ML20081E262

Foundation for the Adequacy of the Licensing Bases.A Supplement to the Statement of Considerations for the Proposed Rule on Nuclear Power Plant License Renewal (10 CFR Part 54).Draft Report for Comment

ML20081E262
Person / Time
Issue date:	07/31/1990
From:	Office of Nuclear Reactor Regulation
To:
References
FRN-55FR29043 AD04-1-027, AD4-1, AD4-1-27, NUREG-1412, NUREG-1412-DRFT, NUREG-1412-DRFT-FC, NUDOCS 9008070326
Download: ML20081E262 (106)

Text

{{#Wiki_filter:- NUREG-1412 l u I Foundation for the Adequacy l of the Licensing Bases j e A Supplement to the Statement of Considerations j for the Proposed Rule on Nuclear Power l Plant License Renewal (10 CFR Part 54) u 1 Draft Report for Comment l i U.S. Nuclear Regulatory Commission OITice of Nuclear Reactor Regulation i L g* " %, e k; f.. ) 2

88" 48ll!e '

7 1412 R PDR v. ... ~...,

AVAILABILITY NOTICE Availability of Reference Matorials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources: 1. Tho NRC Public Document Room 2120 L Stroot, NW, Lower Level, Washington, DC 20555 2, The Superintendent of Documents U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013 7082 3. The National Technical infoimation Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publica-tions, it is not intended to be exhaustivo. Referenced documents available for Mspection and copying for a fee from the NRC Public Document Room includo NRC correspondence and intemal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investi-gation noticos: Licenseo Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence. The following documents in the NUREG series are available for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRC sponsored conference proceed. Ings, and NRC booklets and brochures. Also available are Regulatory Guides. NRC regula-tions in the Code of Fodoral Regulations, and Nuclear Regulatory Commission issuances. Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agenclos and reports prepared by the Atomic Enorgy Commissica, forerunner agency to the Nuclear Regulatory Commission. Documents available from public and special technical librarios includo all open literature-items, such as books, journal and periodical articlos, and transactions. Federal Register noticos, federal and stato logislation, and congressional reports can usually be obtained from these libraries. Documents such as theses, dissoitations, foreign reports and translations, and non-NRC conference proceedings are available for purchaso from the organization sponsoring the publication cited. Single copios of NRC draft reports are available free, to the extent of supply, upon written roquest to the Offico of Information Rosourcos Managoment, Distribution Section U.S. Nuclear Rogulatory Commission, Washington, DC 20555. Copios of industry codes and standards used in a substantivo manner in the NRC regulatory process are maintained at the NRC Library,7920 Norfolk Avenue, Bethesda, Maryland, and are available thoro for reference uso by the public. Codes and standards are usually copy-righted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards institute,1430 Broadway. Now York NY 10018. 4

N UREG-1412 Foundation for the Adequacy of the Licensing Bases A Supplement to the Statement of Considerations for the Proposed Rule on Nuclear Power Plant-License Renewal (10 CFR Part 54) - Draft Report for Comment 1 Manuscript Completed: May 1990 l I) ate Published: July 1990 i i i OITice of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555 l. f* "*y9, 'l.>w/.} i A 4 i I ' i

e l

ABSTRACT In order to limit the Commission's license renewal decision to consideration of whether age-related degradation has been adequately addressed, the Part 54 rulemaking must make a generic finding for cl1 nuclear power plants that the i adequate protection or reasonable assurance findings for issuance of an operating license continue to be true at the time of the renewal application p and eccordingly need not be made anew at the time of license renewal. The objective of this analysis is to describe the regulatory processes that form the bases for the staff's conclusion that any plant-specific licensing bases at the time of license renewal will continue to provide reasonable assurance of the protection of the public health and safety. This document discusses how the licensing process has evolved in major safety issue areas under existing regulatory processes that have ensured continued adequacy of the licensing bases of all operating plants. The document presents the described regulatory processes as the Commission's reasons for considering it unnecessary to re-review an operating plant's licensing basis, except for age-related degradation concerns, at the time of license renewal. This report is a supplement to the Statement of Considerations for the Nuclear Regulatory Commission's proposed rule (10 CFR Part 54) that would establish the criteria and standards governing nuclear power plant license renewal. iii

h y . TABLE OF CONTENTS a -- Page ABSTRACT.............................................................. iii 1. GENERAL.......................................................... 1-1 o Objective of This. Analysis...............-................... 1-1 1.1 - 1. 2 Scope of This Analysis....................................... 1-1 1.3 Technical and Policy 0verview............................... 1-2 1.4 Conclusions................................................. 1-6 . 2.- SITE-RELATED ISSVES.............................................. 2-1 1 2.I'LGeography, Demography, and Potential Site-Proximity Hazards. 2-1 'I 2.2, Meteorology................................................. 2-3 1 2.3 Hydrologic Engineering...................................... 2-5 2,4 ~ Geologic, Seismologic, and Geotechnical Engineering......... 2-7 1 3. DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS......... 3 -' 1 3.1 Scope........................................................ 3-1 j 3.2: Conformance With'NRC General Design Criteria................ 3-1 3 3.3 Classification of Structures, Components, and Systems....... 3-2 'i 13. 4 Wind, Tornado, and Flood Protection......................... 3-3 - 3. 5 Missile _ Protection.......................................... 3-4. i 3.6: Protection Against. Dynamic Effects Associated With ' Postulated Rupture of Piping................................ _3 1 3.7 Seismic Design.............................................. 3-6 1 3.8 Design of Seismic Category I Structures..................... 3-8 1 3.9: Mechanical Systems and Components........................... 3 3.10 Seismic and Dynamic -Qualification of Mechanical and Electrical Equipment........................................ 3-10 j 3.11 Envi,ronment-Design of Mechanical and Electrical Equipment... 3-11 i 4. REACT 0R.......................................................... 14 1 4.1. Scope....................................................... 4-1 1 4.2 Fuel System Design.........................................'. 4-1. ~ 4. 3 Nuclear Design.............................................. 4-2 4.4 Thermal.and Hydraulic Design................................ 4-2 j 4.5 Reactor Materials........................................... 4-3: 4.6. Functional Design of Reactivity Control Systems............. 4-4 5 '.. REACTOR COOLANT-SYSTEM AND CONNECTED SYSTEMS.................... 5

• 5.1 Scope.......................................................

5-1 5.2 Integrity of Reactor Coolant Pressure Boundary and Reactor i Vessels........................................ 5-1 l.

5. 3 Component and Subsystem Design..............................

5-4 j L i m v

TABLE OF CONTENTS (Continued) P,a(Le 6. ENGI NE E RED S AFE TY F EAT URE S....................................... 6-1 6.1 Scope....................................................... 6-1 6' 2 Metallic and Organic Materials.............................. 6-1 6.3 Containment Systems......................................... 6-2 6.4 Emergency Core Cooling Systems.............................. 6-4

6. S Habitability Systems........................................

6-6 ) 6.6 Fission Product Removal and Control Systems................. 6-7 7. INSTRUMENTATION AND CONTROL SYSTEMS.............................. 7-1 7.1 Scope....................................................... 7-1 7.2 Development of Regulatory Requirements...................... 7-1 i 7.3 Reactor Trip System......................................... 7-1 7.4 Engineered Safety Features Actuation Systems................ 7-3 7.S Safety-Related Display Instrumentation...................... 7-4 7.6 Safe Shutdown and All Other Systems Required for Safety..... 7-S 7.7 Control Systems............................................. 7-6 7.8 General Conclusions,........................................ 7-6 8. ELECTRICAL P0WER................................................. 8-1 8.1 Scope....................................................... 8-1 8.2 Safety Issues and Regulatory Requirements................... 8-1 8.3 Evolution of Current Licensing Basis........................ 8-1 8.4 Conclusions................................................. 8-3 9.' AUXILIARY SYSTEMS................................................ 9-1 9.1 Scope....................................................... 9-1 9.2 Safety Issues and Regulatory Requirements................... 9-1 9.3 Evolution of Current Licensing Basis....................... 9-1 9.4 Conclusions................................................. 9-4 10. STEAM AND POWER CONVERSION SYSTEM............. 10-1 10.1 Scope....................................................... 10-1

10. 2 Safety Issues and Regulatory Requi rements...................

10-1 10.3 Evolution of Current Licensing Basis......................... 10-1 10.4 Conclusions................................................. 10-3 11. RADI0 ACTIVE WASTE MANAGEMENT SYSTEMS............................. 11-1 11.1 Scope....................................................... 11-1 11.2 Safety Issues and Regulatory Requirements................... 11-1 11.3 Evolution of Current Licensing Basis........................ 11-1 11.4 Conclusions................................................. 11-2 vi

1, TABLE OF CONTENTS'(Continued) o Pa2e 12. RADIATION PROTECTION.............................................. 12-l' 12.1-Scope....................................................... 12-1 12.2 Safety Issues and Regulatory Requirements................... 12-1

12. 3 Evolution of Current Licensing Basi s........................

12-2 12.4 Conclusions................................................. 12-4 13. CONDUCT OF OPERATIONS................................c........... 13-1 13.1 Management, O 13 13.2 Training'..-..perations, and Technical Support Organizations. 13 '13.3 Emergency Planning..........-................................ 13-4 q o 13.4 Review and Audit............................................ 13-6 1 7 13.5 Plant Procedures............................................ 13-7 i L 13.6: Physical Security............................. 13-9 14. INITIAL TEST PR0 GRAM............................................. 14-1 14,1 Safety Issues ' and Regulatory Requi rements................... 14 14.2 Evolution of Current Licensing Basis........................ 14-1 14.3 Conclusions.- 14-1 N 15. ACCIDENT ANALYSES.............................................-... 15-13 15.1 Scope......................... '15-1 215.24 Safety Issues and Regulatory Requirements........s..........- 15 15.3 Evolution of Current Licensing Basis.....s.................. 15-1 15~.4 Conclusions............................. ..............~..... 15-2 l -16. TECHNICAL SPECIFICATIONS.'........................................ 16-1 l a 16 ' 1 S c o p e.... :.................................................... 16 U 16.2 Safety Issues and Regulatory Requirements =.................. 1= y -16. 3 Evolution of Current Licensing Basis........................ 16 1 16.4 Conclusions....................-........................... 16-2 l 1 1 17. QUALITY ASSURANCE..-.............................................. 17-1 17.1 Scope....................................................... 17-1 p-

17. 2. Safety -Issues and Regulatory Requirements...................

17-1 1

17.3 Evolution of. Current _ Licensing Basis........................

17-1: H 17.'4 Conclusions................................................. '17 '18. ,-HUMAN FACTORS ENGINEERING........................................ 18 1 18.1 Scope.......................-................................ 18-1 '18.2: Control Room................................................ 18-1 18.3 Safety Parameter Display System............................. 18-2 i i i vii i l

s n ,p - ly' h t e TABLE 0F CONTENTS (Continue'd)' c,. f. ik -19.; SAFETYcISSVE RESOLUTION:-TECHNICAL AND IMPLEMENTATION-STATUS'..... 19 n,,. -19.1 L S c o p e.... :.................................... :.'.......... '...... 19-1 -19. 2 LSafety Issues and Regulatory Requirements.......-...-........... 19-l'- 1 n .-19.3 Regulatory Process and Implementation Status......-........... 19 Ji 19. 4. C o n c l u s i o n s................................................ '. :. - 19-3: .j [ m 1 i l 4 ') 1 s.. 5 N.' i g .*i n.<- s> ( i g r. .a i .ty) 3 .,r J - d ( o. _c

v: -;;..

[, l:4 ;' -) .-j s E & f.,, t

. lt =~

. {

s -. a r -..

ils.

v ~ + .f' l ., f ; iy'# 4 c:: a e'h e s r f j m .j!

i jV

.'I ,1

l

_n ,p-

w...

viii [ 3 1 ' h ": ?if

i 1. GENERAL 1.1 Objective of This Analysis In order to limit the Commission's license renewal decision to consideration of' whether age-related degradation has been adequately addressed, the Part 54 rule-making must make a generic finding for all nuclear power plants that the adequate protection or reasonable assurance findings for issuance of an operating license continue to be true at the time of the renewal application and accordingly need not be made anew at the time of license renewal. The objective of this analysis is to describe the regulatory processes that form the bases for the staff's con-clusion that any plant-specific licensing bases at the time of license renewal will continue to provide reasonable assurance of the protection of the public health and safety. This report is a supplement to tr. Statement of Considerations for the Nuclear Regulatory _ Commission's proposed rule (10 CFR Part 54) that would establish the criteria and standards governing nuclear power plant license renewal. 1.2 Scope of This Analysis This document discusses how the licensing process has evolved in major safety issue areas under existing regulatory processes that have ensured. continued adequacy of the licensing bases of all operating plants. The document presents the described regulatory processes as the Commission's reasons for considering it unnecessary to re-review an operating plant's licensing basis, except for age-related degradation concerns, at the time of license renewal. The document does this in generic terms. i'lant-specific details of how the regulatory pro-cesses have-been implemented for specific' technical areas can be found in the docket files containing _the-records of individual plant license applications and licenses. .The statement of considerations for the license renewal rule includes an overview of the basis for the initial and continued adequacy of the current . licensing basis (CLB), identifying and explaining the elements of the licensing approach relied on, including the original licensing basis, the workings of the Commission's backfit policy, and the roles of operating event monitoring and safety issue resolution in ensuring that the CLB continues to be adequate. In the present document, that overview is recapitulated and supported by addition of a substantial detailed examination of the CLB adequacy basis for the full. range of specific major safety-issue areas. In the examinations for each of these areas the safety issues involved are described, the key features of the regulatory requirements are noted, the evolution of the current licensing bases is explained, and conclusions are P asented, recapitulating the main foundations for the continued acceptability of the CLB for older as well as newer plants. 1-1

13 Technical and Policy Overview 1.3.1 Principles of Proposed Rule The rule that the Commission proposes for license renewal is founded on two key principles. The first principle is that, with the exception of age-related degradation, the current licensing basis at any specific reactor provides and maintains an acceptable level of safety for operation during the initial term L that is sufficient to provide reasonable assurance of the public health and safety, and that the same acceptable level of safety, if continued to be main-tained, is also adequate for continued operation during any renewal period, I i The second principle is that the M ant's current licensing basis will be main-tained during the renewal period, in part through a program of age-degradation management for systems, structures, and components. This report relates to the first of these principles--that any plant-specific current licensing basis provides reasonable assurance of public health and safety. 1.3.2 Current Licensing Basis Defined and Explained As defined in the proposed rule, the current licensing basis (CLB) means the Commission requirements imposed on the plant that are in effect at the time of the renewal application. These include the requirements at the time that the initiallicensefortheplantwasgrantedtogetherwithrequirementssubsequently imposed. It includes the licensee s commitments for compliance with those requirements at the time the initial license was granted, including those docu-mented in the operating license application or Final Safety Analysis Report I (FSAR). Further, tne CLB includes those requirements and commitments as modi-fied or supplemented by additional requirements imposed by the Commission and by commitments made by the licensee during the period of plant operation up to the filing of a renewal application that are part of the docket for the plant's license. More specifically this includes, but is not limited to, plant-spec'fic compliance with the Commission regulat Mns as prescribed in Parts 2, 19, 20, 21, 30, 40, 50, 55, 72, 73, and 100 and tht appendices thereto of Title 10 of the Code of Federal Regulations; orders; license conditions; exemptions; and tech-nical specifications. In addition, the current licensing basis includes written commitments made in docketed licensing correspondence such as responses to NRC bulletins and generic letters. .The CLB differs among plants. CLB differences arise from differences in license date as well as differences in.such factors as site, plant design, and plant operating experience. This document describes and discusses the regulatory pro-cesses casigned'to ensure that the CLBs of older plants remain acceptable, in part through backfit of newly evolving requirements and guidance when that is necessary for adequate safety or warranted as worthwhile safety enhancements. Analyses-in this document show in specific detail how these evolutionary pro-cesses have worked in the various safety-issue areas--and with what specific results--in ensuring acceptability of the varying CLBs of the NRC-licensed nuclear power plants. 1.3.3 Acceptable Level of Safety The Atomic Energy Act directs the Commission to ensure that nuclear power plant operation provides adequate protection to the health and safety of the public. 1-2

-However, adequate protection is not absolute protection or zero risk and there-fore safety improvements beyond the minimum needed for adequate protection are possible. As new information is developed on technical subjects, the NRC iden-tifies potential hazards and then requires that designs be able to cope with such hazards with sufficient safety margins and reliable systems. When new information may reveal an unforeseen significant hazard or a substantially greater potential for a known hazard, or insufficient margins and backup capa-bility, the new information is carefully evaluated and the Commission may, in light of the information, conclude that assurance of an acceptable level of safety requires changes in the existing regulations, or other re Therefore, as the Commission identifies new issues or concerns, gulatory action. reasoned engi-neering decisions occur within the Commission concerning whether any additional measures must be taken at plants to resolve the issues. When specific actions are identified, the Commission, through its regulatory programs, can modify the licensing bases at operating plants at any time to resolve the new concern. This process of determinations concerning backfitting of evolving requirements to plants already licensed is currently guided by the provisions of the Backfit Rule (10 CFR 50.109). Before promulgation of the Backfit Rule, similar consider-ations were applied, although the Backfit Rule enhanced the discipline of the

process, 1.3.4 Regulatory Oversight The Commission's regulatory oversight programs ensure that the plant's licensing basis is modified as appropriate to reflect significant new information on tech-nical topics affecting the design or operation of the-licensed plant so that the licensing bases at operating plants continue to provide-an acceptable level of safety.

These continuing activities in place during the initial license term would continue during the renewal term as well. Examples of these types of pro-grams-include operating events assessment and generic issues programs, discussed in the paragraphs below, as well as the Cominission's inspection program. In the cases where the Commission finds that additional protection is necessary to ensure the public health and safety or where significant additional protection at a reasonable cost substantially enhances plant safety, the Commission may require the backfit of a licensed plant, i.e., the addition, elimination, or modification'of the systems, structures, or components of the plant. The Commission has an aggressive program for the review of operating events at nuclear power plants. As a requirement of the current licensing basis, and one which would continue.during the renewal term, each licensee is required to notify the Commission promptly of any plant event that meets or exceeds the threshold defined in-10 CFR 50.72 and to file a written licensee event report for those events that meet or exceed the threshold defined in 10 CFR 50.73. This infor- 'mation is reviewed daily and followup efforts are carried out for events that appear to be potentially risk significant or are judged to be a possible precur-sor to a more severe event. Depending on the significance, further action may be taken to notify all licensees or to impose additional requirements. Infor-mation on operating events is disseminated by the NRC in the form of information notices, bulletins, and other reports; by individual licensees in the form of licensee event reports; and by industry groups, notably the Institute of Nuclear Power Operations (INP0) in the form of significant operating experience reports. The total process offers a high degree of assurance that events that are poten-tially risk significant or precursors to potentially significant events are being reviewed and resolved expeditiously. 1-3

The Commission also maintains an active program for evaluating and resolving generic issues that are related to safety. The current licensing basis includes any requirements imposed on the licensee as a consequence of the resolution of generic issues. A generic safety issue (GSI) is a generic issue that involves a safety concern that may affect the design, construction, or operation of all, several, or a class of reactors or facilities. Its resolution may have a poten- ~ tial for safety improvements and promulgation of new or revised requirements or guidance. It should be noted, however, that GSIs generally address only enhancements of safety or restoration of safety margins originally estimated to be present, because an adequate level of protection of public health and safety currently is believed to exist at all operating nuclear power plants. This belief is assessed during the initial evaluation of the generic concern which determined whether any aspect of the generic concern might have a significant impact on the protection of the public health and safety such that immediate remedial action would be warranted. The generic issues program is described and discussed more fully in Section 19. 1.3.5 Evolution of NRC Requirements In the late 1960s and early 1970s, the U.S. Atomic Energy Commission's (now Nuclear Regulatory Commission) scope of review of proposed power reactor designs was evolving aM somewhat less defined in terms of specific detail than it is today. The mort detailed requircments for acceptability evolved as new facili-ties were reviewed. In 1967, the Commission published for comment and interim use proposed General Design Criteria (GDC) for Nuclear Power Plants that estab-lished minimum requirements for the principal design. standards. The GDCs were ' formally adopted in 1971 and have been used as guidance in reviewing new plant applications since that time. Safety guides issued in 1970 became part of the-Regulatory Guide Series in 1972. These guides described methods acceptable to the staff for implementing specific portions of the regulations, including cer-tain GDCs, and formalized staff techniques for performing a facility review. In 1972, the Commission distributed for information and comment a proposed " Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," now Reg-L ulatory Guide 1.70. It provided a standard format for these reports and identi-l fied the principal 6 formation needed by the staff for its. review. The Standard l Revwei Plan (SRP), NUREG-75/087., was published in December 1975 and updated in July 1981 (NUREG-0800) to provide further guidance for improving the quality and uniformity of staff reviews. This guidance consisted of acceptance criteria and review' procedures necessary to provide.the staff with the basis for concluding. that applicable GDCs have been satisfied. For the most part, the detailed accep-tance criteria prescribed in the SRP were not new; rather, they were methods of review that, in many cases, were not previously published in any regulatory document. The General Design Criteria (GDC) are contained in 10 CFR Part 50, Appendix A. They establish minimum broad requirements for the principal criteria for the materials, design, fabrication, testing, inspection, and certification of all structures, components, equipment, and systems that are important to safety. The staff's plant-specific reviews with respect to the various safety-topic areas (discussed in Sections 2 through 19) must arrive at a conclusion that the overall plant design satisfies the GD" requirements and that the plant can be safely operated. 1-4

In 1977 the NRC initiated the Systematic Evaluation Program (SEP) to review the -designs of older operating nuclear power plants and thereby confirm and document their safety. The review provided (1) an assessment of the significance of dif-ferences between current technical positions on safety issues and those which existed when e particular plant was licensed, (2) a basis for deciding how these differences should be resolved in an integrated plant review, and (3) a docu-mented evaluation of plant safety. The reviews were organized into approximately 90 review topics (reduced by consolidations from 137 originally identified). The review results were documented in a series of Integrated Plant Safety Assessment Reports. Although the SEP demonstrated that, by and large, older plants provided a satisfactory level of safety for the large range of issues reviewed, with respect to some of the issues, the licensees proposed and implemented procedural or hardware modifications or additional analyses to define corrective action that would improve plant safety with respect to the differences from current requirements that were identified. In addition to leading to some specific improvements, the SEP led the staff to conclude that although some of these older plants were originally reviewed before the is-mee of the Draft GDC in 1967, the SEP provides reasonable assurance that the usigns of such older plants are acceptable and that they can be operated without undue risk to the public health and safety. 1 Nevertheless, the SEP effort highlighted a smaller group of 27 regulatory topics for.which corrective action was generally found to be necessary for all of the initial SEP plants and for which significant safety improvements for other oper-ating plants of the same vintage could be expected. The topics on this smaller list are referred to as the SEP " lessons learned" and the staff expects that these topics would be generally applicable to operating plants that received their construction permits in the late 1960s or early 1970s. As part of the current staff effort associated with documenting the regulatory processes that contribute to the continued adequacy of the current licensing bases at operating plants, the staff has under way a short-term effort to iden-tify how specific " lessons learned" from the SEP effort have been factored into the licensing bases of all operating plants, or into ongoing regulatory pro-grams. The staff program includes the identification and definition of the les-sons learned as generic safety issues and the determination of the appropriate priority rankings for the resolution of these issues. Since the staff has not resolved these issues at this time, they remain open and could be potential sub-jects for litigation in any necessary hearings on those plants. However, the staff is continuing in its efforts with respect to these issues and may have them resolved before issuance of a final rule. ~1.3.6 Review of Changes in NRC Requirements and Guidance The NRC has in place arrangements for systematic review to help ensure the effectiveness, efficiency, and coherence of changes in requirements and gui-The Committee to Review Generic Requirements (CRGR) has the responsibility review and recommend to the Executive Director for Operations (ED0) approvai disapproval of requirements or staff positions to be imposed by the NRC staf) on one or more classes of power reactors. This review applies to staff proposals of requirements or positions that reduce existing requirements or positions and proposals that increase or change requirements. The implementation of this responsibility is conducted in such a manner as to ensure that the provisions of 10 CFR 2.204, 10 CFR 50.109, and 10 CFR 50.54(f) pertaining to generic 1-5

requirements and staff positions are implemented by the staff. Theobjectives of the CRGR process are to eliminate or remove any unnecessary burdens placed on licensees, reduce the exposure of workers to radiation in implementing some of thase requirements, and conserve NRC resources while at the same time ensur-ing the adequate protection of the public health and safety and furthering the review of new, cost-effective requirements and staff positions. The tRGR and the associated staff procedures are intended to ensure NRC staff implementation of 10 CFR 50.54(f) and 50.109 for_ generic backfit matters. By having the com-mittee submit recommendations directly to the EDO, a single agency-wide point of control is provided. For those rare instances where it is judged that an immediately effective action is needed to ensure that facilities pose no undue risk to the health-and safety of the public (10 CFR 50.109(a)(4)(ii)), no prior review by the CRGR is neces-sary. However, before or after any such action, the staff conducts a documented evaluation that includes a statement of the objectives of and reasons for the actions and the basis for invoking the exception. In earlier years, the function of the CRGR to determine the need for backfit was performed by the Regulatory Requirements Review Committee, albeit the CRGR introduced enhanced discipline and documentation to the process. Throughout the process of evolution of requirements and staff guidance, the' Commission has had the benefit of advice on significant safety issues from the Advisory Committee on Reactor Safeguards.. 1.3.7 Detailed Analyses Sections 2 to 19 of this report describe and discuss, in more specific terms, how the previously stated regulatory programs and processes have worked in major administrative, technical, and procedural areas, thereby detailing the Commis-sion's reasons for considering it unnecessary to review an operating plant's licensing basis, except for age-degradation concerns, at the time of license renewal. These discussions also provide an indication of how the regulatory process will continue to ensure that, despite the variation of plant design cri-teria, an operating reactor will continue to provide an acceptable level of safety during any renewal term. 1.4 Conclusions The processes outlined above and described and discussed in more substantial' detail in the specific major safety-issue areas in the remainder of this report provide the foundation and justification for exclusion of the CLB from review at license renewal. The key elements include the original licensing basis and the Commission rules, regulations, requirements, and reviews underlying it; the Commission's backfit policy, which has historically resulted in backfit of new requirements being foregone only when not required for adequate safety and not cost-justified as safety enhancements on the basis of net incremental safety value vs. net cost and other adverse impacts; and the Commission's programs of -inspection, of monitoring operational events, and for resolution of plant-specific and. generic safety issues. It is through these processes and programs that the staff ensures the continued acceptability of the licensing bases of older as well as newer plants. 1-6

1 2. SITE-RELATED ISSUES The following section discusses a number of site-related topics that include general site geography and demography, potential site-vicinity hazards, and potential accidents from natural phenomena. The natural phenomena discussed in this section include regional climatology and local meteorology, site hydrology and potential flooding issues, as well as geology and related seismic consider-ations. The nature of the licensing basis for each of these topics will be discussed in greater detail below. 2,1 Geography, Demography, and Potential Site-Proximity Hazards 2.1.1 Scope -Site geography includes the consideration of site location and description, exclusion area authority and control, and broad land use patterns. Demography covers the population distribution in the vicinity of the site. With respect to both, geography and demography, changes over the -licensing term are addressed by making conservative projections for land use and population changes. Nearby industrial, transportation, and military facilities can pose a threat to the safe operation of a nuclear power plant. Site acceptability depends, in part, on the adequacy of the licensee's assessment of and protection against the hazards posed by nearby man-made activities. Although these activities pretent a wide range of external events, the hazards associated with them can be grouped into four broad categories: (1) missiles,(2) explosions,(3) fires,'and (4) toxic gases. 2.1.2 Safety Issues and Regulatory Requirements The Commission regulations require that site evaluation factors be considered-in the review of a license application, including those relating to site loca-tion, exclusion area, low population zone, and population center distance. In addition, the regulations require that plant systems, structures, and components important to safety be appropriately protected against the dynamic effects from events and conditions outside the nuclear power unit. 2.1.3 Evolution of Current Licensing Basis Prior to the issuance of the Standard Review Plan (SRP), the staff reviewed site exclusion area control and denography on a case-by-case basis, with emphasis on independent verification of site-specific characteristics such as property owner-ship, mineral rights, and nearby population distributions. It was recognized that land use and local and State regulations can and do change with time. Hence, for example, staff review of the licensee's ability to exercise appro-priate authority and control of the activities within the exclusion area focused on those aspects that were deemed to be time-dependent. With respect to demography, efforts were made to obtain reasonable projections of population distributions to the end of the licensing term. This was done in j 2-1

recognition that population changes, driven by such factors as local socio-economic conditions, can be potentially significant with passage of time. L l Similarly, potential external hazards in the vicinity of the site that could affect plant safety were reviewed on a case-by-case basis, with emphasis on independent verification of individual hazards for each site. Review of numer-ous license applications in the early and middle 1970s led to a two part approach in addressing site hazards. First, the site and its surroundings were examined with the intent of identifying all existing hazards that had a poten-tially significant impact on the safe operation of the plant. Once the hazards were identified, they were evaluated in terms of their severity and likelihood. For hazardous industrial or military activities, cr servative projections were L made concerning transportation traffic or accident rates. Where projections were not feasible, conservatism commensurate with the potential changes to the hazardous materials operations was applied to the current conditions. The SRP was published in the early 1970s to improve the quality and uniformity of staff review in the particular subject areas as well as to specify acceptance criteria of the staff for concluding that the applicable regulations had been satisfied. The detailed acceptance criteria contained in the SRP were not new, but rather were the acceptance criteria that had been in staff use but had not I been previously published in any regulatory document. As mentioned earlier, the regulations require that reactors be protected against the dynamic effects of events and conditions outside the nuclear plant. For external hazards such as toxic gases or airplane hazards, the licensees fre-quently provided informationi during the initial licensing review, concerning-the frequency of shipments or the amount of airplane traffic and then proposed plant protection features or determined that no protection was necessary based on a determination or analysis of the hazard. Because the regulations remain in effect for the term of the license, licensees have the responsibility to ensure that the plant remains appropriately protected from any site-related hazards, new or existing at the time the plant was licensed. The staff recog-nizes that licensees cannot control development around the site and the regula-l tions do not require licensees to do so. However, the regulations clearly place the responsibility on licensees for ensuring the protection of the reactor. The Commission inspection activities also provide another source of information concerning changes that are occurring around the reactor-site. The resident inspector, who typically resides in the area of the plant, has direct knowledge' and access to the local media and therefore can be informed of potential develop-ments in the surrounding environment that can potentially affect plant safety. In addition, regional and headquarters-based inspectors routinely visit sites, thereby affording further opportunities for observations of potential changes of the surrounding environment. As new issues are identified, these issues are raised to both the licensee and the staff for resolution. The staff is under-taking revisions to sele::ted inspection procedures to require routine documenta-tion of potential changes in the general environs of the facility. 2.1.4 Conclusions The staff review at the time of the initial licensing of a facility determined that the information provided by the applicant was sufficient for the staff to 2-2

conclude that tho siting of the plant met the intent of all applicable regula-tions. As discussed above, the staff has and will continue to obtain informa-tion through a variety of sources regarding changes that occur around the site, in particular, the changes in site demograpFy or potential hazards in the vicin-ity of the reactor site that would have a direct impact on the continued safe operation of the facility. The staff continues to review new information that occurs as a result of updates to the existing FSAR, plant events and routine plant inspections. If the new informationsuggeststhatchangesInthesiteenvironmentcouldpotentially affect plant operation, current regulations require licensees to ensure facility safety. The staff will require, under existing regulator sees perform additional analyses or plant modifications, y programs, that licen-as necessary, to ensure adequacy of the plant licensing basis and the continued health and safety of the public. Through the processes discussed above, the staff has reasonable assurance that operating reactors comply with the intent of ap)11 cable regulations and remain appropriately protected from potential offsite lazards. 2.2 Meteorology 2.2.1 Scope This section discusses the regulations and licensing requirements used by the NRC to ensure safe' siting and operation of nuclear power plants with respect to meteorology. Site-specific data on meteorology and regional climatology is used to ensure that continuing staff awareness of both regional and local meteorolog-ical trends is maintained to ensure that the design basis meteorology conditions remain sufficient to ensure safe plant operation in accordance with the current licensing basis (CLB).

2. 2. 2 Safety Issues..nd Regulatory Requiremrmts Nuclear power plants are dasigned, operated, c c maintained such that offsite exposure to accidental gaseous releases and thete resultant dose to receptors at the plant exclusion area boundary, low population zone distance, and the popula-tion center and offsite exposures from routine normal operational releases at nearby receptors including residences, dairies, farms, schools, etc., comply with the requirements of 10 CFR Part 100 and 10 CFR Part 50, Appendix I, respectively.

2.2.3 Evolution of Current Licensing Basis " Meteorology and Atomic Energy-1968 " AEC 1968, generally, served as a compendium ofmeteorologymeasurement,dispersIonmodeling,anddosedeterminationduring the early 1970s. This document was later used as the foundation for issuance i of safety guide.s, regulatory guides, and the Standard Review Plan sections in I the eeteorology area of review. 1 Regarding the regional climatology, the long-term meteorological conditions affecthg the plant vicinity, as described in the plant final safety analysis report (FSAR) submitted by the licensee, and addressed in the staff safety j 2-3 )

evaluation report (SER), are not expected to change significantly. The basis for the expectation of minimal change lies in the meteorological and climatolog-ical records collected from as far back as 1895 and published in documents pre-pared by the National Climatic Center. The published data demonstrate that nearly constant climatological conditions exist in a local area with only small anomalies on a monthly or seasonal basis. Studies by the National Institute of Standards and Technology (formerly National Bureau of Standards) using long-term data show the low probabilities of rapid significant changes in long-term tem-perature, precipitation, and wind speeds. Thus, design basis characteristics might only be exceeded for brief time periods in the near term (say, next 50 to while greater frequency of duration of " abnormal" conditions might 100 years)Idenceofapossibleworldwidemajorclimaticchange. The changes of provide ev global extent and recognition of its happening would be expected to provide suf-ficient time to allow the staff to take appropriate measures to deal with the changes such that the current licensing basis continues to remain valid for the licensed term. Recently, the staff considered the changes to global climate due to atmospheric l ozone depletion in response to concerns raised by the Council on Environmental Quality (CEQ) pursuant to NEPA. The thrust of the memorandum dealt with high-and low-level waste repositories and impact of global warming on rainfall and flooding due to changes in climate. The original plant site evaiuation was based on the premise and expectation that site area climate would generally not change significantly during the operational life of the plant. Based on current information and staff review experience, site data concerning regicnal climate provided in FSARs and staff conclusions contained in plant SERs are expected to remain valid during any extended term of the operating license. With respect to-the review area of local meteorology, the local meteorology conditions, generally, reflect the expected regional climate influence and unique topographic features that may result in micro-scale phenomena that had been addressed in the FSAR and SER and should remain the same as described in those documents during any renewal period. However, in the event of a marked climatic change, it is probable that parameters representing " normals," such as, extreme wind, precipitation, temperature, and structural capacities may require reevaluation, since climatic change may result in storm systems with greater intensities and frequency than those assumed in the design basis of the plant. However, this type of reevaluation is a part of the NRC staff's continuous plant-4 safety assessment effort to ensure continued adequacy of the meteorology-related current licensing basis for operating plants. The licensee routinely publishes specific information related to meteorology in semiannual reports of meteorolog-icaljointfrequencydataasrequiredbyemergencyplanningrequirements. Plant modifications or improvements in the meteorological monitoring system dictated by the semiannual reports have been implemented by the staff or licensee to ensure the validity of the current licensing basis. The current licensing basis requires each plant to have an onsite mateorological i monitoring program. This onsite meteorological measurement program continues i to monitor local conditions that would affect the dispersion of radioactive and l tox'c gaseous effluent from or to the plant. 2.2.4-Conclusions The staff review at the time of the initial licensing of a facility determined that the information provided by the applicant was sufficient to conclude that 3 2-4 i

i the meteorological and climatological factors related to the siting of the facility met the intent of the applicable regulations. The licensing criteria are conservatively. established to ensure adequate protection of the public from extremely-low probability meteorological phenomena. Included in these events are. tornadoes, high winds, extremes of temperature, and excessive rainfall and snowfall. The design basis for these extremely low probability meteorological events is selected with conservatism and is not expected to change appreciably during the next 50 to 100 year period. Based on t'e discussion above, the staff also concludes that the current licensing basis related to site meteorology is adequate, meets the intent of all applicable regulations, and will remain adequate during any period of extended plant operation. 2,3 Hydrologic Engineerina 2.3.1 Scope Nuclear power plants interact continuously with their hydrosphere (e.g., rivers, lakes, coastal environments, ground water, and water control structures). Such interactions present potential hazards of flooding as a result.of severe hydro-meteorological conditions. This section discusses the regulations and licensing requirements adopted by the NRC to ensure safe operation of nuclear power plants against severe flooding hazard over the licensed plant life. The continuous review process used by the NRC staff to assess safety impact resulting from changes in hydrometeorological parameters and new information related to flooding hazard is also discussed. Lastly, the rationale for an NRC staff conclusion that.the current licensing basis for opeiating plants is adequate to protect public health and safety is discussed. 2.3.2 Safety Issues and Regulatory Requirements The Ce asion's regulations require, in part, that systems, structures, and compt mi, im)ortant to safety be designed to withstand the effects of natural phenone aa suc1 as flo>ds, tsunami, and seiches without loss of capability to perform their safety functions. In addition, the regulations require that phy-sical characteristics of the site, including meteorology and hydrology, be taken into account in determining the acceptability of a site for a nuclear power reactor. More specifically, the regulations require that a detailed study be performed and that the design bases for seismically induced floods and water waves be based on the results of the required geologic and seismic investiga-tions and that these design bases be taken into account in the design of the nuclear power plant. In order to demonstrate compliance with the above regulatory requirements, nuclear power plants are designed to prevent or mitigate the loss of capability for cold shutdown and maintenance thereof resulting from the most severe flood conditions that can reasonably be predicted to occur at a site as a result of severe hydrometeorological conditions, seismic activity, or both. 2.3.3 Evolution of Current Licensing Basis The NRC has recognized the potential hazards resulting from the flooding of a commercial nuclear power plant since the mid-1960s. The flooding hazard review t of plants licensed in the late 1960s was implemented on an ad hoc and plant- ~~ specific basis. 2-5

In order to independently evaluate the potential for flooding at proposed reactor sites, the Atomic Energy Commission contracted the U.S. Army Corps of Engineers and the U.S. Geological Survey to evaluate flooding potential at coastal sites and river sites, respectively. In 1970 the AEC staff developed specific guidance for use in deterrining flood protection requirements for all plant sites. The staff adopted the concept of the " Probable Maximum Flood" from the Corps of Engi-neers and applied this concept to sites along streams and rivers. Guidance for determining the Probable Maximum Hurricane Surge, Probable Maximum Seiche, and Probable Maximum Tsunami flooding was also developed and applied for plant sites along lakes and oceans. During 1973 through 1975, the NRC, based on the above work, published integrated staff positions and acceptance criteria related to acceptable design of nuclear power plants against flooding hazard. The Systematic Evaluation Program (SEP) was initiated by the staff in 1977 to review 10 older plants to compare their design against current licensing cri-teria. SEP evaluation results led to some plant modifications of the older plants in order to enhance protection against possible plant flooding. As part of the Commission's process of reviewing new information related to specific technical issues, the staff learned that a number of probabilistic risk Lssessments completed between 1981 and 1987 concludeJ that external flooding could be a key contributor to overall plant risk. As a result, the NRC staff determined that it would be useful to evaluate the continued adequacy of the existing flood protection regulations by performing an individual plant examina-tion at each reactor site. The staf f developed regulatory guidance and accep-tance criteria for the evaluation of plant-specific vulnerabilities to beyond design bases events initiated from a severe flooding event and incoroorated this evaluation into the Individual Plant Examination External Events (IPEEE) program. The staff intends to evaluate the results of the IPEEE program, not on a plant-specific basis, but as an aggregate to determine whether deficiencies exist in the re ulations related to protections from potential external flooding. If s any deficiencies are identified, modification of the regulations will proceed and implementation of any plant modifications would be required on plant-specific bases to meet the revised regulations. In October 1989, NRC issued Generic Letter 89-22 to inform licensees that the staff has adopted for future plants the latest probable maximum precipitation (PMP) criteria published by the National Oceanic and Atmospheric Administration (NOAA), National Weather Services (NWS), to establish acceptable design config-urations for safety-related nuclear power plant facilities. In this letter the staff also concluded and stated that the existing criteria for determining PMP e at operating plants still provided reasonable assurance of the protection of the health and safety of the public and that no additional backfit action by licensees was necessary. 2.3.4 Conclusions i At the time a nuclear power plant received its initial license, the staff determined that the licensee submitted sufficient information related to the protection of the facility from floods and that the facility met the intent of all epplicable regulations. The evolution of flooding criteria has not changed i significantly since the early 1970s. Plant-specific evaluations of external 2-6

I floods have been performed for some of the older plants whose designs were not based on the most recent criteria. Enhancements such as procedure changes or facility modifications were implemented on a plant-specific basis to enhance the flood protection capability at these facilities. Based on the above, the staff believes that the flood protection measures at operating plants continue to provide reasonable assurance of protection of the 7 health and safety of the public from extreme flooding hazards. The staff con-tinues to review.new information related to flooding and requires licensees to take actions, when necessary, to upgrade their plants to provide continuing assurance that adequate protection of the public safety will continue during the operating lifetime. In summary, the current licensing bases for operating plants regarding external flooding are adequate and meet the intent of all applicable regulations necessary to ensure the continued health and safety of the public. 2.4 Geologic, Seismologic, and Geotechnical Engineerino 2.4.1 Scope This section discusses the regulations and licensing requirements adopted by the NRC to ensure safe operation of nuclear plants subject to the influence of site-specific geologic, seismologic, and geotechnical hazards over the-licensed plant life. The ongoing review process used by NRC staff to assess the safety impact resulting from changes in parameters related to the hazards and pertinent new information is also discussed. 2.4.2 Safety Issues and Regulatory Requirements The Commission's regulations require that systems, structures, and components important to safety be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety function to be per-formed and that nuclear power plant systems, structures, and components impor-tant to safety be designed to withstand the effects of natural phenomena such as earthquakes without loss of capability to perform their safety functions. In addition, the regulations require, in part, that suitable redundancy be provided for the cooling water system to ensure that its safety function can be accom-plished and that measures be established to ensure design control,. material con-trol, special processes control, and inspection and test controls. The regula-tions also require that all nuclear power plants be designed so that, if the safe shutdown earthquake (SSE) occurs, all safety-related systems, structures, and components remain functional. 'In order to demonstrate compliance with these regulatory requirements, nuclear power plants are designed to prevent or mitigate the loss of capability for cold shutdown and maintenance thereof resulting from the safe shutdown earthquake, foundation settlement, or instability. 2.4.3 Evolution of Current Licensing Basis l When the NRC first b(gan to review nuclear power plant seismic designs in the 1960s, the reviews were generally based on an a_d hoc and plant-specific approach. U 2-7

In 1971, the General Design Criteria (GDC) for Nuclear Power Plants were formally adopted as the minimum rec,uiremen. s for the principal design standards. These requirements generally adopted the existing staff practice in effect at that time. The GDC have been used as guidance in reviewing new plant i applications since then. Because of the evolutionary nature of licensing requirements and the development of technology over the years, nuclear power plants employ a broad spectrum of design features and requirements depending on when the plant was designed and constructed, who was the manufacturer, and when the plant was licensed for operation. The Systematic Evaluation Program (SEP) was initiated by the staff in 1977 to review 10 older plants to compare their design with respect to the current seis-mic design criteria. The SEP results led to some plant modifications of the older plants in order to provide additional margin in the plant protection against postulated seismic eventi. Aside from the SEP effort, the Nhc staff, as part of its routine review process, continues to assess the potential safety impact of any new information related to geologic and seismologic issues. New information can be derived from research or additional data observations since the issuance of operating licenses. When-ever the results of such information indicated the need for remedial actions includingplantmodifications,thestaffhasactedtoensuretheimplementatIon of such actions to ensure that the current licensing basis at potentially affected plants remains adequate to protect the health and safety of the public. Examples of this include the discovery of the capable Hosgri fault near Diablo Canyon and the assessment of earthquakes occurring near Maine Yankee. One nuclear power plant (Humboldt Bay) and one non power reactor (General Electric Test Reactor) were shut down, and remain permanently " shut down, as a direct result of geologic concerns. Another example is the Charleston Earthquake Issue" which was raised as a result of a U.S. Geologic Survey letter in 1982. This letter highlighted the possibilit/ that large damaging earthquakes have l some likelihood of occurring at locations not formally considered in past licen-i sing decisions. The staf f initiated ',he Seismic Hazard Characterization Project, which provided probabilistic seismic aazard estimates for nuclear power plant sites east of the Rocky Mountains. /,similar project was carried out by the Electric Power Research Institute (FPRI) for the electric utility industry. The staff's purpose in evaluating the probabilistic studies has been to identify plants in the central and eastern United States where past licensing decisions have resulted in the potential for plant-specific vulnerabilities to beyond ^ design basis events with respect to seismic hazard. The staff's plan for docu-- menting and reconfirming the degree of protection from seismic saftty issues is part of the staff resolution of Generic Issue A-46, " Seismic Qualification of Equipment in Operating Nuclear Power Plants." The purpose of the A-46 is to reverify and document the seismic atequacy of mechanical and electrical equipment qualification to ensure the sLrvival and functionality of equipment required to safely bring the reactor anC plant to a safe shutdown condition. Consistent with the guidance for developit.1 an unre-solved safety issue, the staff performed an analysis to determine if *.he iden-tified seismic concern might have a significant impact on the protection of the public health and safety and, therefore, that immediate remedial action would 2-8

be warranted. The staff's conclusions and their technical bases have been published in NUREG-1211, " Regulatory Analysis for Resolution of Unresolved Safety Issue A-46, Seismic Qualification of Equipment in Operating Plants," February 1987. In this document, the staff concluded that equipment installed in nuclear power plants is inherently rugged and not susceptible to seismic damage. How-ever, the staff also concluded that sufficient justification of a safety benefit could be made because, although the equipment was inherently rugged and not sus-ceptible to seismic damage, failures resulting from seismic loads were possi.11e if the equipment was not adequately supported or anchored. As a result, the staff issued Generic Letter 87-02 to all operating reactors, which required, es a backfit under 50.109, that licensees reverify the seismic qualification and anchorage of installed equipment to provide additional assurance of the contirued protection of public health and safety. The staff will review the informatiot, provided in response to the generic letter and issue plant-specific safety evil-uations of the licensee's evaluation and any proposed plant improvements. The issue of seismic qualification is also discussed in Section 3.10 of this repart. In the staff review of areas relat9d to plant foundation stability / settlement, water control structural safety ar,d heat sink integrity, etc., the staff has genert11y upgraded established geotechnical engineering criteria and methodolo-gles, which have been widely useu to ensure full compliance with the necessary regulatory requirements. As part of the staff's routine rtview effort, any new geotechnical engineering data or analysis techniques, which are judged by the staff as pertinent for inclusion in the current licensing criteria, have been incorporated following established NRC procedures. Where appropriate, the new analysis techniques were applied to assess design adequacy and any plant-specific modifications were implemented on plant-specific bases in order to ensure continued validity of the plant-specific licensing basis. Examples of such staff actions are (1) resolu-tion of Waterford basemat cracking and structural integrity issue, (2) resolu-tion of North Anna buried piping settlement and support integrity issue, and (3) resolution of San Onofre Unit I settlement of foundation and buried equipment issue. As part of the staff's effort to assess the continued adequart of the existing regulations, the staff has implemented the Individual Plant Lxamination External Events program. As part of this program, licenseet will be requested to lock for potential plant-specific vulnerabilities to beyond design basis accidents initiated from postulated seismic events and to report their findings to the Commission. The staff intends to use the results from all the plants in aggre-gate to determine if deficiencies exist in present regulations governing seismic hazards. If such deficiencies are identified, the staff intends to modify the regulations as necessary and would require plant-specific modifications as necessary to establish compliance with the new regulations. 2.4.4 Conclusions At the time the operating license for a facility was initially granted, the licensee submitted information sufficient for the staff to determine that the facility under review met the intent of all applicable regulations. 2-9

Based on the above discussion which reviewed, in general, the evolution of the regulations related to seismic hazards and staff review practices, the staff concludes that operating plants are designed and operated based on established criteria with respect to geologic, seismologic, and geotechnical hazards at the time they were licensed. Plant-specific evaluations were performed for some of the oldest operating plants whose designs were not based on the current staff review criteria. Enhancements which included plant modifications were imple-mented on a plant-specific basis to provide additional margin in the protection ( against seismic events. As applicable, the staff has reviewed pertinent new information arising from research or additional observed data and assessed its-safety implications. As discussed, one program, using the backfit process defined in 50.109, is requiring licensees to confirm and document the seismic qualification and anchorage of equipment and, where necessary, to make modifi-l cations to enhance the licensing basis at individual plants to ensure the continued adequate protection of the public health and safety. As part of the continuing assessment of the adequacy of the existing regulations, the Commission has requested licensees to evaluate their plants for potential vulnerabilities for beyond design basis accidents resulting from geologic, seis-mologic, and geotechnical hazard considerations. If the results of this evalua-- tion indicate that the existing regulations need modification, then the staff i .will proceed to revise the regulations and require plants to meet the revised regulations. The staff also concludes that the current licensing basis for operating plants, as they are related to the subject areas, is adequate and that plants currently meet the intent of applicable regulations necessary to. ensure the health and safety of the public. l 2-10 L

3. DESIGN OF STRUCTURES, COMPONENTS, EQUIPMENT, AND SYSTEMS 3.1 Scope This section addresses the principal criteria required for the materials, design, fabrication, testing, inspection, and certification of all structures, components, equipment, and systems that are important to safety. Important to safety is defined in the introduction to 10 CFR Part 50, Appendix A, as those systems, structures, and components that provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the pub-lic. The topics covered by this section are: the NRC General Design Criteria; classification of systems, structures, and components; wind and tornado loadings and water level (flood) design; missile protection; protection against dynamic effects associated with postulated rupture of piping; seismic design; design of Seismic Category I structures, mechanical systems, and components; seismic and dynamic qualification of Seismic Category I mechanical and electrical equipment; and environmental design of mechanical and electrical equipment. 3.2 Conformance With NRC General Design Criteria 3.2.1 Safety Issues and Regulatory Requirements 10 CFR Part 50, Appendix A, contains General Design Criteria (GDC) that establish minimum broad requirements for the principal criteria mentioned in Subsection 3.1 above. 3.2.2 Evolution of Current Licensing Basis In the late 1960s and early 1970s, the U. S. Atomic Energy Commission's (now Nuclear Regulatory Commission) scope of review of proposed power reactor designs was evolving and somewhat less defined than it is today. The requirements for acceptability evolved as new facilities were reviewed. Tn 1967, the Commission published for comment and interim use proposed General Os sign Criteria (GDC) for Nuclear Power Plants that established minimum requirement for the principal design standards. The GDC were formally adopted in 1973 snd have been used as guidance in reviewing new plant apolications since that s.me. Safety guides issued in 1970 became part of the Regulatory Guide Series in 1972. These guides describe methods acceptable to the staff for implementing specific portions of i the regulations, including certain GDC, and formalize staff techniques for per-forming a facility review. In 1972, the Commission distributed for information and comment a proposed " Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," now Regulatory Guide 1.70. It provided a standard format for these reports and identified the principal information needed by the staff for its review. The Standard Review Plan (SRP), NUREG-75/087, was published in December 1975 and updated in July 1981 (NUREG-0800) to provide further guid-l ance for improving the quality and uniformity of staff reviews. This guidance L consisted of acceptance criteria and review procedures necessary to provide the l staff with the basis for concluding that applicable GDC have been satisfied. For j the most part, the detailed acceptance criteria prescribed in the SRP were not l new; rather they were methods of review that, in many cases, were not previously published in any regulatory document, l - 3-1

Because of the evolutionary nature of the licensing requirements discussed above and the developments in technology over the years, operating nuclear power plants embody a broad spectrum of design features and requirements depending on when the plant was constructed, who was the manufacturer, and when the plant was li-censed for operation. The amount of documentation that defines these safety-design characteristics also has changed with the age of the plant. Although the earlier safety evaluations of operating facilities did not address many of the topics discussed in current safety evaluations, all operating facilities have been reviewed more recently against a substantial number of major safety issues that have evolved since the operating license was issued. Conclusions of overall adequacy with respect to these major issues (e.g., emergency core cooling system, fuel design and pressure vessel design) are a matter of record. a number of other issues (e.g., seismic considerations, tor-On the other hand,issiles, flood protection, pipe break effects inside contain-nado and turbine m ment, and pipe whip) were not originally reviewed against today's acceptance criteria for many operating plants. The Systematic Evaluation Program (SEP) was initiated by the staff in 1977 to review the designs of older operating nuclear power plants in order to enhance the documentation of their safety. The review provided (1) an assessment of the significance of differences between current technical positions on safety issues and those that existed when a particular plant was licensed, (2) a basis for deciding on how these differences should be resolved in an integrated plant review, and (3) a documented evaluation of plant safety. The results of the staf f's SEP reviews are documented in a series of Integrated Plant Safety Assessment Reports. 3.2.3 Conclusions The staff reviews for all plants that have been granted an operating license since 1967 have determined that the information provided by each applicant has i been sufficient to conclude that the plant design satisfies the intent of the applicable GDC. Although some of these older plants were reviewed prior to the t issuance of the GDC-in 1971, the staff concluded that the SEP provides a basis I for reasonable assurancts that the designs of these older plants are acceptable. Therefore, the staff reviews of all plants have concluded that each plant can be operated without undue risk to the health and safety of the public. 3.3 Classification of Structures, Components, and Systems 3.3.) Safety Is;ues and Regulatory Requirements The Commission regulations require that systems, structures, and components important to safety be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be per-formed. Regulatory Guide 1.26, " Quality Group Classifications and Standards for Water, Steam, and Radioactive-Waste-Containing Components'of Nuclear Power Plants," contains staff guidance that may be used to determine how a plant-specific design satisfies the regulations. In 6ddition,.the regulations require that systems, structures, and components important to safety be designed to withstand the effects of earthquakes without loss of capability to perform their safety functions. Regulatory Guide 1.29, " Seismic Design Classification," contains staff guidance that may be used to 3-2

i determine how a plant-specific design satisfies the applicable regulations by identifying all systems, structures, and components that should be classified as Seismic Category I. 3.3.2 Evolution of Current Licensing Basis During the 1960s, when General Design Criteria and the ASME Section III Code for Nuclear Power Plant Components were evolving, the staff reviews of quality group and seismic classification were performed on a plant-specific basis. De-cisions on the classifications for systems, structures, and components were made based on staff positions at that time relative to the importance to safety of each item. These positions were first #cumented in Safety Guides 26 and 29 in 1970 and 1971 and later in Regulatory Guides 1.26 and 1.29 in 1972. Subsequent to an exchange of correspondence between the General Electric Company and the staff during 1973 and 1974, the staff developed its position on classi-fications of the main steam and feedwater lines for BWR/6 plants. This position allowed BWR/6 applicants the option of installing a third shutoff valve and a seismic restraint downstream of the outside isolation valve in these lines. If the applicant chose this option, then the main steam and feedwater lines could be classified as Quality Group D (Non-Nuclear Safety) and non-Seismic Category I downstream of the seismic restraint. This position was implemented by the staff during its reviews of all BWR/6 plants between 1975 and 1981. 3.3.3 Conclusions During its initial licensing reviews, the staff concluded that the quality group and seismic classification of all plants demonstrated compliance with the intent of the regulations and safety guides or regulatory guides that were in effect at the time of the staff review. Because the requirements in this area have changed little over the years, the staff can also conclude that all operating plants since 1970 continue to meet the applicable regulations. If new information should arise that would suggest that new or different requirements are-needed in the classification of systems, structures, and components, the staff has the capability within existing regulatory programs to require additional analyses or plant modifications, as necessary, to ensure the continued health and safety of the public and the acceptability of the plant licensing basis. 3.4 Wind, Tornado, and Floou Protection

3. _4.1 Safety Issues and Regulatory Requirements Commission regulations require,.in part, that systems, structures, and components important to safety shall be designed to withstand the effects of natural phenomena such as tornadoes, hurricanes, and floods.

3.4.2 Evolution of Current Licensing Basis The Commission has recognized the potential hazards resulting from wind, tornadoes, and floods imposed on a_ nuclear power plant since the early 1960s. These early reviews were performed on a plant-specific basis and the staff's guidelines for acceptability evolved as new facilities were reviewed. In 1975, the staff published sections of the Standard Review Plan addressing these 3-3

subjectareas. These guidance documents formally published regulatory positions that had been in practice at that time but had not been previously published in any type of regulatory document. Minor revisions were made to these SRPs in 1981; however, guidelines therein have remained virtually unchanged since 1975. 3.4.3 Conclusions Given that the regulatory ptactice has remained relatively unchanged in this technical area, the staff has concluded that for plants reviewed since the late 1960s, the plant-specific designs for protection against wind, tornadoes, and floods have demonstrated compliance with the intent of the applicable regula-tions. If new information is obtained to suggest that new or different require-ments are needed in these technical areas, the staff has the capability within existing regulatory programs to require additional analyses or plant modifica-tions as necessary to ensure the continued health and safety of the public and the acceptability of the plant licensing basis. 3.5 Missile Protection 3.5.1 Safety Issues and Regulatory Requirements Although large steam turbines and their auxiliaries are not safety-related systems as defined by NRC regulations, failures that occur in these turbines can produce large, high-energy missiles. If such missiles were to strike and to damage plant safety-related systems, structures, and components, they could render them unavailable to perform their safety function. Consequently, the regulations require, in part, that systems, structures, and components important to safety be appropri6tely protected against the effects of missiles that might result from such failures. 3.5.2 Evolution of Current Licensing Basis The standard review plans for turbine missile protection were first published in NUREG-75/087 in December 1975 and updated in NUREG-0800 in July 1981. Regu-latory Guide 1.115 was revised in July 1977. The staff's guidance in these doc-uments indicates that the hazard rate for the loss of essential safety systems from a single turbine missile event must be less than 10 7 per year. Plants con-structed prior to the publication of the staff guidance and evaluated as part of the Systematic Evaluation Program (SEP) were reviewed to ensure that an adequate level of protection from turbine missiles existed at these plants. Turbine missiles are identified as SEP Topic III-4.B. In the initial reviews of this topic, the value for the probability of turbine failure resulting in ejection of turbine fragments through the turbine casing (P ) was assumed be a constant of 10 4 per year for all turbines. Licensees or 3 applicants evaluated the strike probability (P ) and the dama e probability (P ) 2 3 is less than 10- per year. These to ensure that the product of P, P, and P3 3 2 because of early reviews indicated that large uncertainties exist in P2 and P3 the dif ficulty in modeling missiles, barriers, obstacles, and trajectories and ( in determining critical impact energies. In an Electric Power Research Insti-tute-sponsored seminar on " Turbine Missile Effects in Nuclear Power Plants" in October 1982, the staff indicated that, because of the uncertainties in P2 and P, they would emphasize the missile generation probability (P ) in future 3 3 turbine missile reviewt. P2 and Pa probabilities are to be order-of-magnitude 3-4

estimates that are dependent on the orientation of the turbine to essential safety systems. The revised method also ensures that the hazard rate would be less than 10 7 per year. In this method the staff evaluates the procedures and methods used by turbine manufacturers to calculate the total missile generation probability and the associated turbine maintenance and inspection procedures. 3.5.3 Conclusions In summary, protect lon from turbine missiles are consicered adequate when the hazard rate for the uss of essential safety systems from a single turbine mis-sile event is less than 10 7 per year. As new information from plant mainte-nance operations, inservice inspection, or research is received by the staff, it is reviewed to determine if new or different requirements are needed in this area. If new or different requirements are needed the staff has the capability within existing regulatory programs to require additional analyses or plant modifications, as needed, to ensure the cohtinued health and safety of the public. 3.6 Protection Against Dynamic Effects Associated With Postulated Rupture of Piping 3.6.1 Safety Issues and Regulatory Requirements Commission regulations require that systems, structures, and components impor-tant'to safety be appropriately protected against the dynamic effects that may result from equipment failures, including the effects of pipe whipping and discharging fluids. 3.6.2 Evolution of Current Licensing Basis In 1972, the staff documented the deterministic criteria that the staff had been using for several years as guidelines for selecting the locations and orientations of postulated pipe breaks inside containment and for identifying the measures that should be taken to protect safety-rclated systems and equip-ment from the dynamic effects of such breaks. Prior to use of these determin-istic criteria, the staff used non-deterministic guidelines on a plant-specific basis.. The staff criteria were subsequently revised and issued in May 1973 as Regulatory Guide 1.46, " Protection Against Pipe Whip Inside Containment." Prior to 1972, the staff did not require postulation of pipe breaks outside containment. However, as a result of the continuing review of plant safety during that time period, the staff determined that such breaks should be pos-tulated and the effects of these breaks should be evaluated by_all licensees of operating plam and all applicants for Construction Permits or Operating Licenses. Therefore, generic letters were sent to all licensees and applicants from late 1972 through mid-1973. These letters provided deterministic criteria to be used for postulating pipe breaks outside containment and guidelines for evaluating the dynamic effects of these breaks. The letters requested that all recipients submit a report to the staff that summarized each plant-specific analysis of this issue. All operating reactor licensees and license applicants submitted the requested analyses in separate correspondence or updated the safe-ty analysis report for the proposed plant to include the analysis. The staff reviewed all of these submitted analyses and prepared safety evaluations for all plants. 3-5

L In November 1975, the staff published Standard Review Plan sections that slightly reviseo the two generic letters discussed above. As a part of its plant-specific reviews between 1975 and 1981, the staff used the guidelines in Regulatory Guide 1.46 for postulated pipe breaks inside containment and SRPs 3.6.1 and 3.6.2 for outside containment. In July 1981, SRPs 3.6.1 and 3.6.2 were revised to be ap-plicable to both outside and inside containment. On June 19, 1987, Generic Let-4 ter 87-11 was issued to provide revised guidelines for locations of postulated pipe ruptures. i Another example of the continuing review of new technical issues is the potential 1 problem of asymmetric loading on reactor vessel supports following a postulated reactor coolant pipe rupture. In 1975, the staff was informed that asymmetric loading on the reactor vessel supports resulting from a postulated reactor cool-ant pipe rupture at the vessel nozzle had not been considered in the original design of PWR plants. Following a brief review of this problem, the staff deter-mined that a reevaluation of the reactor coolant system of all PWR plants was necessary to determine its capability to withstand these new loads. Unresolved Safety Issue (USI) A-2 was originated to address this problem. All licensees of PWR operating plants were requested to submit plant-specific analyses. In response to this request, several licensees formed an owners group and, in lieu of an analysis, submitted a report that incorporated advanced fracture mechanics techniques to demonstrate that a full diameter break could not occur in their primary loop piping. In Generic Letter 84-04, dated February 1, 1984, the staff agreed that such a break was unlikely to occur, provided it could be demonstrated by deterministic fracture mechanics analyses that postulated through-wall flaws in plant-specific piping would be detected by the plant's leakage monitoring sys-tems long before the flaws could grow to unstable sizes. The concept underlying such analyses is referred to as " leak-before-break" (LBB). Subsequent evalua-tions of this issue by the staff led to the so-called " broad scope rule," which revised G00-4 in 1987 to permit the w e of LBB-type analyses in both PWRs and BWRs. 3.6.3 Conclusions In summary, the staff _has concluded that all plants reviewed since the late 1960s have submitted acceptable evaluations of the effects of postulated pipe l I breaks both inside and outside containment and meet the intent of all applicable l regulations. The staff will continue to monitor any new information that may develop as a result of operating plant events or research. If this new informa-tion suggests that additional requirements are necessary, the staff using exist-ing regulatory programs will require additional analyses or modifications, as necessary, to ensure the continued public health and safety. 3.7 Seismic Design 3.7.1 Safety Issues and Regulatory Requirements The Commission regulations require, in part, that systems, structures, and components important to safety be designed to withstand the effects of earth-quakes without loss of capability to perform their safety functions and provides, i in part, criteria required to determine the suitability of the plant design bases that were established by consideration of the seismic characteristics of the proposed plant site. 3-6

W 3.7.2 Evolution of Current Licensing Basis The Commission has recognized the potential safety related consequences of the occurrence of a significant seismic event at a nuclear power plant site since the staff first began reviewing applications for licenses in the late 1950s. These early reviews were performed on a plant-specific basis, and the staff's guidelines for acceptability evolved as new facilities were reviewed. 10 CFR Part 100, Appendix A, was later issued to establish the seismic design basis for systems, structures, and components. In 1973, Regulatory Guides 1.60 and 1.61 were issued to provide staff positions relative to seismic input levels to be used for plant designs to ensure adequate i consideration of historical data, site characteristics, and material behavior. In 1975, SRPs 3.7.1, 3.7.2, and 3.7.3 were issued to provide detailed guidelines for analytical modeling techniques for seismic analyses. These guidelines were -used by the staff to determine that a plant-specific design satisfies applicable portions of the Commission's regulations, These SRPs were revised in 1981 to reflect changes in these guidelines since 1975. For example, one of the signif-icant changes was related to the staff position on soil-structure interaction which was based on 1975 state-of-the-art. This position was widely debated among industry, ACRS, and the staff. These debates provided the basis for significant industry research effort on this issue during the 1970s. The staffs' evaluation of this research provided the basis for a change in the staff position which incorporated the research recommendations and led to more realistic criteria. In the course of evaluating several plant-specific piping designs in the late 1970s, the staff became aware of significant discrepancies between the original piping seismic analysis computer code and a staf f-approved benchmark code. This problem led to a March 13, 1979 Order to Show Cause from the Commission, which resulted in the shutdown of five plants whose piping designs had involved the use of the suspect computer codes. The differences between the computer codes were attributed to the use of an inappropriate method of combining certain seismic-induced loads in the original codes. In April 1979. IE Bulletin 79-07 was issued to request all licensees and applicants to review their piping analyses and deter-mine if any of their computer codes contained the unacce) table method of combin-ing loads. In addition, they were requested to verify tlat all piping computer programs were checked against either staf f-approved benchmark problems or other acceptable piping computer programs. All licensees were to submit reports to the Commission describing the results of their review. The staff reviewed the submittals from all licensees and appilcants and the issue was resolved on a plant-specific basis by arriving at one of the following conclusions: 1. The licensee or applicant used acceptable methods of combining loads in their piping analyses. 2. If the original analyses used the unacceptable method of combining loads, all applicable piping was reanalyzed using acceptable methodology. The results of these new analyses showed that all piping stresses were within' the allowable stresses of applicable ASME Section III or ANSI B31.1 Codes. 3.7.3 Conclusions The staff has concluded that the plant-specific designs for protection against earthquakes have demonstrated compliance with the intent of the Commission 3-7

r regulations in effect at the time of the staff review. The staff has revised the guidance used over time to ensure the continued acceptability of the licens-ing basis. As new information continues to occur from plant events, research, or processes described in Section 1 of this report, the information is routinely evaluated to determine if new or different requirements are needed. If new or different requirements are deemed necessary, the staff has the capability within existing regulatory programs to require additional analyses, or plant modifica-tions, as necessary, to ensure the continued public health and safety. 3.8 Design of Seismic Category I Structures 3.8.1 Safety Issues and Regulatory Requirements The Commission regulations contain various requirements for the design and construction of concrete and steel containments as well as recuirements for all other Seismic Category I structures both inside and outsice containment. l 3.8.2 Evolution of Current Licensing Basis When the NRC staff first began to review design of Seismic Category I structures in the 1960s, its scope and depth of review were not well defined and the staff acceptance was generally based on an ad hoc and plant-specific approach that provided adequate protection of the general public. Staff review of design adequacy of containment and other Category I structures has been generally upgraded to use established structural design criteria and methodologies. The primary codes used in the early 1970s to review the design i adequacy were the Building Code Requirements for Reinforced Concrete (ACI-318) i and AISC, " Specification for Desigr Fabrication, and Erection of Structural Steel for Buildings," American Institute of Steel Construction, for concrete and steel structures, respectively. In 1973, the ASME Boiler and Pressure Vessel Code, Section III, Divisions 1 and 2, became the standards for the design of steel and concrete containments. In 1975, the staff published the Standard Review Plans (NVREG-0800), which adopted the above-listed codes and standards with appropriate inclusion of new load com-binations and analysis methods. The Standard Review Plans were revised in 1981 and Sections 3.8.1 through 3.8.5 of the plans form the bulk of the current licensing criteria for containments and Category I structures. The Systematic Evaluation Program (SEP) was initiated by the staff at 10 older plants to compare their design against current licensing criteria. The SEP results led to plant modifications of some of the older plants in order to provide enhanced protection of Category 1 structures. Aside from the SEP effort, the staff, as part of its routine review process, continued to assess the potential safety impact of any new information related to design of structures and, as appropriate, caused plant modifications to be implemented for affected plants to ensure continued contormance with the current licensing basis (e.g., modifications of torus supports and header piping supports for all Mark I plants). i 3-8

1 1 3.8.3 Conclusions l Based on the described evolution of structural criteria and the staff review practices, the Commission concludes that: (1) most operating plants structures l are designed based on conservative criteria; (2) for older plants whose designs were not based on the current criteria, plant-specific evaluations were performed I to ensure conformance with the current criteria; and (3) as applicable the impact of new structural design information was factored into the structural Integrity assessments to ensure continued conformance with the current licensing basis. 3.9 Mechanical Systems and Components 3.9.1 Safety Issues and Regulatory Requirements The Commission regulations contain requirements to ensure that all of the different types of mechanical systems, components, and equipment will maintain their structural and functional integrity for the life of the plant. 3.9.2 Evolution of Current Licensing Basis l During the early 1960s when 10 CFR 50 General Design Criteria and the ASME l Section III Code for Nuclear Power Plant Components were evolving, the staff l reviews of design criteria for mechanical systems and components were performed l on a plant-specific basis. ASME Section VIII, " Pressure Vessels," and American l National Standards Institute (ANSI) 831.J, " Power Piping," were the two main l design standards that were accepted by the staff to ensure the structural integ-rity of safety-related mechanical systems and components. In 1963, ASME Section I l III, " Nuclear Vessels," was published and accepted by the staff as a replacement I for ASME Section VIII. In 1969, ANSI B31.7, " Nuclear Power Piping," was published I and accepted by the staff as a replacement for ANSI B31.1. In 1971 ASME Section IIIwasexpandedtoincluderulesforvesseis, pumps, valves,andpIping. ANSI B31.7 was included in ASME Section 111-1971. In that same year, 10 CFR 50.55a was added to the regulations to provide a requiremer.t for applicants to use ASME Section III for the design of reactor coolant pressure boundary components. Sub-sequent editions of ASME Section III through the present 1989 edition have been required by 10 CFR 50.55a for the designs of mechanical systems and components. In 1975, Standard Review Plans 3.9.1 through 3.9.5 were issued to document guidelines that the staff had previously been using in its plant reviews of mechanical systems and components to demonstrate compliance with the applicable Commission regulations. SRP 3.9.6 was also issued in 1975 to provide guidelines for the staff to use in evaluating inservice testing (IST) programs for safety-related pumps and valves in non-operating plants, At that time, there was no requirement for IST applicable to operating plants. Therefore, in February 1976, 10 CFR 50.55a(g) was revised to include specific IST requirements in accordance with ASME Section XI for all licensees of operating plants and all applicants for a license to operate. Included in this revision was a requirement for all licensees to submit a new IST program to the staff every 10 years. These new programs are updated to reflect the latest ASME Section XI requirements and staff positions. Each licensee's program is reviewed and approved by the staff. Prior to 1979, light water reactors experienced a number of occurrences of improper performance of safety and relief valves installed in the reactor cool-ant system. As a result in 1980, the staff issued NUREG-0737, " Clarification of TMI Action Plan Requirements," Item II.D.1, which required all BWR and PWR 3-9

k licensees and applicants to qualify reactor coolant system safety and relief valvn. block valves, and associated piping and supports under expected operat-ing conoitions for design basis transients and accidents. In response to this requirement, the Electric Power Research Institute (EPRI) conducted a series of tests for licensees and applicants in 1981 and 1982 to demonstrate operability of the components under the required loading conditions. All licensees and applicants have submitted information to demonstrate applicability of the EPRI test results to their plant-specific equipment. The staff has reviewed all but a few plant-specific responses on this issue. The staff's reviews assure that all applicable valves, piping, and supports in each plant are enveloped by the 2PRI test program. These reviews are scheduled for completion in 1990. 3.9.3 Conclusions The staff has concluded that plant-specific designs of mechanical systems and components important to safety have demonstrated compliance with the intent of the Commission regulations in effect at the time of the staff review. On the basis of the IST requirements in 10 CFR 50.55a(g) and submittals of the plant-specific IST programs that commit to these requirements, the staff has further concluded that there is reasonable assurance that all plants can be operated without undue risk to the health and safety of the public. 3.10 Seismic and Dynamic Qualification of Mechanical and Electrical Equipment 3.10.1 Safety Issues and Regulatory Requirements The Commission regulations contain requirements to ensure that mechanical and electrical equipment important to safety remain operable under the full range of normal and accident loadings, including seismic. 3.10.2 Evolution of Current Licensing Basis The evolution of the GDC, safety guides, regulatory guides, and SRPs is discussed in Subsection 3.2.2 above. Commission guidance was originally issued in March 1976. These guidelines documented staff positions on seismic and dynamic quali-fication of equipment that had been implemented by the staff since the early 1970s. The analysis and test criteria used by the staff to review this israe evolved rapidly between 1971 and 1980. Consequently, for plants that were re-viewed by the staff prior to the early 1970s, the margins of safety provioed in equipment to resist seismically induced loads are uncertain. This concern led the staff to originate Unresolved Safety Issue (USI) A-46, " Seismic l Qualification of Equipment in Operating Nuclear Power Plants." NUREG-1211, " Regulatory Analysis for Resolution of USI A-46," February 1987, identified some operating plants to be reviewed under USI A-46 as those plants whose equipment had not been qualified by using IEEE Standard 344-1975 or later l revision. On February 19, 1987, the staff issued Generic Letter 87-02, "Verifi- + cation of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors, USI A-46." This letter provided the staff's requirements for imple-L menting the resolution of USI A-46. Each affected licensee is to submit the results of its Irogram to verify the seismic adequacy of all applicable equip-ment. The staf ' will conduct cursory reviews of each submittal to identify any major problems and to select plants for detailed audits or inspections. If this review uncovers no major problems on a specific plant, the staff will write a 3-10 L

safety evaluation report (SER) which will conclude that based on the licensees use of the staf f-approved nethodology, the licensee has completed the VSI A-46 requirements as delineated in GL 87-02. For the remainder of the affected plants, the staff will also write plant-specific SERs which will identify all unresolved issues. These issues will be resolved by the staff on a case-by-case basis. In addition, the staff will conduct detailed audits of a limited number of plants to verify that the licensee has implemented its program in accordance with GL 87-02. Enforcement or other regulatory actions could result from these audits. When a licensee completes its followup actions, it will be required to submit a letter stating that all plant modifications or followup actions related to USI A-46 have been completed. 3.10.3 Conclusions The staff has concluded that all plants whose FSAR or Updated FSAR centains a commitment to IEEE Standard 344-1975 and Regulatory Guide 1.200, Revision 1 August 1977, or later revisions, have satisfied the Commission requirements above. For all plants whose equipment has not been qualified in accordance with IEEE Standard 344-1975 or later revision, the seismic adequacy of equip-ment will be verified by the conclusion of the implementation of the USI A-46 J program. l 3.11 Environmental Design of Mechanical and Electrical Equipment 3.11.1 Safety Issues and Regulatory Requirements The Commission regulations require that systems, structures, ano components important to safety be designed to accommodate the effects of and be compatible with the environmental conditions associated with normal operatiom maintenance, testing, and postulated accidents, including loss-of-coolant accidents. They are to be appropriately protected against the effects of discharging fluids. ' Environmental qualification is one means of satisfying the above requirement for j essential components. Specific requirements for environmental qualification of electrical equipment important to safety are contained in 10 CFR 50.49, which requires each licensee to establish a program for qualification of essential electrical equipment subject to harsh environmental conditions, and maintain qualification of this equipment for the lifetime of the plant. For pur)oses of the discussion on the environmental design basis, it should be noted t1at licensees' current environmental qualification programs will include equipment subject to periodic replacement and equipment that has been qualified for the currently licensed plant lifetime. A review of the program covering equipment periodically replaced is not necessary as this process will continue during the renewed license life. 3.11.2 Evolution of Current Licensing Basis In November 1977, the Union of Concerned Scientists petitioned the Commission to upgrade the envirenmental qualification of equipment in operating facilities ~ to current standards. This petition led to the Commission Memorandum and Order of May 23, 1980 (CLI-80-21) which provided guidance and directives to resolve i this matter in an expeditious manner. Part of this activity included develop-4 ment of a new rule for environmental qualification of electrical equipment. 3-11

This action culminated in issuance of 10 CFR 50.49 dated January 21, 1983. All licensees have implemented programs consistent with 10 CFR 50.49 and supplemental . staff guidelines to ensure the safety function of electrical equipment subjected to harsh environments (radiation, temperature, pressure, and moisture) following postulated design basis accidents. This has resulted in assurance of safe plant shutdown following loss of coolant and steam line break accidents. 3.11.3 Conclusions In summary, the environmental qualification program for electrical equipment of the Commission'y at all existing operating reactors meets the requirements important to safet e, regulations and that compliance will be required at all times during operation, including during any renewal period. However, because certain essential electrical equipment may have been qualified for a life no greater than the term of the current license, this equipment will require staff review as part of the license renewal evaluation in order to ensure its continued function for the renewal period. Other equipment that is subject to periodic replacement will not require review because this practice will continue through i the renewal period as it did during the plant's initial licensed operating life, i In addition, as new information is obtained from review of plant events or re-search, the staff will determine the need for new or different requirements in this area. Such requirements will be imposed within existing regulatory programs, as necessary, to ensure the continued health and safety of the public, i { l 3-12

i l 1 4. REACTOR 4.1 Scope This section describes the evaluation and supporting information reviewed by the staff to establish the capability of the reactor to perform its safety functions throu hout its design lifetime under all normal operational modes includingtranskentandsteadystate,andaccidentconditions. TheevaluatIon-I covers the areas of fuel system design, nuclear design, thermal and hydraulic design, reactor materials, and functional design of reactivity control systems. 4.2 Fuel System Desion 4.2.1 Safety Issues and Regulatory Requirements NRC regulations require that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin to ensure that speci-fled acceptable fuel design limits (SAFDLs) are not exceeded during any condition of normal operation, including the ef fects of anticipated operational occurrences, and that the reactor core and associated coolant systems be designed so that in the power operating range the net effect of the prompt inherent nuclear feedback characteristics tends-to compensate for a rapid increase in reactivity. These regulations also address the. requirements of maintaining the capability to cool the cote under postulated accident conditions. Methods of adequately predicting fuel rod failures during postulated accidents are adopted so that radioactivity release estimates are not underestimated and thereby ensure that the plant in question would continue to satisfy the related requirements of 10 CFR Part 100. Also, the acceptable fuel performance limits under a postulated loss of coolant-accident are specified in 10 CFR Part 50.46 and 10 CFR Part 50, Appendix K. 4.2.2 Evolution of Current Licensing Basis The evolution of the GDC, safety guides, regulatory guides, and SRPs is discussed in Subsection 3.2.2 above. There have been no significant changes to NRC requirements related to fuel design since the early 1970s. t 4.2.3 Conclusions Prior to each plant refueling, the design of a new fuel system is reviewed and approved by the staff in accordance with the acceptance criteria for fuel system design. This established licensing process ensures that the_ fuel system design L of each operating reactor is in compliance with applicable regulations and regu-latory requirements during the lifetime of the plant design. As new information l occurs as a result of plant operation, inservice inspection, surveillance, mate-rial testing, or research, this information is routinely reviewed by the staff i to determine if new or different requirements are needed in this area. If new or different requirements are needed, the staf f has the capability within exist-i ing regulatory programs to require additional analyses or plant changes, as needed, to ensure the continued health and safety of the public. 4-1

J 4.3 Nuclear Design 4.3.1 Safety Issues and Regulatory Requirements Commission regulations require that acceptable fuel design limits be specified .that will not be exceeded during normal operation, including the effects of anticipated operational occurrences, and require that, in the power operating range, the prompt inherent nuclear feedback characteristics tend to compensate for a rapid increase in reactivity. The regulations also require that power oscillations that could result in conditions exceeding SAFDL are not possible or can be reliably and readily detected and suppressed; and require instrumen-tation and controls to monitor variables and systems that can affect the-fission process over anticipated ranges for normal operation and accident conditions, and to maintain the variables and systems within prescribed operating ranges. Further, the regulations require automatic initiation of the reactivity control systems to ensure that SAFDLs are not exceeded; that reliable reactivity control systems be provided under normal or accident operating conditions; and that the effects of postulated reactivity accidents neither result in damage to the reac-tor coolant pressure boundary greater than limited local yielding, nor cause sufficient damage to impair significantly the capability to cool the core. 4.3.2-Evolution of Current Licensing Basis The evolution of the GDC, safety guides, regulatory guides, and SRPs is discussed in Subsection 3.2.2 above. There have been no significant changes in design criteria for nuclear design since the early 1970s. 4.3.3 Conclusions P.'ior to each plant refueling, each licensee is required to verify that any changes in nuclear design do not result in any unreviewed safety questions. If an unreviewed safety question arises or if any technical specifications require modification, staff review and approval is required prior to plant restart. This established licensing review process ensures that the nuclear design of each operating reactor is in compliance with applicable regulations and regulatory requirements during the lifetime of the plant design. As new information occurs as a result of plant operation, inservice inspection, surveillance, material testing, or research, this information is routinely reviewed by the staff to determine if new or different requirements are needed in this area. If new or different requirements are needed, the staff has the capability within existing regulatory programs to require additional analyses, as needed, to ensure the continued health.and safety of the public. 4.4 Thermal and Hydraulic Desian

4. 4.1 : Safety Issues and Regulatory Requirements The Commission's regulations require that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin to ensure that specified acceptable fuel design limits (SAFDLs) are not exceeded during any condition of normal operation, including the effects of anticipated operational. occurrences.

l 4-2

t s 4.4.2 Evolution of Current Licensing Basis The evolution of the GDC, safety guides, regulatory guides and SRPs is dis-cussed in Subsection 3.2.2 above. TherehavebeennosignIficantchangesin design criteria of reactor core thermal and hydraulic design since the early i 1970s. 4.4.3 Conclusions Prior to each plant refueling, each licensee is required to verify that any changes in thermal and hydraulic design do not result in an unreviewed safety question during the next cycle of operation. If an unreviewed safety question is identified, or if any technical specifications require modification, staff i review and approval is required prior to plant restart. This established licen-sing process ensures that the thermal and hydraulic design of each operating reactor is always in compliance with the applicable regulations and regulatory requirements during the lifetime of the operating facility. As new information occurs as a result of plant operation, inservice inspection, surveillance, mate-rial testing, or research, this information is routinely reviewed by the staff to determine if new or dif ferent recuirements are needed in this area. If new or dif ferent requirements are needec, the staf f has the capability within exist-ing regulatory programs to require additional analyses, as needed, to ensure the continued health and safety of the public. 4.5 Reactor Materials 4.5.1 Safety Issues and Regulatory Requirements Commission regulations, in part, require that the reactor coolant pre % ure boundary have an extremely low probability of abnormal leakage, of.apidly pro-pagating failure, and of gross rupture under operating, maintenance, testing, and postulated accident conditions. These regulations also require that struc-tures, systems, and components important to safety be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be performed. In addition, the regulations require that one of the reactivity control systems shall use control rods, areferably inclua-ing a positive means for inserting the rods, and shall be capa)1e of reliably - controlling reactivity changes to ensure that fuel design limits are not exceeded under conditions of normal operation, including anticipated operational occur-rences, and that components that are part of the reactor coolant pressure bound-ary be designed to permit periodic inspection and testing of critical areas to assess their structural and leaktight integrity. l To satisfy these regulations, the staff recommends that control rod drive structural materials, reactor internals, and core support materials be designed, fabricated, erected and tested using the published regulatory guidance and inspectedtotheguIdelinesofSectionXI,CodeClass1,oftheASMEBoilerand Pressure Vessel Code (hereafter ASME Code). Proposed alternatives to the recom-mendations in the current criteria are reviewed by the staff to ensure that they provide an acceptable level of quality and safety. When inservice inspection requirements of Section XI of the ASME Code are l determined to be impractical, the NRC, in accordance with 10 CFR.50.55a(g)(6), may grant relief and may impose alternative requirements that are determined to 4-3

be authorized by law, will not 9ndanger life or property or the common defense and security, and are otherwiso in the public interest, giving due consideration to the burden upon the licensee that could result if the requirements were imposed on the facility. The staff has implemented requirements in addition to Section III of the ASME Code because many of the components are constructed of austenitic stainless steel material that is susceptible to intergranular stress corrosion cracking in the BWR water environment. 4.5.2 Evolution of Current Licensing Basis Sections III and XI of the ASME Code have changed and will continue to change based on changes in technology and operating experience. The staff actively participates in the process that revises the Code and reviews these changes to determine whether they should be incorporated into plants' licensing bases. Section XI of the ASME Code contains updating provisions. It requires licensaes to revise their inservice inspection program every 10 year interval. The revised programs incorporate all the changes required by Section XI of the licensee's program and, in accordance with 10 CFR 50.55a(g)(6), the staff may grant relief or impose alternative requirements. Changes in technologies (i.e., radiation embrittlement, ultrasonic examination, etc.), which are not addressed by the ASME Code, are described in generic letters and regulatory guides. These letters and guides are prepared and published by the staff and become incorporated into the licensing basis of any nuclear power )lant. Many of these guides recommend changes to the plant-@ecific licensing aasis when environmental conditions change. These licensing changes are reviewed and approved by the staff on a plant-specific basis using generic acceptance criteria. 4.5.3 Conclusions In summary, the control rod drive structural materials and reactor internals at any operating reactor meet the Commission regulations and the inservice inspec-l tion requirements in Section XI, Code Class 1, of the ASME Code unless the staffhasapprovedalternativerequirementsorhasapprovedtellefrequests. As new information occurs as a result of plant operation, inservice inspection, surveillance, material testing, or research, this information is routinely reviewed by the staff to determine if new or different requirements are needed in this area. If new or different requirements are needed, the staff has the capability within existing regulatory programs to require additional analyses, tests, or inspections, as needed, to ensure the continued health and safety of the public. 4.6 Functional Design of Reactivity Control Systems 4.6.1 Safety Issues and Regulatory Requirements The Commission's regulations require that the protection system be designed to fail into a safe state or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments (e.g., extreme heat or cold, fire, pressure, steam, water, and radiation) are 4-4 {

1 ) experienced. These regulations also require that the protection system be designed to ensure that SAFDLs are not exceeded for any single malfunction of reactivity control systems, such as accidental withdrawal of control rods, and require that two independent reactivity control systems of different design principles be provided. One of the systems uses control rods, preferably including a positive means for inserting the rods, and shall be capable of reliably controlling reactivity changes to ensure that under conditions of normal operation, including antici-pated operational occurrences, and with appropriate margin for malfunctions such as stuck rods, SAFDLs are not exceeded. The second reactivity control system shall be capable of reliably controlling the rate of reactivity changes result-ing from planned, normal power changes (including xenon burnout) to ensure that SAFDLs are not exceeded. One of the systems shall be capable of holding the reactor core suberitical under cold conditions. Further, these regulations require that the reactivity control systems be designed to have a combined capability, in conjunction with poison addition by the emergency core cooling system, of reliably controlling reactivity changes to ensure that under postulated accident conditions and with appropriate margin for stuck rods the capability to cool the core is maintained; that the reactiv-ity control systems be designed to consider the effects of postulated reactivity accidents and maintain core coolability; and that the reactivity control systems be designed to ensure an extremely high probability of accomplishing their safety function in the event of anticipated operational occurrences. 4.6.2 Evolution of Current Licensing Easis The evolution of the GCO, safety guides, regulatory guides, and SRPs is discussed in Subsection 3.2.2 above. There have been no significant changes in design criteria of the reactivity control system since the early 1970s, 4.6,3 Conclusions Prior to each plant refueling, transients and accident analyses are evaluated by each licensee to verify that the changes resulting from the new core do t.ot result in an unreviewed safety question. If an unreviewed safety question is identified, or if any technical specifications require modification, staff re-view and approval is required prior to plant restart. This staff review also ensures that the reactivity and response characteristics of the reactor control systems are conservative with respect to the parameters assumed in the tran-sients and accident analyses. This review is performed in accordance with the current licensing basis for the individual plant. The plant technical specifi-cation requires surveillance tests to verify the design safety function of the reactivity control system. This established licensing review process ensures that the functional design of the reactivity control system is maintained in compliance with the applicable regulations and regulatory requirements during the lifetime of the plant. As new information occurs as a result of plant operation, inservice inspection, surveillance, material testing, or research, this information is routinely reviewed by the staf f to determine if new or different requirements are needed in this area. If new or different require-ments are needed, the staff has the capability within existing regulatory programs to require additional analyses, as needed, to ensure the continued health and safety of the public. 4-5

t 5. REACTOR COOLANT SYSTEM AND CONNECTED SYSTEMS 5.1 Scope This section addresses an evaluation of the reactor coolant system and systems connected to it. Special consideration is given to the reactor coolant system and pressure-containing appendages out to and including isolation valving which is the reactor coolant pressure boundary (RCPB), as defined in paragraph 50.2(v) of 10 CFR Part 50. The evaluation covers the areas of integrity of reactor coolant pressure boundary, reactor vessels, and component and subsystem design.

5. 2 Integrity of Reactor Coolant Pressure Boundary and Reactor Vessels 5.2.1 Safety Issues and Regulatory Requirements The Commission's regulations require that the reactor coolant pressure boundary have an extremely low probability of abnormal leakage, of rapidly propagating failure, and of gross rupture under operating maintenance, testing, and postu-lated accident conditions and require that the reactor coolant system and asso-ciated auxiliary, control, and protection systems be designed with sufficient margin to ensure that the design conditions of the reactor coolant pressure boundary are not exceeded during any conditions of normal operation, including anticipated operational occurrences.

These regulations also require that com-ponents that are part of the reactor coolant pressure boundary be designed, fab-ricated, erected, and tested to the highest quality standards practical and that components that are part of the reactor coolant pressure boundary be designed to permit periodic inspection and testing of critical areas to assess their structural and leaktight integrity. To satisfy these requirements the reactor coolant pressure boundar must be designed, fabricated, erected, and tested to 10 CFR 50.55a(y components c), inservice t inspected to 10 CFR 50.55a(g), and meet the fracture toughness and material sur-veillance requirements of 10 CFR 50.60. Additional fracture toughness require-ments for protection against pressurized thermal shock events are contained in 10 CFR 50.61. Also protection against overpressure is provided per the requirements of ASME Code Section III, Article NB-7000. 10 CFR 50.55a(c) requires reactor coolant pressure boundary components to meet the Code Edition and Addenda of Section III of the ASME Code that was required by Commission regulations at the time of issuance of the regulations. 10 CFR 50.55a(g) requires reactor coolant pressure boundary components to meet Sec-tion XI of the ASME Code. Proposed alternatives to these ASME Code require-L ments are permitted in 10 CFR 50.55(a)(3) provided the applicant demonstrates that (1) the proposed alternative would provide an acceptable level of quality i l and safety.or (ii) compliance with the specified requirements would result in hardship or unusual difficulties without a compensating increase in the level of quality and safety. When inservice inspection requirements of Section XI of the ASME Code are determined to be impractical, the NRC, in accordance with 10 CFR 50.55a(g)(6), may grant relief and may impose alternative requirements that are determined to be authorized by law, will not endanger life or property or 5-1 t

the common defense and security, and are otherwise in the public interest, giving due consideration to the burden upon the licensee that could result if the requirements were imposed on the facility. 10 CFR 50.60(a) requires that reactor coolant pressure boundary components meet the fracture toughness requirements in Appendix G, 10 CFR Part 50, and requires the reactor vessel material surveillance program to meet the requirements in Appendix H, 10 CFR Part 50. These appendices impose additional requirements on the reactor vessel because the reactor vessel is subjected to neutron irradia-tion embrittlement. 10 CFR 50.60(b) permits licensees to meet alternative requirements to those specified in Appendices G and H when an exemption is granted by the Commission under 50.12. A low-temperature overpressure protec-tion (LTOP) system is provided to ensure that the pressure-temperature limits per the Appendix G requirements are not exceeded. 5.2.2 Evolution of Current Licensing Basis The reactor coolant pressure boundary is composed of piping, pumas, valves, and I vessels. Prior to 1970, piping in the reactor coolant pressure youndary was constructed and fabricated to the American Standards Association Code B31.1, l " Power Piping," and pumps and valves were constructed and fabricated to manufac-turer specifications. In 1970, the ASME Code was revised to include requirements for reactor coolant pressure boundary piping, pumps, and valves in Section III. Vessels within the reactor coolant pressure boundary are constructed and fabri-cated to ASME Code requirements. Earlier plants were constructed to Sections I and VIII and later plants were constructed to Section III requirements. The fabrication requirements for reactor coolant ptessure boundary piping, pumps, and valves and vessels are specified in the plant's Final Safety Analysis Report (FSAR). The staff reviewed the plant's FSAR to determine that the alter-native requirenents to Section III of the ASME Code provided an acceptable level of quality and safety. Sections III and XI of the ASME Code have changed and will change during the I licensed lifetime of nuclear power plants. The staff reviews these changes to determine whether they should be incorporated into the individual plant licensing bases. The most significant change in Section III of the ASME Code, which affects j reactor coolant pressure boundary integrity, was a change in fracture toughness requirements initiated in the Summer 72 Addenda to the 1971 Edition of the ASME Code. This change required additional material testing and required pressure / temperature (PT) limits during heatup, cooldown, and hydrotest of the reactor ] vessel. All licensees are required to heatup, cooldown, and hydrotest the reac-tor vessel in accordance with plant-specific PT limits that are based on linear elastic fracture mechanics technology. However, the Commission decided that plants built prior to 1972 or plants that had ordered their reactor coolant pres-sure boundary material prior to 1972 did not have to perform the additional test-ing required by the Summer 72 Addenda. Except'for reactor vessel materials, the i Commission concluded that the earlier test requirements were adequate to ensure reactor coolant pressure boundary integrity. Commission acceptance of these requirements are documented in Appendix G, 10 CFR Part 50. For reactor vessel materials, the staff issued Branch Technical Position - MTEB 5-2, " Fracture Toughness Requirement." This branch technical position described a method of 5-2

updating the earlier test data to Summer 72 Addenda requirements. Updating of the test data is needed to order to calculate PT limits. Licensees utilized this method or developed their own method to update their reacto vessel material test data. Methods developed by licensees were reviewed and approved by the staff. 10 CFR 50.55a(g) requires that reactor coolant pressure boundary components meet Section XI of the ASME Code. Section XI of the ASME Code contains updating provisions. It requires licensees to revise their inservice inspection programs every 10 years. The vpvised programs incorporate all the changes required by Section XI of the ASME Code, except for those that are impractical. The staff reviews the licensee's program and, in accordance with 10 CFR 50.55a(g)(6), the I staff may grant relief or impose alternative requirements. Changesintechnologies(i.e.,radiationembrittlement,ultrasonicexamination, etc.j, which are not addressed by the ASME Code, are described in generic letters and regulatory guides. These letters and guides are prepared by the staff and may be incorporated into the licensing basis of the nuclear power plant. Many of these guides recommend changes to plant licensing basis when environmental conditions change. These licensing changes are reviewed and approved by the staff. In addition to these requirements, the staff may recommend or require additional programs when it determines that the operat.ng environment for the component is particularly severe. These programs are imposed through issusnce of technical specifications or recommended through issuance of branch technical positions, regulatory guides, standard review plans, or generic letters. Examples of compo-nents that operate in a particularly severe environment and upon which the staff has either recommended or imposed additional re pressure boundary piping, PWR steam generator tubing,quirements are BWR coolan and all LWR reactor vessels. Generic Letter 88-01 specified additional recommendations for BWR coolant pressure boundary piping because the piping was subjected to inter-granular stress corrosion cracking (IGSCC). Generic Letter 88-11 recommended a i revised method of calculating neutron irradiation embrittlement of LWR reactor vessels because analysis of Appendix H, 10 CFR Part 50, surveillar/e data indicated that the previous method did not adequately address tM issue. The staff im)oses augmented inspection program requirements on PWP. steam generator tubing tirough its issuance of technical specifications. 5.2.3 Conclusions In summary, the design of the reactor coolant pressure boundary at any operating facility must meet the requirements in 10 CFR Part 50 except when the staff has approved: (1) alternative requirements in accordance with 10 CFR 50.55a(a)(3), (2) relief requests or imposed alternative inservice inspection requirements in accordance with 10 CFR 50.55(g)(6), and (3) alternative requirements to the frac-1 50.60(a)ghness and material surveillance requirement in accordance with 10 CFR ture tou i As new information occurs as a result of plant operation, inservice inspection, surveillance, material testing, or research, this information is routinely reviewed by the staff to determine if new or different requirements are needed in this area. If new or different requirements are needed, the staff has the capability to require additional analyses, as needed, to ensure the continued health and safety of the public. 1 5-3

/ 5.3 Component and Subsystem Design 5.3.1 Scope This subsection addresses the performance requirements and design features to ensure overall-safety of the various components within the reactor cr91 ant sys-tem.and subsystems-closely allied with the reactor coolant system. This compo-nent and subsystem include raactor coolant pumps, steam generators, reactor cool-ant piping, main steam 1 6 flow restrictions, main steam line isolation system, reactor core isolation cw15g system, residual heat removal system, reactor water cleanup system, main steam line and feedwater piping, pressurizer, pres-surizer relief-discharge system, valves, safety and relief valves, component supports, and reactor coolant system high point vents. 5.3.2 Safety Issues and Regulatory Requirements I i.nmmission regulations require that systems, structJres, and components important t to safety be designed, fabricated, erected, and tested to quality standards com-mensurate with the importance of the safety functions to be performed and that systems, structures, and components important to safety shall be appropriately 4 protected against dynamic effects, including the effects of missiles, pipe whip-ping, and discharging fluids, that may result from equipment failures and from events and conditions outside the plant. In addition, the regulations require i (1) that the reactor coolant pressure boundary shall be designed, fabricated, erected, and tested so as to have an extremely low probability of abnormal leak- ) age, of rapidly propagating failure, and of gross rupture and that the reactor coolant system and associated auxiliary systems shall be designed with suffi-cient margin to assure that the design conditions of the reactor coolant pres-sure boundary are not exceeded during any condition of normal operation, includ-ing anticipated operational. occurrences. - Further, these regulations require that the reactor coolant pressure boundary shall be designed with sufficient margin to assure that, when stressed under operating, maintenance, testing, and postulated accident conditions, the boundary behaves in a nonbrittle manner and the probability of rapidly propagating fracture is minimized, (2) that components j that are part of the reactor coolant pressure boundary shall be designed to per-mit periodic inspection and testing of important. areas, and features to assess their structural and'leaktight integrity, and (3) that a system to supply reac-tor. coolant makeup for protection against small breaks in the reactor coolant pressure boundary chall be provided. The system safety function shall be to transfer fission product decay heat and other residual-heat from the reactor core at a rate such that SAFDL limits and the design conditions of the reactor coolant pressure boundary are not exceeded. Suitable redundancy in components and fea'.ures and suitable interconnections, i leak detection, and isolation capabilities shall be provided. 5.3.3 Evolution of Current Licensing Basis The licensing basis for various components within the reactor coolant system and subsystems has evolved as reactor events and generic studies by the NRC staff provide new information that is determined to provide improvement in the component and subsystem performance. The process of evaluating operating experience and assessing plant data to determine'the need for additional actions is a continuous one. 5-4 f

L From operating experiences, many different forms of stear gemtor t:$e degra-dation have beer, identified including: stress corrosio' r J;na w w.4ge, intergranular attack, denting, erosion-corrosion, fatiga, einc, pitting, fretting, support plate degradation, and mechanical damege ne iting from im-pingement of foreign objects or loose parts on steam gene.up cernal compo-nents. These degradations ha';e resulted in extensive steam gerierator inspec-tions, tube plugging, repair or replacement. Also steam generator tube rupture (SGTR) events have occurred n a few operating reactors. Steam generator tube integrity was designated an unresolved safety issue (USI) in 1978 and Task Ac-tion Plans (TAPS) A-3, A-4, and A-5 were established-to evaluate the safety significance of degradation in s m m generators of various designs. NUREG-0844 was published in September 1988 to present the results of the NRC integrated program for the resolution of USIs A-3, A-4, and A-5 regarding steam generator tube integrity. A generic risk assessment is provided and indicates that risk from SGTR events is not a significant contributor to total risk at a given site, nor to the total risk to which the general public is routinely exposed. This finding is considered to be indicative of the effectiveness of licensee pro-grams and regulatory requirements for ensuring steam generator tube integrity in accordance with 10 CFR Part 50, Appendices A and B. This report also iden-tifies a number of staff-recommended actions that the staff finds can further improve the effectiveness of licensee programs in ensuring the integrity of steam generator tubes and in mitigating the consequences of an SGTR. As part of the integrated program, the staff issued Generic Letter 85-02 encouraging licensees of pressurized water reactors to upgrade their programs, as necessary, to meet the intent of the staff recommended actions; however, such actions do net constitute NRC requirements. In addition, there are a number of ongoing staff actions.and studies involving steam generator issues that are being pursued to provide added assurance that risk from SGTR events will continue to be small. Following the THI-2 accident, the staff found that additional means were neces-sary to vent noncondensible gases from the reactor coolant system which may inhibit core cooling during natural circulation. Based on lessons learned from the-TMI-2 accident, Item II.B.1, " Reactor Coolant System Vents," was incorpo-rated into the licensing bases for individual plants when all operating nuclear power plants were required to implement reactor coolant system high point venting capability in accordance with these guidelines. Also from the experience of the TMI-2 accident, the s h ff found that operational performance of the relief and safety valves under various reactor operating con-ditions is significant to safety. Performance testing of boiling water reactor and pressurized water reactor relief and safety valves was incorporated in.in-l dividual plant licensing bases when all nuclear power plants were required to i implement testing requirements in accordance with the guidelines contained in TMI Action Plan Item II.D 1. l

5. 3. 4 Conclusions Components within the reactor coolant system and subsystems at all operating reactors meet the applicable GDC and other specific regulations for ensuring l

their safety functions. In addition, compliance with the Commission regulations remains effective at all times during the licensed lifetime of the plant. The continuous staff review of events and operating experience and research has led, where necessary to safety, to the issuance of new criteria and implementation 5-5

of improvements in a number of areas over the years, including steam generator tube integrity (GL 85-02), reactor coolant system vents (NUREG-0737, II.B.1), and performance testing of relief and safety valves (NVREG-0737, II.D.1). This continuing process, coupled with future licensee efforts under the IPE program, will ensure that-if new or different requirements are needed, the staff will require, within existing regulatory programs, additional analyses, testing, or inspection,.as needed, to ensure the continued health and safety of the public, -l 'i i 1 i l_ = l i l 3 j l 5-6 3

6. ENGINEERED SAFETY FEATURES 6.1' Scope Engineered safety features (ESFs) are provided to mitigatc the consequences of postulated accidents in spite of the fact that these accidents are very unlikely. The engineered safety features included in plant designs vary depending on the type of plant (PWR or BWR) under evaluation. This section will discuss five general categr les of features routinely considered under the subject of ESFs. These include; metallic and organic materials, containment systems, emergency core cooling systems, habitability systems, and fission product removal and con-trol systems. 6.2 Metallic and Organic Materials 6.2.1 Safety Issues and Regulatory Requirements The Commission regulations require that the containment boundary be designed with sufficient margin to ensure that, under operating, maintenance, testing, and pos-tulated accident conditions, its ferritic materials behave in a nonbrittle manner and the probability of a rapidly propagating fracture is minimized. In addition, the regulations require that systems, structures, and components important to safety be designed, fabricated, erected, and tested to quality standards commen-surate with the importance of the safety function performed. Specific guidance on satisfying these requirements is contained in applicable regulatory guides that refer to the criteria of ASME Section III for metallic materials used in ESF system construction. In specific cases, with proper justification, the staff evaluated and found acceptable alternatives to these criteria that continue to ensure ESF system integrity and performance. In addition, 10 CFR 50.55a(g) requires that essential components in ESF systems built to ASME Section III criteria receive regularly scheduled inservice inspec-tion in accordance with the criteria of ASME Section XI. Relief can be granted against the criteria of ASME Section XI when the NRC staff determines that alter-native measu ms are in place to ensure fracture prevention of the pressure boundary 6.2.2 Evolution of Current Licensing Basis Sections III and XI of the ASME Code have changed and will continue to change during the plant lifetime of nuclear power plants based on operating experience. The staff reviews these changes to determine whether they should be incorporated into the licensing basis of operating plants. Section XI of the ASME Code contains updating provisions. It requires licensees to revise their inservice inspection program every 10 years. The revised pro-grams incorporate all changes required by Section XI of the licensee's program and, in accordance with 10 CFR 50.55a(g)(6), the staff may grant relief or impose alternative requirements. 6-1

6.2.3 Conclusions In summary, ESF system components meet the Commission requirements for design and construction to ensure their integrity and safety function and for inservice in-spection. These components meet the applicable criteria of ASME Sections III and XI or appropriate alternatives. As new information occurs as a result of plant operation, inservice inspection, surveillance, material testing, or research, this information is routinely reviewed by the staff to determine if new or dif-ferent recuirements are needed in this arer.. If new or different requirements are needec, the staff has the capability within existing regulatory programs to require additional analyses or plant modifications, as needed, to ensure the continued health and safety of the public. 6.3 Containment Systems j 6.3.1 Safety Issues and Regulatory Requirements The Commission regulations require that nuclear power plants be provided with an essentially leaktight containment as a barrier against uncontrolled release of radioactivity to the environment following accidents. More specifically, the regulations require that containment heat removal systems be designed, inspected, and tested in a manner intended to ensure their safety function and that contain-ment atmosphere cleanup systems be designed, inspected, and tested in a manner intended to ensure their safet) function. In addition, the regulations require that the containment be designed to (1) withstand post-accident temperature and pressure conditions without exceeding the design leak rate, (2) prevent fracture, (3) permit periodic integrated leakage testing, (4) permit periodic inspection and pressure testing of resilient seals, and (5) provide appropriate isolation valves. 6.3.2 Evolution of Current Licensing Basis In order to demonstrate that containment designs are capable of withstanding post-accident temperature and pressure conditions without releasing excessive radioactivity, licensees and the staff have used mathematical models to estab-lish and confirm acceptable containment performance. These models and the input assumptions are conservative and have demonstrated that containments are designed with substantial margin. As new information and research on containment design and post-accident energy release are obtained, such information is applied to the analytical methods as appropriate to ensure that adequate margins against exces- .sive leakage are maintained. j For example, in the early 1970s, General Electric identified concerns regarding post-accident pool dynamic loads on BWR pressure suppression containments. The staff and BWR licensees performed significant reanalyses of containment perfor-mance based on this newly identified load phenomenon. The result of this effort was the formation of programs for modifications to the Mark I, II, and III BWR containment designs in order to reestablish the original containment design margins. In the early 1980s, Westinghouse informed the staff that steam line break analyses may not have properly considered superheated steam blowdown condi-tions into the containment which could occur as the steam generator drys out. This information led to revised steam line break analyses by license s which 6-2

incorporated the new blowdown input. The new analyses confirmed that containment performance remains acceptable and appropriate margins are maintained. Following the accident at Three Mile Island Unit 2 in March 1979, the NRC staff noted several concerns with regard to containment performance during the event that warranted improvement. One area of major focus concerned the capability to control combustible gas following accidents. Initially, the NRC staff required. licensees to provide dedicated hydrogen penetrations to ensure the ability to employ hydrogen recombiners to reduce post-accident hydrogen concentration in the containment. This improvement was implemented as Item II.E.4.1 of the TMI Action Plan Clarification, NUREG-0737. However, the NRC staff also recognized that further research into combustible gas concerns was necessary. This led to substantial modifications to 10 CFR 50.44 in 1981 and 1985 wherein more stringent combustible gas control measures were specified for pressure suppression contain-ment plants. Implementation of these requirements has improved combustible gas control capability. The TMI-2 accident also pointed out the need for improvements in containment isolation dependability. New criteria in this regard were implemented as part of TMI-2 Action Plan, Item II.E.4.2, which required all licensees to evaluate their post-accident containment isolation capability against current criteria and make the necessary changes to improve its dependability. Over the past few years, the NRC staff has undertaken research into severe accident effects-on containments for all types of operating plants. To date, this program has pointed out weaknesses in the capability of BWR plants with Mark I pressure suppression containment designs to ensure adequate containment integrity under severe accident conditions. This has resulted in issuance of Generic Letter 89-16, which indicated the staff's intention to pursue plant-specific backfit procedures for a wetwell vent on all Mark I plants if the licensee does not voluntarily install the vent. Implementation of this improvement is currently proceeding. Based on the continuous review of Appendix J leak rate test results, the NRC-staff has periodically updated this rule to incorporate improved containment leak rate testing guidelines. One recent change was to permit use of the mass point method when conducting a Type A integrated leak rate test. Other revisions to Appendix J are currently pending and will provide further improvement in leak' rate testing. In addition, inservice inspection requirements for the containment structures and components are identified in Appendix J, 10 CFR Part 50. Section V.A in Appendix J. requires a general inservice inspection of the accessible interior-and exterior surfaces of the containment structures and components prior to any Type A test to uncover any evidence of structural deterioration that may affect either the containment structural integrity or leaktightness. 6.3.3 Conclusions In summary, the containment designs at all existing operating reactors meet the applicable Commission requirements for leaktightness, heat removal, testing capability, and isolation, including the specific criteria for leak rate testing and for combustible gas control. The models used to confirm acceptable post-accident containment performance are conservative for ensuring appropriate 6-3

margin against unacceptable radiation releases and are updated as necessary when new information is obtained. As new information is obtained as a result of plant events or research, this information is routinely reviewed by the staff to deter-mine if new or different requirements are needed in this area. If new or dif-ferent requirements are needed, the staff will impose these requirements within existing regulatory programs, as necessary, to ensure the continued bralth and safety of the public. 6.4 Emergency Core Cooling Systems (ECCS) 6.4.1 Safety Issues and Regulatory Requirements The Comission regulations require that nuclear power plants contain abundant emergency core cooling capability and specifies the specific safety functions for these systems. 10 CFR Part 50.46 and Appendix K to 10 CFR Part 50 establish the criteria and evaluation methods to be used by licensees and vendors to eval-uata ECCS designs. The ECCS cooling performance must be evaluated using an ac-ceptable model and must be evaluated for a number of postulated loss-of-coolant accidents of different sizes, locations and other properties to ensure that the rangeofpostulatedloss-of-coolantaccIdentsareconsidered. 6.4.2 Evolution of Current Licensing Basis !n June 1971, prior to establishing Part 50.46 or Appendix K, the Comission published interim acceptance criteria for ECCS designs by Westinghouse and Gen-eral Electric reactor plants, and concluded that these criteria provide a rea-sonable assurance that ECCS will be effective in the unlikely event of a loss-of-coolant accident. However, research was under way at the time, and increased knowledge of heat transfer, fluid flow, and engineering disciplines important to ECCS analysis was anticipated. Based on this research, modifications were made to the ECCS analysis guidelines. In December 1971, the NRC amended the interim criteria to add evaluation models for reactor designs by Babcock and Wilcox and Combustion Engineering. In Jan-uary 1972, the AEC undertook an extensive rulemaking hearing. As a result of this proceeding, the Comission established a new Part 50.46 and Appendix K in January 1974, setting forth the acceptance criteria and the ECCS evaluation models in a final rulemaking. These regulations, which were enacted only after extensive rulemaking hearings, established the general approach that remains in use today. Between 1974 and 1976, extensive efforts were made to apply the requirements and criteria of Part 50.46 and Appendix K to all light water reac-tors then in operation. All plants subsequently licensed have been found to meet Part 50.46 and Appendix K. 4 In 1987, the Comission proposed modifications to the regulations because research, performed since the current rule was written, has shown that calcula-tions performed using current methods and in accordance with the current require-ments result in estimates of cooling system performance that are significantly more conservative than estimates based on the improved knowledge gained from this research. The final rule incorporating new evaluation models was published in September 1988, but did not force facilities that had used previous models to perform new analyses. The Comission concluded at that time that existing Appendix K 6-4

evaluation models should be permitted indefinitely. The Commission also believes that the decision to permit continued use of such modele can and should be made at this time because it believes that both methods provide adequate protection of the public health and safety. During the process of licensing, each applicant must submit in the FSAR suffi-cient information to describe the design bases for each ECCS subsystem, including its functional requirements, reliability requirements, protection from physical damage, and environmental conditions. Significant design parameters such as design flow rates, system temperatures, etc., along with piping and instrumenta-tion diagrams, are routinely included. Prior to granting an operating license, the staff reviews the described ECCS design against established acceptance criteria and concludes, in general, that the plant-specific design of the ECCS meets all. necessary requirements and is acceptable. The review process does not stop. The performance requirements of the-ECCS are routinely evaluated during each plant refueling to ensure that operation during the subsequent cycle will be within the safety envelope of the plant design. In many instances, technical specification changes or. license conditions are imple-mented to govern operation during the period of operation. In the extreme case, plant modification may be required to provide continued assurance of public health and safety. Plant operating events also generate new information that may require operating plants to reanalyze the performance of the ECCS and, as necessary, make plant modifications. One such example was the lessons learned from the accident at TMI-2. Following this event, all operating reactors were required to reanalyze their plant-specific response.to a range of-small-break LOCAs. In some cases, these reanalyses resulted in plant modifications or changes in operating proce- .dures being made. Another result of the TMI event was the requirement to install reactor head. vents and to have operating procedures that describe how to use these vents in.the event of certain postulated accidents. The net result was an overall improvement in the level of safety provided by the ECCS at operating nuclear power plants.- 6.4.3 Conclusions In summary, the ECCS designs at all existing operating reactors meet the Commis-sion regulations set forth in Part 50.46, using-the evaluation models required by Appendix K to 10 CFR Part 50. Compliance with these regulations will be maintained at all times during plant operation, including during any renewal period. Though emergency core cooling systems at some older' plants were anal-yzed using evaluation models that no longer represent the best available tech-nology, new analysis has not been required because the models used contain large overall conservatism. As new information occurs as a result of plant events or research, this information is routinely reviewed by the staff to determine if new or-different requirements are needed in this area. If new or different requirements are needed, the staff has the capability within existing regulatory [ programs to require additional analyses or plant modifications, as needed, to y ensure the continued health and safety of the public. l ~ I 6-5 l

6.5 Habitability Systems 6.5.1 Safety Issues and Regulatory Requirements The Commission regulations require that control rooms at nuclear power plants be provided with adequate radiacion protection to permit access and occupancy under accident conditions such that personnel do not receive radiation exposures in excess of 5-rem whole body or its equivalent to any part of the body for the duration of the accident. Additional guidelines are contained in regulatory guides for assuring) operator protection against both radioactivity and toxic gas-(e.g., chlorine releases following postulated accidents. 6.5.2 Evolution of Current Licensing Basit i To satisfy the Commission requiremer.ts, all licensees have performed dose anal-yses using mathematical models to ensure that post-accident radiation levels within the control room are within the required limits. Guidelines for conduct-ing these analyses have remained essentially unchanged since the mid-1970s. The assumptions used are considered to be conservative in order to account for uncertainties in the actual radioactivity release mechanism following an accident. The accident at Three Mile Island Unit 2 in March 1979 pointed out potential vulnerabilities in the capability of. control room habitability systems, i.e., the control room ventilation system to ensure adequate radiation protection for the operators. Therefore, Item III.D.3.4 of the TMI Action Plan Clarification, NUREG-0737, was implemented at all operating plants. This item required licens-ees to evaluate their control room habitability systems against the criteria of Standard Review Plan Section 6.4 and perform the necessary analyses of toxic gas and radiation exposure to the operators in order to demonstrate compliance with these criteria. All plants provided responses to this issue and made improve-l ments in the control room ventilation systems, as appropriate. l The staff also recognized the need to conduct a longer term review of criteria for ensuring control room operator protection and began a study in this regard under Generic Issue 83 in the mid-1980s. This effort began with a survey of 12 nuclear power plants to determine what improvements had been made as part of the NUREG-0737, Item III.D.3.4, implementation. Based on the results of the survey, the staff determined that further guidance to improve control room habitability systems was necessary. This guidance is currently under development and is intended to be issued in a ;; nt.ric letter to all licensees soon. 6.5.3 Conclusions In summary, the control room habitability systems at all existing operating reactors meet the Commission requirements for ensuring post-accident control room operator doses within acceptable limits. Compliance with these regulations will be maintainod at all times during operation, including any renewal period. The models used to confirm acceptable post-accident control room doses are conserva-tive and updated as necessary when new information is obtained. As new informa-tion is obtained as a result of plant ever.ts or research, this information is routinely reviewed by the staff to determine if new or different requirements are needed in th's area. If new or different requirements are needed, the staff will impose these requirements using existing regulatory programs, as necessary, to. ensure the continued health and safety of the public. 6-6

6.6 Fission Product Removal and Control Systems 6.6.1 Safety Issues and Regulatory Requirements The Commission regulations require that containment atmosphore cleanup systems be designed, inspected, and tested in a manner to ensure their safety function following postulated accidents. 6.6.2 Evolution of Current Licensing Basis Staff guidance in the fission product removal and control area has changed little over the years. Most nuclear power plants are equipped with ventilation systems containing charcoal and high efficiency particulate air filters for fission pro-duct removal and prevention of unacceptable radiological releases during normal operation and post accident conditions. Plants with filters have technical saecifications that require surveillance and testing of those filters to ensure t1eir continued satisfactory performance. PWR plants are also equipped with containment spray systems that provide both a post-accident heat removal and fission product control safety function in containment. As a means of control-ling pH in the spray water, these plants have utilized a sodium hydroxide solu-tion as a spray additive. Over the years, however, the staff recognized, through research of the post-accident source term, that a lower spray water pH (no lower than 7) was acceptable to ensure iodine retention and long-term corrosion control in ECCS systems. As a result, some PWR licensees have removed the sodium hydrox-ide addition system and replaced it with much simpler trisodium phosphate baskets placed directly in the containment sump in order to achieve necessary pH control. In BWRs, blowdown of the reactor through the suparession pocq results in some fission product removal following an accident. iowever, the staff had not pre-viously credited this pathway in dose analyses. Staff reiiew of recent analyses by General Electric resulted in a recognition of the suppression pool as a means of fission product control and led to a revision of the Standard Review Plan to I credit an appropdg* e decontamination factor. Future BWRs will utilize this additional credit'1n post-accident dose analyses as may currently operating l plants when proposing changes. l 6.6.3 Conclusions In summary, fission product removal and control systems at all existing reactors meet the Commission requirements for design, inspection, and testing to ensure their safety function. Compliance with these regulations will be maintained at all times during operation, including any renewal-period. As new information is obtained as a result of plant events or research, this information is routinely reviewed by the staff to determine if new or different requirements are needed in this area. If new or different requirements are needed, the staff will impose these requirements using existing regulatory programs, as necessary, to ensure the continued health and safety of the public. 6-7

7. INSTRUMENTATION AND CONTROL SYSTEMS 7.1 Scope The licensing bases and regulatory requirements for instrumentation and control (I&C) systems are discussed in the following sections. The systems to be discussed in this section include the reactor trip system, engineered safety features actuation system, safe shutdown systems, and safety-related display systems. Remote shutdown systems are included in safe shutdown l systems and post-accident monitoring and safety parameter display systems are l included in safety-related display systems. 7.2 Development of Regulatory Requirements Initially the regulatory requirements came from the need to develop highly reliable instrumentation and control systems to monitor and control the operation of nuclear reactors and other critical systems. In response to this need, con-cepts and methods such as the single failure criterion, failure mode and effects analysis, reliability, failure rates, sneak circuit analysis, redundancy, and diversity were developed and applied. In August 1968, these concepts and methods were originally collected into proposed IEEE Standard 279, " Criteria for Protec-tion Systems for Nuclear Power Generating Stations," which was incorporated into 10 CFR 50.55a(h) in 1970. In addition, these concepts and methods were made part of the Commission regulations governing the design, fabrication, construc-tion, installation, testing, and operation of these highly reliable instrumen-tation and control systems for nuclear reactors. In 1974 and 1975, the staff went further in providing guidance by drafting and issuing criteria by which they would review the safety analysis reports (SARs) and other.information submitted by licensees and applicants. The totality of. these requirements has become the regulatory requirements that the licensees must address for their plant. This body of requirements is frequently revised and upgraded to take.into account technological advances and lessons learned from operating experience. The licensee, however, is authorized through 10 CFR 50.59 to make changes to-the plant and its procedures and to conduct tests or experiments not-described l in the SAR without prior NRC approval unless the proposed change, test, or experiment involves changes to the technical specifications or introduces an l unreviewed safety question. This body of requirements as it exists at the time application is made for an operating license and as reviewed and approved by the staff becomes the specific regulatory requirements for that plant. 1 7.3. Reactor Trip System 7.3.1. Safety Issues and Regulatory Requirements The primary safety function of the reactor trip system (RTS) inpramentation. is to monitor selected rea:: tor and plant parameters related to nuclear power gen-eration and transfer of the heat from that generation to the power conversion 7-1

q devices. When these parameters approach and exceed. values deemed unsafe by analysis, the system shall initiate reac.or shutdowns that shall promptly.make the reactor core subcritical, i.e., stop the generation of nuclear power, by rapidly inserting control rods into the core or by other means of rapidly inserting enough negative reactivity into the core to make it subcritical and to keep the core suberitical. The RTS instrumentation must be highly re'.f able, minimize false shutdowns, possess high availability, be automatically initiated, provide for manual initiation, and be designed so that the operators can easily and quickly determine the state of the plant. Applicable design requirements ensure that trip parameter monitoring channels and trip logic and actuation trains are redundant and independent; that all channels and trains meet the single failure criterion; that monitored parameters are sufficiently diverse; and that measuring instrumentation possesses adequate range, sensitivity, and accuracy and has adequate capability for test and calibration. These design require-ments ensure that parts and components are specified that meet plant-specific seismic and environmental requirements in accordance with IEEE Standard 344 and 10 CFR 50.49. Fabrication and installation requirements ensure that the system or subsystem is built of Class 1E parts and components, that it is fabricated and installed to meet plant-specific seismic and environmental requirements, and that quality control and quality assurance programs and procedures are used that meet the requirements of 10 CFR Part 50, Appendix B, and applicable IEEE and ANSI standards. Testing and operational requirements set forth in 10 CFR 50.36, 10 CFR Part 50 Appendices A and B, IEEE standards, and various regulatory guidance ensure that the system is adequately tested prior to and during operation and that the system is operated within the limits specified in the plant.techaical specifications. 7.3.2 Evolution of Current Licensing Basis As plants became operational during the 1970s, operating experience indicated the need for improvements and c! Jes in branch-technical positions, technical specifications, regulatory guides, and IEEE standards. Changes at the nuclear power plants were also recommended in generic. letters and bulletins.

However, several major events occurred that caused major changes to be made to the licensing basis.

The Brown's Feiry fire in 1975 taught lessons about separating and protecting safety-related irstrumentation, control, and power cabling. It also emphasized the importance of providing remote initiation capabilities for safety-related equipment that could be made independent of cabling and equipment in the cable spreading and main control rooms. Revision of the IEEE standard and the regula-tory guide on separation and independence as well as revisions to other IEEE standards relating to testing, qualification,~and installation of safety-related equipment resulted from staff experience with this event. All plants licensed subsequently were reviewed by the staff to confirm that the protection system design precludes the use of components that are common to redundant channels, such as: actuation, reset, mode and test switches, common power supplies, or [ any other features that could compromise the independence of redundant channels. IEEE Std. 279 Sec. 4.6; IEEE Std. 384; Regulatory Guide 1.75; GDC-22; and SRPs 7.2 and 7.3 were used as acceptance criteria for these reviews. 7-2

The TMI-2 event in 1979 mandated many changes, which included significant revisions to operating procedures, incorporation of human factors concepts into the design and arrangement of instrumentation and controls on main control boards, monitoring of reactor vessel water level for BWRs and for PWRs, and new ' instrumentation to indicate reactor coolant sub-cooling margin for PWRs. The changes were implemented through generic letters arid confirmatory orders. The Salem ATWS (Anticipated Transients Without Scram) events in 1983 involved the only failure of a V. 5. reactor to shut down on demand. The rapid interven-tion of the operators limited the consequences but the implications regarding shutdown reliability were significant and brought changes in operating procedures, reevaluation ~of on-line testing capability of the RTS, modifications to RTS breakers for B&W and Westinghouse plants, and changes to associated maintenance procedures. These improvements were requested by Generic Letter 83-28. Each licensee response was reviewed and approved by the staff. In 1984, the Commis-sion issued 10 CFR 50.62, which added diverse and independent reactor trip sys-tems to further improve reactor shutdown reliability and reduce the risk from potential occurrences of ATWS events. The NRC is presently reviewing and inspecting each plant to ensure that the systems have been installed properly. 7.4 Engineered Safety Features Actuation Systems 7.4.1 Scope In this section are the actuating systems for typical ESF systems such as containment and reactor vessel isolation, emergency core cooling, containment heat removal, auxiliary feedwater, diesel generators, and standby gas treatment. 7.4.2 Safety Issues and Regulatory Requirements The primary safety function of the engineered safety features actuation system (ESFAS) is to sense the need for, select, and initiate systems that take action to terminate or control and contain the effects and consequences of design basis accidents and operational occurrences. As for the RTS instrumentation and logic, the ESFAS instrumentation, logic, and actuation equipment should also be highly reliable, minimize spurious actuations, possess high availability, be automatically initiated, provide for manual initiation of protective action from the control room, and be so designed that the operators can readily determine the status of the ESF systems and their actuating systems. 7.4.3 Evolution of Current Licensing Basis The ESFAS and the RTS are very similar systems, the difference being principally in the systems controlled or actuated and the mission of those systems. The-licensing basis for the two systems evolved in very much tne same way. The same IEEE standards and the same regulatory guides apply to both systems. Some staff requirements apply to the ESFAS that do not apply to the RTS and vice versa; however, the basis for applying the requirements to the ESFAS and RTS subsystems is the same. Similarly, the modifications to the licensing bases for the ESFAS caused by the Brown's Ferry fire, TMI, Salem ATWS, the ATWS rule, and the feed-back of operating experience are much the same for the ESFAS as they were for the RTS and are therefore not presented again. 7-3

7.5 Safety-Related Display Instrumentation 7 5.1 Scope lhis section includes the post-accident monitoring instrumentation (PAM) and the safety parameter display system instrumentation with the normal safety-related display instrumentation. l 7.5.2 Safety Issues and Regulatory Requu ements i The primary safety function of the safety-related display instrumentation (SRDI) is to assist in meeting the Commission regulations by providing the capability to display the instantaneous values of the monitored plant operating parameters that provide the operators the information they need to form and update their j assessment of the plant's operating status. The primary safety function of the PAM is to provide the capability to monitor appropriate. plant parameters'during and after plant accidents and transients to assist the control room operators in preventing and mitigating the consequences of those events. The primary safety function of the safety parameter display 1 system (SPDS) is to provide a concise display of critical plant variables to the control room operators to aid in rapidly and reliably determining the safety status of the plant. i I As with the RTS, PAM instrumentation must be highly reliable, possess high avail-ability, and be so designed that the operators can readily determine the. status of the key variables. Applicable design requirements ensure that instrumentation channels are redundant and independent; that all channels meet the single failure criterion; that monitored parameters are sufficiently diverse; and that the mea-suring and indicating instrumentation possesses adequa5 range and sensitivity i and has the capability.for test and calibration. These design requirements also ensure that parts and components are specified that meet plant-specific seismic and environmental requirements in accordance with IEEE Standard 344 and 10 CFR 50.49. Fabrication and installation requirements ensure that the instrumentation is built of Class 1E parts and components, that it is fabricated and installed to meet plant-specific seismic and environmental requirements, and that quality control and quality assurance programs and procedures are used that meet the requirements of 10 CFR Part 50 Appendix B and applicable IEEE and ANSI standards, Testing and operational requirements set forth in 10 CFR 50.36,10 CFR Part 50 y L Appendices A and B, IEEE standards,.-and various regulatory guides ensure that l the instrumentation is adequately tested and that the instrumentation is operated L within the limits specified in the plant technical specifications. 1 7.5.3 Evolution of Current Licensing Basis The THI-2 event mandated many changes in safety analysis philosophy, operating procedures, incorporation of human f actors concepts into the design and arrange-i ment of instrumentation and controls on the main control boards, monitoring of reactor vessel water level for BWRs and for PWRs, and reactor coolant sub-cooling margin for PWRs. Following the TMI-2 event, the NRC staff developed a compre-hensive and integrated plan to improve safety at power reactors. As part of this plan, the Commission required the installation of improved post-accident l monitoring instrumentation and SPOS. These improvements were intended to pro-vide the operator with a broader range of information for accidents, including those beyond the design basis. 7-4

l ) The SPDS and Regulatory Guide 1.97, Revision 2, were items identified in the THI Action Plan (NUREG-0737). Additional clarification for implementation of these items was addressed in NUREG-0737, Supplement No. 1 via Generic Letter 82-33. The SPDS and the' instrumentation in Regulatory Guide 1.97 were required for all operating plants, applicants for operating licenses, and holders of construction permits. The staff has reviewed almost all the submittals on conformance to Regulatory Guide 1.97 and SPDS. Generic Letter 89-06 was issued to all licensees for the purpose of certifying that the SPDS fully meets or will be modified to meet the requirements of NUREG-0737, Supplement 1.

7. 6 Safe Shutdown and All Other Systems Required for Safety t

7.6.1 Scope This section includes systems and interlocks required for safe shutdown and safe operation of th wctor which were not included as part of either the reactor trip system, eng(,aered safety features actuation system, or the safety-related display instrue ntation. Examples include, for PWRs: residual heat removal, auxiliary fee 6nter, baration, interlocks, and radiation monitoring systems and remote shutdown facilities; for BWRS: reactor core isolation cooling, residual heat removal (statdown cooling mode), standby liquid control, neutron monitoring (including rod block monitor), recirculation pump trip, interlocks, and radia-tion monitoring systems, low level set instrumentation, and remote shutdown facilities. 7.6.2 Safety Issues and Regulatory Requirements The safety functions of the systems in this section vary with the system or equipment but, for the majority of these systems, it is preventive for the interlocks, boration, and SLCS systems and protective for the shutdown cooling systems and radiation monitoring systems. In general, the instrumentation and logic systems in this section should meet the same safety criteria and regulatory requirements discussed in Section 7.4.1 for the ESFAS instrumentation and logic systems; however, some systems and por-tions of systems, particularly radiation monitoring systems and portions of -interlock systems, may not be required to meet all the requirements for Class 1E t systems. In addition, the Commission regulations require the provision for l remote shutdown facilities that are located outside of the main control room and that meet the regulatory requirements. l 7.6.3 Evolution of Current Licensing Basis f The licensing basis for these systems and equipment contains the same basic requirements as the RTS and ESFAS relating to systen, and equipment reliability;. availability; redundancy; independence; ability to meet the single failure cri-terion;-provision of adequate range, sensitivity, and accuracy in sensing and monitoring equipment; and provision of capability for test and calibration of the systems and equipment to which these requirements apply. Modifications to the licensing basis for the safe shutdown and all other systems required for safety that were found necessary by experience gained from the Brown's Ferry fire, TMI, Salem ATWS, the ATWS rule, and the feedback of oper-ating experience that updates it are the same for the requirements applicable l l L l-7-5 1

to these systems and equipment as they are for the RTS and ESFAS systems..These were previously discussed in Sections 7.2.2 and 7.3.2 and will not be discussed

further, 7.7 Control Systems 7.7.1 Scope This section includes those control systems used for normal operation that are not relied upon to perform safety functions following anticipated operational occurrences or accidents but that control plant processes having a significant impact on plant safety.

Examples include the reactivity control systems; the reactor coolant pressure, temperature, flow, and inventory controls; the secon-dary system pressure and flow controls; and the environmental control systems for safety related instruments and instrument sensing lines. 7.7.? Safety Issues and Regulatory Requirements The licensing of earlier plants in the control system area usually encompassed the revie,! of the interaction of the control systems with the safety systems that have ben discussed in the previous sections. This review was performed to ensure that no interactions existed that would prevent or inhibit the safety system from performing its intended safety function. 7.7.3 Evolution of Current Licensing Basis As the licensing process evolved, the review of the control system mentioned above beame somewhat more detailed. In addition, the environmental control systems were added to the list of significant control systems and a regulatory guide that detailed the review bases for this system was published. During the-later licensing years, plant-specific studies were performed to determine the effects of high energy line breaks on control systems, the effects of the loss of power to control systems used to shut the plant down in a normal manner, and the results of multiple control system failures on the existing safety analysis. Accordingly, requirements and. criteria for the review of these control systems have been included in the SRP, and they have been made a part of the licensing bases. A generic study was undertaken (USI A-47) that led to the conclusion that~ some modifications to plants should be made and that the failure of some control systems'would have an impact on the safety analysis and, therefore, surveillance of these systems should be included in the technical specifications along with the safety systems mentioned in the previous sections. For example, Generic Letter 89-19 requested all reactor licensees to install, if not already present, overfill protection instrumentation. All responses to the generic letters as well as all changes will be reviewed by the staff. 7.8 General Conclusions At the time of the initial licensing for a plant, the applicant provided sufficient information for the staff to conclude that the plant design satis-fled the staff acceptance criteria which ensured that the intent of the appli-cable regulations were met. Consistent with the processes discussed generally above, the staff has modified the licensing basis to ensure not only the contin-ued acceptability of the licensing basis but also the protection of the health 7-6

and safety of the putlic. As new information continues to occur from plant events, research, or die processes discussed in Section 1 of this report, this -information is-routinely evaluated by the staff to determine if new or different requirements are needed in the specific area. If new or different requirements are needed, the staff has the capability within existing regulatory programs to require additional analyses or plant modifications, as necessary, to ensure the continued health and safety of the public and the acceptability of the plant -licensing basis. l-7-7

8. ELECTRIC POWER 8.1 Scope Electric power systems are provided to power safety-related equipment that are necessary to mitigate the consequences of design basis accidents and to bring the plant to a safe condition and maintain it in that condition. The electric power systems are comprised of an offsite power system and an onsite power sys-tem. These two systems will be discussed jointly in this section since their licensing basis is often contained in common regulatory requirements. 8.2 Safety Issues and Regulatory Requirements The Commission regulations establishes the basic criteria to which the offsite power system and the onsite power system must be designed. These regulations require that each system (offsite and onsite) have sufficient capacity and cap- . ability by itself to support vital functions necessary to respond to operational occurrences and mitigate the consequences of design basis accidents. In addi-tion, the onsite power system must be able to withstand a single failure and the offsite power system must have two power circuits designed and located so as to minimize to the extent practical their simultaneous failure. .The regulations also require that the electric power systems be designed to aermit appropriate periodic testing and inspection and that all operating plants lave the capability to withstand and recover from a station blackout (loss of all ac power). These regulations also apply to portions of the electric power systems insofar as they provide general requirements for safety systems or provide requirements for systems that interface with the electric power systems. 8.3 Evolution of Current Licensing Basis The Commission regulations published in February 1971 have provided and continue to provide the primary licensing basis for the electrical power systems. More recently these regulations have been supplemented with the requirements in 10 CFR 50.63, published in June 1988, that require all plants be able to withstand and recover from a station blackout (loss of all ac power). The station blackout rule prov. des an illustration of how the regulatory process functions to modify the licensing basis in the electric power systems area when a need is identified. As operating experience was accumulated from license event reports (LERs), diesel generator failure reports, and feedback from the regions, a concern arose that the reliability of both the offsite and onsite emergency ac power systems might be less than originally anticipated, even for designs that met the requirements of the Commission regulations. Some operating plants had experienced a total loss of offsite power, and operating experience with onsite emergency power sys-tems included many instances when diesel generators failed to start. In a few cases there was even a complete loss of both the offsite and the onsite ac power systems, although ac power was restored in a short time without any serious con-sequences. In 1975, the results of the Reactor Safety Study (WASH-1400) showed that station blackout could be an important contributor to the total risk from nuclear power plant accidents. Although this total risk was found to be small, 8-1

the relative importance of the station blackout accident was established. Subsequently, the Commission designated the issue of station blackout as an unresolved safety issue (USI); and studies were initiated to determine whether additional safety requirements were needed, i As a result of the station blackout studies, a proposed rule was published for 1 comment in the Federal Register in March 1986. The final rule was published in June 1988. Concurrent with the development of the station blackout regulatory guidance, the Nuclear Management and Resource Council (NUMARC) also developed detailed guidelines and procedures for assessing station blackout capabilities at light water reectors (NUMARC 87-00) which were reviewed and approved by the staff and found acceptable for implementation of the station blackout rule. The purpose of the effort in developing the NUMARC 87-00 guidelines and the staff's cooperation with this effort was to iron out differences and misunderstandings in advance and to establish acceptable approaches to various station blackout i issues for all utilities in responding to the aspects of the regulatory guide i and rule. All licensee responses to the station blackout rule were received in April 1989. The staff is presently reviewing these submittals and will issue safety evaluation reports for each plant when the review is completed. It is expected that all licensees will have implemented all required modifications and proce-dure changes within 3 years. While final plans for inspection have not been completed, it is likely'that an audit inspection at some plants will be performed to monitor the licensee s-implementation efforts. In addition to rule changes, other less rigorous methods have been employed by the staff to make improvements in the electric power systems area when a need is identified. These' include the use of generic letters, bulletins, revision to regulatory guides, creation of new regulatory guides, modifications to the standard review plan, and more recently cooperation with the nuclear power industry'in.the development of industry-sponsored guidance documents. Generic Issues B-23 and B-48 on degraded grid voltages and station electric distribution system voltages are examples where generic letters have been used-to implement improvements to electric power systems. Events at Millstone and Arkansas Nuclear One power plants raised a concern that the offsite power sys-tems required by Commission regulations may not satisfy the capability require-ments of the criteria in that they may not always provide adequate voltages to operate safety-related loads. This could cause loss or damage to redundant safety systems during an event. As a result, generic letters were issued to_ all power reactor licensees in June 1977 and August 1979 requesting them to analyze their1 electric distribution systems for adequate voltages and provide to the staff a description of the modifications to upgrade the protection of electrical relaying that separates the offsite power system from the safety loads when volt-age levels are insufficient to operate these loads. These guidelines were later incorporated into a new branch technical position (PSB-1) in the standard review i plan in order to ensure they are consistently applied to new plant license applications. As of today, all operating plants have submitted and received approval for plant modifications that implemented a second level of voltage protection for their safety-related electrical buses. NRC Bulletin No. 88-10 on nonconforming molded-case circuit breakers is an example of how a bulletin has been used to require that licensees take some . action to verify that their electrical system is in conformance with the 8-2

Commission requirements. Here again it was a question of whether the plant electric power systems were continuing to meet the capability requirements specified in the r cable Commission regulations. The staff found that at some plants circi. breakers suppli d T a particular supplier were refurbished rather than new, as indicated by the supplier, and several breakers did not meet required performance specifications. If these breakers were used in safety-related circuits, the reliable functioning of the circuit could not be assured. As a result Bulletin 88-10 was issued in November 1988 requesting that all li-censees verify traceability of certain circuit breakers used in safety systems and test those breakers where traceability to the original manufacturer could not be shown and report the results to the Commission. The staff is reviewing the licensee responses to determine if the licensee has implemented the actions contained in the bulletin. If the staff determines that the licensee has imple-mented the actions contained in the bulletin, no further staff action will be performed. If a licensee these licensees on a case proposes alternative actions, the staff will handle by-case basis. Generic Safety Issue B-56 on diesel generator reliability improvement provides an example of the use of revised regulatory guides and industry-sponsored guid-ance documents to implement improvements to electric power safety systems. B-56 was begun as a response to the lower than expected reliability of diesel genera-tors as emergency power sources in the onsite power systems. It is related to the station blackout issue in that it is one of the primary sources of unrelia-bility in the total loss of ac power event. As a result the station blackout regulatory guidance called for a reliability program at nuclear power plants designed to monitor and maintain the reliability of the diesel generators and improve the reliability if an acceptable level is not achieved. Specific guid-ance to the utilities on how to implement such a program is being provided under the B-56 resolution in the form of a revision to Regulatory Guide 1.9, which will reference a NUMARC document for the diesel generator reliability program recom-mendations. The NUMARC document (NUMARC 87-00 Appendix D) was generated by the nuclear power industry with input from the NRC staff as described above in our station blackout discussion. The resolution of B-56 will be complete when, con-sistent with the requirements of the station blackout rule,'each licensee imple-ments an emergency diesel generator reliability program to enhance the reliabil-ity of the onsite diesel generators. Problems in the electric power systems such as the ones dis;ussed above are identified by the staff on an ongoing basis through the rrview of LERs and other licensee notification requirements and through the vario'.s license review and inspection activities of the staff. Besides the vehic1,s identified above for making changes to the electric power systems licensin', basis, NRC information notices are of ten used by the staf f to notify licenNes of problems-found in the electrical systems at some plants. Although the notices do not require action by the licensees, they serve to quickly advise them of problems that may exist in their plants while the staf f determines what, if any, additional action is warranted. 8.4 Conclusions In summary, the primary current licensing basis for the electric power systems is found in Commission regulations specific to electric power systems or in those which describe general requirements for safety systems or describe requirements for systems that interface with the electric power systems. The staff has used l 8-3

1 a number of methods on an ongoing basis to identify and correct problems or make i improvements to the design or operation of the electric power systems. These include such things as LERs, inspections, generic letters, bulletins, regulatory guides,- standard review plan, and industry-sponsored guidance documents, These devices provide-the staff with the capability to monitor, correct, and improve the implementation of the Commission regulations. The capability also exists to modify or add requirements to the licensing basis as was recently done with the addition of Section 50.63 to 10 CFR Part 50. Based on the staff's continuous j review of information gained from operating experience and research, additional requirements can be implemented within existing regulatory programs, as appro-priate, to ensure the continued health and safety of the public, l 1 l i i )'l l 8-4

9. AUXILIARY SYSTEMS I 9.1 Scope Auxiliary systems are those secondary systems provided to support operation and function of primary engineered safety features (ESFs) and also include other systems not directly related to safe operation and safe shutdown of the reactor. Their primary function is to remove heat from essential components (e.g., cool-ing water and ventilation systems) or provide motive power (e.g., compressed air) to equipment needed for safe reactor-operation and post-accident shutdown. Support systems include cooling water systems (e.g., station service water,- reactor auxiliaries cooling water, and the ultimate heat sink); compressed air systems; heating, ventilation, and air conditioning (HVAC) systems for various plant areas; and diesel generator auxiliaries (e.g., fuel oil, cooling water, lubrication, and combustion air systems). Other auxiliary systems not directly related to safe reactor operation and shutdown include new and spent fuel stor-age and handling systems, process sampling system, equipment and floor drainage system, fire protection system, and communication and lighting systems. In-addition, the chemical and volume centrol system that provides normal reactor coolant system inventory in PWR plants and the standby liquid control system that provides an emergency backup means of reactivity control in BWR plants are also a part of the scope of the auxiliary systems. 9.2 Safety Issues and Regulatory Requirements The Commission regulations require that cooling water systems supporting primary ESF systems be designed, tested, and inspected in a manner intended to ensure l their safety function and that ESF systems be compatible with environmental con-ditions, which includes HVAC systems relied on to provide proper ESF equipment operating conditions. These regulations also require that spent fuel storage and handling systems be designed with features that ensure spent fuel storage facility safety and that nuclear power plants be designed-to minimize the pro-bability of fires and have fire protection features to minimize the adverse effects of fires. Specific additional fire protection requirements are contained in~10 CFR 50.48 and Appendix R to 10 CFR Part 50. 9.3 Evolution of Current Licensing Basis The_ licensing. basis for auxiliary systems has evolved as reactor events and generic studies by the NRC staff provide new information that is determined to provide improvement in auxiliary system perfort:nce. The process of evalu-ating operating experience and assessing plant data to determine the need for additional actions is a continuous one. One important source of operating experience information is the reportable events and equipment-failures provided by all licensees in accordance with the require-ments of 10 CFR 50.72 and 50.73. The NRC Office for Analysis and Evaluation of Operational Data (AE0D) reviews this information and develops recommendations for action. Examples of this with regard to auxiliary systems are discussed below. 9-1

Another means of identifying the need for further actions is through the process of identifying, prioritizing, and evaluating generic issues when poten-tial safety concerns arise that require longer term study. Examples of the generic issue process on auxiliary systems are also discussed below. In 1980, the NRC staff became aware through reported events of fouling of service water systems and the resulting degradation in system performance caused by biological organisms. This resulted in the issuance of IE Bulletin 81-03, "FlowBlockageofCoolingWatertoSafetydatedApril10 Related Components by Corbiocula Sp. (Asiatic Clam) and Mytilus Sp. (Mussel), , 1981. Licensees were requested to assess the potential for biofouling at their sites and implement appropriate monitoring or corrective actions. Subsequent service water system problems were also identified and generically communicated in IE Information Notices IN 85-30, Microbiological Induced Corrosion of Containment Service Water System (April 19, 1985); IN 86-11, Inadequate Service Water Protection Against Core Melt Frequency (February 25, 1986); and IN 86-96, Heat Exchanger Fouling Can Cause Inadequate Operability of Service Water Systems (November 20,1986). As a result of the service water system degradation problems, several generic issues (GIs), but primarily GI-51, " Proposed Requirements for Improving Open Cycle Service Water Systems," were initiated to study the need for further recom-mendations for lmproving service water system performance. In addition, as part of their respo:sibility to evaluate operational data, AE00 undertook a study of' service water system problems. The AE0D findings were eventually published in " Operational Experience Feedback Report - Service Water System Failures and Degradations," NUREG-1275, Volume 3, dated November 1988. The AE00 report and GI-51 resolution led to development and issuance of Generic Letter (GL) 89-13, " Service Water System Problems Affecting Safety-Related Equip-ment," which recommended additional performance monitoring-and design verifica-tions-in order to. ensure the safety function of the service water system. All plants-were required to respond to GL 89-13 by-indicating their plans for accom-plishing the NRC staff's intent to improve service water system performance. Through the inspection program, the NRC staff is performing audits of the imple-mentation of the actions' identified by the licensees in response to the generic letter and will assess the adequacy of the licensee's actions. A similar process was followed during the early 1980s to' correct reported failures and problems with degradation in the instrument air systems. Parallel NRC staff evaluations were conducted under GI-43, " Air System Reliability," and in AE00 which resulted in-publication of " Operational Experience Feedback Report - Air System' Problems," NUREG-1275, Volume 2, dated December 1987. The GI-43 resolution and AE00 report led to development and issuance of GL 88-14, "Instru-ment Air Supply System Problems Affecting Safety-Related Equipment," which requested licensees to perform a design basis verification-of their instrument air systems and make the necessary improvements to ensure its proper function. All~ 1icensees were required to respond to GL 88-14 indicating that they had accomplished the recommended actions. Through the inspection program, the NRC staff is performing audits of instrument air systems to assess the adequacy of the licensees' actions for improving the systems performance. Following the TMI-2 accident, it became apparent from analysis of the event that additional means were necessary to ensure prompt and accurate post-accident sampling of the containment environment and reactor coolant conditions in order 9-2

to provide information needed to manage post-accident recovery. Based on lessons learned from the TMl-2 accident, Item II.B.3, " Post-t.ccident Sampling Capability," was incorporated in the Clarification of TMI Action Plan Require-ments, NUREG-0737. All nuclear power plants were required to implement post-accident sampling capability in accordance with these guidelines. Because of the safety significance of the fire at Browns Ferry Unit 1 in 1975, the staff undertook a comprehensive effort to develop more specific criteria to enhance fire safety. This effort resulted in issuance of various staff posi-tions and guidance in 1976, which included Branch Technical P M tion (BTP) Aux-iliary and Power Conversion System Branch (APCSB) 9.5 1 and Ag m dix A to BTP APCSB 9.5-1. Codification of fire protection requirements was eventually imple-mented by the Commission with issuance of 10 CFR 50.48, " Fire Protection," and Appendix R to 10 CFR Part 50, dated November 19, 1980. All licensees with plants licensed to operate prior to January 1,1979, were required to compare their plant fire protection features against the above criteria and make the necessary modifications. Plants not licensed prior to 1979 were reviewed against similar criteria as part of the normal staff pre-licensing review. Completion of these actions has resulted in substantial improvement in fire protection and post-fire safe shutdown capability in all plants. With the recognition in.the mid-1970s that spent fuel from commercial nuclear power plants would not be reprocessed, it became apparent that much greater quantities of spent fuel would be stored in onsite spent fuel pools. This resulted in the development of additional guidance for ensuring safe spent fuel storage when license amendments were requested for expanding capacity in spent fuel pools. This guidance was issued to all nuclear power reactor licensees by a generic letter, dated April 14, 1978. This guidance continues to serve as a basis for ensuring safe onsite spent fuel storage. Subsequent generic concerns with spent fuel storage safety were evaluated by the NRC staff under Generic Issue 82, "Beyond Design Basis Accidents in Spent Fuel Pools." This effort resulted in a determination that additional criteria beyond these currently established for ensuring safe spent fuel storage were not necessary. In addi-tion, the requirements of 10 CFR Part 72 must be satisfied if a licensee pro-poses to store spent fuel in an independent storage facility separate from the spent fuel pool itself. Concerns with regard to the safe handling of heavy loads at nuclear power plants were the subject of a generic study under Generic Technical Activit{' Control ofA-36 during the late 1970s. This study resulted in publication of NUREG-0612, Heavy Loads at Nuclear Power Plants," dated July 1980, and issuance of a generic letter, dated December 22, 1980. The generic letter requested all licensees to implement improvements per NUREG-0612 to procedures, training, identification of safe' load paths, and crane and lifting device maintenance and testing in order to reduce the probability of a heavy load drop near spent fuel or safety-related equipment that could lead to an unacceptable release of radioactivity. The staff reviewed and provided a safety evaluation of each licensee's proposed actions to improve heavy loads handling safety. Through the inspection program, the NRC staff performed audits of licensee-identified actions to satisfy the concerns identified in NUREG-0612. Following these reviews, the staff undertook a pilot program to assess the need for implementation of additional NUREG-0612 guide-lines. Based on the pilot program, the staff determined that further actions recommended in NUREG-0612, which included the installation of single-f ailure-proof cranes and performance of load drop analyses, were not necessary. This 9-3

conclusion was described in Generic Letter 85-11, dated June 28, 1985, wherein it was determined that actions already completed by licensees have satisfactorily reduced the probability of unacceptable heavy load drops. Since the THI-2 accident, the staff has begun in a systematic manner to review the capability of nuclear power plants to cope with beyond design basis (severe) accidents. This effort has relied largely on probabilistic risk assessment techniques. A major objective of these reviews was to identify potential plant vulnerabilities and take corrective actions accordingly. These reviews have shown that auxiliary and support systems can be dominant contributors to risk, and attention to their continued proper operation is important to plant safety. Future licensee activities requested by the staff as part of the Individual Plant Examination (IPE) and Individual Plant Examination of External Events (IPEEE) will include a focus on auxiliary systems and their contribution to plant safety. Licensee responses to the IPE and IPEEE will be provided in the near future. 9.4 ' Conclusions In summary, auxiliary systems at all operating reactors meet the applicable Commission requirements for ensuring their safety function. Compliance with these regulations will be maintained at all times during operation, including during any renewal period. The continuous staff review of events and operating experience and research has led, where necessary to safety, to issuance of new criteria and implementation of improvements in a number of auxiliary systems areas over the years,-including service water systems (GL 89-13), instrument air systems (GL 88-14), post-accident sampling (NUREG-0737, Item.II.B.3), fire pro-tection (10'CFR 50.48 and Appendix R to 10 CFR Part 50), spent fuel storage (generic letter dated April 14, 1978), and heavy loads handling (NUREG-0 C ). This continuing process coupled with future licensee efforts under the IPE and IPEEE will ensure that as new information suggests, additional criteria are implemented using existing regulatory programs, as appropriate, to ensure the continued health and safety of the public. i 1 94 f

t 10. STEAM AND POWER CONVERSION SYSTEM 10.1 Scope The steam and power conversion system consists of those balance-of plant systems necessary to provide feedwater to the reactor in BWRs and steam generators in PWRs in order to produce the main steam supply to the turbine for generating - power as part of the normal operating function of the nuclear power plant. With the exception of system piping interfaces to the primary (in BWRs) and secondary pressure boundary (in PWRs), these systems have no safety function and are not i relied on to ensure a safe post-accident shutdown with one exception. The aux-iliary feedwater system in PWR plants has an important post-accident and tran-sient decay heat removal safety function and is discussed below. 10.2 Safety Issues and Regulatory Requirements - The Commission regulations require that the reactor coolant pressure boundary have an extremely low probability of abnormal leakage, of rapidly propagating failure, and of gross rupture under operating, maintenance, testing, and post-ulated accident conditions. These requirements pertain to the steam and power conversion system in PWRs because control of the secondary water chemistry and inservice inspection to technical specification limits are essential to ensuring steam generator tube integrity and preventing unacceptable primary coolant leak-age into the secondary (steam) system.- In addition,-the regulations require that nuclear power plants have a system to remove residual heat following accidents and transients and specify design requirements for the system. In PWRs, the auxiliary feedwater system provides this function for most events, except postulated large reactor coolant piping i failures. t 10.3 Evolution of Current Licensina Basis The 1979 accident at Three Mile Island Unit 2 heightened the NRC staff's awareness of the importance of the post-accident decay heat removal safety function provided by the auxiliary feedwater system. Improper isolation of the. auxiliary feedwater flow path at TMI-2 delayed the initiation of decay heat removal through the steam generators. This resulted in implementation of Items II.E.1.1 and II.E.1.2 of NUREG-0737, which required upgrades to the auxiliary feedwater system in all PWR plants to improve its reliability. The specific improvements were identified in NUREG-0611 and -0635 and included chan0es in system design, including initiation and flow indication, operating procedures, and technical specifications. The staff reviewed licensee responses to this item and provided a safety evaluation for each plant. -Despite the improvements obtained by the above effort, concern with auxiliary feedwater system reliability remained. This concern grew out of the review of auxiliary feedwater system reliability studies and continued failures noted from operating experience data reviews. The specific concern was that the availabil-ity of an auxiliary feedwater system with two pumps was not sufficient to ensure the secondary decay heat removal safety function when compared to that of a 10-1 --=

9 three pump system. This concern was amplified by the loss of all feedwater event at Davis-Besse in June 1985. The issue was pursued by the staff under Generic Issue 124 where those few plants with just two auxiliary feedwater pumps were evaluated to determine the need to make further hardware changes to improve their auxiliary feedwater system reliability. GI-124 was ultimately resolved with a requirement that two pump auxiliary feedwater system plants backfit a third means of removing decay heat through the steam generators. Those few licensees affected by this decision have committed to implement this additional improvement for ensuring the auxiliary feedwater system safety function. In addition to the above, while the remaining portions of the power and conver-sion system do not perform a direct function in ensuring post-accident plant safety, events involving balance-of plant systems have resulted in the recogni-tion by the staff that certain improvements in order to ensure the safety func-tion of interfacing systems, or reduce the likelihood of unanticipated plant trips, were necessary. Two such areas of improvement include erosion / corrosion and waterhammer prevention. In the 1970s, waterhammer events in main feedwater systems at several PWR plants including Indian Point Unit 2, Calvert Cliffs, and others demonstrated the need for hardware improvements in order to reduce the chance of breaching the secondary side of the steam generator. The staff evaluated this issue under Unresolved Safety Issue A-1. As a result of this effort, PWas have installed J-tubes on the feedwater ring header within the steam generator to reduce the likelihood of-steam void formation in the feedwater line and potential water-hammer from collapse of the steam bubble on auxiliary feedwater system initia-tion. These actions have been effective at reducing the probability of damaging waterhammer. The feedwater line break event at Surry Unit 2 in December 1986 pointed out the adverse consequences to plant safety from unplanned reactor trips due to balance-of plant failures and to personnel from high energy system steam releases. As a result, the staff issued Bulletin 87-01, which requested that all licensees examine plant piping for wall thinning and take corrective action as necessary. .A subsequent audit of licensee actions against Bulletin-87-01 indicated that-continued programs to monitor for future erosion / corrosion were not in place at the plants. Therefore, the staff issued Generic Letter 89-08, which requested licensees to implement a continuous monitoring program to detect unacceptable pipe wall thinning.and certify that the program is in place. These programs provide the necessary assurance against the type of severe wall-thinning event that challenges plant safety systems. Through the inspection program, the staff audits licensee actions to ensure that adequate implementation has been under-taken. As a result of steam generator. tube degradation and leakage problems at many PWR plants in the 1970s, PWR licensees, NSSS vendors, and the NRC staff initiated studies to improve steam generator tube integrity. One major early outcome of these studies was a recognition that typical secondary water chemistry programs that included sodium phosphate were potentially contributing to the tube degra-dation being experienced. As a result, HSSS vendors recommended a change to an all volatile treatment (AVT) secondary water chemistry program utilizing ammonia and hydrazine. Licensees have adopted this change, and subsequent operating 10-2

i experience has indicated that it has been effective in improving steam generator j tube integrity. Steam generator tube integrity was also designated an unresolved safety issue (VSI) by the NRC staff in 1978 and Task Action Pla'is (TAPS) A-3, A-4, and A-5 were established to evaluate the safety significance of degradation in Westinghouse, Combustien Engineering, and Babcock and Wilcox steam generators, respectively. These studies were later combined into one effort because many of the problems being experienced by these plants were similar. The staff prepared a draft USI report regarding this issue, which primarily considered corrosion-related failure mechanisms, including the " denting" mechanism, since those fail-ures were the main concern during the period when most of the technical studies were performed. In May 1982: s':bsequent to the Ginna steam generator tube rupture (SGTR) event, the r, toff initiated an integrated program to consider the lessons 1carr.cd (1) i from the Ginna SGTR event, (2) from the three previous domestic SGTR events, and l (3) to consider the recommendations in the draft USI report. The objective of l th integrated program was to complete resolution of USIs A-3, A-4, and A-5 and I deterrine the need for further requirements to improve steam generator tube iniegrity. Concurrent with the completion of the staff study under USIs A-3,' A-4, and A-5, in 1985, the NRC staff issued Generic Letter 85-02, which requested all PWR licentees to describe their programs, including secondary water chemistry con-trol, for ensuring steam generator tube integrity. The NRC staff reviewed these programs and accepted them with necessary changes made by licensees. The results of the NRC staff integrated program for resolution of USIs A-3, A-4, a1d A-5 were ultimately documented in NUREG-0844, "NRC Integrated Program for tue Resolution of Unresolved Safety Issues A-3, A-4 and A-5 regarding Steam Gen-erator Tube Integrity," September 1988. In NUREG-08A4, the NRC staff concluded that sufficient regulatory requirements were in place, in conjunction with industry initiatives, to ensure that SGTRs do not contribute significantly to nuclear power plant risk, and thus, no further regulatory requirements were necessary, 10.4 Conclusions In summary, those portions of the steam and power conversion at all operating reactors performing essential safety functions meet current Commission require-ments. Compliance with the Commission requirements will be maintained at all times during operation, including during any renewal period. The TMI-2 accident led to significant improvements in the availability and reliability of the aux-iliary feedwater system, which is the portion of-the steam and power conversion system providing a decay heat removal safety function in PWRs. Events at other plants in balance-of plant systems led to improvements to reduce the likelihood of damaging waterhammer and unanticipated plant trips due to errosion/ corrosion of piping. These improvements will remain in place to provide continued -lant protection. Further requirements as needed will be imposed, as appropriate, based on the continuous review of operating experience and research in order to ensure the continued health and safety of the public. I 10-3

11. RADI0 ACTIVE WASTE MANAGEMENT SYSTEMS 11.1 Scope ] Radioactive waste management systems are provided to control releases of radioactive materials to the environment,in liquid and airborne effluents and to handle radioactive s0Hd wastes produced during normal reactor operation. Process and effluent radiological nenitoring rad sampling systems are provided for monitoring effluent discharge paths for radioactivity that may be released from normal operations and from postulated accidents. Radioactive liquid and solid waste management systems are relatively independent of the type of plant; however, radioacM ve gaseous waste management systems at BWRs are significantly different from those at N".s. 11.2 Safety Issues and Regulatory Requirements The Commission regulations provide limitations and other requirements governing the radioactivity in effluents released to unrestricted areas for the purpose i of providing protection against ti.. hazards of radiation for normal plant oper-ation. These regulations (1) providt requirements regarding the characteristics of radioactive waste prepared ared packaged for transfer to offsite disposal sites, (2) provide design objectives for equipment to control releases of radio-active materials in effluents and (3) require technical specifications to keep releasesofradioactivematerIalstour,restrictedareasduringnormaloperations as low as is reasonable achievable. i Furthermore, the Commission regulations require that (1) the plant design include means to suitably control the r+1 ease of radioactive materials in gaseous and liquid effluents and to handle ridioactive solid wastes produced during normal operations, including anticin teu operational occurrences; (2) radioactive waste systems be designed to ensure adequate safety under normal and postulated acci-dent conditions; and (3) means be provided for monitoring effluent discharge paths for radioactivity that may be released from normal operations, including anticipated operational occurrences, and from postulated accidents. 11.3 Evolution of Current Licensing Basis Significant changes to the regulations gcVerning radioactive waste management systems occurred with the establishment of 10 CFR Part 50, Appendix I, in 1975 and 10 CFR Part 20, S20.311, and 10 CFR Part 61 in 1982s Appendix I was issued because the NRC recognized that specific numerical criteria were necessary to ensure that licensees were maintaining radioactivity levels within normal efflu-ent releases to as low as reasonably achievsble limits as required by 10 CFR Part 20. The technical specifications established under 10 CFR Part 50,650.36a(" Appendix I technical specifications") for all plants are intended to ensure that radio-active waste processing operations are conducted within specific limits. These technical specifications provide limiting conditions for operation and surveil-lance requirements regarding (1) operation of the liquid and gaseous radwaste 11-1

treatment systems, (2) radioactive materials in liquid and gaseous effluots, (3) offsite doses due to radioactive materials in liquid and gaseous effluents, (4) total offsite doses, (5) rac.iological environmental monitoring, (6) content of liquid and gaseous waste storage tanks, (7) explosive mixtures in gaseous radwastes management systems, and (8) processing of solid radioactive wastes. Subsequent experience and problems with the acceptability of solid waste packages from commercial nuclear power plants intended for burial at licensed offsite facilities resulted in issuance of 10 CFR Part 20 recuirements to more closely control transfers of radioactive waste intended for cisposal at a licensed land disposal facility. These problems included excessive amounts of water in solid waste packages and overly rapid deterioration of the waste form itself. Under 520.311, licensees are required to (1) prepare all solid wastes so that they can be classified according to 10 CFR Pert 61,561.55,(2) meet the waste character-istic requirements of 10 CFR Part 61, 661.56, and (3) conduct a quality control program to ensure compliance with 5561.55 and 61.56. These requirements are intended to ensure that future solid waste packages from all plants will be acceptable for buriel at storage facilities and will maintain their long-term integrity. Additional generic requirements that have evolved governing radioactive waste management syt,tems are as follows. NUREG-0737, " Clarification of TMI Action Plan Requirements," Item II.F.1, issued in November 1980, provided new generic requirements regarding additional monitoring and sampling, and analysis of post-accident releases of radioactive materials. These requirements resulted because of weaknesses noted at THI-2 in this area following the THI-2 accident. In the early 1980s, uncertainty arose with regard to future availability of low-level waste disposal capacity at the iicensed burial sites. This concern resulted in issuance of GL 81-38, " Storage of low-Level Radioactive Wastes at Power Reactor Sites," dated November 10, 1981, which provided generic guidance to be used by licensees in the design, construction, and operation of such onsite storage facilities. This guidance continues to be used by licenseec to usure proper storage of low-level waste at nuclear power plants. 11.4 Conclusions In summary, the radioactive waste management systems at all existing operating reactors meet the existing Commission requirements. Compliance with these requirements will be maintained at all times during operation, including any renewal period. As new information occurs as a result of plant events or i research this information is routinely reviewed by the staff to determine if newordIfferentrequirementsareneededinthisarea. If new or different requirements are needed, the staff has the capability within existing regulatory programs to require improvements, if needed, to onsure the continued health and safety of the public. 11-2

J 12. RADIATION PROTECTION ] 12.1 Scope General standards are provided for the protection of the individual from radia-tion hazards associated with activities licensed by the NRC. This section will discuss the different control strategies in place to limit the exposure of I l occupationel workers and the general public to ionizing radiation. l 1 L 12.2 Safety Issues and Regulatory Requirements 1 The Commission regulations provide standards for the protection of licensees, l their employees, and the general public against the radiation hazards arising out of the possession or use of special nuclear, source, or byproduct material under license issued by the NRC. Certain precautionary procedures and adminis-trative controls are provided to ensure that the evaluation of these radiation hazards are adequate and that the resulting radiation doses are kept as low as is reasonably achievable (ALARA). Different limits and controls are provided ? for occupationally exposed individuals and members of the general public. 12.2.1 Occupational Exposures 10 CFR Part 20 prescribes dose limits that govern the exposure of personnel to radiation from sources external to the body. In addition,-limits on the quan-tities of radioactive material taken into the body through inhalation or absorp-tion are provided to control the doses to individual organs and tissues from internal sources. 10 CFR Part 19, paragraph 19.12, prescribes that plant workers be informed of the radiation hazards to which they are subjt.:ted and be instructed in the pur-pose and function of radiation protection 6 vices and controls that they must i observe. 12.2.2 Cxposures to the General Public 10 CFR Part 20 provides controls for radiation exposure to the general public by providing limits on the radiat'on levels that can exist in areas not con-trolled by the-licensee, concentrations of radioactive material that may be discharged from the facility in gaseous and liquid form, and the transportation and disposal of radioactive wastes, j In addition to the limits of 10 CFR Part 20 that apply to all NRC licensees, design specifications and operating requirements are provided in 10 CFR Part 50, Appendix I, to ensure that each power reactor licensee operates their facility such that the quantities of radioactive materials released to the-environment in gaseous and liquid effluents are maintained ALARA. .Also NRC licensees are subject to regulations promulgated by other agencies. 40 CFR Part 190, issued by the Environmental Protection Agency (EPA), provides limitations on the dose to members of the public from facilities in the uranium 12-1

fuel cycle (including those licensed by the NRC). The Department of Transporta-tion (DOT) provides requirements for the shipment of radioactive materials in Title 49 to the Code of Federal Regulations (49 CFR). 12.3 Evolution of Current Licensino Basis The adoption of 10 CFR Part 20 in 1957 established the basic framework currently employed for the protection of licensee personnel aid the public from exposure to radiation. Extensive changes to the dose limits and the permissible concen-trations of radioactive material in air and water, contained in Part 20, were adopted in 1960. These dose limits and permissible concentrations were based on the latest scientific knowledge of the time on the biological effects of radiation exposure. An assumption basic to the radiation protection methods used in 10 CFR Part 20 is that any exposute to ionizing radiation results in a proportional health risk and that there should be no radiation exposure without a commensurate benefit. From 1970 to 1975 the Commission undertook a series of rule changes to improve the framework in 10 CFR Part 20 for ensuring that reasonable efforts are made to keep exposures to radiation, and releases of radioactivity in effluents ALARA and to specify design and operating requirements in 10 CFR Part 50, Appendix I, to restrict quantities of radioactive materials released in gaseous and liquid effluents from light water reactors (LWRs). The dose criteria specified in Appendix I to Part 50 correspond to continuous effluent releases that are a small fraction of the concentration limits in 10 CFR Part 20. Licensees were required to implement technical specifications to ensure plant operations within the Appendix I requirements. In 1981 the Commission amended Part 20 to incorpo nte the EPA require %nts in 40 CFR Part 190, " Environmental Radiation Protection Standards for Naclear Power Operations." 40 CFR Part 190 provides that LWRs be operated so that releases of radioactive material and the resulting radiation dosed to the public are be-low specified limits. These dose limits are comparable to, and in some cases morerestrictivethan,thedoseobjectivesandoperatingconditionscontained in 10 CFR Part 50, Appendix 1. In 1983, 10 CFR Part 20, 9 20.311, was adopted to establish administration pro-cedures and recordkeeping requirements to support the licensing requirements for land disposal of radioactive wastes contained in 10 CFR Part 61. The waste manifests, specified in S 20.311, document that radioactive wastes are properly classified, described, packaged, marked, and labeled and are in proper condition for transportation according to the applicable 00T regulations, During the licensing process, pursuant to 10 CFR Part 50, S 50.34,bes thethe appli-cant must submit a Final Safety Analysis Report (FSAR) that descri facility, 'ne kinds and quantities of radicsctive materials expected to be pro-duced, and t!'e means for controlling and limiting radioactive effluents and radiation exposures within the limits of 10 CFR Part 20. Additional design criteria are provided in Appendix A to 10 CFR Part 50 governing the radioactive exposure to plant operators under accident conditions, the expo-l sure to radiation during fuel handling and storage, and the adequate monitoring l of radioactive concentrations in plant effluents and radiation levels in plant environs during normal operations and postulated accidents. 12-2

4 i Prior to granting a license, the staff reviews the FSAR against established acceptance criteria and concluu that the facility design, and the radiological controls proposed, are adequat', and that the facility can be operated within all applicable limits and radi. tion exposures will be maintained ALARA. The NRC inspection program ensures that each licensee adequately implements the radiation protection controls described in their FSAR and incorporated in their technical specifications. The performance of each licensee's radiation protec-tion program is inspected by the NRC resident inspectors on a weekly basis, by region-based specialists routinely, and by teams of specialists whenever deemed necessary. When deficiencies are noted, the licensee is required to modify its program or implement additional controls as corrective action. An example of this is the finding from the 1980-1981 Health Physics Appraisal Team inspections that efforts at maintaining occupational radiation exposure ALARA lacked licensee support. Subsequently, each licensee implemented additional programs to ensure occupational exposures are maintained ALARA. Plant operating events also provide new information that may require changes to a plant's licensing bases. Two examples are the serious exposure of plant work-ers during a fuel transfer operation in 1978 and the radiation protection expe-riences during the 1979 accident at Three Mile Island. In both cases, each LWR licensee was required to reanalyze its plant design and make appropriate modifi-cations to ensure adequate protecti" to workers during spent fuel transfer oper-ations or during anticipated acciden; situations. In addition, the TMI accident indicated a need throughout the industry to improve accident assessment and mon-itoring capabilities related to potential radioactive releases offsite during an accident. Upgrades in radiation protection during fuel handling operations were made at all operating reactor licensees as a required response to Bulletin 78-08, " Radiation Levels from Fuel Element Transfer Tubes," dated June 12, 1978. Improvements in radiation protection programs to protect workers during a poten-tial plant accident were contained in NUREG-0660 and NVREG-0737 and the implementation at each plant was subsequently required by Commission order. Advances in the scientific and technical knowledge of radiobiology and the risks associated with radiation exposure have been made since the current limits in Part 20 were adopted in 1960. The current recommendations of the International Commission on Radiological Protection (ICRP) provide a radiation protection framework,that relates the risks of nonuniform irradiation to individual tissues and organs from internally deposited radionuclides to the risk of uniform irra-diation of the total body. This method differs from the current standards in 10 CFR Part 20, which limit internal and external exposures separately. The Commission staff has reviewed the ICRP recommendations and has concluded that the framework more firmly establishes health risk as the basis for radia-tion protection than was evident for the current standards. The Commission is currently engaged in a rulemaking proceeding to revise Part 20 to be consistent with these international recommendations and practicos, even though the standards in the current Part 20, in concert with the ALARA programs implemented at LWRs, result in doses generally far below the limits specified in the proposed revi-sion. Thus, revising the limits in Part 20 will have little impact on reactor licensees. For example, limiting the sum of the dose from internally deposited radioactivity and the dose from external sources will not be a significant impact for LWRs since engineering and administrative controls, already required, generally reduce the intake of radioactive material to insignificant levels. If 12-3

approved by the Commission, all NRC licensees will be required to change their programs to implement the radiation protection strategy provided by the revised 10 CFR Part 20. As additional scientific findings become available such as thoserecentlypublishedbytheNationalAcademyofSciencesintheIrBEIRV report, the Commission will consider their significance and make changes to its rules and regulations as appropriate. 12.4 Conclusions The current standards in 10 CFR Part 19, 10 CFR Part 20, and 10 CFR Part 50 provide an adequate basis for the protection of workers and the general public from the radiation hazards associated with nuclear power plants licensed by the NRC. The Commission staff has identified a need to revise 10 CFR Part 20 to incorporate a different radiation protection framework that is consistent with current international recommendations and practices. If approved by the Commis-sion, all licensees will be required to change their programs to implement this new radiatien protection strategy. As new information occurs as a result of research or plant events, this information is reviewed by the staff, through the processes described earlier, to determine if new or different requirements in this area are needed. If it is determined that new or different requirements are needed, the staff has the capability within existing regulatory programs to require additional analyses or plant modifications, as needed, to ensure the continued health and safety of the public. I l l l l 12-4

1 i l 1 13. CONOUCT OF OPERATIONS The following sections discuss a number of sub1ect areas that generally affect theconductofoperationsaroundoperatingfaellities. Thesesubjectareas include discussions of the management, operations and te ization* training programs; emergency planning; IIcensee'chnical support organ-s self-assessment capabilities;plantprocedures;andphysicalsecurity. 13.1 Management, Operations, and Technical Support Organizations i 13.1.1 Scope During the licensing of an operating management and support organizations. plant, the staff reviews the licensee's l This particular review area is limited to ensuring that corporate management is involved with, informed about, and dedicated to the safe design, test and operation of the plant; that there are i sufficienttechnicalresourcesavallabletoensureplantoperationalsafety; and that the structure, functions, and responsibilities of the licensee's onsite organization are acceptably defined. 13.1.2 Safety Issues and Regulatory Requirements Commission regulations require that a licensee must be technic;.lly qualified to operate the plant before a license can be granted and that provisions relating to organization and management be included in the administrative controls sec-tion of the plant technical specifications. The regulations also describe licensed operator requirements during operation of a facility. The TMI Action Plan (NUREG-0737) also describes specific requirements with respect to the responsibility of both the shift supervisor and shift technical advisor. 13.1.3 Evolution of Current Licensing Basis In general the safety evaluation report or its supplements contain descriptions of the management, o)erations, and technical-support organizations for each fa-cility at the time tie' license was issued. A licensee's management, operations, and technical support organizations continually change during the term of the l license. Changes to the management, operations and t tionaremonitoredthroughoutthetermofthelicense,echnicalsupportorganiza-and new criteria are i applied, if applicable. l 10 CFR Part 50.71(e) requires each licensee to periodically update the Final Safety Analysis Report (FSAR) for their facility. The FSAR contains information l with respect to the management, operations, and technical support organizations. L If changes are made to provisions relating to management and organization that areinthetechnicalspecifications,thedommissionreviewsandapprovesthese changes. Thereby, the Commission is continually updated on the licensee's management and technical support organizations at each facility. The management, operations, and technical support organizations at each facility are evaluated continually. The Commission, on a continuing basis, interacts l 13-1 1

with the licensee through the evaluation of reportable events, license changes, 10 CFR Part 50.59 changes, the L,ommission resident inspector program and spe-cial inspections. TheseactivitiesprovideinsightintothecapabilItyofthe technical support organization for the facility. The integration of all these interfaces with the licensea provides a continual evaluation of the management, operations, and technical support organization at each facility. 13.1.4 Conclusions When a license is granted,.the licenseo must be technically qualified to engage in the activities authorized by the license and remain so for the term of the license, including any renewal term. Reviews and approval of technical specifi-cation changes, interactions with the staff, and the inspection program p mvide the Commission with a continuing evaluation of the licensee's management, oper-ations, and technical support organizations. If new information occurs which dictates that new or different requirements should be implemented, the staff has the authority under existing regulatory programs to require plant changes to ensure the continued safe operation of the plant. 13.2 Training 13.2.1 Scope This section describes information relating to the operational training and licensed operator recualificat'on orograms of the plant. The purpose of these programs is to provice assurance t1at the licensee will adequately train a staff to safely operate the plant and, thereby, protect the public health and safety. 13.2.2 Safety Issues and Regulatory Requirements Commission regulations require that licensees provide training and instruction to individuals who manipulate the controls of a facility or direct any licensed activity of a licensed individual and provide information concerning organiza-tional structure, personnel qualifications, and related matters to ensure that proper administrative and managerial controls are in place to ensure safe operation. 13.2.3 Evolution of Current Licensing Basis Following the accident at Three Mile Island Unit 2 (TMI-2), the NRC emphasized the need to up' grade training and qualifications of nuclear power plant person-nel. In the NRC Action Plan Developed as a Result of the TM1-2 Accident" (NUREG-0660, July 1980), the NRC cited its ongoing study of accreditation of training as a possible means of upgrading training programs in the industry. In the " Clarification of TMI Action Plan Requirements" (NUREG-0737, November 1980), the NRC cited interim procedures to improve training programs and to upgrade the qualifications of personnel prior to accreditation of the facility training progrlms. Since that time, the Institute of Nuclear Power Operations (INPO), with i:s associated National Academy for Nuclear Power Operations (Academy), has developed a training accreditation program that the NRC has found to be an acceptable means of self-improvement of training. 13-2

) On March 20, 1985, the Commission published its policy statement on training and qualification of nuclear power plant personnel allowing the industry a min-imum of two years of accreditation activity without the introduction of new NRC training regulations. In the policy statement, the Commission further endorsed the training accreditation program managed by INPO, as it encompasses the elements of effective performance-based training and provides the basis to ensure that personnel have qualifications commensurate with the performance requirements of their jobs, and recognized the accreditation of 10 utility training programs. On November 18, 1988, the Commission published a revised policy statement that reflected the minor modifications made by the Academy to its accreditation pro-l gram and the NRC staff to the methods by which it monitors the industry training l programs. Specifically, the amendments of the revised policy statement are: (1) recognition of the establishment of an eleventh accredited training program; L (2) NRC staff will monitor the industry training programs and training program results by conducting post-accreditation reviews and (3) NRC will conduct in-cordance with the Commission'y, and take appropriate enforcement action in a spections, as deemed necessar s enforcement solicy in 10 CFR Part 2 Appendix C, g when regulatory requirements are not met. iowever, the Commission s policy has e been successfully challenged [Public Citizens v. U.S. NRC No. 89-1017 - 0.C. Circuit April 17,1990]. The Commission has this matter under consideration. To ensure that the nuclear industry's training program improvements are effec-tive, the NRC monitors the accreditation process and its results by attending and observing Accreditation Board meetings, observing training accreditation team visits, conducting operator licensing and requalification exams, and con-ducting performance-oriented training inspections to assess the level of knowledge of plant personnel. 13.2.4 Conclusions 10 CFR 50.34 and 10 CFR Nrt 55 establish the requirements for the development - and implementation of training and requalification programs for facility person-nel to prevent or mitigate the consequences of postulated accidents that could cause undue risk to the health and safety of the public. The Commission believes that an effectively implemented accredited training program is an essential foundation in the continued safe operation of nuclear power facilities. The Commission has reviewed the INP0 training accreditation program and found it to be an acceptable means of self-improvement of training. The INP0 training accreditation program requires the modification of accredited programs based on periodic evaluation of existing plant and training materials and task lists, and feedback from plant personnel concerning the training materials and task lists. ins modification of training materials and task lists ensures that the training provided accurately reflects the current job requirements. To ensure the con-tinued effectiveness and implementation of a licensee's training programs the a NRCmonitorstheaccreditationprocessanditsresults,observesINP0 training accreditation team visits, conducts operator licensing and requalification exams, and conducts performance-oriented training inspections. Under 10 CFR 50.54(a), changes to relax or reduce previous training commitments must receive Commission approval before a licensee can implement the change. As new information is ob-tained as a result of plants events or research, this information is reviewed by the staff to determine if new or different requirements are needed. If it is determined that new or different requirements are needed, the staff has the 13-3

capability to require additional improvements to ensure the continued health and safety of the public. 13.3 Emergency Plannina 13.3.1 Scope This section discusses the requirement that reactor licensees develop and implement emergency plans to ensure the continued protection of the public health and safety in the event of a radiological accident. 13.3.2 Safety Issues and Regulatory Requirements Prior to the issuance of a full power operating license, the emergency planning regulations require a finding that there is reasonable assurance that edequate protective measures can and will be taken in the event of a radiological emer-gency. The regulations were adopted as an added conservatism to the defense-in-depth philosophy. They differ in character from most of the NRC's siting and engineering design requirements which are directed at achieving or maintaining a minimum level of public safety protection. 13.3.3 Evolution of Current Licensing Basis 13.3.3.1 Onsite Emergency Planning In June 1979, NRC began a formal consideration of the role of emergency planning for ensuring the continued protection of the public health and safety in areas around nuclear power plant facilities. A final rule, effective November 3, 1980, was published in the Federal Register on August 19, 1980 (45 FR 55402). It pro-vides that an initial operating license will not be granted unless NRC can make a favorable finding that the integration of onsite and offsite emergency planning provides reasonable assurance that adequate protective measures can and will be taken in the event of a radiological emergency. NRC will base its finding on a review of Federal Emergency Management Agency (FEMA) findings and determinations as to whether State and local emergency plans are adequate and capable of being implemented, and on the NRC assessment as to whether the applicant's onsite emer-gency plans are adequate and capable of being implemented. In the case of an operating reactor, if it is determined that there are such deficiencies that a favorable NRC finding is not warranted, and if the deficiencies are not corrected within four months of that determination, the Commission will determine expedi-tiously whether the reactor should shut down or whether some other enforcement action is appropriate. In any case, where the Commission believes that the pub-lic health, safety, or interest so requires, the plant will be required to shut down immediately. Licensees, however, will have an opportunity to demonstrate to the satisfaction of the Commission, for example, that deficiencies in emer-gency plans are not significant for'the plant in question, that adequate interim compensating actions have been or will be taken promptly, or that there are compelling reasons to permit plant operation. The 1980 rule required that emergency planning considerations be extended to emergency planning zones and that these consist of an area of about 10 miles in radius for exposure to the radioactive plume that might result from an acci-dent in a nuclear power reactor and an area of about 50 miles in radius for food that might become contaminated.- Additionally, the final rule sets forth 13-4

16 emergency planning standards that must be met by onsite, State, and local emergency plans within the emergency planning zones. 13.3.3.2 Offsite Emergency Planning Section 109 of the NRC FY 1980 Authorization Bill (PL 96-295) required that NRC consult with the Director of the Federal Emergency Management Agency (FEMA) on 4 the status of State radiological emergency response plans with respect to the issuance 8 an operating license for a reactor facility. In response, FEMA issued a rule concerning review and approval of State radio-logical emergency plans and preparedness (44 CFR Part 350, September 28,1983). This rule established policy and procedures for review and approval by FEMA of State emergency plans and prep' redness for coping with the offsite effects of radiological emergencies that m Nht occur at nuclear power facilities. The rule sets out criteria that are used by FEMA in reviewing, assessing, and eval-uating the plans and preparedness

• it specifies how and where a State may sub-i mitplans;anditdescribescertaInoftheprocessesbywhichFEMAmakesfind-ihss and determinations as to the adequacy of State plans and the capability of State and local governments to implement these plans and preparedness measures.

Such findings and determinations are to be submitted to the Governors of affected States and to NRC for use in its licensing proceedings. 13.3.3.3 Current Program I As experience was gained in the implementation of the revised onsite and offsite emergency plans by both the licensees and the State and local governments, revi-sions to the regulations were deemed appropriate. For example, the 1980 regula-tions required that the licensees and State and local governments within the 10-mile plume exposure pathway emergency planning zone conduct an annual, full-1 l participation exercise. After considering the experience gained by all of the participants in these annual-exercises, the Commission proposed, and then adopted l i in 1984 a change to a biennial full participation exercise. The revised rule continued to require an annual onsite exercise for licensees, required State and local governments to participate every 2 years with a provision for remedial ex-i ercises to ensure that any deficiencies are corrected, and provided the opportun-ity for State and local government participation in the annual licensee exercise, i if desired. The rationale behind the change was that (1) experience in observing and evaluating over 150 exercises had shown a disproportionate amount of Federal, .j State, and local government resources were being expended to conduct and evaluate the annual exercises, (2) State and local governments respond to a variety of actual emergencies on a continuing basis, thus exercising their emergency pre-paredness capabilities, and (3) the flexibility provided for in a biennial fre-l quency would provide an incentive for State and local governments to perform in I a satisfactory manner in order to avoid conducting remedial exercises. In order to ensure that emergency preparedness around licensed nuclear facilities continues to reflect current conditions and circumstances, licensees are permit-ted to make changes to emergency plans without NRC approval if those changes do not decrease the effectiveness of these plans, and the plans, as changed, con-tinue to meet the standards of 10 CFR 50.47(b) and the requirements of 10 CFR Part 50, Appendix E. Changes made without approval must be reported within 30 days after the changes are made. Proposed changes that decrease the effective-ness of the approved plans may not be implemented without application to and 13-5 j u

approval by the NRC. This requirement is found in 10 CFR 50.54(q) of the regulations. As required by 10 CFR 50.47(b)(8), licensees are to provide and maintain adequate emergency facilities and equipment. To satisfy this requirement, licensees must inspect and perform operability checks of emergency equipment and instruments at frequent intervals throughout the year. In addition, the NRC performs an annual inspection of the licensee's program and equipment to ensure that essential emergency facilities, equipment, instrumentation, and supplies are being maintained in a state of operational readiness. Based on the above discussion, the staff does not believe that equipment used in assur-ing the effectivaness of the emergency preparedness program needs to be evaluated as part of the plant assessment of aging degradation required by the new Part 54, 13.3.4 Conclusions 4 Reactor licensees are required to develop and implement emergency plans to ensure the continued protection of the public health and safety in the event of a radiological accident. State and local governments must meet the regulations of the Federal Emergency Management Agency to ensure that their emergency plans and preparedness are sufficient for coping with the offsite effects of radio-logical emergencies that might occur at nuclear )ower facilities. Provisions exist for the review and prior approval of any c1anges to the emergency plans that may decrease the effectiveness of the plans. Furthermore, the NRC rou-tinely inspects-licensee emergency preparedness programs, including required facilities, equipment, instrumentation, and supplies, to ensure that they are e maintained in a state of operational readiness and meet licensee commitments and NRC requirements at all times during plant operation, including any renewal terms. If necessary, the NRC may take enforcement actions including assessment of civil penalties. Finally, the NRC continues to evaluate the adequacy of-its emergency preparedness regulations, and where any new or different require-ments are deemed necessary, they are implemented by rule, order, or other existing regulatory documents. 13.4 Review and Audit 13.4.1 Scope This section discusses the licensee's operational review program. The purpose of this program is to implement the licensee's responsibility-related proposed-changes, test evaluations of unplanned events, and provisions for the evalua-tion of plant operations, 13.4.2 Safety Issues and Regulatory Requirements The Commission regulations require that one of the considerations in granting a license is the technical qualifications of the applicant. NUREG-0737, "Clarifi-cation of TMI Task Action Plan Requirements," describes the requirements for an Independent Safety Engineering Group (ISEG) for post-TMI licensed plants. In addition, the regulations require that certain provisions relating to adminis-trative controls be incorporated into the administrative controls section of the plant-specific technical specifications. 13-6

l 13.4.3 Evaluation of Current Licensing Basis In general, the safety evaluation report for each facility contains a descrip-tion of the operational review program at the time the facility was licensed. A licensee's operational review program is often revised during the term of the license. Changes to the program are monitored by the Commission throughout the term of the license, and new criteria are applied if applicable. 10 CFR Part 50.71(e) requires each licensee to periodically update the Final l Safety Analysis Report (FSAR) for their facility. The FSAR contains a descrip-t tion of the facility operation 11 review program. In addition, the Commission reviews and approves any changus to the operational review program that are in y the facility technical specifications. Thereby, the Commission is periodically updated on the current operational review program at each facility, l The Commission's inspection program provides for periodic evaluation of the i facility operational review program. Inspection Procedure 40500, " Evaluation of Licensee's Self-Assessment Capability," and Inspection Procedure 88005, " Manage-ment Organization and Controls," provide for the periodic inspection and evalua-tion of the facility operational review program. 13.4.4 Conclusions Commission regulations require that one of the considerations in granting a license is the technical qualifications of the applicant to engage in the activities of the license. Reviews and approvals of technical specification changes and the Commission inspection program provide the Commission with a periodic review and evaluation of the licensee's operational review program. 1 13.5 Plant Procedures This section discusses two general categories of procedures: administrative procedures and operating and maintenance procedures. Administrative procedures include (1) those that provide the administrative controis with respect to pro-cedures, and (2) those that define and' provide controls for operational activi-ties of the plant staff. Operating and maintenance procedures are used by the operating organization (plant staff) to ensure that routine operating, off- ) normal, emergency, and maintenance activities are conducted in a safe manner. 13.5.1 Administrative Procedures 13.5.1.1 Safety Issues and Regulatory Requirements The Commission regulations require that one of the considerations in granting a license is the technical qualifications of the applicant to engage in the activ-ities of the license and require that the licensee designate individuals to be responsible-for directing the activities of licensed operators. The-regulations also require provisions relating to administrative controls in the Administrative Controls Section of the Technical Specifications, Further, NUREG-0737, "Clari-fication of TMI Task Action Plan Requirements," describes certain requirements with respect to administrative procedures requirements. 13-7

13.5.1.2 Evolution of Current Licensing Basis The safety evaluation report (SER) and its supplements describe the administra-tive controls program at the time of licensing of the facility. The administra-tive controls ielate to, in part, procedures and programs and to designating individuals to be responsible for directing the activities of licensed operators. A licensee's procedures and program for the control of procedures may change during the term of the license. Changes to these procedures and programs are monitored during the term of the license and new criteria applied if applicable. 10 CFR Part 50.71(e) requires each licensee to periodically update the Final Safety Analysis Report (FSAR) for their facility. The FSAR contains the admin-istrative controls program for procedures. Changes to the procedures control program that are included in the technical specifications are reviewed and ap-proved by the Commission. Thereby, the Commission is continually aware of the administrative controls program, j i The licensee's administrative controls program at each facility is periodically evaluated through the Commission's inspection prog" ram. In particular, Inspection Procedure 71707, " Operational Safety Verification, and Inspection Procedure theIIcenseesadministrativeprocedurescontrolprogram."ManagementOrganization 88005 13.5.1,3 Conclusions The regulations require that one of the considerations in granting a license is the technical qualifications of the applicant to engage in the activities of the license. Reviews and approvals of technical specification changes and the inspection program provide the Commission with periodic evaluation of the admin-istrative controls program. 13.5.2 Operating and Maintenance Procedures 13.5.2.1 Safety Issues and Regulatory Requirements The regulations applicable to administrative procedures require the detemina-a tion that the licenset. is technically qualified to engage in licensing activi-ties and that the licensee designate individuals to be responsible for direct-ing the licensed activities of licensed operators. ' Commission regulations also govern operating procedures used by licensed operators in the control room and other operating procedures and maintenance procedures. Additionally, the TMI Action Plan (NUREG-0660 and NUREG-0737) requires licensees to upgrade their Emergency Operating Procedures (EOPs). Commission regulations also require that activities affecting quality be prescribed by and accomplished in accordance with documented instructions, procedures, and drawings. 13.5.2.2 -Evolution of Current Licensing Basis Requirements for the commercial nuclear power industry to improve the quality and usability of plant procedures were established as a result of the accident 13-8

i l at Three Mile Island (TMI). Following TMI, the NRC Office of Nucleai Reactor Regulation developed the TMI Action Plan (NOREG-0660 and NUREG-0737) which re-quired licensees of operating reactors to reanalyze transients and accidents and to upgrade E0Ps (Item I.C.1). NUREG-0660 (Item I.C 9) committed the NRC to develop a long-term plan for the overall improvement of nuclear power plant procedures. Requirements for E0Ps were further defined in Generie Letter 82-33. Generic letter 82-33 transmitted Supplement I to NUREG-0737, " Requirements for Emergency Response Capability," and directed each licensee to submit to the NRC a Proce-dures Generation Package (PGP) from which licensees were to develop function or t symptom-based E0Ps. This document also indicated that the NRC staff would audit E0Ps on a selective basis. Early reviews of E0P programs identified potential concerns with their imple-mentation. In response to these findings, the NRC staff conducted inspections to monitor the industry's procedure upgrade programs. Initial inspections re-i vealed a number of problems, and Information Notice 86-64 was issued in August 1986 co alert licensees to these problems. Subsequent inspections revealed sim-ilar results and Information Notice 86-64, Supplement 1, was issued on April 20, 1987, to describe further problems with E0Ps and PGPs and to inform the industry / that the inspection effort would be intensified. NRC Temporary Instruction 2515 92 was issued in April 1988 and defines the objectives of the E0P inspection. The inspection effort now extends to all operating reactors in the United States and has two objectives: (1) to assess the adequacy of the E0Ps themselves, and (2) to establish that the supporting programs and documents are sufficient to ensure the integrity and continued adequacy of the E0Ps. 13.5.2.3 Conclusions A sound procedure revision process will be particularly important if plant l aging accelerates the frequency of maintenance, hardware modifications, and l need for the upgrading of safety systems. The staff has determined that the licensee should have in place an ongoing procedure revision process that en-sures that procedures are technically adequate, comprehensible, and usable. The adequacy of the licensee's procedure revision process sill be verified through regular inspections by the resident inspector, as well as routine and special inspections initiated by the regions. However, as new information oc-curs as a result of plant events or research, this information is routinely reviewed by the staff to determine if new or different requirements are needed in this area. If new or different requ'rements are needed, the staff has tne capability to require additional analyres, as needed, to ensure the continued health and safety of the public. 13.6 Physical Security 13.6.1 Scope This section discusses the evolution of the basis of the reactor security pro-gram. The licensee's security program consists of the following three plans: security, security contingency, and guard training and qualification. These three plans provide the physical protection envelope that provides the assur-ances that.the operation of these plants does not constitute an unreasonable risk to the public health and safety. 13<9

13.6.2 Safety Issues and Regulatory Requirements The Commission regulations require licensees to establish and maintain a physical protection system and security organization that provides high assurance against radiological sabotage. 13.6.3 Evolution of Current Licensing Basis The purpose of nuclear power reactor security requirements is to protect against the design basis threat of radiological sabotage. The design basis threat is generally considered to be the worst-case scenario of attack by several well-trained and dedicated individuals and an individual inside the facility. In 1977, specific requirements of physical protection of licensed nuclear facilities against radiological sabotage were set forth by the NRC in 10 CFR 73.55. In publishing this rule, the Commission stated the following: "The level of protection specified in Part 73.55 is adequate and prudent at this time. The kind and degree of threats will continue to be reviewed by the Commission. Should such reviews show change that would dictate different lev- ) els of protection, the Commission would consider changes to meet the changed conditions (42 FR 10836)." The Commission has since made a number of changes to the requirement to main-tain or increase the level of assurance. In 1978, the Commission issued re-quirementsforasafeguardscontingencyplanandguardtrainingandqualifica-tion plans to be prepared and noted in a facility s license conditions. Sub-sequent changes in Part 73 have required the reporting of physical security events, the protection of unclassified safeguards information, and the " Mis-cellaneous Amendments." Those amendments include a refined vital area access policy, authority to suspend safeguards during safety emergencies, protection .of certain safeguards equipment, and upgrades to key and lock controls. Most 4 recently the regulations have been revised to require that any individual in need of unescorted access at a facility submit to a Federal Bureau of Investi-gation fingerprint' check and chemical testing to determine that they are f i t-f or-duty. These. changes were made to ensure that the level of protection remains adequate considering all new information.and potential threats. In 1989 the Commission requested licensees to include in their safeguards contingency plan procedures for short-term actions to protect against attempted radiological. sabotage in-volving a land vehicle bomb if such a threat were to materialize. i The NRC has conducted Regulatory Effectiveness Reviews (RERs) since 1982 to ensure that safeguards required by NRC's regulations, as implemented by licen-sees, provide the intended level of protection without compromising safety of operations. The RER teams use NRC security personnel and members of the U.S. Army-Special Forces to test plant _ security systems and personnel. Regional' safeguards inspectors continue their routine unannounced and special inspec-tions at all licensed facilities. In addition to continued NRC review of industry-wide conditions, the status of physical security measures are reviewed at each individual plant in the System-atic Assessment of Licensee Performance (SALP) program. Both headquarters and regional safeguards staff provide comments for the " Security" functional' area. i 13-10

Licensee-initiated changes to approved security plans (also contingency and guard training) may only be made by two methods. Changes made purtuant to 10 CFR 50.54(p) may be made without prior Commission approval if the changes do not decrease the safeguards effectiveness of the plan. The changes must be submitted to the Commission within two months and changes are reviewed by the staff. The second method for plan changes involves the amendment process as specified in 10 CFR 50.90 to include reviews by the staff and Federal Register notices soliciting public comment. These changes may involve measures that are not contained in 10 CFR 73.55(b) through (h), but provide the equivalent high assurance against radiological sabotage. Age related degradation of safeguards equipment is not a license renewal issue because it is an issue that is being currently experienced and managed. A num-ber of the originally licensed sites have reached the life expectancy of certain types of security equipment. Because of the general performance objectives and requirements of 10 CFR 73.55(a) and the site-specific commitments contained in the individual plant security plans, normal inspection activities will force the replacement of degraded equipment or subject the licensee to enforcement action. 13.6.4 Conclusions The licensee programs meet all existing Commission requirements relative to physical security at reactor sites. NRC's existing regulatory base, ongoing inspection activities, and continuing re-reviewing of threats, policies, and regulations will provide continued assurance against radiological sabotage. A level of protection will be maintained during the renewal period in the same manner as during the original license term. The requirements of 10 CFR Part 73 will continue to be reviewed and changed, if nr.cessary, to account for new in-formation. Currently there are several safguards rulemaking activities under way, including a site " access authorization rule" for screening of those indivi-duals who require unescorted access to a facility. The above type of regulatory oversight will be present while any facility is subject to the requirements of 10 CFR Part 73, 13-11

~ 14. INITIAL TEST PROGRAM 14.1 Safety Issues and Regulatory Requirements Commission regulations require, in part that an applicant for a license to operateaproductionorutilizationfacIlityincludetheprincipaldesigncri-teria for the propcsed facility in the Safety Analysis Report (SAR). These regulations state that these principal design criteria are to establish the necessary design, fabrication, construction, testing, and performance require-ments for systems, structures, and components important to safety, i.e., systems, structures, and components that provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public. These regulations also require that a test program be established to ensure that systems, structures, and components will perform satisfactorily in service. Since all functions esignated in the General Design Criteria are important to safety, all systems, structures, and components required to perform these functions need to be tested to ensure that they will perform properly. These functions, as noted throughout the specific General Design Criteria, are those necessary to ensure that specified design conditions of the facility are not j exceeded during any condition of normal operation, including anticipated opera-tional occurrences, or as a result of postulated accident conditions. 14.2 Evolution of Current Licensina Basis The NRC safety evaluation report (SER) and supplements describe and attest to the adequacy of the initial test program for each facility at the time the license was issued. Upon completion nf the test program, the results are docu-mented in a final test report subsequent to issuance of an operating license for each facility. The satisfactory completion of the test program provides C surance that the systems, structures and components important to safety will performasdesignedandthatthefaci1Itycanbeoperatedwithoutundueriskto l the health and safety of the public. During the term of the initial license. Commission oversight, regulatory actions, and the implementation of technical specifications provide assurance that the plant continues to meet the current licensing basis. This is sufficient to conclude that the level of safety is also adequate for continued operation during any renewal period. 14.3 Conclusions At the time of the initial licensing for a plant, the applicant provides sufficient information for the staff to conclude that the plant design satisfies the staff acceptance criteria which ensure that the intent of the applicable regulations are met, l'31ng the processes discussed above, the staff has modified the initial licensing basis to ensure not only the continued acceptacility of the licensing basis but also the protection of the health and safety of the pub-lic. As new information continues to occur from plant events, research, or the processes discussed in Section 1 of this report, this information is rout'nely ( evaluated by the staff to determine if new or different requirements are needed 14-1 ~

i in the specific area. If new or different requirements are needed, the staff has the capability with existing regulatory programs to require additional analy-ses or plant modifications, as necessary, to ensure the continued health and safety of the public and the acceptability of the plant licensing basis. l i-14-2

15. ACCIDENT ANALYSES 15.1 Scope This section addresses the analyses of the response of the plant to postulated disturbances in process variables and to postulated malfunctions or failures of equipment. Such safety analyses provide a significant contribution to the selec-tion of limiting conditions of operation, limiting safety system settings, and design specifications for components and systems from the standpoint of public health and safety. Also, the effects of anticipated process disturbances and postulated component failures are examined to determine their consequences and to evaluate the capability built into the plant to control or accommodate such failures and situations. The situations analyzed include anticipated operational l occurrences (e.g., a loss of electrical load resulting from a line fault), off-design transients that include a small amount of fuel failures, and postulated accidents of low probability (e.g., the sudden loss of integrity of reactor cool-ant pressure boundary). The analyses include an assessment of the consequences of an assumed fission product release. 15.2 Safety Issues and Regulatory Requirements The Commission regulations require, in part, that the reactor core and associated coolant, control, and protection systems shall be designed with appropriate mar-1 gin to assure that SAFDLs are not exceeded during any condition of normal opera-tion, including the effects of anticipated operational occurrences; that the reactor coolant system and associated auxiliary, control, and protection systems shall be designed with sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences; and that redundant and reliable reactivity control systems are provided to assure that under conditions of normal operation, including unticipated operational occur-rences, SAFDLs are not exceeded. 1 15.3 Evolution of Current Licensing Basis l l The licensing basis for transient and accident analyses has evolved as reactor events provide new information that is determined to provide improvement in l the methods of evaluation. The process of evaluating operating experience and assessing plant data to determine the need for additional actions is a continued one. General staff guidance specifies that the transients and accidents analyzed in l the plant safety analysis report ensure that a sufficiently broad spectrum of initiating events has been considered; ensure that initiating events of certain l . types and expected frequencies of occurrence be analyzed so that only the limit-ing cases in each group are quantitatively evaluated; and permit the consistent application of specific acceptance criteria for each postulated initiating event. l In general, each initiating event is assigned to one of three frequency groups, I l which include incidents of moderate frequency, infrequent incidents, or limiting faults. The quantitative evaluation of each initiating event in each of_ the 15-1 i i

three frequency groups above establish the limiting conditions of operation for the required safety systems and those limiting parameters are routinely placed in the plant technical specifications to ensure that the plant is operated within its established design envelope. The evolution of the current licensing basis regarding the performance of the emergency core cooling system following a postulated loss of coolant accident is discussed in Subsection 6.4.2 of this report. There are several post-THI action items that affect the management of plant transients and accidents. II.E.1.1 and II.E.1.2 of NUREG-0737 require up-grades to the auxiliary feedwater system in all PWR plants to improve its reliability. The specific improvements include changes in design regarding system initiation and flow indication. II.K.3.5 provides guidelines on auto-matic trip of the reactor coolant pump during a postulated loss of coolant accident. II.K.3.44 requires an evaluation of anticipated transient with single failure to verify no significant fuel failure. 15.4 Conclusions Prior to each plant refueling, the transient and accident analyses are reviewed by each licensee to verify that changes resulting from the new core do not result in an unreviewed safety question. If an unreviewed safety question arises, or if any technical specifications require modification, staff review and approval is required prior to plant restart. This established licensing process ensures that the results of the licensee's transient and accident analy-ses are always in compliance with regulatory requirements during the lifetime of the plant design. As new information is obtained from operating experiences, this information is routinely reviewed by the staff to determine if new or dif-ferent recuirements are needed in this area. If new or different requirements are needec, the staff has the capability within existing regulatory programs to require additional analyses, as needed, to ensure the continued health and safety of the public. l i 15-2

16. TECHNICAL SPECIFICATIONS 16.1 Scope Each applicant for an operating license is required to submit proposed technical specifications and their bases for the facility as a chapter in the Final Safety Analysis Report (FSAR). They should be consistent with the content and format of the Standard Technical Specifications available from the Comission for the appropriate nuclear steam supply system (NSSS) vendor. After review and needed modification by the NRC staff, these technical specifications are issued by the Commission as Appendix A to the operating license. The equipment included in the technical specifications is a broad spectrum of structures and electrical and mechanical systems and components taken from the safety analyses of the FSAR or Updated Safety Analysis Report (USAR). It in-cludes such structures as the reactor vessel and containment, such systems such as the emergency core cooling system and reactor protection system, and such components as circuit breakers, valves, pumps, etc., in these systems. 16.2 Safety Issues and Reaulatory Requirements The Commission regulations require that each license issued by the NRC authoriz-ing operation of a utilization facility shall include technical specifications. These regulations also describe the required contents of the technical specifi-cations. Safety limits, settings for automatic protective devices, and limitin conditions for operation are required to be included in these technical specifig cations. Surveillances are also required to ensure that the necessary qualit of systems and components is maintained, that important parameters are main y tained within specified limits, and that the limiting conditions for operation are satisfied. Compensatory actions, which may include shutting down the reactor, are required when it is found that these conditions are not met, lhe technical specifications are derived from the analyses in the Final (or Updated) Safety Analysis Report. They er;sure that the plant will be operated so that the assumptions of these safety analyses remain valid. The assumptions include both initial conditions and availability of equipment. 16.3 Evolution of Current Licensina Basis Technical specifications are required by the Atomic Energy Act of 1054 (Section which states, in part, that "the applicant shall state such technical 182)lfications,includinginformationoftheamount, kind,andsourceofspecial spee nuclear material required, the place of the use, the specific characteristics of the facility, and such other information as the Commission may, by rule or regulation, deem necessary in order to enable it to find that the utilization or production of special nuclear material will.... provide adequate protection to the health and safety of the public. Such technical specifications shall be a part of any license issued." 16-1

Section 50.36 of the Code of Federal Regulations was promulgated in 1968 to specify the content of the technical specifications. From this time until 1973 each plant's technical specifications were unique but similar. In 1973 the concept of Standard Technical Specifications was introduced in an attempt to make t'echnical specifications of different plants more consistent. When a plant is ready to be licensed, it uses the applicable Standard Technical Specifications as a starting point. Licensees typically request changes to the technical specifications in accor-dance with existing regulations as the plant is operated throughout its life to reflect modifications to the design and different methods of operation. When such changes are requested, the NRC must review and approve the requested changes before they can be implemented. In addition, the NRC also requires changes to the technical specifications as new safety and licensing issues arise. For example, changes were required to plant technical specifications as a result of the Three Mile Island Unit 2 accident. Tha *esolution of other important issues, such as the potential for overpresssrization of reactor ves-sels at low temperatures and isolation of low pressure systems from high pres-sure systems have led to additions to technical specifications to ensure that plantoperatIonisinconformancewiththeresolutionoftheseproblems. As discussed above, the surveillances required by the technical specifications ensure that the plant is operated so that the technical specifications require-ments are met. Technical specifications requirements on equipment are primarily ) a check on operability of the equipment. Degradation (as, for example, from aging) is in most cases not specifically required to be measured, although the ASME Code (which is incorporated in most technical specifications) requires a limited amount of trending of performance for pumps and valves. However, the surveillances are generally done frequently enough so that degradation is not expected to occur to the extent that operability is affected between surveillances. 16.4 Conclusions Because a plant's technical specifications are continually subject to change as the plant's design and operation change or new safety issues arise, and because the technical specifications surveillances ensure that systems, components, and structures for which credit is taken in the plant's safety analyses remain oper-able, the staff is satisfied that the existing technical specifications are adequate. L 16-2 =

17. QUALITY ASSURANCE 17.1 Lcope The quality assurance (QA) program of licensees applies to systems, structures, and components that prevent or mitigate the consequences of postulated accidents that could cause undue risk to the health and safety of the public. The QA pro-gram of each licensee is reviewed by the NRC to ensure that it meets the require-ments of Appendix B to 10 CFR Part 50, and the NRC performs inspections to determine whether the program is being implemented effectively. 17.2 Safety Issues and Regulatory Requirements Commission regulations require that licensees establish and maintain a QA program for the design, construction, and operation of systems, structures, and components that prevent or mitigate the consequences of postulated accidents that could cause undue risk to the health and safety of the public. 17,3 Evolution of Current Licensing Basis In publishing a proposed rule in 1970 to add Appendix B to 10 CFR Part 50, the Commission stated that its purpose was to establish QA requirements for systems, structures, and components to prevent or mitigate the consequences of postulated accidents that could cause undue risk to the health and safety of the public. Further, the Commission stated that the requirements of Appendix B would apply to all activities during design, construction, and operation of such systems, structures, and components and that the criteria of Appendix B would be used for guidance in evaluating the adequacy of the QA programs in use by holders of both construction permits and operating licenses. In essence, Appendix B estab-lishes the minimum acceptable QA requirements for providing reasonable assurance I that (1) applicable regulatory requirements and the design basis for systems, structures, and components, as specified in the license application, are cor-rectly translated into specifications, drawings, procedures, and instructions refueling, repair, maintenance, modification,anddecommissionIng, sting, and (2) subsequent activities, such as construction, operation te are con-ducted and verified in accordance with appropriate procedures and instructions. In the early 1980s, the Commission identified a concern with plant-specific implementation and modification of NRC-approved QA programs. The Commission noted that changes being made in previously approved QA programs could diminish their effectiveness and result in unacceptable QA programs at some licensed fa-cilities. In publishing a final rule addressing this concern, the Commission stated that an NRC-approved QA program becomes a principal inspection and en-forcement tool in ensuring that a licensee is in compliance with QA requirements for protecting the public health and safety. In addition, the final rule [650.54(a) and 50.55(f)] established a procedure requiring review and approval by the Commission prior to implementing any change to a previously approved QA program that would reduce its ef fectiveness. 17-1

The final rule also required that each licensee submit a current description of its QA program and thereafter submit any revisions annually for NRC review and re-approval. Through these requirements, the Commission established an accept-able baseline for a QA program at each plant against which future changes to theprogramwouldbejudgedandensuredthatfuturechangeswouldbeavailable. This rule change created a regulatory process by which the Commission ensures that an acceptable QA program will remain in place at a licensed facility throughout the life of the license and that changes to that program would be routinely reviewed and evaluated to ensure that the program would continue to satisfy the regulatory requirements of Appendix B to 10 CFR Part 50. Toward ensuring this end, the NRC routinely inspects the implementation of QA programs. Safety-related activities undertaken by licensees to obtain a renewed license are also subject to the requirements of Appendix B. 17.4 Conclusions The Commission believes an effective QA program is an essential cornerstone in the construction and subsequent operation of nuclear power facilities. The NRC has reviewed and approved the QA program for each reactor currently operating or under construction. To ensure the continued effectiveness of a licensee's program, the Commission has established a process requiring initial review to Under 10 CFR satisfy)the QA requirements of Appendix 8 to 10 CFR Part 50.and 50.55(e), any sub 50.54(a commitments of the QA program of a licensee must receive NRC approval before the licensee can implement the change. As new information occurs as a result of plant events or research, this information is reviewed by the staff to deter-mine if new or different QA requirements are needed. If it is determined that new or different QA requirements are needed, the staff will require QA program changes using existing regulatory programs to ensure the continued health and safety of the public. 17-2

l 18. HUMAN FACTORS ENGINEERING l 18.1 Scope The following section describes the regulatory requirements in the human factors area. The principal topics where human factors have had a significant role are in the control room design and in the safety parameter display technical areas. These technical areas are discussed in greater detail below. 18.2 Control Room 18.2.1 Scope Nuclear power plants are provided with a control room from which actions can be taken to operate the plant safely under normal and accident conditions. Outside the control room, there is equipment with the design capability for prompt hot shutdown of the reactor, which includes the necessary instrumentation and con-trols to maintain the plant in a safe condition during hot shutdown, and with a potential capability for cold shutdown. 18.2.2 Safety Issues and Reguiatory Requirements The safety is:ve addressed is to confirm that the design of the plant's control room and remote shutdown capability facilitates the plant operator's ability to prevent accidents or cope with accidents if they do occur. The basis for regulating the design of the plant's control room and remote shutdown capability is set forth in the enclosure to Generic Letter 82-33 "Sup-plement I to NUREG-0737--Requirements for Emergency Response Capability.", 18.2.3 Evolution of Current Licensing Basis Requirements for commercial nuclear power plants to review their control room design and correct deficiencies were established as a result of the TMI accident. In May 1980, NUREG-0660, "TMI Action Plan Developed as a Result of the TMI-2 Accident," was issued. Task Item I.D.1, " Control Room Design Reviews," stated that "NRR will require that operating reactor licensees and applicants for oper-ating licenses perform a detailed control room design review to identify and correct design deficiencies." The review was to be performed on a schedule con-sistent with the implementation of other r:,quirements for enhancing operator effectiveness, including necessary retraining. In November 1980, the NRC pub-lished NUREG-0737, " Clarification of TMI Action Plan Items," which identified the requirements associated with detailed control room design reviews (DCRDRs). Guidance published as NUREG-0700, " Guidelines for Control Room Design Reviews" _(1981), was also issued to the industry. In December 1982, " Supplement 1 to NVREG-0737--Requirements for Emergency Response Capability," was issued as Gen-eric Letter 82-33. This document implemented existing requirements for plants to conduct a DCRDR and identify human engineering discrepancies and provided additional clarification. For some, but not all plants, the NRC issued Confir-matory Orders, which required plants to submit schedules for completing a program 18-1 f

plan and a summary report (including a proposed schedule for implementation) of their DCRDR. For operating plants, the staff has reviewed the program plans.for conducting and implementing the DCRDR. These plants also have submitted a summary report of their completed review, which outlines proposed control room changes and implementation schedules. Using established criteria, the staff reviews plant-specific summary reports and determines whether a pre-implementation audit is necessary. After completing its review, the staff issues a safety evaluation report documenting the acceptance of the licensee's proposals. Since the issuance of NUREG-0737, Supplement 1, no new requirements have been identified for completing the DCRDR. Through periodic resident and legional inspections, and 10 CFR 50.59 reviews, the staff will ensure that future modifi-l cations to plant control rooms and remote shutdown facilities are imp'emented in a manner consistent with the plant's approved DCRDR process and NRU acceptance criteria. The staff will review and evaluate advances in technology that may impact the design of the plant control room or remote shutdown facility through periodic plant inspections and by sponsoring research in advanced control room j designs. If changes to the current requirements are needed, they could be imple-mented using existing regulatory programs, as necessary, to ensure continued health and safety to the public. 18.2.4 Conclusions in summary, the requirements for the DCRDRs were established as a result of the TMI accident and are contained in NUREG-0737, Supplement 1. The staff reviews and approves plant-specific DCRDR efforts and documents these approvals in pub-lished safety evaluation reports after the review is completed. Resident and regional inspections, and 10 CFR 50.59 reviews will ensure that future modifica-l tions to plant control rooms and remote shutdown facilities are made in accor-dance with NRC-approved DCRDR programs and NRC acceptance criteria. Advances in design technology will be reviewed by the staff and, if changes to the existing requirements are necessary, they will be implemented through existing regulatory programs, as necessary, to ensure the continued public health and safety. 18.3 Safety Parameter Display System l 18.3.1 Scope In addition to upgrading the design of their control rooms, licensees are to l install a Safety Parameter Display System (SPDS) as an aid to operating person-nel in rapidly and reliably determining the safety status of the plant and in assessing whether abnormal conditions warrant corrective actions to avoid a degraded core. 18.3.2 Safety Issues and Regulatory Requirements l The safety issue addressed is to confirm that the design and implementation of the plant's SPDS facilitate the user's ability to rapidly and reliably determine l the safety status of the plant. l In May 1980, requirements for commercial nuclear power plant licensees to install an SPDS were established as a result of the TMI accident. The basis 18-2 l l

for regulating the design and implementation of the plant's SPDS is set forth l in the enclosure to Generic Letter 82-33, " Supplement 1 to NUREG-0737--Require-ments for Emergency Response Capability." 18.3.3 Evolution of Current Licensing Basis NUREG-0660, Item I.D.2, " Plant Safety Parameter Display Console " stated that 1 "In conjunction with the control room design upgrade described In Its I.D.1, NRR will require all licensees and applicants to install a safety parameter dis-play system that will display to operating personnel a minimum set of parameters l (safety state vector) which define the safety status of the plant." In November l 1980, the NRC published NUREG-0737, " Clarification cf TMI Action Plan Items," [ which identified the specific requirements associated with the SPDS. Guidance published as NUREG-0695," Human Factors Acceptance Criteria for the Safet (1980), and NUREG-0835, J meter Display System, Draft Report for Comment" (1981), were also issued to the industry. In December 1982, " Supplement 1 to NUREG-0737--Requirements for Emer-I gency Response Capability," was issued as Generic Letter 82-33. This document implemented the requirements to install an SPDS and provided additional clarifi-

cation, for some, but not all plants, the NRC issued Confirmatory Orders, which required plants to submit schedules for the design, installatinn, and implemen-tation of an SPDS.

In 1986 the staff issued NUREG/CR-4797, " Progress Reviews of Six Safety Para-meterDIsplaySystems,"andconcludedthatutilitiesmaybehavingmajordiffi-culties in designing and implementing their SPDSs. The staff subsequently issued NRC Inspection and Enforcement (IE) Information Notice (IN) 86-10, " Safety Para-meter Display system Malfunctions" (1986), to inform licensees of the results of the survey. After issuing IN 86-10, the staff received several requests from licensees for extensions to implementation schedules, requests for clarification regarding the definition of an "o)erational SPDS," and questions about SPDS d9ficiencies and how to resolve t1em. In response to the continuing concerns related to SPDS designs, NRC published NUREG-1342, "A Status Report Regarding Industry Implementation of Safety Parameter Display Systems," which described methods used by some licensees to implement the SPDS in a manner acceptable to l the staff cnd issued Generic letter 89-06 in April 1989 requesting licensees to l certify the operational status of their SPDS to the NRC using guidance contained in the generic letter and the stated NUREG. ThestaffIspresentlyreviewing licensee submittals requested by GL 89-06. Since the issuance of NVREG-0737, Supplement 1, and the guidance described above, no new requirements have been identified for installing and implementing the l SPDS. Through the piocess of periodic resident and regional inspecticns and reviews, the staff will ensure that future modifications to plant SPD$s are implemented in a manner consistent with the plant's approved design and NRC acceptance criteria. The staff will review and evaluate advances in technology that may impact the design of the SPDS through periodic plant inspections and by sponsoring research in advanced SPDS design. If changes to the current requirements are needed, they could be implemented by rulemaking on existing requirements or under the backfit rule to ensure continued health and safety to the public. 18-3 {

18.3.4 Conclusions In summary, the requirements for the SPDS were established as a result of the TMI accident and are contained in NVREG-0737, Supplement 1. Since NUREG-0737, Supplement 1, was issued, there have been no new requirements for SPDS. The staff reviews and approves plant SPDS designs, and a safety evaluation report is issued after the staff completes its review. Resident and regional inspec-tions and 10 CFR 50.59 reviews will ensure that future modifications to plant SPOS designs are made in accordance with NRC guidance and acceptance criteria. Advances in design technology will be reviewed by the staff and if changes to the existing requirements are necessary, they will be implemented within exist-ing regulatory programs, as necessary, to ensure the continued public health and safety. l 18-4

19. SAFETY ISSUE RESOLUTION: TECHNICAL AND IMPLEMENTATION STATUS 19.1 Scope The NRC has established an integrated program to review and analyze operating experience to identify specific events and generic situations where the margin of safety established by design through the licensing process has been degraded, or where new information or insights lead to new concerns. The program, further, includes steps to identify and implement corrective actions that will restore the intended margin of safety. 19.2 Safety Issues and Regulatory Requirements NRC licensees must report any unexpected occurrence in operation that has actual or potential safety significance. Some events must be reported within one hour via dedicated direct phone lines, and many are reported in writing within a few weeks. These reports, required by 10 CFR 50.73, are called Licensee Event Re-ports (LERs) and provide a clear, narrative description of the event-and cause of each component or system failure, if known. The staff reviews these LERs to determine the adequacy of short-term corrective actions and the need for possi-ble action at other plants, or to identify potential generic problems and signi-ficant safety concerns warranting further study. 19.3 Regulatory Process and Implementation Status For many safety-related operational events, NRC resident inspectors perform the initial NRC investigations, and the appropriate NRC regional of fice conducts reviews. In addition, the technical aspects of potentially significant opera-tional events are studied by cppropriate organizations within the rlRC, including the Office for Analysis and Evaluation of Operational Data (AE0D) and the Offices of Nuclear Reactor Regulation (NRR) and Nuclear Regulatory Research (RES). The AE00 analyzes and evaluates all operational safety data and provides a strong technical capability that is independent of regulatory activities associated with licensing and inspection. Engineering evaluations are per-formed to examine the implications of operating experience and to determine if intensive analysis and evaluation as a case study are warranted. If necessary, in-depth case studies are performed to determine the level of safety concern, and findings-and recommendations are communicated to the appropriate NRC office for action. The AE0D recommendations and suggestions addressed to NRR are reviewed and prioritized-according to a judgment of their safety significance. If an item appears to have a high degree of safv:1 sigr 'icance, the need for an informa-tion notice, generic letter, bulletin, m .ar appropriate prompt action is determined. If the recommendation does i,; appear to warrant immediate action, it is considered within NRR for appropriata action or a determination whether it can be addressed as part of an existing issue (such as a_ generic issue) or by creation of a new generic issue. If this occurs, the issue is formally trars-mitted to RES for their consideration and prioritization or inclusion into an existing generic issue. 19-1

AE00 also screens the recommendations and suggestions contained in its studies and evaluations for identification as potential generic issues. A generic issue is an issue that is applicable to all,dentified to RES, which then evaluates and several, or a class of reactors or reactor-related facilities. Such issues are i prioritizes the issue in accordance with established procedures (see below). Ge-neric istues may also be suggested by individuals within the NRC, the Advisory Committee on Reactor Safeguards (ACRS), the nuclear power industry, or the public. The generic issues management prograra is divided into six distinct stages. In addition to the identification stage discussed above, the stages are prioritiza-tion, resolution, imposition, implementation, and verification. Each new gen-eric safety issue (GSI) is prioritized by developing a quantitative assessment of safety benefits (risk reduction) and impact (cost) for the utility, the NRC, and any other entities involved, as described in NUREG-0933, "A Prioritization of Generic Safety Issues." Based on the extent of potential risk reduction to the public and value/ impact ratio developed from this assessment, and as further adjusted by qualitative judgments, a priority is assigned to each GSI. Following peer review of the initial prioritizatica, a final priority is recommended and assigned. Issues that receive a HIGH or MEDIUM priority are assigned for resolution by the staff. An issue assigned a LOW or DROP priority by nature of the rating stan-dard is of so low a public risk reduction potential that resolution of the issue is not pursued. All issues are documented in the catalcg of generic issues maintained in NUREG-0933. The resolution process requires the development of a plan and schedule for the work that needs to be done to resolve the issue. The plan also identifies needed resources and coordination points. Following completion of the technical studies, a final resolution package is prepared that includes a regulatory anal-ysis describing various potential solutions and justification for any proposed requirements based on a consideration of value and impact. The resolution pack-age is considered by the ACRS and by the Committee for Review of Generic Require-ments (CRGR) if new requirements are proposed. Resolved issues are forwarded to NRR for imposition, implementation, and verification. This includes issuance of generic correspondence to licensees informing them of the issue resolution, establishment of an acceptable schedule for implementation of the resolution by the affected licensees, and verification that the required improvements have been made in an acceptable manner. Value-impact analyses were employed as part of the basis of resolving some GSIs. In the tradeoffs between net safety benefit and net cost, the remaining plant operating term crainarliy enters the calculations. However, such calculations do not have a precision suff1&nt to de a significant distinction between plaai, operating terms with and without an anditional 20 year renewal interval, given the fact that these decisions have bein based on average plant ages in the first half of a 40 year license term. Accrrdingly, it is not necessary to re-examine in the license renewal context seci cost-benefit calculations underlying decisions not to backfit. Should special ;ircumstances in connection with a particular issue as applied to a particular plant warrant reassessment, it would be reconsidered on a plant-specific basis, as guided by the backfit rule. 19-2

[ L The generic issues management program was initiated in 1981. At that time, 511 . issues were identified to be prioritized; 369 were TMI followup items (NUREGs-0660 and -0737) and 142 were identified by previous assessments of generic issues (NdREGs-0371 and -0471). These issues included 22 issues that had previously been identified as unresolved safety issues (USIs), which are included in the group of HIGH priority generic safety issues. In the past nine years, an addi-tional 261 hsues have been identified for a total of 772; this number includes various human facter issues and issues identified by the staff assessment of the Chernobyl accideni As of December 1989, 699 issues nave been resolved, includ-ing all the USIs. Of the remaining 73 issues, 41 are to be prioritized and 42 are in the resolution process. The implementation status of USIs was recently reviewed by the NRR staff. NRR's findings indicate that, in general, most USIs have been implemented and that unimplemented USIs are being addressed on a schedule satisfactory to the staff. The implementation status of the remaining generic safety issues is currently being assessed by NRR. t 19.4 Conclusions The NRC has an effective program for the review and analysi_s of operating exper-ience and other new information and for implementing any necessary modifications at operating reactors. The process allows for early notification of licensees of potential concerns, if deemed necessary, or for more thorough evaNat. ion through the generic issues management program. Plant modifications are imple-mented following an evaluation of various reasonable alternative colutions and i justification based on an assessment of value and impact. The licensing basis for individual operating plants includes changes resulting from resolution of generic issues determined to be applicable. 19-3

f ? 008tC 70n0 336 U.S. NUCEE AR REOUL ATORY COMMISSION

1. R E POR T NUMBE R km"cb 4:02' d

mo m BIBLIOGRAPHIC DATA SHEET p n=, t=t. .a v,, """' NUREG-1412

2. TITEE AND SveilTLE

) Foundation for the Adequacy of the Licensing Bases f A Supplement to the Statement of Considerations for [ * ' ' "'" " ** S',",', h the Proposed Rule on Nuclear Power Plant License Renewal July 1990 (10 CFR Part 54) ..,,, on on u, uv SE n Draft Report for Comment

6. AUTHOR (S) 6 TYPE OF REPORT I

Regulatory

7. PE R100 COVE R E D tras4,ew peress S. P FOR NG NIZ AT ION - N AME AND ADDR E SS tit enc. peuve 0* woa. Ortsee er Aeroa. us Nucen Assudsvory coawaamoa, east madeae asem de searnsw. pem Office of Nuc. ear Reactor Regulation U.S. Nuclear Regulatory Commission L

Washington, DC 20555 9. RG ant 2 ATION - N AME AND ADDRESS Ist Nac type -seaw a now ; de contenor. am** Nec osedwea. Ortre er Asema, ut svena nervasesay comadssasa, r l Same as above. l l I

10. SUPPLEME NTARY NOTES 11, ABSTRACT Isopmere er met 3.

In order to limit the Commission's license renewal decision to consideration of j(' - whether age-related degradation has been adequately addressed, the Part 54 rulemaking 'must make a generic fin;ing for all nuclear power plants that the findings of h reasonable assurance o adequate protection for. issuance of-an operating license-continue to be true e.c the time of the renewal application and' accordingly need not be made anew at the time of license renewal. This analysis describes the' regulatory processes that form the basis for such a finding. This document discusses how the . licensing process has evolved'in major safety issue areas under existing regulatory -processes that have ensured continued adequacy of the licensing bases of all operating plants. The document presents the described regulatory processes as the Commission's reasons for -considering it unnecessary to re-review an operating plant's licensing basis, except for age-related degradation concerns, at the time of license renewal. This report is a supplement to the Statement of Considerations for the Nuclear Regulatory Commission's proposed rule (10 CFR Part 54) that would establish the criteria and standards governing nuclear power plant license renewal.

12. KL Y WORDS/DESCRtfiORS (ter worm er pasases ease wear assant maws da #cean, ene supers.#

a AvA6LAsitan STAMm1 Unlimitod Licensing Bases, License Renewal, Nuclear Power Plant ...ncunin ctAm ncmo tran ese,> Unc1 as si fied tra. as rie Unclassi fied ~ 16.NUMSER OF PAGES

16. PR1CE l

NAC f OMM 3J6 (249)

UNITED STATES ecs, etcss man NUCLEAR REGULATORY COMMISSION P082^8j,*j"S '*'D WASHINGTON, D.C,20555 ,_,,,p 0FFICIAL BUSINESS ' PENALTY FOR PRIVATE USE, $300 1 1AO' pugt1C ATIONS SVC6 hk g hs PDR-NOREU 3555 P-{2jN010N g g /}}