ML20217K211

Informs Commission of Staff Intent to re-issue for Public Comment Proposed Rulemaking Package Addressing Shutdown & Fuel Storage Pool Operations at NPPs

ML20217K211
Person / Time
Issue date:	07/30/1997
From:	Callan L NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To:
References
SECY-97-168, SECY-97-168-01, SECY-97-168-1, SECY-97-168-R, NUDOCS 9708150168
Download: ML20217K211 (98)

Text

-

L, o . . . . . ., o . . . . . . o o o . . . . o k

RELEASED TOTHE PDR  :

Bkl0uq ta tv

• • A

• )e  : eas in e  :

\...../ i RULEMAKING ISSUE (NEGATIVE CONSENT) * -

July 30, 1997 SECY-97-168

~

2-f_QB: The Comissioners f.BQM: L. Joseph Callan g ae Executive Director for Opgratten. s

SUBJECT:

ISSUANCE FOR PUBLIC COMM FORSHUTDOWNANDFUELST@hlTOhPROPO' AGE y L OPERATION PURPOSE: d This paper informs the Comission of the staff's intent to re-issue for public comment a proposed rulemaking package addressing shutdown and fuel storage pool operations at nuclear power plants.

BACKGROUND:

In SECY-94-176, the staff sought Comission approval to issue for public coment a aroposed rule for shutdown and low-power operation at nucl, ear power plants. T1e Comission approved the recuest in the staff requirements memorandum dated September 12, 1994, anc the proposed rule was published in the Federa7 Register in October 1994. The numerous comments received were considered along with Comission guidance regarding the use of a risk-informed, performance-based approach for new regulations. As a result, the staff made significant changes to the proposed rule and regulatory analysis. In addition, the staff's studies of spent fuel storage pool operations led to a decision to encompass spent fuel storage pool o)erations in the revised rule. Therefore, the staff intends to again issue tie .

rulemaking package for public coment.

DISCUSSION:

The staff's revised regulatory analysis considered important safety functions and the controls cur rently in place to ensure these functions. For low-power o)eration, hot shutdown. and the transition period from hot to cold shutdown, t1e revised analysis concludes that for these periods important safety functions are protected by existing requirements in standard technical s )ecifications. Accordingly, the revised proposed rule no longer addresses

< t1ese modes.

CONTACT: Timothy Collins. NRR j 415-2897 SECY NOTE: TO BE MADE PUBLICLY AVAILABLE AT COMMISSION MEETING ON 81 8 970730 AUGUST 6, 1997 l

97-168 R PDR MMM M m June Amur Jmmmr emuur mammer mem- - - - -

2 For the balance of shutdown operations (cold shutdown and refdeling modes),

the regulatory analysis shows that the proposed rule providesla substantial increase in the overall protection to public health and safety, and that the costs of the pro)osed rule are justified in view of the increased arotection afforded Jy the backfit. The analysis found that current controls lave evolved through a series of NRC and industry actions initiatedsfor the -

most part through NRC generic communications. Although these initiatives have been successful in achieving the acceptable level of risk that now exi'sts at U.S. nuclear power plants, the analysis showed that a significant level of safety is dependent upon measures that are not traceable to specific underlying regulations, and that could, therefore, be withdrawn by licensees without prior staff approval. The practical effect of rule implementation is, therefore, not to raise the current level of safety, but rather to ensure that at least the current level of safety will be maintained. This action is considered necessary to preclude a witMrawal from current practice in light of continuing economic pressure to increase plant availability through shortened outages.

The Committee to Review Generic Requirements (CRGR) reviewed the revised proposed rule, statement of considerations. regulatory guide, and regulatory analysis and sent its comments to the staff on June 12, 1997. The staff incorporated CRGR comments in the enclosed rulemaking package. The staff briefed the Advis6ry Committee on Reactor Safeguards (ACRS) on the status of the rulemaking package in May 1996. The ACRS sent its comments to the staff on June 4.1996, indicating the ACRS )lan to comment again on the proposed final rule after reconciliation of pu)lic comments. .The staff plans to develop inspection and enforcement guidance for the proposed rule during the public comment period.

SUMMARY

OF THE RULE:

The proposed rule consists of three parts: (1) shutdown operations. (2) fire protection, and (3) spent fuel storage pool operations. The overall objective of the rule is to establish a clear, flexible, risk-informed, and enforceable regulatory fr.amework for assuring that cold shutdown, refueling, and fuel (storage) pool o3erations continue to be conducted in a safe manner. Although a shutdown proba)ilistic risk assessment (PRA) is not required, the rule. is . . . , , . ~

written in a fashion that allows licensees to enhance operational flexibility by the use of state-of-the-art PRA methods as a complement to traditional deterministic analyses provided that defense-in-depth considerations are also addressed.

Shutdown Onerations The shutdown operations section of the rule has been structured with the specific objectives of: (1) reducing the frequency of events that can lead to loss of the decay heat removal function. (2) assuring that mitigative equipment is available for those events that do occur. (3) providing a measure of performance through monitoring of parameters that represent necessary safety functions, and (4) facilitating inspection and enforcement act,1vities.

3 These goals are to be achieved through a combination of procedural, monitoring, and mitigation capability requirements.

The ~p oposed rule would require licensees to establish and imhlement procedures for training, quality assurance, and corrective actions to ensure that-the safety functions of decay heat removal, inventory control, and pressure control are maintained and monitored, and that mitigation capabi.lity -

is provided.

The procedures would be described in the administrative controls section of the technical specifications. This would establish a clear regulatory requirement while allowing licensees flexibility in terms of implementing these programs.

The proposed rule would also require licensees to monitor safety function performance and prescribes limits for each safety function. Licensees would choose the specific parameters, parameter limits and instrumentation to be used to demonstrate compliance with the safety function limits. These details would have to be maintained available for inspection in a licensee-controlled document. The criteria and methods used for selecting the parameters and parameter limits, however.-would have to bt described in the administrative controls section of the technical specifications.

The propnsed rule further requires that mitigative equipment be maintained available to ensure core cooling and decay heat removal, and to protect against the uncontrolled release of fission products in the event of loss of the operating decay heat removal system. The specific equipment to be credited at any time in the outage would be under licensee control, but would need to be documented and available for ins)ection. Criteria and msthods for selecting equipment would have to be descriaed in the administrative controls section of the technical specifications.

Fire Protection This part of the rule is intended to extend the fire protection provisions already provided during power operation to shutdown operation. The proposed rule would require licensees to implement measures to minimize the frequency of fires during shutdown operations. It would also require that the. decay .,,_ m heat removal function be maintained free of fire damage, or that fire damage be limited by promptly detecting, controlling, and extinguishing fires that do occur. It would further require that contingency plans be developed to ensure adequate core cooling and restoration of decay heat removal following a fire.

The provisions necessary for implementation.would have to be documented in the licensee *s fire protection plan, Fuel Storace Pool Ooerations The objective of the fuel storage pool portion of the rulemaking is to=

establish clearly defined regulatory controls for current operational practices in spent fuel storage pools and to facilitate inspection and enforcement. ,

- 1

4 In the portion of the rule that deals with fuel storage pool o erations, licensees would be required to: (1) document in their facili 's safety analysis report the current design bases for removing decay h t from the pool. and (2) ensure that operational limits derived from tho bases are incorporated into operating procedures.

Conformina Chanaes .

-In addition, conforming changes would be made'to other regulations in support of the shutdown operation requirements of $50.67. The most significant of these are: (1) adding the structures, systems, and components necessary for compliance with the shutdown operation requirements of S50.67 to the maintenance rule (S50.65) and the license renewal rule (10 CFR Part 54).

(2) providing for notification and submitting reports to the NRC, in accordance with S50.72 and $50.73, of any event that results in actuation of the mitigation equipment, and (3) adding a definition of shutdown operations to $50.2, which makes it clear that normal operation includes shutdown operation.

The proposed rule is provided-in Attachment 1. the statement of considerations in Attachment 2.- the regulatory analysis in Attachment 3. and the regulatory guide in Attachment 4.

Coordination The Office of the General Counsel has no legal objection to this Commission paper. .

RECOMMENDATION:

The staff recoinnends that the Commission note that the staff will proceed to have the proposed rule and the associated statement of consideration published in the Federal Register unless otherwise instructed by the Commission.

L. seph Callan .- .

' Executive Director for Operations Attachments:

1. Shutdown and Fuel Storage Pool Operations at Nuclear Power:P1 ants

~2. Statement-of Considerations

3. Regulatory Analysis for the Proposed Regulation S 50.67

4. ' Draft Regulatory Guide DG-1066 i

T 5

t DISTRIBUTION:

Commissioners l OGC m . .

OlG ~- -

4 .

OPA

- OCA '

ACRS

• CIO -

CFO EDO REGIONS SECY

- SECY NOTE: In the absence of instructions to the contrary, SECY will notify the staff on

' Fridav. Auoust 15.1997, that the Commission, by negative consent, assents to the action proposed in this paper, O ,W b e

,1

July 24, 1997 Attachment 1 5 50.67

- Shutdown and Fuel Storage Pool Operations at Nuclear Power Plants 1~.

A new i 50.67 is added to read as follows: I i 50.67- Shutdown.and Fuel Storage Pool Operations at Nuclear Power Plants (a Shutdown Operations. '

~

licenses)for a-light-water reactor nuclear powerexcept plantHolders those plentsof operating licenses

'that have been pemanently shut down with fuel permanen,tly removed from the reactor vessel, shall comply with the following requirements except when all fuel has been transferred out of the reactor vessel:

impleme(nt procedures (includin1) Licensees Shutdown shall establish Operation and Procedures.

procedures for training, and quality assurance and corrective action. measures for the activities for complying with-the requirements of paragraph (a) f this section. Except for those procedures necessary for com)1ying with paragraph (a)(4) of this section, the criteria for determining t1e adequacy of the procedures and the method for establishing, modifying,- and superseding the procedures must be described in the administrative controls section of technical specifications.

(2) Performance Monitoring.

during(shutdown operation.i) Licensees shall establish, monitor, and comply with paramete The parameter limits must ensure compliance with the following safety function limits: ,

(A) Decay heat removal such that the water temperature above the reactor core is less than the saturation temperature.

(B Reactor Coolant System-(RCS) inventory control such that the RCS water lev)el is sufficient for reliable operation:of the normal means of decay heat removal.

(C) RCS and connected systems pressure control such that the design pressure and Low

• Temperature Overpressure Protection (LTOP) settings are not exceeded.

n n

'(ii) The parameters, parameter limits, and monitoring requirements

.(including the nature and frequency of monitoring) must be identified and described.in a licensee-controlled document that is identified in the administrative controls section of. the technical specifications.-The criteria

-and method for licensee selection of the parameters, the parameter limits,- and the nature and frequency of monitoring must be described in' the administrative controls section of technical specifications.-

(3) Mitigation capability. Licensees shall maintain available a

_ mitigation capability to provide adequate core cooling.: decay heat removal, and sufficient protection against the uncontrolled release of fission products

-following the loss or interruption of decay heat removal during shutdown operation. The structures, systems,- and components' for complying with this 1

July _24, 1997 Attachment I section must be identified in a licensee-controlled document that is identifled-in the administrative controls section-of the=technjcal specifications. The criteria and method for licensee selection;of the structures, systems, and components necessary for complying wi$h this section must be described in the administrative controls section of technical specifications. , ,

(4) Fire Protection. <- . .-

= (1) Licensees shall:

(A) Minimize the frequency of fires during shutdown operation; (B) Maintain the decay heat removal function free of fire damage or limit the levels of fire damage by promptly detecting, controlling, and extinguishing fires that do occur, and (C) Develop and implement a contingency plan for maintaining adequate core cooling and in a timely fashion restoring decay heat removal in the event of a fire in those areas that interrupts or degrades heat removal to an ultimate heat sink.

(ii) The provisions necessary for complying with this paragraph (including the contingency plan) must be described in the fire protection plan required-by 10 CFR 50.48.

(b) Fuel Storage Pool Operation. Holders of licenses authorizing storage or movement of fuel in a-- fuel, storage pool refueling cavity or connected water-filled cavity at a light-water reactor nuclear power plant shall-_ describe in the updated final safety analysis report'the assumptions and parameter values used in safety analyses performed by the licensee as reference-bounds for design to demonstrate adequate decay heat removal for the fuel storage pool and ensure that the procedures for the fuel storage pool contain operational limits that incorporate the assumptions and parameter values in the updated final safety analysis report.-

(c) Implementation. Each licensee shall:

(1) Develop and submit for NRC review and approval technical ,

specifications required by paragraph _(a) of this section by (INSERT EFFECTIVE DATE OF FINAL RULE PLUS 6 MONTHS);

(2) Update the fire protection plan required by i 50.48 of this part by (INSERT EFFECTIVE DATE OF FINAL RULE PLUS 12 MONTHS) by describing the various

. positions within the licensee's organization that are responsible for complying ~with paragraph (a)(4) of this section,-the authorities-that are delegated to each of these positions to implement these responsibilities, and the specific features necessary for complying with paragraph (a)(4); and (3) Revise their updated final safety analysis report as required by paragraph (b) of this section at the next scheduled revision following [ INSERT EFFECTIVE DATE OF FINAL RULE PLUS 6 MONTHS);

2

_ __ =--_-----------_--------z----.-------

July 24, 1997 Attachment 1 (4) Revise the procedures for the fuel storage pool as required by paragraph (b) of this section by (INSERT EFFECTIVE DATE OF FINAL RULE PLUS 12 HONTHS).

CONFORMING CHANGES TO OTHER REGULATIONS _

2. Section 50.2'is' revised by adding in alphabetical order the definition for Sh0tdown operation as follows:. ' -

5 50.2 Definitions Shutdown operation means the reactor. coolant system (RCS) is in Cold Shutdown or Refueling (as defined in a plant's technical specifications) and one or more fuel assemblies are located in the reactor vessel or in the refueling cavity. Shutdown *operation is a part of normal operation.

3. Section 50.34 is revised to read as follows:

i 50.34 Contents of applications; technical information.

(b)

(12) The assumptions and parameter values used in safety analyses required by paragraph 50.67 decay heat remov(b)al. forasthe reference bounds fuel storage for design to demonstrate adequate pool. .

3

4. Section 50.65(b) is revised to insert a new subparagraph (b)(2)(iv) as follows: '

• 6 50.65 Requirements for monitoring the effectiveness of maintenance 'at nuclear power plants.

(b)

(2)

(iv) necessary for* compliance with 5 50.67 of this part.

5. Section 50.72 is revised to insert a new subparagraph (b)(1)(vit) as .. -

follows:

5 50.72 Immediate notification requirements for operating nuclear power reactors.

(b)

(1)

(vii) Any event that results or should have resulted in the actuation of the mitigation capability required by 50.67(a)(3).

3 1

July 24, 1997 Attachment 1

6. Section 50.73 is revised to insert a new subparagraph (a)(2)(xi) as follows: ,

i 50.73 Licensee event report system. j (2)

(xi) Any event that' results or should have resulted in the actuation of the mitigation capability required by 50.67(a)(3). <- . .-

t

7. Section 54.4 is revised to read as follows:

i 54.4 Scope.

(a)

(3) All systems, structures, and components relied on in safety analyses or plant evaluations to perform a function that demonstrates compliance with the Commission's regulations for fire protection (10 CFR 50.48), environmental qualification (10 CFR 50.49), pressurized thermal shock (10 CFR 50.61),

anticipated transients without scram (10 CFR 50.62), station blackout.(10 CFR 50.63) and shutdown and fuel, storage pool operations (10 CFR 50.67).

1. 4 e-

• * ,W IA>

.4 l

[7590-01-P)

NUCLEAR REGULATORY COMMISSION 10 CFR Parts 50 and 54 l

RIN 3150-AE97 Shutdown and Fuel Storage Pool Operations at Nuclear Power Plants AGENCY: Nuclear Regulatory Comission ACTION: Proposed rule -

SUMARY: The Nuclear Regulatory Commission (NRC) is proposing to amend its regulations pertaining to the operation of commercial nuclear power plants for shutdown operation and fuel storage pool operation. The proposed rule would require licensees to establish parameter limits for certain safety functions defined in the proposed rule, monitor those parameters, and take necessary actions to ensure that the parameter limits are not exceeded; maintain available a mitigation capability to provide core cooling, decay heat removal and protection against loss of fission products following loss or interruption of decay heat removal during shutdown operation; amend the required fire protection plan to add provisions for fire protection measures defined in the proposed rule, and report actuations of shutdown mitigation equipment to the NRC. With regard to fuel storage pool operation, the proposed rule would require licensees to update the final safety analysis report (FSAR) to document key safety analysis parameters and assumptions defining the design bases for the fuel pool decay heat removal function and to translate the key parameters into operating procedures. , .

DATES: The connent period expires (insert date 75 days after publication in the Federal Register). Comments received after that date will be considered if it is practical to consider them, but the Connission is able to assure consideration only for comments received on or before that date.

ADDRESSES: Submit comments to: Secretary, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, Attention: Docketing and Service Branch. Deliver comments to: 11555 Rockville, Pike, Rockville, Maryland between 7:30 a.m..and 4:15 p.m. on Federal workdays.

Copies of comments received may be examined and copied for a fee 'at tihe "

NRC Public Document Room, 2120 L Street, NW. (Lower Level), Washington, DC 20037. For information on electronic access and submittal, please see the discussion under Electronic Access in the Supplementary Information section.

FOR FURTHER INFORMATION CONTACT: Mr. Timothy Collins, Section Chief, Reactor Systems Branch, Division of Systems Safety and Analysis, Office of Nuclear Reactor Regulation, Mail Stop 0-8E23, U.S. Nuclear Regulatory Consission, Washington, DC 20555-0001, Telephone:'301 ,415-2897, e-mail: TEC9nrc. gov.

e

SUPPLEMENTARY INFORMATION:

I. Objective II. Background III. Basis for Shutdown Operations Requirements )

IV. Basis for Fuel Storage Pool operation Requirements V. Section-by-Section Analysis of Rule Requirements VI. Coments on the Initially Proposed Rule VII. Request for Public Coments '

s .

VIII. Availability of Documents -

IX. Electronic Access X. Criminal Penalties XI. Finding of No Significant Environmental Impact XII. Paperwork Reduction Act Statement XIII. Regulatory Analysis XIV. Regulatory Flexibility Certification XV. Backfit Analysis I. Objective The obje-tive of the proposed rule is to establish a clear regulatory framework for ensuring that cold shutdown, refueling outages, and fuel pool operations continue to be conducted in a safe manner. To accomplish this objective for cold shutdown and refueling operations, licensees would be required to modify the administrative controls section of their technical specifications in accordance with the requirements of the rule, and establish procedures for performance monitoring and other activities important to safety. To accomplish this objective for fuel pool operation, licensees would be required to document factors important to safety in the FSAR and incorporate these safety factors in fuel pool operating procedures. -

II. Background On October 19,1994 (59 FR 52707), the Comission published a proposed rule that promulgated requirements for low-power and shutdown operations. In that Federa7 Register notice, the Comission described a series of serious events that oc. curred during shutdown operations. Subsequently, other such events have also occurred. During 1995 and 1996, the NRC held several public meetings to ensure that the NRC would have the benefit of an interchan,ge of '

views on the subject of shutdown risk.

III. Basis for Shutdown Operations Requirements On the basis of the extensive written public coments and the discussions at the public meetings, the Comission has decided to substantially revise the proposed rule and the suppnrting regulatory analysis, and republish these documents for public comment. The scope of this rulemaking was changed to include fuel pool operation and to exclude low-power and transition modes.

Fuel pool operation were included because of the need for the Comission to clarify its expectations for documentation and to ensure a clear basis for enforceability and inspectability in this related area. Low-power and 2

I

t transition modes were excluded because analysis shows that important safety l- functions are protected by existing standard technical specifications in these modes.

I In a revised regulatory analysis, the Commission has revigwed the safety functions important to shutdown operation and the controls currently in place to ensure these functions. The current controls have evolved through a series of NRC and industry actions generally initiated through NRC generic communkations. These initiatives have been successful in achieving ,the ,-

acceptable level of risk that now exists at U.S. power plants. However, the Commission has also reviewed the existing body of regulations to establish the underlying regulatory requirement to sustain these practices in place. The Commission's regulatory analysis shows that a significant safety benefit relies upon measures for which a clear legal requirement does not exist.

Accordingly, the regulatory analysis shows that the proposed rule would provide a substantial increase in the overall protection to public health and safety, and that the costs of the proposed rule are justified in view of the increased protection afforded by the backfit. However, the practical effect of rule implementation is not to raise the current level of safety, but rather to ensure that the current level of safety being achieved through voluntary actions of nuclear power plant licensees will be maintained by all licensees in the future. This action is considered necessary to ensure a regulatory

'" floor" for all licensees, and preclude a withdrawal from current practice in light of continuing economic pressure to increase plant availability through shortened outages. ~

The NRC estimated the benefit of implementing the proposed rule less the cost of such implementation. The analysis was perforspd in accordance with the Commission's guidance for regulatory analysis described in NUREG/BR-0058,

" Regulatory Analysis Guidelines of the U.S. Nuclear Regulatory Commission,"

Revision 2, Final Report, November 1995, and SECY-95-028, " Issuance of Regulatory Analysis Guidelines of the U.S. Nuclear Regulatory Commission,"

February 7, 1995. Accordingly, a base case was constructed that represented the protection afforded strictly by legally enforceable requirements, i.e.,

current regulations, technical specifications, license conditions, and orders.

The base case did not credit any measures-that are voluntary or that can be unilaterally c. hanged by the licensee, such as licensee commitments made in response to generic letters and bulletins. When comparing this base case to the rule case, the Commission found the net value was $153 billion for the pressurized-water reactors (PWRs) and $5.1 billion for the boiling-water * ~*

-reactors (BWRs). This was a base-case to rule-case analysis reflecting industry-wide values in 1997 dollars.

Sensitivity analysis showed little quantitative value when comparing the voluntary case (based on the assumption that current voluntary practices remain in effect) to the rule case. This is because of the substantial measures generally adopted by industry in response to generic communications.

These measures include NUMARC 91-06, Nuclear Management and Resources Council,

" Guidelines for Industry Actions to Assess Shutdown Management," December 1991. However, there are significant non-quantifiable benefits when comparing the rule case to the voluntary case. -These non-quantifiable benefits include 3 -

l l

l the enforceability and inspectability that are facilitated by the revised proposed rule's requirements for procedures for training, quality assurance, and corrective actions. Thus, this rule would establish a clear regulatory basistoprecludelicenseesfromretreatingfromcurrentlevelslofsafety.

I IV. Basis for fuel Storage Pool Operation Requirements The revised proposed rule also contains requirements that address fuel storage pool operation. These requirements were not included in the-1994 . .-

version of the rule that was published for coment. The NRC decided to include fuel storage pool operation in this rulemaking because the NRC has found that design-basis assumptions have not been fully documented in the FSAR and have not been captured in procedures in a number of instances. To address these problems,.the NRC has prepared a new section (10 CTR 50.67(b)) on fuel storage pool operation that would require licensees to describe in the updated final safety analysis report (UFSAR) the assumptions and parameter values used in safety analyses performed by the licensee as reference bounds for design to demonstrate adequate decay heat removal for the fuel storage pool. Licensees would also be required to translate these assumptions and parameter values into operational limits in appropriate procedures.

The regulatory analysis for fuel storage pool operation shows no quantifiable risk benefit because risk is already believed to be very low.

The primary benefits of this section are non-quantifiable. These non-quantifiable benefits include improved enforceability and inspectability, and clarification of the Commission's expectations. The Comission believes this is a significant qualitative benefit in addressing the perceived need for improved regulatory controls in this area, which justifies the associated Cost. , .

V. Section-by-Section Analysis of Rule Requirements *

1. Shutdown Operations, f 50.67(a) of the proposed rule would apply to holders of operating licenses and combined licenses for commercial light-water nuclear power plants. The proposed rule is not applicable to commercial nuclear power plants that have been permanently shut down with fuel permanently removed from the reactor vessel,

a. Shutdo'wn Operations Procedures, 5 50.67(a)(1) of the proposed regulation would require holders of operating licenses and combined licen;;es " '

for a light-water reactor nuclear power plant to establish and implement procedures for complying with the requirements of paragraph (a) of the proposed rule. Procedures must address training, quality assurance, and corrective action for complying with the requirements of proposed 6 50.67(a).

Thus, procedures must be developed for establishing, monitoring, and complying with the parameter limits required by 6 50.67(a)(2)(1); activities undertaken to ensure that the safety function limits would be met; and to ensure that the mitigation capabilities required by i 50.67(a)(3) would be maintained. The Commission interprets this section to require that procedures must address all activities that can reasonably affect the reliability and availability of the decay heat removal function. The criteria for determining the adequacy of the procedures, and the methods for establishing, modifying, and superseding the 4

procedures would be set forth in the administrative controls section of the technical specifications. The Commission does not intend the changes to the procedures themselves to be subject to prior NRC review and approval.

Instead, the Commission intends the licensee to be free to change the procedures subject to NRC audit and inspection as long as the criteria for determining (the adequacy of the procedures are s)a,tisfied and the licensee complies with the methodology for changing the procedures, b.* Performance Monitoring, i 50.67 of the proposed rule would . -

require each licensee to estab'ish parame(a)(2)imits ter l for its plant that would ensure compliance with the three safety function limits specified in this paragraph, monitor the paramcters during shutdown operation, and comply with the parameter limits. The licensee need not monitor the parameters and comply with the parameter limits during those periods when the licensee has removed all of the fuel from the reactor vessel. The safety function limits have been selected by the Commission in order to ensure the safety functions of decay heat removal, reactor coolant system boundary control of the RCS and connec(RCS) inventory control, and the pressure ted systems. Some licensees may propose direct methods of measuring the parameters, using either existing or newly inst $d instrumentation. Other licensees may propose indirect methods.

Anal. s to i 50.67(a)(1), the parameters, parameter limits, and the monit ng requirements including the nature and frequency of monitoring of the pai. meters) must be s(pecified in a licensee-controlled document that is identified in (but will not be deemed to be " incorporation by reference" into) the administrative controls section of technical specifications. Therefore, licensee changes to the parameters, parameter limits and monitoring requirements in this licensee-controlled document do not require prior NRC review and approval. However, the criteria and method for licensee seiection of the parameters, parameter limits, and the nature and frequency of monitoring must be set forth in the administrative controls section of the technical specifications. This would provide the necessary assurance'and regulatory control that licensee changes will be acceptable, while maximizing the licensee's flexibility to quickly make changes during an outage to respond to changing conditions and circumstances.

The Commission regards a failure to comply with the parameter limits established for performance monitoring of parameters in i 50.67(a)(2) as a serious matter and intends to revise its enforcement guidelines to reflect the seriousness of such non-compliance. Any failure to comply with the parameter limits must be reported to the NRC in a licensee event report (LER) pursuant to i 50.73(a)(2)(1)(B), which requires an LER for "[a]ny operation or * '

condition prohibited by the plant's Technical Specifications." Furthermore, if the failure to comply with the paramet#; limits results or should have resulted in an actuation of a mitigation system, the event, along with its details, is reportable pursuant to il 50.72(b)(1)(vii) and 50.73(a)(2)(xi).

Mitigation system failure or actuation (by automatic or manual means) would still require reports if there were a need for the actuation as evidenced by exceeding a parameter limit established in the administrative controls section of the technical specifications. ,

c. Mitigation capability, i 50.67(a)(3). This provision would ensure that a backup capability exists if needed to maintain the reactor in a safe 5

condition in the event of the loss of the operating decay heat removal system.

This paragraph would require each licensee to propose in the administrative controls section of the technical specifications for shutdown operation criteria and methods for selecting structures, systems, and com)onents to cover the following three functions after the loss or interruptlon of the operating decay heat removal path: adequate core cooh ig (inventory control),

decay heat removal, and sufficient pr^'oction against the uncontrolled release of fission aroducts'. Each mitigation capability must remain functional followthg tie occurrence of an event that could interrupt or degrade the .

operating decay heat removal path. Thus, the decay heat rertNa1 path element of the mitigation capability would be in addition to the decay heat removal path that is in operation at any time. '

A licensee-controlled document would contain the butage-specific details about which pum)s, systems, .nd other equipment will be used to satisfy the

,altigation capa)ility during different portions of the outage. The document the mustbeidentifiedin(butnotbe"incorporatedbyreference"into)icensee administrative controls section of technical specifications. The v could change the outage-specific details without NRC approval as long as the approved process specified in the administrative controls section of the technical specifications is followed, for decay heat removal, licensees would be required to provide a heat removal path to meet i 50.67(a)(3) in addition to the operating decay heat removal path. The availabiltty of both trains of normal decay heat removal (or residual heat removal as it is sometimes referred to) would satisfy the requirement for both an operating and an additional decey heat removal path.

The Commission expects licensees to propose criteria such that:

(1) The selected path for the decay heat removal system will have support systems, onsite power, and cooling water available for a path to the ultimate heat sink; or (2) A aassive capability of such capacity that a sufficier.t length of time is availa)1e to reestablish a decay heat removal path before exceeding the safety function limits specified in the rule.

For adequate core cooling, licensees would be required to provide a means for maintaining the fuel cladding in a wetted condition following a core uncovery event, and maintaining the reactor in a suberitical condition. The * '

Commission expects licensees to propose such criteria in the administrative controls section of their technical specifications that the selected path would be a subsystem of the safety injection or emergency core cooling system and would be designed to withtand the safe-shutdown earthquake, thus protecting the reactor from .eismic events. in order to meet the Commission's expectations, the non-passive equipment in the selected path should be comprised of structures, systems, and components in addition to those used for the decay heat removal paths. In order for a safety injection or emergency core cooling system to be functional, the. licensee shall ensure that support systems are functional.

6

In addition to decay heat removal and inventory control, licensees shall products.sufficient protection against the uncontrolled release of fission provide During different portions of an outage, this coyld be accomplished with either an intact full-aressure primary containment orla risk-comparable alternative mitigation capa>ility, Commission defines an intact containment as one in which:for purposes of this rdlema (1) The personnel hatch is capable of being readily closed; (2) All other containment penetrations are closed with a sin capable of being remote-manual closed from the control room;gle and barrier or are (3) The differential pressure capability is comparable to that of an integral containment.

Confirmation of leak rate characteristics does'not apply. Most BWRs do not have such a containment during refueling operations and, as a practical matter, PWRs will at times have their containment open or of reduced capability during portions of an outage.

to propose criteria for inclusion in the administrative controls section ofConseque their technical primary specifications for the selection of alternatives to an intact containment.

shutdown probabilistic risk assessmentsThe Commission does not expect licensees to pe expects licensees to develop criteria bas (PRAs), liowever, the Commission ed upon risk insights that account for factors such as independence, diversity, ongoing work activities and plant state, and the defense-in-depth aspect of mitigation ordinarily provided by a containment.

The licensee need not maintain available the mitigation capability to provide adequate core cooling, decay heat removal, and sufficient protection against the uncontrolled release of fission products as required by of the proposed rule during those periods when the licensee aaragraph (a)(3) las removed all of the fuel from the reactor vessel,

d. Fire Protection, i 50.67 a licensees to minimize the frequenc(y)o(4). This provision f fires during shutdownwould require operation and their potential consequences in those areas in which a fire could impair the decay heat removal system in operation. Thus, the Commission expects licensees to control combustible materials used during an outage, control interruption of fire barriers, and control potential sources of ignition in . ~

all areas in which fire could impair the decay heat removal function.

L.icensees would also be required to limit the levels of fire damage by promptly detecting, controlling, and extinguishing fires, and to develop and implement contingency plans for maintaining the fuel cladding wetted and for restoring a heat removal path in the event of a fire in those areas that interrupts or degrades heat removal to an ultimate heat sink. Some licensees may find it necessary to install fire protection equipment for use in areas essential for removing decay heat or for adding water to the vessel. The reason for this fire protection provision is that the potentially short time to core damage would make it difficult to restore a fire-damaged system to

- service. The reason for the requirement to have contingency plans is based on the need to have a reliable source of water readily available to maintain the

} 7

wetted fuel cladding. Licensees may need to have the reactor sump available or to replenish the tank used for safety injection. As with the preceding provisions, the licensee would also be required to ensure the availability of su port systems, including emerpency onsite power sources for the safety in ection or emergency core coo ing system used for this functiqn. Lastly, th s provision would also require licensees to describe these measures in their fire protection plan. However, licensees need not actually implement the shutdown fire protection measures described in the plan for those when thd licensea has removed all of the fuel from the reactor vessel.. periods .

2.. Fuel storage Pool Operation, 5 50.67(b . This provision would

• require holders of operating licenses and combi)ed n licenses for a light-water reactor nuclear power plant, and licenses authorizing storage or movement of fuel in a fni storage pool at a ligM-water reactor nuclear power dant to document their design basis for fuel .torage pool operation. This pr w iston would not be applicable to commercial nuclear power plants that have been pemanently shut down with fuel transferred to a storage facility other than the fuel storage pool, the refueling cavity, or connected water-filled cavities. Licensees would be required to describe in the UFSAR the assumptions and parameter values used in safety analyses performed by the licensee as reference bounds for the design to demonstrate adequate decay heat removal for the fuel storage pool and to translate these assumptions and parameter values into operational limits in appropriate procedures.

3. Implementation, i 50.67(c would require licensees to develop and submit for NRC review and approval)a modification of the administrative controls section of the technical specifications required by paragraph (a),

" Shutdown Operation Procedures," within 6 months after a final rule is published. Model technical specifications are includesi as an appendix in the would require the regulatory guide associated with this rule.- 150.67(c)(2) fire protection plan required by i 50.48 to be updated by describing the various positions within the licensee's organization that are responsible for complying with i 50.67(a)(4), of this section, the authorities that are delegated to each of these positions to implement these responsibilities, and the specific features necessary for complying with 5 50.67(a)(4). This documentation is intended to be sufficiently detailed to be enforceable and inspectable. 5 50.67(c)(3) would require licensees to update their final safety analysi.s report (FSAR) to reflect the requirements of i 50.67(b) in the first scheduled ,FSAR update cycle that begins 6 months after the rule is published in final form. I 50.67(c)(4) would require licensees to revise the * "-

procedures for fuel pool storage within 12 months after the rule is published in final form.

4. Definitions, I-50.2.= This provision would define ' shutdown operation" consistent with the mode definitions found in individual plant technical specifications.

5. Maintenance Rule, 5 50.65(b)(1)(iv). This provision would require non-safety-related structures, systems, and components necessary for compliance with i 50.67 to be covered by the monitoring program of the maintenance rule. Safety-related structures, systems, and components 8

b

i necessary for compliance with i 50.67 are already covered by the maintenance rule.

6. FSAR Rulo, i 50.34(b). This paragraph would clarify that future applicationsforoperatinglicensesandcombinedlicensesmustlincludethe design assumptions and parameters used as reference bounds for design to demonstrate adequate decay heat removal for the fuel storage pool. The l Commission believes-that an explicit requirement to include the fuel storage pool design assumptions and parameters in the FSAR will end any ambiguity with. -

respect to the necessity for inclusion of such information in the FSAR pursuant to i 50.34.

• 7.

EventReportSystem,550.73(a)(2)q(xi).Innediate Notification These provisions Re the would require uirement, 1- i 50.72(b)(1)(v hour reports via the emergency nothfication system and licensee event reports.

Real actuations of a shutdown mitigation system, failures of a mitigation system to respond, and failures to actuate a mitigation system manually when it should have been manually actuated would all be reportable.

8 License Renewal, 5 54.4(a)(3). This provision would reflect a change in scope consistent with i 50.67 so that non-safety related structures, systems, and components necessary for compliance with i 50.67 would be included within the scope of the license renewal rule. Safety related structures, systems, and components necessary for compliance with i 50.67 are already within the scope of license renewal in accordance with 6 54.4(a)(1).

VI. Consents on the 1994 Proposed Rule The period for commenting on the,1994 proposed rule closed on February 3, 1995. There were 1023 connents received from 49 different commenters.

Comments were received on the proposed rule, the regulatory analysist and the regulatory guide. All comments were considered in formulating the revised proposed rule, regulatory analyses, and regulatory guide.

The 49 sources of comment consisted of two licensed operators, five utility owners' groups, 39 utilities, the Nuclear Energy Institute (NEI),

Engineering planning and Management, Inc., and one public interest group. The five utility owners' groups were the Combustion Engineering Owners Group (CE0G), the Boiling Water Reactor Owners Group (BWROG), the Westinghouse Owners Group (WOG), the Babcock and Wilcox Owners Group (BWOG), and the ,

Nuclear Utility Backfitting and Reform Group (NUBARG), which was represented by Winston and Strawn. .

Among the 1023 comments were the following four letters received before the proposed rule was published: (1) letter from Thomas E. Tipton (NUMARC) to William T. Russell (NRC), dated January 11, 1994; (2)letterfromRaymond-Burski (CEOG) to William T. Russell (NRC), dated April 8, 1994; (3) letter from William H. Rasin (NEI) to Edward L. Jordan (NRC), dated March 28, 1994; and (4) letter from William Bray (NEI) to Chairman Ivan Selin (NRC), dated May 25, 1994. Several of the comments on the prepublication rule were reiterated by the same commenters in separate letters after the initial proposed rule was issued.

9 l

l 1

About 379 coments addressed the regulatory analysis. There were 82 coments that addressed the regulatory guide. Most commenters stated that there was no need for the proposed rule because no consideration had been given to'significant industry changes to improve safety. Manylcommenters stated that the regulatory anal, sis was based on outdated info $ation and contained assumptions that did not accurately portray risk, implementation cost, or safety benefit. Many commenters also stated that the regulatory guide was a restatement of the proposed rule and did not contain sufficient guidance or clarification. . .

In response to the public comments, the staff rewrote the 1994 proposed rule, the associated regulatory guide, and the regulatory analysis to more clearly reflect NRC regulatory requirements and to provide more flexibility to licensees in meeting these requirements (i.e., a rule with some performance elements). Because of the substantial revision to the 1994 proposed rule and because the revised proposed rule is being reissued for public comment, the Comission has determined that a detailed analysis of the public coments and responses to the coments on the 1994 proposed rule would not be useful.

VII. Request for Public coments Coments on the revised proposed rule, the draft regulatory guide, and the regulatory analysis may be submitted to the Secretary, U.S. Nuclear Regulatory Comission, Washington, DC 20555-0001, Attention: Docketing and Service Branch. Please refer to the next section, ' Availability of Documents," for information on obtaining copies of these documents. In addition, the Comission requests public coments on the following issues:

Issue 1. The Commission has developed.the requirement.s in 5 50.67(a)(3) based upon its understanding of the designs for representative boiling-water reactor (BWR) and pressurized-water reactor (PWR) plants. However, there may be specific plants whose approved designs are such that compliance with the requirements of 5 50.67(a)(3) may represent a substantial cost, or may be impractical. For example, some plants do not have containments during shutdown and may need to take credit for an alternative means of achieving comparable levels of safety. Licensees whose plants have been licensed with plant designs that would require substantial modification to comply with the requirements qf i 50.67(a)(3) of the proposed rule, or for which compliance would be impractical, are asked to identify their design bases with a concise explanation of why compliance with the requirements of 5 50.67(a)(3) woulci be " ,

impractical or would otherwise result in inordinate costs. In this regard, licensees are also asked to present alternatives that achieve the same level of risk reduction.

Issue 2. The Comission is interested in detailed coments relating to the cost, operational burden, and safety benefit to be derived from the proposed rule. Comments that discuss alternative approaches to achieving safety with the least burden are desired.

Issue 3. The Comission is interested in obtaining additional information on the risk of shutdown and low-power operation and insights on whether the Comission should engage in a more detailed quantitative examination of risk 10

during shutdown and low-power operation at representative nuclear power plants. Would such a study be warranted in order to specify limits on the tolerable durations of plant configurations that pose very high risks? How could the rule be structured to better reflect the risk insights and strategies commonly used to develop sof tware tools now in use tty the industry for outage )lanning, such as the Electric Power Research Institutes's ORAM (Outage Ris( Assessment and Management).

Issue 4. The Comission is interested in determining how licensees could best. -

structure the administrative controls section of their technical specifications to achieve the objectives of the rulemaking. Should the' technical specifications required by this rulemaking be placed in a separate section of plant technical specifications that addresses only shutdown operation?

VI!!. Availability of Documents Copies of NRC documents, including the regulatory guide and regulatory analysis, are available for public inspection and copying for a fee at the NRC Public Document Room (PDR) at 2120 L Street, NW. (Lower Level), Washington, DC 20037.

Copies of NRC reports in the NUREG series may be purchased from the Superintendent of Documents, U.S. Government Printing Office, by calling 202-275-2060 or by writing to the Superintendent of Documents, U.S. Government Printing Office, Hall Stop SSOP, Washington, DC 20402-9328. Copies are also available from the National Technical Information Service, 5825 Port Royal Road, Springfield, VA 22161.

^

Copies of the regulatory analysis and of the prop'osed regulatory guide are available from the Superintendent of Documents. Prospective commenters may also request single copies from Mr. Kulin Desai, Reactor Systems Engineer, Reactor Systems Branch, Division of Systems Safety and Analysis, Office of Nuclear Reactor Regulation, Mail Stop 0-8E23, U.S. Nuclear Regulatory Comission, Washington, DC 20555-0001, Telephone: 301-415-2835; e-mail:

KDD9nrc. gov.

. IX. Electronic Access Coments may be submitted electronically, in either ASCl! text or Wo.rd Perfect format (version 5.1), by calling the NRC Electronic Bulletin Board on " '

FedWorld. The bulletin board may be accessed using a personal computer, a modem, and one of the commonly available communications software packages, or directly via Internet. Some of the documents related to this rulemaking are also available for downloading and viewing on the bulletin board.

If using a personal computer and modem, the NRC subsystem on FedWorld can be accessed directly by dialing the toll-free number: 1-800-303-9672.

Comunications software parameters should be set as follows: parity to none, data bits to 8, and stop bits to I (N,8,1). Using ANSI or VT-100 terminal emulation, the NRC rulemaking subsystems can then be accessed by selecting the

" Rules Menu' option from the "NRC Main Menu." For further information about 11

options available for NRC at FedWorld, consult the ' Help /Information Center' from the 'NRC Main Menu " Users will find the 'FedWorld Online User's Guides' particularly helpful. ManyNRCsubsystemsanddatabasesalsohavea

' Help /Information Center" option that is tailored to the particular subsystem.

The NRC subsystem on FedWorld can also be accessed b a d rect-dial phone number for the main NJWorld BBS: 703-321-8020; Telnet via Internet:

fedworld. gov (192.239.93.3); File Transfer Protocol (FTP) via Internet:ftptfedworld. gov (192.239.92.205); and World Wide Web using:- . .-

http://www.fedworld. gov (this is the Uniform Resource locator (URL)). ,

If using a method other.than the toll-free number to contact FedWorld, access the NRC subsystem from the main FedWorld menu by selecting "F --

Regulatory, Government Administration and State Systems," then selecting "A -

Regulatory Information Mall." At that point, a menu will be displayed that has an option "A - U.S. Nuclear Regulatory Commission' that will take you to -

the NRC Online Main-Menu. You can also go directly to the NRC-Online area by typing */go nrc' at a FedWorld command line. If you access NRC from FedWorld's Main Menu, then you may return to FedWorld by selecting the ' Return to FedWorld" option from the NRC Online Main Menu. However, if you access NRC at FedWorld by using NRC's toll-free number, then you will have full access to all NRC systems, but_ you will not have access to the main FedWorld system.

For more infomation on NRC bulletin boards, call Mr. Arthur Davis, Office of Infomation Resources Management, Systems Development and Integration Branch, U.S. Nuclear Regulatory Commiission Telephone: 301-415-5780; e-mail:

AXD39nrc. gov.

X. Criminal = Penalties For purposes-of Section 223 of the Atomic Energy Act of 1954, as amended (AEA), the Commission proposes to issue the proposed rule under one er more of sections 161b,1611, or 161o of the AEA. Willful violations of the proposed rule are subject to criminal enforcement.

XI. Finding of Mo significant Environmental Impact

-The Commission has detemined under the National Environmental Policy Act of- 1969, as amended, and the Commission's regulations in Subpart A of 10 CFR Part 51, that-this proposed rule -if adopted -will not have a significant impact on the environment. The actions resulting from this proposed rule,, if ' , ,

adopted, would reduce the core-damage frequency and risks during shutdown operation. Therefore, the Conwission concludes that there will be no significant impact on the environment from this proposed rule. This discussion constitutes.the environmental assessment and finding of no significant impact for this proposed rule.

XII. Paperwork Reduction Act Statement This proposed rule amends information collection requirements that are

-subject to the Papemork Reduction Act of. 1995 (44 U.S.C. 3501 et seq.). This rule has been submitted to the Office of Management and Budget (OMB) for review and approval of the infomation collection requirements.

12

The public reporting burden for this collection of information is estimated to average 3000 hours0.0347 days <br />0.833 hours <br />0.00496 weeks <br />0.00114 months <br /> per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. The l U.S. Nuclear Regulatory Comission is seeking public coment on, the potential impact of the collection of information contained in the proposed rule and on the following issues:

1

1. Is the proposed collection of information necessary for the ) roper .

performance of the functions of the NRC, including whether tie information will have practical utility? *

2. Is the estimate of burden accurate?

3. Is there a way to enhance the quality, utility, and clarity of the information to be collected?

4. How can the burden of the collection of information be minimized, including the use of automated collection techniques?

Send comments on any aspect of this proposed collection of information, including suggestions for reducing the burden, to the Information and Records Management Branch (T-6F33), Office of Information Resources Management, U.S.

Nuclear Regulatory Comission, Washington, DC 20555-0001, or by the Internet electronic mail at BJS19nrc. gov; and to the Desk Officer, Office of Information and Regulatory Affairs, NE0B-10202 (3150-0011), Office of Management and Budget, Washington, DC 20503, Comments to OMB on the collections of information or on the preceding issues should be submitted by (insert date 30 days after publication in the federal Register). Comments received after this date will'be considered if it is practical to do so, but assurance of consideration cannot be given to comments received after this date.

Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, a. collection of information unless it displays a currently valid OMB control number.

XIII. Regulatory Analysis *

• The NRC has prepared a regulatory analysis for this rule that examines the costs and benefits of the rule and alternatives considered: " Regulatory Analysis for the Proposed i 50.67 ' Shutdown and Fuel Storage Pool Operation at Nuclear Power Plants'," United States Nuclear Regulatory Commission, July 24, 1997.

The proposed rule's general requirements for shutdown operation are quantitatively analyzed in the main section of the regulatory analysis. The requirements applicable to fuel storage pool operation and for fire protection during shutdown are qualitatively analyzed in Appendix A and Appendix B, 13 <

respectively. The regulatory analysis for the general shutdown operations requirements establishes that shutdown operation is important and that the proposed rule would significantly reduce risk to public health ,and safety, and it will accomplish this in a ec:t beneficial wi w , as evidenced by the-large net values for both PWRs and BWRs. l The regulatory analysis for the fuel storage pool concludes that the proposed requirements would result in a substantial increase in protection to public health and safety due to improved enforceability and inspectability.of . -

the design basis for the fuel storage pool, assuming that fuel storage pool operating procedures are consistent with design parameters and assumpti6ns.

The regulatory antlysis for the fire protection requirements during shutdown' operation concludes that the proposed fire protection requirements would result in a substantial decrease in risk due to fires during shutdown operations and that the cost of implementation of about $1 million per would be justified in light of the substantial increase in protection._ plantCopies of the regulatory analysis are available as stated in Section VIII,

" Availability of Documents."

XIV. Regulatory Flexibility certification in accordance with the Regulatory Flexibility Act of 1980 (5 U.S.C.

605(b)), the Commission certiftes that this proposed rule, if promulgated, will not have a significant economic impact on a substantial number of small entities. This proposed rule would affect only the licensing and operation of nuclear power plants. The companies that own these plants do not fall within the scope of the definition of "small entities" as specified in the Regulatory Flexibility Act or the Small Business Size Standards in regulations issued by the Small Business Administration at 13 CFR Part 121.

XV. Backfit Analysis The Comission's backfit analysis for this rulemaking is found in Section 1.4 of the regulatory analysis and Section 2.0 of 10 CFR Part 50, Appendix A.

Refer to Section Vill, " Availability of Documents," of this notice for information on obtaining copies of these documents. The backfit analysis concludes that, the proposed rule's would result in a substantial increase in protection to public health and safety and that the associated costs are justified in light of this increased protection. , ,

List of Subjects 10 CFR Part 50 Antitrust, Classified infomation, Criminal penalties, Intergovernmental relations, Nuclear power plants and reactors, Radiation protection, Reactor siting criteria, Reporting and recordkeeping requirements.

14

_ _ = _ _ = = = = =

iib i i iii i i i

10 CFR Part 54 l Administrative practice and procedure, Age-related degradation, Backfitting, Classified information, Criminal penalties, Environmental 3rotection, incorporation by reference, Nuclear power plants arjd reactors, leporting and record keeping requirements.

For the reasons given in this statement of consideration and under the authority of the Atomic Energy Act of 1954, as amended; the Energy - s . .-

Reorganization Act of 1974, as amended; and 5 U.S.C. 553; the NRC is pr,oposing to adopt the following amendments to 10 CFR Parts 50 and 54.

PART 50 - DOMESTIC LICENSING 0F PRODUCTION A2 UTILIZATION FACILITIES

1. The authority citation for Part 50 continues to read as follows:

AUTHORITY: Secs. 102, 103, 104, 105, 161, 182, 183, 186, 189, 68 Stat.

936, 937, 938, 948, 953, 954, 955, 956, as amended, Sec. 234, 83 Stat. 1244, as amended (42 U.S.C. 2132, 2133, 2134, 2135, 2201, 2232, 2233, 2236, 2239, 2282); Secs. 201, as amended. 202, 206, 88 Stat. 1242, as amended, 1244, 1246 (42 U.S.C. 5841, 5842, 5846), E.0. 12829, 3 CFR, 1993 Comp., p. 570; E.O.

12958, as amended, 3 CFR, Comp., p.333; E.O. 12968, 3 CFR, 1995 Comp., p. 391.

Sec. 50.7 also issued under Pub. L.95-601, Sec.10, 92 Stat. 2951 as amended by Pub. L. 102-486, Sec. 2902, 106 Stat 3123 (42 U.S.C. 5851). Sec.

50.10 also issued 'under Secs. 101, 185, 68 Stat. 936, 955, as amended (42 U.S.C. 2131, 2235); Sec. 102, Pub. L.91-190, 83 Stat. 853 (42 U.S.C. 4332).

Secs 50.13, 50.54(dd), and 50.103 also issued under Sec.108, 68 Stat. 939, as amended (42 U.S.C. 2138). Secs. 50.23. 50.35, 50.55, and 50.56 also issued under Sec. 185, 68 Stat. 955 (42 U.S.C. 2235). Secs. 50.33a, 50.55a and Appendix Q also issued under Sec.102, Pub. L.91-190, 83 Stat. 853 ('42 U.S.C.

4332). Secs. 50.34 and 50.54 also issued under Sec. 204, 88 Stat. 1245 (42 U.S.C. 5844). Secs. 50.58, 50.91, and 50.92 also issued under Pub. L.97-415, 96 Stat. 2073 (42 U.S.C. 2239). Sec. 50.78 also issued under Sec. 122, 68 Stat. 939 (42 U.S.C. 2152). Secs. 50.80-50.81 also issued under Sec. 184, 68 Stat. 954, as amended (42 U.S.C. 2234). Appendix F also issued under Sec. 187, 68 Stat. 955 (42 U.S.C. 2237).

2. In i 50.8, paragraph-(b) is revised to read as follows:

i 50.8 Information collection requirements: OH8 approval.

(b) The approved information collection requirements contained in this part appear in il 50.30, 50.33, 50.33a, 50.34, 50.34a 50.35, 50.36, 50.36a, ,

50.36b, 50.44, 50.46, 50.47, 50.48, 50.49, 50.54, 50.55, 50.55a 50.59, 50.60, 50.61, 50.62, 50.63, 50.64, 50.65, 50.66, 50.67, 50.71, 50.72, 50.73, 50.74, 50.75, 50.80, 50.82, 50.90, 50.91, 50.120, and appendices A, B, E, G, H, 1. J, K, M, H, 0, Q, R, and S to this part.

15

__ a

3. Section 50.2 is revised by adding in alphabetical order the definition for Shutdown operation as follows:

i 50.2 Definitions  !

l Shutdown operatfon means the reactor coolant system (RCS) is in Cold Shutdown or Refueling (as defined in a plant's technical specsfications) and one or more fuel assemblies are located in the reactor vessel or in the refueling cavity. Shutdown operation is a part of normal operation. - - -

4. Section 50.34 is revised to read as follows:

i 50.34 Contents of applications; technical information.

(b)

(12) The assumptions and parameter values used in safety analyses required by i 50.67(b) as reference bounds for design to demonstrate adequate decay heat removal for the fuel storage pool.

5. Section 50.65(b) is revised to insert a new subparagraph (b)(2)(iv) as follows:

i 50.65 Requirements for monitoring the effectiveness of maintenance at nuclear power plants.

(b)

(2)

(iv) necessary for compliance with 5 50.67 of this pa,rt.

6. A new i 50.67 is added to read as follows:

5 50.67 Shutdown and Fuel Storage Pool Operations at Nuclear Power Plants (a) Shutdown Operations. Holders of operating licenses and combined licenses for a light-water reactor nuclear power plant, except those plants that have been permanently shut down with fuel permanently removed from the reactor vessel., shall comply with the following requirements except when all fuel has been transferred out of the reactor vessel:

(1) Shutdown Operation Procedures, l.icensees shall establish and implement procedures (including procedures for training, and quality assurance and corrective action measures) for the activities for complying with the requirements of paragraph (a) of this section. Except for those procedures necessary for com)1ying with paragraph (a)(4) of this section, the criteria for determining tie adequacy of the procedures and the method for establishing, modifying, and superseding the procedures must be described in the administrative controls section of technical specifications.

(2) Performance Monitoring.

16

(1) Licensees shall establish, monitor, and comply with parameter limits during shutdown operation. The parameter limits must ensure compliance with the following safety function limits: ,

qA) Decay heat removal such that the water temperature abhe the reactor core 1s less than the saturation temperature.

(B) Reactor Coolant System (RCS) inventory control such that the RCS water level is sufficient for reliable operation of the normal means of decay heat removal, (C) RCS and connected systems pressure control such that the design pressure and Low Temperature Overpressure Protection (LTOP) settings are not exceeded.

(ii) The parameters, parameter limits, and monitoring requirements (including the nature and frequency of monitoring) must be identified and described in a licensee-controlled documer.t that is identified in the administrative controls section of the technical srecifications. The criteria and method for licensee selection of the parameters, the parameter limits, and the nature and frequency of monitoring must be desciibed in the administrative controls section of technical specifications.

(3) Mitigation Capability. Licensees shall maintain available a mitigation capability to provide adequate core cooling, decay heat removal, and sufficient protection against the uncontrolled release of fission products following the loss or interruption of decay heat removal during shutdown operation. The structures, systems, and components for complying with this section must be identified in a licensee-controlled document that is identified in the administrative controls section of the technical specifications. The criteria and method for licensee selection of the' structures, systems, and components necessary for complying with this section must be described in the administrative controls section of technical specifications.

(4) Fire Protection. -

(i) Licensees shall:

(A) Minimize the frequency of fires during shutdown operation; ,

(B) Maintain the decay heat removal function free of fire damage or limit the levels of fire damage by promptly detecting, controlling, and extinguishing fires that do occur, and (C) Develop and implement a contingency plan for maintaining adequate core cooling and in a timely fashion restoring decay heat removal in the event of a fire in those areas that interrupts or degrades heat removal to an ultimate heat sink.

17

(ii) The provisions necessary for complying with this paragraph (including the contingency plan) must be described in the fire protection plan required by 10 CFR 50.48. ,

(b) Fuel Storage Pool Operation. Holders of licenses authbrizing storage or movement of fuel in a fuel storage pool refueling cavity or connected water-filled cavity at a light-water reactor nuclear power plant shall describe in the updated final safety analysis report the assumptions and parametbr values used in safety analyses performed by the licensee ass ~

reference bounds for design to demonstrate adequate decay heat removal for the fuel storage pool and ensure that the procedures for the fuel storage pool contain operational limits that incorpnrate the assumptions and parameter '

values in the updated final safety analysis report.

(c) Implementation. Each licensee shall:

(1) Develop and submit for NRC review and approval trchnical specifications required by paragraph (a) of this section by (INSERT EFFECTIVE DATE OF FINAL RVLE PLUS 6 MONTHS);

(2) Update the fire arotection plan required by i 50.48 of this part by (INSERT EFFECTIVE DATE OF clNAL RULE PLUS 12 MONTHS) by describing the various positions within the licensee's organization that are responsible for complying with paragrash (a)(43 of this section, the authorities that are delegated to each of tiese positions to implement these res >onsibilities, and the specific features necessary for complying with paragrap1 (a)(4); and (3) Revise their updated final safety analysis report as required by paragraph (b) of this section at the next scheduled revision following (INSERT EFFECTIVE DATE OF FINAL RULE PLUS 6 MONTHS); ,

(4) Revise the procedures for the fuel storage pool as required by paragraph (b) of this section by (INSERT EFFECTIVE DATE OF FINAL RULE PLUS 12 MONTHS).

7. Section 50.72 is revised to insert a new subparagraph (b)(1)(vii) as follows:

i 50.72 Immediate notification requirements for operating nuclear power reactors. . . , .

(b) * * *

(1)

(vii) Any event that results or should have resulted in the actuation of the mitigation capability required by i 50.67(a)(3).

8. Section 50.73 is revised to insert a new subparagraph (a)(2)(xi) as follows:

6 50.73 Licensee event report system.

(a) 18

(2) * * *

(xi) Any event that results or should have resulted in the actuation of the mitigation capability required by i 50.67(a)(3).

PART 54 -- REQUIREMENTS FOR RENEWAL OF OPERATING LICENSES FOR NGCLEAR POWER PLANTS

9. The authority citation for Part 54 continues to read as followst , .-

AUTHORITY: Secs. 102, 103, 104, 161, 181, 182 183, 186, 189, -

68 Stat. 936, 937, 938, 948, 953, 954, 955, as amen,ded, sec. 234, 83 Stat.1244, as amended (42 U.S.C. 2132, 2133, 2134, 2135, 2201, 2232, 2233, 2236, 2239, 2282); secs 201, 202, 206, 88 Stat.1242, 1244, as amended (42 U.S.C. 5841, 5842), E.O.12829, 3 CFR 1993 Comp., p. 570; E.O.12958, as amended, 3 CFR,1995 Comp., p. 333; E.O.12968, 3 CFR,1995 Comp., p. 391.

10. Section 54.4 is revised to read as follows:

6 54.4 Scope.

All systems, structures, and components relied on in safety analyses or plant evaluations to perform a function that demonstrates compliance with the Comission's regulations for fire protection (10 CFR 50.48), environmental qualification (10 CFR 50.49), pressurized thermal shock (10 CFR 50.61),

anticipated transients without scram (10 CFR 50.62), station blackout (10 CFR 50.63), and shutdown and fuel storage pool operations (10 CFR 50.67).

Dated at Rockville, Maryland, this _th day of September 1997 For the Nuclear Regulatory Comission.

John C. Hoyle,

. Secretary of the Commission.

.w- th 19 -

Attachment 3 AE971 United States Nuclear Regulatory Cod 1 mission Regulatory Analysis for the Proposed Regulation 5 50.67, " Shutdown and Fuel Storage Pool Operations at Nuclear Power Plants" July 24,1997

Table of contents -

I Section p3gg 1

INTRODUCTION 1.1 Objective and Problem .. .................... ,..... 1 1.2 Background and History of ................. Events................) ..... 1 2

1.3 Cases Used for Analysis ...

1.4 Backfit Rule-

. . . . . . . . ................... ................. 5 6

.c : , ,-

2' IDENTIFICATION AND PRELIMINARY ANALYSIS OF ALTERNATE APPROACHES . . . 10 2.1 Take No Action . . . . . . . . . . . . . . . . . . . , . . . . . ' . 10 2.2 Issue an Information Notice ................... 10 2.3 Issue a Generic Letter or Bulletin 2.4 ................ 10 Implement the Rule Published in 59 TR 52707 ........... 10 2.5 Rewrite the Maintenance Rule (i 50.65) .............. 11 2.6 Modify and Prepare Technical Specifications Without Rulemaking . . 11 2.7 la lement a Risk-Informed Rule With Performance Elements . . . . . 11 2.8 Im lament a Rule Applicable Solely to PWRs ............ .

11 2.9 Im lement a Rule Applicable to PWRs During Midloop or Reduced Inventory ............................ 11 3 ESTIMATION AND EVALUATION OF VALUES AND IMPACTS........... 11 3.1 Probabilistic Risk Assessment .................. 12 3.2 Estimation of Values ....................... 14 3.3 Estimation of Impacts ...................... 15 3.4 Evaluation of Values and Impacts ................. 15 3.4.1 ............... 16 3.4.2 Avoided Public Avoided Occupational Health Health Ris Risk............

(VI)k (V2) 18 3.4.3 Avoided Offsite Damage to Property (V3) ............ 18 3.4.4 . Avoided Onsite Power Replacement and Cleanup (V4)- ...... 19 3.4.5 Routine Occupational Health Risk (VS) ....;.... .. 19 3.4.6 ................. 20 3.4.7 CostsorSavingsto-NRC(II)icensees(12)

Direct Costs or Savings to L .......... 21 4 DISCUSSION OF RESULTS ........................ 24 4.1 Net Value ............................ 26

'4.2 Attributes for Each Case ..................... 26 4.3 Non-Quantifiable or Poorly Quantifiable Attributes ........ 27 4.4 Key Ass'umptions ......................... 27 4.4.1 Base Case 27 4.4.2 Voluntary Action Case. . . . . . . . . . . . . . . . . . . . . . . ... /.

................... 27

"^

4.4.3 Rule Case .......................... 28 .

5 -RATIONALE FOR-SELECTING THE PROPOSED ACTION . . . . . . ._. . . . . . 29 5.1 Relationship to Other NRC Programs and Requirements ....... 29 5.2 Statement of Proposed Generic Requirement ............

30 5.3 Statement Regarding Nature of Proposed Requirement ........ 34 6 IMPLEMENTATION . . . . . . . . . . , . . . . . . . . . . . . . . . .

, 34 7 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . .-. . . . 34 i

• Appendix A: Regulatory Analysis " Fuel Storage Pool Operation" . . . . . . A-1 Appendix B: Regulatory Analysis Supplement " Fire Protection for Shutdown Operation" . . . . . . . . . . . . . . . . . . . . . . . . , ..... B-1 I

4 y b

A .

9

.h -b

+

ii

Regulatory Analysis for the Proposed Regulation i 50.67, ' Shutdown and Fuel Storage Pool Operations at Nuclear Power Plants" l

s 1 INTRODt)CTION This regulatory analysis assesses the proposed rule in accordance with the linited 50.109, States Nuclear "Backfitting," and theRegulatory guidance in Commission's SECY-95-028 and(NRC's) NUREG/BR-0058 regulations,10 CFf.

This analysis has three separate sections. The first section discusses shutdown operations exclusive of proposed fire protection requirements. The second section, which is Appendix A to this regulatory analysis, discusses the fuel pool regulatory analysis. The third section, which is Appendix B, discusses the fire protection regulatory analysis. Because of the degree of quantitative assessment associated with the first section, it is separate from the regulatory analysis for those aspects of the proposed rule regarding the fuel storage pool and fire protection during shutdown o)erations. For fire protection, a detailed quantification is not practical secause of the many plant-specific dependencies.

1.1 Objective and Problem The objective of the pro)osed rule is to establish a clear regulatory framework for assuring t1at cold shutdown, refueling gutages and fuel pool o)erations continue to be conducted in a safe manner. To accomplish this o)jective for cold shutdown and refueling operations, licensees shall modify their administrative controls section of the technical specifications in accordance with the requirements of the rule, and have procedures for performance monitoring and other activities important to safety. To accomplish this objective for fuel pool operation, licensees shall appropriately document factors important to safety in the FSAR and operating procedures.

Existing regulatory controls for shutdown operations have evolved through a series of NRC and industry actions generally initiated as a result of NRC generic communications. Such measures have been successful in achieving 'the acceptable level of safety which exits at plants today. However, to prevent " ^

licensees from retreating from these voluntary measures to the minimum recuirements of existing regulations, a comprehensive and coherent codification has been proposed to address a wide range of considerations.

These include quality assurance for cold shutdown equipment, inventory and pressure control during shutdown operations, availability of mitigation equipment, fire protection and containment. The staff's review found that much of the equipment used during cold shutdown is not safety-related or is See section 7 for a cceptete list of references, incLtding titles, authors, ard publication dates of docments referenced here.

1

. , _ , _ _ , ___.mm_m -

not required to be in a safety-related configuration and therefore is not subject to the QA requirements of 10 CfR Appendix B. PWRs are not currently requiredtohaveanECCSinjectioncapabilityduringcoldshutpownor refueling. BWRs are not required to maintain pressure control, capability during cold shutdown. This is risk significant because if thetvessel were to pressurize in an accident, pressure relief is necessary to permit low pressure injection. Although backup decay heat removal systems are required during cold shutdown, the associated support systems necessary for mitigative decay heat removal capability are not required. Containment is not requiredrduring -

cold shutdown and thus control of the release of fission prooucts following an accident is unaddressed. Fire protection during cold shutdown is large'ly unaddressed despite initiating frequencies comparable to power operation. The risk from fire is the aroduct of several factors besides initiating frequency and virtually all of tiese factors are under significant regulatory control during operation but not cold shutdown. In addition, many BWRs rely on inerted containment to address fire in containment during power operation but inerting is not available during cold shutdown and refueling.

1.2 Background and History of Events Over the past several years, the NRC has become increasingly concerned about the potential for loss of the residual heat removal (RHR) capability during shutdown periods. Several serious incidents involving loss of RHR prompted the NRC to reexamine the entire scope of shutdown operation.

In 1980 an event occurred involvi.)g loss of both RHR trains at Davis-Besse.

This resulted when one RHR pum) failed while the second pump was already out of service. After reviewing tits event, the NRC concluded that control of RHR availability was inadequate and issued Generic Letters 80-42 and 80-53. These generic letters proposed technical specifications that require the availability of two RHR pumps for many shutdown conditions;

• In 1986 one of the San Onofre units lost RHR during a particularly sensitive shutdown condition referred to as "midloop operations." (Duringmidloop operations, the water in the reactor coolant system (RCS) is partially drained to allow access to the steam generators and other components.) A few months later, on April 10, 1987, Diablo Canyon lost RHR despite licensee knowledge of the San Onofre event and despite precautions taken by the Diablo Canyon licensee to preclude a similar event. At Diablo Canyon, the water was drained too low and the RHR pumps failed because of air in their intake lines, After * ,

reviewing the event, NRC issued Generic Letter 87-12, which established that aspects of the Diablo Canyon event were generic to operation of all pressurized water reactors (PWRs). After further assessment of the technical issues, and applying probabilistic risk assessment (PRA) techniques, the NRC concluded that the risk of some shutdown operations should be reduced. The NRC then issued Generic Letter 88-17, which focused on PWR reduced inventory operation (watcr level lower than 3 feet below the reactor vessel flange). It covered many shutdown concerns, including instrumentation, controls, procedures, understanding, and training.

In response to Generic Letter 88-17, all licensees operating PWRs improved reduced inventery operation and other aspects of shutdown operation.

2

inspections found that licensees often failed to adequately address containment closure and water level measurements. Among other weaknesses were inadequacies in procedures, understanding of thermal-hydraulic behavior, understanding of accident behavior, and other instrumentation.

The loss during shutdown of all vital ac power at the Alvin W. Vogtle, Jr.,

nuclear plant on March 20, 1990, was judged to have particularly serious 1mpilcations, and the-NRC sent an incident investigation team to the plant.

The temin's re > ort (NUREG-1410) identified weaknesses in the licensee's : -

response to G. 88-17, the need for improvements, the need for risk management of shutdown operations, and the need for overall management of shutdown operations. Discussions with re organizations (French, Japanese,presentatives of foreign regulatory and Swedish authorities reinforced NRC staff concerns that the core-damage probability for shutdown op)erations can be a substantial fraction of the total core-damage probability. Consequently, the staff initiated a study of shutdown and low-power operations at U.S.

commercial nuclear power plants.

The NRC staff reviewed shutdown operating experience at nuclear )ower plants by studying licensee event reports (LERs), reports prepared by tie Office for Analysis and Evaluation of Operational Data (AE00), and various inspection reports such as NUREG-1410 (the loss of all vital ac power event at Vogtle in 1990). The NRC staff also reviewed events at foreign nuclear power plants using information found in the foreign events file maintained for AE00 at the Oak Ridge National Laboratory. The staff visited 11 plant sites to broaden its understanding of shutdown operations, outage planning, outage management, and startup and shutdown activities. The NRC staff performed thermal-hydraulic and risk assessment scoping analyses to gain insights about the relative importance of events and phenomena, ,

industry also began to respond to increasing concerns regarding shutdown operations following the loss-of-RHR event at Diablo Canyon in 1987 (NUREG-1269). Following issuance of GL 87-12 (1987) and GL 88-17 (1988), the initial emphasis was on PWRs. The entire industry actively addressed shutdown operations problems following the Vogtle event (NUREG-1410), furnished support to NRC fact-finding and information exchange visits to U.S. nuclear power plants, and supported an industry initiative (NUMARC 91-06) that was implemented, at least in part, by the end of 1992 at every operating U.S.

nuclear )ower plant. The Industry has addressed outage planning and control with suci programs as workshops, Institute of Nuclear Power Operations .

inspections, Electric Power Research Institute support, enhanced training, and improved procedures. The NUMARC 91-06 initiative established high-level guidelines for self-assessment of shutdown operations that address many of the areas that need improvement. Further, industry's defense-in-depth concept for safety functions and outage strategy contained in NUMARC 91-06 represent good self-improvements in the shutdown operations area.

The NRC published the results of its evaluation in NUREG-1449 " Shutdown and low-Power Operation at Commercial Nuclear Power Plants in the United States" (September 1993). It reported that public health and safety were protected during shutdown operation, but that substantial safety improvements were justifiable. In particular, the study concluded that although shutdown risks 3

i

l l

l have been reduced at many plants through improvements to outage programs, the improvements are unevenly and inconsistently applied across the industry and significant precursor events continue to occur. The report noted that a significant lack of controls, including lack of regulatory controls, allows plants to enter circumstances likely to challenge safety funct1ons with minimal mitigation equipment available and containment capability not established, it was 41so noted that current NRC requirements in the area of fire protection 1:e.', 10 CFR Part 50, Appendix R) do not apply to shutdown conditions, even(though significant maintenance activities, which can increase ~

the potential for fire, do occur during shutdown. The report recommended that licensees perform fire hazard analyses with a focus on RHR systems. Technical specifications for residual heat removal, ensergency core cooling, and containment systems were judged to be of insufficient detail to address the number and risk significance of RCS configurations during shutdown. Careful outage planning and well-trained and well-equipped c)erators were found to '

play a significant role in accident mitigation for slutdown events, but training and procedures for use of effective passive methods of decay heat removal were lacking. The NRC has also completed probabilistic risk studies of shutdown operation at the Surry and Grand Gulf 31 ants; these concluded that operations during shutdown significantly contriaute to overal1 plant risk.

Furthermore, these studies indicate that risk per unit time during normal shutdown activities can be higher than during power operation.

The NRC updated the NUREG-1449 events information by means of a preliminary survey and assessment based upon readily available information for 1993, 1994, and the first five months of 1995 (Michel Labatut and Mohammed Shuaibi,

' Review of Recent Shutdown Events," NRC Memorandum to R. C. Jones, Chief of Reactor Systems Branch, Office of Nuclear Reactor Regulation August 14, 1995). It identified 426 events originating during shutdown operations and 60 events that occurred during power operation that would have challenge,d the safety of the plant had they occurred during shutdown. It~found 187 events in 1993,152 in 1994, and 147 in the first five months of 1995. Of the 486 events, 64 were judged to be of concern or to be significant.

Events reported involved RHR, design problems and unanalyzed conditions, offsite power, external events, refueling, reactor vessel water level problems, containment, and reactivity control. Safety-related equipment accounted for.ll7 events and emergency safeguard features and reactor protection systems accounted for another 95.

NRC dispatched augmented inspection teams (AITs) to investigate shutdown . , , , - 3 events in 1991 at Diablo Canyon, in 1992 at Prairie Island and three times at Oconee, and once at Oyster Creek in 1993. There have also been other serious events at Oyster Creek in 1993, at Hope Creek in 1995, and at Haddam Neck in 1996.

In SECY-94-176 (July 1994), the staff asked the Commission to approve a proposed rule. The proposed rule was published for comment in 59 [8 52707 (October 1994). It would have required power reactor licensees to do the following:

4

__________ _ - _ _ . l

• Assure that uncontrolled changes will not occur in reactivity, reactor coolant inventory, and loss of subcooling in the RCS when subcooled conditions are normally being maintained.

• Assure that containment integrity is maintained or can be heestablished to prevent releases in excess of regulatory limits.

• Establish controls in technical specifications limiting conditions for operation and surveillance recuirements or in plant procedures require.d -

by technical specifications acministrative controls for equipment that the licensee identifies as necessary to ensure maintenance of the tafety functions. -

• Evaluate realistically the effect of fires stemming from activities conducted during cold shutdown, determine whether such fires could realistically prevent accomplishment of the normal RHR capability, and if they could, either present measures to prevent loss of normal RHR or establish a contingency plan to ensure that an alternate RHR capability exists.

+ for licensees of PWRs only, install instrumentation for monitoring water level in the RCS during midloop operation.

The NRC received 1023 comments on the proposed rule (that are discussed in Section proposedVI of was rule the Statement of was unnecessary, Considerations.) Most commenters said (1) the arescriptive, would unnecessarily complicate outages, and would lengtien many outages by 1 or 2 weeks; (2) the regulatory analysis was inaccurate and incomplete; and (3) the regulatory guide was incomplete and offered little guidance. The only unqualified support came from a public interest group. The NRC found many comments valid and it consequently reevaluated all aspects of the rulemaking effort.-

The NRC held several public meetings during 1995 and 1996 to ensure that a revised shutdown rule could be effectively implemented and to encourage the Nuclear Energy Institute (NEI) to develop an implementation guide that the NRC could reference in a regulatory guide. The NRC's dialogue with the industry was effective in obtaining information useful to the development of a draft shutdown rule. However, following the NRC's decision in June 1996 that extending coverage of the rule to the fuel storage pool, and containing language regarding internal and external events, NEI decided not to d 9velop an implementation guidance document.

• 1.3 Cases Used for Analysis A quantitative analysis was performed using PRA techniques for the shutoown operations portion of the rule exclusive of fire protection requirements. This analysis has three cases: the base case, the voluntary case, and the rule case.

The base case represents the level of protection afforded strictly by legally-enforceable requirements, i.e. current regulations, technical specifications, S

! license conditions and orders. It does not credit any measures that are voluntary or that can be unilaterally changed by the licensee, such as licensee commitments made in response to generic letters and bulletins. It is the case against which costs and benefits are measured in assessing the value of proposed new requirements. I The voluntary case is representative of the level of protection for plants as they would be if oper~ated with a reasonable implementation of voluntary ~

measures based on guidance from HUMARC 91-06. These voluntary measures go-beyond those strictly required by the regulations technical specificat, ions, license conditions and orders. Becauseofthevoluntarynatureofthese measures, the Commission rex ects that there would be a range in the level of implementation of these measure among nuclear power plant licensees. The difference between the base case and the voluntary case is a measure of the actual risk reduction in plants, assuming effective voluntary measures are maintained in the future.

The rule case represents the level of protection which would be afforded by all plants complying with the requirements of the proposed rule. The difference between the base case and the rule case shows the enforceable risk reduction that would be achieved as a result of the proposed rule and it is the case against which benefits are measured in assessing the value of new requirements.

1.4 Backfit Rule Section 50.109(a)(3) requires that there be a substantial increase in the overall protection of public health and safety or common defense and security to be derived from the backfit and tFu the direct and indirect costs of implementation for that facility are Estified in view of this increased protection. Section 50.109(c) lists nine items that will be considered in satisfying i 50.109(a)(3). Each is addressed below.

(1) Statement of the specific objectives that the proposed backfit is designed to achieve.

The objective of the pro)osed rule is to establish a clear regulatory framework for assuring t1at cold shutdown and refueling outages continue to be conducted in a safe manner. To accomplish this objective, licensees shall modify their administrative controls section of the technical specifications in accordance with the requirements of the rule, and have procedures for. . .

performance monitoring and other activities important to safety.

(2) General description of the activity that would be required by the Itcensee or a>plicant in order to complete the backfit To meet the slutdown operations requirements of 5 50.67, licensees would be required to: (a) monitor and comply with parameters for the reactor coolant system water temperature, level, and pressure; (b) provide mitigation capability for events that result in a loss of decay heat removal; and (c) implement procedures for training, quality assurance, and corrective actions to ensure the parameters are monitored and complied with and that the mitigation capability is provided.

6

l In addition, conforming changes would be made to other regJlations in support of the shutdown operations requirements of 6 50.67. These changes require licensees to (a) conside & *w definition of shutdown operations m i 50.2 as meaning the reactor coolant system (RCS) is in Cold Shutdown or Refueling (as defined in a plant's technical specifications) and one or moreIfuel assemblics are located in the reactor vessel or in the refueling cavity and that shutdown operation is a part of normal operation, (b) include tha structures, systems, and components necessary for compliance with the shutdown operation requirements of 5 50.67 into the maintenance rule (i 50.65), (c) include in -

safety. analyses for the license renewal rule (i 54.4) the structures, systems, and cr.,mponents relied on to perform a function that demonstrates compliance with i 50.67, (d) provide notification and submit reports to the NRC in accordance with i 50.72 and i 50.73 of any event that results in or should have resulted in the actuation of the mitigation capability.

(3) Potential change in the risk to the public from the accidental offsite release of radioactive material.

Release rates for PWRs are predicted to be reduced from the base case value of 2E-2/ reactor-year to IE-6. For boiling water reactor BWRs, the release rates are predicted to be reduced from lE-3/ reactor-year to 4E-6/ reactor-year. The NRC analysis assumed a 35-day refueling outage each 18 months of operation and addressed initial entry into cold shutdown until the refueling cavity was filled. This addressed 9 days of the 35 days of the outage for the PWRs and 6 days of the outage for BWRs. This approach was based upon plant-specific shutdown PRA results which indicated that these were the most risk-significant periods. The NRC then added an additional 10-20 percent to the calculated risk values for these periods to approximate the entire refueling outage.

Only event initiators that result in the loss of PJiR were considered. The contributions from seismic events, fires, and internal floods were not modeled in the quantitative risk assessment due to their highly plant-s)ecific nature, inclusion of these events would increase the risk benefits'of tie rul'e.

Existing requirements were considered to provide protection for reactivity events and low temperature overpressure (_ TOP) events and for hot shutdown conditions. The total risk contribution from all non-refueling outages was assumed to be equal to the refueling outage contribution.

(4) Potential impact on radiological exposure of facility employees.

The reduction..in dose from event cleanup (i.e., the frequency of events x the cleanup dose per event x remaining reactor-years) is estimated to be 17,000 person-Sv. Nearly all of this comes from improvements in PWR operation; .less _ ,

than 5 percent is attributable to BWR improvements. The occupational exposure increase from instrumentation improvements is estimated to be less than 30 person-Sv and is negligible. Thus, the total expected impact on radiological exposure of facility employees is a reduction of about 17,000 person-Sv. No estimate was made of immediate dose to workers on site at the time of a serious accident.

(5) Installation and continuing costs associated with the backfit, including the cost of facility downtime or cost of construction delay.

The NRC separated industry costs into initial costs (one-time) and continuing costs (recurrent) as specified in Table 3. For analysis purposes, all licensees were assumed to incur costs based on " average" PWRs or BWRs. All 7

f costs are given in 1997 dollars and the operating costs are discounted at an annual rate of 7 percent. l. abor cost rates were developed using NUREG/CR-4627. updated to 1997 dollars by assuming an ennual rate of infiction of 5 -

percent. i I

1he following industry costs were considered in the regulatory analysis:

• developing procedures and implementation of quality assurance to control shutdown operations and maintenance of those procedures * -

~

• providing operator training to minimize the frequency of events that interrupt or degrade shutdown cooling and training to ensure effective operator response to events that occur a

providing instrumentation to monitor and comply with the parameters and to monitor significant changes in the reactor coolant system parameters.

• reporting shutdown operations events that occur to the NRC in accordance with 10 CFR 50.72 and 50.73

• providing a mitigation capability following loss of decay heat removal events

• updating FSAR and technical specifications, and developing an understanding of system behavior The NRC estimated there would be no cost impact from any extension in outage time. The mitigat19n requirements are judged to be sufficiently flexible that with deliberate and careful licensee planning, the rble can be satisfied with no increase in the duration of outages on an industry-wide basis. The total industry cost is estimated to be $180 N in going from the base case to the rule case and $137 H in going from the voluntary case to the rule case. These costs are estimated for the industry over the lifetime of all plants. Each plant would therefore need to spend orrly about $1.8 M.over the 1tfetime of the plant. These costs are similar for both cases because of the administrative burden associated with bringing a voluntary program under regulatory '

enforceable purview.

(6) The potential safety impact of changes in plant or operational complexity, including the relationship to proposed and existing regulatory requirements.

The rule is focused on a disciplined and safety-conscious approach to shutdown operations. Additional complexity is assumed to be added to the planning stages of an outage due to the rule. Well-planned and well-controlled work practices are important contributors to the benefits of the rule. The. .

- ~

regulatory analysis assumes that these practices reduce the frequency of initiating events, and ensure the availability of systems for mitigating events. Therefore, although initial outage planning may be more complex, safety during the actual outage is expected to be enhanced.

Other proposed or existing regulatory requirements which address shutdown operation include the following:

• The maintenance rule (6 50.65) focuses on assuring the reliability of equipment to fulfill its intended safety function. In conjunction with the proposed shutdown rule, changes are being proposed to the maintenance 8

l rule to include $50s selected by the licensee for decay heat removal and event mitigation.

• 1he reporting requirements (6 60.72 ana 50.H) wili be rey!15ed to have l licensee's report events that result in or should have resbited in the l

actuation of the mitigation capability.

• The recuirements* governing the content of the FSAR (i 50.34) will be revisec to have licensees incorporate information related to fuel ' pool. .~

operations.

• The shutdown rule requires revision of individual plant technical specifications.

• The emergency preparedness regulations (i 50.47(b)(4) and Aapendix E to 10 CFR Part 50) are applicable in all modes of operation. lowever guidance documents for developing emergency action levels meet the regulations do not adecuately address shutdown ope (EAls) ration. A that regulatory guide containing guicance on EAls for the shutdown mode of operation is being developed.

• License renewal ($ 54.4(a)(3)) will reflect a change in scope consistent with i 50.67 such that non-safety related structures, systems and components necessary for compliance with i 50.67 are included within the scope of the license renewal rule. Safety related structures, systems and components necessary for compliance with i 50.67 are already within the scope of license renewal in accordance with 5 54.4(a)(1).

(7) The estimated resource burden on the NRC associated with the proposed backfit and the availability of such resources.

NRC costs were estimated per site or, when a total was determined, it'was divided according to the number of sites when assigning costs among pWRs and BWRs. Headquarters and regional staff training as well as inspection and review time were included. The total estimated staff cost for all plants is

$1.5'M. This cost is a negligible contributor to the value-impact analysis.

Staff resources are available for this work. Resources were estimated for the following activities:

• resident ' inspector time to verify compliance with new requirements

• reviewing technical specifications and licensee bases for claiming . ,

compliance with the new regulation '_

• training resident inspectors a training regional staff training headquarters project managers a

preparing temporary instructions and training material

• conducting training regional inspector time to verify compliance with new requirements headquarters inspector time to verify compliance with new requirements a

headquarters event-receipt / response / analysis (8) The potential impact of differences in facility type, design, or age on the' relevancy and practicality of the proposed backfit.

9

- - - - - . - . - - . _ . - - - - - - _ ~ - - _ -

~

Facility type and design are significant factors in the backfit analysis.

PWRs have a considerably higher net valuo and value-impact ratio than BWRs.

This is due largely to the lower estimated-core damage .9equency (CDF) for i BWRs in the base case analysis and the, tssumption that the containment is open fcr both reteter typer in the bate case.. The Iowar CDF in BWRslis attributable to the greater number of required water addition sources in the base case and the absence of a 'mid-loop' operating state. Differences i between PWR vendor-designs and differences within a vendor type are not  ;

expected to make a significant difference in the analyses. + -

l f9 dus)tification for imposing the proposed backfit on an interin basis.Whether the p The proposed backfit is f'nal. .

I 2 IDENTIFICATION AND PRELIMINARY ANALYS!$ 0F ALTERNATE APPROACHES 2.1 Take No Action The "no action" option has been rejected on the basis of the regulatory analysis and also for the following reasons:

• Existing regulations do not provide an enforceable basis for effective regulation of shutdown operation.

• Nessures assumed for the voluntary case are unevenly applied across the industry, as evidenced by the number of events with serious implications that continue to occur, and increasing economic pressure in the absence of explicit regulations may result in a relaxation of current voluntary  ;

measures. > .

2.2 Issue an Information Notice '

Shutdown operation encompasses a broader secpe than can be addressed in an information notice, and there is no enforcement basis provided by an information notice.

2.3 Issue a Generic Letter or Bulletin Generic letter's and bulletins have been successful in improving shutdown operations. These approaches, however, do not establish a satisfactor.y . .,,. .

enforcement basis since licensees can, in general, unilaterally change commitments made in response to these generic letters and bulletins; generic letters and bulletins may not achieve the same level of attention as provided to implement a technical specification (TS) or a rule.

2.4 Implement the Rule Published in 59 FR 52707 The 59 FR 52707 rule addressed many of_the same areas covered by the presently proposed rule. 'However, consideration.of.public comments and Commission policy regarding the use of a performance-based approach guided by risk insights have led to a restructuring of the rule.

I l 10 1

_. ._..m -

_ . . ~ .~-- - - - - - - - - . . - - - - - - - - - - - - - - - - - - -

2.5 Rewrite the Maintenance Rule (i 50.65)

Industry representatives have suggested rewriting the maintenance rule ($

50.65), its regulatory guide, and industry documentation that 3s referenced in the regulatory guide. Although the maintenance rule and the a guidancecoverbothpowerandshutdownoperation,muchofits)sociated effectiveness depends upon the definition of functional requirements that are clear for power operation and not well defined for shutdown operation. Rewriting the maintenance rule so that it had clear functional requirements for shutdown -

operation would effectively produce a rule similar to that now proposed' as 5 50.67.

2.6 Modify and Prepare Technical Specifications Without Rulemaking The staff's regulatory analysis shows that shutdown operation can be a significant contributor to overall risk and therefore the public should be given the opportunity to participate in the process of developing these requirements. Rulemaking is the preferred method of offering the public this opportunity to rtrticipate.

2.7 Implement a Risk-Informed Rule With Performance Elements Rewriting the rule and regulatory guide using a risk-informed approach with performance elements wherever practical is the alternative selected.

2.8 Implement a Rule Applicable solely to PWRs Yt.e estimated probability of core damage is greater for PWRs than for BWRs.

However, since PWRs generally have a more robust containment than can be economically provided for BWRs during much of shutdown operation, this greater probability of core damage does not translate into a greater probability of release of radioactive material. This regulatory analysis shows that the combination of core damage probability and containment characteristics results in similar release probabilities for the PWRs and BWRs, and it justifies a rule that applies to both. Consequently, a rule that excluded BWRs was

, rejected in favor of an industry-wide action.

2.9 Implement a Rule Applicable to PWRs During Midloop or Reduced Inventory The perceived probability of core damage is greater during these aspe. cts ,of operation than at other times during shutdown opeiation of PWRs. Overall, the regulatory analysis and defense-in-depth considerations justify a rule that evers all phases of shutdown operation when in the cold shutdown and

.* M 11ng modes. Consequently, a rule limited to this narrow aspect of shutoown operation was rejected. Further, the rule is justified for both BWRs and PWRs during the cold shutdown and refu-ling modes.

11

3 ESTIMATION AND EVALUATION OF VALUES AND IMPACTS 3.1 Probabilistic Risk Assessment ,

A reference PRA was developed for the PWRs and another was devkloped for the BWRs. The NRC assumed that plant operations can be described on average by considering a four-loop Westinghouse PWR with a large, dry containment and a BWR-4 with a Mark I containment. Each represents the largest fraction of plants in its category. . .

The following accident initiators were considered: *

• loss of offsite power causing loss of RHR

• loss of inventory (LOI) causing loss of RHR

= direct loss of the operating train of the RHR system e loss of level (LOL) control causing loss of RHR (PWRs only)

Event trees were developed on the basis of the four initiators to describe the base case, voluntary case and the rule case. Each tree describes accident sequences leading to core damage and the consequential release of radioactive material. Core damage was taken as exceeding a clad temperature of 1200 'F.

The release of radioactive material following a core damage event was furthu considered in the analysis only if the release was unmitigated. An unmitigated release was assumed to be a significant fraction of the release that would occur during and following an accident in which (1) most of the core melted, (2) the reactor coolant system pressure boundary was breached or there was a large opening in the reactor coolant system (vessel head or primary side manways removed) and (3) r containment equipment hatch cover was removed that provided a direct releast: to the environment outside the plant.

Releases via such paths as a BWR suppression pool would be reduced by a significant factor would represent success with respect to the prevention of unmitigated releases.

Logic trees were developed for certain major events, including the injection and ac power systems, to provide data for the event tree quantification.

The NRC assumed a 35-day refueling outage each 18 months of operation. It examined typica,1 outage schedules and several shutdown operation PRAs, which establish that most of the shutdown operation risk occurs before floo, ding the '

refueling cavity. Before initiating RHR, little risk was identified, few RCS "

configurations changed, and standard technical specifications (STSs) provided coverage equivalent to that provided for power operation as long as equipment was not removed from service in anticipation of entering modes in which it was not required. Consequently, the NRC judged that it could capture the more risk-significant portions of a refueling outage by analyzing two phases: from RHR '.nitiation until reaching 200 *F with the RCS closed, and from that point until the refueling cavity was filled. This addressed 9 days of the 35 days 12 l

i L

of the outage for the PWRs and 6 days of the outage for BWRs.2 Analyses then established that the risk prior to entering cold shutdown was small.

Consequently, the NRC's analyses, and the rule, were limited to the cold-shutdown and refueling modes. The NRC then added an assumed 10-20 percent to the calculated risk to approximate the entire refueling outage.g Since this addition is small, there is little perturbation of the results and conclusions.

Nonref:celing outages also make up a significant fraction of shutdown.. --

operad ens. Nonrefueling outages consist of both scheduled outages and unscheduled outages, and can vary widely from a few hours in hot standby to many days in cold shutdown. The latter may or may not include extended periods with the containment and the RCS open, and may sometimes include extended midloop operation in PWRs. The NRC judged that, for purposes of the regulatory analysis, it could estimate the risk of non-refueling outage operation by assuming that the refueling outage results could be applied to nonrefueling outages. The judgment was based on consideration of the fact that the decay heat removal function is the primary concern in either case.

The NRC assumed nuclear power plants would be operated at power for 87 percent of the time. This time is compared in Table 1 to outage information provided in Nucleonics Week (August 22,199P for refueling outages at 34 U.S. plants during the spring of 1996.

A number of event categories were not directly included in the PRA because of Table 1. Comparison of Assumed and plant-specific considerations. These Actual Outage Characteristics include fire, internal flood, seismic, ,

and weather-related impacts (although ,

loss-of-offsite-power data were compiled Ti" *v$ A** = d Actu*t for the total of all causes). The totat cycie sta su proposed rule covers fire through a separate analysis. Seismic nefueting 3s ss considerations are implicitly addressed Other outa,e 33 a ,cox 42 through the Commission's expectation that licensees will implement the rule's ^**"' '78 * *' " " 7 requirement to have a mitigation ti = at power s7x s2x capability by 'using an emergency core y,,, ,,,, ,,,,

cooling system or safety injection 33, ,,,

system that are designed to withstand *

• the safe-shutdown earthquake.

The base case PRA did not explicitly account for licensees who voluntarily documented commitments in their FSARs in response to Generic Letters.

Although these commitments have occasionally been so documented, this is a For the PWRs, Phase 1 tests for 1 day, starting 0.5 day af ter shutdown from tut t power. Phase 2 covers 8 days, starting 1.5 days after shutdown, and includes midtoop operation as wett as the non-flooded refueling mode operation. Of these 8 days, the test 6 are with the RCS " vented." For the BWRs. the analyses cover the reactor vesset head on (4 days, starting 1 day af ter shutdown from futt power) and head off (2 days) conditions.

13

relatively unusual occurrence. When it has been done, it is usually enforceable as a design comitment and not as an availability or operational commitment. Therefore, consistent with the agency guidance on regulatory 7

analysis, such commitments have not been included in the base case.

I 3.2 Estimation of Values values are the changes due to implementing the proposed rule in public and occupational radiation exposure with their associated monetary equivalent and -

changes in property damage. The NRC used the following values: ,

VI avoided public health risk (person-Sv or the monetary equivalent to dose in 1997 dollars)

V2 avoided occupational exposure risk associated with accident management and cleanup (person-Sv or the monetary equivalent to dose in 1997 dollars)

V3 avoided offsite property damage risk (1997 dollars)

V4 avoided onsite financial risk due to cleanup and power replacement costs (1997 dollars)

V5 change in routine occupational exposure due to the implementation of the increases or decreases (person-Sv or the monetary equivalent to dose in 1997 dollars)

The first four are positive with respect to decreases in the frequency of consequences of accidents. The fifth may be a positive (beneficial) or negative perturbation associated with a decrease or increase, respectively, in the rottine occupational exposure to implement the changes. -

The shutdown dose consequence to the public within a 50-mile radius for ap unmitigatedrgleasefromtheSurryplantattheSurrysiteistakenas10' person-Sv (10 person-rem) (NUREG/CR-6144). This value has been estimated using the MELCOR and MACCS codes assuming a severe accident following an event duringmid-loopopera} ions. TpedosecongequencesaspresentedinNUREG/CR-6144 ranges from 3x10 to 2x10 person-Sv. Little information is available of a comparable quality for shutdown operation at other plants. Consequently, Although this regulatory analysis did not explicitly analyte the potentist effect of air Ingression on the source term, there are some unique technical and phenomenological lasues that could potentially lead to dif ferences in the melt progression, metattic oxidation, and source term release and transport from that typicatty predicted by severe accident thermot hydrautic codes. In typical severe accident analysis, t! e core degrades, selts, and relocates in a steam environment; whereas, & ring shutdown operations with the reactor vesset head removed, the potentist exists for core degradation in an air envircraent. The technical issues and some exploratory calculations for the surry plant on the effects of air ingression are surnarized in NUREG/CR 6218, *A Review of the Technical Issues of Air Ingression During severe Reactor Accidents.' Additional snalyses assessing the ispect of air ingression & ring a severe accident for the Grand Gulf plant are documented in WUREG/CR-6143, Vol. 6, Part 2

• Evaluation of Potential Severe Accidents During Low Power and shutdown Operations'at Grand Gulf, Unit 1.* The potentist impact of air ingression on severe accidents during shutdown operation is not expected to decrease the value of the proposed shutdown operations rule.

14 ,

I

\

k - ________ ___.________ _ ____

t the NRC assumed that the Surry result could be applied to other plants as follows:

• by multiplying the Surry result by each plant's full-power;1evel divided by the Surry full-power level to account for radionuclide pnventory

• by multi plying the preceding result for each plant by the respective plant release characteristics for a full-power accident (NUREG/CR-2239) divided by the Surry release characteristics for a full-power accident, to. -

account for individual siting characteristics Other assumptions included:

Plant-specific information (applicable to Surry) was used for loss of offsite power.

• Each plant's remaining life (from 1997) was individually accounted for and core-damage accidents were assumed equally probable from 1997 to the end of the 40-year plant life for each plant.

• A 5-percent inflation value and a 7-percent discount value were used to adjust dollar values that were determined or assumed for years other than 1997.

3.3 Estimation of Impacts Impacts are the costs and savings for the changes evaluated in the regulatory analysis. The NRC used the following:

Il cost to the NRC covering training inspection, re' view, and monitoring associated with the changes (positive impact) (1997 dollars) -

12 direct cost to the licensee to implement the changes and perturbation in operating cost (positive or negative impact) (1997 dollars)

The assumptions applicable to impact estimation are the same as those discussed in Section 3.2 for value estimation.

3.4 Evaluation of Values and Impacts Values and impacts were combined to form the following equation, whicti * *

• represents the net value of a proposed regulatory action in 1997 dollars:

NV - VI + V2 + V3 + V4 + V5 - (Il + I2)

The value attributes VI, V2, and V5 are converted from person-Sv to 1997 dollars by assuming $200 K per person-Sv (COMSECY-95-033).

The corresponding impact /value ratio is defined as follows:

I/V - (Il + 12)/(V1 + V2 + V3 + V4 + V5) 15 -

This regulatory analysis is based upon 73 PWRs and 37 BWRs that are assumed located on-49 and 31 sites, respectively. Essentially identical nuclear steam supply systems (NSSSs) were assumed to be located at the same site. Those that differ in design were treated as though they were located lat different sites for all purposes exce)t for assessing the effect of an adcident at one site on the operation of otler NSSSs at the same site. Thus, for most purposes, two sites are associated with Millstone: one for the BWR and one for the two PWRs. Similarly, one site is associated with Oconee and one with Palo Verde, sites that each contain three PWRs. -

3.4.1 Avoided Public Health Risk (VI) ,

For any given plant i, the estimate of VI is obtained:

Vl

i = avoided public health risk (1997 dollars) in moving from the base case to the rule case for plant i This was calculated by first obtaining the incremental change in containment release frequencies via the PRA discussed in Section 3.1. Consider the PWRs and a comparison of the base case to the rule case as an example. The PRA provides the following:

reduction in frequency of an open containment type release af (RC-fd )(RC-1) for a PWR moving from the base case to the rule case Plant-specific source terms associated with shutdown accidents are generally not available. Brookhaven National Laboratory recently estimated the shutdown-related dose consequences to thg public within 50 miles for an open containment type release for Surry as ,10 person-rem (JiVREG/CR-6144). As previously discussed, the NRC applied the Surry estimate to each individual plant by adjusting it for power level (radionuclide inventory) and location (siting). Thus, for nuclear power plant 1, one has the following:

P, - thermal power (HWt) associated with nuclear plant i

- site scaling factor to account for the conditional latent cancer SSF, fa talities from a reference plant (i) (NUREG/CR-2239).

< Now pd (RC-li )', the conditional public dose (person-Sv) associated with RC type releases for plant i, can be obtained from the following equation: ,

pd (RC-1 1) =pd (RC-1sur ry) x x pSurry SSF Surry where:

6 pd(RC-Isorry) is 1.0 x 10' person-Sv (1.0 x 10 person-rem),

P*

p Surry is the source term scaling factor, and 16

SSF i SSF surry is the site scaling factor, The annual per-plant reduction in public dose consequences (pe son-Sv) for RC-I type releases is:

RDannut ereon-sv (RC-1 1 ) = Af (RC-ly) x pd (RC-1 3)

. One can convert the annual per-plant reduction in public dose to a monetary equivalent (1997 dollars) by assuming $200 K for a person-Sv ($2000 for a '

person-rem):

RDannual iss1-dollars (RC-1 ) = Af (RC-1M) x pd (RC-l ) x $200K 3 '

i The avoided public health risk associated with moving from the base case to the rule case for the RC-1-type- release for plant i, expressed in monetary equivalent value, is:

8 ~

V1 ;"3,=RD,on.13,,,.4 13 ,, (RC-1g) where:

r = real discount rate (fraction) t, = years-remaining until end of plant i life. .

The total avoided public health risk for plant i associated with moving from the base case to the-rule case for all RC type releases is:

Vl!'" = V1Ei"1, Suming over all plants in a class, e.g., all PWRs, yields:

yg, a yg-a - -

-2 where I - total number of PWRs.

17 '

i

i i

The approach for BWRs is similar but as a group BWRs yield the different resultant values because of the differences in pumber of BWRs, their lower CDF in the base case and site specific differences. ,

3.4.2 Avoided Occupational Health Risk (V2) i Estimation of avoided onsite consequences depends on CDF and accompanying containment effective' ness. The occupational exposure consists of immediate and long-term components. . .

The number of personnel on site during an outage typically ranges from 'a few hundred to a thousand and, as reported in NUREG-1410, evacuation is not assured. The potential exists for an immediate high dose to onsite personnel.

Despite this, the NRC has not included this potential effect in the impact /value assessment because of the large uncertainty involving personnel movements.

Long-term occupational exposure occurs when cleanup and recovery take place beyond work immediately associated with the accident. The value used as an estimate for this exposure was based on a study of decommissioning a reference light-water reactor following a major loss-of-coolant accident in which the emergency core cooling system was delayed in starting (NUREG/CR-2601). All fuel cladding was assumed to rupture with significant fuel melting and core damage. It was also assumed that the containment building was extensively contaminated, and that the auxiliary building was contaminated too. The estimated occupational radiation dose from cleanup and recovery was 200 person-Sv. The postulated shutdown accident assumes significant contamination of the auxiliary building and other buildings, as well as the surrounding plant area, because the containment is. assumed to be open, in contrast to the case discussed in NUREG/CR-2601 in which the containment was closed. For purposes of impact /value analysis, the NRC assumed that th6 200 persoh-Sv value was appropriate for the Surry plant discussed in NUREG/CR-2601 and consistent with a closed containment. The NRC then assumed exposures of 600 person-Sv for the more serious conditions that would exist without containment for those releases. Values at all other plants were adjusted relative to these values based on each plant's power level. The conversion to 1997 dollars assumes $200 K/ person-Sv.

3.4.3 Avoided offsite Damage to Property (V3)

• ^

Offsite property loss is one of the major value categories.for calcul'a tin'g avoided risk. In severe accidents, property damage off site can exceed the damage on site. Public property damage costs, V3, were calculated using an ,

analysis similar to that for VI as described in Section 3.4.1.

The source term used in consevence anstysis is affected by many f actors including: the reactor desion, core redionuctide inventory, reactor therest power, fuel burnup, fuet management, time of accident, and fission product release and transport. Although these f actors vary for BWRs and PWRs, they are not expected to significantly chanee the conse w ence estiastes such that the value of the shutdown operation rule is significantty changed.

18

Scaled results for property damage costs, given a radionuclide release from the containment, were obtained from NUREG/CR-2723. This study reported offsite property costs for accidents at 91 U.S. sites with licensed reactors or construction permits. These values were updated to 1997 dollars using an annual inflation rate of 5 percent. A public property damage cpst of $800 M per unmitigated release for Surry at the Surry site was used and the value adjusted for each other plant was based on that particular plant's power level and site charactsrtstics.

These offsite property damage costs were discounted at a 7-percent rate for each year after 1997, when the risk reductions were assumed to begin. '

3.4.4 Avoided Onsite Power Replacement and Cleanup (V4)

Replacement power costs were derived by first assuming the replacement power costs determined in NUREG/CR-4627, and then adjusting these figures, established in 1988, to 1997 dollars by assuming a 5-percent annual inflation rate. For the damaged plant, the time for replacement power is the remaining life of the plant with costs adjusted to 1997 dollars assuming a 7-percent annual discount rate. For sites with more than one unit, it was assumed that the undamaged unit (s) would be shut down for 2 years after the accident, and thus replacement power would also be needed for the undamaged unit (s). No

&1lowance was taken for cleaning up of such undamaged units.

Cost estimates for cleanup were obtained from a study that estimated the cost of a major loss-of-coolant accident in which emergency core cooling was assumed to be delayed (NUREG/CR-2601). In that study, it was assumed that the cleanup activities would take 10 years and the cost would be $373 M per event.

No distinction was made between BWRs and PWRs. The ortsite consequences were limited to the containment and auxiliary buildings. Thus, as discussed for V2 (Section 3.4.2), this value was assumed. Consequently, this value was tripled for a case with no containment. In addition, the "$373 M' was adjusted for 5-percent annual rate of inflation, bringing it from its 1983 value to $73.8 M/yr as a 1997 estimate.

The total cleanup costs were discounted at a 7-percent rate for each year after 1997, when the CDF reductions were assumed to begin. Cleanup costs were added to the power replacement cost to get total costs. The total yearly cleanup and power replacement costs, given core damage, were then expressed in 1997 dollars.

Avoided property damage cost, V4, due to cleanup and power replacement given a core-damage accident, was calculated by adding the cost of replacement power to the cost of cleanup.

3.4.5 Routine Occupational Health Risk (VS)

For routine occupational health risk (VS), an exposure of 3 person-rem during instrumentation installation per unit and,0.5 person-rem per unit per outage thereafter was assumed. Consistent with the rest of the regulatory analysis, a refueling outage and a maintenance outage were assumed each 18 months [(12 months /yr)/(18 months) x (2 outages) = 1.333 outages /yr). For the per-outage 19

value, the conversion to 1997 dollars, assuming $200 K/ person-Sv and a 7-percent discount rate, is the same as described under Section 3.4.1 for VI.

For the one-time installation exposure, the 1997 value is $6000 per unit.

3.4.6 Costs or Savings to NRC (II) k NRC costs were estimated on a per-site basis or, when a total was determined, it was divided according to the number of sites when assigning costs between PWRs and BWRs. A cost of $56/hr was used since the rule was assumed-not to change overhead associated with the NRC offices and general support, and such support was assumed covered by existing NRC work. The following outage' activity elements were identified:

• resident inspector time to verify compliance with new requirements: (10 staff-day / site) x (8 hr/ day) ($56/hr) - $4480/ site e review technical specifications: (20 staff-day / site) x (8 hr/ day) r.

($56/hr) - $8960/ site

• training resident inspectors: (5 staff-day / site) x (8 hr/ day) x ($56/hr)

- $2240/ site e training regional staff: (10 staff-day / region) x (4 rep on) x (8 hr/ day) x ($56/hr) - $17,920

• training headquarters project managers: (2 staff-day / staff) x (75 staff) x (8 hr/ day) x ($56/hr) - $67,200

• preparing temporary instructions and training material: (30 staff-day) x (8 hr/ day) x ($56/hr) - $13,440 , ,

e conducting training: (40 staff-day) x (8 hr/ day) x ($56/hr) = $17,920

• regional inspector time to verify compliance with new requirements: (5 staff-day / site) x (8 hr/ day) x ($56/hr) - $2240/ site

• headquarters inspector time to verify compliance with new requirements:

(2 staff-day / site) x (8 hr/ day) x ($56/hr) - $896/ site

• headquarters event receipt / response / analysis (20 staff-days / year) x , ,' ,

(8 hr/ day) x ($56/hr) - 58,960 l'

The total cost of these ten activities for all PWRs is "I(1) = $0.96 M.

For all BWRs, it is **I(1)"L' = $0.54 M. These costs are summarized in Table 2.

20

_.._____.m._ _ - _ _ _ _ _ _ _ _ _ _ --.

I Table 2. Base Case to Rule Case .

NRC Costs for i 50.67 ACTIVITY PWho COST 4K twme COST 4K 447 enes) (26 ottest Resident b 7= Time to vertfy TOTAL COST 4K 210.5 1165 Rowlew Technical Specificatsone 327 4 21.1 232.9 Trca, *- ^ Inspectors

• 954 106.3 58.2 Trca"4 *; .:.' Staff 363 5 S.O 9.0 18 Tri HQ Preiset Mm_ . 43,3 23.8 %7.2 Propertne Tre and Trca, Meterial 6.7 6.7 conductine Tri-14 13.4 s.0 9.0 Ameional b ; u ; Time to Verify la 106.3 58.2 HQ S- not Time to VerHy 163.5 42.1 23.3 HQ Event Rooeipt/ Resp /Andveie 66.4 t 5.8 3.2 9.0 Total NRC costs OK) 958.1 540.9 1.499.0 3.4.7 Direct Costs or Savings to Licensees (12)

The NRC separated industry costs into two subcategories: implementation or one-time costs, and operating or continuing costs.

The nature of these costs (i.e., implementation, operating, or both) was also investigated.

For analysis purposes, all licensees were assumed to incur costs to be less based costly for onthe" BWRs average" since PWRs or BWRs,there is less r

wo k tImpleme o be done and the estimates are provided accordingly. All costs are given in 1997 dollars and all operating costs are discounted at an annual rate of 7 percent. Labor cost rates an annual wererate developed of inflationusing of 5 NUREG/CR-4627, percent. In each ofupdated to 1997 dollars by assuming the following calculations, the base case to rule case is calculated first, then an adjustment is made according to NRC staff estimates of the extent to which industry has already voluntarily complied with rule - thus developing an estimate of the costs for voluntary case to rule case.

The following industry costs were calculated:

TS update - PWRs: (28 new pages M base case and voluntary case /NSSS) x ($5000/page) x (73 NSSSs) - $10.2 BWRs: (24 new pages x (37 NSSSs) = $4.4 M base case; and voluntary case /NSSS) x ($5000/page)

= develop system behavior understanding - PWRs: $3 M; BWRs: $0.5 M

+ develop and/or modify operations and maintenance procedures - PWRs:

(3 owners groups) x (200 pages/ owners group) x ($3000/page)= $1.8 M plus (200 pages/ site) x (47 sites) ($1500/page) = $14.1 M base case which totals BWRs: $15.9 M and 50 percent is estimated for voluntary case -58.0 M; (1 owners group) x (35 pages/ owners group) ($3000/page) = $0.1 M 21

plus (35 pages/ site) x (26 sites) x ($1500/page) = $1.4 M base case which totals $1.5 M and 50 percent is estimated for voluntary case =$0.8 M.

The difference in the number of pages between PWRs and BWRs represents more extensive procedure modification for the PWRs. '

+ new plans for operating in compliance with the new rule rekuirements -

PWRs: (20 staff-weeks / site) x (47 sites) x (40 hr/wk) x ($100/hr) = $3.8 M base case and voluntary case; BWRs: (8 staff-weeks / site) x (26 sites) x (40 hr/wk) ($100/hr) = $0.8 M base case and voluntary case , , ,

• provide instrumentation - A number of PWR licensees have installed

• level instrumentation systems that are assumed to meet the requirements. The NRC assumed that 45 PWRs do not have the necessary level instruments.

The NRC also assumed that little work was needed to provide temperature instrumentation for PWRs. All BWRs were assumed to need improved temperature instrumentation. PWRs: (45 NSSSs) x ($300,000/ unit) = $13.5 M base case and $5.2M voluntary case; BWRs: (37NSSSs) x ($300,000/ unit) =

$11.1 M base case and voluntary case

• develop or modify (or both) QA procedures - PWRs: (3 owners groups) x (150 pages/ owners group) x ($3000/page)= $1.4 M plus (300 pages/ site) x (47 sites) ($1500/page) = $21.2 M which totals $22.6 M for the base case and voluntary case; BWRs: (1 owners group) x (150 pages/ owners group)

($3000/page) = $.5 M plus (300 pages/ site) x (26 sites) x-($1500/page) =

$11.7 M which totals $12.2 M for the base case and voluntary case.

Industry costs are incurred over the remaining life of each NSSS and are individually converted to a present value via [1-exp(-rti )]/r, where r = discount rate (7 percent) and ti - remaining , life of plant "1." The present values are:

• operator training - PWRs: (1 staff-mo) x (4.3 wk/mo) x (40-hr/wk) x 1*73

($100/hr) x (1-exp(-rt i)]/r = $14 M base case and 50 percent is estimated for voluntary case =$7.0 M; BWRs: (1 staff-wk) x (40 hr/wk) x (1-exp(-rt )]/r = $1.7 M base case and 50 percent 'is

($100/hr) x i estimated for voluntary case =$.9 M

• instrumentation per NSSS - PWRs: ($2000) x [1-exp(-rt i )]/r = $1.6 M base case and voluntary case; BWRs: ($2000) x (1-exp(-rt i)]/r = $0.8 M 22

base case and voluntary case where the NRC assumed $2000 of maintenance cost per NSSS unit per year.  !

I 1*73

• procedures maintenance - PWRs: (20 pages/yr) x ($1500) {[1-exp(-

s .

rt )]/r i = $24.4 M base case and 50 percent is estimated voluntary c,ase -

i=37 '

12.2 M; BWRs : (20 pages/yr) x ($1500)) {[1-exp(-rt i)]/r = $12.0 M base case and 50 percent is estimated for voluntary case =$6.0 M

. quality assurance - PWRs: (1 staff-mo) x (4.3 wk/mo) x (40 hr/wk) x i =13

($100/hr) x ((1-exp(-rt )]/ri = $14 M base case and voluntary case; i=37 BWRs: (1 staff-mo) x (4.3 wk/mo) x(40hr/wk)x($100/hr)x{[1-exp(-

rt )]/r i = $6.9 M base case and voluntary case i =7 3

• event reporting - PWRs: (1 staff-wk) x (40 hr/wk) x ($100/hr) x ((1-exp(-rt i)]/r = $3.3 M base case and voluntary case; BWRs: (1 staff-wk) x i=37 (40 hr/wk) x ($100/hr) x {[1-exp(-rt )]/ri = $1.7 M base case and voluntary case . .

Total industry implementation cost is summarized in Table 3 for the base case and the voluntary case.

23

l Table 3. Base Case to Rule Case and Voluntary Case to Rule Case (Industry Costs for i 50.67)

Base Case to Rule Case ($M) l Voluntary Case to Rule Case ilM)

TASK l

PWRs BWRs Total PWRs i BWRs Total Tech Spec Update 10.2 4.4 14.6 10.2 4.4 14.6 Develop System Behavior . - 3.0 0.5 3.5 3.0 0.5 3.5

~

New Opersbons/Maint Procedures 15.9 1.5 17.4 8.0 0.8 ' e8 Now Plans 3.8 0.8 4.6 3.8 0.8 . 4.6 Pro Ade instrumentation 13.5 11.1 24.6 5.2 11.1 16.3 New QA Procedures 22.6 12.2 34.8 22.6 12.2 34.8 Subtotal Oritial Costs) 69.0 30.5 99.5 ,

52.8 29.8 82.6 Operator Trairung 14.0 1.7 15.7 7.0 0.9 7.9 instrumentation Maintenance 1.6 0.8 2.4 1.6 0.8 2.4 Procedures Maintenance 24.4 12.0 36.4 12.2 6.0 18.2 Quahty Assurance 14.0 6.9 20.9 14.0 6.9 20.9 Event Report no 3.3 1.7 5.0 3.3 1.7 5.0 Subtotal thesent veive commumo costs) 57.3 23.1 80.4 38.1 16.3 54.4 Total Cost to industry 126.3 53.6 179.9 90.9 46.1 137.0 4 DISCUSSION OF RESULTS Comparisons of the base cases, voluntary cases, and rule cases for both PWRs and BWRs are summarized in Table 4. The base case represents shutdown risk crediting only equipment required by regulation (assumed in Standard TS). The voluntary action case includes equipment required by regulation and equipment voluntarily added by the licensee based on NRC and industry guidance. The rule case represents shutdown risk crediting equipment as described in the Statement of Considerations and the Regulatory Guide for 6 50.67. Details of these cases are provided in subsequent sections. Results of an impact /value analysis that.was perforpd simultaneously with the PRA are summar,1 zed in Table 5. The net values are positive and the impact /value ratios are less than 1, showing that the rule is justified. -

• The net value (of the regulatory action) is the algettraic sus of the

• values" (e.g., the monetary value of avoided public risk in moving from the base case regime to the rule case regime) minus the "lapacts" (e.g., the costs to the licensee for taptementing the rule). A positive net value supports rule isplementation.

The tapact/value ratio is the sun of the cost ispects divided by the sum of the values (benefits.) The values incluse evolded pubtle health risk (in dollars), avoided occtpational exposure risk (in dollars),

avoided of fsite property damage, and avoided onsite property damage. Routine occteational exposure from laptementation of the changes is also accounted for as a ne9ative value. A ratio less than 1 supports rule isplementation.

24 J

Table 4. Probabilistic Risk Assessment Results Regulatory Analysis Coro damage Frequency Frequency of Untrutigated Release per Ahernative events / reactor-voor reactor-year PWR BWR PWR '

BWR 1

Potential Regulatory M.rmmum (Base Cose): 2E 2 1E 3 2C 2 1E 3 Estimate *of industry Practice -

per NUMARC 91-06 SE 5 1E 5 2E 5 BE 6 (Voluntary Case): to to to to 2E-6 6E 7 2E 7 6E-7 Proposed Ca"9***

Requiremente E**P""' 1 E-5 4E 6 1E-6 4E 6 (Rule Case):

(S/D only)  % SE 5 8E 6 1E 6 4E 6 Centawwwn1 Table 5. ImpactNalue Summary item PWR BWR Net Value. SM 153,000 5,100 impactNelue 0.001 0.01 (dimensionlese)

The Regulatory Analysis results show that the most significant risk reduction in moving from the base case to the rule case is achieved in several increments. The most significant reduction in risk is derived from the introduction of an ECCS injection path for PWRs and a RCS venting capability for BWRs (SRV operability). The PWR ECCS injection path and BWR RCS venting capability are not currently required to be available by TS in cold shutdown and refueling. The second most significant reduction in risk results' from the introduction of procedures as required by 9 50.67(a)(1) including those for training, quality assurance, and corrective actions. This portion of the rule is credited with a reduction in the frequency of initiating events and an increase in the probability of restoring a RHR system if it is lost. The third most significant incremental reduction in risk results from the introduction of either a containment that is expected to reduce the release frequency significantly or a risk-comparable mitigation capability.

In terms of relative cost, the requirement for maintaining mitigation. .

capability available is less than the procedural elements or the rule. This is because equipment such as the ECCSs is already installed and can be readily aligned with no additional equipment acquisition. The largest cost associated with the shutdown operations portion of the rule (excluding fire protection) is that associated with the development of procedures for training, quality assurance, and corrective actions. In addition to reducing risk, these procedures have the unquantifiable benefit of enforceability; it permits the NRC to inspect and enforce safe operation during shutdown and refueling.

However, the overall cost for rule implementation is modest, averaging about

$1.8 M per plant over the remaining lifetime of the plant.

25

l

)

In sumary, the rule case significantly reduces risk from the base case. The rule permits the NRC to inspect and enforce safe operation practices before an event occurs. The rule reduces risk from plants that are beloy average in safety. The rule also ensures a minimum level of safety by greatly reducing risk from what it would be if plants chose to comply with little more than what is required by present regulation. Nevertheless, little reduction in overall risk is achieved by the rule for the licensee who has adopted effective voluntarf practicos that reduce risk for shutdown operation.

4.1 Net Value ,

The impo, tant risk measures are the CDFs and the corresponding release frequencies. The release frequencies drive the public value attributes VI and V3, which are the most important attributes in the net value equation. The CDFs drive the onsite risk value attributes V2 and V4.

Estimated net values are shown in Table 6. Both the PWR and BWR net values are positive when the base case is compared to the rule case, indicating that it is worthwhile, from an impact and value perspective, to proceed with the proposed rule.

Table 6 Value impact Analysis Attribute PWR BWR

$M 4M VI, evoided pubhc exposure 91.900 2.920 V2, avoided worket exposure 5,700 238 V3, avoided oNoite property demece 36,800 '1,160 V4, avoided tJeanup & power replacement 18,800 855 VS, routine worker exposure -1.5 -o.8 11, Cost to NRC 0.96 0.5 12 Cost to hcensee 104.3 42.8 NV, Not value 153,100. 5,129 Impact value ratio 0.001 0.01 4.2 Attributes for Each Case The results for the seven attributes (5 values and 2 impacts), that togetner yield the net values, are sumarized in Table 6. The avoided public health (It is sufficiently large that the net risk value,(VQisthedominantvalue.

NV', would still be positive if all the other values (V2, V3, V4, and V5) were zero.) However, V3, avoided offsite property damage, and V4, avoided onsite costs, also are important contributors. Avoided occupational exposure associated with accident management and cleanup (V2) contributes a small amount. Routine occupational exposure from implementation of new requirements (VS) is a negative value but almost negligible. The dominant impact is direct 26

licensee cost to implement the r.ew requireme n s and changes in operating costs (12). The cost to the NRC (11) is eseentialb negligible.

4.3 Non-Quantifiable or Poorly Quantifiable Attributes  !

l Section 50.67(a)(1) will result in some benefits that are quantifiable and some that are not quantifiable. These non-quantifiable benefits include the improved enforceability and inspectability that are facilitated by the, proceddres for training, quality assurance, and corrective actions to ensure -

compliance with the requim ments of rule. The requirement of f 50.67 t develop TS also facilitates the inspectability and enforceability of th,oe rule.

These non-quantifiable benefits permit the NRC to reduce the number of significant events, particularly those that may occur at plants with practices that are well below average in terms of safety and, thus, more susceptible to identification through inspection and remediation through enforcement.

4.4 Key Assumptions 4.4.1- Base Case for the base case, the Regulatory Analysis Guidelines (NUREG/BR-0058, Rev. 2) specify that no credit may be given for voluntary actions taken by licensees.

Therefore, with respect to equipment availability, the base case only credits equipment-that is required to be operable by Standard Technical Specifications (STS). 7 The base case estimates credit:

e one onsite power source e one offsite power source r .

-e 2 trains of RHR (which also meet BWR Mode-5 ECCS LCOs) and support equipment , ,

PORV operability (PWR LTOP TS) e RHR nutomatic isolation on Level III (BWRs)

• operator recovery actions __

Since the following equipment isinot required by TS to be available, the base case does not credit:-

e -containment

• PWR ECCS capability . .

-e '_ ,

BWR RCS venting capability (SRV operability) 4.4.2 Voluntary Action Case As recommended in- NUREG/BR-0058, a voluntary action case was performed that -

credits voluntary initiatives. . This case credited equipment required by TS and- equipment' recommended to be available' based on guidance from GL 88-17 and The base case configuration should not be interpreted as representative of actunt plant configuration. It is rather a re@lred construct for purposes of regulatory enetysis. Through NRC and industry guidance, licensees routinely keep more egipment available than required by TS.

27

NUMARC 91-06. For PWRs, GL 88-17 recommended the following to be implemented during reduced inventory operations: containment clasure procedures, two means of adding inventory to the RCS in addition to the two RHR pumps, level and temperature instrumentation. NUMARC 91-06 provided high level. guidance to BWR and PWR licensees on how to control outage risk. {

For both PWRs and BWRs, two voluntary action cases were performed representing different interpretations of NUMARC 91-06 and GL 88-17. Ti.e higher CDF voluntary case represents a minimal implementation of both guidance documents,. -

in terms of the amount of extra equipment and additional sources of water being made available. The low CDF voluntary case represents a more in ' depth implementation of both guidance- Both PWR and BWR cases include improved initiating event frequencies and improved operator recovery actions. These two cases are not meant to bound current plant operations but are intended to be examples of reasonable interpretations of the referenced guidance.

The higher CDF voluntary case for BWRs credits equipment credited in the base case plus, two operable SRVs, an additional low pressure injection pump, and a long term source of water. The lower CDF voluntary case includes the equipment described in the high voluntary action case plus an additional EDG (or equivalent onsite power source), high pressure service water, fire water, and core spray. For PWRs, the higher CDF voluntary action case includes the equipment credited in the base case, plus 1 ECCS injection pump, gravity feed, and an "available" containment. The lower CDF PWR voluntary action case adds:

an additional EDG (or equivalent power source), a second ECCS pump, containment spray pumps (to supplement the RHR pumps), steam generator heat removal, and a recirculation capability. (An "available containment" is 1

defined as one that can be closed by remote or local manual actions before containment conditions become intolerable.) ,

4.4.3 Rule Case -

The rule case only credits equipment as outlined in the Statement of Considerations and the Regulatory Guide for i 50.67. The following equipment was credited:

2 RHR trains, including support equipment 1 emergency core cooling system (ECCS) pump and support equipment (one of the RHR pumps for BWRs) 1 emergency diesel generator 1 source of offsite power , ,

~_ .,

• • equipment comparable in mitigation capability to an intact containment indication of temperature immediately above core inside the reactor vessel (RV) accurate RV water level indication pressure control capability (2 SRVs for BWRs or 2 PORVs for PWRs) level III isolation capability for BWRs a long term source of water or a recirculation capability reduced initiating event frequencies and improved operator recovery actions.

28 1

Since it is the staff's expec.tation that the licensee will have an intact containment or an additional mitigative capability that is comparable to an intact containment, two risk estimates are provided in Table 4. For BWRs, the additional mitigative capability that is comparable to an intact. containment includes fire water. For PWRs, the additional mitigative ca an "available containment", an additional injection source, an pab,ility ir-ludes additic,ral EDG (or feed.

equivalent onsite power source), steam generator heat removal, and gravity 5 RATIONALE FOR SELECTING THE PROPOSED ACTION < .

As discussed in this regulatory analysis, a quantitative value-impact analysis using PRA techniques shows large positive net values for tho prescribed " base case to rule case" comparison for both PWRs and BWRs, despite a bias built into the analysis that undercalculates the worth of the rule. This bias was principally the omission of certain external events from the calculations. In addition, the non-quantifiable attributes of the proposed rulemaking are

. substantial; they include the ability to inspect and enforce elements of safe operation during the shutdown condition.

5.1 Relationship to Other NRC Programs and Requirements Modifications are expected in plant-specific TSs and in the STSs documented in NUREG-1430, NUREG-1431, NUREG-1432, NUREG-1433, and NUREG-1434 (Standard TSs for NSSSs [and associated plants] applicable to Babcock & Wilcox, Westinghouse, Combustion Engineering, General Electric BWR/4 designs, and General Electric BWR/6 designs, respectively). Some of these changes have been addressed in this regulatory analysis and in associated rulemaking documentation.

The rule will result in inspection activities that are' broadly covered by the NRC's Five-Year Plan. Headquarters, regional, and resident- inspector-personnel will be trained in the rule's features and its implications.

Workshops will be conducted to update licensee and vendor personnel and to explain NRC's expectations. Inspection depth will be tailored to the adequacy of licensee implementation and the observed effectiveness on event frequency and mitigation.

The decision to proceed with rulemaking is consistent with NRC's safety goal screening crit'eria. Guidance on what constitutes a substantial increase in the overall- protection of public health and safety appears in Table 7,(taken from NUREG/BR-0058).

By the agency's procedures, the staff is required to assume that in the base case, licensees follow no more than what is required by the regulations and technical specifications. The difference between the base case and the rule .

case is used as a decision. criterion. T base case to the rule case of 10'3 to 10'ge per CDFreactor-year reduction ininmoving from the combination with a containment that is not required to be closed, meets the criteria of Table 7 to proceed, and the NRC consequently developed the PRA and the proposed rulemaking.

29

Table 7. Safety Goal Decision Guidance t

It 03 j Proceed with value/lapact portion of Proceed with value/ impact portion of regulatory analysis regulatory analysis (Priority) 12 . Management decislen eether to Proceed wlth value/lapact' portion of.

Change in proceed with value/lapact portion of regulatory analysis Core-Damage regulatory analysis .

Frequency

(&CDF/r yr) 12 05 '

No Actico Management decision sether to proceed with value/lapact portion of regulatory analysis it 02 It 01 1 Conditional Contalrpent Failed Probability 5.2 Statement of Proposed Generic Requirement The following proposed rule will be published in the federal Register for comment:

PART 50 - DOMESTIC LICENSING OF PRODUCTION AND UTluZATION FACILITIES

1. The authority citation for Part 50 continues to read as follows:

AUTHORITY: Secs. 102,103,104,105,161,182,183,186,189, 68 Stat. 936,937,938, 948,953,954,955,956, as amended Sec. 234, 83 Stat.1244, as amended (42 U.S.C. 2132, 2133, 2134, 2135, 2201, 2232, 2233, 2236, 2239, 2282); Secs. 201, as amended. 202,206, 88 Stat.1242, as amended, 1244,1246 (42 U.S.C 5841, 5842, 5846), E.O.12829, 3 CFR.

1993 Comp., p. 570; E.O.12958, as amended, 3 CFR, Comp., p.333; E.O.12968, 3 CFR,1995 Comp., p. 391.

Sec. 50.7 also issued under Pub. L.95-601, Sec.10, 92 Stat. 2951 as amended by Pub. L.

102-486, Sec. 2902,106 Stat 3123 (42 U.S.C 5851). Sec. 50.10 also issued under Secs.101, 185, 68 Stat. 936, 955, as amended (42 U.S.C. 2131, 2235); Sec.102, Pub. L.91-190, 83, Stat. , ,,

853 (42 U.S.C. 4332). Secs. 50.13, 50.54(ddl, and 50.103 also issued under Sec.108, 68 Stat.

939, as amended (42 U.S.C. 2138). Secs. 50.23. 50.35, 50.55, and 50.56 also issued under Sec.185, 68 Stat. 955 (42 U.S.C. 2235). Secs. 50.33a, 50.55a and Appendix Q also issued under Sec.102, Pub. L. 91 190, 83 Stat. 853 (42 U.S.C. 4332). Secs. 50.34 and 50.54 also issued under Sec. 204, 88 Stat.1245 (42 U.S.C 5844). Secs. 50.58, 50.91, and 50.92 also issued under Pub. L.97-415, 96 Stat. 2073 (42 U.S.C. 2239). Sec. 50. 78 also issued under Sec. 122, 68 Stat. 939 (42 U.S.C 2152). Secs. 50.80 50.81 also issued under Sec.184, 68 Stat.

954, as amended (42 U.S.C. 2234). Appendix F also issued under Sec.187, 68 Stat. 955 (42 U.S.C 2237).

2. In i 50.8, paragraph (b)is revised to read as follows:

30 1

i 50.8 information collection requirements: OM8 approval.

(b)

The approved information coIInction requirements contained in this part appyr in ii 50.30, 50.33, 60.33a, 50.34, 50.34a, 50.35, 50.36, 50.36a, , 50.36b, 50.44, 50.46, 50.47, 50.48, 50.49, 60.54, 60.55, 50.55a, 50.59, 50.60, 50.61, 50.62. 50.63, 50.64, 50.65, 50.66, 50.67, .

50. 71, 50. 72, 50. 73, 50. 74, 50. 75, 50.80, 50.82, 50.90, 50.91, 50.120 and appendices A, B, E, G, H, I, J, K, M, N, 0, O R and S to this part. ,,; -

3. Section 50.2 is revised by adding in afohabetical order the definition for Shutdown oneration as foMows:

i 50.2 Definitions Shutdown aceration means the reactor coolant system (RCS)is in Cold Shu;down or Refueling (as defined in a plant's technical specifications) and one or more fuel assemblies are located in the reactor vessel or in the refueling cavity. Shutdown operation is a part of normal operation.

4. Section 50 34 is revised to read as foHows:

5 50.34 Contents of appucations; technicalinformation.

(b) * * *

(12) The assumptions andparameter values usedin safety analyses required by i 50.67(b) as reference bounds for design to demonstrate adequate decay heat removal for the fuel storage pool.

5. Section 50.65(b) is revised to insert a new, subparagraph (b)(2) liv) as foHows:

I 50.65 Requirements for monitoring the effectiveness of maintenance at nuclear powerplants.

(b) * * *

(2) * * *

(iv). necessary for compliance with I 50.67 of this part.

6. A new i 50.67 is added to read as foHows:

l 5 50.67 Shutdown and Fuel Storage Pool Operations at Nuclear Power Plants (a) Shutdown Operations. Holders of operating Mcenses and combined Mcenses for a light water reactor nuclear power plant, except those plants that have been permanently shut down with fuel permanently removed from the reactor vessel, shan comply with the following requirements except when allfuelhas been transferred out of the reactor vessel:

.. (1) Shutdown Operation Procedures. Ucensees shall establish andimplement procedures

. (including procedures for training, and quality assurance and corrective action measures) for the activities for complying with the requirements of paragraph (a) of this section. Except for those procedures necessary for complying with paragraph (a)(4) of this section, the criteria for determining the adequacy of the procedures and the method for establishing, modifying, and 31 '

< superseding the procedures must in describedin the administrative controls section of technical specifications.

(2) Performance Monitoring. '

(i) Licensees shan establish, monitor, and comply with parameter limits during \

shutdown operation. The parsmeter limits must ensure compliance with the fonowing safety function limits:

(A) Decay heat removal such that the water temperature above the reactor core is less than the -

saturation temperature.

(B) Reactor Coolant System (RCS) inventory control such that the RCS water levelis sufficient for reliable operation of the normalmeans of decay heat removal.

(C) RCS and connected systems pressure control such that the design pressure and Low Temperature Overpressure Protection (LTOP) settings are not exceeded.

(ii) The parameters, parsmeter limits, and monitoring requirements (including the nature and frequency of monitoring) must be identified and described in a licensee-controHed document that is identified in the administrative controls section of the technical specifications. The criteria and method for licensee selection of the parameters, the parameter limits, and the nature and frequency of monitoring must be describedin the administrative controls section of technical specifications.

(3) Mitigation Capability. Licensees shan maintain available a mitigation capability to provide adequate core cooling, decay heat removal, and sufficient protection against the uncontrolled release of fission products foHowing the loss or interruption of decay heat removal during shutdown operation. The structures, systems, and conmonents for complying with this section must be identified in a licensee-controHed document that is identified in the administrative controls section of the technicalspecifications. The criteria andmethod forlicensee sqlection of the structures, systems, and components necessary for complying with this section must be describedin the administrative controls section of technical specifications. - -

(4) Fire Protection.

(i) Ucensees shan:

(A) Minimize the frequency of fires during shutdown operation; (B) Maintain the decay heat removal function free of fire damage or limit the levels of fire damage by promptly detecting, controHing, and extinguishing fires that do occur, and , , ,

(C) Develop and implement a contingsacy plan for maintaining adequate core cooling andin a timely fashion restoring decay heat removalin the event of a fire in those areas that interrupts or degrades heat removal to an ultimate heat sink.

(ii) The provisions necessary for complying with this paragraph (including the contingency plan) must be describedin the fire protection plan required by 10 CFR 50.48.

(b) FuelStorage Pool Operation. Holders oflicenses authorizing storage or movement of fuelin a fuel storage pool refueling cavity or connected wate'r-fined cavity at a light water reactor nuclear power plant shah describe in the updated final safety analysis report the assumptions and parameter values usedin safety analyses performed by the licensee as reference bounds for design 32

A to demonstrate adequate decay heat removal for the fuel storage pool and ensure that the procedures for the fuelstorage poolcontain operationallimits that incorporate the assumptions and parameter values in the updated final safety analysis report.

(c) Implementation. Each licensee shall:

\

(1) Develop and submit for NRC review and approval technical specifications required by paragraph (a) of this section by (INSERT EFFECTIVE DA TE OF FINAL RULE PLUS 6 MONTHS);

.c -

(2)

Update the fire protection plan required by i 50.48 of this part by (INSERT EFFECTIVE.

OA 7E OF FINAL RULE PLUS 12 MONTHS) by describing the various positions within the lic'ensee's organization that are responsible for complying with paragraph (a)(4) of this section, the authorities that are delegated to each of these positions to implemnnt these responsibilities, and the specific features necessary for complying with paragraph (a)(4)/ and (3) Revise their updated final safety analysis report as required by paragraph (b) of this section at the next scheduled revision following (INSERT EFFECTIVE DA TE OF FINAL RULE PLUS 6 MONTHS);

(4) Revise the procedures for the fuel storage poolas required by paragraph (b) of this section by (INSERT.EFFECTIVE

. . . . DA TE OF FINAL RULE PLUS 12 MONTHS).

7.

Section 50. 72 is revised to insert a new subparagraph (b)(1)(vii) as follows:

i 50.72 Immediate

. . . . notification

. requirements for operating nuclear power reactors.

(b) * * *

(1) * * *

(vii) Any event that results or should have resultegiin the actuation of, the mitigation capability required by i 50.67(a)(3),

8. Section 50.73 is revised to insert a new subparagraph (a)(2)(xi) as follows:

I S0.73 Licensee event report system.

(a) * * *

(2) * * *

(xi) Any event that results or should have resultedin the actuation of the mitigation capability requiredby 5 50.67(a)(3).

. , , . u.

PART PLANTS 54 - REQUIREMENTS FOR RENEWAL OF OPERA TING LICENSES FOR NUCLEAR POWER

9. The authority citation for Part 54 continues to read as follows: '

AUTHORITY: Secs. 102,103,104,161,181,182,183,186,189, 68 Stat. 936, 937, 938, S48, 953, 954, 955, as amended, sec. 234, 83 Stat.1244, as amended (42 U.S.C. 2132, 2133, 2134, 2135, 2201, 2232, 2233, 2236, 2239, 2282); secs 201, 202, 206, 88 Stat.1242, 1244, as amended (42 U.S.C. 5841, 5842), E.O.12829, 3 CFR 1993 Comp., p. 570; E.O.12958, as amended, 3 CFR,1995 Comp., p. 333; E.O.12968, 3 CFR,1995 Comp., p. 391.

33 ^

10. Section 54.4 is revised to read as follows:

I S4.4 Scope.

(a) l (3) All systems, structures, and components relied on in safety analyses or plapt evaluations to perform a function that demonstrates compliance with the Commission's regulations for fire protection i10 CFR 50.48), environmental qualification (10 CFR 50.49), pressurized thermal shock (10 CFR 50.61), anticipated transients without scram (10 CFR 50.62), station blackout (10 CFR 50.63), anc' shutdown and fuel storage pooloperations (10 CFR S0.67). . .

5.3 Statement Regarding Nature of Proposed Requirement The proposed rulemaking action is to issue the proposed rule for coment.

Following the coment period and after addressing the coments, the staff will issue the rule as a final requirement to address shutdown and fuel storage pool operation.

6 IMPLEMENTATION The proposed action is a new rule that addresses shutdown operation of nuclear power plants. The licensee's response to the rule is to be documented by modification of its FSAR, procedures for the fuel storage pool, fire protection plan, and its technical specifications. Temporary instructions will be issued and ' workshops will be held to explain the rule and its implications to industry and to NRC staff. The rule spedfies taat technical specifications must be submitted to the NRC within 6 months of the date of issuance of the rule, and the fire protection plan and. procedures for the fuel pool must be revised within 12 months of the date of issuance of the rule. The rule also specifies that the FSAR for the fuel pool must be updated at the first scheduled revision of the FSAR following 6 months from the date of issuance of the rule.

7 REFERENCES Advisory Comittee on Reactor Safeguards, " Proposed Rule on Shutdown Operations," Letter from Chairman, ACRS, to NRC Executive Director for Operations, June 4, 1996.

~ '

Advisory Comittee on Reactor Safeguards,

• Establishing a Benchmark on' Risk During Low-Power and Shutdown Operations," Letter from Chairman, ACRS to Chairman, NRC, April 18, 1997.

" Background Information for Westinghouse Owners Group Abnormal Response Guideline, ARG-1, Loss of RHR While Operating at Mid-loop Conditions," Rev.

O, March 15, 1990.

Babcock and Wilcox, Nuclear Technologies, " Emergency Operating Procedures Technical Bases Document," Rev. 7, (no number) October 1989.

34

Nuclear Management and Resources Council, ' Guidelines for Industry Actions to Assess shutdown Management," NUMARC 91-06, December 1991.

U.S. Nuclear Regulatory Comission,Bulletin 80-12 " Decay Heat! Removal System Operability," May 1980.

{

U.S. Nuclear Regulatory Commission, COMSECY-95-033 Memorandum to Executive Director for Ope *ations from Secretary, September 18, 1995.

U.S. Nuclear Regulatory Commission, ' Shutdown and low-Power Operations for .

Nuclear Power Reactors," federal Register, Vol. 59, No. 201, page 52707, (59 FR 52707) October 19, 1994.

U.S. Nuclear Regulatory Comission, GL 80-42 " Decay Heat Removal System Operability" (also referenced as IE Bulletin 80-12), May 9,1980.

U.S. Nuclear Regulatory Comission, GL 80-53

• Decay Heat Removal Capability,"

June 11, 1980.

U.S. Nuclear Regulatory Comission, GL 81-21 ' Natural Circulation Cooldown,"

May 1981.

U.S. Nuclear Regulatory Comission, GL 85-05 " Inadvertent Boron Dilution Events," January 1985.

U.S. Nuclear Regulatory Comission, GL 87-12 " Loss of RHR While the RCS is Partially Filled," July 1987.

U.S. Nuclear Regulatory Commission, GL,88-17 ' Loss of Decay Heat Removal,"

October 17, 1988.

U.S. Nuclear Regulatory Comission, ' Review of Recent Shutdown Events,"

Memorandum from Michel Labatut and Mohamed A. Shuaibi to Chief, Reactor Systems Branch, NRR, August 14, 1995 (TAC No. M77701).

U.S. Nuclear Regulatory Commission, Region 1, 'Haddam Neck Station, NRC Inspection Report No. 50-213/96-08, September 3,1996 - October 2,1996.

U.S. Nuclear R'egulatory Comission, Augmented Inspection Team, "Less of Residual Heat Removal System, Diablo Canyon, Unit 2, April 10,1987,"

NUREG-1269 June 1987. ,

U.S. Nuclear Regulatory Comission, " Loss of Vital AC Power and the Residual Heat Removal System During Mid-loop Operations at Vogtle Unit 1 on March 20, 1990," NUREG-1410, June 1990.

U.S. Nuclear Regulatory Comission, 'NRC Standard Technical Specification and Bases for Babcock and Wilcox Plants," NUREG-1430, April 7,1995.

U.S. Nuclear Regulatory Comission, "NRC Standard Technical Specification and Bases for Westinghouse Plants," NUREG-1431, April 7, 1995.

35

U.S. Nuclear Regulatory Comission, 'NRC Standard Technical Specification and Bases for Combustion Engineering Plants," NUREG-1432, April 7, 1995.

U.S. Nuclear Regulatory Comission, "NRC Standard Technical Spe'cification and Bases for Boiling Water Reactor - 4 Plants," NUREG-1433, April 7, 1995.

U.S. Nuclear Regulatory Comission, "NRC Standard Technical Specification and Bases for Boiling Water Reactor - 6 Plants," NUREG-1434, April 7,1995.

U.S. Nuclear Regulatory Commission, " Shutdown and Low-Power Operation at Comercial Nuclear Power Plants.in the United States," Final Report, HUREG-1449, September 1993.

• U.S. Nuclear Regulatory Commission, PRA Working Group, ' A Review of the N,RC Staff Uses of Probabilistic Risk Assessment," NUREG-1489, March 1994.

U.S. Nuclear Regulatory Comission, "NRC Regulations Handbook," Rev. 3, NUREG/BR-0053, June 1995.

U.S. Nuclear Regulatory Comission, " Regulatory Analysis Guidelines of the U.S. Nuclear Regulatory Comission," Revision 2, Final Report, NUREG/BR-0058, November.1995.

U.S. Nuclear Regulatory Comission, " Technical Guidance for Siting Criteria l Development," Sandia National Laboratory, NUREG/CR-2239, December 1982.

U.S. Nuclear Regulatory Commission, " Technology, Safety and Costs of Decomissioning Reference Light Water Reactors Following Postulated Accidents," Pacific Northwest Laboratory, NUREG/CR-2601, November 1982.

U.S. Nuclear Regulatory Comission, " Estimates of the Finan~cial Consequences of Nuclear Power Reactor Accidents," Sandia National Laboratory, NUREG/CR-2723, November 1982.

U.S. Nuclear Regulatory Conaission, " Generic Cost Estimates," Science and l Engineering Associates, Rev.1, NUREG/CR-4627, February 1989.

l U.S. Nuclear Regulatory Commission, "A Review of the Technical Issues of Air Ingression During Severe Reactor Accidents." Sandia National Laboratories, NUREG/CR-6218, September 1994. . , ,

i U.S. Nuclear Regulatory Comission, " Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Grand Gulf, Unit 1," Sandia National Laboratories, NUREG/CR-6143, June 1994 (Main report; appendices-published at later dates).

U.S. Nuclear Regulatory Commission, " Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Surry, Unit 1," Brookhaven National Laboratory, NUREG/CR-6144, June 1994 (Main report; appendices published at later dates).

l 1

36 l

APPENDIX A (FUEL STORAGE POOL OPERATION)

Regulatory Analysis Fuel Storage Pool Operation in the Proposed Rule' i 50.67 Shutdown and Fuel Storage Pool Operations at Nuclearg Power Plants 1 RULEMAKING OBJECTIVE, STATEMENT OF PROBLEM, RESOLUTION 1.1 Objective The objective of the fuel storage pool portion of the rulemaking is to present

• clearly defined regulatory controls for current fuel storage pool operational practices.

1.2 Statement of Problem The safety of fuel storage in the fuel storage pool is determined by the coolant inventory, coolant temperature, and fuel reactivity. Coolant inventory affects the capability to cool the stored fuel, the length of time for events involving the coolant to become significant, the degree of shielding provided for the operators, and the consequences of postulated fuel handling accidents.

Coolant temperature affects operator performance during fuel handling, control of coolant chemistry and radionuclide concentration, generation of thermal stress within structures, and, at elevated temperatures, environmental conditions in areas surrounding the storage pool. Environmental conditions are important because an adverse environment could preclude access to equipment necessary for control of coolant inventory and temperature, which is typically controlled and operated ir areas adjacent, to the fuel pool, and degrade the operation of essential systems. Fuel storage pools are designed to maintain a substantial reactivity margin to criticality under all -

postulated storage conditions to ensure the heat generated within each fuel assembly decreases with time.

The existing regulatory framework provides controls on the design of the fuel storage pool and related equipment in the form of the design bases for these structures, systems, and components (SSCs) and in the form of the design control provisions of each licensee's quality assurance program. However, the applicability of design control provisions to the fuel storage pool heat removal function is not clear and not uniform throughout industry, and this regulatory framework does not provide effective controls on the availa'bility "

• of equipment and the performance of operators in maintaining the heat removal and coolant level control safety functions. Methodical management of assumptions in the design basis is important to ensure operating conditions are within analyzed bounds.

Over the past few years, the NRC staff has reviewed fuel storage pool design features and operational practices and has evaluated the risk from storage of irradiated fuel in pools. The NRC's activities in these areas were influenced by the following occurrences: a notification of potential design defects related to irradiated fuel storage at-Susquehanna, an NRC inspection identifying design weaknesses and substantial deviations from safety analysis ,

A-1

conditions for storage of irradiated fuel at the permanently shutdown Dresden .

Unit 1, and a request for enforcement action regarding fuel storage pool operational practices at Millstone. The NRC coordinated these activities through implementation and modification of a generic spent fuel storage pool action plan (Memo to A. C. Thadani from G. M. Holahan, " Task Aqtion Plan for Spent Fuel Storage Pool Safety," October 13,1994).

As specified in the action plan, the NRC gathered information on fuel storage pool design features and operational practices through operational event .

reviews, site visits, and reviews of licensing documents (including safety analysis reports). Using this information, the NRC reviewed fuel stora'ge pool designs to identify particular sites having fuel storage pool related features that increased the potential for a significant loss of coolant inventory, reduced the reliability of fuel pool decay heat removal, or increased the potential for a consequential loss of essential safety functions affecting an operating reactor. On the basis of its review, the NRC determined that existing structures, systems, and components related to storage of irradiated fuel provide protection of the public health and safety. However, the NRC found that design features inconsistent with current design standards existed at several plants, and the NRC determined that further evaluation of these specific plants was warranted. (" Resolution of Spent Fuel Storage Pool Action Plan Issues," EDO report to the Commission, July 26,1996),

in parallel, the NRC evaluated the conformance of refueling operational practices with design basis assumptions associated with the fuel storage pool and its support systems. During its evaluation, the NRC noted that routine refueling offload practices have not been consistent with licensing basis assumptions at several plants. In a number of instances, the NRC found that design basis assumptions have not been, captured in procedures, including procedural controls governing the timing and size of fuel transfers and the availability and redundancy of fuel storage pool cooling systems and toolant inventory control systems. [" Report on Survey of Refueling Practices " ED0 report to the Commission, May 21,1996). The NRC also determined that voluntary actions to govern fuel storage pool operations were inconsistently implemented despite industry-wide guidance and offered an inadequate basis for enforcement. Finally, an assessment of NRC oversight actions with regard to -

fuel storage pool operations at one plant site performed by the Office of the Inspector General noted considerable weaknesses in the staff's enforcement practices ("NRC Failure to Adequately Regulate - Millstone Unit 1," Office of the Inspector General Case No.95-771, December 21,1995). These findings. led '_ ,

the NRC to conclude that an explicit regulatory framework needed to be established for fuel storage pool operations in order to ensure that activities are conducted in accordance with safety analysis assumptions, and to ensure.that deviations from those assumptions are subject to enforcement.

1.3 Resolution The resolution of the NRC's action plan for spent fuel storage pool safety identified three areas for regulatory action. The first action involves implementation of this proposed rule for fuel storage pool operations. The second action involves addressing certain identified design features that reduce the reliability of fuel storage pool-decay heat removal, increase the A-2

potential for loss of spent fuel coolant inventory, or increase the potential for consequential loss of essential safety functions at an operating reactor.

The identified design features that pose an increase 90tential of fuel storage pool events relative to common design practices will be addressed for each affected plant through regulatory analyses for safety enhancement backfits on a plant-specific basit,. The third action is revision of the fuel storage pool design guidance documents.

The fuel storage pool portion of the rulemaking contains clearly defined ~

regulatory controls for current fuel storage pool operational practices. The NRC believes that the proposed rule expresses NRC expectations for contr'ol of fuel storage pool operations and establishes a clear basis for enforcement actions.

2 BACKFIT ANALYSIS Although the existing regulations governing the design of fuel storage pools provide protection of public health and safety, the NRC has determined that an enhancement of existing regulatory control of fuel storage pool operations is i

justified by the qualitative benefits of that action. Through its review activities associated with fuel storage pools, the NRC has found that the design bases for fuel storage pools documented in safety analysis reports are a inadequate for consistent enfor::ement and ins >ection of fuel storage pool o)erations.This condition, in combination witi economic pressure to achieve s:1orter refueling outages and the safety benefits achieved by removing all fuel from the reactor vessel darir:g certain refueling operations, has enabled some licensees to o)erate in conditions outside the envelope evaluated for safe operation of tie fuel storage pool without effective methods for the NRC to apply regulatory controls, e .

To correct this situation, the NRC has drafted the fuel storage pool o'peration portion of the proposed rule. The regulatory analysis for the fuel storage pool operation shows no quantifiable risk benefit because risk is already believed to be very low. The low risk results from passive desitn features of the fuel storage pool and the resulting long time period available for mitigative actions from the occurrence of an event to the onset of fuel damage. However, the NRC concluded that the proposed requirements for fuel storage pool operation provide significant benefits. These non-quantifiable benefits include the enforcement and inspection capabilities that are facilitated by the documentation of key parameters and assumptions. . .

The requirement of 5 50.67 to incorporate these assumptions into procedures also facilitates the inspection and enforcement of operations that deviate from the procedures. The inclusion of the design parameters and assumptions in the safety analysis report will also result in increased regulatory control over changes to these parameters and assumptions, since they will be subject to the requirements of i 50.59.

These non-quantifiable benefits permit the.FRC to prevent significant events from occurring, particularly thoSL that may occur at plants with practices that are well below average in terms of safety and, thus, more susceptible to identification through inspection and remediation through enforcement. These A-3

significant qualitative benefits address the perceived need for improved regulatory controls in this area and justify the associated cost.

2.1 Objective.

i lhe objective of the fuel storage pool portion of the rulemaking is to provide clearly defined regulatory controls for current fuel storage pool operational practices. -

2.2 Required Licensee Actions. .

For fuel storage pc.o1 operation, each licensee must document the current design bases for fuel storage pool decay heat removal in the facility's safety

' analysis report and trust ensure that operational limits derived from those bases are contained in procedures. To fulfill this raquirement, each licensee shall review its own s4fety analyses to demonstrate u.quate decay heat removal for the fuel storage pool and to identify assumptions and parameter values used as reference bounds for design. Then, the licensee shall resolve any discrepancies or inconsistencies in these assumptions and parameter values using its own procedures for resolving non-conforming conditions. After the licensee develops a consistent set of assumptions and parameter values from the safety analyses, the licensee shall describe that set cf assumptions and parameter values in the safety analysis report and ensure that the procedures for the fuel storage pool contain operational limits that accurately reflect the assumptions and parameter values in the safety analysis report.

2.3 Potential Change in Risk to the Public.

The staff does not believe a significant, quantifiable, change in risk to the public will result from implementing the fuel storage pool aspects of the proposed rule. Estimates of the frequency of poolcoolantinventoryrangefromabout6x10,aseriouglossoffuel' to lx10' events per reactor storage year,andestimatesofthefrequencyof,asignifjeantincreaseinfuelstorage pool temperature range from about lx10' to lx10' events per reactor-year. On the basis of the expected equipment availability and the time available for human performance of activities necessary for recovery, the estimates of the frequency of fuel damage for these types of events is about 4x10'8 fuel damage events per reactor-year [NUREG-1353, ' Regulatory Analysis for the Resolution of Generic Iss'ue 82, 'Beyond Design Basis Accidents in Spent Fuel Pools").

2.4 Potential Impact on Occupational Radiation Exposure.

The proposed rule does not require the installation of equipment or the performance of any additional tasks inside radiologically controlled areas, nor does it require actions that reduce the potential occupational exposure during event recovery. Therefore, the potential impact on occupational radiation exposure is negligible.

2.5 Industry Costs.

• The proposed rule and regulatory guide have been drafted to minimize costs to licensees consistent with achieving minimum operating requirements. The NRC A-4

based its cost estimates on the one-time costs associated with revisions to the safety analysis report and to operating procedures.

On the basis of a survey of fuel storage pool licensing basis information completed in 1996, the NRC assumed that 40 operating reactor sites would implement complex revisions to operating procedures and, of those 40 sites,15 operating reactor sites would implement complex revisions to the updated safety analysis reports and 25 sites would implement minor revisions to the updated safety analysis reports in order to comply with the requirements. The

~

NRC estimated that the remaining 35 sites (i.e., the 29 remaining opera (ing reactor sites and the 6 independent permanently shutdown sites) would implement only minor revisions to tneir updated safety analysis reports and operating procedures to demonstrate compliance with the proposed regulation.

All costs are given in 1997 dollars and all operating costs are discounted at an annual rate of 7 percent. 1. abor cost rates were developed using information from NUREG/CR-4627 updated to 1997 dollars by assuming an annual rate of inflation of 5 percent. The following industry costs were calculated:

+ develop and/or modify operations and maintenance procedures - Complex: (40 Sites) X (20 pages/ site) X ($1500/page)= $1.2M; Minor: (35 sites) X (6 pages/ site) X ($1500/page) = $0.3H.

• revise the safety analysis report - Complex: ( 20 pages/ site) X

($5000/page) X (15 sites) = $1.5H ; Minor: (5 pages/ site) X ($5000/page) X (60 sites) =$1.5H.

The NRC expects continuing costs to be negligible for the documentation of the existing design basis because the administrative process controlling future changes and the operational limitations that evolve from the design are not required to be modified by the proposed regulation. On thit basis, the NRC estimates the total cost of implementation for the entire industry at $4.5H.

2.6 Potential Safety impact of Changes.

Although unquantified, the portion of the rule focused on the fuel storage pool is expected to enhance public health and safety, and to help in averting onsite consequences. These expectations will be realized through increased attention to the operational bounds established by the fuel storage pool's design bases. The increased attention will be driven by the rule, which is, a clear statement of HRC requirements, and which contains the framework needed _ ,

to facilitate inspection and enforcement activities that were lacking in the past.

2.7 Estimated hRC Resource Burden.

NRC costs were estimated to be negligible on the basis that existing inspection and enforcement activities encompass the activities necessary to verify compliance with the proposed requirements.

A-5

2.8 Potential Impact of Facility Differences.

Because the proposed requirement for documentation of the design bases and translation of assumptions and parameter values used in the design process into operational limitations is specific to each facility, thistrequirement will not involve cost impacts associated with facility differences.

2.9 Interim or Final Action.

The proposed actions are final. .

3 0FFICE POSITION ON PROPOSED GENERIC REQUIREMENT 3.1 Statement Regarding Nature of Proposed Requirement The proposed rulemaking action is to issue the proposed rule for comment.

Following the comment period and after addressing the comments, the staff will issue the rule as a final requirement to address shutdown and fuel storage pool operations.

3.2 Implementation The proposed action is a new rule that addresses fuel storage pool operation at nuclear power plants. The rule specifies that the FSAR must be updated at the first scheduled revision of the FSAR following 6 months from the date of issuance of the rule, in addition, the rule specifies that the procedures for the fuel storage pool must be revised within 12 months of the date of issuance of the rule. Some work will be necessary to clarify reporting requirements under i 50.72 and i 50.73. > .

4 IDENTIFICATION AND PRELIMINARY ANALYSIS OF ALTERNATE APPROACHES 4.1 No Action '

The no action option has been rejected on the basis that licensees have inconsistently implemented industry initiatives related to fuel storage pool operations and because existing regulations have not provided a clear basis for effective regulation of fuel storage pool operation. The NRC judges that, absent a rule, an observed trend toward shorter refueling outages and tighter main +,enance schedules will continue with the attendant increased potential. for . .

procedures to provide inadequate controls to maintain operation within the design basis for fuel storage pool operation.

4.2 Information Notice Numerous aspects of fuel storage pool design and operation have been addressed through information notices. Because fuel storage pool operation is broader than can be addressed in a single information notice, and there is little accountability or regulatory authority associated with an information notice, the NRC has rejected this option.

A-6

I 4.3 Generic Letter or Bulletin Generic letters and bulletins have been used to request that licensees provide information regarding )lanned actions to address a variety of issues. These approaches do not esta)11sh a satisfcctory enforcement basis because licensees can untiaterally change commitments ior made in response to generic letters and bulletins. The NRC has rejected this option because the estabitshment of an enforcement basis is an essential objective of this rule, 4.4 Technical Specifications Without Rulemaking ,

The NRC has rejected this approach because the regulatory basis for fuel storage pool decay heat removal specifications is inadequate. Specifications governing the availability and operation of systems are included in the category of limiting conditions for operation, but the fuel storage pool decay heat removal systems do not satisfy any of the criteria contained in 6 50.36 for establishment of a specification in this category.

4.5 Rule Establishing Uniform Regulatory Controls for Fuel Storage Pool Operation The NRC selected this alternative on the basis of the proposed rule's significant qualitative benefits. These benefits are seen to be the improved uniformity of regulatory controls and the clarification of staff expectations with regard to fuel storage pool operation. These benefits address the perceived need for improvement in this area and, thus, justify the associated Cost.

5 FUEL STORAGE P00L REQUIREMENTS e .

5.1 Proposed Individual Requirements

• I 50.67 Shutdown and Fuel Storage Pool Operations at Nuclear Power Plants.

(a) ** *

(b) Fuel Storage Pool Operation. Holders oflicenses authorizing storage or movement of fuelin a fuel storage pool, refueling cavity, or connected water filled cavity at a light water reactor nuclear power plant shall describe in the updated final safety analysis report the assumptions and parameter values usedin safety analyses performed by the licensee as reference bounds for design to dsmonstrate adequate decay he ? removal for the fuel storage pool and ensure that the procedures for the fuel storage poolcontain operationallimits which incorporate the assutnptions ,

and parameter values in the updated final safety analysis report. ,

(c) Implementation. Each licensee shalt:

(3) Revise their updated finel safety analysis report as required by paragraph (b) of this section at the next scheduled revision following (INSERT EFFECTIVE DA TE OF FINAL RULE PL US 6 MONTHS];

(4) Revise the procedures for the fuel storage poolas required by paragraph (b) of this section by (INSERT EFFECTIVE DA TE OF FINAL RULE PL US 12 MONTHS).

A-7 l

i 50.34 Contents of applications; technicalinformation.

(a) * **

(b) * **

(12) The assumptions andparameter values usedin safety analyses required by paragraph 50.67(b) as refersnce bounds for design to demonstrate adequate decay heat removal for the feel storage pool.

5.2 Relationship to Existing Requirements Some existing requirements apply to fuel storage pool operations. These include the following:

(1) Quality assurance (10 CFR 50.34(a)(7); 10 CFR 50.34(b)(6)(ii); 10 CFR 50.54(a) 1); and Appendix B to 10 CFR Part 50D, safety evaluation of changes 10 CFR 50.59), and notification requ4rements related to the design b sis (10 CFR 50.71(e); 10 CFR 50.72(b); and 10 CFR 50.73(a)(2)}-

A primary function of these regulations is to ensure that operations are conducted within bounds that have been evaluated for safe operation.

Because the quality assurance requirements do not apply equally to fu_el storage pool decay heat removal systems at all licensed reactors, the NRC concluded that these regulations provide insufficient regulatory control of fuel storage pool operations relative to the safety importance of the operations. Additionally, some licensees have not fully documented the assumptions for fuel storage pool decay heat removal in their safety analysis reports, and, consequently, the provisions of 5 50.59 are not fully controlling changes in operations related to these assumptions.

(2) Technical Specifications -Historically, technical specifications related to the fuel storage pool have been derived from the fuel handling accident analyses, and, consequently, the applicability of these technical specifications is limited to periods during movement of irradiated fuel or movement of loads over irradiated fuel. However, a small number of licenses for operating reactors contain technical s)ecifications requiring the operability of equipment capable of cooling tie fuel storage pool for a set period following reactor shutdown. Other licenses for operating reactors contain technical specifications .for. _ .

minimum fuel decay time ) receding movement that is based on the time for the decay heat rate in tie fuel to decrease to a value within the capacity of the fuel storage pool cooling system. Finally, another small group of licenses for operating reactors contain technical specifications that impose a limit on spent fuel storage pool temperature.

A-8

Appendix B Regulatory Analysis supplement Fire Protection For shutdown Operations

?

1 INTRODUCTION This appendix covers the regulatory analysis for the fire protection aspects of the shutdown operations rule. An analysis comparing the vulnerability of .-

the plant to a fire-induced core-damage event at shutdown to the plant vulnerability at power was performed for three cases: abasecasecrediting only existing fire protection regulatory requirements, a voluntary case crediting existing regulatory requirements and voluntary initiatives undertaken by licensees, and a rule case crediting the impact of the new fire protection requirements of 50.67. Factors important in relating the frequency of fire occurrence with core damage frequency were developed from the methodology used in NUREG/CR-5088 " Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, including Previously Unaddressed Issues.* The following factors were considered for the base, voluntary, and rule cases:

(1) the frequency of fires initiated during shutdown operations (2) the probability of having sufficient combustible loadings to allow a fire to propagate or to cause thermal / smoke degradation to important components, equipment, or systems needed to achieve and maintain the required safety function (3) the probability of important fire protection features being inoperable or degraded (e.g., fire detection and/or suppression system and the plant condition impact on, or delay of the fire brigade res>onse) to detect, control, and extinguish the fire before it affected tie redundant means of removinfl decay heat from the core (4) the probab'lity of failure to recover from the loss of decay heat removal, due to fire-related component, equipment, or system damage, before core damage -

2 CURRENT REQUIREMENTS

-The current requirements for operating nuclear power plants' fire protection programs are described in 10 CFR 50.48, " Fire Protection," Appendix A to 10 CFR Part 50, ' General Design Criteria for Nuclear Power Plants, Criterton 3 -

Fire Protection,' and Appendix R to 10 CFR Part 50, " Fire Protection P.rogram for Nuclear Power Facilities Operating Prior to January 1,1979.* In 10 CFR _ .

50.48 have a(a) and (e), the staff. specifies that all operating nuclear power plants fire protection plan that satisfies Criterion 3 o# Appendix A to 10 CFR Part 50. This plan must describe the overall fire p*otection program for the

' facility and the specific features necessary to implement the program, such as administrative controls and personnel requirements for fire prevention and manual fire suppression activities, automatic and manually operated fire detection and suppression systems, and the means.to limit fire damage to structures,. systems, or components important-to safety so that the capability to safely shut down the plant ir ensured. The NRC basic fire protection program guidance is contained it. Ranch Technical Position Auxiliary Power Conversion Systems Branch (BTP AN3) 9.5-1, ' Guidelines for Fire Protection B-1 '

for Nuclear Power Plants," for plants docketed after July 1,1976, and its Appendix A, ' Guidelines for Fire Protection for Nuclear Power Plants Docketed Prior to July 1, 1976.' ,

Criterion 3 of Appendix A to 10 CFR Part 50 only specifies theloverall fire protection design criteria for the facility and does not establish operational fire protection requirements, such as administrative controls and )ersonnel recuirements related to fire prevention, manual fire fighting capa)ilities, anc configuration controls regulating the operability of plant fire protection. ~

features. Current NRC fire protection requirements and guidance provide reasonable assurance that a significant fire event will not affect the , plant's ability to achieve'and maintain a safe hot shutdown under those conditions where it is operating at full power. In such an event, the plant will transition from power operation and achieve and maintain operation at hot shutdown conditions, using the post-fire, safe-shutdown train of systems that are free of fire damage, such as a high-pressure injection system for reactor makeup and by removing decay heat via the steam generators or the main condenser, while repairs to components, equipment, and systems necessary to achieve and maintain cold shutdown conditions and long-term decay heat removal are being implemented. However, if a significant fire event were to occur during shutdown operations (cold shutdown or refueling), current NRC fire protection regulations and guidance would allow damage to redundant systems necessary to remove decay heat and would only require that such systems be repaired within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Depending on plant conditions, core damage may occur if decay heat removal is lost for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> during shutdown operations, in summary, current fire protection requirements and related regulatory guidance focus on maintaining one train of those systems necessary for achieving and maintaining safe-shutdown conditions from power operations and do not address the effect of fires initiated during siwtdown modes of operations, or the potential impact a fire may have on the plant's ability to remove decay heat and maintain reactc,r water temperature below saturation conditions.

3 REGULATORY ANAL.YSIS APPROACH 3.1 Base Case A draft special study performed by The Office for Analysis and Evaluation of Operational Da'ta (AE00) entitled " Fire Events - Feedback of U.S. 0)erating Experience,' estimates.the mean frequency of fires in areas with tio potential _ .

to impact cold-shutdown equipment as follows: the BWR reactor building of 2.7E-2 per reactor-year, the PWR auxiliary building of 1.8E-2 per reactor-year, and the diesel generator building of 3.2E-2 per reactor-year. For the base case, however, the frequency of fires during shutdown operations is judged to be higher than that reported in the AE00 study because the study includes plants that have adopted voluntary measures to reduce the frequency of fire initiation. In addition, there is large uncertainty in the data base because of the reporting criteria used for assessing the frequency of fires.

Fires are only reportable to the NRC under 10 CFR 50.72, "Immediate Notification Requirements for Operating Nuclear Power Reactors " when the fire lasts for more than 10 minutes and, as such, results in the declaration of one of the emergency classes. Accordingly, the frequency of fires during shutdown B-2

operations is assumed to be in the IE-1 to IE-2 per reactor-year range.

According to the AE00 study, the fire frequency at power was similar to the fire frequency at Jhutdown operations.

Once a fire has started, sufficient combustibles must be available for the fire to develop and release sufficient energy or combustion byproducts so that it could damage the components, equipment, or systems important and necessary for removing decay-heat from the core. Virtually all extended outages involve the increased use of combustible materials. Therefore, the probability of. ~

having sufficient combustible materials to sup) ort the development of a fire during shutdown operations is judged to be higier than the probability

• associated with power operations. -

Fire barriers, or combinations of fire barriers or spatial separation with automatic sup)ression and detection systems, are used in some plants to ensure that one of tie redundant trains of post-fire safe-shutdown equipment is free of fire damage following a fire. In order to perform maictenance or facilitate modification work during shutdown operations, some plant fire barriers, automatic detection, or suppression systems are often degraded or taken out of service. During shutdown operations, there are no requirements that fire barriers have to remain in place or that compensatory actions other than a roving fire watch be provided following their removal. Therefore, the probability of important plant fire barriers to effectively mitigate the spread of fires during shutdown operations is judged to be lower than that associated with power operations, where fire barriers for separating post-fire safe-shutdown systems are required to be in place.

Automatic fire suppression systems can be effective in mitigating the consequences of fires. During shutdown o)erations, there are no requirements for automatic fixed fire su)pression capa)ility in plant areas important to achieving and maintaining t.1e decay heat removal fur.ction. In addition, manual fire fighting and fire detection features may be removed from service in plant areas important to decay heat removal, because of area related work activities. Accordingly, this factor is judged to be higher than that associated with )ower operations even though compensatory measures such as firewatches are seing taken, in the event that decay heat removal is lost because of a fire, there is the potential to r'ecover decay heat removal before the onset of core damage. In general, there are no requirements in the regulations for procedures, or ,

training for recovery of decay heat removal following a fire, except for the * ,

requirement that RHR be repairable within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. However, the time to reactor coolant system boiling and core uncovery are significantly less than the 72-hour repair period and, in some sequences, can be less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

Therefore, the failure to recover decay heat removal following a fire that results in fire damage and loss of decay heat removal is judged to be high.

For power operations, one train of safe-shutdown equipment is protected from fire damage at all times.

All four of these factors indicate a great'er threat from fires initiated during shutdown operations than from power-operations. This analysis leads to the conclusion that the core-damage frequency from fires during shutdown B-3

operations for the base case is significantly higher than that for power operations.

3.2 Voluntary case '

I On a voluntary basis, some plants have adopted enhanced practices for fire prevention and suppression. For example, licensees have trained fire brigades and generally comply with the guidance in BTP APCSB 9.5-1 or Standard Review Plan Section 9.5.1 on fire brigades, and the safety evaluation reports for . .

these plants reflect these commitments. In addition, plants have adopted measures to control transient combustible loadings. This is apparent in that, although a relatively high frequency of fires is observed during shutdown  ;

operations, the fires have typically been of short duration and of insignificant consequence. Furthermore, the AE00 study indicates that the fires that have occurred during shutdown operations have not resulted in unavailability of multiple trains of decay heat removal. The voluntary practices of licensees are therefore of safety relative to the base case. judged to provide a significant measure 3.3 Rule Case The fire protection aspects of the shutdown rule require licensees to minimize the frequency of fires, maintain the decay heat removal function or limit the levels of fire damage following a fire, and provide contingency plans for maintaining the fuel clad wetted and restoring a deca) heat removal path in the event of a fire. The fire protection aspects are intended to ensure that the components, equipment, and systems needed to support decay heat removal or the mitigation equipment in standby are not both lost as the result of a fire.

incorporate fire protection The proposed features rule design, into the plant requires licensees which to either (1)in the components, would mainta equipment, and systems needed to perform the decay heat removal functfon free of fire damage, or (2) limit the level of fire dama controlling, and extinguishing fires that do occur.ge by Forpromptly detecting, the components, equipment, and systems necessary to support and perform the decay heat removal function, licensees can adopt the fire protection features required by Appendix R,Section III.G.2 to ensure that the decay heat removal function remains free of fire damage. Both approaches are generally consistent with those fire operations. protection measures These measures notthat onlyare implemented reduce during the frequency offull-power initiating events but, make the measures contemplated by the proposed rule inspectable and . ', ,

enforceable. If implemented, it is estimated that these measures would reduce the frequency of fires and their duration, and would reduce consequences from the base case. Little change in duration is expected when compared to the voluntary case, although some reduction in consequence may result'from the rule requirement for core cooling contingency plans.

4. BACKFIT RULE The staff is pursuing requirements for fire protection for shutdown modes of operation in accordance with 10 CFR 50.109(a)(3), which specifies that the Commission _ shall require the backfitting of a facility only when it determines that there is a substantial increase in the overall protection of public B-4 l

(

health and safety or common defense and security to be derived from the backfit and that the direct and indirect costs of implementation for that facility are justified in view of this increased protection. ,

As discussed in sections 2 and 3.1, the existing fire protection requirements for shutdown operations are limited in scope and, as a result, significant risk to public health and safety may result from fires during shutdown operations, if licensees only implement the minimum requirements. The proposed fire protection requirements for shutdown 09erations are intended.to -

assure that a level of protection comparable to the Ievel provided for power operations is maintained during shutdown operations. Licensees will be required to include provisions to minimize the frequency of fires, protect '

shutdown eculpment from fire damage, and maintain the fuel cladding in a wetted concition until decay heat removal is restored. The cost of implementing the fire protection measures during shutdown operations has been estimated to be between $81 M and $100 M for the entire industry. The staff believes these costs are justified given the increased level of safety that will be assured shutdown through the more extensive fire protection requirements during operations.

The nine items listed in Section 50.109(a)(3) are discussed below for the proposed fire protection requirements during shutdown operations.

(1) Statement of the specific objectives that the proposed backfit is designed to achieve The fire protection aspects of the shutdown operations rule are to ensure that a level of protection comparable to that provided for power operations is maintained during shutdown operat, ions. .

(2) General description of the activity that would be required by the licensee or applicant in order to complete the backfit The fire protection aspects of the shutdown rule require licensees to minimize the frequency of fires, maintain the decay heat removal function free of fire damage or limit.the levels of fire damage following a fire, and provide contingency plans for maintaining the fuel cladding wetted and restoring a, decay heat removal path following a fire. The fire protection aspects are intended to ensure that the components equipment, and systems needed to provide decay heat removal and to have av,ailable mitigation equipment are not both lost as. the result of a comon mode failure, suc'h as " ,,

a fire. The proposed rule requires licensees to either incorporate fire protection features into the plant design which would maintain the components, equipment and systems needed to perform the decay heat removal function free of fire damage or limit the level of fire damage by promptly detecting, controlling, and extinguishing fires that do occur. For those components, equipment, and systems necessary to su) port and perform the decay heat removal function, licensees can adopt tie fire protection features required by Appendix R,Section I!!.G.2 to ensure that the decay heat removal function remains free of fire damage.

B-5

(3) Potential change in the risk to the public from the accidental off-site release of radioactive material Significant decrease in the risk to the public is expected from the base case with no fire protection requirements to the rule case ifor the voluntary case to rule case, varying degrees of risk reduction are expected to be gained from the fire protection aspects. This is due to the fact that some licensees currently are implementing fire protection measures on a voluntary basis and therefore, little risk reduction would occursat these ~

plants. However, significant risk reduction will be achieved for those licensees who have implemented only minimal fire protection measures ,during shutdown operations. Nevertheless, all of the voluntary measures can be retracted by licensee's without NRC approval. The rule is designed to assure the level of protection is maintained.

(4) Potential impact on radiological exposure of facility employees Three factors were considered in determining the impact of radiological exposure of facility employees: routine exposure, installation exposure, and clear.up exposure. No significant change is expected in routine and installation exposure since the plant design features necessary for compliance with this rule are already installed and maintained. Fire protection systems are largely situated in the auxiliary building of PWRs and the reactor building of BWRs. The routine doses in these areas is minimal. For the cleanup exposure, a significant decrease in exposure is expected because of the large decrease in core damage frequency from fires.

(5) Installation and continuing costs associated with the backfit, including the cost of facility downtime or the cost of construction delay The rule allows licensees three approaches for addressing fire prot'ection:

a hardware-oriented approach, a software-oriented approach, or a combination software / hardware oriented approach. The hardware-criented approach would be more expensive if equipment and features are not already in place. If the hardware does exist, minimal costs are anticipated; otherwise, a licensee would probably implement the software-oriented approach, which would mainly consist of procedures and contingency plans, in some cases, licensees may pursue a combination of the hardware and softwareapptoach.

" ^

The cost of implementing any of the approaches is likely to be highly plant-specific. The software approach consisting of procedures, training, quality assurance, corrective actions, and contingency plans has been estimated to cost approximately $700 K per plant with annual maintenance costs of $30 K. Much of the post-fire safe shutdown analysis to support the procedures, and training required to meet the software approach already exists in existing fire protection requirements for. power operation and, therefore the costs associated with the shutdown operation rule would be limited to the extension of these measures to shutdown operation at an estimated cost of $300 K (200 pages at $1500 per page) per plant and annual maintenance costs of $10 K. The contingency plans and the equipment and B-6 l

1

components necessary to support the contingency plans are estimated to cost

$400 K per plant, with annual maintenance costs of $20 K per plant.

The hardware approach is estimated to cost approximately $905 K. Before any fire protection hardware can be installed, a fire and >ost-fire analysis must be performed to determine the locations at witch fire protection is needed. Much of this analysis has already beert performed for power operations and, therefore, costs of $75 K have been estimated to extend this analysis to shutdown operation. The actual fire protection -

hardware has been estimated to cost $800 K per plant with annual maintenance costs of $30 K.

• The combined approach is estimated to cost approximately $750 K with annual maintenance costs of $30 K. This estimate was selected on the basis of a combination of the hardware and software costs.

Fire Protection Software Approach Hardware Approach Combined Approach item $K $K

$K Hardware Features _

0 800 400 Procedures, 300 75 150 Training, and Analysis Contingency Plans 400 0 200 and Equipment Annual 30 '

30

• 30 Maintenance The total fixed cost for the 110 plants ranges from $77 M ($700 K x 110) to

$96 M ($875 K x 110). Industry annual maintenance costs ($30 K) are incurred over the remaining life of each NSSS and are individually converted percent) and to tia=present remainingvalue life via [1-exp(-rt})]/r, of plant where value

" " The present r - discount of the rate (7 continuing costs for 73 PWR plants is $2.4 M, and the present value for the 37 BWR plants is $1.2 M. Thus, the total sum of fixed plus present value of continuing costs ranges from approximately $81 M to $100 M for the industry. * * * *

(6) The potential safety impact of changes in plant or operational complexity, including t:1e relationship to proposed and existing regulatory requirements As the rule will place additional burden on licensees, operational complexity will increase in that fire protection features will be required to remain in place during shutdown operations, or additional procedures and contingency plans will have to be developed and adhered to. This could complicate maintenance and outage activities and could lead to additional operational complexity and the need for more preplanning. However, many B-7

licensees have already implemented fire protection measures to decrease the risk associated with fires during shutdown operations and, therefore, this impact would be minimized for those licensees. The rule is designed to ensure that these or comparable measures remain in place. There are no new programs associated with implementation of the rule, only the extension of existing controls associated with fire prevention during power operations into shutdown operations.

(7) The estimated resource burden on the NRC associated with the proposed. -

backfit and the availability of such resources ,

The fire protection aspects are only a portion of the overall shutdown rule. The NRC resource burden associated with the implementation of the fire protection aspects is not expected to exceed 10 percent of the overall NRC resource burden from imposition of the shutdown operations rule.

(8) The potential impact of differences in facility ty>e, design or age on the relevancy and practicality of the proposed bac(fit The impact of the shutdown rule requirements is dependent upon plant-specific features across all vendor designs and dependent upon the decay heat rer.aval system configuration and degree of separation. However, the overall impact is expected to be~small when compared to the risk reduction provided.

(9) Whether the proposed backfit is interiu or final and, if interin, the justification for imposing the proposed backfit on an interim basis The proposed backfit is final. ,

O O ,W W B-8 l

July 24, 1997 Attachment 4 Draf t Regulatory Guide DG-1066 Shutdown and fuel Storage Pool Operations at Nuclear Power Plants A. . INTRODUCTION i Overview The United States Nuclear Regulatory Commission (NRC) is proposing to amend -

its regulations by adding a new section 50.67, ' Shutdown and fuel Storce Pool Operations at Nuclear Power Plants," to 10 CFR Part 50, " Domestic Licensing of Production and Utilization Facilities." The NRC is proposing Section 50.67 because it has determined that:

(1) Additional requirements for safety are needed during shutdown operation at light-water nuclear power plants, when operating in cold shutdown or refueling (as defined in a plant's technical specifications) with one or more fuel assemblies located in the reactor vessel or in the refueling cavity, and (2) The updated final safety analysis report and the procedures for the fuel storage pool operation should document the assumptions and parameter values used in safe', .nalyses that have been performed to demonstrate adequate decay heat removal for the fuel storage pool.

Protection of Public Health and Safety The design criteria for nuclear power plants are intended to establish that the structures, systems, and components provided in the design of each plant are capable of performing their safety function within credible bounds of operating and accident conditions. The safety analysis report for each plant contains design criteria and describes how the design satisfies the criteria.

Although the design criteria ensure that a capability to perform specific safety functions is included in the plant's design, the design criterion relevant to a particular functional capability does not control the availability or operation of the equipment that provides the capability.

Several mechanisms, such as technical specifications, are in place to provide operational controls when the plant is operating at power and, in a less comprehensive manner, when it is shut down. Based on an assessment of ri.sk, _ m the NRC has determined that the protection provided to the public by current requirements and industry practices would be more uniformly implemented and maintained by generic regulatory action that more comprehensively addressed shutdown operation. This protection would be provided through new requirements for procedural control of shutdown operation; by requirements to establish, monitor, and comply with parameter limits associated with important safety functions; and by requirements to maintain a mitigation capability following events that result in the loss or interruption of decay heat removal.

Regulatory guides are issued to describe and make available to the public such information as methods acceptable to the NRC staff for implementing specific parts of the Commission's regulations, techniques used by the staff in 1

, evaluating specific problems or postulated accidents, and guidance to .

licensees and applicants. Regulatory guides are not substitutes for regulations, and compliance with regulatory guides is not required.

l

' Regulatory guides are issued in draft form for public comment to involve the public in the early stages of developing the regulatory positions. Draft regulatory guides have not received complete staff review and do not represent official NRC staff positions.

The information collections contained in this draft regulatory guide are _

covered by the requirements of 10 CFR Part 50, which were approved by the -

Office of Management and Budget, approval number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently' valid OMB control number.

B. DISCUSSION The proposed Section 50.67 would apply to all holders of operating licenses, combined licenses for a light-water reactor nuclear power plant (except those plants that have been permanently shutdown with fuel permanently removed from the reactor vessel), and licenses authorizing storage of fuel in a fuel storage pool at a light-water reactor nuclear power plant.

The requirements proposed for shutdown operation would apply when one or more fuel assemblics are located in the reactor vessel and when the plant is in cold shutdown or refueling (as defined in the technical specifications).

Thus, the requirements do not apply when the licensee has transferred all of the fuel out of the reactor vessel.

The requirements proposed for fuel storage pool operation would apply when one or more fuel assemblies are located in'the fuel storage pool or in connected water-filled cavities that are located outside the primary containmen.t.

The proposed Section 50.67 would extend the regulatory coverage of power operation to shutdown operation through the development of additional administrative control technical specifications. The proposed requirements have been developed based upon engineering analyses, insights from risk studies, and experience from actual events.

The safety functions that must te ensured during shutdown operation are (1) removal of decay heat, (2) control of reactor coolant system (RCS) inventory, and (3) control of RCS boundary integrity. The shutdown operation rule would - -

ensure that these safety functions are met by establishing parameter limits that are not to be exceeded. l.icensees select the particular parameters to be monitored to ensure that the safety function limits are not exceeded. In the event the safety functions are challenged or the safety function limits are exceeded, the licensee's mitigation capability must consist of a minimum set of equipment that is required to remain functional following the occurrence of an event that interrupts or degrades the operating decay heat removal system.

The new requirements (1) reduce the frequency and severity of events that may cause the safety functio,n limits to be exceeded. (2) provide effective monitoring of parameters indicative of safety function status, (3) ensure that mitigation capability and effective operator response is provided for those events that do occur, (4) ensure reliable methods are employed for decay heat 2

l removal, and (5) reduce the frequency of human errors and hardware failures that interrupt or degrade decay heat removal, for fuel storage pool operation, licensees must document in the updated final safety analysis report (UFSAR) the assumptions and parameter values used in safety analyses performed to demonstrate adequate decay heat removal for the fuel storage pool. Licensees must also ensure that procedures for the fuel storage pool contain operational limits that incorporate the assumptions and parameter values. - -

C. REGULATORY POSITION This section of the proposed regulatory gul6e discusses the regulatory requirements and provides guidance on meeting these requirements. The NRC solicits comments and suggested alternatives to the regulatory positions discussed in this section if the alternative will achieve the same level of protection of public health and safety,

1. Prooosed Section 50.67(a)(1).

• Shutdown Operation Procedures" Section 50.67(a)(1) would remire licensees to establish and implement procedures to control aethities that can effect decay heat removal and provide performance monitoring and mitigation capability. The adequacy of the procedures, and the method for establishing, modifying, and superseding the procedures would be described in the administrative controls section of the licensee's technical specifications. The procedural control process selected can be an approved industry standard or existing measures used by the licensee for control of procedures. An example of such procedural controls is within the model technical specification of Appendix B.

The procedures should address (1) a11 activities that'could affect the availability or operation of the decay heat removal function, the parameter monitoring system, or the mitigation capability to respond to a loss of decay heat removal event, (2) training for all personnel who perform activities that could affect the availability or operation of the decay heat removal function, parameter monitoring system, or the mitigation capability to respond to a loss of decay heat removal event, (3) quality assurance for all activities that could affect the availability or operation of the decay heat removal function, parameter monitoring system, or the mitigation capability to respond to a loss of decay heat removal event, and (4) corrective actions for all conditions adverse to quality affecting the availability or operation of the decay h, eat removal function, parameter monitoring system, or the mitigation capability to ^

• respond to a loss of decay heat removal event.

If the procedures for meeting the proposed Section 50.67 explicitly covered by the existing quality assurance requ(a)(1) areinnot irements Appendix B to 10 CFR Part 50, they should be governed by the quality assurance guidance in Appendix A to this regulatory guide.

2. Proposed Section 50.67(a)(2). " Performance Monitorina" Section 50.67(a comply with para)m(eter limits during shutdown operation.2)(1) The parameter limits would require licens 3

must ensure compliance with the safety function limits of (1) decay heat removal such that the water temperature above the reactor core is less than the saturation temperature, (2) reactor coolant system (RCS) inventory control such that the RCS water level is sufficient for reliable operat. ion of the normal means of decay heat removal, and (3) RCS and connected systems pressure control such that the design pressure and low-temperature overpressure protection (LTOP) settings are not exceeded. The parameters, parameter limits, and monitoring requirements (including the nature and frequency of monitoring) would be ' set forth in a licensee-controlled document. The criterit and method for licensee selection of the parameters, the parameter -

limits, and the nature and frequency of monitoring are to be described 'in the administrative controls section of the technical specifications. The parameters monitored should be RCS temperature, level, and pressure, but the method of measuring these parameters may vary. Appendix B contains model administrative control technical specifications that licensees should consider in developing their plant specific administrative control technical specifications. The specific monitoring method and instrumentation used to monitor these parameters during shutdown operation, including alarms as appropriate, may vary based on the reactor coolant system configuration, outage activities, decay heat levels, and method for removing decay heat.

In selecting the parameter limits and the parameters to be monitored, licensees should ensure that the safety function limits are not exceeded in the event that the method used for monitoring the parameters is intentionally disabled or accidently lost. With respect to the parameters monitored, engineering analyses could demonstrate an acceptable time frame for loss of parameter monitoring. Licensees should establish expected values or, for transient conditions, an expected range of values applicable to each planned phase of the outage for reactor water temperature, level, and pressure.

Licensees should use these expected values to detect degradation of important safety functions. Parameter limits must be established in accordance with the methodology specified in the administrative controls technical s)ecifications to ensure that the safety function limits associated with decay leat removal, reactor coolant system inventory control, and pressure boundary integrity are not exceeded. In addition, parameters should be monitored on a time scale commensurate with )otential changes in the parameters based on the RCS conditions, decay leat levels, outage activities, and monitoring method.

The parameters specified in proposed section 50.67(a)(2) may be measured directly, or a correlation may be developed to relate another parameter or condition measured at another location to the specified values. The frequency "

• for monitoring the parameters should be determined on the basis of the RCS and associated equipment operating conditions and the shutdown activities that could have an impact on the parameters.

If the structures, systems, and components for meeting the proposed Section 50.67(a)(2) are not explicitly covered by the existing quality assurance requirements in Appendix B to 10 CFR Part 50, they should be governed by the quality assurance guidance in Appendix A to this regulatory guide.

3. Proposed Section 50.67(a)(3). "Hitiaation capability" Section 50.67(a)(3) wuuld require licensees to maintain a capability to 4

9

' provide adequate core cooling, decay heat removal, and sufficient protection against the uncontrolled release of fission products following the loss or interruption of decay heat removal during shutdown operation. The structures, systems, and components used for this capability should be documented within a licensee-controlled document. The criteria and method for the licensee's selection of the structures, systems, s i components should beidescribed in the administrat'ive controls section - She technical specifications. Appendix B contains model administrative co,..ois technical specifications that licensees specifications.

technical should cons ~1 der in developing plant specific administrative . controls _

The mitigation capability required by the shutdown operation rule for '

incorporation into administrative controls technical specifications should include a safety injection path for adding water-into the reactor vessel, an additional path for decay heat removal to an ultimate heat sink that does not share active components with the safety injection system (excluding support systems), and protection against an uncontrolled release comparable to that provided by an intact primary containment. The basis for providing the mitigation capability is-to provide for core cooling following an event that results in a loss of decay heat removal. Events considered for the loss of decay heat removal include the random failure of residual heat removal equipment or its support systems and the loss of residual heat removal through a loss of inventory, loss of level control, or loss of AC power. With respect to the mitigation equipment, contingency plans should be developed to cover such actions as replenishing the water inventory or the boron used for injection, assuring the availability of containment sumps when needed for long-term recirculation, and maintaining RCS pressure control. In performing the Regulatory Analysis in support of the proposed Section 50.67, the following equipment was assumed available:

- 2 residual heat removal trains 1 service water system train configured for high reliability'for RHR support (multiple pumps, parallel paths, common power)

- 1 emergency core cooling system pump and support equipment

- 1 emergency diesel generator

- 1 source of offsite power

- intact containment or comparable equipment

--indication of temperature immediately above the core

- reactor vessel or RCS (as appropriate) water-level indication

- capability to control pressure

- continued source of water for ECCS pump . .

- BWR Level III isolation .

In selecting the particular equipment for meeting the requirements of the proposed Section 50'.67, licensees should consider this list of equipment, the planned activities, the plant status and configuration, and potential initiating events.

The mitigation capability must be available to meet the provisions of proposed section 50.67(a)(3). Availability in this context includes credit for operator action to align SSCs. For example, operator actions may be credited to align breakers and valves and to start. active components provided local environmental conditions (temperature, humidity, radiation) permit (1) the 5

operator access, (2) appropriate procedures and training have been implemented to support these actions, and (3) sufficient time is available to accomplish the actions. Availability does not mean that the equipment may be disassembled and be restored to service when needed, because disassembly greatly reduces the probability of the equipment performing thel function when needed. Unlike many design basis events during power operation 6 licensees have more time during shutdown operation to take manual actions for mitigation purposes. There is often time to realign valves, close breakers, and perform procedures before a plant reaches unacceptable conditions during shutdown.

Contingency plans, as previcusly discussed, should ensure that the mitigation -

capability can perform its function for its intended mission time. ,

In selecting the SSCs to satisfy the decay heat removal path and the water addition path required by the proposed Section 50.67(a)(3), licensees should consider the decay heat load, RCS inventory, RCS configuration, and method of normal shutdown cooling as well as work evolutions that are planned or in progress. Inde)endence from the systems and components used for the operating decay acat removal method, reliability, and protection against common cause failures should be considered. The SSCs selected for the decay heat removal function should have the capacity to keep the temperature above the reactor core at less than the saturation temperature. In general, two methods for removing decay heat should be provided at all times. When the refueling cavity is flooded, licensees could rely on an operating decay heat removal method and credit the heat capacity of the flooded cavity in conjunction with contingency plans for recovering a decay heat removal path prior to saturation of the flooded cavity for the two methods of removing decay heat. The SSCs selected for the water addition path (safety injection or emergency core cooling) should have the capacity to provide adequate core cooling. Support systems for a safety injection or emergency core cooling system include its emergency onsite power source, which is typically an emergency diesel generator, an adequate source of water, and a reliable means of RCS pressure control. An adequate source of water means that the licensee should ensure that either (1) sufficient water remains in the water storage tank or (2) the sump is clear of debris and functional and the likelihood of a significant loss of inventory outside the primary containment is negligible.

Maintenance of an intact primary containment for all containment types is encouraged, whenever possible, to provide protection against the uncontrolled release of fission products. However, it is recognized that the containment must be opened to support some outage and maintenance activities. An intact primary containment is one in which the equipment hatch is closed, the. .

personnel hatch h capable of being readily closed, and all other containment penetrations are closed with a single barrier or capable of being remote-manually closed from the control room. When an intact primary containment is not available, alternative risk-comparable features should be provided. In defining the criteria for selecting these features, licensees should consider the ability of the features to mitigate a loss of decay heat removal event due to risk-significant events that were initiated by a range of events, including loss of ac power, loss of level control, loss of inventory, and loss of the decay heat removal train. The selection criteria should also factor in plant conditions and the independence of the equipment from that credited for safety injection and backup decay heat removal.

6 l

l

The capability for primary containment closur, and secondary containment closure may also be credited in combination eith other mitigation equipment as an alternative to an intact containment. ae alternative for BWRs could be a diesel-driven fire protection pump with >ction capability into the reactor vessel. For PWRs, the staff's regula. analysis assumed a containment closure capability in conjunction with ,i additional onsite power source, an additional injection source, the potentt ' for steam generator cooling, and gravity feed as comparable to an intact wntainment. In assessing the ability to close the containment, consideration should be given to such factors as time to boiling, power suppites, equipment staging, and environmental ' effects -

on the ability to perform in-containment work necessary to effect containment closure. In addition, combinations of capabilities should be included'such as injection- (either safety-related or not safety-related capability through steam generators or other means, sum)p, decay heat removal recirculation capability with assurance of debris-free sumps, containment sprays, containment restoration capability, contingency plans, and other means that yield release frequencies comparable to those achieved with an intact .

pressure-retaining containment and that account for the reduction in defense-in-depth because of the substitution for the primary containment. Licensees are not expected to perform shutdown probabilistic risk assessments to comply with the proposed Section 50.67.

The structures, systems, and components intended to meet the requirements of the proposed Section 50.67(a)(3) that are not explicitly covered by the existing quality assurance requirements in Appendix B to 10 CFR Part 50 should be governed by the quality assurance guidance in Appendix A to this regulatory guide.

(4) Proposed Section 50.67(a)(4). " Fire Protection" Section 50.67(a)(4) would require licensees to include in their fire protection plan provisions during shutdown operation to minimize the frequency of fires, maintain the decay heat removal function free of fire damage or limit the levels of fire damage by promptly detecting, controlling, and extinguishing fires that do occur, and developing contingency plans for maintaining adequate core cooling and restoring a decay heat removal path.

During periods when the decay heat load is high and the coolant inventory is low, maintenance of a heat removal path is critical to maintaining control of event progression because of the short time necessary for the decay heat to bring the coolant to saturation. Fires pose a special threat to the heat removal paths because of their potential to affect redundant decay heat .

removal paths. , ,

To minimize the frequency of fires during shutdown operation, specifically in those plant areas important to achieving and maintaining the decay heat removal function, licensees should implement controls on combustible materials and potential ignition sources. Licensees should conduct a fire hazards analysis that assesses the adequacy of )lant fire protection features and the separation between the operating decay leat removal path and the backup decay heat removal path selected to meet the requirements of proposed Section 50.67(a)(3) under postulated fire conditions. This analysis should also describe the location of equipment and the routing of cables required to establish the heat removal path from the RCS to the ultimate heat sink and the 7

1 l

l provisions for either maintaining one path free of fira damage or establishing a path through the implementation of contingency plans. The paths are considered to be protected from fire in locations where fire protection features are provided in accordance witn subparagraphs (a) through (f) of aaragraph III.G.2 in Appendix R to 10 CFR Part 50. Where the separation setween the two paths does not meet these criteria, licensees should develop and implement provisions to limit the levels of fire damage by promptly detecting, controlling, and extinguishing fires that do occur Licensees should develop and-implement contingency plans for maintainin adequate core cooling' and restoring a heat removal path in the event of a f re in any areas -

that interrupt or degrade heat removal to an ultimate heat sink. The eytent of the contingency plans should be commensurate with the level of protection provided by the proposed section 50.67(a)(4)(1)(B). For example, if a licensee relies upon limiting the level of fire damage as opposed to maintaining the decay heat removal function free of fire damage, more extensive contingency plans, including the technical bases that support their feasibility, should be developed. If sup)orted by an analysis and a sound

, technical basis, a decay heat removal pati may be recovered by routing new cable around damaged sections or by providing alternative equipment to replace the function of the damaged equipment.

(5) Proposed Section 50.67(b). " Fuel Storaae Pool Ooeration" Section 50.67(b) would require licensees to describe in the updated final safety analysis report the assumptions and parameter values used in safety analyses performed by the licensee as reference bounds for design to demonstrate adequate decay heat removal for the fuel storage pool and ensure that the procedures for the fuel storage pool contain operational limits that incorporate the assumptions and parameter values in the updated finki safety analysis report. -

For the fuel storage pool, licensees should establish coolant temperature limits and assumptions regarding equipment availability for routine refueling operation as primary design basis constraints. The temperature limits may be derived from design temperatures for the fuel storage pool structure or attached systems. Then, licensees ~should either establish new operational limitations for each refueling based on expected or planned ranges of secondary parameter values for that one refueling or establish a bounding set of secondary parameter values for all future refueling operation. The secondary parameters evaluated for limiting values should include ultimate heat sink temperature and the timing, size, and operational history of fuel _ ..

transfers.

Licensees should resolve discrepancies between the safety analyses used in the design process, the facility's updated FSAR, and operating procedures using their process for resolution of degraded or non-conforming conditions.

Changes tu the facility or procedures made pursuant to 10 CFR 50.59 may also be employed to eliminate a nonconforming condition. The NRC issued Generic Letter 91-18. "Information to Licensees Regarding Two NRC Inspection Manual Sections on Re alution of Degraded and Nonconforming Conditions and Operability," dated November 7,1991, to all nuclear power reactor licensees and applicants for inspection of activities to resolve degraded and nonconforming conditions.

8 l

D. IMPLEMENTATION The purpose of this section is to provide information to licensees and applicants regarding the NRC staff's plans for using this regul,atory guide.

This draft guide has been released to encourage public participation in its development. Except in those cases in which a licensee or applicant proposes I

an acceptable alternative method for complying with specified portions of the NRC's regulations,-the methods to be described in the active guide reflecting public comments will be used in the evaluation of submittals for construction -

permits and operating licenses (as appropriate) and will be used to evaluate the effectiveness of shutdown and fuel storage pool operation of licenstes who are required to comply with 10 CFR 50.67. -

E. REGULATORY ANALYSIS A separate regulatory analysis was not prepared for this regulatory guide.

The regulatory analysis prepared for 10 CFR 50.67, " Shutdown and Fuel Storage Pool Operations at Nuclear Power Plants," provides the regulatory basis for this guide and examines the costs and benefits of the rule as implemented by the uide. A copy of this regulatory analysis is available for inspection and copy ng for a fee at the NRC Public Document Room 2120 L Street NW.,

Wash ngton, DC, as an enclosure-to 10 CFR 50.67.

e

, %m O 9

-__ = -

t APPENDIX A - OVALITY ASSURANCE FOR PROCEDURES AND NON-SAFETY EQUIPMENT .

ASSOCI ATED W11H IMPLEMENTATIO' Of THE SHVIDOWN RULE The quality assurance (QA) guidance provided here is applicable to structures, systems, and components (SSCs), including the programmatic elements related to procedural controls and training necessary to meet the requirements of the proposed Section 50.67, that are not explicitly covered by existing QA requirements in Appendix B to 10 CFR Part 50. Additionally, the installation or modification of non-safety-related SSCs required to meet the rule must be controlled and implemented so that they do not degrade existing safety-related -

SSCs. A licensee can rely on non-safety-related equipment currently covered by the provisions of 10 CFR 50.62 and 50.63 to satisfy both the technical and QA requirements of 10 CFR 50.67. This is accomplished by making the non- '

safety-equiament as independent as practicable from existing safety-related systems. 11e design requirements and operational controls required by this rule should incorporate sufficient design criteria and appropriate quality elements to provide reasonable assurance that, when called upon, the equipment will perform its intended function. While the associated equipment will be required to be reliable, it is not anticipated that it will have to meet all the requirements normally applied to safety-related SSCs. Accordingly, this Appendix A outlines an acceptable QA program that is applicable to the non-safety-related SSCs that the licensee relies upon to satisfy the requirements of the rule.

1. ORGANIZATION The licensee's responsible engineering organization is expected to verify compliance with this guidance through the use of a peer review process. '

Therefore, a separate oversight process is not required. However, licensees may elect to use their existing QA organization to perform compliance verification activities. .

2. OVALITY ASSURANCE PROGRAM The existing body of plant procedures and practices is expected to adequately address the QA controls applied to the subject equipment. Accordingly, there is no need for an additional or supplementary QA program to satisfy the requirements of proposed Section 50.67.

3. DESIGN CONTROL The design process should be defined, controlled, and verified. App 1"icable design inputs should be appropriately specified and correctly translated into design documents. Design interfaces should be identified and controlled.

Design adequacy should be verified by persons other than those who were directly involved in the design of the system, structure, or component.

Design changes, including field changes, should be governed by control measures commensurate with those applied to the original design.

Design methods, materials, parts, equipment, and processes that are essential to the function of the structure, system, or component should be selected and reviewed for suitability of application. The final design (approved design output documents and approved changes thereto) should correlate to the design 10

I 9

input documentation in sufficient detail to permit verification of the design.

To verify the adequacy of design, one or more design control measures should be applied performing design reviews, using alternative calculations, or performing qualification tests. The responsible design organization should identify the particular design verification method or methods used.

4. PROCUREMENT DOCUMENT CONTROL Applicable design criteria and other requirements necessary to ensure .

component function and reliability should be included or referenced in documents for procurement of items and services. To the extent necessar'y, procurement documents should require suppliers to have a QA program consistent with the applicable requirements, such as those described in American National Standard ANSI /ASQC 09001.

5. INSTRUCTION

S. PROCEDURE

S. AND DRAWINGS Technical requirements, inspections, tests, administrative controls, and training necessary for compliance with the proposed Section 50.67 should be prescribed by documented instructions, procedures, and drawings and should be accomplished in accordance with these documents. These documents should include or reference approarlate quantitative or qualitative acceptance criteria for determining t1at prescribed activities have been satisfactorily accomplished.

6. DOCUMENT CONTROL Measures should be established to control the issuance of and changes to documents related to the implementation of the proposed Section 50.67.

7. CONTROL OF PURCHASED ITEMS AND SERVICES -

• Measures should be established to ensure that purchased material, equipment, and services conform to the procurement documents and engineering specifications.

8. JDENTIFICATION AND CONTROL OF ITEMS Controls should be established to ensure that only correct and accepted items are used or installed. . .

9. CONTROL OF SPECIAL PROCESSES Special processes affecting the design integrity, function, or reliability of items or the quality of services should be controlled. 5)ecial processes that establish or verify quality-related activities, such as tiose used in welding, heat treating, and nondestructive examination, should be performed by qualified personnel using appropriate procedures in accordance with specified requirements.

I 11

10. . INSPECTION Heasures are to be established to inspect activities affecting the design integrity and functinn of equipment associated with the requirements of the proposed Section 50.67. Inspections should verify conformance with design requirements and confirm the appropriate accomplishment of activities intended to ensure reliable operation, in general, the licensee's cognizant engineering organization is responsible for determining the inspection requirements and for ensuring that sufficient inspections are performed.

Inspections should be performed by knowledgeable personnel other than those ~

who performed or supervised the work being inspected. ,

11. TEST CONTROL Tests required to verify conformance of an item to specified design and functional recuirements and to demonstrate that items will perform reliably in service shoulc be planned and executed. Characteristics to be tested and the test methods to be employed should be specified. Test results should be documented and their conformance with acceptance criteria should be appropriately evaluated. In general, the licensee's cognizant engineering organization is responsible for developing, implementing, and validating the acceptability of any required testing.

12. CONTROL OF MEASVRING AND TEST E0VIPMENT Tools, gauges, instruments, and other measuring and test equipment used for activities affecting the design, function, or reliability of equipment associated with the implementation of the aroposed Section 50.67 should be controlled and, at specified periods, cali) rated and adjusted to maintain accuracy within specified limits. .

13. HANDLING. STORAGE. AND SHIPPlHG Handling, storage, cleaning, packaging, shipping, and preservation of items should be controlled in accordance with utility practices and tle manufacturers' recommendations to prevent damage and to minimize deterioration.

14. . INSPECTION. TEST. AND OPERATING STATUS Heasures should be established to properly indicate the status of inspection _ .

results, test data, and operational capabilities of installed equipment necessary to implement the provisions of the proposed Section 50.67,

15. CONTROL OF NONCONFORMING ITEMS Hensures should be established to control items that do not conform to specified requirements to prevent inadvertent use or installation.

16. CORRECTIVE ACTION Heasures should be established to ensure that failures, malfunctions, deficiencies, deviations, defective components, and nonconforming conditions, 12 l

including programmatic and procedural discrepancies, are promptly identified, reported, and corrected. Conditions that adversely affect the design function or reliability of the equipment associated with the requirements of proposed Section 50.67 should be evaluated and corrected accordingly.

t

17. DUALITY ASSURANCE RECORDS Records should be prepared and maintained to furnish documented evidence that the criteria enumerated above are being accomplished for the activities required to comply with the proposed Section 50.67. .-

~

18. AUDITS

• Audits should be conducted and documented to verify compliance with design and procurement documents, instructions, procedures, drawings, and inspection and test activities developed to comply with the proposed Section 50.67.

4 0 0 ,W 4 13

APPENDIX B - MODEL TECHNICAL SPECiflCATIONS Model Administrative Controls Technical Specification for Shutdown Operation 5.0 ADMINISTRATIVE CONTROLS 5.5.X Shutdown Operation

a. The purpose of this specification is to ensure that activities are planned, conducted, and controlled in a safe manner and that

adequate monitoring and mitigation capabilities are available during' _

the COLD SHUTDOWN and REFUELING modes of o)eration when one or more irradiated fuel assemblies are located wit 11n the reactor vessel or refueling cavity (shutdown operation).

b. Procedures must be developed, implemented, and maintained for outage planning, work control, maintenance, modification, monitoring safety parameters, and operation affecting structures, systems, and components important for reactor vessel decay heat removal, reactor vessel coolant inventory control, reactor coolant system and connected systems pressure control, and protection against the uncontrolled release of radioactive material during shutdown operation. These procedures must be developed with appropriate consideration for shutdown safety issues including (mid-loop operation (PWRs), operation at reduced inventory, fuel movement, support system availability, use of soluble neutron poisons for reactivity control, RHR system isolation on low level, etc., ...).

[The criteria and method for establishing, modifying, and superseding the procedures must be { described or referenced).]

c. Training must be planned and conducted for individuals performing activities that affect the reliability of reactor vessel decay heat removal, reactor vessel coolant inventory control, reactor coolant system and connected systems pressure control, and protection against the uncontrolled release of radioactive material during shutdown operation. At a minimum, training is to cover outage planning and plan implementation, work control, maintenance, modification, and equipment operation under normal and abnormal conditions.

i. Quality assurance and corrective action measures are to be developed, implemented, and maintained for activities that affect - -

the reliability of reactor vessel decay heat removal, reactor vessel coolant inventory control, reactor coolant system and connected systems pressure control, and protection against the uncontrolled release of radioactive material during shutdown operation. At a minioum, these measures must include the functions described in Appendix A to Regulatory Guide DG-1066 " Shutdown and Fuel Storage Pool Operations at Nuclear Power Plants."

e. Parameter limits and monitoring frequencies for shutdown operation must be established (criteria listed) to allow sufficient time for operator mitigative action to reasonably ensure meeting the plant 14 I

conditions listed in paragraph (f) and the following safety parameter limits:

1. Maximum water temperature at all locations above the reactor coro is below saturat on.

2. RCS water level it, sufficient for reliable o oeFy heat removal method cuirently in use. peration of the

3. The design pressures of the RCS, connected systems 3 any ,-

other components that constitiate part of the phys ~ical boundary necessary to contain RCS pressure, and the Low

' Te:nperature Overpressure Protection (LTOP) System settings, are not exceeded.

f.

Mitigation capability, as described in paragraphs 1, 2, and 3 below, that remains functional following the occurrence of an event that interrupts or degrades the currently operating method for decay heat removal operations. from the RCS, must be available at all times during shutdown If_the minimum capaci11 ties, as described in paragraphs 1, 2, and 3 below, cannot be met, plant procedures must exist that address contingencies, establish actions for restoring mitigation capability, and halt all activities that could cause a further deterioration of plant conditions unless such activities are essential for safety.

1.

{0ne subsystem of the safety injection or emergency core cooling system with a suction and recirculation source of

[boratedl water sufficient for providing adequate reactor core cooling and maintaining the r,eactor subcritical];

2. [One path for decay heat removal to an ultimate heat sink

-that does not share active components with the safety injection system selected (exclusive of-support equipment)];

and, 3.. [An intact primary containment in which (1) the personnel hatch is capable of being readily closed, 2) all other containment penetrations are closed or capa(ble of being remotely closed from the control room, and (3) equipment hatch is closed.

OR Equipment (which may include a reduced-capability containment) that is comparable-to an intact containment on the basis of risk and defense-in-depth considerations.]

i' 15

~