ML18212A231
| ML18212A231 | |
| Person / Time | |
|---|---|
| Site: | Duane Arnold  |
| Issue date: | 07/26/2018 |
| From: | NextEra Energy Duane Arnold |
| To: | Office of New Reactors |
| References | |
| NG-18-0090 | |
| Download: ML18212A231 (125) | |
Text
NEI 99 QI (RevisioA 6)
}>Joye me er 2Q 12 10 HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY ICS/EALS 179
}>ffil 99 QI (RevisioR e)
November 2012 Tal>le H 1: Reeognition CategoFY "H" Initiating Condition MatFix UNUSUAL EVENT HUl Confirmed SECURITY CONDITION or
~
Op. A1edes: All HU2 Seismic e1,rent greater than OBE
~
Op. A1edes: All HUJ Hazardous e¥eflt Op. A1edes: All HU4 FIRE potentially degrading the level of safety of the plant.
Op. },1edes: All ALERT HAl HOSTILE ACTION within the OWNER CO~ffROLLED AREA or airborne attack threat *within 30 minutes.
Op. },fades: All HA5 Gaseous release impeding access to equipment necessary for normal plant operations, cooldown or shutdo1Nn.
Op.,\\1edes: All Hf...(i Control Room evacuation resulting in transfer of plant control to alternate locations.
Op.,\\1edes: All SITE AREA EMERGENCY HSl HOSTILE ACTION within the PROTECTED AREA.
Op. A1edes: All HS(i Inability to control a key safety function from outside the Control Room.
Op. },1edes: All 180 I
GENERAL EMERGENCY HGl HOSTILE ACTION resulting in loss of physical control of the facility.
Op.,\\1edes: All Table intended for use by 1 EAL deYelopers.
- lnelusion in lieensee
- doeurnents is not required.
L------------------J
UNUSUAL EVENT HU7 Other conditions exist which in the judgment of the Emergency Director 1tvarrant deelaration of a (NO)UE.
Op. J,1odes: All ALERT HA7 Other conditions e>,ist which in the judgment of the Emergency Director warrant deelaration ofan Alert.
Op. A/odes: All ECL: Notification of Unusual Event SITE AREA EMERGENCY HS7 Other conditions e>,ist which in the judgment of the Emergency Director warrant deelaration of a Site Area Emergency.
Op. A1odes: All Initiating Condition: Confirmed SECURITY CONDITION or threat.
Operating Mode Applicability: All Emergency Action Levels:
NE! 99 01 (RevisioR 6)
November 2012 GENERAL EMERGENCY HG7 Other conditions e>,ist which in the judgment of the Emergency Director warrant declaration of a General Emergency.
Op.,\\1odes: All HU1 Example Emergency Action Levels:
(1 or 2 or 3)
A SECURJTY CONDITION that does not involve a HOSTILE ACTION as reported by the (site specific security shift supervision).DAEC Security Shift Supervision.
Notification of a credible security threat directed at the siteDAEC.
A validated notification from the NRC providing information of an aircraft threat.
Definitions:
SECURITY CONDITION: Any Security Event as listed in the approved security contingency plan that constitutes a threat/compromise to site security, threat/risk to site personnel, or a potential degradation to the level of safety of the plant. A SECURITY CONDITION does not involve a HOSTILE ACTION.
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end.
This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-
-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
181
}ffil 99 0 I (Re,*isioA 6)
}fo1remeer 2012 SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including theincluding the ECCS. These systems are classified as safety-related.
Basis:
This IC addresses events that pose a threat to plant personnel or SAFETY SYSTEM equipment, and thus represent a potential degradation in the level of plant safety. Security events which do not meet one of these EALs are adequately addressed by the requirements of 10 CFR f-73.71 or 10_-CFR--§ 50.72. Security events assessed as HOSTILE ACTIONS are classifiable under ICs HAI, HSI and HGl.
Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. Classification of these events will initiate appropriate threat-related notifications to plant personnel and GRGoffsite response organizations.
182
NEI 99 QI (RevisieA a)
!>foveme er 2012 Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.
183
NEI 99 Q 1 (ReYisioA i) l'loYeFAeeF 2Q12 EAL HUI. I references (site specific security shift supervision)DAEC Security Shift Supervision because these are the individuals trained to confirm that a security event is occurring or has occurred. Training on security event confirmation and classification is controlled due to the nature of Safeguards and 10 CFR § 2.39Q information.
EAL HUI.2 addresses the receipt of a credible security threat. The credibility of the threat is assessed in accordance with Abnormal Operating Procedure (AOP) 914, Security Events. fsite-specific procedure).
EAL HU 1.3 addresses the threat from the impact of an aircraft on the plant. The NRC Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft. The status and size of the plane may also be provided by NORAD through the NRC.
Validation of the threat is performed in accordance with (site specific procedure) Abnormal Operating Procedure (AOP) 914, Security Events..,.
Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should beis contained in non public documents such as the Security Plan.
Escalation of the emergency classification level would be via IC HA 1.
Developer Notes:
The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force.
The (site specific procedure) is the procedure(s) used by Control Room and/or Security personnel to determine if a security threat is credible, and to validate receipt of aircraft threat information.
Emergency plans and implementing procedures are public documents; therefore, E/\\Ls should not incorporate Security sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan.
With due consideration given to the above developer note, EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures. Such references should not contain a recognizable description of the event. For example, an EAL may be worded as "Security event #2, #5 or #9 is reported by the (site specific security shift supervision)."
EGL Assignment Attributes: 3.1.1.A 184
NEI 99 0 I (Re11isioR 6)
}io¥ember 2012 ECL: Notification of Unusual Event Initiating Condition: Seismic event greater than OBE levels.
Operating Mode Applicability: All Exa1Rple Emergency Action Levels:
H 2. 1 Seismic event greater than Operating Basis Earthquake (OBE) as indicated by+
HU2
--+---- receipt of the Amber Operating Basis Earthquake Light and the wailing seismic alarm on IC35.
Definitions:
DESIGN BASIS EARTHQUAKE (DBE): A DBE is vibratory ground motion for which certain (generally, safety-related) structures. systems, and components must be designed to remain functional.
OPERATING BASIS EARTHQUAKE (OBE): An OBE is vibratory ground motion for which those features of a nuclear power plant necessary for continued operation without undue risk to the health and safety of the public will remain functional.
Basis:
This IC addresses a seismic event that results in accelerations at the plant site greater than those specified for an Operating Basis Earthquake (OBEt. An earthquake greater than an OBE but less than a Safe ShutdownDesign Basis Earthquake (SSeDBE)i should have no significant impact on safety-related systems, structures and components; however, some time may be required for the plant staff to ascertain the actual post-event condition of the plant (e.g., performs walk-downs and post-event inspections). Given the time necessary to perform walk-downs and inspections, and fully understand any impacts, this event represents a potential degradation of the level of safety of the plant.
Event verification with external sources should not be necessary during or following an OBE.
Earthquakes of this magnitude should be readily felt by on-site personnel and recognized as a seismic event (e.g., typical lateral accelerations are in e>wess of 0.08g). The Shift Manager or Emergency Director may seek external verification if deemed appropriate ( e.g., a call to the
+ AR OBE is ¥ibratory grouRd motioR fur whieh those features ofa Ruelear power plaRt Reeessary for eoRtiRued operatioR without uRdue risk to the health aRd safety of the publie will remaiR fuAetioAal.
- ! AR SSE is Yibratory grouRd motioR fur whieh eertaiR (geRerally, safety related) struetures, systems, aAd eompoReRts must be desigRed to remaiR fuAetioRal.
185
NEI 99 0 I (Re\\*ision 6)
NoYember 2012 USGS, check internet news sources, etc.); however, the verification action must not preclude a timely emergency declaration.
OBE events are detected in accordance with AOP 901. The OBE is associated with a peak horizontal acceleration of+/- 0.06g.
Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or.£.A.9SA8.
De"-1el0per Netes:
This "site specific indication that a seismic event met or exceeded QBE limits" should be based on the indications, alarms and displays of site specific seismic monitoring equipment.
Indications described in the EAL should be limited to those that are immediately available to Control Room personnel and which can be readily assessed. Indications available outside the Control Room and/or 1.vhich require lengthy times to assess (e.g., processing of scratch plates or recorded data) should not be used. The goal is to specify indications that can be assessed within 15 minutes of the actual or suspected seismic event.
For sites that do not have readily assessable QBE indications within the Control Room, developers should use the following alternate EAL (or similar 1.vording).
(1)
- a.
- b.
Control Room personnel feel an actual or potential seismic event.
The occurrence of a seismic event is confirmed in manner deemed appropriate by the Shift Manager or Emergency Director.
The EAL l.b statement is included to ensure that a declaration does not result from felt vibrations caused by a non seismic source (e.g., a dropped heavy load). The Shift Manager or Emergency Director may seek e><ternal verification if deemed appropriate (e.g., a call to the USGS, check internet nev,rs sources, etc.); howe*,rer, the verification action must not preclude a timely emergency declaration. It is recognized that this alternate EAL *.vording may cause a site to declare an Unusual Event *while another site, similarly affected but with readily assessable QBE indications in the Control Room, may not.
The above alternate *n<ording may also be used to develop a compensatory EAL for use during periods vrhen a seismic monitoring system capable of detecting an QBE is out of service for maintenance or repair.
EGL Assignment Attributes: 3.1.1.A 186
NEI 99 Q 1 (ReYision 6)
No11ember 2Ql2 HU3 ECL: Notification of Unusual Event Initiating Condition: Hazardous event.§ Operating Mode Applicability: All Emergency Action Levels:
Example EmeFgeney Aetion Levels: (1 or 2 or 3 or 4 or 5 or 6)
Note: EAL HU3.4 does not apply to routine traffic impediments such as fog, snow, ice, or vehicle breakdowns or accidents.
~
1
!k2 H~J3.3 HLJ3.4 A tornado strike within the PROTECTED AREA.
Internal room or area flooding of a magnitude sufficient to require manual or automatic electrical isolation of a SAFETY SYSTEM component needed for the current operating mode.
Movement of personnel within the PROTECTED AREA is impeded due to an offsite event involving hazardous materials (e.g., an offsite chemical spill or toxic gas release).
A hazardous event that results in on-site conditions sufficient to prohibit the plant staff from accessing the site via personal vehicles.
Definitions:
PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan.
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the EGGS. Systems classified as safety related.
Basis:
This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant.
EAL HU3.1 addresses a tornado striking (touching down) within the Protected Area.
EAL HU3.2 addresses flooding of a building room or area that results in operators isolating power to a SAFETY SYSTEM component due to water level or other wetting concerns.
Classification is also required if the water level or related wetting causes an automatic isolation of a SAFETY SYSTEM component from its power source ( e.g., a breaker or relay trip). To 187
Jloffil 99 01 (Revision a)
Jl,fo,,cember 2012 warrant classification, operability of the affected component must be required by Technical Specifications for the current operating mode.
EAL HU3.3 addresses a hazardous materials event originating at an offsite location and of sufficient magnitude to impede the movement of personnel within the PROTECTED AREA.
188
NEI 99 01 (RevisioR e)
NoYeR'leer 2012 EAL HU3.4 addresses a hazardous event that causes an on-site impediment to vehicle movement and significant enough to prohibit the plant staff from accessing the site using personal vehicles.
Examples of such an event include site flooding caused by a hurricane, heavy rains, up-river water releases, dam fai lure, etc., or an on-site train derailment blocking the access road.
This EAL is not intended apply to routine impediments such as fog, snow, ice, or vehicle breakdowns or accidents, but rather to more significant conditions such as the Hurricane Andrew strike on Turkey Point in 1992, the flooding around the Cooper Station during the Midwest floods of 1993, or the flooding around Ft. Calhoun Station in 2011.
EAL.H..!LL5 addresses (site specific description)..
Escalation of the emergency classification level would be based on I Cs in Recognition Categories AR, F, Sor C.
De'i'elepeF Netes:
The "Site specific list of natural or technological hazard events" should include other events that may be a precursor to a more significant event or condition, and that are appropriate to the site location and characteristics.
Notwithstanding the events specifically included as EALs above, a "Site specific list of natural or technological hazard events" need not include short lived events for which the extent of the damage and the resulting consequences can be determined 1.vithin a relatively short time frame.
In these cases, a damage assessment can be performed soon after the event, and the plant staff 1.vill be able to identify potential or actual impacts to plant systems and structures. This 1.vill enable prompt definition and implementation of compensatory or corrective measures with no appreciable increase in risk to the public.
To the e>,tent that a short lived event does cause immediate and significant damage to plant systems and structures, it will be classifiable under the Recognition Category f, S and C ICs and EALs. Events of lesser impact would be e>,pected to cause only small and localized damage.
The consequences from these types of events are adequately assessed and addressed in accordance with Technical Specifications. In addition, the occurrence or effects of the event may be reportable under the requirements of 10 CFR 50.72.
EGL Assignment Attributes: 3.1.1.A and 3.1.1.C 189
NEI 99 Q l (RtwisieR e)
Ne¥ember 2012 HU4 ECL: Notification of Unusual Event Initiating Condition: FIRE potentially degrading the level of safety of the plant.
Operating Mode Applicability: All Emergency Action Levels:
Example Emergeeey Aetiee Levels: (1 or 2 or 3 or 4)
Note~:
The Emergency Director should declare the Unusual Eventevent promptly upon determining that the applicable time has been exceeded, or will likely be exceeded.
HLJ4. l
- a.
A FIRE is NOT extinguished within 15-minutes of ANY of the following FIRE detection indications:
H 4.2 H 4.4 Report from the field (i.e., visual observation)
Receipt of multiple (more than 1) fire alarms or indications Field verification of a single fire alarm AND
- b.
The FIRE is located within ANY of the followingTable H-1 plant rooms or areas+
- a.
(site specific list of plant rooms or areas)
Receipt of a single fire alarm ~with no other indications of a FIREj.
---AND
- b.
The FIRE is located within ANY of the followingTable H-1 plant rooms or areas (site specific I ist of plant rooms or areas)
AND
- c.
The existence of a FIRE is not verified within 30-minutes of alarm receipt.
A FIRE within the plant or ISFSI [forplemts wit.Li an ISFSI eutside t,l1ep/a,9t Preteeted Afe.at-PROTECTED AREA not extinguished within 60-minutes of the initial report, alarm or indication.
A FIRE within the plant or ISFSI [for plants wit.Li an ISFSI eutside the plant Pfflteeted Afe.at-PROTECTED AREA that requires firefighting support by an offsite fire response agency to extinguish.
Table H-1 Fire Areas 190
I G31 DG and Day Tank Rooms, I G21 DG and Day Tank Rooms, Battery Rooms, Essential Switchgear Rooms, Cable Spreading Room Torus Room
~Intake Structure; Pumphouse
- Drywell, Torus NE. NW. SE Corner Rooms, HPCI Room, RCIC Room, RHR Valve Room, North CRD Area, South CRD Area, CSTs Control Building, Remote Shutdown Panel I C388 Area, Panel ICSS/56 Area; SBGTRoom 191 Jl,ffil 99 g I (ReyisioR e) jl,fo,,cemeer 2('.)12
Definitions:
NEI 99 0 I (ReYisioR 6)
}fo1i8FR88F 20] 2 FIRE: Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.
PROTECTED AREA: The area under continuous access monitoring and control. and armed protection as described in the site Security Plan.
Basis:
This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.
EAL HU4.1 The intent of the 15-minute duration is to size the FIRE and to discriminate against small FIRES that are readi ly extinguished (e.g., smoldering waste paper basket). In addition to alarms, other indications of a FIRE could be a drop in fire main pressure, automatic activation of a suppression system, etc.
Upon receipt, operators will take prompt actions to confirm the validity of an initial fire alarm, indication, or report. For EAL assessment purposes, the emergency declaration clock starts at the time that the initial alarm, indication, or report was received, and not the time that a subsequent verification action was performed. Similarly, the fire duration clock also starts at the time ofreceipt of the initial alarm, indication or report.
EAL HU4.2 This EAL addresses receipt of a single fire alarm, and the existence of a FIRE is not verified (i.e., proved or disproved) within 30-minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire alarm. For EAL assessment purposes, the 30-minute clock starts at the time that the initial alarm was received, and not the time that a subsequent verification action was performed.
A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipment failure or a spurious activation, and not an actual FIRE. For this reason, additional time is allowed to verify the validity of the alarm. The 30-minute period is a reasonable amount of time to determine if an actual FIRE exists; however, after that time, and absent information to the contrary, it is assumed that an actual FIRE is in progress.
192
~IBI 99 01 (ReYisioA 6)
~Jovemeer 20 I 2 If an actual FIRE is verified by a report from the field, then EAL HU4.1 is immediately applicable, and the emergency must be declared if the FIRE is not extinguished within 15-minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation, and this verification occurs within 30-minutes of the receipt of the alarm, then this EAL is not applicable and no emergency declaration is warranted.
EAL HU4.3 In addition to a FIRE addressed by EAL HU4. 1 or EAL HU4.2, a FIRE within the plant or ISFSI PROTECTED AREA not extinguished within 60-minutes may also potentially degrade the level of plant safety. This basis extends to a FIRE occurring within the PROTECTED AREA of an ISFSI located outside the plant PROTECTED AREA. [Sentence for plants with an ISFSI outside the plant Protested i\\rea]
EAL HU4.4 If a FIRE within the plant or ISFSI [for plants with tm ISFSI eutside the plant PretectedArea]
PROTECTED AREA is of sufficient size to require a response by an offsite firefighting agency
( e.g., a local town Fire Department), then the level of plant safety is potentially degraded. The dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts because the fire is beyond the capability of the Fire Brigade to extinguish. Declaration is not necessary if the agency resources are placed on stand-by, or supporting post-extinguishment recovery or investigation actions.
Basis-Related Requirements from Appendix Rand NFPA-805 Criterion 3 of Appendix A to 10 CFR 50 states in part that "structures, systems, and components important to safety shall be designed and located to minimize. consistent with other safety requirements, the probability and effect of fires and explosions."
The Nuclear Safety Goal ("NSG") in NFPA 805, Section 1.3.1 states, "The nuclear safety goal is to provide reasonable assurance that a fire during any operational mode and plant configuration will not prevent the plant from achieving and maintaining the fuel in a safe and stable condition."
When considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance because a safe shutdown success path, free of fire damage, must be available to meet the nuclear safety goals, objectives and performance criteria for a fire under any plant operational mode or configuration.
Because fire may affect safe shutdown systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post-fire conditions does not per se impact public safety. the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents.
193
J>ffil 99 O 1 (Re,*isioR e)
J>fo*yemaer 2012 In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of I-hour fire barriers for the enclosure of cable and equipment and associated non-safety circuits of one redundant train (G.2.c). Even though DAEC has adopted the alternate approach provided by NFPA-805 in lieu of the deterministic requirements of Appendix R, the 30-minutes to verify a single alarm as used in EAL HU4.2 is considered a reasonable amount of time to determine if an actual FIRE exists without presenting a challenge to the nuclear safety performance criteria.Basis Related Requirements from Appendix R Appendi>l R to 10 CFR 50, states in part:
Criterion 3 of Appendi>, A to this part specifies that "Structures, systems, and components important to safety shall be designed and located to minimize, consistent 1.vith other safety requirements, the probability and effect of fires and e>,plosions."
'.¥hen considering the effects of fire, those systems associated 1.vith achieving and maintaining safe shutdovm conditions assume major importance to safety because damage to them can lead to core damage resulting from loss of coolant through boil off.
Because fire may affect safe shutdovm systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents.
In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barriers for the enclosure of cable and equipment and associated non safety circuits of one redundant train (G.2.c). As used in EAL #2, the 30 minutes to verify a single alarm is,veil within this worst case 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> time period.
Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or SA-9SA8.
De...eloper Notes:
The "site specific list of plant rooms or areas" should specify those rooms or areas that contain SAFETY SYSTEM equipment.
As noted in the EALs and Basis section, include the term ISFSI if the site has an ISFSI outside the plant Protected Area.
EGL Assignment Attributes: 3.1.1.A 194
ECL: Notification of Unusual Event NEJ 99 01 (RevisioA 6)
~fo*,<emeer 2012 HU-76 Initiating Condition: Other conditions exist which in the judgment of the Emergency Director warrant declaration of a fN0 1UE.
Operating Mode Applicability: All l
Exemple Emergency Action Levels:
1 Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated.
No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of SAFETY SYSTEMS safety systems occurs.
Definitions:
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdovm condition, including the EGGS. Systems classified as safety related.
Basis:
This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a NOUE.
195
NEJ 99 QI (RevisioR 6)
No1t'0FR00F 2()12 HA1 ECL: Alert Initiating Condition: HOSTILE ACTION within the OWNER CONTROLLED AREA or airborne attack threat within 30 minutes.
Operating Mode Applicability: All Example Emergency Action Levels.:.: (1 or 2)
A HOSTILE ACTION is occurring or has occurred within the OWNER CONTROLLED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision.
A validated notification from NRC of an aircraft attack threat within 30 minutes of the site.
Definitions:
HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
OWNER CONTROLLED AREA: The site property owned by or otherwise under the control of the licensee.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
Basis:
This IC addresses the occurrence of a HOSTILE ACTION within the OWNER CONTROLLED AREA or notification of an aircraft attack threat. This event will require rapid response and assistance due to the possibility of the attack progressing to the PROTECTED AREA, or the need to prepare the plant and staff for a potential aircraft impact.
Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event.
Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.
196
NEI 99 0 I (RevisioA i)
NoYeFAeer 2012 As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures ( e.g., evacuation, dispersal or sheltering).
The Alert declaration will also heighten the awareness of Offsite Response Organizations, allowing them to be better prepared should it be necessary to consider further actions.
This IC does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical disputes between employees, etc.
Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR -§-73.71 or 10 CFR -§-50.72.
EAL HAI.I is applicable for any HOSTILE ACTION occurring, or that has occurred, in the OWNER CONTROLLED AREA. This includes any action directed against att-the ISFSI that which is located outside the plant PROTECTED AREA.
EAL HAI.2 addresses the threat from the impact of an aircraft on the plant, and the anticipated arrival time is within 30 minutes. The intent of this EAL is to ensure that threat-related notifications are made in a timely manner so that plant personnel and GRGoffsite response organizations are in a heightened state of readiness. This EAL is met when the threat-related information has been validated in accordance with fAbnormal Operating Procedure (AOP) 914, Security Events site specific procedure).§.,_
The NRC Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft. The status and size of the plane may be provided by NORAD through the NRC.
In some cases, it may not be readily apparent if an aircraft impact within the OWNER CONTROLLED AREA was intentional (i.e., a HOSTILE ACTION). It is expected, although not certain, that notification by an appropriate Federal agency to the site would clarify this point.
In this case, the appropriate federal agency is intended to be NORAD, FBI, FAA or NRC. The emergency declaration, including one based on other ICs/EALs, should not be unduly delayed while awaiting notification by a Federal agency.
Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be ~ contained in non public documents such as the Security Plan.
Escalation of the emergency classification level would be via IC HS 1.
DevelopeF Notes:
The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force.
Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan.
197
~ffil 99 0 I (Re*,isioA e) urth 8
November 201?
.r1ue cons1aeration given to the abo* ce
- ~hoR>0 :'*'°'""*** te soloote0 ovoAls Bosoribo~ iElet~el';J'er *.***. EALs "'"'.I ***teio alpha e, imp ementmg proceaures. Such references h la n e ec~nty Plan ans associates event. For e:irnm I e
s ou not contam a re
- bl
( *
. ----p*e, ao -AL fllay be wer0e8 as "S
_eeg,,,za
- Elesenptieo efthe site specific security shift supervision)."
ecunty event #2, #5 or #9 is reportea by the See the relates Developer Note.
A aevelopment of a scheme aefinition for1:h;*~~~~~~BCgefinitions, for guiaance on the
}>HROLLBD A~ A eCL Assignment Attributes: 3.1.2.D
- n.
198
NEI 99 01 (RevisioR e)
?>lovember 2012 HA5 ECL: Alert Initiating Condition: Gaseous release impeding access to equipment necessary for normal plant operations, cooldo'+'m, or shutdown.
Operating Mode Applieal>ility: All Example Emergeney Aetion Levels:
Note: If the equipment in the listed room or area \\Vas already inoperable or out of service before the event occurred, then no emergency classification is warranted.
follo'+'i'ing plant rooms or areas:
(site specific I ist of plant rooms or areas 1Nith entry related mode applicability identified)
,t\\..l\\JD
- b.
Entry into the room or area is prohibited or impeded.
This IC addresses an event involving a release of a hazardous gas that precludes or impedes access to equipment necessary to maintain normal plant operation, or required for a normal plant cooldown and shutdown. This condition represents an actual or potential substantial degradation of the level of safety of the plant.
An Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the gaseous release. The emergency classification is not contingent upon whether entry is actually necessary at the time of the release.
Evaluation of the IC and EAL do not require atmospheric sampling; it only requires the Emergency Director's judgment that the gas concentration in the affected room/area is sufficient to preclude or significantly impede procedurally required access. This judgment may be based on a variety of factors including an existing job hazard analysis, report of ill effects on personnel, advice from a subject matter ex.pert or operating e>tperience vrith the same or similar hazards.
Access should be considered as impeded if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).
An emergency declaration is not 1Narranted if any of the following conditions apply.
The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the gaseous release). For e>rnmple, the plant is in Mode 1 1.vhen the gaseous release occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the affected room unti I Mode 4.
199
- h. h address the r, measures 'tV ie
. ludes compensate. Y
, tern testing).
- ~:::;:::* ;;;n;e~d;a~c~ftp~,'i~t)~'~
th~a~t;m:;c;;Efir:es:u:p:p:re:s:s:10:n::S)~:s*:::re:c:o:r:dk:e:e:pm:g TAe gas,el ease IS a.:'~~ efa roam a, area (e.g;j is ef!lfl admiaistrot,ve e, erary iaaeeess,,
, rea eat,y is req**ff>
d " *euld Rel temp.
fer wAieA,eem,a fRe iRSj)eet10as).
f """'Y """'"'* aA "
- The action I rounds or mu I
'ati, '0 or precau I E
norma f consen
- naturee.g.,
I easures are o a.
The aeeess eeRtro* '." ede a required aeheA.
d. te daagerous levels.
aeUJally preveat er,mp tAe level ef eKygea iR !lie ~=s:.i eaviroameat. -!~"
al,le ef redue1ag
. I eiag aiflA aa eae
., 4.ieA eaa lea e
' R aspAy,<iaat is a gas *IIJ' ats werk l,y merely d1Sp ** al !~tel ef al'0uad 19,S, "
n moni)', asphyxia
, n below the nor Mest eem eRtmtiea ef e*) ge
"""" deatla.
reduces the cone I
- unconsciousness, or
~
200
201 NEI 99 O 1 (RevisieR e)
},fovemaer 2012
ECL: Alert NEI 99 01 (RevisioR e)
~fo*refReer 2012 HA6HA5 Initiating Condition: Control Room evacuation resulting in transfer of plant control to alternate locations.
Operating Mode Applicability: All Example Emergency Action Levels:
H 65.1 An event has resulted in plant control being transferred from the Control Room to fs-ite-specific remote shutdo 1Nn panels and local control stations)the Remote Shutdown Panel (1 C388).
Definitions:
Basis:
This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations outside the Control Room. The loss of the ability to control the plant from the Control Room is considered to be a potential substantial degradation in the level of plant safety.
Following a Control Room evacuation, control of the plant will be transferred to alternate shutdown locations. The necessity to control a plant shutdown from outside the Control Room, in addition to responding to the event that required the evacuation of the Control Room, will present challenges to plant operators and other on-shift personnel. Activation of the ERO and emergency response facilities will assist in responding to these challenges.
Escalation of the emergency classification level would be via IC HS62_.
Developer Notes:
The "site specific remote shutdovrn panels and local control stations" are the panels and control stations referenced in plant procedures used to cooldown and shutdown the plant from a location(s) outside the Control Room.
EGL Assignment Attributes: 3.1.2.B 202
ECL: Alert NEI 99 01 (Re11ision t'i)
~lo*reff!eer 2012 HA7HA6 Initiating Condition: Other conditions exist which in the judgment of the Emergency Director warrant declaration of an Alert.
Operating Mode Applicability: All l
E,ample Eme.-geeeyEmergency Action Levels:
1 Other conditions exist which, in the judgment of the Emergency Director, indicate that events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities {i.e.. this may include violent acts between individuals in the owner controlled area).
HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
Basis:
This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for an Alert.
203
ECL: Site Area Emergency Initiating Condition: HOSTILE ACTION within the PROTECTED AREA.
Operating Mode Applicability: All Example EmergeneyEmergency Action Levels:
NEI 99 01 (RevisioR e)
~lovemeer 2012 HS1 S 1.1 A HOSTILE ACTION is occurring or has occurred within the PROTECTED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
HOST AGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
HOSTILE FORCE: One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan.
Basis:
This IC addresses the occurrence of a HOSTILE ACTION within the PROTECTED AREA.
This event will require rapid response and assistance due to the possibility for damage to plant equipment.
Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event.
Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.
204
NEI 99 01 (RevisioA 6)
NoYemeer 2012 As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures (e.g., evacuation, dispersal or sheltering).
The Site Area Emergency declaration will mobilize GRGoffsite response organization resources and have them available to develop and implement public protective actions in the unlikely event that the attack is successful in impairing multiple safety functions.
This IC does not apply to a HOSTILE ACTION directed at atrthe ISFSI PROTECTED AREA which is located outside the plant PROTECTED AREA; such an attack should be assessed using IC HAI. It also does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical disputes between employees, etc. Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR f-73.71 or 10 CFR f-50.72.
Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should beis contained in non public documents such as the Security Plan.
Escalation of the emergency classification level would be via IC HGl.
Develeper Netes:
The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force.
Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan.
'Nith due consideration given to the above developer note, EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures. Such references should not contain a recognizable description of the event. For e).ample, an EAL may be 1.vorded as "Security event #2, #5 or #9 is reported by the (site specific security shift supervision)."
See the related Developer Note in Appendix B, Definitions, for guidance on the development of a scheme definition for the PROTECTED AREA.
EGL i\\ssignment Attributes: 3.1.3.D 205
l'JEI 99 QI (Re*,isioR e)
}'fo*,emaer 2Q 12 HS6HS5 ECL: Site Area Emergency Initiating Condition: Inability to control a key safety function from outside the Control Room.
Operating Mode Applicability: All Example Emergency Action Levels:
Note: The Emergency Director should declare the Site Area Emergencyevent promptly upon determining that (site specific number the applicable timeof'.20 minutes) has been exceeded, or will likely be exceeded.
- a.
- b.
Definitions:
Basis:
An event has resulted in plant control being transferred from the Control Room to (site specific remote shutdown panels and_control stations) the Remote Shutdown Panel (1 C388).
AND Control of ANY of the following key safety functions is not reestablished within (site specific number of20 minutes).
Reactivity control Core cooling [PWR] I RPV water level [BWR]
RCS heat removal This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations, and the control of a key safety function cannot be reestablished in a timely manner. The failure to gain control of a key safety function following a transfer of plant control to alternate locations is a precursor to a challenge to one or more fission product barriers within a relatively short period of time.
The determination of whether or not "control" is established at the remote safe shutdown location(s)Remote Shutdown Panel (1 C388-islli based on Emergency Director judgment. The Emergency Director is expected to make a reasonable, informed judgment within (the site specific time for transfer) ~20 minutes whether or not the operating staff has control of key safety functions from the remote safe shutdown location(s).
AOP 915, "Shutdown Outside Control Room" provides the following CAUTION - "For Control Room evacuation as the result ofa fire, transfer of control at panels 1 C388, 1 C389, 1 C390.
JC391, JC392and JC392 is required to be completed within 20 minutes."
Escalation of the emergency classification level would be via IC FG I or CG 1.
206
Developer Notes:
NEJ 99 01 (ReYisioR 6)
No1rember 2012 The "site specific remote shutdown panels and local control stations" are the panels and control stations referenced in plant procedures used to eooldown and shutdown the plant from a location(s) outside the Control Room.
The "site specific number of minutes" is the time in which plant control must be (or is expected to be) reestablished at an alternate location as described in the site specific fire response analyses. Absent a basis in the site specific analyses, 15 minutes should be used. Another time period may be used with appropriate basis/justification.
EGL Assignment Attributes: 3.1.3.B 207
ECL: Site Area Emergency
}ffil 99 QI (Re\\1isioR i)
}loyemeer 2012 HS7HS6 Initiating Condition: Other conditions exist which in the judgment of the Emergency Director warrant declaration of a Site Area Emergency.
Operating Mode Applicability: All
~ E.. mple Emergency Action Levels:
1 Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts, (1) toward site personnel or equipment that could lead to the likely fai lure of or, (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA Protective Action Guideline exposure levels beyond the site boundary.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
Basis:
This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a Site Area Emergency.
208
NE! 99 01 (Re\\'isioR 6)
~foYemaer 2012 HG1 ECL: General Emergency Initiating Condition: HOSTILE ACTION resulting in loss of physical control of the facility.
Operating Mode Applicability: All Example Emergency Action Levels:
H 1. 1
- a.
A HOSTILE ACTION is occurring or has occurred within the PROTECTED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision.
AND
- b.
EITHER of the following has occurred:
- 1.
ANY of the following safety functions cannot be controlled or maintained.
Reactivity control Core cooling [PWR] I RPV water level [BWR]
- 2.
Damage to spent fuel has occurred or is IMMINENT.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end.
This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
HOST AGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
HOSTILE FORCE: One or more individuals who are engaged in a determined assault, overtly or by stealth and deception. equipped with suitable weapons capable of killing. maiming. or causing destruction.
IMMINENT: The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.
209
NEI 99 QI (Re;cisioA a)
November 2012 PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan.
210
Basis:
211 tffil 99 01 (Re1,1isioR fi) tfo1,1emeer 2012
NEI 99 C:l 1 (Re,*isioA 6)
Novemeer 2C:ll2 This IC addresses an event in which a HOSTILE FORCE has taken physical control of the facility to the extent that the plant staff can no longer operate equipment necessary to maintain key safety functions. It also addresses a HOSTILE ACTION leading to a loss of physical control that results in actual or IMMINENT damage to spent fuel due to 1) damage to a spent fuel pool cooling system (e.g., pumps, heat exchangers, controls, etc.) or, 2) loss of spent fuel pool integrity such that sufficient water level cannot be maintained.
Timely and accurate communications between the DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event.
Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program].
Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should beis contained in non public documents such as the Security Plan.
212
Developer Notes:
l>ffil 99 Q l (ReYisieA a) l>foi,*ember 2Ql 2 The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force.
Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan.
With due consideration given to the above developer note, EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures. Such references should not contain a recognizable description of the event. For e1rnmple, an EAL may be worded as "Security event #2, #5 or #9 is reported by the (site specific security shift supervision)."
8ee the related Developer Note in Appendix. B, Definitions, for guidance on the development of a scheme definition for the PROTECTED AREA.
EGL Assignment Attributes: 3.1.4.D 213
ECL: General Emergency l'>ffil 99 01 (ReYisioR 6)
NoYember 2012 HG7HG6 Initiating Condition: Other conditions exist which in the judgment of the Emergency Director warrant declaration of a General Emergency.
Operating Mode Applicability: All 6
E,ae,ple Emergency Action Levels:
1 Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area.
Definitions:
HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area).
HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station.
IMMINENT: The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.
PROJECTILE: An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety.
Basis:
This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a General Emergency.
214
11 SYSTEM MALFUNCTION ICS/EALS NEI 99 01 (ReYisieR e)
}foyemaer 2012 Table S 1: Reeognition Categorv "S" Initiating Condition Matrix UNUSUAL EVENT SUl Loss of all offsite AC power capability to emergency buses for 15 minutes or longer.
Op. },fades: 1. 2. 3. 4Pewer Operetien, Stertup, Het St611'lde:y, Hat 8/mtdewl'l SU2 illlPL",1'll>lED loss of Control Room indications for 15 minutes or longer.
Op.,\\fades: Pewer Operetien, Stertup, Hat Stemie;*, Hat 8!1utdewnL...l,_
- 3. 4 SUJ Reactor coolant actiYity greater tkan Technical Specification allowable limits.
Op. },fades: 1. 2. 3. 4Pewer Operntien, Sf6lrtup, Het Stendh;*, Het Shutdewn SU4 RCS leakage for 15 minutes or longer.
Op. }.fades: 1. 2. 3, '/Pewer Operetien, Stertup, Het Stendby, Het Shutdem'l SUS Automatic or manual (trip [PWRJ /
scram [BWR]) fails to shutdown the reactor.
Op. }.lodes:
Pewer OpaGltien}
ALERT SAl Loss of all but one AC power source to emergency buses for 15 minutes or longer.
Op. },fades: L...1....J...
1:.Pewer Opeffllien, Stertup, Het Sf6lndby, Het 8!1utdewn SA2 ill~PLA1'Jl>ffiD loss of Control Room indications for 15 minutes or longer witk a significant transient in progress.
Op. Mades: 1. 2. 3. 4 Pewer Operetien, Stertup, Het Stendby, Het Shu1dew1q SAS Automatic or manual (trip [PWR] /
scram [BWR]) fails to shutdown the reactor, and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor.
Op. }.{edes: Pewer Operetienl_
215 SITE A.REA EMERGENCY SS1 Loss of all offsite and all onsite AC pov,rer to emergency buses for 15 minutes or longer.
Op. },fades: 1, 2, 3, 4Pewer Operetien, Stertup, Het Stendb;*, Het Shutdewn SSS Inability to shutdovm the reactor causing a challenge to (core cooling [PWR] I R.0 V water level [BWR])
or RC8 heat removal.
Op. }.fades: Pewer Operetienl 1
GENERAL EMERGENCY SGl Prolonged loss of all offsite and all onsite AC power to emergency buses.
Op. }.fades: 1, 2. 3, 4Pewer Operetien, Stertup, Het Stendh;*, Het 8!1utdewn
- Table intended for use by 1 EAL developers.
- Inclusion in licensee I 0
. d ocuments 1s not require.
L------------------1
UNUSUAL EVENT SU6 Loss of all onsite or offsite eommunieations eapabilities.
Op. },fades: 1, 2, 3, 4.Pewer Operetien, Stcwtup, Hat Stal'ldhy, Het Slwtdewn SU7 Failure to isolate eontainment or loss of eontainment pressure eontrol. [PWR]
Op. Afades: 1, 2, 3,
- 1. Pewe,* Operatie,"i, Starh,tp, Het Stendhy, Hat Shi1tdewl'I A,LERT SITE AREA EMERGENCY NEI 99 01 (Re,,*isioR e)
},foyemeer 2012 GENER.... L EMERGENCY SS8 Loss of all Vital DC SG8 Loss of all AC and SA9 Ha:mrdous event affeeting a SAFETY SYSTEM needed for the eurrent operating mode.
Op. Medes: 1, 2, 3, 4.Pewer Operatiel'I, Startitp, Hat S:emihy, Hat Shutdewl'1 po1Ner for 15 minutes or
~
Op. },fades: 1, 2, 3, 4Pewer Operetien, Startitp, Het Standby*, Hat Shutdewl'I 216 Vital DC power sourees for 15 minutes or longer.
Op. },1edes: 1, 2, 3, 4Pewer Operetien, Stlrt1,!fJ, Het Stendey, Hat Shutdewn
- Table intended for use b)'
I EAL de>,<elopers.
- lnelusion in lieensee I d
. d oeuments ts not require.
1 L------------------J
ECL: Notification of Unusual Event NE! 99 0 I (ReYisioR 6)
NoYember 2012 SU1 Initiating Condition: Loss of alt-ALL offsite AC power capability to emergency essential buses for 15_-minutes or longer.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdown.1..1.,_]_
Example Emergency Action Levels:
Note: The Emergency Director should declare the Unusual E~vent promptly upon determining that the applicable time 15 minutes has been exceeded, or will likely be exceeded.
S 1.1 Loss of ALL offsite AC power capability to (site specific emergency buses)1A3 AND 1 A4 buses for 15 minutes or longer.
Definitions:
Basis:
This IC addresses a prolonged loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emergency essential buses-..,_ This condition represents a potential reduction in the level of safety of the plant.
The intent of this EAL is to declare an Notification of Unusual Event when offsite power has been lost and both of the emergency diesel generators have successfully started and energized their respective 4kv essential bus.
For emergency classification purposes, "capability" means that an offsite AC power source(s) is available to the emergency essential buses, whether or not the buses are powered from it.
Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power.
Escalation of the emergency classification level would be via IC SAL De*,zeloper Notes:
The "site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typically 1 emergency bus per train of SAFETY SYSTEMS.
At multi unit stations, the EALs may credit compensatory measures that are proceduralized and can be implemented 1within 15 minutes. Consider capabilities such as power source cross ties, "s1.ving" generators, other power sources described in abnormal or emergenC)' operating procedures, etc. Plants that have a proceduralized capability to supply offsite AC power to an 217
NEl 99 QI (ReyisioR 6) tlo*,<emeer 2Q 12 affeeted unit via a eross tie to a eompanion unit may eredit this power souree in the EAL provided that the planned eross tie strategy meets the requirements of 10 CFR 50.63.
EGL Assignment Attributes: 3.1.1.A 218
ECL: Notification of Unusual Event NEI 99 QI (Re'iisioA 6)
No¥ember 2Q 12 SU2SU3 Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdown.L..LJ Examf)le Emergency Action Levels:
Note: The Emergency Director should declare the Unusual E~vent promptly upon determining that the applicable time 15 minutes has been exceeded, or will likely be exceeded.
S 3.1
++-a.--An UNPLANNED event results in the inability to monitor one or more of the Definitions:
Reactor Power R.0 V '.Vater Level RPV Pressure Primary Containment Pressure Suppression Pool Le1rel Suppression Pool Temperature Suppression Pool Temperature Table S-1 Safety System Parameters Reactor power RPV Water Level RPV Pressure Primary Containment Pressure Suppression Pool Level Suppression Pool Temperature SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are 219
}ffil 99 0 I (ReYisioA 6)
N0Ye1'l'!eer 2012 classified as safety-related.A system required for safe plant operation, cooling dovm the plant and/or placing it in the cold shutdovm condition, including the EGGS. Systems classified as safety related.
UNPLANNED: A parameter change or an event that is not I) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.
Basis:
This IC addresses the difficulty associated with monitoring normal plant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant.
As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). _For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.
220
NE! 99 0 I (Re,*isioH 6) 1-foyemeer 2012 An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.
This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling [PWR] I RPV level [BWR] and RCS heat removal.
The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [PWR] / RPV water level [BWR] cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.
Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.
Escalation of the emergency classification level would be via IC SA+/-}.
De*,releper Netes:
In the PWR parameter list column, the "site specific number" should reflect the minimum number of steam generators necessary for plant cooldown and shutdovm. This criterion may also specify whether the level value should be *wide range, narrow range or both, depending upon the monitoring requirements in emergency operating procedures.
Developers may specify either pressurizer or reactor 11essel level in the PWR parameter column entry for RCS Le11el.
The number, type, location and layout of Control Room indications, and the range of possible failure modes, can challenge the ability of an operator to accurate!)' determine, within the time period available for emergenC)' classification assessments, if a specific percentage of indications have been lost. The approach used in this EAL facilitates prompt and accurate emergency classification assessments by focusing on the indications for a selected subset of parameters.
By focusing on the availability of the specified parameter values, instead of the sources of those values, the EAL recognizes and accommodates the wide variety of indications in nuclear power plant Control Rooms. Indication types and sources may be analog or digital, safety related or not, primary or alternate, individual meter value or computer group display, etc.
/ 1, loss of plant annunciators will be evaluated for reportability in accordance *with 10 CFR 50.72 (and the associated guidance in 1'ruREG 1022), and reported if it significantly impairs the capability to perform emergency assessments. Compensatory measures for a loss of annunciation can be readily implemented and may include increased monitoring of main control boards and more frequent plant rounds by non licensed operators. Their alerting function notwithstanding, annunciators do not provide the parameter values or specific component status information used to operate the plant, or process through AOPs or EOPs. Based on these considerations, a loss of annunciation is considered to be adequately addressed by reportability criteria, and therefore not included in this JC and EAL.
221
~ffil 99 QI (RevisieA 6)
~fo>,*emeer 2012 With respect to establishing event severity, the response to a loss of radiation monitoring data (e.g., process or effluent monitor values) is considered to be adequately bounded by the requirements of 10 CPR 50.72 (and associated guidance in NUREG 1022). The reporting of this event 1,vill ensure adequate plant staff and NRG awareness, and drive the establishment of appropriate compensatory measures and corrective actions. In addition, a loss of radiation monitoring data, by itself, is not a precursor to a more significant event.
Personnel at sites that have a Failure Modes and Effects Analysis (H,4EA) included within the design basis of a digital I&C system should consider the FMEA information when developing their site specific EALs.
Due to changes in the configurations of SAFETY SYSTEMS, including associated instrumentation and indications, during the cold shutdown, refueling, and defueled modes, no analogous IC is included for these modes of operation.
EGL Assignment Attributes: 3.1.1.A 222
2 NEI 99 QI (ReYisioR e)
Noyemeer 2Q 12 SU3SU4 ECL: Notification of Unusual Event Initiating Condition: Reactor coolant activity greater than Technical Specification allowable limits.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdov,mL 2, 3 Example Emergency Action Levels: (1 or 2)
(Site specific radiation monitor) reading greater than (site specific value). Pretreatment Off gas System (RM-4104) Hi-Hi Radiation Alarm.
Sample analysis indicates that reactor coolant specific activity is greater than 2.0 µCi/gm dose equivalent 1-131 for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or longerSample analysis indicates that a reactor coolant activity value is greater than an allowable limit specified in Technical Specifications.,,.,.
Definitions:
Basis:
This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.
For EAL SU4.1, RM-4104 Hi-Hi Radiation Alarm has been chosen because it is operationally significant is readily recognizable by the Control Room Operations Staff, and is set at a level corresponding to noble gas release rate, after 30-minute delay and decay of 1 Ci/sec.
For EAL SU4.2, coolant samples exceeding the 2.0 µCi/gm dose equivalent l-131concentration require prompt action by DAEC Technical Specifications and are representative of minor fuel cladding degradation.
Escalation of the emergency classification level would be via ICs FAl or the Recognition Category A-R I Cs.
DevelepeF Netes:
For EAL #1 Enter the radiation monitor(s) that may be used to readily identify 1.vhen RCS activity levels e>rneed Technical Specification allovvable limits. This EAL may be developed using different methods and sites should use existing capabilities to address it (e.g., de;,elopment of new capabilities is not required). E>rnmples of e>C.isting methods/capabilities include:
An installed radiation monitor on the letdown system or air ejector.
A hand held monitor or deployed detector reading with pre calculated conversion values or readily implementable conversion calculation capability.
223
l>ffil 99 O 1 (Re*,isioR e)
November 2012 The monitor reading values should eorrespond to an RCS aetivity level approximately at,
Teehnieal Specification allowable limits.
If there is no e>dsting method/capability for determining this EAL, then it should not be included.
IC evaluation will be based on EAL #2.
For EAL#2 Developers may reword the EAL to include the reactor coolant activity parameter(s) specified in Teehnieal Specifieations and the assoeiated allowable limit(s) (e.g.,
values for dose equivalent I 131 and gross activity, time dependent or transient values, ete.). If this approach is selected, all RCS aetivity allowable limits should be ineluded.
EGL Assignment Attributes: 3.1.1.A and 3.1.1.B 224
NEI 99 Ql (RevisioA 6)
November 2012 SU4SU5 ECL: Notification of Unusual Event Initiating Condition: RCS leakage for 15 minutes or longer.
Operating Mode Applicability: Po*.ver Operation, Startup, Hot Standby, Hot Shutdownl..,_Ll Exem13le Emergency Action Levels: (1 or 2 or 3)
Note:
S 5.1
$ 2
~
3 The Emergency Director should declare the Unusual E~vent promptly upon determining that the applicable time 15 minutes has been exceeded, or will likely be exceeded.
RCS unidentified or pressure boundary leakage greater than (site specific Yalue) 10 gpm for 15 minutes or longer.
RCS identified leakage greater than (site specific Yalue)25 gpm for 15 minutes or longer.
Leakage from the RCS to a location outside containment greater than 25 gpm for 15 minutes or longer.
Definitions:
UNISOLABLE: An open or breached system line that cannot be isolated, remotely or locally.
Basis:
This IC addresses RCS leakage which may be a precursor to a more significant event. In this case, RCS leakage has been detected and operators, following applicable procedures, have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant.
EAL SUS.I and EAL SU5.2 are focused on a loss of mass from the RCS due to "unidentified leakage", "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications).
EAL SU5.3 addresses a RCS mass loss caused by an UNISOLABLE leak through an interfacing system. These EALs thus apply to leakage into the containment, a secondary-side system~
steam generator tube leakage in a PWR) or a location outside of containment.
The leak rate values for each EAL were selected because they are usually observable with normal Control Room indications. Lesser values typically require time-consuming calculations to determine (e.g., a mass balance calculation). EAL SUS. I uses a lower value that reflects the greater significance of unidentified or pressure boundary leakage.
225
tJEI 99 Ql (RevisieR C:i) tl011em0er 2Q 12 The release of mass from the RCS due to the as-designed/expected operation of a relief valve does not warrant an emergency classification. For PWRs, an emergency classification would be required if a mass loss is caused by a relief valve that is not functioning as designed/expected (e.g., a relief valve sticks open and the line flo1t't' cannot be isolated). For BWRs, aA stuck-open Safety Relief Valve (SRV) or SRV leakage is not considered either identified or unidentified leakage by Technical Specifications and, therefore, is not applicable to this EAL.
226
227
~ffil 99 01 (RevisioR 6)
~fo*remeer 2012
NEI 99 Gl (Re,*isioA 6) l>fo*,*emeer 2G 12 The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage, if possible.
Escalation of the emergency classification level would be via ICs of Recognition Category A-R or F.
Develof)eF Notes:
Ei\\L #1 For the site specific leak rate 11alue, enter the higher of l O gpm or the Yalue specified in the site's Technical Specifications for this type of leakage.
EAL #2 For the site specific leak rate,,atue, enter the higher of 25 gpm or the value specified in the site's Technical Specifications for this type of leakage.
For sites that haYe Technical Specifications that do not specify a leakage type for steam generator tube leakage, developers should include an EAL for tube leakage greater than 25 gpm for 15 minutes or longer.
EGL Assignment Attributes: 3.1. l.,",
228
l>JEI 99 0 I (RevisioA 6) l>fo\\'emeer 2012 SU5SU6 ECL: Notification of Unusual Event Initiating Condition: Automatic or manual (trip [PWR] / scram [BWR]) fails to shutdown the reactor.
Operating Mode Applicability: Power Operationl,2 Nate: A manual action is any operator action, or set of actions, \\Yhich causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.
Exemf)le Emergency Action Levels: (1 or 2)
Note: A manual action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.
SU6. 1
- a. An automatic (trip [PWR] / scram [B'.VR]) did not shutdown the reactor.
S 6.2 AND
- b.
ANY of the following manual actions taken at 1C05 are successful in lowering reactor power below 5% power
- a.
Manual Scram Pushbuttons Mode Switch to Shutdown Alternate Rod Insertion (ARI)A subsequent manual action taken at the reactor control consoles (I C05) is successful in shutting down the reactor.
A manual trip ([P'.1/R] / scram [B'.1/R]) did not shutdown the reactor.
AND
- b.
EITHER of the following:
- 1. -ANY of the following subsequent manual actions taken at l COS are successful in lowering reactor power below 5% power Manual Scram Pushbuttons Mode Switch to Shutdown Alternate Rod Insertion (ARI)A subsequent manual action taken at the reactor control console (1 C05)s is successful in shutting down the reactor.
---__ OR 230
Definitions:
Basis:
NEI 99 0 I (Re*,isioA 6)
~lovemeer 2012
- 2.
- A subsequent automatic (trip [PWR] / scram [BWR]) is successful in shutting down the reactor.
This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ~
[PWR] I scram [BWR]) that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic (trip [PWR] I scram [BWR])
is successful in shutting down the reactor. _ This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.
Following the failure on an automatic reactor (trip [PWR] I scram [BWR]), operators will promptly initiate manual actions at the reactor control consoles to shutdown the reactor (e.g.,
initiate a manual reactor (trip [PWR] I scram [BWR])). If these manual actions are successful in shutting dov,rn the reactor, core heat generation willscram quickly fall to a level within the capabilities of the plant's decay heat removal systems.
231
~JBI 99 g I (ReYisioA e)
November 2012 If an initial manual reactor (trip [PWR] I scram [BWR]) is unsuccessful, operators will promptly take manual action at another location(s) on the reactor control consoles to shutdown the reactor (e.g., initiate a manual reactor (trip [PWR] I scram [BWR])) using a different switch). Depending upon several factors, the initial or subsequent effort to manually (trip [PWR] I scram [BW~]) the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor ftrtp
[PWR] I scram [BWR]) signal. If a subsequent manual or automatic (trip [PWR] I scram [BWR])
is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems.
A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor ftrtp
[PWR] I scram [BW1"])). This action does not include manually driving in control rods or implementation of boron injection strategies. Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".
Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.
[BWR]
The plant response to the failure of an automatic or manual reactor (trip [PWR] / scram [BWR])
will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level wi ll escalate to an Alert via IC SA:)§. Depending upon the plant response, escalation is also possible via IC FAl. Absent the plant conditions needed to meet either IC SA:)§ or FAI, an Unusual Event declaration is appropriate for this event.
The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).A reactor shutdovm is determined in accordance *.vith applicable Emergency Operating Procedure criteria.
Should a reactor (trip [PWR] / scram [BWR]) signal be generated as a result of plant work (e.g.,
RPS setpoint testing), the following classification guidance should be applied.
I
- If the signal causes a plant transient that should have included an automatic reactor ftrtp
[PWR] / scram [BWR]) and the RPS fai ls to automatically shutdown the reactor, then this IC and the EALs are applicable, and should be evaluated.
If the signal does not cause a plant transient and the (trip [PWR] / scram [BWR]) failure is determined through other means (e.g., assessment oftest results), then this IC and the EALs are not applicable and no classification is warranted.
De*1el013er Netes:
This IC is applicable in any Mode in which the actual reactor power level could eJrneed the power level at which the reactor is considered shutdown. A PWR with a shutdown reactor power level that is less than or equal to the reactor power level which defines the lov,er bound of Pov,er Operation (Mode 1) will need to include Startup (Mode 2) in the Operating Mode Applicability. For example, if the reactor is considered to be shutdov,rn at 3% and Power Operation starts at >5%, then the IC is also applicable in Startup Mode.
Developers may include site specific EOP criteria indicative of a successful reactor shutdown in 232
aA EAL staterneAt, the Basis or aoth (e.g., a reactor pov,cer leYel).
wm 99 Ql (ReYisioR a)
NoYemeer 2Q12 The term "reactor coAtrol coAsoles" may ae replaced with the appropriate site specific term (e.g., rnaiA eoAtrol aoards).
EGL AssigArneAt Attriautes: 3.1.1.A 233
1>,'EI 99 QI (Re1,1isioA e) l>io't'emeer 2Q 12 SU6SU7 ECL: Notification of Unusual Event Initiating Condition: Loss of al-I-ALL onsite or offsite communications capabilities.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdown.L..LJ Example Emergency Action Levels: (1 or 2 or 3)
S 7.1
.fill.L2 S 7.3 Basis:
Loss of ALL of the following onsite communication methods:
(site specific list of communications methods) Plant Operations Radio System In-Plant Phone System Plant Paging System (Gaitronics)
Loss of ALL of the following GRGoffsite response organization communications methods:
_* _(site specific list of communications methods) DAEC All-Call phone All telephone lines (PBX and commercial)
Cell Phones (including fixed cell phone system)
Control Room fixed satellite phone system FTS Phone system Loss of ALL of the following NRC communications methods:
_* _(site specific list of communications methods) FTS Phone system All telephone lines (PBX and commercial)
Cell Phones (including fixed cell phone system)
Control Room fixed satellite phone system This IC addresses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to GRGoffsite response organizations and the NRC.
This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).
235
l>IEI 99 0 I (Re*,isioA 6)
NoYemeer 2012 EAL SU7.l addresses a total loss of the communications methods used in support of routine plant operations.
EAL SU7.2 addresses a total loss of the communications methods used to notify all GRGoffsite response organizations of an emergency declaration. The GRGoffsite response organizations referred to here are-the State of Iowa, Linn County, and Benton County (see Developer Notes).
---EAL SU7.3 addresses a total loss of the communications methods used to notify the NRC of an emergency declaration.
DeYelopeF Notes:
EAL #1 The "site specific list of communications methods" should include all communications methods used for routine plant communications (e.g., commercial or site telephones, page party systems, radios, etc.). This listing should include installed plant equipment and components, and not items owned and maintained by individuals.
EAL #2 The "site specific list of communications methods" should include all communications methods used to perform initial emergency notifications to OROs as described in the site Emergency Plan. The listing should include installed plant equipment and components, and not items ovmed and maintained by individuals. Ei>cample methods are ring dovm/dedicated telephone lines, commercial telephone lines, radios, satellite telephones and internet based communications technology.
In the Basis section, insert the site specific listing of the OROs requiring notification of an emergency declaration from the Control Room in accordance 1Nith the site Emergency Plan, and typically within 15 minutes.
EAL #3 The "site specific list of communications methods" should include all communications methods used to perform initial emergency notifications to the NRG as described in the site E,mergency Plan. The listing should include installed plant equipment and components, and not items ovmed and maintained b)' individuals. These methods are typically the dedicated Emergency Notification System (m-18) telephone line and commercial telephone lines.
EGL Assignment Attributes: 3.1.1.C 237
1'JEI 99 QI (RevisioR e)
November 2Q 12 SU7 ECL: Notification of Unusual Event Initiating Condition:
Failure to isolate containment or loss of containment pressure control. [P\\"JR]
Operating Mode Applicability: Po,.*,er Operation, Startup, Hot Standby, Hot Shutdov.*n Example Emergency Action Levels: (1 or 2) 1
- a.
Failure of containment to isolate 'A'hen required by an actuation signal.
AND
- b. ALL required penetrations are not closed within 15 minutes of the actuation signal.
2
- a.
Containment pressure greater than (site specific pressure).
AND
- b. Less than one full train of (site specific system or equipment) is operating per design for 15 minutes or longer.
Basis:
Th is IC addresses a failure of one or more containment penetrations to automatically isolate (close) '.\\.'hen required by an actuation signal. It also addresses an event that results in high containment pressure,,,ith a 239
NEI 99 0 I (RevisioR a)
No,*ember 2012 concurrent failure of containment pressure control systems. Absent challenges to another fission product barrier, either condition represents potential degradation of the level of safety of the plant.
For EAL 1, the containment isolation signal must be generated as the result on an off normal/accident condition (e.g., a safety injection or high containment pressure); a failure resulting from testing or maintenance does not warrant classification. The determination of containment and penetration status isolated or not isolated should be made in accordance v.*ith the appropriate criteria contained in the plant AOPs and EOPs. The 15 minute criterion is included to allow operators time to manually isolate the required penetrations, if possible.
EAL 2 addresses a condition 'Nhere containment pressure is greater than the setpoint at '.*Jhich containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design. The 15 minute criterion is included to allo'I-' operators time to manually start equipment that may not have automatically started, if possible. The inability to start the required equipment indicates that containment heat removal/depressurization systems (e.g.,
containment sprays or ice condenser fans) are either lost or performing in a degraded manner.
This event,,.,ould escalate to a Site Area Emergency in accordance,,.,ith IC FS1 if there,.,.,ere a concurrent loss or potential loss 240
1>IBI 99 QI (Re,*isioA e)
"!>lo'iemeer 2Q 12 of either the Fuel Clad or RCS fission product barriers.
Developer Notes:
Enter the "site specific pressure" value that actuates containment pressure control systems (e.g., containment spray). Also enter the site specific containment pressure control system/equipment that should be operating per design if the containment pressure actuation setpoint is reached. If desired, specific condition indications such as parameter values can also be entered (e.g., a containment spray flow rate less than a certain value).
EAL #2 is not applicable to the U.S. Evolutionary Po'..ver Reactor (EPR) design.
Attributes:
241 ECL Assignment 3.1.1.A
242
~m, 99 Ql (Re,*isioR e)
~fovemaer 2()12
Ne! 99 0 I (ReYisioA 6)
- Jlolo1,em0er 2012 SA1 ECL: Alert Initiating Condition: Loss of al-l-ALL but one AC power source to emergency essential buses for 15 minutes or longer.
Operating Mode Applicability: Po1Ner Operation, Startup, Hot Standby, Hot Slrntdown.1.1..,_J.
Example Emergency Action Levels:
Note: The Emergency Director should declare the Alert-event promptly upon determining that the applicable time 15_ minutes has been exceeded, or will likely be exceeded.
S 1.1
- a.
AC power capability to (site specific emergency buses) 1A3 and 1 A4 buses is reduced to a single power source for 15 minutes or longer.
AND
- b.
Any /\\NYANY additional single power source failure will result in a loss of alt ALL AC power to SAFETY SYSTEMS.
Definitions:
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdovm condition. including the EGGS. Systems classified as safety related.
Basis:
This IC describes a significant degradation of off site and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering one, or more than one, train of safety.::-
related equipment. This IC provides an escalation path from IC SUL An "AC power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to an emergency bus. Some examples of this condition are presented below.
A loss of all offsite power with a concurrent failure of all but one emergency power source
( e.g., an onsite diesel generator).
A loss of all offsite power and loss of all emergency pO'Ner sources (e.g., onsite diesel generators) 1Nith a single train of emergency buses being back fed from the unit main generator.
A loss of emergency power sources (e.g., onsite diesel generators) with a single train of essentialemergency buses being -eaek-fed from an offsite power source.
Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power.
Escalation of the emergency classification level would be via IC SSl.
De*;eleper Notes:
For a po 1Ner source that has multiple generators, the EAL and/or Basis section should reflect the minimum number of operating generators necessary for that source to provide required power to 243
Nel 99 QI (Re\\1isioA a) l>lo*,*eme er 2Q 12 an AC emergency bus. For e>rnmple, if a backup pov,er source is comprised of two generators (i.e., two 50% capacity generators sized to feed 1 AC emergency bus), the EAL and Basis section must specify that both generators for that source are operating.
The "site specific emergency buses" are the buses fed by offsite or emergency /\\C po1Ner sources that supply power to the electrical distribution system that powers SAFETY 8¥8TEM8. There is typically 1 emergency bus per train of SAFETY 8¥8TEM8.
Developers should modify the bulleted e>rnmples provided in the basis section, above, as needed to reflect their site specific plant designs and capabilities.
The EALs and Basis should reflect that each independent offsite pov,er circuit constitutes a single po:wer souroe. For e>rnmple, three independent 345kV offsite power circuits (i.e.,
incoming power lines) comprise three separate power sources. Independence may be determined from a revie\\\\' of the site specific UF8AR, 8BO analysis or related loss of electrical power studies.
The EAL and/or Basis section may specify use of a non safety related power source provided that operation of this sou roe is recognized in AOPs and EOPs, or beyond design basis accident response guidelines (e.g., FLEX support guidelines). 8uch power sources should generally meet the "Alternate ac souroe" definition provided in 10 CFR 50.2.
At multi unit stations, the EALs may credit compensatory measures that are proceduralized and can be implemented within 15 minutes. Consider capabilities such as power source cross ties, "sv,*ing" generators, other power sources described in abnormal or emergency operating procedures, etc. Plants that have a proceduralized capability to supply offsite AC power to an affected unit Yia a cross tie to a companion unit may credit this power source in the EAL provided that the planned cross tie strategy meets the requirements of 10 CFR 50.63.
EGL Assignment Attributes: 3.1.2.B 244
NEI 99 01 (Re\\1isioA e)
~fovemeer 2012 SA2SA3 ECL: Alert Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer with a significant transient in progress.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdovml.,_1,_l Example Emergency Action Levels:
Note: The Emergency Director should declare the A-left-event promptly upon determining that the applicable time 15_ minutes has been exceeded, or will likely be exceeded.
S 3.1
- a.
An UNPLANNED event results in the inability to monitor one or more Table S-1 parameters from within the Control Room for 15 minutes or longerAn UNPLANl'H3D e'rent results in the inability to monitor one or more of the follo 1Ning parameters from within the Control Room for 15 minutes or longer.
Table S-1 Safety System Parameters
- Reactor power
- RPV Water Level
- RPV Pressure
- Primary Containment Pressure
- Suppression Pool Level
- Suppression Pool Temperature PeweF RPV Water Level R1)V Pressure Primary Containment Pressure Suppression Pool Level Suppression Pool Temperature Suppression Pool Temperature AND Reactor
___ b __. __ ANY of the Table S-2 transient events are in progress.
245
Table S-2 Significant Transients Automatic or manual runback greater than 25% thermal reactor power Electrical load rejection greater than 25% full electrical load Reactor scram ECCS actuation Thermal power oscillations greater than 10%
transient eyents in progress.
}>JEI 99 QI (Re\\*isioA 6)
}>Jo\\*emeer 2Q 12 of the following Automatic or manual runback greater than 25% thermal reactor power Electrical load rejection greater than 25% full electrical load Reactor scram [BWR] / trip [PWR]
EGGS (81) actuation Thermal power oscillations greater than 10% [BWR]
246
Definitions:
~JEJ 99 0 I (Re\\*isieA e)
~Je\\1eme er 2012 SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling dov-m the plant and/or placing it in the cold shutdov,rn condition, including the EGGS. Systems classified as safety related.
UNPLANNED: A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.
Basis:
This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant.
247
NEI 99 0 I (RevisioA 6)
])ofo¥emeer 2012 As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.
An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CPR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.
This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling [PWR] I RPV level [BWR] and RCS heat removal.
The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [PW~] I RPV water level [BWR] cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.
Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.
Escalation of the emergency classification level would be via I Cs FS 1 or IC AS+RS 1.
Developer Notes:
In the PWR parameter list column, the "site specific number" should reflect the minimum number of steam generators necessary for plant cooldown and shutdown. This criterion may also specif)' \\\\'Aether the level value should be vride range, narrow range or both, depending upon the monitoring requirements in emergency operating procedures.
Developers may specify either pressurizer or reactor vessel level in the P'.VR parameter column entry for RCS Level.
Developers should consider if the "transient events" list needs to be modified to better reflect site specific plant operating characteristics and eJ(pected responses.
The number, type, location and layout of Control Room indications, and the range of possible failure modes, can challenge the ability of an operator to accurately detennine, within the time period available for emergency classification assessments, if a specific percentage of indications have been lost. The approach used in this EAL facilitates prompt and accurate emergency classification assessments by focusing on the indications for a selected subset of parameters.
By focusing on the availability of the specified parameter values, instead of the sources of those values, the EAL recognizes and accommodates the 1.,*ide variety of indications in nuclear power plant Control Rooms. Indication types and sources may be analog or digital, safety related or not, primary or alternate, individual meter value or computer group display, etc.
248
Ne! 99 QI (RevisioR e)
Jlolovemeer 2Q 12 A loss of plant annunciators will be evaluated for reportability in accordance with 10 CPR 50.72 (and the associated guidance in NUREG 1022), and reported if it significantly impairs the capability to perform emergency assessments. Compensatory measures for a loss of annunciation can be readily implemented and may include increased monitoring of main control boards and more frequent plant rounds by non licensed operators. Their alerting function notwithstanding, annunciators do not provide the parameter values or specific component status information used to operate the plant, or process through AOPs or EOPs. Based on these considerations, a loss of annunciation is considered to be adequately addressed by reportability criteria, and therefore not included in this IC and EAL.
With respect to establishing event severity, the response to a loss of radiation monitoring data (e.g., process or effluent monitor values) is considered to be adequately bounded by the requirements of 10 CPR 50.72 (and associated guidance in NUREG 1022). The reporting of this event will ensure adequate plant staff and NRG awareness, and drive the establishment of appropriate compensatory measures and corrective actions. In addition, a loss of radiation monitoring data, by itself, is not a precursor to a more significant event.
Personnel at sites that have a Failure Modes and Effects Analysis (FMEA) included within the design basis of a digital J&C s;'stem should consider the FMEA information when developing their site specific EALs.
Due to changes in the configurations of 8AFETY 8¥8TEM8, including associated instrumentation and indications, during the cold shutdown, refueling, and defueled modes, no analogous IC is included for these modes of operation.
EGL Assignment Attributes: 3.1.2.B 249
ECL: Alert
}ffil 99 0 I (ReYisioA 6)
}lo\\1emeer 2012 SA5SA6 Initiating Condition: Automatic or manual (trip [P'.l/R] / scram [BWR]) fails to shutdown the reactor, and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor.
Operating Mode Applicability: Pov,er Operation.1.....1 Note: A manual action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.
l E,ample EmeFgeeeyEmergency Action Levels:
1
- a.
An automatic or manual (trip [PWR] / scram [BWR]) did not shutdown the reactor.
AND
- b.
ALL of the following manual actions taken at 1 COS are not successful in lowering reactor power below 5% power Manual Scram Pushbuttons Mode Switch to Shutdown Alternate Rod Insertion (ARI)Manual actions taken at the reactor control consoles (1 COS) are not successful in shutting down the reactor.
Definitions:
Basis:
This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ftrtJ3
[PWR] I scram [BWR]) that results in a reactor shutdown, and subsequent operator manual actions taken at the reactor control consoles to shutdown the reactor are also unsuccessful. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emergency declaration is required even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RPS.
A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor ftrtJ3
[PWR] I scram [BWR])). This action does not include manually driving in control rods or implementation of boron injection strategies. If this action(s) is unsuccessful, operators would immediately pursue additional manual actions at locations away from the reactor control consoles (e.g., locally opening breakers). _Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles.,_-:-
251
NEI 99 01 (RevisioA a) l>fovemeer 2012 Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action.
[BWR]
252
NEI 99 0 I (RevisioA 6)
]I,[ 0\\'emeer 2012 The plant response to the failure of an automatic or manual reactor (trip [PWR] I scram [BWR])
will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If the failure to shutdown the reactor is prolonged enough to cause a challenge to the core cooling [PWR] / RPV water level [BWR] or RCS heat removal safety functions, the emergency classification level will escalate to a Site Area Emergency via IC SS~§.
Depending upon plant responses and symptoms, escalation is also possible via IC FSl. Absent the plant conditions needed to meet either IC SS~§ or FSl, an Alert declaration is appropriate for this event.
It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however, this IC and EAL are included to ensure a timely emergency declaration.
The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).A reactor shutdovm is determined in accordance *.vith applicable Emergency Operating Procedure criteria.
Develeper Netes:
This IC is applicable in any Mode in which the actual reactor power level could exceed the pov,rer level at which the reactor is considered shutdown. A PWR *.vith a shutdown reactor power level that is less than or equal to the reactor power level which defines the lower bound of Pmver Operation (Mode l) will need to include Startup (Mode 2) in the Operating Mode Applicability. For example, if the reactor is considered to be shutdovm at 3% and Power Operation starts at >5%, then the IC is also applicable in Startup Mode.
Developers may include site specific EOP criteria indicative of a successful reactor shutdown in an EAL statement, the Basis or both (e.g., a reactor power level).
The term "reactor control consoles" may be replaced vrith the appropriate site specific term (e.g., main control boards).
EGL Assignment Attributes: 3.1.2.B 254
Nm 99 QI (ReYisioR 6)
~loYemller 2Q 12 SA9SA8 ECL: Alert Initiating Condition: Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdovm.1..1.,_]_
Example Emergency Action Levels:
Notes:
S 8.1
- If the affected SAFETY SYSTEM train was already inoperable or out of service before the hazardot1s event occurred, then this emergency classification is not warranted.
If the hazardous event only resulted in VISIBLE DAMAGE, with no indications of degraded performance to at least one train of the SAFETY SYSTEM, then this emergency classification is not warranted.
- a.
AND
- b.
The occurrence of ANY of the Table S-3 hazardous events:
l Table S-3 Hazardous Events Seismic event (earthquake)
Internal or external flooding event High winds o r tornado strike FIRE EXPLOSION Other events w ith s imilar hazard c h aracteristics as determined by the Shift Manager or Emergency Director Director
- 1.
- 2.
Event damage has caused indications of degraded performance in one train of a SAFETY SYSTEM needed for the current operating mode.
AND EITHER of the following:
256
~IEJ 99 QI (Re,,isioA 6)
- Novemeer 2Q 12 Event damage has caused indications of degraded performance to a second train of the SAFETY SYSTEM needed for the current operating mode, The event has resulted in VfSTBLE DAMAGE to the second train of a SAFETY SYSTEM needed for the current operating mode.;:
E1,rent damage has caused indications of degraded performance to a second train of the SAFETY SYSTEM needed for the current operating mode, or The eyent has resulted in VISIBLE DAMAGE to the second train of the SAFETY SYSTEM needed for the current operating mode.
Loss of the safety function of a single train SAFETY SYSTEM.
257
Definitions:
NEI 99 0 I (ReYisioA e) 1-Jo,,ember 20 12 EXPLOSION: A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events may require a post-event inspection to determine if the attributes of an explosion are present.
FIRE: Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdov,rn condition, including the BCCS. Systems classified as safety related.
VISIBLE DAMAGE: Damage to a component or structure that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure. Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not VISIBLE DAMAGE.
EITHER of the following:
- 1.
event damage has caused indications of degraded performance in at least one train of a SAFBTY 8Y8TBM needed for the current operating mode.
- 2.
The e1,*ent has caused V18IBLB DAMAGE to a SAFBTY 8¥8TBM component or structure needed for the current operating mode.
Basis:
This IC addresses a hazardous event that causes damage to SAFETY SYSTEMS needed for the current operating mode. In order to provide the appropriate context for consideration of an ALERT classification, the hazardous event must have caused indications of degraded SAFETY SYSTEM performance in one train, and there must be either indications of performance issues with the second SAFETY SYSTEM train or VISIBLE DAMAGE to the second train such that the potential exists for this second SAFETY SYSTEM train to have performance issues. In other words, in order for this EAL to be classified, the hazardous event must occur, at least one SAFETY SYSTEM train must have indications of degraded performance, and the second SAFETY SYSTEM train must have indications of degraded performance or VISIBLE DAMAGE such that the potential exists for performance issues. Note that this second SAFETY SYSTEM train is from the same SAFETY SYSTEM that has indications of degraded performance for criteria SA98.1.b.1 of this EAL; commercial nuclear power plants are designed to be able to support single system issues without compromising public health and safety from radiological events.
An event affecting a single-train SAFETY SYSTEM (i.e., there are indications of degraded performance and/or VISIBLE DAMAGE affecting the one train) would not be classified under SA8 because the two-train impact criteria that underlie the EALs and Bases would not be met. If 258
Ne! 99 01 (Re;1isioR e)
~Jo*temeer 2012 an event affects a single-train SAFETY SYSTEM, then the emergency classification should be made based on plant parameters/symptoms meeting the EALs for another TC. Depending upon the circumstances, classification may also occur based on Shift Manager/Emergency Director judgement.
Indications of degraded performance addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it wi ll be readily available. The indications of degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.
259
~JEI 99 QI (ReYisioA e)
No,*ember 2Q 12 VISIBLE DAMAGE addresses damage to a SAFETY SYSTEM train that is not in service/operation and that potentially could cause performance issues. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.
This VISIBLE DAMAGE should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.
261
Tl-IE! 99 0 I (Re,,*isioA 6)
November 2012 This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. This condition significantly reduces the margin to a loss or potential loss of a fission product barrier, and therefore represents an actual or potential substantial degradation of the level of safety of the
~
EAL l.b.l addresses damage to a SAFETY SYSTEM train that is in serYice/operation since indications for it 1,vill be readily available. The indications of degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.
EAL 1.b.2 addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components. Operators will make this determination based on the totality of available eYent and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage.
Escalation of the emergency classification level would be via IC FS 1 or Ml-RS 1.
Develeper Netes:
For (site specific hazards), developers should consider including other significant, site specific hazards to the bulleted list contained in EAL 1.a (e.g., a seiche).
- Nuclear power plant SAFETY SYSTEMS are comprised of t>.¥0 or more separate and redundant trains of equipment in accordance with site specific design criteria.
EGL Assignment,r\\ttributes: 3.1.2.B 262
ECL: Site Area Emergency NEI 99 0 I (Re*,isioR 6)
No*,emeer 2012 551 Initiating Condition: Loss of ALLa-lt offsite and al-I-ALL onsite AC power to emergency essential-buses for 15 minutes or longer.
Operating Mode Applicability: Pov,*er Operation, Startup, Hot Standby, Hot Shutdownl....1.J Example Emergency Action Levels:
Note: The Emergency Director should declare the Site Area Emergencyevent promptly upon determining that the applicable time 15 minutes has been exceeded, or will likely be exceeded.
S 1.1 Loss of ALL offsite and ALL onsite AC power to (site specific emergenC)' buses) 1 A3 and 1A4 buses for 15 minutes or longer.
Definitions:
SAFETY SYSTEM: A system required for safe plant operation. cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling do 1.vn the plant and/or placing it in the cold shutdovm condition, including the EGGS. Systems classified as safety related.
Basis:
This IC addresses a total loss of AC power that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink.
In addition, fission product barrier monitoring capabilities may be degraded under these conditions.
This IC represents a condition that involves actual or likely major failures of plant functions needed for the protection of the public.
Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.
Escalation of the emergency classification level would be via I Cs AG+RG 1, FG I or SG I.
De*;eloper Notes:
For a power source that has multiple generators, the EAL and/or Basis section should reflect the minimum number of operating generators necessary for that source to provide adequate power to an AC emergency bus. For e>rnmple, if a backup power source is comprised of two generators (i.e., tv,o 50% capacity generators sized to feed 1 AC emergency bus), the EAL and Basis section must specify that both generators for that source are operating.
The "site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typically l emergenC)' bus per train of SAFETY SYSTEMS.
263 J
NBT 99 0 I (RevisioA 6)
November 2012 The EAL and/or Basis section rnay specify use of a non safety related power source pro11ided that operation of this source is controlled in accordance with abnorrnal or ernergency operating procedures, or beyond design basis accident response guidelines (e.g., FLEX support guidelines).
Such power sources should generally rneet the "Alternate ac source" definition provided in 10 GFR 50.2.
At rnulti unit stations, the EA.Ls rnay credit compensatory rneasures that are proceduralized and can be irnplernented within 15 minutes. Consider capabilities such as power source cross ties, "swing" generators, other po1.Yer sources described in abnormal or ernergency operating procedures, etc. Plants that have a proceduralized capability to supply offsite AG power to an affected unit via a cross tie to a cornpanion unit may credit this po 1.ver source in the EAL provided that the planned cross tie strategy meets the requirernents of 10 GFR 50.63.
EGL Assignrnent Attributes: 3.1.3.B 264
ECL: Site Area Emergency
~JEI 99 0 I (RevisioA 6)
November 2012 SS8SS2 Initiating Condition: Loss of ALL Vital DC power for 15 minutes or longer.
Operating Mode Applicability: l, 2, 3 Emergency Action Levels:
Note: The Emergency Director should declare the Site Area Emergenc)'event promptly upon determining that the applicable time 15 minutes has been exceeded, or will likely be exceeded.
~S+=-2~. l __ Indicated voltage is less than (site specific bus voltage value) 105 VDC on ALL(site specific Vital DC busses) BOTH Div 1 and Div 2 125 VDC buses for 15 minutes or longer.
Definitions:
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling do,Yn the plant and/or placing it in the cold shutdown condition, including the EGGS. S)'stems classified as safet)' related.
Basis:
This IC addresses a loss of Vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public.
Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.
Escalation of the emergency classification level would be via I Cs AG-1-RG 1, FG 1 or SG2.
265
~ml 99 Ql (RtwisioA a)
No*,emaer 2Q12 SS5SS6 ECL: Site Area Emergency Initiating Condition: Inability to shutdown the reactor causing a challenge to (core cooling
[PWR] I RPV water level [BWR]) or RCS heat removal.
Operating Mode Applicability: Power OperationLl Examf)le Emergency Action Levels:
S 6. 1
- a.
- b.
An automatic or manual (trip [PWR] / scram [BV/R]) did not shutdown the reactor.
AND ALL of the following manual actions taken at 1 COS are not successful in lowering reactor power below 5% power:
Manual Scram Pushbuttons Mode Switch to Shutdown Alternate Rod Insertion (ARI)AII manual actions to shutdown the reactor have been unsuccessful.
AND
- c.
EITHER of the following conditions exist:
Definitions:
Basis:
_* _(Site specific indication of an inability to adequately remove heat from the core) Reactor vessel 'NaterRPV level cannot be restored and maintained above
-25 inches.
(Site specific indication of an inability to adequately remove heat from the
-RGSjHCL (Graph 4 of EOP 2) exceeded.
This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ftFtp
[PWR] I scram [BWR]) that results in a reactor shutdown, all subsequent operator actions to manually shutdown the reactor are unsuccessful, and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.
In some instances, the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition 266
NE! 99 QI (ReYisieR 6)
"t-Je¥ember 2Q 12 Category F ICs/EALs. This is appropriate in that the Recognition Category F ICs/EALs do not address the additional threat posed by a failure to shutdown the reactor. The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shutdown the reactor.
The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).
A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.
Escalation of the emergency classification level would be via IC AG+-RG 1 or FG 1.
De*,relof)er Notes:
This IC is applicable in any Mode in which the actual reactor povt'er level could e,rneed the power level at vt'hich the reactor is considered shutdown. A PWR with a shutdown reactor power level that is less than or equal to the reactor power level which defines the lower bound of Power Operation (Mode 1) will need to include Startup (Mode 2) in the Operating Mode Applicability. For e,rnmple, if the reactor is considered to be shutdown at 3% and Power Operation starts at >5%, then the IC is also applicable in Startup Mode.
Developers may include site specific EOP criteria indicative of a successful reactor shutdown in an EAL statement, the Basis or both (e.g., a reactor power level).
Site specific indication of an inability to adequately remove heat from the core:
[BWR]
Reactor vessel water level cannot be restored and maintained above Minimum Steam Cooling RPV Water Level (as described in the EOP bases).
[PWR]
Insert site specific values for an incore/core e,cit thermocouple temperature and/or reactor vessel water level that drives entry into a core cooling restoration procedure (or otherwise requires implementation of prompt restoration actions). Alternately, a site may use incore/core eJlit thermocouple temperatures greater than l,200 6F and/or a reactor vessel water level that corresponds to apprmcimatel)' the middle of active fuel. Plants vt'ith reactor vessel level instrumentation that cannot measure down to approximately the middle of active fuel should use the lowest on scale reading that is not above the top of active fuel. If the lo'Nest on scale reading is above the top of active fuel, then a reactor vessel level value should not be included.
For plants that have implemented Westinghouse Owners Group Emergency Response Guidelines, enter the parameters used in the Core Cooling Red Path.
Site specific indication of an inability to adequately remove heat from the RCS:
[BWR]
Use the Heat Capacit)' Temperature Limit. This addresses the inability to remove heat via the main condenser and the suppression pool due to high pool water temperature.
[PWR]
Insert site specific parameters associated with inadequate RCS heat removal via the steam generators. These parameters should be identical to those used for the Inadequate Heat Removal threshold Fuel Clad Barrier Potential Loss 2.B and threshold RCS Barrier Potential Loss 2.A in the PWR EAL Fission Product Barrier Table.
EGL Assignment Attributes: 3.1.3.B 267
SS8 ECL: Site Area EmergeRcy Initiating Condition: Loss of all Vital DC power for 15 miRutes or loRger.
~
1%1 99 GI (ReYisioA 6)
November 2G 12 Of)erating Mode Af)f)lieability: Power OperatioR, Startup, Hot 8taRdb;*, Hot 8hutdovm1, 2, 3, 4 Examf)le Emergeney Aetion Levels:
Note: The EmergeRcy Director should declare the Site Area EmergeRcy promptly upoR determiRiRg that 15 miRutes has beeR e)weeded, or will likely be e)weeded.
l lAdicated voltage is less thaR (site specific bus voltage value)l 15 VOC OR ALL (site specific Vital DC busses) 1(2) D O l, D 02, D 03, aRd D 04 for 15 miRutes or loRger.
Basis+
SAFETY 8Y8TEM: /*, system required for safe plaRt operatioR, cooliRg dowR the plaRt aRd/or placiRg it iR the cold shutdovm coRditioR, iRcludiRg the EGGS. Systems classified as safety related.
This IC addresses a loss of Vital DC power which compromises the ability to moRitor aRd coRtrol SAFETY 8Y8TEM8. IA modes above Cold 8hutdowR, this coRditioR iRvolves a major failure of plaRt fuRctioRs Reeded for the protectioR of the public.
FifteeR miRutes was s~lected as a threshold to e,wlude traRsieRt or momentary power losses.
EscalatioR of the emergeRcy classificatioR level 1Nould be via ICs AGlB.Ql, FGl or 808.
DeYelof)er Notes:
The "site specific bus Yoltage value" should be based OR the miRimum bus voltage Recessary for adequate operatioR of SAFETY 8Y8TEM equipmeRt. This voltage value should iRcorporate a margiR of at least 15 miRutes of operatioR before the oRset of iRability to operate those loads.
This voltage is usually Rear the miRimum voltage selected wheR battery siziRg is performed.
The typical value for aR eRtire battery set is appFO>(imately 105 VDC. For a 60 cell striRg of batteries, the cell voltage is apprmdmately 1.75 Volts per cell. For a 58 striRg battery set, the miRimum voltage is approximately 1.81 Volts per cell.
The "site specific Vital DC busses" are the DC busses that provide moRitoriRg aRd coRtrol capabilities for SAFETY 8Y8TEM8.
EGL AssigRmeRt Attributes: 3.1.3.B 268
1'IBI 99 O I (ReYisioR e)
NoYemeer 2012 SG1 ECL: General Emergency Initiating Condition: Prolonged loss of al-l-ALL offsite and ALLalt onsite AC power to emergency essential buses.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot ShutdovmL..1.,__J Example Emergency Action Levels:
Note: The Emergency Director should declare the General Emergencyevent promptly upon determining that (site specific hours) the applicable time 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> has been exceeded, or will likely be exceeded.
- a.
Loss of ALL offsite and ALL onsite AC power to 1A3 and 1 A4 busesfsite-specific emergency buses).
AND
- b.
EITHER of the following:
Definitions:
_* _ Restoration of at least one AC emergency essential bus in less than fs-tte-specific hours)4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is not likely.
OR (Site specific indication of an inability to adequately remo*,e heat from the serejRPV level cannot be restored and maintained above -25 inches.
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the EGGS. Systems classified as safety related.
Basis:
This IC addresses a prolonged loss of all power sources to AC emergency essential buses. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A prolonged loss of these buses will lead to a loss of one or more fission product barriers. In addition, fission product barrier monitoring capabilities may be degraded under these conditions.
The EAL should require declaration of a General Emergency prior to meeting the thresholds for IC FG 1. This will allow additional time for implementation of offsite protective actions.
Escalation of the emergency classification from Site Area Emergency will occur if it is projected that power cannot be restored to at least one AC emergency essential bus by the end of the analyzed 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> station blackout coping period. Beyond this time, plant responses and event trajectory are subject to greater uncertainty, and there is an increased likelihood of challenges to multiple fission product barriers.
269
~JEI 99 QI (ReYisioA e)
~Je*remeer 2Q 12 The estimate for restoring at least one essentialemergency bus should be based on a realistic appraisal of the situation. Mitigation actions with a low probability of success should not be used as a basis for delaying a classification upgrade. The goal is to maximize the time available to prepare for, and implement, protective actions for the public.
270
NEI 99 0 I (RevisioA 6)
No¥ember 2012 The EAL will also require a General Emergency declaration if the loss of AC power results in parameters that indicate an inability to adequately remove decay heat from the core.
De*,reloper Notes:
Although this JG and EAL may be vie*,*,ced as redundant to the Fission Product Barrier IGs, it is included to provide for a more timely escalation of the emergency classification level.
The "site specific emergency buses" are the buses fed by offsite or emergency AG pov,*er sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typical I)' 1 emergency bus per train of SAFETY SYSTEMS.
The "site specific hours" to restore AG power to an emergency bus should be based on the station blackout coping analysis performed in accordance with 10 GFR § 50.63 and Regulatory Guide 1.155, Stetien Bkwkeut.
Site specific indication of an inability to adequately remove heat from the core:
[BWR]
Reactor vessel ;vater level cannot be restored and maintained above Minimum Steam Cooling RPV \\1/ater Level (as described in the EOP bases).
[PWR]
Insert site specific values for an incore/core e>dt thermocouple temperature and/or reactor vessel water le*,rel that drive entry into a core cooling restoration procedure (or othervrise requires implementation of prompt restoration actions). Alternately, a site may use incore/core e>(it thermocouple temperatures greater than l,200°F and/or a reactor vessel water level that corresponds to appro>(imately the middle of active fuel. Plants with reactor vessel level instrumentation that cannot measure down to approximately the middle of active fuel should use the lowest on scale reading that is not above the top of active fuel. If the lowest on scale reading is above the top of active fuel, then a reactor vessel level value should not be included.
For plants that have implemented Westinghouse Ovmers Group Emergency Response Guidelines, enter the parameters used in the Gore Cooling Red Path.
EGL Assignment Attributes: 3.1.4.B 272
NEI 99 0 I (ReYisioR 6) r>Jovemeer 2012 SG8SG2 ECL: General Emergency Initiating Condition: Loss of al-I-ALL AC and Vital DC power sources for 15 minutes or longer.
Operating Mode Applicability: Power Operation, Startup, Hot Standby, Hot Shutdown.l.,_l,_l Example Emergency Action Levels:
Note: The Emergency Director should declare the General Emergencyevent promptly upon determining that the applicable time 15 minutes has been exceeded, or will likely be exceeded.
- a.
- b.
Definitions:
Loss of ALL offsite and ALL onsite AC power to (site specific emergency
---b-u
... s-e-s)+-1A3 and 1A4 buses for 15_-minutes or longer.
AND Indicated voltage is less than (site specific bus voltage value) 105 VDC on Abb (site speeifie Vital DC busses) BOTH Div 1 and Div 2 125 VDC buses for 15 minutes or longer.
SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the EGGS. Systems elassified as safety related.
Basis:
This IC addresses a concurrent and prolonged loss of both AC and Vital DC power. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A loss of Vital DC power compromises the ability to monitor and control SAFETY SYSTEMS. A sustained loss of both AC and DC power will lead to multiple challenges to fission product barriers.
Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. The 15-minute emergency declaration clock begins at the point when both EAL thresholds are met.
De,*eleper Netes:
The "site specific emergency buses" are the buses fed by offsite or emergency AC pov;er sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typically l emergency bus per train of SAFETY SYSTEMS.
The "site specific bus voltage value" should be based on the minimum bus voltage necessar)' for adequate operation of SAFETY SYSTEM equipment. This Yoltage value should incorporate a margin of at least 15 minutes of operation before the onset of inability to operate those loads. This voltage is usually near the minimum voltage selected when battery sizing is performed.
273
NE[ 99 0 I (Re*,*isieA a)
Nevemeer 20 I 2 The typical value for an entire battery set is apprmlimately l 05 VDC. For a 60 cell string of batteries, the cell voltage is approximately 1.75 Volts per cell. For a 58 string battery set, the minimum voltage is apprmlimately 1.81 Volts per cell.
The "site specific Vital DC busses" are the DC busses that pro11ide monitoring and control capabilities for SAFETY SYSTEMS.
This IC and EAL 1.vere added to Revision 6 to address operating experience from the March, 2011 accident at Fukushima Daiichi.
EGL Assignment Attributes: 3.1.4.B 274
}ffil 99 0 I (Re\\*isioA e)
}fo\\1eme er 2012 APPENDIX A - ACRONYMS AND ABBREVIATIONS AC...................................................................................................................... Alternating Current AOP................................................................................................. Abnormal Operating Procedure A
.......................................................................................................................................... r, PFJi.4.................................................................................................... /\\verage Po1.ver Range Meter ATWS................................................................................... Anticipated Transient Without Scram
.......................................................................................................................................... 8
&¥.'................................................................................................................... Babcock and \\l/ilcox
.......................................................................................................................................... B HT....................................................................................... Boron Injection Initiation Temperature BWR............................................................................................................. Boiling Water Reactor CDE...................................................................................................... Committed Dose Equivalent CFR...................................................................................................... Code of Federal Regulations CT~4T/CNMT............................................................................................................... Containment
.......................................................................................................................................... C 8F................................................................................................................ Critical Safety Function
.......................................................................................................................................... C 8F8T........................................................................................ Critical Safety Function Status Tree
.......................................................................................................................................... D BA................................................................................................................. Design Basis i\\ccident DC.............................................................................................................................. Direct Current EAL........................................................................................................... Emergency Action Level ECCS............................................................................................ Emergency Core Cooling System ECL................................................................................................ Emergency Classification Level EOF.................................................................................................. Emergency Operations Facility EOP............................................................................................... Emergency Operating Procedure EPA............................................................................................. Environ1nental Protection Agency EPG............................................................................................... Emergency Procedure Guideline
.......................................................................................................................................... E PIP................................................................................... gmergency Plan Implementing Procedure
.......................................................................................................................................... E PR......................................................................................................... gyolutionary Po\\ver Reactor
.......................................................................................................................................... E PRJ............................................................................................... Electric Power Research Institute
.......................................................................................................................................... g RG.................................................................................................. Emergency Response Guideline
.......................................................................................................................................... F EMA................................................................................ Federal Emergency Management Agency f8AR................................................................................................... fin al Safety Analysis Report GE...................................................................................................................... General Emergency HC+ L.......................................................................................... Heat Capacity Temperature Limit HPCI.............................................................................................. High Pressure Coolant Injection
.......................................................................................................................................... H 81................................................................................................................ Human System Interface IC........................................................................................................................ lnitiating Condition
Nel 99 01 (Re\\'isioA e)
T>lo¥efl'leer 2012
.......................................................................................................................................... I D............................................................................................................................... Inside Diameter IPEEE............................. Individual Plant E>rnmination of External Events (Generic Letter 88 20)
ISFSI........................................................................... Independent Spent Fuel Storage Installation Keff.................................................................................... Effective Neutron Multiplication Factor LCO............................................................................................... Limiting Condition of Operation
.......................................................................................................................................... L OCA.......................................................................................................... Loss of Coolant Accident
- ** *********************************** ** ************ ** ** ************* ************** *************************** ****** ~4 CR..................................................................................................................... ~4ain Control Room
.......................................................................................................................................... ~4 SIV........................................................................................................ ~4ain Steam Isolation Valve
~<ISL....................................................................................................................... ~<fain Steam Line mR, mRem, mrem, mREM............................................................ milli-Roentgen Equivalent Man MW.................................................................................................................................... Megawatt NEI............................................................................................................. Nuclear Energy Institute
.......................................................................................................................................... l>+
PP..................................................................................................................... l'+uclear Po\\ver Plant
.......................................................................................................................................... N RC................................................................................................. Nuclear Regulatory Commission NSSS................................................................................................. Nuclear Steam Supply System NORAD................................................................. North American Aerospace Defense Command fNO)UE.......................................................................................... fNotification Off Unusual Event NUMARC 1 ** ****** *** ************** ********************************* ****
- Nuclear Management and Resources Council OBE....................................................................................................... Operating Basis Earthquake OCA............................................................................................................. Owner Controlled Area
.......................................................................................................................................... 0 f)GMLODAM......................................................... Offsite Dose Calculation (Assessment) Manual ORO................................................................................................ Off site Response Organiz:ation PA.............................................................................................................................. Protected Area
.......................................................................................................................................... p ACS...................................................................................... Priority Actuation and Centro I System PAG....................................................................................................... Protective Action Guideline
- ******** ** ******* ***** ***** ** **** **** ************************************* ***** ************** **** ** ** **** ** ****** p JCS................................................................................... Process Information and Control System PRA/PSA.................................... Probabilistic Risk Assessment / Probabilistic Safety Assessment PWR........................................................................................................ Pressurized Water Reactor
- ** ****** ******** ******************* p S........................................................................................................................... Protection System PSIG................................................................................................. Pounds per Square Inch Gauge R......................................................................................................................................... Roentgen
.......................................................................................................................................... R CC.............................................................................................................. Reactor Control Console RCIC............................................................................................... Reactor Core Isolation Cooling 1 NUMARC was a predecessor organization of the Nuclear Energy Institute (NEI).
A-2
NE! 99 0 I (Re¥isioA 6)
~io¥ember 2012 RCS............................................................................................................. Reactor Coolant System Rem, rem, REM...................................................................................... Roentgen Equivalent Man
.......................................................................................................................................... R ETS......................................................................... Radiological Effluent Technical Specifications RPS......................................................................................................... Reactor Protection System RPV............................................................................................................. Reactor Pressure Vessel
.......................................................................................................................................... R VLIS......................................................................... Reactor Vessel Level Instrumentation System RWCU.......................................................................................................... Reactor Water Cleanup
.......................................................................................................................................... s AR................................................................................................................ Safet)',<\\nalysis Report