ML19274B077

Non- Concurrence Process - Oconee Nuclear Station, Units 1, 2, and 3, Issuance of Amendments Regarding the Physical Security Plan

ML19274B077
Person / Time
Site:	Oconee
Issue date:	09/30/2019
From:	Audrey Klett Plant Licensing Branch II
To:	Louis Cubellis, Pamela Lee Office of Nuclear Reactor Regulation
Klett A, 415-0489
References
EPID L-2018-LLA-0042, NCP-2019-001
Download: ML19274B077 (86)

Text

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION (12-2018)

NRG MD 10.156 NON-CONCURRENCE PROCESS COVER PAGE The U.S. Nuclear Regulatory Commission (NRC) strives to establish and maintain an environment that encourages all employees to promptly raise concerns and differing views without fear of reprisal and to promote methods for raising concerns that will enhance a strong safety culture and support the agency's mission.

Employees are expected to discuss their views and concerns with their immediate supervisors on a regular, ongoing basis. If informal discussions do not resolve concerns, employees have various mechanisms for expressing and having their concerns and differing views heard and considered by management.

Management Directive, MD 10.158, "NRC Non-Concurrence Process," describes the Non-Concurrence Process (NCP).

The NCP allows employees to document their differing views and concerns early in the decisionmaking process, have them responded to (if requested), and include them with proposed documents moving through the management approval chain to support the decisionmaking process.

NRC Form 757, "Non-Concurrence Process," is used to document the process.

Section A of the form includes the personal opinions, views, and concerns of a non-concurring NRC employee.

Section B of the form includes the personal opinions and views of the non-concurring employee's immediate supervisor.

Section C of the form includes the agency's evaluation of the concerns and the agency's final position and outcome.

NOTE: Content in Sections A and B reflects personal opinions and views and does not represent the official agency's position of the issues, nor official rationale for the agency decision. Section C includes the agency's official position on the facts, issues, and rationale for the final decision.

1. If the process was discontinued, please indicate the reason (and skip to #3):

D Non-concurring employee(s) requested that the process be discontinued D Subject document was withdrawn

2. At the completion of the process, the non-concurring employee(s):

D Concurred

[Z] Continued to non-concur D Agreed with some of the changes to the subject document, but continued to non-concur

3. For record keeping purposes:*

D This record is non-public and for official use only 0 This record has been reviewed and approved for public dissemination NRG FORM 757 (12-2018) Use ADAMS Template NRC-006 (ML063120159) Page 1 of 5

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION 1. NCP Tracking Nurraber (12-2018) NCP-2019-001 NRC MD 10.156 NON-CONCURRENCE PROCESS (Continued)

Date 03/08/2019 Section A -To Be Completed By Non-Concurring Employee

2. Title of Subject Document 3. ADAMS Accession Number Oconee Nuclear Station, Units 1, 2, and 3, Issuance of Amendments Regarding the Physical Security Plan (EPID No. L 2018-LLA-0042) ML19056A086

4. Document Signer 5. Document Signer's Phone Number (Enter 10 numeric digits)

Audrey Klett (301) 415-0489

6. Title of Document Signer 7. Office (Choose from the drop down list or fill in)

Project Manager, Plant Licensing Branch 11-1 NRR

8. Name of Non-Concurring Employee(s) 9. Employee's Telephone Number (Enter 10 numeric digits)

Pete Lee, Louis Cubellis, Rupert Rockhill (301) 287-3690

10. Title of Non-Concurring Employee 11. Office (Choose from the drop down list or fill in)

Senior Security Program Manager and Specialist NSIR 12.

D Document Author D Document Contributor D Document Reviewer 0 On Concurrence

13. Name of Non-Concurring Employee's Supervisor 14. Office (Choose from the drop down list or fill in)

Michele Sampson NSIR

15. Title of Non-Concurring Employee's Supervisor 16. Supervisor's Telephone Number (Enter 10 numeric digits)

Chief, Reactor Security Branch (301) 415-7493 17.

0 I would like my non-concurrence considered and would like a written evaluation in Section B and C.

D I would like my non-concurrence considered, but a written evaluation in Sections Band C is not necessary.

18. When the process Is complete, I would like the NRC Form: [Z] Public D Non-Public

19. Reasons for the Non-Concurrence, Potential Impact on Mission, and the Proposed Alternatives The staff non-concur with the Safety Evaluation (SE) Section 2, "Regulation Evaluation," and Section 3, "Technical Evaluation," and Section 6, "Conclusion," based on the following:

(1) The NRC evaluations and conclusion are based on incomplete and inaccurate information (2) The NRC evaluations and conclusion are inadequate based on consensus facts.

(3) The NRC evaluations and conclusion did not adequately address obligation of Duke Energy to comply with regulatory requirements.

(4) The NRC evaluation and conclusion did not adequately address compliance with security regulatory requirements.

(5) The NRC evaluations and conclusion did not adequately address compliance with approved Duke Energy Physical Security Plan.

(6) The NRC evaluations and conclusion did not consider safety/risk insights for informed regulatory and technical evaluation for the safety/security interface.

The details of the reasons for the non-concurrence (evaluations of the regulatory, technical, legal, security/safety significances. and safety/risk insights) are provided in Sections A.1 through A.5. Section A.5 also includes a recommendation for oversight of whether licensees have adequately met the requirements of 10 CFR 73.55 for vital equipment and vital areas with the identification of a complete and accurate list of vital equipment.

Section A.6, contains the non-concurring NRC staffs proposed alternatives.

NRC FORM 757 (12-2018) Use ADAMS Template NRC-006 (ML063120159) Page 2 ofS

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION 1. NCP Tracking Number (12-2018) NCP-2019-001 NRCMD10.156 NON-CONCURRENCE PROCESS (Continued)

Date 03/08/2019 Section A.7 provides the references of documents relevant and examined in the due diligent effort to verify and gather information relevant, including the understanding of safety/security significances and their interfaced to inform and prepare the non-concurrence.

The information contained in Sections A.1 through A.7 has been reviewed and determined to be uncontrolled information; contains no official-use.,only security-related information, safeguards information, or proprietary information; and is portioned marked with the designation "(U)."

See Attachments.

• Peter Lee and Rupert Rockhill concurrence via email.

20. Signature and Date of Non-Concurring Employee Digitally signed by Louis J. Cubellis Louis J. Cubellis Date: 2019.03.1111:32:08-04'00' NRC FORM 757 (12-2018) Use ADAMS Template NRC-006 (ML063120159) Page 3 of5

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION 1. NCP Tracking Number (12-2018) NCP-2019-001 NRC MD 10.156 NON-CONCURRENCE PROCESS (Continued) Date 03/08/2019

.,~- "' - .. -... ,.

2. Title of Subject Document 3. ADAMS Accession Number Oconee Nuclear Station, Units 1, 2, and 3, Issuance of Amendments Regarding the Physical Security Plan (EPID No. L 2018-LLA-0042) ML19056A086

4. Name of Non-Concurring Employee's Supervisor 5. Office (Choose from the drop down list or fill in)

Michele Sampson NSIR

6. Title of Non.Concurring Employee's Supervisor 7. Supervisor's Telephone Number (Enter 10 numeric digits)

Chief, Reactor Security Branch (301) 415-7493

8. Comments for the NCP Reviewer to Consider I support my staffs efforts to express their views on this Oconee Nuclear Station license amendment request. The non-concurring staff have clearly put a significant effort into identifying their concerns and provided detailed background and supporting information. Consideration of concerns and other viewpoints improves decisionmaking and supports our safety and security mission, and I appreciate their willingness to engage in this process.

9. Signature and Date of Non.Concurring Employee's Supervisor Digitally signed by Michele M. Sampson Michele M. Sampson Date: 2019.03.12 15:42:46 -04'00' NRC FORM 757 (12-2018) Use ADAMS Template NRC-006 (ML063120159) Page 4 of 5

NRC FORM 757 U.S. NUCLEAR REGULATORY COMMISSION 1. NCP Tracking Number (12-2018) NCP-2019-001 NRC MD 10.156 NON-CONCURRENCE PROCESS (Continued) Date 03/08/2019

2. Title of Subject Document 3. ADAMS Accession Number Oconee Nuclear Station, Units 1, 2, and 3, Issuance of Amendments Regarding the Physical Security Plan (EPID No. L 2018-LLA-0042) ML19056A086

4. Name of NCP Coordinator 5. Office (Choose from the drop down list or fill in)

Audrey Klett NRR

6. Title of NCP Coordinator 7. Coordinator's Telephone Number (Enter 10 numeric digits)

Project Manager (301) 415-0489

8. Agreed Upon Summary of Issues See Attachment, Section 3.

9. Evaluation of Non-Concurrence and Rationale for Decision See Attachment for detailed evaluation and rationale. In summary, NRR/DORL staff conclude that the licensee's current configuration is consistent with its licensing basis and that the non-concurring staffs' concerns would need to be addressed via the backfit process if pursued further. Therefore, NRR/DORL is proceeding with issuing the amendments. Based on the evaluation performed to address this non-concurrence, DORL staff updated the licensing basis discussion in the safety evaluation.

NOTE: One of the non-concurring staff members retired before NRR/DORL completed its evaluation; therefore, DORL staff was unable to complete Section A for that individual.

Page 5 of 5

The Enclosure 4, Safety Evaluation (SE), "Safety Evaluation by the Office of Nuclear Reactor Regulation and the Office of Nuclear Incident Response, Amendment No. 411 to Renew Facility Operating License No. DPR-38, Amendment No. 413 to Renewed Facility Operating License No. DPR-47, Amendment No. 412 to Renewed Facility Operating License No. DPR-55, Duke Energy Carolinas, LLC, Oconee Nuclear Station, Units 1, 2, and 3, Docket No. 50-269, 50-270, and 50-287," Agencywide Document Access and Management System (ADAMS) Accession No. ML19056A086, documents the staff evaluations and findings for Duke Energy's license amendment request (LAR) No. LAR-2018-001 submitted on February 12, 2018 (ADAMS Accession No. ML18046A080).

The staff non-concur with the Safety Evaluation (SE) Section 2, "Regulation Evaluation," and Section 3, 'Technical Evaluation," and Section 6, "Conclusion," based on the following:

(1) The NRG evaluations and conclusion are based on incomplete and inaccurate information (See Section A.1)

(2) The NRG evaluations and conclusion are inadequate based on consensus facts. (See Section A.2)

(3) The NRG evaluations and conclusion did not adequately address obligation of Duke Energy to comply with regulatory requirements (4) The NRG evaluation and conclusion did not adequately address compliance with security regulatory requirements. (See Section A.4)

(4) The NRG evaluations and conclusion did not adequately address compliance with approved Duke Energy Physical Security Plan. (See Section A.5)

(5) The NRG evaluations and conclusion did not consider safety/risk insights for informed regulatory and technical evaluation for the safety/security interface (See Section A.6)

The details of the reasons for the non-concurrence (evaluations of the regulatory, technical, legal, security/safety significances, and safety/risk insights) are provided in Sections A.1 through A.5, as indicated above.

Also Section A.6, contains the non-concurring NRG staffs proposed alternatives. Section A.5 also include a recommendation for oversight of whether licensees has adequate met the requirements of 10 CFR 73.55 requirements for vital equipment and vital areas with the identification of a complete and accurate list of vital equipment.

Section A. 7 provides the references of documents relevant and examined in the due diligent effort to verify and gather information relevant, including the understanding of safety/security significances and their interfaced to inform and prepare the non-concurrence.

The information contained in Sections A.1 through A. 7 has been review and determined to be undesignated information, contain no official-use-only security-related information, safeguards information, or proprietary information and is portioned with the designation

"(U)."

Page 1 of 56

(U) SECTION A.1 INCOMPLETE AND INACCURATE INFORMATION (U) The Enclosure 4, Safety Evaluation (SE), "Safety Evaluation by the Office of Nuclear Reactor Regulation and the Office of Nuclear Incident Response, Amendment No. 411 to Renew Facility Operating License No. DPR-38, Amendment No. 413 to Renewed Facility Operating License No. DPR-47, Amendment No. 412 to Renewed Facility Operating License No. DPR-55, Duke Energy Carolinas, LLC, Oconee Nuclear Station, Units 1, 2, and 3, Docket No. 50-269, 50-270, and 50-287," Agencywide Document Access and Management System (ADAMS} Accession No. ML19056A086, documents the staff evaluations and findings for Duke Energy's license amendment request (LAR} No. LAR-2018-001 submitted on February 12, 2018 (ADAMS Accession No. ML18046A080}.

(U) The NRC non-concurring staff do not concur with the NRC Safety Evaluation (SE} Section 2, "Regulation Evaluation," and Section 3, 'Technical Evaluation," and the resulting Section 6, "Conclusion" on the basis of that the evaluations and conclusion are based on information that are not complete and accurate. The inadequacies raises the following:

1. (U) The NRC SE is based on licensee's information that is not complete and accurate (contrary to the requirement of 10 CFR 50.9}. The non-concurring staff determined that Duke Energy's statements of assertions, explicit and/or implicit, in the LAR-2018-001 for Oconee Nuclear Station Units 1, 2, and 3 are incomplete and inaccurate representations of the safety and security regulatory and technical bases and the safety/risk significance of the matters described in the LAR No. LAR-2018-001.

2. (U) The NRC SE is based on licensee's information that is not complete and accurate, and information that was not independently verified and evaluated. The staff's evaluation does not provide assurance that the regulatory and technical evaluations and results are sufficiently accurate or complete and independent or reliable for the NRC to make the appropriate regulatory decisions and permit regulatory action's with conclusions, as indicated in the Safety Evaluation Section 6, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

3. (U) The SE findings in Section 6, "[t]he Commission has concluded, based on the considerations above [Regulatory Evaluation and Technical Evaluation]: (1) there is reasonable assurance that the health and safety of the public will not endanger by operations in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public" is not defensible based on a foundation built on incomplete and inaccurate information.

(U) The non-concurring staff due diligent review and verification of Duke Energy's information submitted with the LAR No. LAR-2018-001 is provided below that confirm and demonstrates that information submitted were incomplete and inaccurate, including explicit statements that were determined to be apparently false. The regulatory evaluation and subsequently technical evaluations and conclusions documented in the SE did not independently evaluate the information and did not seek through request for additional information to provide complete and accurate findings.

Page 2 of 56

(U) DETAIL REASONS (REGULATORY. TECHNICAL, LEGAL, SAFETY/RISK-INFORMED)

FOR NON-CONCURRENCE (U) The following describes and identifies unsupported Duke Energy's assertions (explicit and/or implied) that are incomplete and inaccurate information, material false statements, to the Commission in the submission of amendment request, ADAMS Accession No. ML18046A080, Letter (ONS-32018-014) from J.E. Burchfield, Jr., Duke Energy, Oconee Nuclear Station, to NRC, Document Control Desk, dated February 12, 2018. The subject of the letter is "License Amendment Request (LAR) for Changes to the Duke Energy Physical Security Plan, License Amendment Request No. 2018-01" and the letter enclosed an "Evaluation of Proposed Changes" with attachments: (1) Marked-Up PSP Pages and (2) Retyped (Clean) PSP Pages.

The bases and discussions are provided for each assertion that were found to be incomplete or inaccurate.

(U) The 10 CFR Part 50 establish requirements in Section 50.90, "Application for amendments of license, construction permit, or early site permit," Section 50.4, "Written Communications,"

and Section 50.9, "Completeness and accuracy of information" that "Information provided to the Commission by an applicant for a license or by a licensee or information required by statute or by the Commission's regulations, orders, or license conditions to be maintained by the applicant or the licensee shall be complete and accurate in all material respects."

(U) The non-concurring staff found that following statements are incomplete, inaccurate, and/or misrepresentations that forms the unsupported assertions, material false statements, in the Duke Energy's amendment request submitted to the NRC in LAR No. LAR-2018-001 on February 12, 2018. The licensee did not meet the requirements of 10 CFR 50.9, "Completeness and accuracy of information."

(1) (U) Section 1, Summary Description (1st paragraph, Page 1 of 10):

(U) Duke Energy states:

(U) "... These changes are being made in response to discussions with the NRG regarding the 10 CFR 73.55(e) designation of the [intentionally not stated].

First is the incorporation of additional security measures that provide increased protection for the [intentionally not stated] under specific infrequent short-tenn plant conditions. Second is the installation of a {intentionally not stated] system in the [location intentionally not stated]."

(U) Duke Energy identifies and indicates that the proposed security measures for the structures, systems, and components [intentionally not stated], referred here on as "the component," that is subject of the amendment request as "increase protection," and "voluntarily pursing modification" and implies that they, in parts, address the requirements of the 2009 final rule that all licensees must be in full compliance by March 21, 2010. The following specific requirements, not only 10 CFR 73.55(e) as stated by Duke Energy, must be met by all currently operating licensees. The requirements of 10 CFR 73.55 may not be characterized or presented by Duke Energy as "measures that provide increased protection" (Page 1) and "voluntarily made to further increase the margin of protection" (Page 3), but are security measures addressing some of the prescriptive and performance requirements for adequate protection.

Page 3 of 56

(U) The following list, but not limited to, regulatory requirements that would be applicable as on the regulatory basis and technical evaluation of structures, systems, and components that are performing vital functions that meet the definition of 10 CFR 73.2 for vital equipment:

(U) Definitions: 10 CFR 73.2: Continuous Visual Surveillance, Controlled Access Area, Intrusion Alarm, Isolation Zone, Lock, Physical Barrier, Protected Area, Vital Area, Vital Equipment 10 CFR 73.3: Interpretations - Except as specifically authorized by the Commission in writing, no interpretations of the meaning of the regulations in this part by any officer or employee of the Commission other than a written interpretation by the General Counsel will be recognized as binding upon the Commission (U) General Requirements: 10 CFR 73.55 (b) all but specifically- (b}(1), (b)(2},

(b)(3)(i) and (3)(ii); 10 CFR 73.55(b}(4}, 10 CFR 73.55 (e)(1}, (2), (3), (4), (7), (8),

(9) and (10)(i) and (10)(ii}, and 10 CFR 73.55(f)(3}, which include but not limited to prescriptive requirements for physical barrier, protected areas, and vital areas requirements, and 10 CFR 73.55(f)(3) for target sets (U) Protected Area: 10 CFR 73.55(g)(1)(i), (g)(2), (g)(3), (g)(4) and (4)(i) and (4)(ii}, (g)(5}, (g)(6)(i) and (6)(ii}, (g)(7) and (g)(8)

(U) Searches: 10 CFR 73.55(h)(1 }, (h)(3)(i) and (3)(v)

(U) Detection and Assessment: 10 CFR 73.55(i)(1) through (1)(6)

(U) Duke Energy's LAR No. LAR-2018-001 identified a specific additional security measure as voluntary (page 3). The requirements of 10 CFR 73.55(b}(2) and 73.55(e)(3)(i}, and 73.55(e)(10) apply to all licensees, without exceptions. Duke Energy had not requested exemptions and the NRC had not granted exemptions from any requirements in 10 CFR 73.55.

Duke Energy's assertions that the proposed additional measure is an increased protection, and voluntary, beyond what is required or not necessary, respectively, is not supported by the regulatory basis that all licensees are obligated to meet the requirements in 10 CFR 73.55, which includes Sections 73.55(b)(2), 10 CFR 73.55(e), and other sections.

(U) Duke Energy's descriptions in the LAR No. LAR-2018-001 misrepresents to the NRC information of record for the Oconee Nuclear Station on the docket by specifying selected excerpts or citations of incomplete historical records and misrepresents the proposed measures in the LAR No. LAR-2018-001 as additional protection to increase margin, voluntary, or provided only under specific short-term plant condition (Page 3).

(2) (U) Section 2, Background (second paragraph, Page 1 of 10)

(U) Duke Energy states:

(U) "In 1997 and 1978 Duke had dialogue with the NRC regarding alternate measures to meet newly issued regulation regarding fire, flood, and sabotage. The alternative measures consisted of an alternative train of equipment (designated Standby Shutdown Page 4 of 56

System or SSS). This proposal was approved in a December 1978 letter from NRC (Robert W. Reid) to Duke (William 0. Parker) which included the following relevant comments:

• (U} "... the number of vital areas can be reduced when the SSS is in operation."

• (U} "The conceptual design ... will ... provide relief from the requirements of the modified Amended Security Program in regard to designation of vital areas."

(U} Duke Energy selected and limited quotations inaccurately and incompletely and used these to represent the publically available December 6, 1978 letter from Reid (NRC) to Parker (DPC).

The letter conveying the NRC position on the proposal of a safe shutdown system (SSS or later referred as standby shutdown facility (SSF)), which did not explicitly (or implicitly) indicate that "the component" that is the subject matter of the LAR is exempted from regulatory requirements of 10 CFR 73.55. The letter conveyed the NRC position that the conceptual design of the SSS does not provide functions for emergency core cooling for all postulated accidents or sabotage scenarios and does not transfer to, and maintain, a cold shutdown mode following implementation of the SSS hot shutdown operations. The conceptual design of the SSS did not describe the capabilities of redundancy to the function of "the component." The December 6, 1978 NRC letter approved a conceptual design of the SSS only and did not provide the NRC approval of a reduction of vital areas or the Commission approval of exemptions to requirements in 10 CFR 73.55 for "the component."

(U} The December 6, 1978 NRC letter from Reid to Parker (publically available) stated the following:

(U} "CONCLUSIONS" (U} "The conceptual design of the SSS will result in a final design that will provide a dedicated independent shutdown system if the licensee designs it to the above mentioned criteria and follows the NRG conditions appended to the criteria. The conceptual design, as conditioned above, will meet the Fire Protection Program requirements of the NRG August 11, 1978 License Amendment, provide relieffrom the requirements of the Modified Amended Security Program in regard to designation of vital areas and provide adequate protection against flooding of vital systems in the Turbine Room basement by providing alternate shutdown capability. We conclude the conceptual design is acceptable."

(U} The following is conveyed in the same letter:

(U} "We have found the conceptual design of the system to be acceptable. Our review is presented in the enclosed Concept Evaluation. NRG approval of the final design is required before you make any modifications which affect existing safety related structures or systems. Credit cannot be assumed for the effect of the completed modifications on the fire protection, security and flooding considerations until our final acceptance of the modifications. We request that you identify and justify those portions of the final design not meeting NUREG 751087. Kindly submit the final design within 15 months of date of this letter."

Page 5 of 56

(U) The enclosure of the December 6, 1978 NRC letter, "Oconee Nuclear Station Safe Shutdown System Concept Evaluation," included the following NRC position:

(U) "Oconee nuclear Station is currently being reviewed by the NRG in the areas of fire.

protection, physical security (10 CFR 73. 55) and flooding of the turbine building. The fire protection and flooding review deals with the capability to safely shutdown the plan if vital systems are disabled. The physical security deals with the definition of vital areas under the rule: the number vital areas can be reduced when the standby shutdown is in operations." (Introduction, Page 1)

(U) "This evaluation covers our review of the proposed functional aspects of the SSS which will be used to supply adequate primary and secondary system coolant for the removal of decay heat. The planned capability of the SSS is to maintain hot shutdown conditions in all units for approximately three and one-half days following loss of normal power to the reactor coolant pumps (emergency conditions)." (Discussion, Page 1)

(U) "However, to ensure that the final design will perform as intended, the licensee must include additional information, and engineering evaluations as described in the appropriate sections of NUREG 751087. In particular, the licensee must show that the makeup system will provide adequate cooling volume to maintain a sufficient level in the pressurizer to assure natural circulation under the most conservative conditions. The licensee's final design should also provide information on the plants design capabilities to transfer to, and to maintain, a cold shutdown mode following implementation of the SSS hot shutdown operations." (Emergency Makeup System, Page 3)

(U) The above conveys a portion of the NRC position and understanding that the proposed conceptual design of the SSS, and its limited safety functions and capabilities to address certain postulated design basis accidents, but not other postulated design basis accidents. The Duke Energy proposed conceptual design for the SSS and its design functions do not provide redundancy to "the component." The NRC did not address the matters as asserted by Duke Energy, with the reference to the December 6, 1978.

(U) Prior to the NRC December 6, 1978, the subject of a proposed design of the SSS, its functions and capabilities, were further documented in Summary of public meeting held on January 18, 1978, "To Discuss a Proposed Safe Shutdown System (SSS) for Oconee,"

(publically available). The following address the design and intended safety functions and capabilities of the SSS:

(U) "Our purpose in meeting today is to describe the Safe Shutdown System that we propose for utilization at Oconee Nuclear Station. The system would bring all or any combination of units, if necessary, to a shutdown conditions: in response to certain postulated accidents or sabotage scenarios. The system is not designed for emergency core cooling nor is it intended to be redundant to the EGCS equipment function. The system is one aspect of Oconee security systems; other aspects have been previously discussed with NRG." (Page 1)

(U) The information from the summary of meeting above and in the letter and enclosure of NRC December 6, 1978 does not support the Duke Energy assertions, explicit or implicit, that the SSS (now called the SSF) provides the safety functions and capabilities that are equivalent or redundant to "the component," nor support the Duke Energy's assertions that the NRC provided Page 6 of 56

approval to reduced number of vital areas and a relief from the requirements based on the installation of the SSS.

(U) Duke Energy misrepresented and implied that the NRC acceptance of the proposal, conceptual design of SSS, was NRC approval for exemptions (or relief) from regulatory requirements of 10 CFR 73.55, including applying the definition vital equipment and its application to designate structures, systems, and components as vital equipment. Duke Energy also misrepresents or implies that the SSS provides redundant functions for "the component,"

which was not a part of the conceptual design for the SSS described in the NRC December 6, 19781etter.

(U) In the December 6, 1978 NRC letter to Duke Energy, and enclosure, the NRC did not address "the component." Specifically the NRC did not:

• (U) provide approval that the number of vital areas can be reduced

• (U) provide approval for any specific exemption to 10 CFR 73.5 or 10 CFR 73.55 requirements)

• (U) provide approval of any alternatives under provisions of 10 CFR 73.55(a) to 10 CFR 73.55 requirements

• (U) Refer to or discuss "the component."

(U) The non-concurring staff notes that Section 10 CFR 73.55(a), alternatives, prior to issuance of 2009 final rule, revising Section 10 CFR 73.55 and other sections of 10 CFR Part 73, was the following:

(U} "[t]he Commission may authorize an applicant or licensee to provide measures for protection against radiological sabotage other than those required by this section if the applicant or the licensee demonstrates that the measure have the same high assurance objectives as specified in this paragraph and that the overall level of system performance provides protection against radiological sabotage equivalent to that which would be provided by paragraph (b) through (h) of this section and meet the general performance requirement of this section."

(U) No NRC record was found to indicate that the NRC approved specific exemptions in accordance with provision of 10 CFR 73.5 for requirements of 10 CFR 73.55 prior to the final revised rule of 2009 or prior to or after the implementation date of March 2010. There is also no NRC record that the NRC approved alternatives providing equivalent protection in accordance with 10 CFR 73.55(a), prior to 2009 final rule, or in accordance with 10 CFR 73.55(r), before or after implementation of 2009 revised rule, with regards to "the component."

(3) (U} Section 2, Background (second paragraph, Page 2 of 10)

(U) Duke Energy states:

(U) "Additionally a July 17, 1986 letter from NRC (John F. Stolz) to Duke (H.B.

Tucker) communicated the results of the NRC's Regulatory Effectiveness Review (RER) which concluded that Duke's plan to vitalize [intentionally not stated] in place of other safety systems is an acceptable approach. It also states, "When Page 7 of 56

the SSS become operational, the licensee intends that the [intentionally not stated] will no longer be designated as vital."

(U) Duke Energy statements above assert or imply that the NRG approved Duke Energy's plans to change the designation of equipment that meets the definition as vital equipment and implied that the NRG provided approval of exemptions to requirements of 10 CFR 73.55, that included the protection of vital equipment and protection against the design basis threat for radiological sabotage.

(U) The NRG letter transmitting the NRG findings, Safety Evaluation by the Officer of Nuclear Regulatory Regulation, Oconee Nuclear Station Standby Shutdown Facility, Duke Power Company, Docket Nos. 50-269, 50-270, and 50-287," addressed the evaluations and findings for the SSF capabilities relative to mitigating postulated fires, turbine building flooding and security incidents.

(U) The NRG Safety Evaluation addressing the SSF system descriptions, capabilities related to plant reactor cooling makeup, auxiliary service water, electrical power supply, normal AC power supply, standby power supply, DC power supply, support subsystems, service water subsystems, SSF HVAC system, building sump subsystem, portable water subsystem, and instrumentation and controls in Section 1. The NRG technical evaluations addressed the structure design, seismic subsystem analysis, dynamic testing and analysis of mechanical components, ASME codes, inservice testing, seismic and dynamic qualification of Category I electrical equipment, fire protection, safe shutdown systems, area where dedicated shutdown is required, remaining plant area, performance goal, source range flux, steam generator pressures, instrumentation guideline, repair requirement, circuits and isolation, safe shutdown procedures and manpower, and conclusion for the FSS, and flooding review in Sections 4.0 Through

4. 7.9 of the Safety Evaluation.

(U) The NRG Safety Evaluation Section 4.8, "Conclusion," stated the following:

(U) "Based on our review, we concluded that the ONS design will provide one train of systems necessary to achieve and maintain safe shutdown conditions by utilizing either the control room or the SSF in conjunction with undamaged systems in the fire affected unit, and thus will meet the requirement of Appendix R to 10 CFR 50, Section 111.G.3 and 111.L with respect to safe shutdown in the event of a fire, with the exceptions of the availability of a source range flux monitor and steam generator pressure indication at the SSF."

(U) Section 4.9,"Security Review," of the Safety Evaluation stated the following:

(U) "The licensee submitted physical security, contingency planning, and guard training and qualification plan in accordance with requirements of 10 CFR Part 73, Section 73.55 and Appendices Band C. We have detennined that these plan satisfy regulatory requirements and accordingly have been approved. The acceptability of the licensee identification of vital area required to be protected by 10 CFR 73.55(c) is contingent upon confirmatory analysis to be perfonned by the NRG at a future date."

(U) "The SSF, with its capability to independently bring the reactor to safe shutdown mode [MODE 3, Hot Standby, Table 1.1-1 "MODES'J increases Page 8 of 56

significantly the defense-in-depth characteristics of the facility and provides incremental protection against both internal and external sabotage."

(U) The NRC letter dated July 17, 1986, from J. Stolz to Tucker, "Oconee Nuclear Station, Units 1, 2, and 3 - Regulatory Effectiveness Review," (publically available) stated the following for the enclosed report documenting the NRC regulatory review (i.e.,

a confirmatory review):

(U) "The enclosed portion of the RER report present the findings of the Regulatory Effectiveness Review and do not, in themselves, constitute a requirement for any licensing action. However, some of the findings could constitute potential items of non-compliance. If such findings have not already been addressed during an inspection by the NRG Regional Office, they could be in a future inspection. We recommend that you review your plan in light of these findings and initiate any corrective action necessary to ensure that any possible item of non-compliance are corrected expeditiously. "

(U) "The vital area part of the report is provided to keep you informed of the results of the Los Almos National Laboratory vital area analysis of your plant. It is not intended to convey any new or changed NRG staff position or backfit. In fact, NRG policy concerning vital areas is presently undergoing staff review.

Once the NRG adopts a final position regarding the identification of vital equipment, the vital area analyses of all plant including Oconee Nuclear Station, will be reevaluated from a licensing perspective."

(U) The NRC letter dated July 17, 1986, transmitting results of NRC regulatory effectiveness review did not: (a) provide new requirements; (b) provide approval of alternative to security requirements in 10 CFR 73.55; (c) provide approval of exemptions to requirements in 10 CFR 73.55; (d) provide inspection findings; or (e) provide a new NRC positions.

(U) The NRC regulatory effectiveness review did not determined or provided the safety basis different from what was in the NRC documented findings for the SSF in the Safety Evaluation dated April 23, 1983, and does not support the Duke Energy assertion that the approval of the SSS (i.e., SSF), its functions and capabilities, is a substitute for "the component" (functions and capabilities).

(U) Additional information on the RER is provided in September 04, 1985 NRC memorandum, from J. Stohr (Division of Radiation Safety and Safeguard) to R. Burnett (Division of Safeguards, NMSS), "Regulatory Effectiveness Review of Oconee Nuclear Station September 19-25, 1985" (NS104815, not publically available). It described the intention of Duke Power's plans in the near future to place in service the SSF, in accordance with its approved security plan, to devitalize certain plant areas in the power block, including the area of "the component." The internal memo stated:

(U) "The licensee recently submitted a 50. 54(p) change which establishes an industrial security program for the [intentionally not stated] that provide some degree of access control. However, this program is not referenced in a commitment to the NRG. In addition, the licensee plans to identify other commitments in another plan change, to be submitted in about a week, to establish security measures for certain devitalized areas upon failure or Page 9 of 56

unavailability of the [intentionally not stated]. When the changes is received by the Region, we will expeditiously review it and verbally provide your staff with details and our comments on its contents."

(U) "It is our understanding that the Vital Area Validation effort was completed for the Oconee facility in early 1984. Regardless of the results of that effort, the current RER analysis must consider the situation after the [intentionally not stated1 is declared operable with attendant devitalized and the [intentionally not stated] is inoperable for maintenance, etc."

(U) The internal memorandum reflects documented Duke Energy plan of actions related to "the component." The Duke Energy's plans did not reflect the safety and risk significance and incorrectly assume redundancy of system functions that is not supported by the design and safety bases for plant operations, as previously discussed, then and now of the UFSAR. The NRC staff internal memorandums and memorandums to file on record did not support that the NRC considered or approved any exemptions to requirements of 10 CFR 73.55 for Duke Energy, prior to 2009 revised final rule or after the required implementation, March 2010.

(4) (U) Section 2, Background (third paragraph, Page 2 of 10)

(U) Duke Energy states:

(U) "ONS Physical Security Plan Rev. 24, transmitted April 4, 1998, deleted interim vital areas and implemented vital areas associated with the [intentionally not stated}. The only issued of concern identified was communicated in a May 30, 1989, NRC letter to Duke regarding the protection of [intentionally not stated]

piping (which was subsequently resolved in November 1989). Consistent with the alternative measure proposal and acceptance discussed above, the approved vital area list did not include the [intentionally not stated] or another previously designated interim vital area."

(U) In the first statement above, Duke Energy asserts that the submission of the Physical Security Plan on April 4, 1998 constituted NRC approval of changes implemented and/or the NRC omissions or a lack of responses to changes constitute tacit approval of changes, including approval of exemptions to requirements of 10 CFR 73.55 and approval of alternatives to requirements. There are no NRC records that Duke Energy requested alternatives to security requirements in 10 CFR 73.55 using the provisions of 10 CFR 73.55(a) or requested specific exemptions to requirements in accordance with 10 CFR 73.5 prior to the submission of revised Physical Security Plan on April 4, 1998. Contrary to Duke Energy's statements above, the submission of the Physical Security Plan with omissions (i.e., deleted interim vital areas) or the NRC receipt of the changed Physical Security Plan do not constitute the NRC approval of exemptions or alternatives to requirements or an approval of the omissions, including the absence of any identifications of vital equipment. Duke Energy's, or any licensees, changes to the security plan submitted under the provision of 10 CFR 50.54(p)(2) do not require NRC approval.

(U) With regards to the third sentence, the April 28, 1983, from Stolz to Tucker, transmitting the NRC findings, "Safety Evaluation by the Officer of Nuclear Regulatory Regulation, Oconee Nuclear Station Standby Shutdown Facility, Duke Power Company, Page 10 of 56

Docket Nos. 50-269, 50-270, and 50-287," did not authorized that Duke Energy may delete vital areas or vital equipment and does not grant exemptions of requirements in 10 CFR 73.55, including protection against radiological sabotage, or relief from designating structures, systems, and components that meet the definition of vital equipment in 10 CFR 73.2 as vital equipment. The NRC review of the proposal and findings for the approval of the SSF, as documented in the NRC Safety Evaluation, does not support the Duke Energy assertions that approval of the SSF constituted an approval of the deletion of vital areas, "interim vital areas," or vital equipment designations.

(U) In summary, the Duke Energy assertions that by omissions or only discussions of piping in the May 30, 1989 means the NRC acceptance or approval of exemptions or relief from requirements of 10 CFR 73.55 or the NRC provided tacit approval is not support by the fact that exemptions to requirements are only approved formally through a licensing action request, appropriate NRC reviews and considerations under the provisions of 10 CFR 73.5. Also, the acceptance of a report of changes under the provision of 10 CFR 50.54(p) do not constitute exemptions or give Duke Energy is relief of its obligations to comply with regulatory requirements.

(5) (U) Section 2, Background (3"d paragraph, Page 2 of 10)

(U) Duke Energy states:

(U) "... Consistent with the alternative measure proposal and acceptance discussed above, the approved vital area list did not include the [intentionally stated] or any other previously designated interim vital areas."

(U) Duke Energy's statement above implies that omissions or deletions of information in a revised Physical Security Plan submitted to the NRC constitute an approval of the Security Plan. It also implies that Duke Energy interactions with the NRC the SSF prior to the 2009 final rule constitute relief from the requirement that operating license must fully implement the updated the Section 73.55 by March 2010. The NRC receipt of licensee security plans submitted under the provisions of 10 CFR 50.54(p)(2) or any other correspondence under 10 CFR 50.4, "Written communications," do not constitute the NRC approval of the licensees changes to the security plan, including omissions of information or noncompliance with regulatory requirements from the changes, and licensees are not relieffrom compliance with the requirements in 10 CFR 73.55.

(6) (U) Section 2, Background (4th paragraph, Page 2 of 10)

(U) Duke Energy states:

"The current approved Oconee Vital Area List is as follows:"

Oconee Nuclear Station - Vital Area

• [intentionally not stated}

• Central Alarm Station GAS Page 11 of 56

(U) Duke Energy implies that the NRC approved the list of vital areas above, which are inside the protected area, and asserts that the Physical Security Plan with omissions of vital areas, including the identification of vital equipment, was approved, and implies that the vital areas listed above fully complies with the requirement that all vital equipment are in vital areas.

(U) The Duke Energy's Physical Security Plan did not identify the vital equipment that are not In accordance with 10 CFR 73.55(e)(9)(i}, and exception has not been reviewed or approved by the NRC. Similarly, the Duke Energy Physical Security Plant submitted in 2004, approved October 2004 and any subsequent revision to the security plans, to include the recent Revision 24 of the Duke Energy Security Plans submitted with report of changes under provisions of 10 CFR 50.54(p)(2)

(U) The NRC Memorandum from S. Treby, Assistant General Counsel for Rulemaking and Fuel Cycle, Office of General Counsel, to G. Tracy, Chief Operating Licensing, Human Performance, and Plant Support Branch, Office of Nuclear Reactor Regulation,

Subject:

"Legal Analysis of 10 CFR 50.54(p), 10 CFR 50.90, and 10 CFR 73.5 as Applied to Changes to Commitments Contained in Licensees Plans Defined in 10 CFR 50.54(p)(1}," September 15, 2000, Page 3, states:

(U) "Licensee who seek approval of alternative measures which do not met the criteria/ for approval of "other measures" under Section 73. 55(a) (or from other provisions of Part 73) should be reviewed and approved by the NRG as exemptions under Section 73.5, inasmuch as the provisions for Section 73.5 continue to be available if the more specific provisions of Section 73. 55(a) cannot be met. In addition, a conforming license amendment should be processed to change the plan."

(U) The OGC Memo from S. Treby to G. Tracy, September 15, 2000, Page 4, with respect to "[d]oes NRC approval of these plans [Physical Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan] also constitute exemptions from applicable regulatory requirements?, the OGC states the following:

(U) "Consistent with our discussion above, NRG approvals pursuant to Section 73.55(a) of licensee-proposed alternatives to the requirements of Section

73. 55(b) through (h) and Appendices B and C to Part 736 with respect to the Safeguards Contingency Plan and the Guard Training and Qualification Plan do not constitute exemptions. Any further change to these plans must be determined based upon whether the change as proposed by the licensee complies with the provisions of Section 50. 54(p), Section 73. 55(a) or Section 73. 5."

(U) This further clarified the treatment of alternatives identified in the security plans that were reviewed and approved by the NRC for the citation of inspection violations in May 13, 1982, NRC Memorandum from J. Lieberman, Acting Director of Enforcement to R.

Carlson, Director, Enforcement Staff, RI, C. Alderson, Director, Enforcement Staff, RII, R. Warnick, Director, Enforcement Staff, RIii, E. Johnson, Director, Enforcement Staff, RIV, A. Johnson, Director, Enforcement Staff, RV,

Subject:

CITING SAFEGUARDS VIOLATIONS AGAINST APPROVED PLANS, May 13, 1982, which states that

"[t]herefore, citations should be made against the plan and not the rule," with regards to alternatives or alternative measures identified in the security plan that Page 12 of 56

were reviewed and approved under the provisions of 10 CFR 73. 55(a) for alternatives. The citation should reference the license amendment approving the plan."

(U) The requirements for review and approval of alternative (10 CFR 73.55(a) prior to revised final rule in 2009 and the requirements for review and approval of alternative measures (10 CFR 73.55(r), both are reviewed and approved through amendment to the license (i.e., changes to the security plan describing the alternative method or approach) for meeting regulatory requirements, and where exemptions are granted under the provisions of 10 CFR 73.5.

(U) Duke Energy has neither an exemption nor an amendment for alternative that supports the assertions that the NRC approved relief from requirements. The omissions in the Duke Energy's Physical Security Plan does not constitute NRC approval of exemptions from regulatory requirements or the approval of alternatives to regulatory requirements.

(U) The facts that are relevant and omitted by Duke Energy are the NRC issued final rule in 2009 that revised 10 CFR 73.55 for power reactors, which must be fully implemented by March 2010. Duke Energy did not propos or request exemptions from requirements of 10 CFR 73.55 prior to the submission of Security Plan, Revision 16 on April 15, 2010 under the provisions of 10 CFR 50.54(p)(2). The NRC do not approve the Security Plan reported under the provision of 10 CFR 50.54(p)(2), including the security plans submitted after March 2010 that is required to describe how it complied with all requirements in the 2009 final rule. The Duke Energy's Security Plan for Oconee Nuclear Station Units 1, 2, and 3, Revision 15, which include the above table, with omissions of vital areas outside of the protected area and identification of vital equipment, submitted in April 2010 was not approved as complying with requirements of 10 CFR 73.55, nor did any NRC records show that the Commission provided approval of exemptions to requirements in 10 CFR 73.55.

(7) (U) Section 2, Background (51h paragraph, Page 2 of 10)

(U) Duke Energy states:

"1. ONS is currently operating in full compliance with the approved Duke Energy PSP."

(U) Duke Energy's statement above implies incorrectly that the NRC approved the Duke Energy's Physical Security Plan that is required to be in compliance with the 2009 final rule. The NRC approved the licensees security plans submitted to meet the DBT Order EA-03-086 in October 2004. The NRC Letter from Nakoski to Barron, dated October 29, 2004,

Subject:

"William B. McQuire Nuclear Station, Units 1 and 2, Catawba Nuclear Station, Units 1 and 2, and Oconee Nuclear Station, Units 1, 2, and 3 - Administrative Change to Facility Operating License in Conjunction with the Commission Order EA 086 Regarding Revised Design Basis Threat (DBT); and Revision to Physical Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan (MC2936, MC2937, MC2902, MC2903, MC2945, MC2946, and MC2947)," included approval of alternatives to the requirements of 10 CFR Part 73, which did not include any alternatives for meeting Section 10 CFR 73.55(b) or 10 CFR 73.55(e).

Page 13 of 56

(U) The NRC letter from Nakoski to Barron, dated October 29, 2004, the table titled "Approved Alternative to the Requirements of 10 CFR Part 73," only identified the approval of alternatives to Sections 73.55(c)(2}, 73.55(c)(3), 73.55(d)(4}, 73.55(d)(1},

73.55(d)(4), 73.55(c)(5}, 73.55(c)(1}, and 73.55(d)(7)(i)(B). Also, the NRC did not approve the Duke Energy's Security Plan or any other operating reactor licensees' security plans that are required to comply with the 2009 final rule. The NRC did not provide any approval of exemptions or alternatives, 10 CFR 73.5 or 10 CFR 73.55(r),

current or past 10 CFR 73.55(a}, respectively, that exempted Duke Energy from requirements in 10 CFR 73.55. Duke Energy's assertion that it's Physical Security Plan in compliance with the requirements of 10 CFR 73.55 of the 2009 final rule is not supported by the table shown in the PSP that omit areas that contained vital equipment, including those outside of the vital areas listed inside the power block of the Oconee Nuclear Station Units 1, 2, and 3. The NRC at no time in the review and approval related to the SSS (i.e., SSF) provided approval of exemptions from requirements of 10 CFR 73.55(b) and applicable sections of 10 CFR 73.55 for protection against radiological sabotage (i.e., preventing the loss of risk significance structures, systems and components functions that could to core damage).

(8) (U) Section 2, Background (5th paragraph, Page 2 of 10)

(U) Duke Energy states:

(U) "2. The original and existing approach used by Duke Energy for meeting 10 CFR 73.55(e) requirements is consistent with current regulatory guidance."

(U) Duke Energy's statement above implies incorrectly that the NRC approved or granted exemptions to requirements. The definition of vital equipment, 10 CFR 73.2, remains then and now, "any equipment, system, device, or material, the failure, destruction, or release of which could directly or indirectly endanger the public health and safety by exposure to radiation. Equipment or systems, which would be required to function to protect public health and safety following such failure, destruction, or release are also considered to be vital."

(U) Duke Energy's approach is based on the safety basis that the SSF approved by the NRC is redundant to "the component." As previously discussed, this does not reflect the NRC approval of the proposal of the SSF or the documented safety findings in the NRC Safety Evaluation for the approval of the SSF, and subsequent update to the facility operating safety basis. The risk-informed safety and design bases do not support the Duke Energy's approach or assertion that "the component" becomes safety or risk significant only when the SSF is unavailable. The NRC Safety Evaluation addressing the SSF operability and safety functions did not find or credit the SSF as redundant nor did the NRC finds that the SSF is capable of functions credited or needed for all postulated design basis accident scenarios. The beyond design basis accidents of intentional acts (i.e., DBT) are prevented based on adequate physical protection, achieve through meeting the performance and prescriptive requirements in 10 CFR Part 73 applicable to power reactors.

(U) The risk-informed evaluation based on the Standardized Plant Analysis Risk (SPAR) model, Level 1 PRA, for Oconee shows that the unavailability of "the component," with the availability of the SSF, would result in the conditional core damage probability for such an event approaches 1E-04 CC DP/yr. This level of risk would be equivalent to a Page 14 of 56

RED significance determination process finding. In addition, the overall risk and safety significance of "the component"to the plant based on the Plant Risk Information Book is 1.45E-3, which measures the rate of change in total risk as a result of changes to the probability of an individual basic event. In this case, it measures the impact of loss of the equipment (i.e., functions) to all plant accidents and initiators and not limited to a specific design basis accident scenario. The value of 1.45E-3 is very high relative to other components modeled in the probabilistic risk assessment model and indicates the importance and risk significance of "the componenf' to the overall risk of the Oconee Nuclear Power Station Units 1, 2, and 3.

Duke Energy's assertion of its original and existing approach based on the SSF or the safety basis justifying that deleting vital equipment or vital areas for meeting 10 CFR 73.SS(e) requirement is not supported by the NRC approval of the SSF or the current risk-informed information on the importance and safety/risk significance of "the component."

Duke Energy did not specify a specific regulatory guide, but asserts that it is in compliance with requirements of 10 CFR 73.55(e). This is not supported by the fact that regulatory guides, including RG 5.76 (identified in the first paragraph, Pager 3 of 10) are not substitute for regulations and the compliance with requirements of 10 CFR 73.55 is not voluntary.

(9) (U) Section 2, Background (5th paragraph, Page 2 of 10)

(U) Duke Energy states:

(U) "3. Oconee's current approach for establishing and protecting vital areas complies with past and cuffent regulatory requirements."

(U) "4. The relevant historical regulatory correspondence demonstrates a consistent progression with appropriate review and approval by the NRG."

(U) Duke Energy statements above imply incorrectly that the Commission granted exemptions to requirements. Only if the NRC granted Duke Energy exemptions to requirements of 10 CFR 73.55 would the statement item no. 3 be true. The NRC records do not support that Duke Energy, at any time in the history of the plant operations, requested exemptions or the NRC granted exemptions to specific requirements in 10 CFR 73.55 prior to or after the required implementation of the 2009 final revised rule.

(10) (U) Section 2, Background (5th paragraph, Page 2 of 10)

(U) Duke Energy states:

(U) "5. The [intentionally not stated] and associated power path are not vital equipment and thus are not required to be in a vital area."

(U) The Duke Energy statement above implies that "the componenf' is not vital and that there is no safety/risk significance to the plant to required protection against the DBT for radiological sabotage. Contrary to this assertion, "the componenf' meets the definition of 10 CFR 73.2 for vital equipment and is of high safety importance and risk significance for the overall risk of the Oconee Nuclear Station Units 1, 2, and 3 due to the functions credited for mitigating postulated design basis accidents.

Page 15 of 56

(11) (U) Section 2, Background (1 51 and 2nd paragraph, Page 3 of 10)

(U) Duke Energy states:

(U) "ONS is in full compliance with the approved PSP; however the proposed changes in this submittal are being voluntarily made to further increase the margin of protection. . . . As such, the current approved PSP identified additional security measures that are taken anytime that the [intentionally not stated] is degraded (i.e. when any systems of the [intentionally not stated] is declared inoperable by Operations personnel). ONS has also voluntarily made changes to existing site procedures creating additional security measures to further increase the protection afforded to the [intentionally not stated] when the

[intentionally not stated] is inoperable for a nuclear unit in an outage specifically during Higher Risk Plant Operational State (HRPOS) conditions. The changes proposed in the submittal will incorporate these additional measures into the PSP."

(U) "HRPOS are those higher risk periods of plant operations during a nuclear unit outage where loss of a Key Safety Function due to fire may have higher consequences. HRPOS is defined to occur when both [intentionally not stated]

and [intentionally not stated] coexists until one of the following conditions exists:

• (U) Refueling Canal [intentionally not stated] or

• (U) Have entered [intentionally not stated] period where [intentionally not stated] are available for decay heat removal."

(U) Duke Energy indicated that the additional security measures are to increase the margin of protection and measures described in Physical Security Plan are only required when the SSF is unavailable, due to fire during certain plant condition. The Duke Energy assertions above are not supported by the NRC review, approval and staff safety findings for the SSF, including the NRC review and the findings in the approval of amendment for applying NFPA 805 for risk-informed fire protection. The NRC did not find or established the system dependency between the SSF and "the componenf' as implied above for mitigating postulated design basis accidents. The SSF do not and is not capable of addressing all postulated design basis accident or sabotage scenarios.

The plant specific SPAR model, as previously described, based on the Level 1 PRA (e.g., success criteria, systems dependencies, etc.) did not consider the SSF unavailability for the risk and safety significance of "the component," which if unavailable increase significantly the plant core damage frequency for postulated design basis accident scenarios.

(12) (U) Section 2, Background (3rd paragraph, Page 2 of 10) [New Information]

(U) Duke Energy states:

(U) "ONS Physical Security Plan Rev. 24, transmitted April 4, 1988 deleted interim vital areas and implemented vital areas associated with the SSF. The only issue of concern identified was communicated in a May 30, 1989, NRG letter to Duke regarding protection of [intentionally not stated] piping (which was subsequently resolved in November 1989." Consistent with the alternate measures proposal and acceptance discussed above, the approved vital area list Page 16 of 56

did not include the [intentionally not stated] or any other previously designated interim vital areas."

(U) The statements above assert or imply by an NRC on May 30, 1989 granted approval of alternative measures proposed through the acceptance of the changes submitted in Revision 24 of the Physical Security Plan and approved the deletion of previously designated interim vital areas.

(U) The following two NRC letters to Duke Energy dated May 30, 1989 are NRC records in the NRC repository (i.e., eSafe) for records containing safeguards information:

(a) (U) NRC letter from D.S. Matthew, Director Project Directorate, 11-3, Division of Reactor Projects, to H.B. Tucker, Vice President, Nuclear Production Department, Duke Power Company,

Subject:

"[INTENTIONALLY NOT STATED] PIPING PROTECTION AT OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3, and (b) (U) NRC letter from D.S. Matthew, Director Project Directorate, 11-3, Division of Reactor Projects, to H.B. Tucker, Vice President, Nuclear Production Department, Duke Power Company,

Subject:

"REGIONAL TRANSFER OF 50.54(p) SUBMITTAL FOR OCONEE NUCLEAR STATION, UNITS 1, 2, AND3" (U) The first letter (a) supports the Duke Energy's assertions and correctly the characterization that the NRC communicated issues of concerns, specific to the protection of functions of at least one train of functions [intentionally not stated] and identified vulnerabilities of piping. This letter also communicated acceptance of certain guards and barriers would not be treated as vital areas, with exceptions of certain areas, and requested information on whether Oconee's armed response force could protect certain specific areas from the DST adversary with assumption of initial detection and assessment at the protected areas perimeter.

(U) The second letter (b) communicated the results of NRC determination that changes submitted regarding the vital and bullet-resisting barriers for the central alarm station are consistent with the provisions of 10 CFR 50.54(p), based on inspection from April 10-14, 1989. This letter does not support the Duke Energy/s assertion that "[c]onsistent with the alternate measures proposal and acceptance discussed above, the approved vital area list did not include the [intentionally not stated] or any other previously designated interim vital areas" was provided in communications that occurred on May 30, 1989.

This letter also did not communicate that the "ONS Physical Security Plan Rev. 24, transmitted April 4, 1988 deleted interim vital areas and implemented vital areas associated with the SSF," were reviewed and accepted as part of the matter addressed in the letter of May 30, 1989 for changes made through the provision of 50.54(p).

(U) Duke Energy's indicated, that over one year after the changes to the security plans on April 4, 1988, the NRC approved the security plan changes by letter dated May 30, 1989 is not supported by the NRC record, letter (b), that address the compliance with the provision of 10 CFR 50.54(p) for the central alarm station. The NRC letter acknowledged that the changes reported and implemented were accordance with the provisions in 50.54(p), and did not provide an NRC approval of security plan changes reported.

Page 17 of 56

(U) The Duke Energy's on December 5, 2017 pre-application meeting presented to the NRG the following on presentation, "Pre-submittal Meeting - December 5, 2017, Security Plan Enhancements LAR," Page No. 11, that states that "May 30, 1989 NRG letter to Duke approved the vital area list which did not include the interim vital areas including the [intentionally not mentioned]." Neither of the two records of NRG communications with Duke Energy provide NRG approval as asserted in the presentation and in the LAR No. LAR 2018-001.

Page 18 of 56

(U) SECTION A.2 NON-CONCURRENCE BASED ON CONSENSUS FACTS (U) The arguments presented in this section of the non-concurrence assume the licensee and staff's prevailing contention in the safety evaluation is accurate, specifically that the component in question (intentionally not stated for SGI, hereafter referred to as "the component') is not vital equipment, as.defined in 10 CFR 73.2, when the site's Standby Shutdown Facility (SSF) is operational. The non-concurring NRC staff make this assumption not because it agrees with that contention, but to present arguments from the same perspective to (1) highlight critical shortcomings in the safety evaluation and (2) avoid raising concerns that could be characterized as potential compliance or adequate protection backfits. The position articulated here is consistent with the NRC's more than 30-year practice of accepting "the componenf' is not vital when the SSF is available.

(U) In the LAR application and the staffs safety evaluation, the licensee and staff acknowledge the following facts, which non-concurring staff refers to in this section as consensus facts:

• (U) Prior to the SSF becoming operational, the licensee listed "the component" as an interim vital area in the Oconee security plan.

• (U) On April 4, 1988, the licensee revised the Oconee security plans to establish the SSF and associated equipment as vital, resulting in those locations being designated as vital areas (i.e., Revision 24).

• (U) In that April 4, 1988, security plan revision, the licensee stopped considering "the component" to be vital equipment.

(U) The logic associated with these consensus facts is straightforward. The licensee and the NRC staff considered "the component"to be vital equipment before the SSF existed. After the licensee built the SSF and put it into service, staff accepted the licensee's contention that "the component" is no longer vital when the SSF is operational, because the SSF fulfilled the safety-related function(s) that the licensee formerly relied on "the component" to perform. The licensee provided no information regarding alternate or additional engineered safety systems or equipment that (1) have been built between April 1988 and February 2017 (when the licensee submitted the LAR 2018-01 application) and (2) can assume SSF function(s) when the SSF is unavailable. Therefore, when the SSF is unavailable, it is reasonable to conclude "the component" would be vital equipment, because it would assume the vital safety-related function(s) normally performed by the SSF.

(U) The LAR 2018-01 safety evaluation does not discuss "the component's" safety or risk significance when the SSF is unavailable, and there is no evidence that staff evaluated that condition or relied on information from a previous evaluation of that condition. Staffs reasoning in the safety evaluation is less than adequate, because it relies on a regulatory position and technical basis for a different condition (i.e., SSF is available) than the one pertaining to the licensee's LAR 2018-01 application (i.e., SSF is not available). Non-concurring staff can find no information indicating the existing regulatory position is "the component" is not vital when the SSF is not available. In fact, Oconee Licensee Amendments 406,408, and 407, dated November 20, 2017 (ADAMS Accession No. ML17124A608), seem to consider "the component" as having substantial safety significance even when the SSF, numerous sources of offsite power, and other systems (e.g., Protected Service Water, Emergency Feedwater, Diesel-Driven Feedwater Pump) are all available.

Page 19 of 56

(U) The arguments in this section challenge three of the staff's technical conclusions in Section 4.2 of the LAR 2018-01 safety evaluation:

(1) (U) The licensee can voluntarily implementthe proposed security measures for "the componenf' when the SSF is unavailable.

(U) Non-concurring staff contends the NRC must require the licensee to comply with the 10 CFR Part 73 requirements for protecting vital equipment at least during periods when the SSF is unavailable. 1 The NRC originally licensed Oconee Nuclear Station Units 1, 2, and 3 without the SSF, and at that time, the licensee relied on "the componenf' and several dependent plant systems for safe shutdown. 2 The licensee considered "the componenf' to be an interim vital area until the SSF was declared operational in April 1988. The licensee provided no information regarding other safety systems or equipment that have been built between April 1988 and present day and that can assume SSF function(s) when the SSF is unavailable. Plus, the licensee behaves as if "the componenf' has vital function(s) when the SSF is unavailable, because it is willing to voluntarily implement significant security measures (e.g., permanently installed waterside barrier) for "the componenf' in the midst of multi-year efforts by NEI, the industry, and NRC to accept less conservative safety margins as one method for reducing industry burden.

(U) Ultimate responsibility for ensuring the licensee adequately identifies and protects vital equipment rests with the NRC, and staff has an obligation to correct the licensee's apparent refusal to designate "the componenf' as vital equipment when the SSF is unavailable. It should be noted that other licensees (e.g., Limerick, Wolf Creek, Shearon Harris) have established second protected areas for systems or equipment that simply support components that provide equivalent function(s) as "the componenf' at Oconee Nuclear Station. The safety evaluation permitting this licensee to not meet existing vital equipment protection requirements without an adequate technical basis could be viewed as disparate licensee treatment.

(U) NRC approval of LAR 2018-01 without an adequate basis may also set a licensing precedent that could lead to greater risk to the public and the environment if other licensees decide to initiate actions to reclassify their vital equipment so they can dismantle their secondary protected areas.

(2) (U) There is reasonable assurance that the licensee's implementation of the proposed security measures will meet the 10 CFR 73.55 requirements.

(U) Since "the componenf' performs vital SSF functions when the SSF is unavailable, "the componenf' meets the definitions of a safety-related component in 10 CFR 50.2 and vital equipment in 10 CFR 73.2. Consequently, the security measures proposed by the licensee in LAR 2018-01 would not meet all of the 10 CFR Part 73 requirements for protecting vital equipment. One significant example is 10 CFR 73.55(e)(9)(i), which requires vital equipment to be located inside a vital area(s}, which is then located inside a protected area(s). Because the proposed security measures would not meet all of the 1

The non-concurring staff makes a separate, subsequent argument that the licensee should be required to comply at all times with the Part 73 vital equipment protection requirements.

2 Summary for the January 18, 1978, meeting between Duke and NRC (ADAMS No. ML15212A318)

Page 20 of 56

10 CFR Part 73 requirements for physical protection of vital equipment, approving LAR 2018-01 would be the practical equivalent of issuing a specific exemption for the unsatisfied requirements without an adequate technical basis.

(3) (U) The licensee's proposed security measures increase the margin of protection for "the component' whenever the licensee declares the SSF to be inoperable.

(U) Staffs conclusion appears to be based on the fact that the licensee currently provides little, if any, security for "the componenf'. So, in theory, the proposed security measures are better than what the licensee is currently doing. A few staff and managers voiced that perspective during the limited number of meetings non-concurring staff were invited to attend. Their reasoning was if the NRC considers the licensee to currently be in compliance with 10 CFR Part 73 requirements without the proposed measures, then voluntary implementation of those measures would provide more defense-in-depth.

When one compares the proposed security measures to the level of protection that would be afforded if the licensee implemented the required physical protection measures for vital equipment, it is clear that the proposed measures would not satisfy the minimum level of protection, much less increase it. Under the proposed measures, "the componenf' would not be located inside a protected area, so it would not have that additional layer of defense. For example, there would be no second barrier to provide adequate delay against an attacking force and no continuous detection and assessment capabilities at a sufficient distance from "the componenf', which reduce the licensee's ability to successfully identify, respond to, and neutralize the threat and keep "the componenf' operational.

(U) Non-concurring staff also takes issue with staffs approach of relying on the licensee to include the proposed security measures in the Oconee security plans as a means of ensuring the durability of the proposed measures. Non-concurring staff is aware of many instances when NRC has concluded there were no decreases in effectiveness as a result of licensees eliminating voluntary measures from their approved security plans. Because the staff concluded in the LAR 2018-01 safety evaluation that the proposed security measures are not required, non-concurring staff is confident that NRC would adopt a similar perspective when evaluating the licensee's potential future decision to remove the proposed measures through a subsequent security plan revision. One needs to look no further than handgun elimination to substantiate this assertion. The two prevailing reasons staff permitted licensees to remove handguns from their security plans were 1) the decrease in effectiveness was not substantial enough to warrant concern, and 2) 10 CFR Part 73 does not require power reactor licensees arm their security personnel with handguns.

(U) Considering all of these factors, non-concurring staff finds no basis for concluding that the proposed measures increase the margin of protection for "the componenf'.

(U) Non-concurrence based on technical and legal information (e.g .* safety- and risk significance of "the component" 1 no exemption issued)

(U) The limited amount of information in Section 2.1 of the staffs safety evaluation implies the SSF is able to maintain safe shutdown without "the componenf'. As the staff notes, it is true that Section 9.6.1. in Revision 27 of the Oconee Updated Final Safety Analysis Report, dated June 29, 2018 (ADAMS No. ML18192A809), indicates the SSF:

Page 21 of 56

• (U) is "designed to maintain the plant in a safe a stable condition following postulated emergency events that are distinct from the design basis accidents and design basis events for which the plant systems were originally designed [emphasis added],

• (U) "provides additional "defense in-depth" protection for the health and safety of the public by serving as a backup to existing safety systems" [emphasis added],

• (U) provides "an alternate means to achieve and maintain mode 3 ... following postulated fire, security-related, or turbine building flood events, and is designed in accordance with criteria associated with these events" [emphasis added], and

• (U) "was credited as the alternate AC (AAC) power source and the source of decay heat removal required to demonstrate safe shutdown during the required station blackout coping duration" [emphasis added].

(U) However, staffs evaluation does not discuss how or whether it considered the following information that demonstrates "the componenf' performs safety- and risk-significant functions not possible with the SSF. Non-concurring staff thinks this information challenges the licensee and staffs position that "the componenf' is not vital equipment:

• (U) The SSF provides adequate capabilities for loss-of-offsite-power scenarios, but not for accidents. Staffs analysis in Section 2.1 of the safety evaluation for L-2018-LLA-0042 incorrectly implies the SSF provides redundant functions and capabilities as "the componenf'. Section 9.6.1. in the Oconee UFSAR, Revision 27, indicates the SSF is "designed to maintain the plant in a safe and stable condition following postulated emergency events that are distinct from the design basis accidents and design basis events for which the plant systems were originally designed [emphasis added]. "The componenf' is one of those plant systems upon which the current facility operating licenses are based.

• (U) "The component," not the SSF, is credited for the Design Basis Accident (Oconee UFSAR, Revision 27, Section 6.3.3.3.). "The componenf' or offsite power is necessary for providing core inventory makeup during loss of coolant accidents (LOCAs), including seal LOCAs, because alternating current (AC) power is necessary to operate the High Pressure Injection (HPI), Low Pressure Injection/Decay Heat Removal (LPI/DHR), or High Pressure Sump Recirculation (HPR) Systems (Oconee UFSAR, Revision 27, Sections 8.3.1.2. and Table 8-1 ). The SSF Diesel Generator is incapable of powering those systems. The SSF Reactor Coolant Makeup (RCM) pump draws borated water from the spent fuel pools to provide Reactor Coolant Pump (RCP) seal cooling and Reactor Coolant System (RCS) makeup for only volume shrinkage and other RCS leakage. The SSF RCM pump flow rate of 29 gallons per minute is insufficient for providing core inventory makeup. (Oconee UFSAR, Rev 27, Section 9.6.3.2. and Table 9-14)

(U) "The early decay heat removal capability that is available during a station blackout is the turbine-driven [intentionally not stated] pump and the SSF [intentionally not stated]

pump. The turbine-driven pump and the SSF component are capable of removing decay heat via the steam generators to cool the reactor down. If there is a need for inventory makeup, then offsite or onsite emergency ac power must be recovered for HPI system to operate and provide makeup. There is no inventory makeup system available if power Page 22 of 56

cannot be recovered. The SSF component pump is a positive displacement pump and its capacity is insufficient to provide RCS makeup. Core uncovery is assumed because of the lack of inventory control." ... "If there is a RCP seal loss-of-coolant, the SSF positive displacement pump has insufficient capacity to provide RCS makeup. Then HPI is required for inventory control and recovery of offsite ac power must be accomplished.

Offsite power recovery is required within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after a seal LOCA in order for inventory makeup to be provided prior to core uncovery. If offsite ac power is recovered, the HPI system must provide makeup flow to replenish the water lost through the RCP seals.

Long-term cooling is also required given the HPI system provided sufficient makeup water to the RCS. Long-term cooling can be provided by either OHR or HPR." (Revision 8.55 of the "Standardized Plant Analysis Risk Model for Oconee 1, 2, and 3," dated December 2017, Section 2.10.2.2., page 2-27)

• (U) The licensee relies on "the componenf' as the sole means for satisfying Criterion 24, which requires sufficient alternate sources of power be provided for operating Protective Systems when all offsite power is lost (Oconee UFSAR, Revision 27, Section 3.1.24.).

• (U) The licensee relies on "the componenf' as the sole onsite means for satisfying Criterion 39, which requires sufficient alternate sources of power be provided for operating Engineered Safety Features (Oconee UFSAR, Revision 27, Section 3.1.39.).

• (U) "The componenf' is located outside the protected area. Staff and the licensee should assume offsite power and equipment located outside a protected area will be lost when it's most advantageous for an adversary during an attack. "Consistent with 10 CFR 73.55(f)(3}, target set equipment or elements that are not contained within a protected or vital area must be identified and documented consistent with the requirements in 10 CFR 73.55(f)(1) and accounted for in the licensee's protective strategy. Those target elements that cannot be protected, such as electrical transmission lines that support offsite power, should be considered to be disabled, lost, or made nonfunctioning at any time. However, unprotected equipment may be assumed to operate where this would intensify the effects of an attack [emphasis added]. For example, if the loss of offsite power is timed to occur after direct current systems are destroyed, field flash and control of emergency diesel generators may not function."

(Regulatory Guide 5.81, dated November 2010, Section 6.6, pages 18-19)

(U) A postulated accident sequences that could cause a station blackout outside Oconee the protected area, involving the two supporting functions, one of which is "the component'. Staff should analyze whether it would be possible for vulnerability of single point failure located in area outside perimeter of "the component" structure to disable "the component's" function, without access to the structure. If that is possible, then the licensee should ensure that exterior area is also protected against the design basis threat.

(U) According to PRA subject matter expert, in NRR/DRA, if "the component' function and an additional supporting functions is unavailable when the SSF is operational, the conditional core damage probability (CCDP) for such an event approaches 1E-04 CCDP/ry. This level of risk would be equivalent to a RED significance determination process finding. Consistent with Inspection Manual Chapter 0309, "Reactive Inspection Decision Basis for Reactors," dated October 28, 2011 (ADAMS Accession No. ML111801157), this condition would be a significant operational event that would Page 23 of 56

warrant an Augmented Inspection Team to investigate the issue, which is the second-highest reactive inspection category.

• (U) Plant specific SPRA Model, the NRR/DRA staff related the overall risk importance of "the componenf' to the plant is 1.45E-3, based on the Oconee Plant Risk Information Book, dated December 11, 2017. This Birnbaum value is derived from the Oconee Standardized Plant Analysis Risk Model for Oconee Units 1, 2, and 3, dated December 2017. The Birnbaum value measures the rate of change in total risk as a result of changes to the probability of an individual basic event. In this case, it measures the impact of loss of "the componenf' to all plant accidents and initiators and not limited to just loss-of-offsite power scenarios. A value of 1.45E-3 is very high relative to other components analyzed in the probabilistic risk assessment model and indicates the importance and risk significance of "the componenf' to the overall risk of the site.

• (U) The licensee assumes "the componenf' will always be available, except during station blackout (Oconee UFSAR, Revision 27, Section 8.3.1.2. and Table 8-3). The Oconee facility operating licenses require "the componenf' be operable for all MODES (Sections 3.8.1., "AC Sources - Operating," and 3.8.2., "AC Sources - Shutdown," in the Oconee Nuclear Station, Unit 1, "Renewed Facility Operating License," Docket 50-269, ADAMS Accession No. ML052840238; Unit 2, "Renewed Facility Operating License,"

Docket 50-270, ADAMS Accession No. ML052840239; Unit 3, "Renewed Facility Operating License," Docket 50-287, ADAMS Accession No. ML052870402).

• (U) The SSF does not enable the plant to operate in MODE 4. Technical Specification (TS) 3.8.1., "AC Sources- Operating," establishes requirements for AC power sources when the Oconee Units 1, 2, and 3 are in MODES 1 through 4. The limiting condition for operation requires, in part, that two offsite sources and "the componenf' be operable.

The TS 3.8.1 Bases state the AC power system includes offsite power sources and the onsite standby power sources (i.e., "the componenf'). The TS 3.8.1 Bases also state the AC power system is designed to supply the required engineered safeguards loads of one unit and safe shutdown loads of the other two units and is arranged so that no single failure can disable enough loads to jeopardize plant safety. (Oconee Nuclear Station, Unit 1, "Renewed Facility Operating License," Docket 50-269, ADAMS Accession No. ML052840238; Unit 2, "Renewed Facility Operating License," Docket 50-270, ADAMS Accession No. ML052840239; Unit 3, "Renewed Facility Operating License," Docket 50-287, ADAMS Accession No. ML052870402; Section 2.1 in License Amendment, EPID No. L-2016-LLA-0002, ADAMS No. ML17124A608)

• (U) The SSF does not enable the plant to operate in MODE 5 or 6. Technical Specification (TS) 3.8.2., "AC Sources - Shutdown," establishes requirements for AC power sources when the Oconee Units 1, 2, and 3 are in MODES 5 and 6. The limiting condition for operation requires, in part, that two offsite sources and "the componenf' be operable. The TS 3.8.2 Bases state the AC power system includes offsite power sources and the onsite standby power sources (i.e., "the componenf'). The TS 3.8.2 Bases also state the AC power system is designed to supply the required engineered safeguards loads of one unit and safe shutdown loads of the other two units and is arranged so that no single failure can disable enough loads to jeopardize plant safety.

(Oconee Nuclear Station, Unit 1, "Renewed Facility Operating License," Docket 50-269, ADAMS Accession No. ML052840238; Unit 2, "Renewed Facility Operating License,"

Docket 50-270, ADAMS Accession No. ML052840239; Unit 3, "Renewed Facility Page 24 of 56

Operating License," Docket 50-287, ADAMS Accession No. ML052870402; Section 2.1 in License Amendment, EPID No. L-2016-LLA-0002, ADAMS No. ML17124A608)

• (U) Staff's position in its safety evaluation for L-2018-LLA-0042 is inconsistent with staff's safety evaluation for the Oconee License Amendments 406, 408, and 407

("Oconee Nuclear Station, Units 1, 2 and 3 - Issuance of Amendments Regarding the Technical Specifications for Electrical Power Systems," EPID No. L-2016-LLA-0002, dated November 20, 2017 (ADAMS Accession No. ML17124A608)). In L-2016-LLA-0002, staff highlighted the importance of "the componenf' throughout its safety evaluation. Staff imposed numerous and significant conditions before permitting the licensee to completely disable "the componenf' for 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> and permit the component to be capable of operation in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (vs the normal immediate requirement) for a period of 55 days, even though normal offsite power sources, an additional and committed source of offsite power, the SSF, and Emergency Feedwater and Protected Service Water Systems were operational. The licensee was required to stage a portable diesel generator at "the component's" structure to make "the componenf' operational within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

• (U) Staff's safety evaluation does not consider whether "the component's" is important for maintaining the spent fuel pools in a safe condition. The SSF has no ability to provide spent fuel pool makeup inventory, and it would be depleting inventory over time as the SSF Reactor Coolant Makeup Pump in each Reactor Building uses the spent fuel pools as suction sources for Reactor Coolant Pump seal cooling. At 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the water level in the spent fuel pools could be as low as one foot above the top of the spent fuel racks (Oconee UFSAR, Rev 27, Section 9.6.3.2.).

• (U) For the L-2018-LLA-0042 safety evaluation, staff assumes that the licensee is complying with current 10 CFR Part 73 requirements based on the fact that (1) NRC

'approved' Revision 24 of the Oconee security plans, dated April 4, 1988 (when the licensee removed "the componenf' from its list of interim vital areas}, and (2) during the decades since that time, NRC's oversight activities have confirmed the licensee is complying with 10 CFR Part 73 requirements. Regarding the first basis, it is non-concurring staff's understanding that security plan changes cannot constitute exemptions to NRC requirements or acceptance of alternative measures for meeting NRC requirements. Licensees need to apply for exemptions pursuant to 10 CFR 73.5 because staff does not have the authority to grant exemptions through security plan reviews, and they need to request approval for the use of alternative measures under 10 CFR 73.55(r). In the latter case, licensees need to demonstrate how the alternative measures provide at least an equivalent level of protection as NRG-endorsed methods.

Concerning the second basis, non-concurring staff contends the scope of NRC's security inspection activities has been limited to the information provided by the licensee. For example, Inspection Procedure 71130.05, "Protective Strategy Evaluation and Performance Evaluation Program," dated January 1, 2019, requires the use of licensee-provided information as the basis for security inspections. Inspectors are not expected, or given the resources, to analyze whether the provided vital area information is complete and accurate. For example, Item "k" for the Tier 1 Criterion 02.06, "Components of the Protective Strategy," has inspectors confirming that licensee security personnel observe and verify the integrity of vital equipment. Neither of those tasks requires, expects, or encourages inspectors to independently evaluate whether the licensee has provided a complete and accurate list of vital areas. It is unsurprising that inspectors have considered the licensee to be in compliance with the 10 CFR Part 73 Page 25 of 56

requirements, because the licensee adequately implemented the protective strategy it said it would implement-a strategy that does not consider "the componenf' to be vital equipment. Non-concurring staff is arguing the licensee should identify "the componenf' as vital equipment, as defined in 10 CFR 73.2, based on the information non-concurring staff presented in the preceding paragraphs. Approval of LAR 2018-01 would constitute an exemption from the vital area protection requirements in 10 CFR Part 73 without an adequate technical basis.

Page 26 of 56

(U) SECTION A.3 OBLIGATIONS TO MEET REGULATORY REQUIREMENTS The following address the reason for non-concurrence that is based on Duke Energy is obligated, prior to and after the revised 2009 final rule, to meet the legally binding requirements imposed on licensees through rule, regulations, order and license. The NRC SE Section 2.3, Regulatory Review, and did not address and based it evaluation on acceptance, without verification, of Duke Energy assertions of NRC approved changes to the security plan that Duke Energy's assert that provided relief, exempted, from obligations to comply with regulatory requirements of 10 CFR 73.55 for "the component.".

The following are summary of the reasons and the detailed basis that is discussed in this section for the reason for non-concurrence:

• Duke Energy is obligated to meet the legally binding requirements imposed through 10 CFR 73.55 for vital equipment, protection of vital equipment, and the protection against the DBT for radiological sabotage.

• Duke Energy has not requested or was granted specific exemptions from requirements in 10 CFR 73.55 for vital equipment for "the component," along with other SSC that have provide vital functions.

• Duke Energy's assertion that the NRC provided approval of changes to the vital areas identified in a revised security plan on May 30, 1989 is false and mislead the NRC on the record of approval of changes in the security plan.

The compliance with regulatory requirements of 10 CFR 73.55 for protect safety/risk significance safety and supporting structures, systems, and components vital functions from malevolent acts up to the DBT for radiological sabotage, permit NRC to find that all the criteria of 10 CFR 50.92 are met. The NRC SE regulatory evaluation that incomplete and inaccurate, and did not consider or evaluate compliance with requirements of 10 CFR 73.55 do not meet the criteria that "there is reasonable assurances that such activities will be conducted in compliance with the Commission's regulations."

EXEMPTION OR RELIEF FROM REGULATORY REQUIREMENTS - NRC APPROVAL OF ONS PHYSICAL SECURITY PLAN - MAY 30, 1989 (U) The Duke Energy asserted during pre-application meeting on December 7, 2017 and in the submission of LAR No. LAR-2018-001 that the NRC approved on May 30, 1989 the descriptions in the revised ONS Physical Security Plan, Revision 24, transmitted on April 4, 1988 that deleted the identification of "the component" as a vital areas with the implemented vital areas associated with the SSF.

(U) The following two NRC letters to Duke Energy dated May 30, 1989 are records in the NRC repository (i.e., eSafe) for records containing safeguards information:

(a) (U) NRC letter from D.B. Matthew, Director Project Directorate, 11-3, Division of Reactor Projects, to H.B. Tucker, Vice President, Nuclear Production Department, Duke Power Company,

Subject:

"[INTENTIONALLY NOT STATED] PIPING Page 27 of 56

PROTECTION AT OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3, May 30, 1989 (b) (U) NRC letter from D.S. Matthew, Director Project Directorate, 11-3, Division of Reactor Projects, to H.B. Tucker, Vice President, Nuclear Production Department, Duke Power Company,

Subject:

"REGIONAL TRANSFER OF 50.54(p) SUBMITTAL FOR OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3" May 30,1989 (U) The non-concurring staff determined the following:

• (U) The first letter (a) supports the Duke Energy's assertions and correctly the characterization that the NRC communicated issues of concerns, specific to the protection of functions of at least one train of functions [intentionally not stated] and identified vulnerabilities of piping. This letter also communicated acceptance of certain guards and barriers would not be treated as vital areas, with exceptions of certain areas, and requested information on whether Oconee's armed response force could protect certain specific areas from the DBT adversary with assumption of initial detection and assessment at the protected areas perimeter.

• (U) The second letter (b) communicated the results of NRC determination that changes submitted regarding the vital and bullet-resisting barriers for the central alarm station are consistent with the provisions of 10 CFR 50.54(p), based on inspection from April 10-14, 1989. This letter does not support the Duke Energy/s assertion that "[c]onsistent with the alternate measures proposal and acceptance discussed above, the approved vital area list did not include the [intentionally not stated] or any other previously designated interim vital areas" was provided in communications that occurred on May 30, 1989. This letter also did not communicate that the "ONS Physical Security Plan Rev. 24, transmitted April 4, 1988 deleted interim vital areas and implemented vital areas associated with the SSF," were reviewed and accepted as part of the matter addressed in the letter of May 30, 1989 for changes made through the provision of 50.54(p).

• (U) The Duke Energy's assertion that over one year after the changes to the security plans, April 4, 1988, the NRC approved the security plan changes by letter dated May 30, 1989 is not supported by the NRC record, letter (b), that address the compliance with the provision of 10 CFR 50.54(p) for the central alarm station. The NRC letter acknowledged that the changes reported and implemented were accordance with the provisions in 50.54(p), and did not provide an NRC approval of security plan changes reported.

• (U) In addition, Duke Energy's on December 5, 2017 pre-application meeting presented to the NRC the following on presentation, "Pre-submittal Meeting -

December 5, 2017, Security Plan Enhancements LAR," Page No. 11, that states that "May 30, 1989 NRC letter to Duke approved the vital area list which did not include the interim vital areas including the [intentionally not mentioned]." Neither of the two records of NRC communications with Duke Energy provide NRC approval as Duke Energy indicated during the pre-application meeting and as asserted in the LAR No. LAR 2018-001 ..

(U) The NRC SE, Section 2.3, "Regulatory Review," do not reflect due diligent review and verification of the Duke Energy assertions that NRC approved or provided relief (i.e.,

Page 28 of 56

exemptions from requirements). The NRC SE incorrectly accepted them false information as factual and truthful in its review of the licensing basis.

(U) The subsequent SE descriptions and evaluation of regulatory requirements in the NRC staff SE (i.e., 10 CFR 73.1, 10 CFR 73.55(a), 10 CFR 73.55(b), 10 CFR 73.55(c), 10 CFR 73.55(e),

Appendix C) is inadequate based on unsupported assertion that Duke Energy has been granted relief (i.e., exemption) from requirements to protect "the component" as vital and result in finding that did not evaluate the LAR No.2018-001 for compliance with all applicable requirements in 10 CFR 73.55 that remains legally binding.

EXEMPTION OR RELIEF FROM REGULATORY REQUIREMENTS - NRC APPROVAL BY LETTER - DECEMBER 6, 1978 (U) The NRC SE, Section 2.3, "Regulatory Review," discussed the "Licensing Basis,"

paragraph 2 on Page 3, refers to information provided by Duke Energy in LAR No. LAR-2018-001, Section 2, "Background," Page 2, where Duke Energy asserted that the NRC provided "relief from Commission requirements in regards to designations of vital areas as identified in Section 5.1 of the 1978 security plan for interim vital areas and vital equipment not located within vital areas but outside a protected area."

(U) The non-concurring staff determined the following:

(U) Duke Energy misrepresented the facts and implied that the NRC acceptance of the proposal, conceptual design of SSS, was NRC approval for exemptions (or relief) from regulatory requirements of 10 CFR 73.55, including applying the definition vital equipment and its application to designate structures, systems, and components as vital equipment. The Duke Energy also misrepresents or implies that the SSS provides redundant functions for "the component' that is the subject of the LAR, which was not a part of the conceptual design for the SSS described in the NRC December 6, 1978 letter.

(U) In the December 6, 1978 NRC letter to Duke Energy, and enclosure, the NRC did not address "the component" that is the subject matter of the LAR No. LAR-2018-001. Specifically the NRC did not:

• (U) provide approval that the number of vital areas can be reduced

• (U) provide approval any specific exemption to 10 CFR 73.5 or 10 CFR 73.55 requirements)

• (U) provide approval of any alternatives under provisions of 10 CFR 73.55(a) to 10 CFR 73.55 requirements

• (U) Refer to or discuss "the component" that is the subject of the LAR No. LAR-2018-001 (U) Note: Section 10 CFR 73.55(a), alternatives, prior to issuance of 2009 final rule, revising Section 10 CFR 73.55 and other sections of 10 CFR Part 73, stated that:

(U) "[t]he Commission may authorize an applicant or licensee to provide measures for protection against radiological sabotage other than those required by this section if the applicant or the licensee demonstrates that the measure have the same high assurance Page 29 of 56

objectives as specified in this paragraph and that the overall level of system performance provides protection against radiological sabotage equivalent to that which would be provided by paragraph (b) through (h) of this section and meet the general performance requirement of this section.".

(U) There are no NRC record that the NRC approved specific exemptions accordance with provision of 10 CFR 73.5 for requirements of 10 CFR 73.55 prior to the final revised rule of 2009 or prior to or after the implementation date of March 2010. There is also no NRC record that the NRC approved alternatives providing equivalent protection in accordance with 10 CFR 73.55(a), prior to 2009 final rule, or in accordance with 10 CFR 73.55(r), before or after implementation of 2009 revised rule, with regards to "the component" that is the subject matter of the LAR No. 2018-001.

(U) The NRC SE, Section 2.3, "Licensing Basis," do not reflect due diligent review and verification of the Duke Energy assertions that NRC approved or provided relief (i.e.,

exemptions from requirements). The NRC SE incorrectly accepted the incomplete and incorrect information provided in LAR No. LAR-2018-001 as factual and truthful in its review of the licensing basis.

(U) The subsequent SE descriptions and evaluation of regulatory requirements in the NRC staff SE is inadequate based on unsupported assertions that Duke Energy has been granted relief (i.e., exemption) from requirements to protect "the component" as vital and result in finding that did not evaluate the LAR No.2018-001 for compliance with all applicable requirements in 10 CFR 73.55 that remains legally binding.

EXEMPTION OR RELIEF FROM REGULATORY REQUIREMENTS - NRC APPROVAL BY LETTER - JULY 17, 1986 (U) The NRC SE, Section 2.3, "Regulatory Review," discussed the "Licensing Basis,"

paragraph 3 on Page 3, refers to information provided by Duke Energy in LAR No. LAR-2018-001, Section 2, "Background," Page 2, for the assertion that the NRC provided relief in an NRC Regulatory Effectiveness Review relative to the Duke Energy plan to vitalize the SSS in place of other safety systems as an acceptable approach.

(U) The non-concurring NRC staff determined the following:

(U) Duke Energy states:

(U) "Additionally a July 17, 1986 letterfrom NRC (John F. Stolz) to Duke (H.B. Tucker) communicated the results of the NRC's Regulatory Effectiveness Review (RER) which concluded that Duke's plan to vitalize [intentionally not stated] in place of other safety systems is an acceptable approach. It also states, "When the SSS become operational, the licensee intends that the [intentionally not stated] will no longer be designated as vital."

(U) Duke Energy statements above assert or imply that the NRC approved Duke Energy's plans to change the designation of equipment that meets the definition as vital equipment and implied that the NRC provided approval of exemptions to requirements of 10 CFR 73.55, that included the protection of vital equipment and protection against the design basis threat for radiological sabotage.

Page 30 of 56

(U) The NRC letter transmitting the NRC findings, Safety Evaluation by the Officer of Nuclear Regulatory Regulation, Oconee Nuclear Station Standby Shutdown Facility, Duke Power Company, Docket Nos. 50-269, 50-270, and 50-287," addressed the evaluations and findings for the SSF capabilities relative to mitigating postulated fires, turbine building flooding and security incidents.

(U) The NRC Safety Evaluation address the SSF system descriptions, capabilities related to plant reactor cooling makeup, auxiliary service water, electrical power supply, normal AC power supply, standby power supply, DC power supply, support subsystems, service water subsystems, SSF HVAC system, building sump subsystem, portable water subsystem, and instrumentation and controls in Section 1. The NRC technical evaluations addressed the structure design, seismic subsystem analysis, dynamic testing and analysis of mechanical components, ASME codes, inservice testing, seismic and dynamic qualification of Category I electrical equipment, fire protection, safe shutdown systems, area where dedicated shutdown is required, remaining plant area, performance goal, source range flux, steam generator pressures, instrumentation guideline, repair requirement, circuits and isolation, safe shutdown procedures and manpower, and conclusion for the FSS, and flooding review in Sections 4.0 Through 4. 7.9 of the Safety Evaluation.

(U) The NRC Safety Evaluation Section 4.8, "Conclusion," stated the following:

(U) "Based on our review, we concluded that the ONS design will provide one train of systems necessary to achieve and maintain safe shutdown conditions by utilizing either the control room or the SSF in conjunction with undamaged systems in the fire affected unit, and thus will meet the requirement of Appendix R to 10 CFR 50, Section 111.G.3 and 111.L with respect to safe shutdown in the event of a fire, with the exceptions of the availability of a source range flux monitor and steam generator pressure indication at the SSF."

(U) Section 4.9, "Security Review," of the Safety Evaluation stated the following:

(U) "The licensee submitted physical security, contingency planning, and guard training and qualification plan in accordance with requirements of 10 CFR Part 73, Section 73.55 and Appendices B and C. We have determined that these plan satisfy regulatory requirements and accordingly have been approved. The acceptability of the licensee identification of vital area required to be protected by 10 CFR 73.55(c) is contingent upon confirmatory analysis to be performed by the NRC at a future date."

(U) "The SSF, with its capability to independently bring the reactor to safe shutdown mode

[MODE 3, Hot Standby, Table 1.1-1 "MODES") increases significantly the defense-in-depth characteristics of the facility and provides incremental protection against both internal and external sabotage."

(U) The NRC letter dated July 17, 1986, from J. Stolz to Tucker, "Oconee Nuclear Station, Units 1, 2, and 3 - Regulatory Effectiveness Review," (publically available) stated the following for the enclosed report documenting the NRC regulatory review (i.e., a confirmatory review):

(U) "The enclosed portion of the RER report present the findings of the Regulatory Effectiveness Review and do not, in themselves, constitute a requirement for any licensing action. However, some of the findings could constitute potential items of non-compliance. If such findings have not already been addressed during an inspection by the NRC Regional Office, they could be in a future inspection. We recommend that you review your plan in light of these findings and initiate any corrective action necessary to ensure that any possible item of non-compliance are corrected expeditiously."

Page 31 of 56

{U) "The vital area part of the report is provided to keep you informed of the results of the Los Almos National Laboratory vital area analysis of your plant. It is not intended to convey any new or changed NRC staff position or backfit. In fact, NRC policy concerning vital areas is presently undergoing staff review. Once the NRC adopts a final position regarding the identification of vital equipment, the vital area analyses of all plant including Oconee Nuclear Station, will be reevaluated from a licensing perspective."

{U) The NRC letter dated July 17, 1986, transmitting results of NRC regulatory effectiveness review did not: (a) provide new requirements; (b) provide approval of alternative to security requirements in 10 CFR 73.55; (c) provide approval of exemptions to requirements in 10 CFR 73.55; (d) provide inspection findings; or (e) provide a new NRC positions.

{U) The NRC regulatory effectiveness review did not determined or provided the safety basis different from what was in the NRC documented findings for the SSF in the Safety Evaluation dated April 28, 1983, and does not support the Duke Energy assertion that the approval of the SSS (i.e., SSF), its functions and capabilities, is a substitute for "the component" (functions and capabilities) that is the subject of the LAR No. LAR-2018-001.

{U) Additional information on the RER is provided in September 04, 1985 NRC memorandum, from J. Stohr (Division of Radiation Safety and Safeguard) to R. Burnett (Division of Safeguards, NMSS), "Regulatory Effectiveness Review of Oconee Nuclear Station September 19-25, 1985" (NS104815, not publically available). It described the intention of Duke Power's plans in the near future to place in service the SSF, in accordance with its approved security plan, to devitalize certain plant areas in the power block, including the area of "the component" that is subject of the LAR No. LAR-2018-001. The internal memo stated:

{U) 'The licensee recently submitted a 50.54(p) change which establishes an industrial security program for the [intentionally not stated] that provide some degree of access control. However, this program is not referenced in a commitment to the NRC. In addition, the licensee plans to identify other commitments in another plan change, to be submitted in about a week, to establish security measures for certain devitalized areas upon failure or unavailability of the [intentionally not stated]. When the changes is received by the Region, we will expeditiously review it and verbally provide your staff with details and our comments on its contents."

{U) "It is our understanding that the Vital Area Validation effort was completed for the Oconee facility in early 1984. Regardless of the results of that effort, the current RER analysis must consider the situation after the [intentionally not stated'] is declared operable with attendant devitalized and the [intentionally not stated] is inoperable for maintenance, etc."

{U) The internal memorandum reflects documented Duke Energy plan of actions related to "the component" that is subject of the LAR No. LAR-2018-001. The Duke Energy's plans did not reflect the safety and risk significance and incorrectly assume redundancy of system functions that is not supported by the design and safety bases for plant operations, as previously discussed, then and now of the UFSAR. The NRC staff internal memorandums and memorandums to file on record did not support that the NRC considered or approved any relief or exemptions to requirements of 10 CFR 73.55 for Duke Energy, prior to 2009 revised final rule or after the required implementation, March 2010 Page 32 of 56

(U) The NRC SE, Section 2.3, "Licensing Basis," do not reflect due diligent review and verification of the Duke Energy provided information in the LAR No. LAR-2018-001 that asserts or implies that NRC approved or provided relief (i.e., exemptions from requirements). The NRC SE incorrectly accepted the incomplete and incorrect information provided in LAR No. LAR-2018-001 in the NRC staff review of the licensing basis.

(U) The subsequent SE descriptions and evaluation of regulatory requirements in the NRC staff SE is inadequate based on unsupported information and assertions that Duke Energy has been granted relief (i.e., exemption) from regulatory requirements and result in finding that did not evaluate the LAR No.2018-001 for compliance with all applicable requirements in 10 CFR 73.55 that remains legally binding.

EXEMPTION OR RELIEF FROM REGULATORY REQUIREMENTS - NRC APPROVAL BY LETTER - APRIL 4 1998 (U) The NRC SE, Section 2.3, "Regulatory Review," discussed the "Licensing Basis,"

paragraph 3 on Page 3, refers to information provided by Duke Energy in LAR No. LAR-2018-001, Section 2, "Background," Page 2, for the assertion that the NRC provided relief by acceptance of Revision 24 of its security plans dated April 4, 1988, which the changes deleted the listing of interim vital areas and implemented vital areas associated with the SSF.

(U) The non-concurring staff determined the following:

(U) In Section 2, Background (third paragraph, Page 2 of 10) of the LAR No. LAR-2018-001, Duke Energy states:

(U) "ONS Physical Security Plan Rev. 24, transmitted April 4, 1988, deleted interim vital areas and implemented vital areas associated with the [intentionally not stated]. The only issued of concern identified was communicated in a May 30, 1989, NRC letter to Duke regarding the protection of [intentionally not stated] piping (which was subsequently resolved in November 1989). Consistent with the alternative measure proposal and acceptance discussed above, the approved vital area list did not include the

[intentionally not stated] or another previously designated interim vital area."

(U) In the first statement above, Duke Energy asserts that the submission of the Physical Security Plan on April 4, 1988 constituted NRC approval of changes implemented and/or the NRC omissions or a lack of responses to changes constitute tacit approval of changes, including approval of exemptions to requirements of 10 CFR 73.55 and approval of alternatives to requirements. There are no NRC records that Duke Energy requested alternatives to security requirements in 10 CFR 73.55 using the provisions of 10 CFR 73.55(a) or requested specific exemptions to requirements in accordance with 10 CFR 73.5 prior to the submission of revised Physical Security Plan on April 4, 1988. Contrary to Duke Energy's statements above, the submission of the Physical Security Plan with omissions (i.e., deleted interim vital areas) or the NRC receipt of the changed Physical Security Plan do not constitute the NRC approval of exemptions or alternatives to requirements or an approval of the omissions, including the absence of any identifications of vital equipment. The Duke Energy's, or any licensees, changes to the security plan submitted under the provision of 10 CFR 50.54(p)(2) do not require NRC approval.

(U) With regards to the third sentence, the April 28, 1983, from Stolz to Tucker, transmitting the NRC findings, "Safety Evaluation by the Officer of Nuclear Regulatory Regulation, Oconee Nuclear Station Standby Shutdown Facility, Duke Power Company, Docket Nos. 50-269, 50-270, and 50-287," did not authorized that Duke Energy may delete vital areas or vital equipment Page 33 of 56

and does not grant exemptions of requirements in 10 CFR 73.55, including protection against radiological sabotage, or relief from designating structures, systems, and components that meet the definition of vital equipment in 10 CFR 73.2 as vital equipment. The NRC review of the proposal and findings for the approval of the SSF, as documented in the NRC Safety Evaluation, does not support the Duke Energy assertions that approval of the SSF constituted an approval of the deletion of vital areas, "interim vital areas," or vital equipment designations.

(U) In summary, the Duke Energy assertions that by omissions or only discussions of piping in the May 30, 1989 means the NRC acceptance or approval of exemptions or relief from requirements of 10 CFR 73.55 or the NRC provided tacit approval is not support by the fact that exemptions to requirements are only approved formally through a licensing action request, appropriate NRC reviews and considerations under the provisions of 10 CFR 73.5. Also, the acceptance of a report of changes under the provision of 10 CFR 50.54(p) do not constitute exemptions or that Duke Energy is relief of its obligations, to comply with regulatory requirements.

(U) The NRC SE, Section 2.3, "Licensing Basis," do not reflect due diligent review and verification of the Duke Energy provided information in the LAR No. LAR-2018-001 that asserts or implies that NRC approved or provided relief (i.e., exemptions from requirements). The NRC SE incorrectly accepted the incomplete and incorrect information provided in LAR No. LAR-2018-001 in the NRC staff review of the licensing basis.

(U) The subsequent SE descriptions and evaluation of regulatory requirements in the NRC staff SE is inadequate based on unsupported information and assertions that Duke Energy has been granted relief (i.e., exemption) from regulatory requirements and result in finding that did not evaluate the LAR No.2018-001 for compliance with all applicable requirements in 10 CFR 73.55 that remains legally binding.

EXEMPTION OR RELIEF FROM REGULATORY REQUIREMENTS - BY NRC APPROVAL OF SECURITY PLAN SUBMITTED FOR COMPLIANCE WITH 2003 DBT ORDER -

OCOTBER 29, 2004 (U) The NRC SE, Section 2.3, "Regulatory Review," discussed the "Licensing Basis,"

paragraph 4 on Page 3, the NRC staff indicated that "[t]he staff The staff also considered the safety evaluation (designated as SGI) for administrative changes to the operating licenses issued via letter dated October 29, 2004 (ADAMS Accession No. ML043120017), and the Duke Energy Physical Security Plan, Revision 26, with an effective date of June 21, 2018, and submitted to the NRC via letter dated August 21, 2018. This letter is not publicly available because it contains SGI." The considerations of the NRC SE approving and administrative changes to the license on October 29, 2004 and the most recent Security Plan, Revision 26, submitted with report of changes on August 21, 2018 (i.e., 10 CFR 50.54(p)(2) constitute approval of exemption or relief from regulatory requirements is similar to that of Duke Energy assertions in LAR No. LAR-2018-001.

(U) The non-concurring staff determined the following:

(U) In Section 2, Background (3nd paragraph, Page 2 of 10), Duke Energy states:

(U) "... Consistent with the alternative measure proposal and acceptance discussed above, the approved vital area list did not include the [intentionally stated] or any other previously designated interim vital areas."

Page 34 of 56

(U) The Duke Energy's statement above implies that omissions or deletions of information in a revised Physical Security Plan submitted to the NRC constitute an approval of the Security Plan.

It also implies that Duke Energy interactions with the NRC the SSF prior to the 2009 final rule constitute relief from the requirement that operating license must fully implement the updated the Section 73.55 by March 2010. The NRC receipt of licensee security plans submitted under the provisions of 10 CFR 50.54(p)(2) or any other correspondence under 10 CFR 50.4, "Written communications," do not constitute the NRC approval of the licensees changes to the security plan, including omissions of information or noncompliance with regulatory requirements from the changes, and licensees are not relief from compliance with the requirements in 10 CFR 73.55.

(U) Duke Energy, in Section 2, Background (4th paragraph, Page 2 of 10) indicate that the current approved Oconee Vital Area List for the Oconee Nuclear Station - Vital Area, inside the protected areas consist of the Control Rooms, Spent Fuel Pools, Central Alarm Station, and five other areas [intentionally not stated], which do not include "the component."

(U) Duke Energy implies with the NRC approved the list of vital areas above, which are inside the protected area, and asserts that the Physical Security Plan with omissions of vital areas, including th identification of vital equipment, was approved, and implies that the vital areas listed above fully complies with the requirement that all vital equipment are in vital areas. The Duke Energy's Physical Security Plan did not identify the vital equipment that are not In accordance with 10 CFR 73.55(e)(9)(i), and exception has not been reviewed or approved by the NRC.

Similarly, the Duke Energy Physical Security Plant submitted in 2004, approved October 2004 and any subsequent revision to the security plans.

(U) The NRC Memorandum from S. Treby, Assistant General Counsel for Rulemaking and Fuel Cycle, Office of General Counsel, to G. Tracy, Chief Operating Licensing, Human Performance, and Plant Support Branch, Office of Nuclear Reactor Regulation,

Subject:

"Legal Analysis of 10 CFR 50.54(p), 10 CFR 50.90, and 10 CFR 73.5 as Applied to Changes to Commitments Contained in Licensees Plans Defined in 10 CFR 50.54(p)(1)," September 15, 2000, Page 3, states:

(U) "Licensee who seek approval of alternative measures which do not met the criteria! for approval of "other measures" under Section 73.55(a) (or from other provisions of Part 73) should be reviewed and approved by the NRC as exemptions under Section 73.5, inasmuch as the provisions for Section 73.5 continue to be available if the more specific provisions of Section 73.55(a) cannot be met. In addition, a conforming license amendment should be processed to change the plan."

(U) The OGC Memo from S. Treby to G. Tracy, September 15, 2000, Page 4, with respect to

"[d]oes NRC approval of these plans [Physical Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan] also constitute exemptions from applicable regulatory requirements?, the OGC states the following:

(U) "Consistent with our discussion above, NRG approvals pursuant to Section 73.55(a) of licensee-proposed alternatives to the requirements of Section 73.55(b) through (h) and Appendices B and C to Part 736 with respect to the Safeguards Contingency Plan and the Guard Training and Qualification Plan do not constitute exemptions. Any further change to these plans must be determined based upon whether the change as proposed by the licensee complies with the provisions of Section 50.54(p}, Section 73.55(a) or Section 73.5."

Page 35 of 56

(U) This further clarified the treatment of alternatives identified in the security plans that were reviewed and approved by the NRC for the citation of inspection violations in May 13, 1982, NRC Memorandum from J. Lieberman, Acting Director of Enforcement to R. Carlson, Director, Enforcement Staff, RI, C. Alderson, Director, Enforcement Staff, RII, R. Warnick, Director, Enforcement Staff, RIii, E. Johnson, Director, Enforcement Staff, RIV, A. Johnson, Director, Enforcement Staff, RV,

Subject:

CITING SAFEGUARDS VIOLATIONS AGAINST APPROVED PLANS, May 13, 1982, which states that "[t]herefore, citations should be made against the plan and not the rule," with regards to alternatives or alternative measures identified in the security plan that were reviewed and approved under the provisions of 10 CFR 73. 55(a) for alternatives.

The citation should reference the license amendment approving the plan."

(U) The requirements for review and approval of alternative (10 CFR 73.55(a) prior to revised final rule in 2009 and the requirements for review and approval of alternative measures (10 CFR 73.55(r), both are reviewed and approved through amendment to the license (i.e., changes to the security plan describing the alternative method or approach) for meeting regulatory requirements, and where exemptions are granted under the provisions of 10 CFR 73.5.

(U) Duke Energy has neither an exemption nor an amendment for alternative that supports the assertions that the NRC approved relief from requirements. The omissions in the Duke Energy's Physical Security Plan does not constitute NRC approval of exemptions from regulatory requirements or the approval of alternatives to regulatory requirements.

(U) The facts that are relevant and omitted by Duke Energy, and the NRC are the NRC issued final rule in 2009 that revised 10 CFR 73.55 for power reactors, which must be fully implemented by March 2010. Duke Energy did not proposed or requested exemptions from requirements of 10 CFR 73.55 prior to the submission of Security Plan, Revision 16 on April 15, 2010 under the provisions of 10 CFR 50.54(p)(2). The NRC do not approve the Security Plan reported under the provision of 10 CFR 50.54(p)(2), including the security plans submitted after March 2010 that is required to describe how it complied with all requirements in the 2009 final rule. The Duke Energy's Security Plan for Oconee Nuclear Station Units 1, 2, and 3, Revision 15, which include the above table, with omissions of vital areas outside of the protected area and identification of vital equipment, submitted in April 2010 was not approved as complying with requirements of 10 CFR 73.55, nor did any NRC records show that the Commission provided approval of exemptions to requirements in 10 CFR 73.55.

(U) The NRC SE, Section 2.3, "Licensing Basis," 4th paragraph, indicate that the staff considered the NRC SE approving and administrative changes to the license on October 29, 2004 and the most recent Security Plan, Revision 26, submitted with report of changes on August 21, 2018 (i.e., 10 CFR 50.54(p)(2) does not result or justify agreement with Duke Energy's assertions in the LAR No. LAR-2018-001 that NRC approved exemptions or relief from regulatory requirements.

(U) The subsequent NRC SE descriptions and staff evaluation of regulatory requirements in the are inadequate based on unsupported information and assertions that Duke Energy has been granted relief (i.e., exemption) from regulatory requirements and result in finding that did not evaluate the LAR No.2018-001 for compliance with requirements of 10 CFR 73.55 that remains legally binding.

Page 36 of 56

SECTION A. 4 COMPLIANCE WITH SECURITY REGULATORY REQUIREMENTS The Enclosure 4, Safety Evaluation (SE), "Safety Evaluation by the Office of Nuclear Reactor Regulation and the Office of Nuclear Incident Response, Amendment No. 411 to Renew Facility Operating License No. DPR-38, Amendment No. 413 to Renewed Facility Operating License No. DPR-47, Amendment No. 412 to Renewed Facility Operating License No. DPR-55, Duke Energy Carolinas, LLC, Oconee Nuclear Station, Units 1, 2, and 3, Docket No. 50-269, 50-270, and 50-287," Agencywide Document Access and Management System (ADAMS) Accession No. ML19056A086, documents the staff evaluations and findings for Duke Energy's license amendment request (LAR) No. LAR-2018-001 submitted on February 12, 2018 (ADAMS Accession No. ML18046A080).

{U) The staff non-concur with the Safety Evaluation (SE) Section 2, "Regulation Evaluation,"

and Section 3, 'Technical Evaluation," and the resulting Section 6, "Conclusion" did not adequately address compliance with security regulatory requirements.

REGULA TORY BASIS AND TECHNICAL REVIEW DID NOT SUFFICIENTLY ADDRESS APPLICABLE REQUIREMENTS AND APPLIED APPROPRIATE STAFF GUIDANCE

{U) The NRC Safety Evaluation for LAR No. LAR-2018-001 did not identify and evaluate the regulatory requirements that form the regulatory basis for adequate physical security, if adequately implemented, would provide the basis for the finding of reasonable assurance of public health and safety. The NRC safety evaluation Section 2.3, "Regulatory Review," of the staff SE for the approval of LAR No. LAR-2018-001, identified regulatory requirements (Page 4) and guidance (Page 4) that were considered in the review of the regulatory basis, including the security licensing basis (Page 3). The NRC SE identifies and describe for the regulatory review the following sections of 10 CFR Part 73:

Item No. Section (U) Requirements (as described in the SE) 1 73.1 "Purpose and scope," of 10 CFR prescribes requirements for the establishment and maintenance of a physical protection system and for protection against the design basis threat of radiological sabotage 2 75.55(a) "Introduction," of 10 CFR states, in part, that each nuclear power reactor licensee shall implement the requirements of 10 CFR 73.55 through its Commission approved Physical Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Cyber Security Plan, referred to collectively as "security plans," and that the security plans must identify, describe, and account for site-specific conditions that affect the licensee's capability to satisfy the reauirements of 10 CFR 73.55.

3 73.55(b) "General performance objective and requirements," of 10 CFR contains performance-based requirements that specify that a licensee's physical protection system will have as its objective to provide high assurance that covered activities are not inimical to the common defense and security and do not constitute an unreasonable risk to public health and safety.

4 73.55(c) "Security plans," of 10 CFR states that the licensee must establish, maintain, and implement security plans to meet the requirements of 10 CFR 73.55 and 10 CFR Part 73, Appendices Band C. The licensee must demonstrate through these plans establishment and Page 37 of 56

maintenance of a security organization, the use of security equipment and technology, the training and qualification of security personnel, the implementation of predetermined response plans and strategies, and the protection of digital computer and communication systems and networks. The licensee must have a management system for development, implementation, revision, and oversight of security implementing procedures. The approval process for implementing security procedures must be documented.

5 73.55(e) "Physical barriers," of 10 CFR states that each licensee shall identify and analyze site-specific conditions to determine the specific use, type, function, and placement of physical barriers needed to satisfy the physical protection program design requirements of 10 CFR 73.55(b).

6 Appendix C "Licensee Safeguards Contingency Plans," of 10 CFR Part 73 describes requirements for a documented plan to give guidance to licensee personnel in order to accomplish specific defined objectives in the event of threats, thefts, or radiological sabotage relating to nuclear power reactors.

(U) The NRC Safety Evaluation, Section 2.3 (Page 4), identifies NUREG 0800, "Standard Review Plan," Section 13.6.1, "Physical Security-Combined License and Operating Reactors,"

Revision 2, dated August 2015 (ADAMS Accession No. ML172918265), as guidance for the physical security review of designs of physical security system."

(U) The non-concurring NRC staff determined the following:

(U) The regulatory requirement of 10 CFR 73.55 captured in the NRC SE are captured in the table above, along with the staff guidance for regulatory review, are not complete and do not address the regulatory requirements that are applicable to "the component" and the protection of the safety/risk significance functions that if unavailable would lead to core damage, and the loss of spent fuel cooling. Specifically, the minimum required, based on the vital functions and the risk/significance of "the component" include that the compliance with prescriptive requirements and performance requirements of 10 CFR 73.55 for a reasonable assurance of adequate physical protection.

(U) The following are minimum requirements, along the administrative controls required for interdiction/neutralization functions and program implementations and organization that establish the regulatory basis for adequate physical protection of nuclear power plant are applicable to the amendment, LAR No. LAR-2018-001, to the licenses for Duke Energy to operate the Oconee Nuclear Station Units 1, 2, and 3 will be in compliance with the Commission's regulations.

Item Section (U) Regulatory Requirements No.

1 10 CFR 73.2 Definitions, Vital equipment means any equipment, system, device, or Vital Equipment and Vital material, the failure, destruction, or release of which could Area directly or indirectly endanger the public health and safety by exposure to radiation. Equipment or systems which would be required to function to protect public health and safety following such failure, destruction, or release are also considered to be vital.

Page 38 of 56

Vital area means any area which contains vital equipment.

2 10 CFR 73.55(b)(3)(i) (3) The physical protection program must be designed to 10 CFR 73.55(b)(3)(ii) prevent significant core damage and spent fuel sabotage.

Specifically, the program must: (i) Ensure that the capabilities to detect, assess, interdict, and neutralize threats up to and including the design basis threat of radiological sabotage as stated in § 73.1, are maintained at all times. (ii) Provide defense-in-depth through the integration of systems, technologies, programs, equipment, supporting processes, and implementing procedures as needed to ensure the effectiveness of the physical protection program.

10 CFR 73.55(b)(9) (9) The licensee shall establish, maintain, and implement an insider mitigation program and shall describe the oroaram in the Physical Security Plan.

10 CFR 73.55(e}(1)(i) (e) Physical barriers. Each licensee shall identify and analyze site-specific conditions to determine the specific use, type, function, and placement of physical barriers needed to satisfy the physical protection program design requirements of§ 73.55(b). (1) The licensee shall: (i)

Design, construct, install and maintain physical barriers as necessary to control access into facility areas for which access must be controlled or denied to satisfy the physical protection program design requirements of paragraph (b) of this section.

10 CFR 73.55(e)(3)(i)(A) Physical barrier systems facilitating interior security response for defense-in-depth protection against the DBT of radiological sabotage.

10 CFR 73.55(e)(3)(ii) (ii) Physical barriers must provide deterrence, delay, or 10 CFR 73.55(e)(3)(iii) support of access control.

(iii) Support effective implementation of the licensee's protective strategy.

10 CFR 73.55(e)(4) (4) Consistent with the stated function to be performed, openings in any barrier or barrier system established to 10 CFR 73.55(8)(ii) meet the requirements of this section must be secured and monitored to prevent exploitation of the opening.

(8)(ii) Penetrations through the protected area barrier must be secured and monitored in a manner that prevents or delays, and detects the exploitation of any penetration.

10 CFR 73.55(e)(5) (5) Bullet Resisting Physical Barriers. The reactor control room, the central alarm station, and the location within Page 39 of 56

which the last access control function for access to the protected area is performed, must be bullet-resisting.

10 CFR 73.55(e)(7)(i) (i) An isolation zone must be maintained in outdoor areas 10 CFR 73.55(e)(7)(i)(A) adjacent to the protected area perimeter barrier. The isolation zone shall be:

(A) Designed and of sufficient size to permit observation and assessment of activities on either side of the protected area barrier; 10 CFR 73.55(e)(7)(i)(B) (B) Monitored with intrusion detection equipment designed 10 CFR 73.55(e)(7)(i)(C) to satisfy the requirements of§ 73.55(i) and be capable of detecting both attempted and actual penetration of the protected area perimeter barrier before completed penetration of the protected area perimeter barrier; and (C) Monitored with assessment equipment designed to satisfy the requirements of§ 73.55(i) and provide real-time and play- back/recorded video images of the detected activities before and after each alarm annunciation.

10 CFR 73.55(e)(8)(i)(C) Be separated from any other barrier designated as a vital area physical barrier, unless otherwise identified in the Physical Security Plan.

10 CFR 73.55(e)(8)(iii) All emergency exits in the protected area must be alarmed and secured by locking devices that allow prompt egress during an emergency and satisfy the requirements of this section for access control into the protected area.

10 CFR 73.55(e)(9)(i) Vital equipment must be located only within vital areas, which must be located within a protected area so that access to vital equipment requires passage through at least two physical barriers, except as otherwise approved by the Commission and identified in the security plans.

10 CFR 73.55(e)(9)(ii) (ii) The licensee shall protect all vital area access portals 10 CFR 73.55(e)(9)(iii) and vital area emergency exits with intrusion detection equipment and locking devices that allow rapid egress during an emergency and satisfy the vital area entry control requirements of this section.

(iii) Unoccupied vital areas must be locked and alarmed.

10 CFR 73.55(e)(10) ( 10) Vehicle control measures. Consistent with the 10 CFR 73.55(e)(10)(i)(A) physical protection program design requirements of§ 10 CFR 73.1 (a)(1 )(E)(iii) 73.55(b), and in accordance with the site-specific analysis, the licensee shall establish and maintain vehicle control measures, as necessary, to protect against the design basis threat of radiological sabotage vehicle bomb assault.

(i) Land vehicles. Licensees shall: (A) Design, construct, install, and maintain a vehicle barrier system, to include passive and active barriers, at a stand- off distance Page 40 of 56

adequate to protect personnel, equipment, and systems necessary to prevent significant core damage and spent fuel sabotage against the effects of the design basis threat of radiological sabotage land vehicle bomb assault.

10 CFR 73.1(a)(1)(E)(iii) A land vehicle bomb assault, which may be coordinated with an external assault; 10 CFR 73.55(e)(10)(ii) (A) (ii) Waterborne vehicles. Licensees shall: (A) Identify 10 CFR 73.1 (a)(1 )(E)(iv) areas from which a waterborne vehicle must be restricted, and where possible, in coordination with local, State, and Federal agencies having jurisdiction over waterway approaches, deploy buoys, markers, or other equipment.

10 CFR 73.1(a)(1)(E)(iv) establish (iv) A waterborne vehicle bomb assault, which may be coordinated with an external assault; 10 CFR 73.55(g)(1}(i}(A) (g) Access controls. (1) Consistent with the function of each barrier or barrier system, the licensee shall control personnel, vehicle, and material access, as applicable, at each access control point in accordance with the physical protection program design requirements of§ 73.55(b).

(i) To accomplish this, the licensee shall: (A) Locate access control portals outside of, or concurrent with, the physical barrier system through which it controls access.

10 CFR 73.55(g)(1 )(8) (8) Equip access control portals with locking devices, 10 CFR 73.55(9)(1)(0) intrusion detection equipment, and surveillance equipment consistent with the intended function.

(D) Limit unescorted access to the protected area and vital areas, during non-emergency conditions, to only those individuals who require unescorted access to perform assigned duties and responsibilities.

10 CFR 73.55(i)(1) Interior detection and assessment systems satisfying the design requirement of 10 CFR 73.55(b) and provide, at all times, the capability to detect and assess unauthorized persons and facilitate interior security response for effective implementation of a protective strategy.

10 CFR 73.55(g)(4)(i) (4) Vital Areas. (i) Licensees shall control access into vital 10 CFR 73.55(g)(4)(ii) areas consistent with access authorization lists.

(ii) In response to a site-specific credible threat or other credible information, implement a two-person (line-of-sight) rule for all personnel in vital areas so that no one individual is permitted access to a vital area.

10 CFR 73.55(i)(2) (2) Intrusion detection equipment must annunciate and video assessment equipment shall display concurrently, in at least two continuously staffed onsite alarm stations, at least one of which must be protected in accordance with Page 41 of 56

the requirements of the central alarm station within this section.

10 CFR 73.55(i)(5)(i) Interior surveillance systems providing capabilities for surveillance, observation, and monitoring to satisfy the design requirements of 10 CFR 75.55(b).

10 CFR 73.55(i)(5}(iii) Unattended openings that intersect a security boundary such as underground pathways must be protected by a physical barrier and monitored by intrusion detection equipment or observed by security personnel at a frequency sufficient to detect exploitation.

10 CFR 73.55(i)(6)(i) Specifications for the illumination for satisfying the design requirement of 10 CFR 73.55(b) and implementing security response.

(U) The NRC Safety Evaluation, Section 2.3, for regulatory requirements and applied in the NRC staff review for the finding that "there is reasonable assurance that such activities will be conducted in compliance with the Commission regulations" did not address those requirements that must be applied for the Duke Energy to operate the Oconee Nuclear Station Units 1, 2, and 3 will be in compliance with the Commission's regulations.

(U) The Duke Energy's proposed additional measures, characterized as "measures that provide increased protection" (Page 1) and "voluntarily made to further increase the margin of protection" LAR No. LAR-2018-001, (Page 3), do not meet the minimum requirements of 10 CFR 73.55 indicated above for a reasonable assurance of adequate protection of vital equipment and protection of SSC from that if unavailable that leads to significant core damage and potential of the loss of cooling for spent fuel sabotage. It is also noted that the voluntary measures to increased protection in the LAR No. LAR-2108-001 are not substantially different, with the exception for a proposed waterborne vehicle barrier system, from those already identified as compensatory measures in Section 19.3.3, Oconee Site, of the Duke Energy Physical Security Plans.

(U) The compensatory measures identified in Section 19.3.3 and similar measures proposed as voluntary, do not meet the requirements and does not support the Duke Energy's assertions, LAR No. LAR-2018-001, Section 2, that:

• (U) "2. The original and existing approach used by Duke Energy for meeting 10 CFR 73.55(e) requirements is consistent with current regulatory guidance,"

• (U) "3. Oconee's current approach for establishing and protecting vital areas complies with past and current regulatory requirements."

• (U) "4. The relevant historical regulatory correspondence demonstrates a consistent progression with appropriate review and approval by the NRG."

(U) The non-concurring staff also determined that the NRC Safety Evaluation, Section 2.3 (Page 4) indicates that the staff reviewed the LAR No. LAR-2018-001 based on NUREG 0800, Section 13.6.1, "Physical Security-Combined License and Operating Reactors," Revision 2, Page 42 of 56

dated August 2015 (ADAMS Accession No. ML172918265), do not provide the staff with the guidance and acceptance criteria for the review of the "designs of physical security system,"

which are found in NUREG 0800, Section 13.6.2, "PHYSICAL SECURITY - REVIEW OF PHYSICAL SECURITY SYSTEM DESIGN-STANDARD DESIGN CERTIFICATION AND OPERATING REACTOR LICNESING APPLICATIONS," Revision 2, dated June 2015, that provide guidance on design of physical security systems meeting the requirements of 10 CFR 73.55.

(U) The NRC Safety Evaluation, Section 3.1.2 (Page 8) for the proposed security measures that states:

(U) "The staff finds that the proposed additional security measures proposed by the licensee for implementation of site specific requirements to be included in the licensee's physical protection program are consistent with the acceptance criteria described in NUREG-0800, Section 13. 6. 1 and meet the regulatory intent of the Commission regulations in: 10 CFR 73.55(b); 10 CFR 73.55(e)(6); 10 CFR73.55(g)(1), (2), and (6);

10 CFR 73.55(h); 10 CFR 73.55(i)(1) and (4); 10 CFR 73.55 (k); 10 CFR 73.55(k)(8);

and 10 CFR Part 73, Appendix C, Section 11.B.2.5. The staff finds that the additional security measures address the key physical protection system elements including security personnel, detection and assessment systems, physical security barriers, access controls, search programs, and implementing procedures, once implemented, will provide reasonable assurance during the HRPOS that the licensee's security force can detect, assess, and respond to a threat against the KHS and, therefore, are acceptable."

(U) The finding above is based on regulatory requirements and staff guidance, acceptance criteria, that are not complete and applied guidance that did not include review for conformance with acceptance criteria in NUREG 0800 Section 13.6.2 to provide the assurance that Duke Energy to operate the Oconee Nuclear Station Units 1, 2, and 3 will be in compliance with the Commission's regulations Page 43 of 56

SECTIONA.4 REGUAL TORY AND TECHNICAL REVIEW DID NOT ADRESS COMPLIANCE WITH THE APPROVED DUKE ENERGY PHYSICAL SECURITY PLAN (U) In Section 2, Background (5th paragraph, Page 2 of 10) of the LAR No. LAR-2018-001, Duke Energy states that the "ONS is currently operating in full compliance with the approved Duke Energy PSP." Duke Energy's statement above implies incorrectly that the NRC approved the Duke Energy's Physical Security Plan that is required comply with the revised requirements of the 2009 final rule, implemented by March 2010. The NRC evaluations and conclusions did not adequately address compliance with approved Duke Energy Physical Security Plan. (See Section A.5).

(U) The non-concurring NRC staff determined the following for the NRC approval of Duke Energy Physical Security Plan:

• (U) On October 29, 2004, the NRC approved the licensees security plans submitted to meet the DBT Order EA-03-086. The NRC Letter from Nakoski to Barron, dated October 29, 2004,

Subject:

"William B. McQuire Nuclear Station, Units 1 and 2, Catawba Nuclear Station, Units 1 and 2, and Oconee Nuclear Station, Units 1, 2, and 3 - Administrative Change to Facility Operating License in Conjunction with the Commission Order EA 086 Regarding Revised Design Basis Threat (DBT); and Revision to Physical Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan (MC2936, MC2937, MC2902, MC2903, MC2945, MC2946, and MC2947)," included approval of alternatives to the requirements of 10 CFR Part 73, which did not include any alternatives for meeting Section 10 CFR 73.55(b) or 10 CFR 73.55(e).

• (U) The NRC letter from Nakoski to Barron, dated October 29, 2004, the table titled "Approved Alternative to the Requirements of 10 CFR Part 73," only identified the approval of alternatives to Sections 73.55(c)(2), 73.55(c)(3), 73.55(d)(4), 73.55(d)(1),

73.55(d)(4), 73.55(c)(5), 73.55(c)(1), and 73.55(d)(7)(i)(B). The approval did not include any exemptions to requirements of 10 CFR 73.55 for requirements of vital equipment or the performance requirements of 10 CFR 73.55(b) to protect against the DBT at all times.

• (U) In 2010, the NRC did not approve the Duke Energy's Security Plan or any other operating reactor licensees' security plans that are required to comply with the 2009 final rule. The NRC did not provide any approval of exemptions or alternatives, 10 CFR 73.5 or 10 CFR 73.55(r), current or past 10 CFR 73.55(a), respectively, that exempted Duke Energy from any requirements in 10 CFR 73.55. The Duke Energy's assertion that it's Physical Security Plans in compliance with the requirements of 10 CFR 73.55 of the 2009 final rule is not supported by the table shown in the PSP addressing the Oconee Nuclear Station, which omit areas that contained vital equipment, including those outside of the vital areas listed inside the power block of the Oconee Nuclear Station Units 1, 2, and 3.

• (U) The NRC review and approval related to conceptual design of the SSS (i.e., SSF) did not provide provided approval of exemptions from requirements of 10 CFR 73.55(b) and applicable sections of 10 CFR 73.55 for protection against radiological sabotage (i.e., protection of safety/risk significant structures, systems and components functions that potentially lead to core damage within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />).

Page 44 of 56

(U) In Section 2, Background (5th paragraph, Page 2 of 10) of the LAR No. LAR-2018-001, Duke Energy states that the "ONS is currently operating in full compliance with the approved Duke Energy PSP." Duke Energy's statement above implies incorrectly that the NRC approved the Duke Energy's Physical Security Plan that is required comply with the revised requirements of the 2009 final rule, implemented by March 2010.

The NRC SE regulatory and technical evaluations did not adequate and independently evaluate the regulatory basis and accepted Duke Energy's unsupported assertion of compliance with NRC approved security plans.

Page 45 of 56

SECTION A.5 SAFETY AND RISK INSIGHTS FOR INFORMED REGULATORY AND TECHNICAL EVALAUTIONS OF THE SAFETY/SECURITY INTERFACE (U) The NRC SE, Section 2.3, "Regulatory Review," discussed the "Licensing Basis,"

paragraph 3 on Page 3, refers to information provided by Duke Energy in LAR No. LAR-2018-001, Section 2, "Background," Page 2, for the assertion that the NRC provided relief in an NRC Regulatory Effectiveness Review relative to the Duke Energy plan to vitalize the SSS in place of other safety systems as an acceptable approach. Section 3, "Technical Evaluation," and the resulting Section 6, "Conclusion," address only physical security with the acceptance of the Duke Energy's characterization and assertions for NRC approval in the LAR No. LAR-2018-001 of safety/risk significance or lack thereof for "the component," without the consideration of the safety/security interfaced.

(U) The staff non-concur with the Safety Evaluation (SE) Section 2, "Regulation Evaluation,"

and Section 3, 'Technical Evaluation," and the resulting Section 6, "Conclusion" based on the fact that the evaluations did not considered safety/risk information and insights for an informed regulatory and technical evaluation for the safety/security interface.

The non-concurring NRC staff determined the following:

(U) In the LAR No. LAR-2018-001, Section 2, Background (Page 2), Duke Energy states:

(U) "2. The original and existing approach used by Duke Energy for meeting 10 CFR 73.55(e) requirements is consistent with current regulatory guidance."

(U) "3. Oconee's current approach for establishing and protecting vital areas complies with past and current regulatory requirements."

(U) "4. The relevant historical regulatory correspondence demonstrates a consistent progression with appropriate review and approval by the NRC."

(U) "5. The [intentionally not stated] and associated power path are not vital equipment and thus are not required to be in a vital area."

(U) Duke Energy's statement above implies incorrectly that the NRC approved or granted exemptions to requirements. The definition of vital equipment, 10 CFR 73.2, remains then and now, "any equipment, system, device, or material, the failure, destruction, or release of which could directly or indirectly endanger the public health and safety by exposure to radiation.

Equipment or systems, which would be required to function to protect public health and safety following such failure, destruction, or release are also considered to be vital." The following are safety/risk insights of the safety basis and the safety/security interface:

• (U) Duke Energy's approach is based on the safety basis that the SSF approved by the NRC is redundant to "the component." The assumptions of the safety basis does not reflect that the NRC approval of the proposal of the SSF or the documented safety findings in the NRC Safety Evaluation for the approval of the SSF, and subsequent update to the facility operating safety basis. The risk-insights from probability risk analysis based on design, configurations, and safety functions of engineered safety and support system bases, do not support the Duke Energy's approach or assertion that "the component" becomes safety or risk significance only when the SSF is unavailable.

Page 46 of 56

• (U) The NRC Safety Evaluation addressing the SSF operability and safety functions did not find or credit the SSF as redundant nor did the NRC finds that the SSF is capable of functions credited or needed for all postulated design basis accident scenarios and accident sequences analyzed in the plant specific Standardized Plant Analysis Risk

[SPAR] Model for Oconee 1, 2, & 3, prepared by Idaho National Laboratory, Battelle Energy Alliance, LLC., December 2017 (i.e., Section 2.0). The beyond design basis accidents of intentional acts (i.e., DBT) are not analyzed in the plant risk analysis or considered in the safety basis for operations on the assumptions that intentional acts are prevented based on adequate physical protection, achieve through meeting the performance and prescriptive requirements in 10 CFR Part 73 applicable to power reactors.

• (U) The risk-informed evaluation based on the Standardized Plant Analysis Risk (SPAR) model, Level 1 PRA, for Oconee shows that the unavailability of "the component," with the availability of the SSF, would result in the conditional core damage probability for such an event approaches 1E-04 CCDP/yr. This level of risk would be equivalent to a RED significance determination process finding. In addition, the overall risk and safety significance of "the component" to the plant based on the Plant Risk Information Book is 1.45E-3, which measures the rate of change in total risk as a result of changes to the probability of an individual basic event. In this case, it measures the impact of loss of the equipment (i.e., functions) to all plant accidents and initiators and not limited to a specific design basis accident scenario. The value of 1.45E-3 is very high relative to other components modeled in the probabilistic risk assessment model and indicates the importance and risk significance of "the component" to the overall risk of the Oconee Nuclear Power Station Units 1, 2, and 3.

• (U) Duke Energy's assertion of its original and existing approach based on the SSF or the safety basis justifying that deleting vital equipment or deleting vital areas (i.e.,

devitalizing vital equipment and vital areas) and the compliance with 10 CFR 73.55(e) requirement is not supported by the NRC approval of the conceptual design of the SSS or the current risk-informed information on the importance and safety/risk significance of "the component."

• (U) Duke Energy did not specify a specific regulatory guide, but asserts that it is in compliance with requirements of 10 CFR 73.55(e). However, the non-concurring staff review of regulatory requirements of 10 CFR 73.55 his is not supported by the fact that regulatory guides, including RG 5.76 (identified in the first paragraph, Pager 3 of 10) are not substitute for regulations and the compliance with requirements of 10 CFR 73.55 is not voluntary.

• (U) Duke Energy statements imply incorrectly that the Commission granted exemptions to requirements. Only if the NRC granted Duke Energy exemptions to requirements of 10 CFR 73.55 would the statement item no. 3 be true. The NRC records do not support that Duke Energy, at any time in the history of the plant operations, requested exemptions or the NRC granted exemptions from any specific requirements in 10 CFR 73.55 prior to or after the required implementation of the 2009 final revised rule.

• (U) The Duke Energy statement above implies that "the component" is not vital and that there is no safety/risk significance to the plant to required protection against the DBT for Page 47 of 56

radiological sabotage. Contrary to this assertion, "the component" meets the definition of 10 CFR 73.2 for vital equipment and is of high safety importance and risk significance for the overall risk of the Oconee Nuclear Station Units 1, 2, and 3 due to the safety/risk significant function credited in accident sequences for the success or failure to prevent core damage.

(U) The non-concurring NRG staff also determined the following:

(U) In the LAR No. LAR-2018-001, Section 2, Background (1 51 and 2nd paragraph, Page 3 of 10), Duke Energy states:

(U) "ONS is in full compliance with the approved PSP; however the proposed changes in this submittal are being voluntarily made to further increase the margin of protection.

. . As such, the current approved PSP identified additional security measures that are taken anytime that the [intentionally not stated] is degraded (i.e. when any systems of the [intentionally not stated] is declared inoperable by Operations personnel). ONS has also voluntarily made changes to existing site procedures creating additional security measures to further increase the protection afforded to the [intentionally not stated] when the [intentionally not stated} is inoperable for a nuclear unit in an outage specifically during Higher Risk Plant Operational State (HRPOS) conditions. The changes proposed in the submittal will incorporate these additional measures into the PSP."

(U) "HRPOS are those higher risk periods of plant operations during a nuclear unit outage where loss of a Key Safety Function due to fire may have higher consequences.

HRPOS is defined to occur when both [intentionally not stated] and [intentionally not stated] coexists until one of the following conditions exists:

• (U) Refueling Canal [intentionally not stated} or

• (U) Have entered [intentionally not stated] period where [intentionally not stated] are available for decay heat removal."

(U) Duke Energy indicated that the additional security measures are to increase the margin of protection and measures described in Physical Security Plan are only required when the SSF is unavailable, due to fire during certain plant condition. The Duke Energy assertions above is not supported by the NRG review, approval and staff safety findings for the SSF, including the NRG review and the findings in the approval of amendment for applying NFPA 805 for risk-informed fire protection. The requirement for safe shut down for fire protection is required for all modes of operations, which include Mode 4 and Mode 5 that correspond to the Duke Energy characterized high risk periods.

{U) The NRG did not find or established the system dependency between the SSF and "the componenf' as implied above. The SSF do not and is not capable of addressing all postulated design basis accident and do not analyze or postulate accident sequences based on intentional acts possible with the DBT for radiological sabotage. For postulated accident sequences, the plant specific SPAR model, Level 1 PRA (e.g., success criteria, systems dependencies, etc.) did not consider the SSF unavailability for the risk and safety significance of "the component," which if unavailable increase significantly the plant core damage frequency that presents unanalyzed conditions for determining the criteria set forth in 10 CFR 50.92, "Issuance of amendment," on whether the proposed amendment would not:

Page 48 of 56

(1) (U) Involve a significant increase in the probability or consequences of an accident previously evaluated; or (2) (U) Create the possibility of a new or different kind of accident from any accident previously evaluated; or (3) (U) Involve a significant reduction in a margin of safety.

(U) VITAL EQUIPMENT NOT IN VITAL AREAS (U) The following are identified from the review of the Oconee security plan.

(U) In addition to "the component," there are three (3) areas of the plant that contained vital equipment that are not in compliance with the requirements of 10 CFR 73.55. The specific building or area containing the SSC that performing functions that are safety/risk significance are identified in Section 19.3.3, "Oconee Site," (page 19-3) of the Duke Energy Physical Security Plan for Catawba, McGuire, and Oconee Nuclear Stations, Revision 16, dated March 3, 2010 by letter from RM.Glover to Document Control Desk, which submitted a changes under the provisions of 10 CFR 50.54(p)(2) that implement the new requirements under 10 CFR Part 73, 2009 final rule and its implementation by March 2010. The SSC providing the vital functions are not located in the designated vital areas identified in Section 14.5, "VITAL AREA ACCESS CONTROLS," (Page 14-14), Revision 16 of the Duke Energy Security Plan that identified the vital areas for Oconee Nuclear Station. The Duke Energy is in non-compliance with the applicable requirements of 10 CFR 73.55 for vital equipment.

(U) Section 19.3.3, "Oconee Site," Revision 16, (Page 19-4) establish in Section C, "Compensatory Measures," that are implemented, when SSF is notified by the Operations Shift Manager or designee of degraded condition. The list of compensatory measures identified in Section 19.3.3.C are not substantially different from those described as additional measures in LAR No. LAR-2018-001 and that described in Section 3.1.2 of the NRC SE. Essentially, the measures identified as additional measures in the amendment are basically the measures that are already described in the Security Plan submitted in March 2010 and currently required by the condition of license and they are not new or substantially different.

Page 49 of 56

SECTION A.6 PROPOSED ALTERNATIVES The following are non-concurring NRC staff proposed alternatives for: (a) assurance of adequate regulatory and technical evaluations for NRC regulatory decision; (b) regulatory actions to address noncompliance; and (c) possible permanent final technical safety/security efficient and effective solution to achieve regulatory compliance and finality.

An additional issue of concern was identified and a course the evaluation of the non-concurrence and a recommendation is identified for determining whether there is a generic issues of whether licensees has identified a complete and accurate list of vital equipment and they are located in vital area.

1. Assurance of Adequate Regulatory and Technical Evaluations for NRC Regulatory Decisions The following should be completed for an independent and thorough evaluation of the regulatory and technical (safety and security) and safety/security interfaced for an adequate and defensible regulatory decisions:

a. Take appropriate actions to seek information to verify licensee compliance with the current licensing basis for that facility and re-evaluate the LAR No.LAR-2018-001 based on complete and accurate information.

b. Re-evaluate the LAR No. LAR-2018-001 with risk-informed and performance-based information on the safety/risk significance of "the component' and the performance capabilities of SSF for all postulated OBA and all modes of operations, not limited to fire protection safe shutdowns.

c. Re-evaluate the LAR No. LAR-2018-001 compliance with performance and prescriptive requirements of 10 CFR 73.55 for protection of "the component" vital functions and capabilities of the SSF for safety/security interface for a reasonable assurance of public health and safety.

2. Regulatory Actions to Address Noncompliance The following are actions within the regulatory framework and processes for licensing and oversight to address noncompliance and the appropriate choices of action, commensurate with the licensee response(s), should be taken restore compliance ..

a. Take necessary licensing actions for seek complete and accurate information on the regulatory and licensing basis for assurance of safety/security requirements for reasonable assurance of public health and safety, beginning with a request for additional information.

b. Take necessary enforcement actions to establish physical security measures that meet the performance and prescriptive requirements of 10 CFR 73.55. Appropriate enforcement discretions should be applied.

Page 50 of 56

c. Take necessary actions "to enable the Commission to determine whether or not the license should be modified, suspended" in accordance with 10 CFR 50.54(f}, which including issuance of an order (10 CFR 2.202 Orders) or a demand for information (10 CFR 2.204, Demand for information) to why the license should not be modified, suspended, or revoked or why such other action as may be proper should not be taken.

3. Permanent Final Technical Safety/Security Efficient and Effective Solution to Achieve Regulatory Compliance and Finality Two possible approaches described below may be considered for a permanent solution to achieve the required safety/security bases that provides a reasonable assurance of public health and safety.

1. A permanent solution should evaluate the installation of engineered SSC to provide redundant capabilities of "the component" function, capabilities for sufficient inventory to keep core covered, and assurance of maintaining of SSF functions within the protected area and protection of all vital equipment with physical security measures meeting the performance and prescriptive requirements of 10 CFR 73.55 requirements. An exemption from 10 CFR 73.55 requirements for "the component" would be requested based on installation of engineered SSC for redundant functions. This approach would eliminate the need to construct and install a waterborne vehicle barrier system and the need for established and proposed additional compensatory physical security measures described in Section 19.3.3, "Oconee," of the Duke Energy- Catawba, McGuire, and Oconee Physical Security Plan.

2. A permanent solution should evaluate the engineered and administrative controls for installation of physical security structures, systems, and components and implementation of operations program requirements that are adequate to meet the performance and prescriptive requirements for "the component," to protect against the DBT for radiological sabotage, without a need for an exemptions. This approach is consistent with accepted approaches implemented by other operating reactors (e.g.,

Limerick Generating Station, Wolf Creek Generating Station, Shearon Harris Nuclear Plant) and provide finality without the need for exemptions to requirements. This approach would eliminate the need compensatory physical security measures described in the Section 19.3.3, "Oconee Site," for special situation effecting security for degraded standby shutdown facility in the Duke Energy Physical Security Plan for Catawba, McGuire, and Oconee Nuclear Stations.

Additional Recommendation On the basis that the non-concurring staff identified that current and past oversight and inspection procedure, has not and does not verify that vital equipment are complete and accurate, and they are within a vital areas, a recommendation that is appropriate and prudent to: (1) establish IP, allocate resources, (2) make available subject matter experts, to verify that licensees has identified complete and accurate list of vital equipment and that vital equipment are located within in a vital area and protected in accordance with all applicable requirements of 10 CFR 73.55. Specifically, for the Duke Energy Oconee Nuclear Station, Section 19. 3. 3, "Oconee Site," of the Duke Energy Physical Security Plan for Catawa, McGuire, and Oconee Nuclear Station, Section B, "Areas Provided Physical Page 51 of 56

Protection," identified four areas within the power block that contain equipment that perform vital functions, which are not in a vital areas and compensatory measures are applied only under certain conditions.

Page 52 of 56

SECTION A.7 REFERENCES

1. Summary of Meeting Held on January 18, 1978, To Discuss a Proposed Safe Shutdown Systems (SSS) for Oconee, Docket Nos. 50-269, 50-270 and 50-287, Licensee: Duke Energy Company (DPC); Facility: Oconee Nuclear Station; Don Neighbors, Project Manager, Operating Reactor Branch 1, Division of Operating Reactor; February 2, 1978.

2. NRC Letter, From Robert W. Reid, Chief Operating Reactor Branch No.4, Division of Operating Reactors, to Mr. William 0. Parker, Jr., Vice President- Steam Production, Duke Power Company, and

Enclosure:

Concept Evaluation [OCONEE NUCLEAR STATION, SAFE SHUTDOWN SYSTEM CONCEPT EVALUATION], December 6, 1978

3. NRC Letter, From John F. Stolz, Chief Operating Reactor Branch #4, Division of Licensing, to Mr. H. B.Tucker, Vice President, Nuclear Production Department [Duke Power Company],

Enclosure:

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION, OCONEE NUCLEAR STATION STANDBY SHUTDOWN FACILITY, DUKE POWER COMPANY, DOCKET NOS. 50-269, 50-270, AND 50-287, April 28, 1983

4. NRC Letter from John Stang, Senior Project Manager, Plant Licensing Branch 11-1, Division of Division of Operating Reactor Licensing, Office of Nuclear Reactor Regulation, to Mr. T.

Preston Gillespie, Site Vice President, Oconee Nuclear Station, OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3, ISSUANCE OF AMENDMENTS REGARDING TRANSITION TO A RISK-INFORMED, PERFORMANCE-BASED FIRE PROTECTION PROGRAM IN ACCORDNACE WITH 10 CFR 50.48(c) (TAC NOS. ME3844, ME3845, AND ME3846), December 29, 2010

5. NRC Letter, From Audrey L. Klett, Project Manager, Plant Licensing Branch 11-1, Division of Operating Reactor Licensing, Office of Nuclear Reactor Regulation, to Mr. Thomas D. Ray, Site Vice President, Oconee Nuclear Station, Duke Energy Carolinas, LLC,

SUBJECT:

OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3 - ISSUANCE OF AMENDMENTS REGARDING THE TECHNICAL SPECIFICATIONS FOR ELECTRICAL POWER SYSTEMS (CAC NOS. MF7417, MF7418, AND MF7419; EPID NO. L-2016-LLA-0002);

Enclosure 4, Safety Evaluation. (ADAMS Accession No. ML 1712A608), November 20, 2017

6. Summary of December 5, 2017, Closed Meeting with Duke Energy Carolinas, LLC to Discuss Security-Related Information for Oconee Nuclear Station, Units 1, 2, and 3 (CAC Nos MG0250, MG0251, and MG0252; EPID L-2017-LRM-0039), Audrey L. Klett, Project Manager, Plant Licensing Branch 11-1, Division of Operating Reactor Licensing, Office of Nuclear Reactor Regulation, and

Enclosure:

List of Attendees. (ADAMS Accession No. ML17341A872), December 8, 2017

7. Letter from J. Ed Burchfield, Jr., Vice President, Oconee Nuclear Station, [Duke Energy Carolinas, LLC] to Document Control Desk, U.S. Nuclear Regulatory Commission,

Subject:

Duke Energy Carolinas, LLC, Oconee Nuclear Station, Units 1, 2, and 3, Updated Final Safety Analysis Report, Revision 27, (ADAMS Accession No. ML 1 ), June 29, 2018 Page 53 of 56

8. Duke Energy Carolinas, LLC, Docket No. 50-269, Oconee Nuclear Station Unit 1, Renewed Facility Operating License, Renewed License No. DPR-39

9. Duke Energy Carolinas, LLC, Docket No. 50-270, Oconee Nuclear Station Unit 2, Renewed Facility Operating License, Renewed License No. DPR-47

10. Duke Energy Carolinas, LLC, Docket No. 50-287, Oconee Nuclear Station Unit 3, Renewed Facility Operating License, Renewed License No. DPR-55

11. Letter from J. Ed Burchfield, Jr., Vice President Oconee Nuclear Station, Duke Energy Carolinas, LLC, to Document Control Desk, U.S. Nuclear Regulatory Commission,

Subject:

License Amendment Request (LAR) for Changes to the Duke Energy Physical Security Plan, License Amendment Request No. 2018-01;

Enclosure:

Evaluation of Proposed Changes (ADAMS) Accession No. ML18046A080), February 12, 2018

12. Letter from J. Ed Burchfield, Jr., Vice President Oconee Nuclear Station, Duke Energy Carolinas LLC, to Document Control Desk, U.S. Nuclear Regulatory Commission,

Subject:

Response to Request for Additional Information Related to Proposed Revisions to the Duke Energy Physical Security Plan, License Amendment Request No. 2018-01, Supplement 2;

Enclosure:

Duke Energy Response to NRC Request for Additional Information," August 23, 2018.

13. Draft Safety Evaluation, SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 2018-01 TO FACILITY LICENSE NOs. DPR-38, DPR-47, and DPR-55, DUKE ENERGY CAROLINAS, LLC.

OCONEE NUCLEAR STATION, UNITS 1, 2, and 3, DOCKET NOs. 50-269, 50-270, and 50-287, November 2018, Prepared by: Dennis Gordon, Reactor Security Branch, Division of Physical and Cyber Security Policy, Office Nuclear Security and Incident Response

14. Standardized Plant Analysis Risk [SPAR] Model for Oconee 1, 2, & 3, December 2017, Idaho National Laboratory, Battelle Energy Alliance, LLC.

15. Email, Vijay Goel, to Louis Cubellis and Pete Lee,

Subject:

Information Request Re; Oconee,

Attachment:

Oconee SLD OEPD training diagram.pdf, October 11, 2018 5:46:54 PM

16. Email, Pete Lee to Mike Markley, Louis Cubellis, Audrey Klett, Doris Lewis, David Curtis, and Shana Helton,

Subject:

Re: Status of NSIR's Oconee License Amendment Request (LAR) Review, October 12, 2018 10:06:12 AM.

17. Email, Antonio Zoulis to Pete Lee and Louis Cubellis,

Subject:

Risk Significance

[Intentionally Not Stated]. October 11, 2018 2:52:43 PM;

Attachment:

Risk Significance of Intentionally Not State]

18. Plant Risk Information e-Book (PRIB), Plant Name: Oconee Nuclear Station, Prepared by:

Idaho National Laboratory for the Office of Nuclear Reactor Research, Division of Risk Analysis, December 11, 2017, Model Version 8.54 (Official Use Only- not publically available)

19. Oconee SLD OEPD Training Diagram Page 54 of 56

20. Memorandum from S. Treby, Assistant General Counsel for Rulemaking and Fuel Cycle, Office of General Counsel, to G. Tracy, Chief Operating Licensing, Human Performance, and Plant Support Branch, Office of Nuclear Reactor Regulation,

Subject:

"Legal Analysis of 10 CFR 50.54(p), 10 CFR 50.90, and 10 CFR 73.5 as Applied to Changes to Commitments Contained in Licensees Plans Defined in 10 CFR 50.54(p)(1)," September 15,2000

21. Memorandum from J. Lieberman, Acting Director of Enforcement to R. Carlson, Director, Enforcement Staff, RI, C. Alderson, Director, Enforcement Staff, RII, R. Warnick, Director, Enforcement Staff, RIii, E. Johnson, Director, Enforcement Staff, RIV, A. Johnson, Director, Enforcement Staff, RV,

Subject:

CITING SAFEGUARDS VIOLATIONS AGAINST APPROVED PLANS, May 13, 1982

22. NRC Inspection Procedure (IP) 71130.03, "Contingency Response- Force on Force Testing," January 1, 2017;

23. NRC Inspection Procedure (IP) 71130.05, "Protective Strategy Evaluation and Performance Evaluation Program," January 1, 2019;

24. NRC Inspection Procedure (IP) 71130.14, "Review of Power Reactor Target Sets," January 1,2018 Safeguards References

25. NRC letter from D.B. Matthew, Director Project Directorate, 11-3, Division of Reactor Projects, to H.B. Tucker, Vice President, Nuclear Production Department, Duke Power Company,

Subject:

"[INTENTIONALLY NOT STATED] PIPING PROTECTION AT OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3," May 30, 1989

26. NRC letter from D.B. Matthew, Director Project Directorate, 11-3, Division of Reactor Projects, to H.B. Tucker, Vice President, Nuclear Production Department, Duke Power Company,

Subject:

"REGIONAL TRANSFER OF 50.54(p) SUBMITTAL FOR OCONEE NUCLEAR STATION, UNITS 1, 2, AND 3," May 30, 1989

27. Letter from Hal B. Tuker, Duke Power Company, to Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation and Document Control Desk (J.F. Stolz, Director, PWR Project Directorate #6, Division of PWR Licensing - B, Office of Nuclear Reactor Regulation),

Subject:

Oconee Nuclear Station, Units 1, 2, and 3, Docket Nos. 50-269. 270. 287, Regulatory Effectiveness Review (Duke Power Company Response to Weakness and Comments), August 31, 1986 (SAFEGUARDS INFORMATION).

28. Letter from Hal B. Tuker, Duke Power Company, to Document Control Desk, U.S. Nuclear Regulatory Commission,

Subject:

Auxiliary Service Water Piping Protection at Catawba Nuclear Station - Docket Nos. 50-413, 0414, McGuire Nuclear Station - Docket no. 50-369, -370, Oconee Nuclear Station - Docket Nos. 50-269, -270, -287, August 26, 1986 (SAFEGUARDS INFORMATION).

29. NRC Staff Memorandum to File, L. J. Bare,

Subject:

Oconee and McGuire Nuclear Station Security, October 18, 1978 (SAFEGUARDS INFORMATION).

Page 55 of 56

30. Memo from J. Philip Stohr, Director, Division of Radiation Safety and Safeguards, to Robert F. Burnett, Director, Division of Safeguards, NMSS,

SUBJECT:

REGULATORY EFFECTIVENSS REVIEW OF OCONEE NUCLEAR STATION SEPTEMBER 19-25, 1985, September 04, 1985 (SAFEGUARDS INFORMATION).

31. NRC staff Memorandum to File, L. J. Bare,

Subject:

Oconee Nuclear Station, Security, Vital Area Analysis, October 2, 1978 (SAFEGUARDS INFORMATION).

32. NRC staff Memo to File: OS 155 and OS 176,, R.L Dobson, Senior Engineer, Electrical Division, Oconee Nuclear Station Industry Security, Vital Area Analysis; Enclosure 1 -

Discrepancies in Vital Area Analyses for Oconee Nuclear Power Station Units 1, 2, and 3; Enclosure 2 - Comments on Draft Supplemental Safety Evaluation Report, Oconee Standby Shutdown System, September 26, 1978 (SAFEGUARDS INFORMATION).

33. Oconee Nuclear Power Station Units 1, 2, and 3, Part II - Vital Area Definition, Based on LANL Vita Area Analysis Printout Dated March 26, 1982 (SAFEGUARDS INFORMATION).

34. NRC Letter from John A. Nakoski, Chief Security Plan Review Team, Project Directorate II, Division of Licensing Project Management, Office of Nuclear Reactor Regulation, to Mr.

Henry B. Barron, Group Vice President Nuclear Generation and Chief Nuclear Officer, Duke Power Corporation,

SUBJECT:

WILLIAM B. MCGUIRE NUCLEAR STATION, UNITS 1 AND 2, CATAWA NUCLEAR STATION, UNITS 1 AND 2, AND OCONEE NUCLEAR POWER STATION, UNITS 1, 2, AND 3-ADMINISTRATIVE CHANGE TO FACILITY OPERATING LICENSE IN CONJUNCTION WITHT EH COMMISSION ORDER EA-03-086 REGARDING REVISED DESIGN BASIS THREAT (DBT); AND REVISION TO PHYICAL SECURITY PLAN, TRAINING AND QUALIFICATION PLAN, AND SAFEGUARDS CONTINGENCY PLAN (MC2936, MC2902, MC2903, MC2945, MC2946, AND MC 2947),

October 29, 2004;

Enclosures:

1. Administrative Change to Renewed FOL Nos. NPF-9, NFP-17, NPF-35, NPF-52, DPR-38, DPR-47, and DPR-55; 2. SE Regarding the Security Plan, October 29, 2004 (SAFEGUARDS INFORMATION).

35. Duke Energy, Oconee Nuclear Station, Pre-submittal Meeting - December 5, 2017, Security Plan Enhancements LAR [Opening Remarks, Regulatory History, Proposed PSP Enhancements, LAR Submittal and Implementation Plan, Closing Remarks]

(SAFEGUARDS INFORMATION)

36. Letter from J. Ed Burchfield, Jr., Vice President Oconee Nuclear Station, Duke Energy Carolinas, LLC, to Document Control Desk, U.S. Nuclear Regulatory Commission,

Subject:

License Amendment Request (LAR) for Changes to the Duke Energy Physical Security Plan, License Amendment Request No. 2018-01;

Enclosure:

Evaluation of Proposed Changes (ADAMS) Accession No. ML18046A080}, February 12, 2018 (NS119932)

37. Letter from J. Ed Burchfield, Jr., Vice President Oconee Nuclear Station, Duke Energy Carolinas LLC, to Document Control Desk, U.S. Nuclear Regulatory Commission,

Subject:

Response to Request for Additional Information Related to Proposed Revisions to the Duke Energy Physical Security Plan, License Amendment Request No. 2018-01, Supplement 2;

Enclosure:

Duke Energy Response to NRC Request for Additional Information," August 23, 2018. (NS123327)

Page 56 of 56

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C 1.0

Introduction:

The Division of Operating Reactor Licensing (DORL) staff appreciates the research and effort that the non-concurrence (NC) submitters performed to ensure that the agency's actions are thoroughly evaluated and that differing views are considered.

DORL staff researched available licensing and correspondence history in the Agencywide Documents Access and Management System (ADAMS) and Safeguards Information Local Area Network and Electronic Safe (SLES) and reviewed the references provided by the NC submitters to determine if the U.S. Nuclear Regulatory Commission (NRC) had established a staff position regarding the acceptability of devitalizing the [Subject Area]. Section 4 of this response lists the documents reviewed by DORL staff.

Based on DORL staff's review, DORL staff believes that the NRC issued a site-specific staff position to the licensee that accepted the devitalization of the [Subject Area] once the SSF was installed and placed into operation. In summary, DORL staff considers the NRC letter dated December 6, 1978, to have established a staff position that it was acceptable for the licensee to devitalize certain areas upon completion of the SSF. This staff position was contingent upon the licensee constructing and implementing the SSF. This letter, in conjunction with the NRC's approval of the construction of the SSF, the lack of NRC action challenging or objecting to the licensee's 1988 submission of Revision 24 of the physical security plan that removed the vital area designation of the subject area, and the NRC's 2004 approval of security plans via amendments without the subject area identified as a vital area, constitute an NRC staff position.

The NRC did not communicate explicitly whether this position was an exemption, an alternative per Part 73.55, or an acceptable means of meeting the regulations; however, this does not obviate the fact that the NRC established a staff position that is subject to the backfitting provisions of 10 CFR 50.109.

The basis for DORL's conclusion is described in Section 2 of this response. DORL addressed the Summary of Issues in Section 3 of this response based on this conclusion.

2.0 Results of Correspondence Research 2.1 SSF Proposal Correspondence Correspondence History:

On December 28, 1973, the Atomic Energy Commission published regulations that established definitions for vital equipment and vital areas (VAs (38 Federal Register (FR) 35430)). These definitions have not changed since issuance of the 1973 rule. On February 24, 1977, the NRC issued a rule that required vital equipment to be in a protected area (42 FR 10836). As discussed in a meeting summary dated February 2, 1978 (ADAMS Accession No. ML15212A318), the licensee informed the NRC in January 1978 that it could not feasibly or economically meet NRC requirements for some vital equipment. An NRC letter to the licensee dated December 6, 1978 (ADAMS Accession No. ML16134A621, non-public), references two letters from the licensee dated February 1 and June 19, 1978 (SLES or ML Nos. not found), via which the licensee submitted a proposed program for a Safe Shutdown System (SSS, now called the Standby Shutdown Facility, or SSF) that would augment existing capabilities relative to the licensee's Modified Amended Security Program (MASP), which was submitted November 21, 1977 (SLES No. not found).

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C In a memorandum to file titled, "[Plant] Industrial Security Vital Area Analysis," dated September 26, 1978 (SLES No. NS104942), the NRC documented that Los Alamos Scientific Labs (LASL) advised the NRC of the results of its vital area analysis for the subject plant.

LASL's analysis produced a list of areas and combination of areas wherein "sabotage could result in 10 CFR Part 100 ["Reactor Site Criteria"] releases." 1 The memorandum then lists what the identified vital areas were before and after "SSF installation." The [Subject Area] was on the "Before SSF Installation" list but not on the "After SSF Installation" list. Two NRC memoranda to file dated October 2 and 18, 1978 (SLES No. NS104942), discussed the need to provide additional protection for the [Subject Area] but did not discuss explicitly the acceptability of devitalizing the [Subject Area].

On December 6, 1978, the NRC issued a letter with an enclosed "Concept Evaluation" to the licensee, which stated that the conceptual design of the SSF was acceptable and will provide relief from the requirements of the MASP regarding designation of vital areas (ADAMS Accession No. ML16134A621, non-public). The Concept Evaluation also stated that the number of vital areas can be reduced when the SSF is in operation. In the cover letter, the NRC stated, "NRC approval of the final design is required before you make any modifications which affect existing safety related structures or systems." This concept evaluation was not provided as part of an amendment, exemption, or Part 73 alternative. However, the NRC issued a safety evaluation (SE) to the licensee in 1983 approving the final SSF design, and an amendment to the licensee in 1992 approving SSF Technical Specifications. Those licensing actions will be discussed further in this response.

On May 13, 1982 NRC issued an internal memorandum to the Regions stating that licensees should submit amendment requests for Part 73 alternatives (ADAMS Accession No. not found, but see Enforcement Guidance Memorandum 85-03 dated February 26, 1985, and memoranda dated January 28 and June 17, 1987). However, the NRC already communicated its staff position to the licensee on the acceptability of reducing the number vital areas in its letter dated December 6, 1978 (ADAMS Accession No. ML16134A621, non-public).

The NRC issued an SE to the licensee dated April 28, 1983 (ADAMS Accession No. ML103370444, non-public), for the licensee's final SSF design proposal. The NRC found that the design meets the appropriate requirements except for some instrumentation issues.

Regarding the treatment of the SSF in the physical security plan, Section 4.9 of the SE states:

The licensee submitted physical security, contingency planning, and guard training and qualification plans in accordance with the requirements of 10 CFR Part 73, Section 73.55 and Appendices B and C. We have determined that these plans satisfy regulatory requirements and accordingly have been approved. The acceptability of the licensee's identification of vital areas required to be protected by 10 CFR 73.SS(c) is contingent upon a confirmatory analysis to be performed by the NRG staff at a future date. [emphasis added]

The SSF, with its capability to independently bring the reactor to safe shutdown, increases significantly the defense-in-depth characteristics of the facility and provides incremental protection against both internal and external sabotage."

1 Section 6.1 of NUREG-1178, "Vital Equipment/Area Guidelines Study: Vital Area Committee Report,"

published in February 1988, explains the criteria in 10 CFR Part 100 used by LASL at the time for determining which equipment was considered vital.

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C DORL Staff Interpretation:

Regarding the information communicated to the licensee via the NRC letter dated December 6, 1978, DORL staff considers that letter to have established a staff position that it was acceptable for the licensee to devitalize certain areas upon completion of the SSF. This staff position was contingent upon the licensee constructing and implementing the SSF. The NRC did not communicate explicitly whether this position was an exemption, an alternative per Part 73.55, or an acceptable means of meeting the regulations; however, this does not obviate the fact that the NRC established a staff position that is subject to the backfitting provisions of 10 CFR 50.109.

Based on internal NRC memorandum dated the September 26, 1978 (SLES No. NS104942),

and later the Regulatory Effectiveness Review (RER) report terminology, DORL staff considers the phrase, "in operation," or "operational" to be a one-time event occurring after the SSF was installed and placed into initial operation instead of the periodic state of operability, which is a term defined in the Technical Specifications. In addition, DORL staff considers the internal memorandum dated September 26, 1978, as reflecting the staff's understanding at the time of the letter dated December 6, 1978, of which areas would be devitalized upon completion of the SSF. The practice of issuing staff positions in letters or SEs without a corresponding licensing action was not unique to this subject at that time (i.e., it appears to have been an NRC licensing practice at the time given similar types of licensing correspondence on other issues). 2 Regarding the internal NRC memorandum dated May 13, 1982, that communicated the expectation that licensees should submit amendment requests for Part 73 alternatives, DORL staff does not consider this memorandum to be negating the staff position established in the letter dated December 6, 1978. Rather, DORL staff interprets the memorandum as instructing NRC staff to correct licensing and inspection practices going forward and not as reversing previous staff positions already communicated to licensees. Therefore, DORL staff considers the concept evaluation establishing a staff position that communicated to the licensee that it was acceptable to reduce the vital areas after the SSF was installed and placed into initial operation.

DORL staff also interprets the staff position as not requiring additional security measures when the SSF is inoperable because vital areas are not situational (i.e., an area is either always a vital area, or it is not a vital area at all).

Regarding the NRC SE dated April 28, 1983, that the NRC issued to the licensee for the licensee's final SSF design proposal, DORL staff believes that this SE created a staff position that the submitted security plans were acceptable but made acceptability of the licensee's identification of vital areas contingent upon a future NRC action (i.e., a confirmatory analysis).

DORL staff believes that this position was a potential change from that already established in the letter dated December 6, 1978, because that future analysis could find the devitalization unacceptable after the NRC already communicated the acceptability of the reduction in vital areas after SSF installation.

2 The response to TIA 2014-01 (ADAMS Accession No. ML18226A215) on degraded voltage protection indicates that plant-specific SEs without corresponding amendments established staff positions.

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C 2.2 Vital Area Confirmatory Analyses Correspondence History:

An internal NRC Regional memorandum dated June 4, 1985 (SLES No. NS121592), documents a site visit summary and concerns with many vital areas no longer being vital areas after the SSF was operational. 3 The memorandum states that the devitalization of the [Subject Area]

appeared unacceptable without some other restrictive control. However, the memorandum also states to leave any additional concerns to the Regulatory Effectiveness Review (RER) that was scheduled for September 1985.

As stated in the internal memorandum from NMSS 4 to the Region dated June 28, 1985 (SLES No. NS121582), the NRC planned to conduct the RER the week of September 17-25, 1985.

The purpose of the RER was to evaluate the overall effectiveness of the plant's safeguards program and to determine whether existing safeguards regulations yielded the level of protection intended by the NRC. On July 22, 1985, the licensee submitted Revision 15 of its PSP (SLES No. NS114363), which discussed the licensee's plans to establish an industrial type of security program for the [Subject Area] after the SSF is operational. By internal memorandum dated September 4, 1985 (SLES Nos. NS104815 and NS121591), the Region informed NMSS that the upcoming RER must consider the licensee's plans to put the SSF in service and devitalize the subject area. The Region also informed NMSS that the RER should consider whether any additional security measures are needed when the SSF is unavailable or inoperable.

By internal memorandum dated December 10, 1985 (SLES No. NS121587), NMSS provided the Region the [Plant] RER Report for comment. Part II, "Vital Area Definition," of the report was based on the Los Alamos National Laboratories (LANL, an NRC contractor) vital area analysis. NMSS stated that the vital areas would be reassessed in the future following completion of the Vital Area Committee work on vital area assumptions. By internal memorandum dated January 17, 1986 (SLES No. NS104810), the Region provided comments on the draft final RER report; however, the record in SLES did not contain the enclosed comments. DORL and Regional staff were unable to locate the enclosed comments. By internal memorandum dated January 10, 1986 (SLES No. NS114315), NRR licensing asked NRR electrical staff for comments on the RER report. In its internal memorandum dated March 26, 1986 (SLES Nos. NS121586 and NS121010), the electrical branch staff did not provide explicit comments about the devitalization of the [Subject Area]; however, it did mention certain capabilities of the SSF having not yet been analyzed.

By internal memorandum, "Vital Area Validation at [Plant]," dated January 6, 1986 (SLES No. NS121589), from the NMSS/SGAS Vital Area Analyst to presumably his branch or section chief, the Vital Area Analyst documented the results for the Vital Area Validation conducted by the SGAS staff as part of the RER. The staff validated the LANL Vital Area Analyses computer printout dated November 15, 1984. This memorandum does not mention the devitalization of the [Subject Area], but states that the SSS provides an alternate and independent means to achieve and maintain hot shutdown and discusses not having to vitalize portions of another building when certain SSS equipment is unavailable.

3 The memorandum discusses the Region's plans to review the licensee's intent to devitalize areas and make a decision (presumably on its acceptability) in 30 days (DORL staff was unable to locate any documentation of a Regional decision on the matter).

4 NSIR's function was in NMSS at the time.

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C DORL staff located a version of the RER report signed by NMSS management on June 13, 1986 (SLES No. NS104817). The RER report contains 6 Parts. Parts I through Ill were made available to the licensee; Parts IV through VI were internal to the NRC.

Part I, "Safeguards Systems Effectiveness Review," of the RER stated that NRC's contractor - LANL - analyzed vital areas for pre- and post-SSF installation. Part I, Section 1.2, "Security Program Description," states, "At the time of the RER, [Plant] was in the process of switching from an approved interim [PSP] to an approved final [PSP]. The final [PSP] is to become completely effective when the [SSF] becomes operational. The [SSF] would provide an alternate and independent means of achieving and maintaining hot shutdown for one or more of the three reactor units. Some of the areas which were vital under the interim plan would not remain vital in the final plan." Part 1, Section 2.0, "Findings," discusses issues of varying significance identified during the review. Sections 2.1, "Potential Sabotage Vulnerabilities,"

and 2.2, "Significant Safeguards Inadequacies," presented the issues deemed to be more significant or higher priority but do not discuss the devitalization issue. However, in Section 2.3, "Safeguards Program Concerns," Section 2.3.2, "Weaknesses of the Physical Barriers at

[Subject Area]," states, "At the time of the review, the [Subject Area] was designated as a vital area .... When the [SSF] becomes operational, the licensee intends that the [Subject Area] will no longer be designated as vital." Section 2.4.5 notes some weaknesses if the [Subject Area] is no longer vital. After this section, the RER report lists possible solutions to the RER concerns, including the construction of an additional protected or vital area for the [Subject Area].

Part II, "Vital Area Definition," Section 2.5, "Plant Status Assumptions," stated that in analyzing the mitigation systems necessary to prevent an off-site radiological release, maintenance of the plant for eight hours in stable hot standby or hot shutdown is considered adequate capability for vital areas. Section 5.3, "Additional Considerations," notes that NUREG-0922 would have the

[Subject Area] be considered vital. Section 5.4, "Redundancy," discusses what measures the licensee should take when the SSF becomes inoperable or unavailable due to routine maintenance, and states that if the licensee elects a protection strategy and vital area option that protects as vital only a single train of a vital system, continued plant operation with a vital component of that system removed from operability for routine or planned maintenance would require the licensee to vitalize instead a redundant component or train as a compensatory measure. The report states that to preclude this need for compensatory vitalization, the licensee should consider routinely protecting some redundant components in excess of the minimum indicated by the analysis in this report. The report states that it may be necessary to pay particular attention to compensatory vitalization if key components of the SSF are unavailable, which could require the licensee to vitalize instead a redundant component or train or [another] system as a compensatory measure. The report states that this would include necessary support systems, including [Subject Area & function] and [associated equipment].

The report states that if credit is given to [another system], then it could be an attractive alternative for compensatory vitalization, and all [support systems] for this [other system] are believed to be in areas that are designated vital in the interim security plan. Section 5.5, "Comparison with Security Plan," provides LANL's comparison of vital areas before and after SSF installation. Section 5.5.2, "Comparison with Final Physical Security Plan," states, "To protect against sabotage during maintenance of the SSF system, one of the options #1 through

1. 9 of Table 5.1 could be protected as a compensatory measure."

Part IV, "Licensing Actions to Correct Plan Deficiencies," of the RER Report, which was not provided to the licensee, discusses those findings that the RER team believed were a result of deficiencies in the approved security plan and could potentially be candidates for backfit under

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C 10 CFR 50.109. The devitalization issue was not listed as an issue that could degrade to a sabotage vulnerability, but the RER report indicated that it could limit the effectiveness of specific elements of the facility's safeguards systems and could be addressed by "routine procedural steps" if the licensee does not initiate voluntary action. In Section 3.2, the RER report acknowledged the [Subject Area] to no longer be vital under the final plan but still providing backup [function] to [security measures], hence the RER had concerns with the listed separation of protected and vital areas and protection of some features. Part V, "Implementation Problems," of the RER Report identifies those issues "subject to correction through inspection and enforcement actions of Regional Office." The devitalization of the

[Subject Area] was not listed as a concern warranting enforcement.

By letter to the licensee dated July 17, 1986 (SLES No. NS114389), NRC sent the RER results to the licensee. The letter states that the findings in the RER do not, in themselves, constitute a requirement for a licensee action, nor a new or changed staff position. The letter also states that the vital area part of the report is not intended to convey any new or changed NRC staff position or backfit, the NRC policy concerning vital areas is presently undergoing staff review, and once the NRC adopts a final position regarding the identification of vital equipment, the vital area analyses of all plants will be re-evaluated from a licensing perspective.

By letter to the NRC dated August 31, 1986 (SLES Nos. NS104941 and NS104943), the licensee provided comments on the RER report. Regarding Part I, Safeguards Systems Effectiveness Review," Section 2.3.2, the licensee states that the [Subject Area] is no longer designated as vital because the SSF is operational and [Plant] Security is operating under the final Security Plan commitments. The licensee also stated, "However, the [Subject Area] vital barriers were approved by the interim security plan, there was no commitment to harden

[Subject Area] during this period." In Part II, "Vital Area Definition," the licensee did not provide any comments regarding devitalization of the [Subject Area].

By internal memorandum dated October 1, 1986 (SLES No. NS104808), NMSS requested comments from other NMSS branches on a draft SE for the SSF changeover. The draft SE states that the SSF was proposed as an alternative and that it was found as an acceptable alternative. DORL staff was unable to find a final version of the SE and assumes that had one been issued, the licensee would have referenced it in its 2018 application, given that the draft SE stated that the SSF was an acceptable alternative.

In February 1988, NRC published NUREG-1178, "Vital EquipmenUArea Guidelines Study: Vital Area Committee [VAC] Report." The abstract for this NUREG states:

A study was conducted by the staff to (1) re-evaluate the guidelines and bases used to determine what are the vital equipment and areas to be protected against radiological sabotage in nuclear power plants and (2) to recommend revised guidance. On the basis of this study, the staff has recommended a revised vital equipmenUarea protection philosophy:[ ... ]. To implement this overall protection philosophy, the staff also has recommended new analysis assumptions or guidelines to identify the specific equipment and areas in each plant that require protection as "vital".

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C Section 3, "Background of Licensing Practices for Physical Protection of Power Reactors Against Sabotage," of NUREG-1178 states, in part:

During its review of [the licensee's] vital area program for [another] plant, the staff used LANL's modeling assumptions as a technical basis for evaluating the adequacy of protecting the [other plant's] standby shutdown facility, which was an alternative to protecting [emphasis added] certain other safety-related equipment. The staff had previously approved this standby shutdown facility protection strategy [emphasis added] for [the plant that is the subject of the NC].

... In the course of this review, a number of questions surfaced concerning LANL's modeling assumptions. To address these concerns, the VAC was established to review the vital area identification process in general, and the modeling assumptions specifically.

Section 6.1, "Proposed Vital Equipment/Area Protection Philosophy and Analysis Assumptions,"

of NUREG-1178 states:

On the basis of its review and evaluation of relevant background information, data, and operational experience, the VAC developed an overall vital equipment/area protection philosophy or goal: to protect as vital [equipment] that provide[s] the capability to achieve and maintain hot shutdown."

Implementation of this philosophy would protect a set of safety-related components rather than protecting all safety-related components. It is derived from and is consistent with Appendix A to 10 CFR Part 100 and Appendix R to 10 CFR 50. Appendix A to 10 CFR 100 defines [equipment] to be protected from the effects of earthquakes; the staff uses this to identify equipment to be protected in design basis events. Appendix R to 10 CFR 50 addresses fire protection. The proposed philosophy also builds on the existing defense-in-depth safeguards approach, which consists of ... determining specific equipment and areas to be protected as vital ... and an assumed shutdown capability.

In summary, protecting as vital [equipment] that provide[s] the capability to achieve and maintain hot shutdown represents an approach to safeguards protection that is consistent both with the existing regulations for ensuring safety under design basis earthquake and fire conditions and with the current approach to safeguards protection. Application of this philosophy will contribute to the overall program designed to provide a high degree of assurance against radiological sabotage.

After re-evaluating the current analysis assumptions, in light of the VAC protection philosophy and these ... assumptions, the VAC developed the revised set of assumptions . . . . Application of these assumptions might result in designation of vital equipment different from that recommended in NUREG-0992, "Report of the Committee to Review Safeguards Requirements at Power Reactors," dated May 1983, which was that several specific plant areas or equipment items be protected as independent vital islands.

On April 4, 1988 (SLES No. NS114357}, the licensee submitted Revision 24 of its physical security plan and deleted interim vital areas and implemented a new vital area. This revision of the plan ceased considering the [Subject Area] as a vital area.

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C By letter dated August 26, 1988 (SLES No. NS104942), the licensee responded to an NRR letter dated June 24, 1988, and informed NRR, "The [function] for [Plant] is very diverse and to eliminate all non-SSF sources of [function sources] would take multiple events," and that these "complex sabotage scenarios ... require numerous activities." The letter indicates that the licensee's position was that it did not have to account for losing these [function sources] in its PSP.

DORL staff is aware of two letters from the NRC to the licensee dated May 30, 1989 (SLES Nos. NS114393 and NS114392). One of the letters was about concerns that the NRC had regarding protection of some piping, which does not appear related to the subject of the LAR.

The other letter was about the transfer of some reviews from the Region to NRC Headquarters and discussed security measures for the SSF in relation to Revision 25 of the licensee's PSP.

Per the licensee's presubmittal presentation dated December 5, 2017 (SLES No. NS124143),

the licensee considered an NRC letter dated May 30, 1989, as approving the vital area list.

By letter dated May 11, 1992, the NRC issued an amendment to the plant (ADAMS Accession No. ML012190128, public), which approved new Technical Specifications [TSs] for the SSF.

The NRC's SE for the amendment stated, "The licensee is proposing the following TS for Section 3.18, "Standby Shutdown Facility," to ensure that the operability of the SSF components is compatible with fire, flooding, and security assumptions used in the design. . . . In 1983, the NRC staff found the SSF design acceptable to meet the safe shutdown requirements for fire protection, turbine building flooding, and physical security." The 1992 SE does not refer to any subsequent effort changing the 1983 SE conclusion and staff positions.

DORL Staff Interpretation:

The RER report expressed concerns with devitalizing the [Subject Area] but ultimately determined that to try to enforce the issues may be a backfit. This concern came after the backfitting regulation was revised in 1985. The RER Report did not list the issue as one that could be addressed via inspection and enforcement. The RER report provided suggestions on how to address the condition of when the SSF is inoperable. DORL staff did not examine whether those suggestions were implemented in developing this response.

The NRC letter to the licensee dated July 17, 1986 (SLES No. NS114389), states that the findings in the RER do not, in themselves, constitute a requirement for a licensee action, nor a new or changed staff position. The letter also states that: (1) the vital area part of the report is not intended to convey any new or changed NRC staff position or backfit, (2) the NRC policy concerning vital areas is presently undergoing staff review, and (3) once the NRC adopts a final position regarding the identification of vital equipment, the vital area analyses of all plants will be re-evaluated from a licensing perspective. DORL staff notes that the "in themselves" wording of the letter would allow for the contingency aspect of the NRC's SE dated April 28, 1983, to be fulfilled because the RER Report was a confirmatory analysis (i.e., the 1983 SE plus the results of the confirmatory analysis would constitute a staff position). However, the internal memorandum from NMSS to the Region dated December 10, 1985 (SLES No. NS121587),

states that Part II of the RER Report will be reassessed following completion of the Vital Area Committee work on vital area assumptions. In addition, the letter to the licensee dated July 17, 1986, also states that the NRC policy concerning vital areas is presently undergoing staff review, and once the NRC adopts a final position regarding the identification of vital equipment, the vital area analyses of all plants will be re-evaluated from a licensing perspective.

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C In February 1988, NRC issued NUREG-1178, which, based on its title, appears to be the "completion of the Vital Area Committee work on vital area assumptions," as discussed in the internal memorandum dated December 10, 1985 (SLES No. NS121587), and the "final position" as discussed in the letter to the licensee dated July 17, 1986 (SLES No. NS114389). This NUREG acknowledged that the NRC had approved the plant's SSF protection strategy. The NU REG also did not appear to state explicitly that the plant's devitalization of the [Subject Area]

was unacceptable. DORL staff views these statements in the NU REG as supporting DORL's interpretation that the NRC had established a position that found the plant's protection strategy, including devitalization of the subject area, acceptable. Although not part of the plant's licensing basis, NUREG-1178 appears to reflect the staff's understanding, at the time of the NUREG's issuance, that the NRC approved the licensee's protection strategy involving the SSF. The NUREG also documented the staff's generic position at the time on criteria for considering areas to be vital areas. The NC submitters indicated that the staff later determined that this NUREG no longer aligns with regulations and is no longer used (as discussed in Regulatory Guide (RG) 5.81 ); however, under the provisions of the NRC's backfitting policy, the staff must consider the guidance and standards used at the time of the subject position and regulatory action - in this case, the licensee's submittal of its PSP revision that removed the subject area as a vital area - when considering the backfitting requirements.

DORL staff was unable to locate documentation regarding the Vital Area Committee work after February or April 1988 showing that the NRC staff took any new or changed positions with respect to the letter dated December 6, 1978, regarding the devitalization of the [Subject Area]

based on completion of the RER and issuance of NUREG-1178. DORL staff believes that Section 6.1 of NUREG-1178 would support an interpretation that the staff's understanding at the time was that equipment that provides the capability to achieve and maintain hot shutdown was to be protected as vital equipment. This understanding was also reflected in the RER report.

DORL staff reviewed various letters, as discussed above, discussing security measures for the SSF and other equipment; therefore, if such follow-up was related to a "re-evaluation from a licensing perspective," then that "re-evaluation" did not pursue enforcement or licensing action regarding the devitalization of the [Subject Area]. One of the letters dated May 30, 1989, appears to acknowledge the treatment of [a structure] as a vital area in Revision 25 of the licensee's PSP. However, DORL staff could not conclude whether NRC considered the plant completely "re-evaluated from a licensing perspective."

In its 1992 SE for the SSF TS amendment, the NRC interpreted the 1983 SE as having found the SSF design "acceptable to meet the safe shutdown requirements for fire protection, turbine building flooding, and physical security," and does not refer to any subsequent effort overturning that conclusion for this licensee.

DORL staff considers the RER effort, of which the Vital Area Validation effort appeared to be part, and the Vital Area Committee work to have not imposed a new or changed staff position on the licensee and, therefore, did not change the staff position issued to the licensee via the letter dated December 6, 1978. Given that the correspondence history shows that the NRC was aware of the devitalization of the [Subject Area] and pursued other issues identified in the RER Report, DORL staff believes the lack of enforcement or licensing actions related to the devitalization of the [Subject Area] reflects the likelihood that the staff considered the devitalization to either be acceptable and/or within the licensing basis.

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C 2.3 2004 Amendment and 2009 Rulemaking Correspondence History:

On October 29, 2004 (SLES Nos. NS100209-x (cover letter), NS100209-02 (license pages),

and NS100209-03 (safety evaluation)), the NRC approved, via amendments, the licensee's PSP that addressed security-related orders for a revised design basis threat. The licensee's PSP contained a listing of vital areas that did not include the subject area. The NRC referenced the PSP in the operating licenses via a new license condition. The orders did not change the definition of a vital area. The NRC's SE for the amendments discusses the identified vital areas as listed in the licensee's submitted PSP.

On March 27, 2009, the NRC issued a final rule, "Power Reactor Security Requirements (74 FR 13926), that revised 10 CFR 73.55 to impose new security requirements on commercial nuclear power reactors. However, this rulemaking did not change the definition of vital areas. The NC submitters informed DORL staff that the rulemaking imposed new requirements for developing target sets, which are derived from vital equipment lists, and that in 2010, the NRC issued Regulatory Guide (RG) 5.81 (ADAMS Accession No. ML102720056, which is not publicly available), which presented a methodology acceptable to the NRC for identifying vital equipment and areas. Section 5.1.2 of RG 5.8.1 states:

The basis for excluding safety-related equipment from the vital equipment list should be documented .... The technical recommendations in NUREG[-]1178, "Vital Equipment/Area Guidelines Study: Vital Area Committee Report,"

published in 1988 should not be utilized for the identification of vital equipment as the assumptions in this document do not consider all equipment that should be identified as vital in accordance with in 10 CFR 73.2.

The licensee's security plan as of September 23, 2019, contains the following statement regarding RG 5.81:

[The licensee's] sites implement a process for oversight of target set equipment and systems. Changes to the configuration are considered in each site's protective strategy. Where appropriate, each site makes changes to document target sets. Regulatory Guide 5.81, "Target Set Identification and Development For Power Reactors[,"] describes a method that the NRC staff considers acceptable for meeting the requirements of 10 CFR 73.55(f).

DORL Staff Interpretation:

DORL staff believes that the NRC's 2004 review of the PSP would not have focused on validating that all vital areas were appropriately identified given that the scope of the orders did not change the definition of vital areas (rather, the SE focused on ensuring that a certain vital area was protected). In addition, the 2009 rulemaking did not change the definition of a vital area. DORL staff believes that the 2009 rulemaking did not establish any new requirements regarding the identification or definition of vital areas. Therefore, DORL staff considers the 2004 license amendments and the 2009 rulemaking as not affecting the staff's position communicated to the licensee in its letter dated December 6; 1978.

Regarding the applicability of RG 5.81, this RG was issued after the 2009 rulemaking and after the implementation date requirements for the new rule. RGs do not constitute requirements;

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C rather, they provide guidance to licensees and applicants on implementing specific parts of the NRC's regulations, techniques used by the NRC staff in evaluating specific problems or postulated accidents, and data needed by the staff in its review of applications. The licensee added a statement in its PSP stating that RG 5.81 provides a method for identifying target sets.

This statement is not a commitment by the licensee to incorporate RG 5.81 into its PSP or otherwise commit to following RG 5.81. It is a mere statement of fact and does not impose RG 5.81 guidance on the licensee as its means for meeting or complying with the applicable regulatory requirement in 10 CFR 73.55. Therefore, DORL staff does not view the RG as a requirement for this licensee.

2.4 Enforcement-Related Memorandum Recent Activities:

Regional inspectors have questioned why the [Subject Area] is not a vital area. An internal memorandum to file, "Meeting Minutes - November 10, 2016 Meeting to Discuss Plant Vital Area," dated November 30, 2016 (ADAMS Accession No. ML16337A041, non-public, limited access), from the Regional DRP Director to the Vital Area Working Group File, stated that staff and managers from the Region and NRC HQ discussed the plant's requirements, why the subject area was not designated a vital area, what actions the licensee should take, and how to implement those actions. The memorandum stated, "We discussed that the plant is in full compliance with all requirements associated with a security event, based on how that plant was licensed [emphasis added]. We agreed that the plant was licensed as a hot-shutdown facility.

We discussed the desire to address information relative to all modes of operation even though we acknowledged that the original license did not require this detail. ... We discussed that to enforce such a change may require utilization of a backfit." The memorandum also indicates that the NRC staff considered that a voluntary request from the licensee to require the compensatory measures it currently has in place for the [Subject Area] at lower modes would be an "increase" in security effectiveness.

The licensee and NRC staff held a presubmittal meeting on December 5, 2017 (meeting summary at SLES No. NS124143), to discuss the licensee's plans to submit an amendment request to address the concerns about the [Subject Area] by obtaining NRC approval of a new security barrier and NRC clarification of the licensing basis. On February 12, 2018 (SLES Nos. NS119932 and NS123327), as supplemented by two letters responding to requests for additional information, the licensee submitted its application.

DORL Staff Interpretation:

Written descriptions in NRC-approved security plans are part of the site licensing basis. The plant's PSP that was approved by the NRC in 2004 contained a written description of its vital areas. The NRC staff approved the security plan via the amendment process and required, via a license condition, the licensee to implement it, thus making the security plan part of the licensing basis. It has been over 30 years since the licensee's 50.54(p)(2) change that devitalized some areas. During that time, the NRC has reviewed this issue on multiple occasions without pursuing enforcement action, the NRC issued a concept evaluation in 1978 approving the licensee's plan to devitalize the subject area, and that the NRC has noted previously backfitting concerns on multiple occasions if enforcement was pursued (i.e., in the 1986 RER report and in the internal NRC memorandum from November 2016). For these reasons, DORL staff believes that the licensee would have a strong position for claiming that an NRC determination that the [Subject Area] should be a vital area constitutes a backfit.

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C 2.5 DORL Conclusion DORL staff believes that the licensee had an NRC staff position on the acceptability of the removal of the vital areas via the concept evaluation dated December 6, 1978, the subsequent SSF licensing actions, the vital area validation effort, the RER, and the issuance of NUREG-1178 and the 2004 amendments that required the licensee to follow the submitted PSP (and included vital area listing) via a license condition. DORL staff believes that the 2009 Part 73 rulemaking did not change that site-specific staff position. DORL staff views the removal of some vital areas via the 50.54(p )(2) PSP change in 1988 to not be a decrease in the effectiveness of the PSP because the licensee already had an NRC staff position that such a change to the PSP was acceptable. The backfit rule was also substantially changed in the 1985 to 1988 timeframe to clarify compliance backfitting.

The NC calls into question the adequacy of NRC's prior approval. DORL staff's view is that a backfit would be needed to address a condition known since 1978, for which there is correspondence that indicates that the NRC understood the situation, found it acceptable, and took no action to change it. If the agency wished to pursue the NC staff's issues further, the staff may need to evaluate it using the backfit process.

Because of the backfit implications, DORL staff did not task any other NRC divisions with assessing or confirming the risk, safety, and security significance to disposition this non-concurrence, which will be reflected in some of the responses to the Summary of Issues in Section 3. DORL staff is proceeding with dispositioning the licensee's request. DORL staff identified the need to clarify and rephrase portions of the draft SE for the licensing action based on research efforts to disposition the non-concurrence, which is discussed further in Section 3.

3.0 DORL Response to Summary of Issues 3.1 Issue 1, "The SE does not address the subject component's safety or risk significance."

Issue 1.a The historical references seem to be of little relevance to the LAR application, because they pertain to circumstances when the SSF is operational. The references indicate the licensee can rely on the SSF (vice the subject component) for achieving safe hot shutdown following fires, flooding, and reactor sabotage events. The references do not indicate how the licensee would achieve and maintain hot shutdown for those events when the SSF is not operational.

DORL Response to Issue 1.a In issue 1.a, DORL staff learned from further discussion with the NC staff that their view is that when the SSF is inoperable, the [Subject Area] is required to be operable for the plant to achieve and maintain hot shutdown, and that the [Subject Area] should, therefore, be a vital area. The NC staff informed the DORL PM that they use the terms "operational" and "operable" interchangeably (i.e., that they mean the same thing).

As discussed in the RER report and the memorandum dated September 26, 1978, NRC staff appeared to make a distinction between operational (or "after installation") and operability per the TSs. NRC staff understood that once the SSF became operational (i.e., after it was installed), the number of vital areas would be reduced. DORL is treating this position as an

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C established staff position and is reviewing the proposed change against that position. If approved, this amendment would provide a staff position within the purview of the plant's current licensing basis on the adequacy of additional measures to take when the SSF is inoperable.

Issue 1.b The SSF is incapable of maintaining the plant in hot shutdown during events where reactor core or spent fuel pool inventory makeup is required. The licensee and SE imply the SSF provides fully redundant capabilities of the subject component. However, the subject component performs critical functions during a broader set of events than the SSF is designed to handle.

For example, regardless of SSF availability, records and risk analyses indicate the subject component is critical for maintaining the safety of the plant during accidents, such as the design basis accident or those related to the safety of the spent fuel pools.

DORL Response to Issue 1.b The DORL PM obtained clarification from the NC staff that the implication is derived not from explicit statements in the license amendment request or draft SE on redundancy, but rather the implied redundancy by taking additional measures to protect the [Subject Area] when the SSF is inoperable. DORL staff agrees with the NC staff that the subject component and the SSF are not redundant (e.g., the SSF is not credited to mitigate design basis accidents described in Chapter 15 of the UFSAR); however, the devitalization of the [Subject Area] is part of the licensing basis. DORL staff will make any needed changes or clarifications to the SE to remove implications of redundancy and focus it within the purview of previous licensing basis information (i.e., that the proposed changes are the additional measures that the staff finds acceptable given that the [Subject Area] is not a vital area per the PSP).

Issue 1.c The same rationale that led to the SSF being declared a vital area would apply to the subject component when the SSF is not operational (i.e., the subject component would meet the definitions of a safety-related component in 10 CFR 50.2 and vital equipment in 10 CFR 73.2.).

Prior to the SSF becoming operational, the licensee relied on the subject component for achieving and maintaining safe shutdown following all events, not just fires, flooding, and reactor sabotage events. Absent new information regarding alternate or additional engineered safety systems or equipment that can assume vital SSF function(s) when the SSF is unavailable, it is reasonable to conclude the licensee would need to rely on the subject component to perform vital safety-related functions normally performed by the SSF.

DORL Response to Issue 1.c DORL staff considers requiring the vitalization of the [Subject Area] to be a change in staff position and, therefore, may need to be evaluated via the backfitting process if pursued by the NRC. DORL staff is approaching the amendment request with the knowledge that the licensee is complying with its current licensing basis. Therefore, the staff is treating the application as a request for additional measures beyond those specified in the PSP and the staff position in the letter dated December 6, 1978.

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C Issue 1.d According to the UFSAR and the Technical Specifications in the facility operating licenses, the subject component, not the SSF, is required for the licensee to operate the plant in all MODES.

In November 2017, the SE for L-2016-LLA-0002 demonstrates staff's regulatory position is the subject component is important at all times and for all MODES. In that action, staff imposed numerous and significant conditions before permitting the licensee to completely disable the subject component for 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> and permit the licensee to make the component operational within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (vs. the normal immediate requirement) for a period of 55 days, even though the SSF, normal offsite power sources, an additional and committed source of offsite power, and Emergency Feedwater and Protected Service Water Systems were operational.

DORL Response to Issue 1.d The NC staff informed the DORL PM that security requirements apply in all MODES of operation. The SSF achieves and maintains MODE 3, Hot Standby. The NC submitters informed the DORL PM that the subject area should always be vital because of this and because the SSF is not credited to mitigate design basis accidents.

DORL staff considers requiring the vitalization of the [Subject Area] to be a change in staff position. Therefore, DORL staff is approaching the amendment request with the assumption that the licensee is complying with its licensing basis. Therefore, the staff is treating the application as a request for additional measures beyond those specified in the PSP and the staff position in the letter dated December 6, 1978. The RER report explains the staff's rationale and assumptions behind the LANL proposed designation of certain areas at nuclear power stations as "vital." Part 11, Section 2.5, "Plant Status Assumptions" of the RER report states:

"Furthermore, in analyzing the mitigation systems necessary to prevent an offsite radiological release, maintenance of the plant in stable hot standby is considered an adequate final state."

DORL staff believes that this rationale may have been used by the staff to justify the [Subject Area] being devitalized. DORL staff believes this issue may need to be evaluated via the backfitting process if pursued further.

Issue 1.e An adversary could cause a station blackout without targeting the protected area. Staff should analyze whether a single-point failure exists on the exterior of the subject component structure; if such a failure point exists, staff should ensure the licensee also protects that area against the design basis threat.

DORL Response to Issue 1.e For the reasons previously discussed, DORL staff believes this analysis would be conducted and evaluated as part of the backfitting process if this issue is pursued.

Issue 2 There appears to be a disconnect between safety and security. The SE seems to rely on the perspective that the licensee is currently complying with physical security requirements, and therefore, any additional measures for protecting the subject component are enhancements.

This perspective implies the NRC inspected the licensee's existing strategy for protecting the subject component while the SSF was not operational (i.e., before implementing the proposed

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C security measures) and found it to be acceptable. The SE presents no information indicating such inspection(s) ever occurred, and it does not explain that even if such inspection(s) did occur, the NRC's physical security oversight program is not designed to verify a licensee's vital area list is complete and accurate.

DORL Response to Issue 2 DORL staff will update the SE to clarify that the NRC created a staff position in 1978 that allowed some areas to be devitalized, as described in Section 2.

Issue 3 The Commission has not granted the licensee an exemption to the vital area requirements or determined that any alternative measures (i.e., like the ones proposed in this LAR) provide equivalent protection to NRG-approved methods. Allowing the permanent use of what the licensee calls "Compensatory Measures" to substitute for the reasonable assurance of adequate protection provided by the regulation is inconsistent with Commission requirements for alternate measures and exemptions, as appropriate. The licensee's proposed security measures should not be considered voluntary, sufficient, or as increasing the margin of protection. The proposed measures would be required, not voluntary, because the vital area designation would transfer to the subject component when the vital safety-related function(s) transfers from the SSF to the subject component. Also, the licensee would need to implement security measures in addition to ones being proposed, because the proposed measures do not meet all of the 10 CFR 73.55 requirements for protecting a vital area. Although the proposed measures would provide more protection for the subject component than the licensee currently affords it, they would not increase the margin of protection because they don't not meet the minimum protection requirements.

DORL Response to Issue 3:

DORL staff believes that the letter dated December 6, 1978, established a staff position that it was acceptable for the licensee to devitalize certain areas after the SSF was installed. DORL staff will clarify in the SE that its decision is being framed with respect to the current licensing basis. For the staff to consider the licensee not in compliance with its licensing basis, the staff would likely have to backfit a change to the licensing basis.

Issue 4 Staff should not characterize inclusion of the security measures in the licensee's security plan as an effective method for ensuring future implementation. Because the SE declares the proposed security measures would increase the margin of protection, history has demonstrated the licensee would easily be able to remove the measures with a subsequent security plan revision pursuant to 10 CFR 50.54(p)(2). The foreseeable argument would be there is no decrease in effectiveness due to the removal of the additional measures, because the minimum regulatory requirements already include the appropriate margin the Commission deemed necessary for adequate protection.

DORL Response to Issue 4:

DORL staff believes that the letter dated December 6, 1978, and subsequent approval of the SSF amendments and the PSPs that listed the current set of vital areas established a staff

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C position about the acceptability of not considering the subject area a vital area. Therefore, the staff considers the additional security measures that the licensee has proposed in its 2018 license amendment request to be voluntary. Whether the licensee can remove the measures via 10 CFR 50.54(p)(2) after implementation of the subject amendment would depend on the Commission's interpretation of what constitutes a decrease in effectiveness, which is beyond the scope of the subject licensing action and cannot be addressed in this response to the NC.

Issue 5 Ultimate responsibility for ensuring the licensee adequately identifies and protects vital equipment rests with the NRG, and staff has an obligation to correct the licensee's apparent refusal to designate the subject component as vital equipment when the SSF is unavailable.

Other licensees (e.g., Limerick, Wolf Creek, Shearon Harris) have established second protected areas for systems or equipment that simply support components that provide the equivalent function(s) as the subject component. Permitting this licensee to not meet existing vital equipment protection requirements without an adequate technical basis could be viewed as disparate licensee treatment.

DORL Response to Issue 5:

DORL staff believes that the letter dated December 6, 1978, and subsequent approval of the SSF amendments and the PSPs that listed the current set of vital areas established a staff position that it was acceptable for the licensee to devitalize certain areas, including the subject area, after the SSF was operational. The licensee's reliance on this staff position that the subject area can be devitalized does not constitute a refusal to designate the subject component as vital equipment, nor does DORL staff consider the establishment of this staff position to constitute disparate treatment. The staff position was based on a site-specific analysis of the purpose and function of the SSF and the impact of the SSF on the licensee's physical protection program. This analysis served as the technical basis for the staff's position and does not constitute disparate treatment. DORL staff will clarify in the SE that its decision is being framed with respect to the current licensing basis for this specific site. For the staff to consider the licensee not in compliance with its licensing basis, the staff would have to backfit a change to the licensing basis.

Issue 6 The correspondence history (e.g., NRC's 1978 and 1983 letters to the licensee), security plans submitted per 10 CFR 50.54(p ), the RER effort, and NRG reviews of security plans did not constitute approval for the licensee to devitalize the component/area of concern. Such approval would have required an approved alternative or an exemption from the NRG per Part 73.

Therefore, the licensee provided inaccurate and incomplete information in its application with regards to its licensing basis.

DORL Response to Issue 6:

Although the NRG did not issue an exemption or approved alternative, DORL staff believes that the correspondence history does establish a staff position as discussed in Section 2, which if changed, may require evaluation through the backfitting process. Notwithstanding the RER report, the licensee did submit the §50.54(p )(2) change in 1988 that devitalized the subject area.

The Region has intentionally decided to not pursue enforcement action for this change, as discussed in its memorandum dated November 2016. The NRG did approve the licensee's

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C security plan in 2004, which DORL considers to be part of the licensing basis (even though the 2004 amendment SE did not discuss the entire list of vital areas, the list was provided as part of the application). In addition, long periods of inactivity on §50.54(p)(2) changes might raise backfitting issues. DORL staff believes that these various positions support having to resolve the NC staff's concerns via another process (e.g., the backfit process) if the agency decided to pursue the concerns.

Issue 7 The licensee did not meet its obligations to protect the plant as required and is not currently complying with Part 73 requirements.

DORL Response to Issue 7:

As discussed above, DORL staff believe that the NRC established a staff position that devitalizing the [Subject Area] was acceptable, and that the licensee's 50.54(p)(2) change that devitalized the area, along with the subsequently approved PSPs, would constitute the licensing basis. DORL views an enforcement action to "vitalize" the [Subject Area] would be a backfit because the NRC has already established a staff position on how the licensee is meeting its licensing basis and, therefore, the regulations. Taking a position that the licensee is no longer meeting regulations would require a backfit to change the plant's licensing basis.

4.0 Documents Reviewed Date Reference Document/Subject 02/01/1973 FR Vol. 38 AEC's proposed rule for vital equipment definition.

No. 21 12/28/1973 FR Vol. 38 No. 248 Final Rule published. Became effective 03/06/1974.

02/1976 ML13350A385 Regulatory Guide 1.29, "Seismic Design Classification,"

(public) Revision 2 02/24/1977 FR Vol 42, NRC power reactor security rule, which created 73.55 No. 37, pgs 10836- and applied it to all operating power reactor licensees 40 and applicants.

05/25/1977 Referenced in Licensee's Amended Security Plan submittal ML15212A318 (public) 11/21/1977 Same as above Licensee's Modified Amended Security Plan (MASP) submittal 01/23/1978 SGI, Non-Public Revision 1 of Review Guideline No. 17, "Definition of Vital Areas" 02/02/1978 ML15212A318 Meeting summary for a 01/18/1978 meeting (public) 02/01/1978 Referenced in the Licensee submittals of a proposed design for a Safe 06/19/1978 non-public Shutdown System that would augment existing 12/06/1978 letter capabilities relative to the fire protection plan (FPP), the below MASP, and Turbine Building (TB) flooding.

09/26/1978 NS104942 NRC Memorandum to File: "[Plant] Industrial Security SGI, Non-Public Vital Area Analysis" 10/02/1978 NS104942 NRC memorandum for file SGI, Non-Public

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C Date Reference Document/Subject 10/18/1978 NS104942 NRC memorandum to file SGI, Non-Public 12/06/1978 ML16134A621 Letter with an enclosed "Concept Evaluation [CE]" from (non-public) NRC [R. Reid, NRR, Division of Operating Reactors] to licensee rw. Parkerl 05/13/1982 Non-public. Refer NRC memorandum from OE to the Regions re. Part 73 to EGM 85-03 dated alternative submissions.

02/26/1985; 01/28/1987 memo; 06/17/1987 memo 04/28/1983 ML103370444 NRC Safety Evaluation (SE) on SSF final design (non-public) proposal.

Incoming: 3/28/80, 2/16/81, 3/31/81, 4/13/82, 9/20/82, 12/23/82 06/04/1985 NS121592 Regional memorandum ("[Plant][SSF] Docket Nos .... ")

SGI, Non-Public 06/28/1985 NS121582 "Regulatory Effectiveness Review Program" Non-Public Letter from NMSS Director to Reqional Administrator 07/22/1985 NS114363 Revision 15 of [Plant] PSP - Industrial type of Security SGI, Non-Public Proqram for [Subject Areal.

09/04/1985 NS104815 Internal NRC memorandum from Region/DRS to NMSS NS121591 regarding the RER scheduled for Sept 19-25, 1985.

SGI, Non-Public The document also contained Part II, "Vital Area Definitions," of the LANL report (print date of March 26, 1982; document attachment dated July 14, 1986).

12/10/1985 NS121587 Cover Letter of Memorandum from NMSS to Region and (U), Non-Public NRR, "[Plant] [RER] Report," provides the draft final report for comment for the RER done in September 1985.

01/06/1986 NS121589 Internal memorandum from NMSS/SGAS staff (i.e., the SGI, Non-Public "VA Analyst") to the section or branch chief.

Subject:

"[VA] Validation at [Plant]"

01/10/1986 NS114315 Request from NRR licensing to NRR electrical branch SGI, Non-Public askinQ for comments on the RER report.

01/13/1986 Letters from NRR to licensee re. removal of vitalization of equipment.

01/17/1986 NS104810 Memo from Region/DRS Director to NMSS re. "[Plant SGI, Non-Public RERl Report" 03/26/1986 NS121586 Electrical branch comments from NRR to NMSS NS121010 SGI, Non-Public 06/13/1986 NS104817 Regulatory Effectiveness Review Report.

SGI, Non-Public 07/14/1986 NS121590 Copies of final RER report - cover letter only from SGI, Non-Public NMSS to NRR 07/17/1986 NS114389 Letter from NRC/NRR to the licensee discussing the SGI, Non-Public results of the RER effort at [Plant].

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C Date Reference Document/Subject 08/31/1986 NS104941 Letter from licensee to NRC (Harold Denton) regarding NS104943 the RER (licensee's response to weaknesses and SGI, Non-Public comments).

10/01/1986 NS104808 NMSS memo to other NMSS branches requesting SGI, Non-Public comments on a draft SE for SSF chanoeover.

10/10/1986 NS103144 NMSS memo that mentions the SSS.

SGI, Non-Public 11/09/1987 NS114353 Rev 22 of [Plant] PSP SGI, Non-Public 02/1988 Non-Public NUREG-1178, "Vital EquipmenUArea Guidelines Study:

Vital Area Committee Report" 04/04/1988 NS114357 [Plant] PSP Rev 24 SGI, Non-Public 08/26/1988 NS104942 Licensee letter to NRR regarding [system] protection.

SGI, Non-Public 05/30/1989 NS114393 Two NRC letters to the licensee identifying issues of NS114392 concern regarding the security features.

SGI, Non-Public The May 25 PSP can be found at NS 114122.

The licensee's August 30 clarification letter is at NS114120.

05/11/1992 ML012190128 SSF TS Amendments issued to licensee.

(public) 09/15/2000 ML003750432 OGC memorandum Non-public 10/29/2004 (U} NS100209-x:CL NRC approval of amendments, adding the [Licensee (U} NS 100209-02: Fleet] PSP to the operating license via a license OL condition. (Incoming: 9/8, 9/30, 10/15, 10/21, 10/27/04)

NS 100209-03: SE SGI, Non-Public 03/27/2009 74 FR 13926-13993 Part 73.55 rulemaking approved; new rule must be fully implemented bv March 2010.

11/---/2010 ML102720056 Regulatory Guide 5.81, "Target Set Identification and Non-Public Development for Nuclear Power Reactors."

09/29/2016 ML16193A517 Letter explaining why NRC could not endorse proposed (Public) NEI Guidance Document 16-02, Licensing Basis of Vital Equipment and Vital Areas," Revision 0, dated April 2016 11/30/2016 ML16337A041 Internal NRC Memorandum from Joel T. Munday Non-public (Region DRP Director) to VA Working Group File, "Meeting Minutes - November 10, 2016 Meeting to Discuss Plant Vital Area" 11/20/2017 ML17124A608 Oconee amendments 406, 407, and 408 regarding the (public) technical specifications for electrical power systems, EPID No. L-2016-LLA-0002 12/05/2017 NS124143 NRC summary of 12/5/17 presubmittal meeting with SGI, Non-Public licensee 02/18/2018 NS119932 Subject License Amendment Request SGI, Non-Public

ATTACHMENT TO NCP-2019-001, FORM 757, SECTION C Date Reference Document/Subject 08/23/2018 NS123327 RAI Response related to above amendment request SGI, Non-Public 02/01/2019 ML19085A043 DPO Case File DP0-2018-003, "Regulatory Framework (public) governing power reactor licensee security plan changes ML18319A186 submitted under 10 CFR 50.54(p )(2)"

ML18319A161 (non-public)