephone lines, radios, satellite telephones and internet based communications technology.
In the Basis section, insert the site specific listing of the OROs requiring notification of an emergency declaration from the Control Room in accordance 1vvith the site Emergency Plan, and typically within 15 minutes.
EAL #3 The "site specific list of communications methods" should include all communications methods used to perform initial emergency notifications to the NRG as described in the site Emergency Plan. The listing should include installed plant equipment and components, and not items ovmed and maintained by individuals. These methods are typically the dedicated Emergency Notification System (ENS) telephone line and commercial telephone lines.
EGL Assignment Attributes: 3.1.1. C 231
SU7 ECL:
Initiating Condition:
AND
DevelefJeF Notes:
Nb! 99 U ! (KeYISIOA e)
J>l o¥ember 2012 Enter the "site specific pressure" value that actuates containment pressure control systems (e.g.,
containment spray). A.lso enter the site specific containment pressure control system/equipment that should be operating per design if the containment pressure actuation setpoint is reached. If desired, specific condition indications such as parameter values can also be entered (e.g., a containment spray flov,r rate less than a certain value).
EAL #2 is not applicable to the U.S. Evolutionary Power Reactor (EPR) design.
EGL Assignment.Attributes: 3.1.1.A 234
ECL: Alert N hi YY U I (Kev1s1on 6)
~Jovember 2012 SA1 Initiating Condition: Loss of al!-ALL but one AC power source to emergency essential buses for 15 minutes or longer.
Operating Mode Applicability: Pov,er Operation, Startup, Hot Standby, Hot Shutdown.L..LJ Example Emergency Action Levels:
Note: The Emergency Director should declare the Alert promptly upon determining that 15_
minutes has been exceeded, or will likely be exceeded.
~
1
- a.
AC power capability to (site specific emergency buses)1A3 and 1A4 buses is reduced to a single power source for 15 minutes or longer.
AND
- b.
Any MlYANY additional single power source failure will result in a loss of all ALL AC power to SAFETY SYSTEMS.
Definitions:
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety--
related.
Basis:
This IC describes a significant degradation of offsite and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering one, or more than one, train of safety:-
related equipment. This IC provides an escalation path from IC SUI.
An "AC power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to an emergency bus. Some examples of this condition are presented below.
A loss of all offsite power with a concurrent failure of all but one emergency power source
( e.g., an onsite diesel generator).
,e.~ loss of all offsite power and loss of all emergency power sources (e.g., onsite diesel generators) 1.vith a single train of emergency buses being back fed from the unit main generator.
A loss of emergency power sources ( e.g., onsite diesel generators) with a single train of essentialemergency buses being -baek:-fed from an offsite power source.
Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power.
Escalation of the emergency classification level would be via IC SS 1.
236
Develeper Netes:
!>Hil YY (::l l (K0YISIOH a)
~lo\\'ember 2012 For a po,.ver source that has multiple generators, the EAL and/or Basis section should reflect the minimum number of operating generators necessary for that source to provide required power to an AC emergency bus. For e>mmple, if a backup power source is comprised of two generators (i.e., two 50% capacity generators sized to feed 1 A.C emergency bus), the EAL and Basis section must specify that both generators for that source are operating.
The "site specific emergency buses" are the buses fed by offsite or emergency A.C power sources that supply power to the electrical distribution system that pov,<ers SAFETY SYSTEMS. There is typically 1 emergency bus per train of SAFETY SYSTEMS.
Developers should modify the bulleted e>mmples provided in the basis section, above, as needed to reflect their site specific plant designs and capabilities.
The EALs and Basis should reflect that each independent offsite power circuit constitutes a single povrer source. For example, three independent 345kV offsite power circuits (i.e.,
incoming power lines) comprise three separate power sources. Independence may be determined from a review of the site specific UFSA.R, SBO analysis or related loss of electrical po1tver studies.
The EAL and/or Basis section may specify use of a non safety related power source provided that operation of this source is recognized in AOPs and EOPs, or beyond design basis accident response guidelines (e.g., FLEX support guidelines). Such power sources should generally meet the "Alternate ac source" definition provided in 10 CFR 50.2.
At multi unit stations, the EALs may credit compensatory measures that are proceduralized and can be implemented within 15 minutes. Consider capabilities such as power source cross ties, "swing" generators, other po1,ver sources described in abnormal or emergency operating procedures, etc. Plants that have a proceduralized capability to supply offsite AC power to an affected unit via a cross tie to a companion unit may credit this power source in the EAL provided that the planned cross tie strategy meets the requirements of 10 CFR 50.63.
EGL Assignment Attributes: 3.1.2.B 237
ECL: Alert Nel 99 u l (Kev1s1on o)
November 2012 SA2SA3 Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer with a significant transient in progress.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdownh_U Example Emergency Action Levels:
Note: The Emergency Director should declare the Ale1i promptly upon determining that 15_
minutes has been exceeded, or will likely be exceeded.
S 3.1
- a.
An UNPLANNED event results in the inability to monitor one or more of the following parameters from within the Control Room for 15 minutes or longer.
Reactor Power RPV Water Level RPV Pressure Primary Containment Pressure Suppression Pool Level
-suppression Pool Temperature Suppression Pool Temperature AND
__ b'--. __ ANY of the following transient events in progress.
Definitions:
Automatic or manual runback greater than 25% thermal reactor power Electrical load rejection greater than 25% full electrical load Reactor scram [BWR] / trip [PWRJ
._ECCS fSB-actuation
- ._ Thermal power oscillations greater than 10% [BWR]
238
Nel YY 01 (Ke111s1on o) 1'l O\\'ember 2012 SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety-related.
UNPLANNED: A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.
Basis:
This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant.
239
f'lel W u I (Kev1s1on 6) l>Jo*,emeer 2012 As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.
An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.
This EAL is focused on a selected subset of plant parameters associated with the key safety functions ofreactivity control, core cooling [PWR] I RPV level [BWR] and RCS heat removal.
The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [PWR] I RPV water level [BWR] cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.
Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.
Escalation of the emergency classification level would be via ICs FSI or IC A&l-RSI.
Develeper Netes:
In the PWR parameter list column, the "site specific number" should reflect the minimum number of steam generators necessary for plant cooldown and shutdown. This criterion may also specify whether the level value should be 1.vide range, narrow range or both, depending upon the monitoring requirements in emergency operating procedures.
Developers may specify either pressurizer or reactor vessel level in the PWR parameter column entry for RCS Level.
Developers should consider if the "transient events" list needs to be modified to better reflect site specific plant operating characteristics and expected responses.
The number, type, location and layout of Control Room indications, and the range of possible failure modes, can challenge the ability of an operator to accurately determine, within the time period available for emergency classification assessments, if a specific percentage of indications have been lost. The approach used in this EAL facilitates prompt and accurate emergency classification assessments by focusing on the indications for a selected subset of parameters.
By focusing on the availability of the specified parameter values, instead of the sources of those values, the EAL recognizes and accommodates the wide variety of indications in nuclear power plant Control Rooms. Indication types and sources may be analog or digital, safety related or not, primary or alternate, individual meter value or computer group display, etc.
240
Nel \\.J\\.J O l (Kev1s1on 6)
- November 2012 A loss of plant annunciators will be evaluated for reportability in accordance with 10 CFR 50.72 (and the associated guidance in NUREG 1022), and reported if it significantly impairs the capability to perform emergency assessments. Compensatory measures for a loss of annunciation can be readily implemented and may include increased monitoring of main control boards and more frequent plant rounds by non licensed operators. Their alerting function notwithstanding, annunciators do not provide the parameter values or specific component status information used to operate the plant, or process through l..OPs or EOPs. Based on these considerations, a loss of ar..nunciation is considered to be adequately addressed by reportability criteria, and therefore not included in this IC and EA.L.
With respect to establishing event severity, the response to a loss of radiation monitoring data (e.g., process or effluent monitor values) is considered to be adequately bounded by the requirements of 10 CFR 50.72 (and associated guidance in l'JUREG 1022). The reporting of this event will ensure adequate plant staff and NRG U\\vareness, and drive the establishment of appropriate compensatory measures and corrective actions. In addition, a loss of radiation monitoring data, by itself, is not a precursor to a more significant event.
Personnel at sites that have a Failure Modes and Effects Analysis (FMEA) included within the design basis of a digital I&C system should consider the FMEA information vlhen developing their site specific EA.Ls.
Due to changes in the configurations of SAFETY SYSTEMS, including associated instrumentation and indications, during the cold shutdown, refueling, and defueled modes, no analogous IC is included for these modes of operation.
EGL A.ssignment l..ttributes: 3.1.2.B 241
ECL: Alert Nel 99 u I (Ke1,r1s1on 6)
NoYember 2012 SA5SA6 Initiating Condition: Automatic or manual (trip [P',\\ZR] / scram [BWR]) fails to shutdown the reactor, and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor.
Operating Mode Applicability: Power Operation.L.2 Note: A manual action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.
l EHm~le EmergeeeyEmergenci,: Action Levels:
1
- a.
An automatic or manual (trip [PWR] / scram [BWR]) did not shutdown the reactor.
- b.
Definitions:
Basis:
AND ALL of the following manual actions taken at 1C05 are not successful in lowering reactor power below 5% power Manual Scram Pushbuttons Mode Switch to Shutdown Alternate Rod Insertion (ARI)Manual actions taken at the reactor control consoles (1 C05) are not successful in shutting down the reactor.
This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ftfip
[PWR] I scram [BWR]) that results in a reactor shutdown, and subsequent operator manual actions taken at the reactor control consoles to shutdown the reactor are also unsuccessful. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emergency declaration is required even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RPS.
A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core ( e.g., initiating a manual reactor ftfip
[PWR] I scram [BWR])). This action does not include manually driving in control rods or implementation of boron injection strategies. If this action(s) is unsuccessful, operators would immediately pursue additional manual actions at locations away from the reactor control consoles (e.g., locally opening breakers). _Actions taken at back-panels or other locations within 243
Nel W Ul (Kev1s1on 6)
- t-Jo11ember 2012 the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles.,_-:-
244
Nbl 99 Ul (K.eYISIOfl e)
NoYemeer 2012 Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.
[BWR]
245
NeL YY u L (Kev1s1on o) l>foyember 2012 The plant response to the failure of an automatic or manual reactor (trip [PWR] I scram [BWR])
will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If the failure to shutdown the reactor is prolonged enough to cause a challenge to the core cooling [P\\VR] / RPV water level [BWR] or RCS heat removal safety functions, the emergency classification level will escalate to a Site Area Emergency via IC SS~§_.
Depending upon plant responses and symptoms, escalation is also possible via IC FS 1. Absent the plant conditions needed to meet either IC SS~§_ or FS 1, an Alert declaration is appropriate for this event.
It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however, this IC and EAL are included to ensure a timely emergency declaration.
The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.
Develaper Nates:
This IC is applicable in any Mode in which the actual reactor power level could e>weed the pmver level at which the reactor is considered shutdovm. /'.. PWR,.vith a shutdown reactor pmver level that is less than or equal to the reactor power level which defines the lower bound of Power Operation (Mode 1) vlill need to include Startup (Mode 2) in the Operating Mode Applicability. For e>rnmple, if the reactor is considered to be shutdown at 3% and Power Operation starts at >5%, then the IC is also applicable in Startup Mode.
Developers may include site specific EOP criteria indicative of a successful reactor shutdown in an EAL statement, the Basis or both (e.g., a reactor pov,er level).
The term "reactor control consoles" may be replaced with the appropriate site specific term (e.g., main control boards).
EGL Assignment Attributes: 3.1.2.B 246
Nhl 99 U l (Kev1s1on o)
- November 2012 SA9SA8 ECL: Alert Initiating Condition: Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdovml, 2, 3 Example Emergency Action Levels:
Notes:
- If the affected SAFETY SYSTEM train was already inoperable or out of service before the hazardous event occmTed, then this emergency classification is not warranted.
If the hazardous event only resulted in VISIBLE DAMAGE, with no indications of degraded performance to at least one train of the SAFETY SYSTEM, then this emergency classification is not warranted.
---For a single train SAFETY SYSTEM, degraded performance which results in loss of the safety function of the SAFETY SYSTEM
~
1
- a.
- b.
The occurrence of ANY of the following hazardous events:
Seismic event (earthquake)
Internal or external flooding event High winds or tornado strike FIRE EXPLOSION
~(site speeifie haz:a-rds)River level above 757 feet River Water Supply (RWS) pit low level alarm Other events with similar hazard characteristics as determined by the Shift Manager or Emergency Director AND
- 1.
- 2.
Event damage has caused indications of degraded performance in one train of a SAFETY SYSTEM needed for the current operating mode.
AND EITHER of the following:
Event damage has caused indications of degraded performance to a second train of the SAFETY SYSTEM needed for the cmTent operating mode, The event has resulted in VISIBLE DAMAGE to the second train of a SAFETY SYSTEM needed for the current operating mode, 248
,"l el 99 u l (Ke*,1s10A e) l>leYember 2012 Loss of the safety function of a single train SAFETY SYSTEM.
Event damage has caused indications of degraded performance to a second train of the SAFETY SYSTEM needed for the current operating mode, or The event has resulted in VISIBLE DA.MAGE to the second train of the SAFETY SYSTEM needed for the current operating mode.
Loss of the safety function ofa single train SAFETY SYSTEM.
249
Definitions:
N bl L)L) U I (Kev1s1on 6)
}lo't'emeer 2012 EXPLOSION: A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events may require a post-event inspection to determine if the attributes of an explosion are present.
FIRE: Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety--
related.
VISIBLE DAMAGE: Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not VISIBLE DAMAGE.
EITHER of the following:
- 1.
Event damage has caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode.
- 2.
The event has caused VISIBLE DAl\\4AGE to a SAFETY SYSTEM component or structure needed for the current operating mode.
Basis:
This IC addresses a hazardous event that causes damage to SAFETY SYSTEMS needed for the current operating mode. In order to provide the appropriate context for consideration of an ALERT classification, the hazardous event must have caused indications of degraded SAFETY SYSTEM performance in one train, and there must be either indications of performance issues with the second SAFETY SYSTEM train or VISIBLE DAMAGE to the second train such that the potential exists for this second SAFETY SYSTEM train to have performance issues. In other words, in order for this EAL to be classified, the hazardous event must occur, at least one SAFETY SYSTEM train must have indications of degraded performance, and the second SAFETY SYSTEM train must have indications of degraded performance or VISIBLE DAMAGE such that the potential exists for performance issues. Note that this second SAFETY SYSTEM train is from the same SAFETY SYSTEM that has indications of degraded performance for criteria SA98. l.b.1 of this EAL; commercial nuclear power plants are designed to be able to support single system issues without compromising public health and safety from radiological events.
Indications of degraded pe1fom1ance addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The indications of degraded 250
N bl 99 U l (Ke\\'1510A e)
Novemeer 2012 performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.
251
f>H~l YY U 1 (Kev1s1on 6)
~l 0 1,emeer 2012 VISIBLE DAMAGE addresses damage to a SAFETY SYSTEM train that is not in service/operation and that potentially could cause performance issues. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.
This VISIBLE DAMAGE should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.
252
N el !.J!.J u I (Ke111s1on a)
~loYeR'lber 2012 This IC addresses a hazardous event that causes damage to a SA.FETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. This condition significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore represents an actual or potential substantial degradation of the level of safety of the f*iW; EAL 1.b. l addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The indications of degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.
EAL l.b.2 addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent thrnugh indications alone, or to a structure containing SAFETY SYSTEM components. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.
Escalation of the emergency classification level would be via IC FS 1 or AS+RS 1.
De,,ele~eF Notes:
For (site specific hazards), developers should consider including other significant, site specific hazards to the bulleted list contained in EAL l.a (e.g., a seiche).
Nuclear power plant SAFETY SYSTEMS are comprised of two or more separate and redundant trains of equipment in accordance with site specific design criteria.
EGL Assignment Attributes: 3.1.2.B 253
Ne! l)l) u I (KevISIOA a)
- November 2012 ECL: Site Area Emergency Initiating Condition: Loss of ALLall offsite and all-ALL onsite AC power to emergency essential -buses for 15 minutes or longer.
SS1 Operating Mode Applicability: Power Operation, 8tartup, Hot 8tandby, Hot 8hutdown.L..LJ Example Emergency Action Levels:
Note: The Emergency Director should declare the Site Area Emergency promptly upon determining that 15 minutes has been exceeded, or will likely be exceeded.
S 1.1 Loss of ALL offsite and ALL onsite AC power to (site specific emergency buses)1A3 and 1A4 for 15 minutes or longer.
Definitions:
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety--
related.
Basis:
This IC addresses a total loss of AC power that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink.
In addition, fission product barrier monitoring capabilities may be degraded under these conditions.
This IC represents a condition that involves actual or likely major failures of plant functions needed for the protection of the public.
Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.
Escalation of the emergency classification level would be via I Cs AG+RG 1, FG 1 or SG 1.
DeYeloper Notes:
For a power source that has multiple generators, the EAL and/or Basis section should reflect the minimum number of operating generators necessary for that source to provide adequate pov,rer to an A.. C emergency bus. For e>mmple, if a backup pov,rer source is comprised of two generators (i.e., tv,ro 50% capacity generators sized to feed 1 AC emergency bus), the EAL and Basis section must specify that both generators for that source are operating.
The "site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers 8AFETY 8Y8TEM8. There is typically 1 emergency bus per train of 8AFETY 8Y8TEM8.
254
t>U~I yy u I (KeYISIOA e)
}Jo11ember 2012 The EAL and/or Basis section may specify use of a non safety related power source provid~d that operation of this source is controlled in accordance 1~,1ith_ abnormal or eme~gency op~rat~ng procedures or beyond design basis accident response gmdelmes (e.g., FLEX suppo~ gm~elmes).
Such powe~* sources should generally meet the "Alternate ac source" definition provided m 10 CFR 50.2.
At multi unit stations, the EA.Ls may credit compensatory measures that are proceduralize~ and can be implemented within 15 minutes. Consider capabilities such as pmver source ~ross ties, "sv,ing" generators, other power sources described in abnormal or emerge~cy operatmg procedures, etc. Plants that have a proceduralized capabi~ity ~o supply offs1te _AC power to an affected unit via a cross tie to a companion unit may credit this pmver source m the EAL provided that the planned cross tie strategy meets the requirements of 10 CFR 50.63.
EGL Assignment Attributes: 3.1.3.B 255
ECL: Site Area Emergency Nel 99 U l (Kev1s1on 6) l>Jovember 2012 SS8SS2 Initiating Condition: Loss of ALL Vital DC power for 15 minutes or longer.
Operating Mode Applicability: 1, 2, 3 Emergency Action Levels:
Note: The Emergency Director should declare the Site Area Emergency promptly upon determining that 15 minutes has been exceeded, or will likely be exceeded.
=S-'!'-=-2'-=.1 __.Indicated voltage is less than (site specific bus voltage value) 105 VDC on ALL(site specific Vital DC busses) BOTH Div 1 and Div 2 125 VDC buses for 15 minutes or longer.
Definitions:
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety--
related.
Basis:
This IC addresses a loss of Vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public.
Minimum DC bus voltage selected due to automatic trip of the inverters at 105 VDC decreasing.
Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.
Escalation of the emergency classification level would be via I Cs AG-1-RG 1, FG 1 or SG2.
256
Nb! 1)1) U I (K0YISIOR a) 1>lovember 2012 SS5SS6 ECL: Site Area Emergency Initiating Condition: Inability to shutdown the reactor causing a challenge to (core cooling
[PWR] I RPV water level [BWR]) or RCS heat removal.
Operating Mode Applicability: Pov;er OperationLl Example Emergency Action Levels:
S 6.1
- a.
An automatic or manual (trip [PWR] / scram [B\\VR]) did not shutdown the reactor.
AND
- b.
ALL of the following manual actions taken at 1C05 are not successful in lowering reactor power below 5% power:
Manual Scram Pushbuttons Mode Switch to Shutdown Alternate Rod Insertion (ARI)All manual actions to shutdown the reactor have been unsuccessful.
AND
- c.
EITHER of the following conditions exist:
_* _(Site specific indication of an inability to adequately remove heat from the core) Reactor vessel waterRPV level cannot be restored and maintained above
-25 inches.
OR (Site specific indication of an inability to adequately remove heat from the
~HCL (Graph 4 ofEOP 2) exceeded.
Definitions:
Basis:
This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ftrip
[PWR] I scram [BWR]) that results in a reactor shutdown, all subsequent operator actions to manually shutdown the reactor are unsuccessful, and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.
257
?>lei YY 01 lKe111s1on o)
}J 01,erneer 2012 In some instances, the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition Category F ICs/EALs. This is appropriate in that the Recognition Category F ICs/EALs do not address the additional threat posed by a failure to shutdown the reactor. The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shutdown the reactor.
The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).
A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.
Escalation of the emergency classification level would be via IC AG-1-RG 1 or FG 1.
DevelepeF Netes:
This IC is applicable in any Mode in which the actual reactor power level could e>weed the pov,rer level at which the reactor is considered shutdov,CJ1. A. P'."VR with a shutdown reactor power level that is less than or equal to the reactor power level which defines the lov,rer bound of P01.ver Operation (Mode 1) will need to include Stmiup (Mode 2) in the Operating Mode l\\pplicability. For example, if the reactor is considered to be shutdov,n at 3% and Pov,rer Operation stmis at >5%, then the IC is also applicable in Startup Mode.
Developers may include site specific EOP criteria indicative of a successful reactor shutdovm in an EAL statement, the Basis or both (e.g., a reactor pmver level).
Site specific indication of an inability to adequately remove heat from the core:
[BWR]
Reactor vessel water level ear.not be restored and maintained above Minimum Steam Cooling RPV Water Level (as described in the EOP bases).
[PWR]
Insert site specific values for an incore/core e>cit thermocouple temperature and/or reactor vessel water level that drives entry into a core cooling restoration procedure (or otherwise requires implementation of prompt restoration actions). i\\ltemately, a site may use incore/core e>cit thermocouple temperatures greater than 1,200°F and/or a reactor vessel water level that corresponds to approximately the middle of active fuel. Plants with reactor vessel level instrumentation that car.not measure dovm to apprmcimately the middle of active fuel should use the lov,rest on scale reading that is not above the top of active fuel. If the lowest on scale reading is above the top of active fuel, then a reactor vessel level value should not be included.
For plants that have implemented Westinghouse Owners Group Emergency Response Guidelines, enter the parameters used in the Core Cooling Red Path.
Site specific indication of an inability to adequately remove heat from the RCS:
[BWR]
Use the Heat Capacity Temperature Limit. This addresses the inability to remove heat via the main condenser and the suppression pool due to high pool water temperature.
[PWR]
Insert site specific parameters associated with inadequate RCS heat removal via the steam generators. These parameters should be identical to those used for the Inadequate Heat Removal threshold Fuel Clad Barrier Potential Loss 2.B and threshold RCS Barrier Potential Loss 2.A in the P'.VR EAL Fission Product Barrier Table.
258
EGL A.ssignment Attributes: 3.1. 3.B 259 F>Jel yy u l (Kev1s10R 6)
~leYemeer 2012
SS&
ECL: Site Area Emergency Initiating Condition: Loss of all Vital DC power for 15 minutes or longer.
Nel yy U I (KeYISIOR 0)
J>JOY6FR06F 20)3 Operating *Mede Applieability: Povf'er Operation, Startup, Hot Standby, Hot 8hutdovml, 2, 3, 4 Example Emergeney Aetien Levels:
Note: The Emergency Director should declare the Site A.rea Emergency promptly upon determining that 15 minutes has been e)cceeded, or will likely be exceeded.
1 Indicated voltage is less than (site specific bus voltage value) 115 VDC on ALL (site specific Vital DC busses)1(2) D 01, D 02, D 03, and D 04 for 15 minutes or longer.
Basis:
SAFETY SYSTEM: /\\. system required for safe plant operation, cooling dovm the plant and/or placing it in the cold shutdown condition, including the EGGS. Systems classified as safety related.
This IC addresses a loss of Vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold 8hutdovm, this condition involves a major failure of plant functions needed for the protection of the public.
Fifteen minutes v,ras selected as a threshold to e)cclude transient or momentary power losses.
Escalation of the emergency classification level would be via ICs AGlRQl, FGl or 808.
Developer Notes:
The "site specific bus voltage value" should be based on the minimum bus voltage necessary for adequate operation of SAFETY SYSTEM equipment. This voltage value should incorporate a margin of at least 15 minutes of operation before the onset of inability to operate those loads.
This voltage is usually near the minimum voltage selected when battery sizing is performed.
The typical value for an entire battery set is apprmcimately 105 VDC. For a 60 cell string of batteries, the cell voltage is approximately 1.75 Volts per cell. For a 58 string battery set, the minimum voltage is apprmcimately 1.81 Volts per cell.
The "site specific Vital DC busses" are the DC busses that provide monitoring and control capabilities for SAFETY SYSTEMS.
EGL Assignment Attributes: 3.1.3.B 260
Nbl IJIJ U I (KeYISIOR 6)
- Jlfoyerneer 2012 SG1 ECL: General Emergency Initiating Condition: Prolonged loss of all-ALL offsite and ALLall onsite AC power to emergency essential buses.
Operating Mode Applicability: Pov,er Operation, 8tartup, Hot 8tandby, Hot 8hutdown.L._U Example Emergency Action Levels:
Note: The Emergency Director should declare the General Emergency promptly upon determining that (site specific hours)4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> has been exceeded, or will likely be exceeded.
- a.
Loss of ALL offsite and ALL onsite AC power to 1A3 and 1A4 busesfsite-specific emergency buses).
AND
- b.
EITHER of the following:
Definitions:
.!.__Restoration of at least one AC emergency essential bus in less than fsite-specific hours)4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is not likely.
OR (8ite specific indication of an inability to adequately remove heat from the eerejRPV level cannot be restored and maintained above -25 inches.
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety--
related.
Basis:
This IC addresses a prolonged loss of all power sources to AC emergency essential buses. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A prolonged loss of these buses will lead to a loss of one or more fission product barriers. In addition, fission product barrier monitoring capabilities may be degraded under these conditions.
The EAL should require declaration of a General Emergency prior to meeting the thresholds for IC FG 1. This will allow additional time for implementation of offsite protective actions.
Escalation of the emergency classification from Site Area Emergency will occur if it is projected that power cannot be restored to at least one AC emergency essential bus by the end of the analyz:ed 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> station blackout coping period. Beyond this time, plant responses and event trajectory are subject to greater uncertainty, and there is an increased likelihood of challenges to multiple fission product barriers.
261
I N el YY u I (Ke111s1on 6)
Noveffiber 2012 The estimate for restoring at least one essentialemergency bus should be based on a realistic appraisal of the situation. Mitigation actions with a low probability of success should not be used as a basis for delaying a classification upgrade. The goal is to maximize the time available to prepare for, and implement, protective actions for the public.
262
Nbl IJY U I lK0YISIOA 6) 1>lovember 2012 The EAL will also require a General Emergency declaration if the loss of AC power results in parameters that indicate an inability to adequately remove decay heat from the core.
De:Yeloper Notes:
Although this IC and EAL may be viewed as redundant to the Fission Product Barrier ICs, it is included to provide for a more timely escalation of the emergency classification level.
The "site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers SA.FETY SYSTEMS. There is typically 1 emergency bus per train of SAFETY SYSTEMS.
The "site specific hours" to restore AC power to an emergency bus should be based on the station blackout coping analysis performed in accordance with 10 CFR § 50.63 and Regulatory Guide 1.15 5, SUltion Biflckout.
Site specific indication of an inability to adequately remove heat from the core:
[BWR]
Reactor vessel water level cannot be restored and maintained above Minimum Steam Cooling RPV Water Level (as described in the EOP bases).
[PWR]
Insert site specific values for an incore/core mcit thermocouple temperature and/or reactor vessel 1.vater level that drive entry into a core cooling restoration procedure (or otherwise requires implementation of prompt restoration actions). Alternately, a site may use incore/core e1(it thermocouple temperatures greater than 1,200°F and/or a reactor vessel water level that corresponds to approximately the middle of active fuel. Plants with reactor vessel level instrumentation that cannot measure dovvn to apprm(imately the middle of active fuel should use the lowest on scale reading that is not above the top of active fuel. If the lov,est on scale reading is above the top of active fuel, then a reactor vessel level value should not be included.
For plants that have implemented Westinghouse Ov,rners Group Emergency Response Guidelines, enter the parameters used in the Core Cooling Red Path.
EGL Assignment Attributes: 3.1.4.B 263
t>J bl YY u I (Kev1s1on a) 1'lo*;ember 2012 SG8SG2 ECL: General Emergency Initiating Condition: Loss of all-ALL AC and Vital DC power sources for 15 minutes or longer.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdovm.L..LJ Example Emergency Action Levels:
Note: The Emergency Director should declare the General Emergency promptly upon determining that 15 minutes has been exceeded, or will likely be exceeded.
- a.
Loss of ALL offsite and ALL onsite AC power to (site specific emergency
+btt1uts-se~sTi) 1A3 and 1A4 for 15_-minutes or longer.
AND
- b.
Indicated voltage is less than (site specific bus voltage value) 105 VDC on Abb (site speeifie Vital DC busses) BOTH Div 1 and Div 2 125 VDC buses for 15 minutes or longer.
Definitions:
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety--
related.
Basis:
This IC addresses a concurrent and prolonged loss of both AC and Vital DC power. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A loss of Vital DC power compromises the ability to monitor and control SAFETY SYSTEMS. A sustained loss of both AC and DC power will lead to multiple challenges to fission product barriers.
Minimum DC bus voltage selected due to automatic trip of the inverters at 105 VDC decreasing.
Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. The 15-minute emergency declaration clock begins at the point when both EAL thresholds are met.
DevelepeF Netes:
The "site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typically 1 emergency bus per train of SAFETY SYSTEMS.
The "site specific bus voltage value" should be based on the minimum bus voltage necessary for adequate operation of SA.FETY SYSTEM equipment. This voltage value should incorporate a margin of at least 15 minutes of operation before the onset of inability to operate 264
Net YY u I (Kev1s1on e)
- t>lo 1remaer 2012 those loads. This *roltage is usually near the minimum voltage selected when battery sizing is performed.
The typical value for an entire battery set is apprmcimately 105 VDC. For a 60 cell string of batteries, the cell voltage is approximately 1.75 Volts per cell. For a 58 string battery set, the minimum voltage is apprmcimately 1.81 Volts per cell.
The "site specific Vital DC busses" are the DC busses that provide monitoring and control capabilities for Si\\,FETY SYSTEMS.
This IC and EAL were added to Revision 6 to address operating experience from the March, 2011 accident at Fukushima Daiichi.
EGL A.ssignment Attributes: 3.1.4.B 265
NE! 99 01 (RevisioR 6)
- November 20 12 APPENDIX A - ACRONYMS AND ABBREVIATIONS AC...................................................................................................................... Alternating Current AOP................................................................................................. Abnormal Operating Procedure A
.......................................................................................................................................... I'i PR.14.................................................................................................... Average Power Range :Meter A TWS................................................................................... Anticipated Transient Without Scram
.......................................................................................................................................... B
&V..'................................................................................................................... Babcock and V..'ilco>E
.......................................................................................................................................... B IIT....................................................................................... Boron Inj ection Initiation Temperature BWR............................................................................................................. Boiling Water Reactor CDE...................................................................................................... Committed Dose Equivalent CFR...................................................................................................... Code of Federal Regulations CT~4T/CNMT............................................................................................................... Containment
.......................................................................................................................................... C SF................................................................................................................ Critical Safety Function
.......................................................................................................................................... C SFST........................................................................................ Critical Safety Function Status Tree
.......................................................................................................................................... D Bf................................................................................................................... Design Basis Accident DC.............................................................................................................................. Direct Current EAL........................................................................................................... Emergency Action Level ECCS............................................................................................ Emergency Core Cooling System ECL................................................................................................ Emergency Classification Level EOF.................................................................................................. Emergency Operations Facility EOP............................................................................................... Emergency Operating Procedure EPA............................................................................................. Environmental Protection Agency EPG............................................................................................... Emergency Procedure Guideline
.......................................................................................................................................... E PIP................................................................................... Emergency Plan Implementing Procedure
.......................................................................................................................................... E PR......................................................................................................... Evolutionary Povrer Reactor
.......................................................................................................................................... E PRI............................................................................................... Electric Pov1er Research Institute
.......................................................................................................................................... E RG.................................................................................................. Emergency Response Guideline
.......................................................................................................................................... F EMA................................................................................ Federal Emergency Management Agency FSA..... ~................................................................................................... Final Safety Analysis Report GE...................................................................................................................... General Emergency HC+L.......................................................................................... Heat Capacity Temperature Limit HPCI.............................................................................................. High Pressure Coolant Injection
.......................................................................................................................................... H SI................................................................................................................ Human System Interface IC........................................................................................................................ Initiating Condition
NEI 99 0 I (ReYision 6) 1'l oYember 2012
.......................................................................................................................................... I D............................................................................................................................... Inside Diameter IPEEE............................. Individual Plant Examination of External Events (Generic Letter gg 20)
ISFSI........................................................................... Independent Spent Fuel Storage Installation Keff.................................................................................... Effective Neutron Multiplication Factor LCO............................................................................................... Limiting Condition of Operation
.......................................................................................................................................... L OCA.......................................................................................................... Loss of Coolant Accident
.......................................................................................................................................... M CR..................................................................................................................... ~4ain Control Room
.......................................................................................................................................... M SIV........................................................................................................ ~4ain Steam Isolation Valve
~4SL....................................................................................................................... ~4ain Steam Line mR, mRem, mrem, mREM............................................................ milli-Roentgen Equivalent Man MW.................................................................................................................................... Megawatt NEI............................................................................................................. Nuclear Energy Institute
.......................................................................................................................................... 1'l" PP..................................................................................................................... 1'l"uclear Po1,ver Plant
.......................................................................................................................................... N RC................................................................................................. Nuclear Regulatory Commission N888................................................................................................. Nuclear Steam Supply System NORAD................................................................. North American Aerospace Defense Command fNOjUE.......................................................................................... fNotification O+/-j Unusual Event NUMARC 1............................................................... Nuclear Management and Resources Council OBE....................................................................................................... Operating Basis Earthquake OCA............................................................................................................. Owner Controlled Area
.......................................................................................................................................... 0 DCM/ODAM......................................................... Off site Dose Calculation (Assessment) Manual ORO................................................................................................ Off site Response Organization PA.............................................................................................................................. Protected Area
.......................................................................................................................................... P ACS...................................................................................... Priority Actuation and Control System PAG....................................................................................................... Protective Action Guideline
.......................................................................................................................................... P ICS................................................................................... Process Information and Control System PRA/PSA.................................... Probabilistic Risk Assessment I Probabilistic Safety Assessment PWR........................................................................................................ Pressurized Water Reactor
.......................................................................................................................................... P S........................................................................................................................... Protection System PSIG................................................................................................. Pounds per Square Inch Gauge R......................................................................................................................................... Roentgen
.......................................................................................................................................... R CC.............................................................................................................. Reactor Control Console RCIC............................................................................................... Reactor Core Isolation Cooling 1 NUMARC was a predecessor organization of the Nuclear Energy Institute (NEI).
NBI 99 01 (Re11ision 6)
~Joyemeer 2012 RCS............................................................................................................. Reactor Coolant System Rem, rem, REM...................................................................................... Roentgen Equivalent Man
.......................................................................................................................................... R ETS......................................................................... Radiological Effluent Technical Specifications RPS......................................................................................................... Reactor Protection System RPV............................................................................................................. Reactor Pressure Vessel
.......................................................................................................................................... R VLIS......................................................................... Reactor Vessel Level Instrumentation System RWCU.......................................................................................................... Reactor Water Cleanup
.................................................................................................................................. "...... s i\\R................................................................................................................ Safety l..nalysis Report
.......................................................................................................................................... s i\\.S.......................................................................................................... Safety Automation System
- *********************************************************************** s BO........................................................................................................................... Station Blackout SCBA..................................................................................... Self-Contained Breathing Apparatus
.......................................................................................................................................... s G.............................................................................................................................. Steam Generator