ML20244C647
| ML20244C647 | |
| Person / Time | |
|---|---|
| Issue date: | 01/09/1989 |
| From: | Sniezek J Office of Nuclear Reactor Regulation |
| To: | Jordan E Committee To Review Generic Requirements |
| References | |
| NUDOCS 8906150066 | |
| Download: ML20244C647 (147) | |
Text
UNITED STATES
(('1 ),i 4
NUCLEAR . REGULATORY COMMISSION r,, . A<
-l WASHlf4GTON, D. C. 20S55 RELEASED TO THE PDR
(%...../ m, m- %.
WV
, ? l[f' i
JAN 9 1989 )
I MEMORANDUM FOR: Edward L. Jordan, Chairman I Comnittee to Review Generic Requirements Office for Analysis and Evaluation of Operational Data FROM: James H. Sniezek, Deputy Director Office of Nuclear Reactor Regulation
SUBJECT:
CRGR REVIEW 0F POWER REACTOR SAFEGUARDS CONTINGENCY PLANNING FOR SURFACE VEHICLE BOMBS The Commission has requested staff (June 16, 1988 memorandum from the Secre- ;
tary -- Enclosure 5 of the enclosed draft Commission Paper) to require power {
reactor licensees to develop safeguards contingency plans for short-range 1' actions that could be taken to protect against a land vehicle bomb.
NRR proposes to implement this Commission request by issuing a generic letter to all power reactor licensees / applicants (Enclosure 1 of the enclosed draft {
Commission Peper) modifying the Commission's " statement of. perceived danger" i applicable to safeguards contingency planning at power reactors. The draft j generic letter explains that this planning is only for temporary short-term j measures to be implemented in an emergency or in response to a warning notice ;
from the NRC. It does not affect the design-basis threat in 10 CFR 73.1(a) I and does not imply any need to alter physical protection currently required by 10 CFR 73.55. Short-range planning for security actions could include such things as advance arrangements to facilitate rapid emplacement of emergency temporary vehicle barriers to limit and centrol land vehicle access. Planning should also consider thort-range operat'onal measures to increase plant readiness in the event of a credible P lant specific land vehicle bomb threat. ,
I A generic letter is an appropriate mechanism for communication of this Commis-sion re mest to the licensees. Operating power reactor applicants and '
licen w . are required by 10 CFR 50.34(d) and 50.54(p) to prepare or maintain safeguards contingency plans and procedures in accordance with the criteria set forth in Appendix C to 10 CFR Part 73. A safeguards contingency plan, prepared in accordance with 10 CFR Fart 73, Appendix C, identifies and def'nes ggg the perceived dangers and incidents with which the plan will deal and the otra. general way it will ha.ndle them. In accordance with Appendix C:
58w "The statem_nt of perceived danger should conform with that promulgated
,y by the Nuclear Regulatory Commission. (The statement contained in 10 CFR 73.55(a) o gbsequent Commission statements will suffice.)" [ emphasis a
I\
woz cdded] j -
)
Brian K. Grimes, NRR/DRIS ocument Transmitted 7 ;
b
Contact:
3@ 492-Lo03 Herewith Contains I \
l ggg SAFEcuAnos INFORMAricN i R[IddilIl} REGULhIORY * %-
C[WIRAL W~.$$,
"sw"Cos
/ A/ FejdM & r'r &
O WDWA_-
p 1 j
l Edward L. Jordan g g Therefore, a revision to the statement of perceived danger promulgated by the Commission does not require a rulemaking and can be communicated in a generic letter. A representative of OGC's Division of Rulemaking and Fuel Cycle has l
informally concurred in this approach and helped to draft the generic letter'.-
Formal OGC review is being sought concurrent with CRGR review.
1 Most of the licensee planning will be included'in contingency procedures, which are not submitted for NRC licensing review. Some minor changes may have to' be made in approved plans. However, in accordance with 10 CFR 50.54(p)(2),
licensees may make changes to safeguards contingency plans without prior Commission approval when the changes do not decrease the safeguards effec-tiveness of the plan. Since changes in these plans that reflect an additional perceived danger should increase rather than decrease their safeguards effec-tiveness,' prior submittal and staff review of the plan changes will not be.
necessary. -Staff reviews can be accomplished as part of normal inspection and 50.54(p) activities, as time permits. "
i The recommended' actions above are Category 2 and do not warrant accelerated actions. In accordance with CRGR operating procedures, enclosed are 20 copies of the CRGR package for your review.
Please note that Enclosure 2 to the Commission Paper is Safeguards Information that needs to be protected from unauthorized disclosure as described in NRC Manual Chapter Appendix 2101. In addition, Enclosure 6 is identified as.
" Limited Distribution."
'l k '
f k- :at w w k M 4te>
J !s H. Sniezek, Depu Director Off ice of Nuclear P.eactor Regulation
) 1 l
Enclosures:
- 1. Draft Commission Paper, " Contingency ,
I Planning to Counteract Possible Surface l Vehicle Threat', with enclosures l
(Safeguards Information)
- 2. Supplemental Information
-l l
l l 1 i
_ _ _ _ _ - - __ =___ O
9
?
s a
'l i
q 1
~j ENCLOSURE 1 DRAFT. COMMISSION PAPER
(
- )
l
0 M.N$E EMAIN l NEGATIVE CONSENT. PAPER mp t ML
} g.
p i .
i w sm ' w J For The Commissioners From: Victor Stello, Jr.
l Executive Director for Operations l .
Subject:
POWER REACTOR CONTINGENCY PLANNING FOR A POSSIBLE LAND VEHICLE BOMB IN THE EVENT SUCH A THREAT ARISES u l
Purpose:
To report'on staff actions in response to item 3-in the
]
l Secretary's memorandum of June 16,'1988(Enclosure-5),
approving a requirement for power reactor' licensees to-
, develop short-range contingency plans for.use in the event that a credible. land vehicle bomb threat arises. ]j
Background:
Following incidents in the Middle Eastiinvolving terrorist.
use of explosive-laden vehicles as-bombs, the NRC staff provided the Commission with its recommendations on responding-to such a threat at nuclear. power plants in two SECY-86-101, dated March 31, 1986, and Commission SECY-86-101A pap (ers:
Confidential),-datedJune 12, 1986, both entitled " Design-Basis Threat 0ptions for Considerations."
The staff further provided the Commission with a range of 1 options for counteracting a surface vehicle: threat in --
SECY v3-127 (Limited Distr'ibution), dated May.10,'1988 (Enclosure 6). The Commission decided that it would not be
necessary(to change the design-basis threat' for radiological sabotage 10CFR73.1[a][1])nortorequirelong-range
~
planning by power reactor licensees for permanent protection measures against land vehicle bombs. However, as a matter of prudence, the Commission approved: development of NRC and- ;
licensee contingency plans for dealing with a possible land '
vehicle bomb threat to power reactors, should one arise.
l l \
l I '
l CONTACT: Brian K. Grimes, NRR/DRIS Datement Transmitted Herewig .
- j. 492-0903 Cortains Seteruards Information ;
UFON REMOVAL OF ATTACHMENT THIS DOCURRENT R~
I g .
'l The Commissioners .
l Discussion: Regulatory Approach 10 CFR 50.34(d) requires that each application for a. license ]
to operate a nuclear power reactor include a safeguards l contingency plan. Such a plan, prepared:in accordance with i 10 CFR Part 73, Appendix C, identifies and defines "the perceived dangers and. incidents with which the plan will i deal and the general way it will handle these." The plan i should contain a statement of perceived danger conforming with that published by the Commission. For this purpose, y l
Appendix C indicates that the design-basis threat in 10 CFR 73.1(a) "or subsequent Commission statements will suffice." :
Accordingly, for the purpose only of safeguards contingency )
planning for-licensed power reactors, the staff will inform licensees that the statement of perceived danger should include the threat of a land vehicle bomb. Enclosure 1 is I a draft generic letter conveying this position. Enclosure 4 is a backfit analysis for this: proposed action. 4 Implementing Contingency Planning l
The draft generic letter makes clear that this " statement of. '
perceived danger" is pertinent only to safeguards contingency planning. The draft generic letter also explains that this planning is only for temporary short-term measures to be imple- l mented in an emergency or in response to a warning notice ,
i from the NRC. It does not affect the design-basis threat in l 10 CFR 73.1(a) and does not _ imply any need to alter. physical l protection currently required by 10 CFR 73.55. ;
1 l In accordance with existing regulations, the necessary changes l l to contingency plans and procedures need not be submitted for ,
l NRC approval before implementation. Implementing plans and i procedures will be subject to inspection by.the NRC staff commencing approximately 6 months from the date of the generic letter. These inspections can be absorbed in'the NRC' inspection program with no increase in resources.
Guidance for Licensees '
Possible characteristics of a land vehicle bomb, for purposes :
of contingency planning, will be provided to licensees in an attachment (Enclosure 2) to the generic letter controlled as-Safeguards Information (as defined in 10 CFR 73.21). These planning characteristics are based on a staff review that included an exchange of information with cognizant Federal agencies and a review of data on 194 land vehicle borb events worldwide.
i l
t . _ _ _ _ _ _______.________________m
o e
)
The Commissioner NURE0/CR-5246, "A Methodology-to Assist in Contingency Planning for Protection of Nuclear. Power Plants Against .
Land Vehicle Bombs" (Enclosure 3), will be forwarded with.
the' generic letter to; assist licensees in the required
. planning.
NUREG/CR-5246 provides a methodology and illustrative guidance..
to licensees regarding analysis and planning for a possible land vehicle bomb' contingency., . Licensees following the methodology of NUREG/CR-5246 would be. expected to-(1) Identify system cptions available to establish and maintain safe shutdown' conditions.
(2)- Identify buildings containing' components and equipment associated with each system. option..
~ "
(3) Determine'" survivability envelopes" for the system options.
(4) ' Review site features'to determine land' vehicle access approach paths and distances.
(5) Identify short-range measures _ to limit or thwart vehicle access and protect'and preserve: preferred system options.
(6) Prepare plans and make advance arrangements to facilitate the short-range contingency measures in the i event a land vehicle bomb threat arises.
NUREG/CR-5246 does not contain any Safeguards Information.
However, site-specific analyses and associated safeguards contingency planning documents developed by licensees based on NUREG/CR-5246 guidance will likely contain Safeguards Information requiring protection in accordance with 10 CFR 73.21.
I Short-range planning for security. actions could-include such items as' advance' arrangements to facilitate rapid emplacement of emergency temporary vehicle barriers to limit and control-land vehicle access.
l
= _ _ _ _ - _ - _ _
- q t
i The Commissioners i l
Planning should also consider short-range operational measures.to increase plant readiness in-the, event of a credible plant-specific land vehicle bomb threat.
Recommendations: That the Commission:
Note that, if the Commission:does not object, the staff i sTTT issue a generic letter to-initiate short-range contingency planning by power reactor licensees for' )
emergency temporary measures .to be implemented in the. ..
event that 6 credible surface vehicle bomb threat arises.- .
1 i
Victor Stello, Jr. 1 Executive Director for Operations . i
Enclosures:
- 1. Draft Generic Letter to All Power Reactor Licensees and Applicants
- 2. Characteristics of Perceived Danger for Contingency Planning Purposes (SAFEGUARDS INFORMATI0ft) 1
- 3. NUREG/CR-5246, "A Methodology to Assist in Contingency Planning for Protection of Nuclear Power Plants Against Land-Vehicle Bombs" 1
- 4. Backfit Analysis '
- 5. Memorandum from Samuel J. Chilk, "SECY-80-127 - Contingency Planning to Counteract Possible Surface Vehicle Threat," June 16, 1988
- 6. SECY-88-127, " Contingency Planning to Coc.1teract Possible Surface Vehicle Threat," May 10, 1988
The Commissioners Planning should also consider short-range operational measures to increase plant-readiness in the event of a credible plant-specific land vehicle bomb threat.
Recommendations: That the Cornission:
Note that, if the Comission does not object, the staff wiU issue a generic letter to initiate short-range contingency planning by power reactor licensees for emergency temporary measures to be implemented in the event that a credible surface vehicle bomb threat arises.
Victor Stello, Jr.
Executive Director for Operations
Enclosures:
l 1. Draft Generic Letter to All Power Reactor I
Licensees and Applicants
- 2. Characteristics of Perceived Danger for Contingency Planning Purposes (SAFEGUARDSINFORMATION) BE/ ETFO
- 3. NUREG/CR-5246, "A Methodology to Assist in Contingency Planning for Protection of Nuclear Power Plants Against Land Vehicle Bombs"
- 4. Backfit Analysis -
- 5. Memorandum from Samuel J. Chilk, j
"SECY-88-127 - Contingency Planning to Counteract Possible Surface Vehicle Threat," June 16, 1988
- 6. SECY-88-127, " Contingency Planning to !
Counteract Possible Surface Vehicle i Threat," May 10, 1988 j 0FC :R5GB:NRR :R5GB:NRR: : TECH EDITOR :R5GB:NRR :D:DRI5:NRR :0GC NAME :BTMendelsohn:bjp:RJDube :BCalure :RAErickson :BKGrimes :
DATE :1/ /89 :1/1/89 :1/ /89 :1/ /89 :1/ /89 :1/ /89 :
i 0FC :0GCB:HkR :SGTR:NMSS :ADT:NRR :ADP:NRR :D:NkR :EDO NAME :CBerlinger :RFBurnett :FJMiraglia :DMCrutchfield :TEMurley :VStello DATE :I/ /89 :1/ /89 :1/ /89 :1/ /89 :1/ /89 :1/ /89 i - - - _ _ - - _ - - - - -- _ - -
ENCLOSURE 1
PROPOSED GENERIC LETTER FOR TRANSMITTAL TO ALL POWER REALTOR LICENSEES AND APPLICANTS
SUBJECT:
POWER REACTOR SAFEGUARDS CONTINGENCY PLANNING FOR SURFACE VEHICLE B0MBS-(GENERICLETTER89- )
Each application for a license to operate a nuclear power reactor is required by 10 CFR 50.34(d) to include a licensee safeguards contingency plan in accor -
dance with the criteria set forth in Appendix C to 10 CFR Part 73. Each plan identifies and defines the perceived dangers and incidents that it covers and the general way in which they should be handled. In accordance with 10 CFR 73, Appendix C, Section 1.a., the statement of perceived danger should conform -
with that issued by the U.S. Nuclear Regulatory Commission.
l l Recognizing terrorist use of explosive laden vehicles as bombs, particularly-in the Middle East, the Commission concluded it would be prudent to have power reactor licensees include in their safeauards contingency plans short-term actions to protect against attempted radiological sabotage involving a land vehicle bomb if such a threat were to materialize. Accordingly, for the sole purpose of safeguards contingency planning for licensed power reactors, the perceived danger should include a land vehicle bomb with the' characteristics described in I l the Safeguards Information addendum to this letter. Such contingency planning l could involve, but not be limited to, procedures and advance arrangements 'for d increases in security and in the operational readiness of a plant. This action is consistent with the Commission's intention to take a deliberative and 1 J
- systematic approach in the absence of a credible threat in the United States.
J Each power reactor licensee is required by 10 CFR 50.54(p)(1) to prepare and mainthin safeguards contingency plan procedures in accordance with Appendix C j to 10 CFR Part 73. In response to this letter, licensees should modify their 'I safeguards contingency procedures to address the possibility of a land vehicle bomb. The enclosed report, NUREG/CR-5246, provides guidance and examples to assist licensees in developing contingency procedures for vehicle bombs. This j report describes only one approach, although others would also be acceptable, j Please note that although the enclosed NUREG report does not contain 'any Safe- l guards Information, site-specific enalyses and associated safeguards contingency planning documents prepared by licensees would be expected to contain Safeguards I Information and require protection in accordance with 10 CFR 73.21.
1 ENCLOSURE 1 l
l
]
Generic Letter Pursuant to 10 CFR Part 73, Appendix C, safeguards contingency implementing j procedures need not be submitted to the Commission for approval but will-be subject to inspection by the NRC staff. commencing approximate 1y'6 months from the date of this letter. If land vehicle bomb considerations require change!. -
in existing contingency plans, licensees may make them in accordance with 10 CFR
50.54(p)(2). Such changes will not require specific NRC approval unless they could decrease the effectiveness of existing contingency plans.
i A power reactor licensee is required by 10 CFR 73.55(a) to establish and main-tain an onsite physical' protection system and security organization .that will
. provide a high degree of protection against the design-basis threat of radio-logicalsabotageasstatedin10CFR73.1(a). The design-basis threat in 10 CFR 73.1(a) includes the possibility of a. determined violent external-assault by several persons. The Comission has concluded that the current design-basis threat for radiological sabotage continues to be adequate and appropriate for establishing _and maintaining onsite physical protection systems.
Accordingly, the consideration of a land vehicle bomb is pertinent only to safeguards contingency planning and does not imply any need to alter physical protection systems established under Id CFR 73.55 for licensed power reactors.
This contingency planning is only for temporary short-term measures that could be implemented by licensees in response to a warning notice from the NRC.
This effort will result in an increase in the overall protection of the public health and safety and the common defense by ensuring that power reactor licensees
)!
are prepared to take short-term measures to protect against a land vehicle bcmb if such a threat develops. The Commission believes that the costs of contingency planning for protection against a land vehicle bomb are justified in view of this increased preparedness.
l ENCLOSURE 1 l
y 4
Generic Letter -3' This request is covered by Office of Management and Budget Clearance Number 3 3250-0011, which expires December 31, 1989. Where plent systems, . structures,- 3 layout and topography are' amenable to simple analysis the average burden for the requested. contingency planning is. estimated to be in!the range of 350 to 500 man-hours per licensee response, including assessment of the new requirements, searching data sources, gathering and analyzing the data, and preparing the required records. Where a licensee must do more rigorous.
analysis, several thousand man-hours could be' required. Concents on the .
accuracy of this estimate _and suggestions to reduce the burdenLmay be directed to the Office of Management and Budget, Room 3208, New Executive Office Building, Washit.gton, D.C. 20503,iand to the U.S. Nuclear Regulatory Commission, Records -
and Reports Management Branch, Office of Administration and Resources Management, ;
Washington, D.C. 20555. l
)
I l
l Dennis Crutchfield. ]
Acting Associate Director for Projects i Office of Nuclear Reactor Regulation i 1
i i
I a
I i
ENCLOSURE 1
fk. h,kAjjlgg - 1 D! CLOSURE 2 I 4 l 1 i I l l SARARDS rag)g
I sw
-1 l
i.l l
-l 1
;l
-l 1
.i i
4 ENCLOSURE 3 e
i FINAL DRAFT l l 2 NUREG/CR-5246 S AIC-88/1885 ( h 1 1
)
A Methodology to Assist-in 1 Contingency Planning for Protection of Nuclear Power Plants Against Land Vehicle Bombs ( J
-__ _ _._ =
= ~_
~ "
m E EE
~NN$"we Science Appleations katemationalCorporation An Employee-Owned Company January 3,1989 Joseph W. James j Lewis A. Goldman Peter R. Lobner l Stephen P. Finn 1 Theodore H. Koch
, John D. Veatch
\
l l PREPARED FOR l U. S. NUCLEAR REGULATORY COMMISSION j Contract NRC-03-87-029 NRC FIN NO. D-1772 Task Order 28 l 1710 Goodridge Drive, P.O. Box 1303, McLean, Virginia 22102 (703) 821-4300 Other SAIC OMcw Anhuover~ue Boston Cokwado Sprmes. Dayton. Montsale, Las W;res, los Angeles, Oak Rodge. Orlanoo. Polo Afra San Dega Seattle, and Tucson
SAIC 01V)349 ABSTRACT This report provides a methodology which could be used by operators oflicensed nuclear power reactors to address issues related to contingency planning for a land vehicle bomb, should such a threat arise. The methodology presented'in this report provides a structured framework for understanding factors to be considered in contingency planning for a land vehicle bomb - including: 1) system options available to maintain a safe condition, 2) associated components and equipment,3) preferred system options for establishing and maintaining a - safe shutdown condition, and 4) contingency measures to preserve the preferred system options. Example applications of the methodology for a Boiling Water Reactor (BWR) and Pressurized Water Reactor (PWR) are provided along with an example of contingency plan changes necessary for implementation of this methodology, a discussion of some contingency measures that can be used to limit land vsMcle access, and a bibliography. l l l i i l k i. l~ l 1
\
1 J l f- ; i iii , I L l i
q SAIC 01\03\89 R TABLE OF CONTENTS Section T.lile Eau i Title Page .i j Abstract iii ~ Table of Contents v 1 List of Figures viii 1 List of Tables viii Preface ix Acronyms and Abbreviations xi l l EXECUTIVE
SUMMARY
1 j 1 INTRODUCTION 1.1 Purpose . 1-1 1.2 Nuclear Power Plant Design Basis 1-1
)
1.3 A proach 1-1 1 1 1.4 S tion 1 References 1-2 i 1 2 SYSTEM OPTIONS FOR ESTABLISHING AND l MAINTAINING SAFE SHUTDOWN { 2.1 Front-Line Systems 2-1 2.2 Support Systems 2-7 2.3 Identification of Available System Options 2-7 i 2.4 Section 2 References 2-10 l 3 PROTECTING PLANT SYSTEM OPTIONS l 3.1 Plant Stuvival Zones 3-1 3.2 location of Systems in Relation to the Defined Stuvival Zones 3-1 l 3.3 Blastleading Estimates 3-2 3.4 Survival Envelopes 3-3 3.5 Section 3 References - 3-3 J 4 SELECTION OF PREFERRED SYSTEM OPTIONS BASED t ON PLANT LAYOUT l 4.1 Avenues of Approach 4-1 4.2 Relationship of Survival Envelopes and Areas Accessible to Land Vehicle Bombs 4-1 5 CONTINGENCY MEASURES TO PRESERVE THE l PREFERRED SYSTEM OPTIONS ! 5.1 Operational Measures to Increase Plant Readiness 5-1 ; 5.2 Changes to Plant Operating Mode 5-2 5.3 Measures for Limiting Vehicle Access 5-3 5.4 Section 5 Reference 5-3 V
f SAIC 01\03\89- ' d, r TABLE; OF, CONTENTS, Continued , J 1 Section 'I,itig ' East '] i 6 -EXAMPLE APPLICATION OF THE METHODOLOGY TO; i THE SUNSHINE BWR PLANT. .. l 6.1 Overview of Example _ .. .. . . 6-1 j 6.2 Principle Contingency Planning Considentions at the '_ . Sunshine BWR Plant 6-1 1
'6.2.1 - Front-Line Systems 6-1 '
6.2.2 Support Systems ~6 6.2.3 ' Preferred System Options'- 6-2 6.3 Protecting System Options at the Sunshine BWR Plant - '6 ; 6.3.1 PlantSurvivalZones . 6.3.2 - Location of Essential Equipment 6 6-6 1 1 j 6.3.3 Blast Loading of Structures. 6-8 .;
' 6.3.4 , Surviva1 Envelopes 6-10 i 6.4 Selection of Prefened System Options Based on Plant : 1 Layout at the Sunshine BWR Plant , 6-10 !
6.4.1 Avenues of Approach . ' 6-10' ~l 6.4.2 Relationship of Survival Envelopes and i . 1 Areas Accessible to Surface Vehicle Bombs (6-10 ' 6.5 Contingency Measures to Preserve the Preferred System : Options at the Sunshine BWR Plant ' 6 12 ! 6.5.1 Increase Plant Readiness- 6-12' i 6.5.2 Changes to Plant Operating Mode .6-15 1 6.5.3 Measures for Limitmg Vehicle Access 6-15 6.6 Section 6 References ; 6 , 4 7 EXAMPLE APPLICATIONS OF THE METHODOLOGY TO THE MUONfff OW PWR PLANT-7.1 O r. c. ev ef) > unple 7-1 .! 7.2 Prb;:ph: NCngency Planning Consideranons at the _ Moonglow PWR Plant- 1 7.2.1 Front-Line Systems . 7 7.2.2 Support Systems 7-2 4 7.2.3 Preferred System Options - 7-3 ; 7.3 _ ProtectinJ System Options at the Moonglow PWR Plant 5 7.3.1 P ant Survival Zones ' 7-5 : 7.3.2 Location of Essential Equipment 17-7 :! 7.3.3 Blast Loading of Structures ' 7 ! 7.3.4 SurvivalEnvelopes' .
.7 l 7.4 Selection of Prefened System Options Based on Plant 1 l: Iayout at the Moonglow PWR Plant 7-8 7.4.1 ~ Avenues of Approach . 7-8 ;
7.4.2 Relationship of Survival Envelopes and . ' Areas Accessible to Surface Vehicle Bombs ' 7-11 L vi
SAIC 01\03\89 TABLE OF CONTENTS, Continued Section IIllt Eagt 7.5 Contingency Measures to Preserve the Preferred System Options at the Moonglow PWR Plant 7-11 7.5.1 Increase Plant Readiness 7-11 7.5.2 Changes to Plant Operating Mode 7-12 7.5.3 Measures for Liminng Vehicle Access 7-13 7.6 Section 7 References 7-13 Anoendix A SAMPLE MODIFICATIONS TO A SECURITY CONTINGENCY PLAN A-1 A.1 Purpose A-2 A.2 Background and Scope A-2 A.3 Responsibility Matrices A-2 A.4 Implementing Procedures A-5 B TOPICAL BIBLIOGRAPHY OF SAFEGUARDS REFERENCES B-1 l Vii
G
.'SAIC' 01\03\89 LIST OF FIGURES lillt EAER Figure 2-1 PWR Transient Mitigating System Fault Tree 2-5 Figure '-2 BWR Transient Mitigating System Fault Tree 2-6.
Figure 2-3 Definition of Symbols Used in Fault Trees : 2-8 Figure 2-4 , Example System Dependency Diagrams . 2-9 L Figure 6-1 ' Simplified Plot Plan of a Sunshine BWR Plant '6-7 & Figure 6-2 Survival Zones for Sunshine Plant Structures . 6 Figure 6-3 Survival Envelopes for Sunshine Plant . . 6-11. Figure 6-4 Layout of Reactor Building at Grade Level 13; Figure 7-1 Simplified Plot Plan of a Moonglow PWR Plant '7-6; Figure 7-2 Survival Zones for Moonglow Plant Structures 7-9 Figure 7-3 Survival Envelopes for Moonglow Plant 7-10 I>IST OF TABISR' 1111C EAER Table 2-1 Safety Functions and Associated Front-line Systms for a TypicalPWR Plant - " 2-3 Table 2-2 Safety Functions and Associated Front-line Systems for a - TypicalBWR Plant . 2-4 Table 6-1 Safety Functions and Associated Front Line Systems for the Sunshine BWR Plant 6-3 Table 6-2 Support Functions and Systems for the Sunshine BWR Plant ' ~ 6-4' Table 6-3 System Dependency Matrix for Front-line Systems at the Sunshine BWR Plant - 6-5 Table 7-1 System Options for Safe Shutdown at the Moonglow PWR Plant 7 Table A-1 Responsibility Matrix for Event 9: Fire, Explosion, or Other Catastrophe . A-3 ' Table A-2 Responsibility Matrix for Event 14: Land Vehicle Bomb Alert A-4 L Viii
SAIC 0lV)3\89' Preface j f This work was undenaken in response to' contract NRC-03-87-029. It suppons NRC efforts to provide technical guidance to licensees for development of contingency plans for - land vehicle bombs should such a threat arise. 1 The NRC Lead Engineer for this task, Barry T. Mendelsohn, provided considerable input 4 and technical direction for this repon. Additionally, the repon benefited from valuable technical direction given by Roben Dube of the Safeguards Branch. j The authors are especially grateful to Sarah O'Bryhim, Mary Ann McKenzie, and Kathy j McGrath for their considerable patience in producing numerous revisions to this repon. 1 d (. ') 1 l l
\ !
l q l l j i I
'i
-l l
l 1 ix
'SAIC OlND3\89 ACRONYMS AND- ABBREVIATIONS AC Alternating Current .
ADHRS Auxiliary Decay Heat Removal System ' ADS Automatic Depressurization System AFW Auxiliary Feed Water BWR Boiling Water Reactor CAS Central Alarm Station - .
]
.i CRDHS Control Rod Drive Hydraulic System i CST Condensate StorageTank CVCS Chemical and Volume Control System DC. Direct Current ~.
.DG DieselGenerator ECCS Emergency Core Cooling System -
EDO Emergency Duty Officer _ . .l EOD Explosive Ordinance Disposal ; EOF. Emergency Operations Facility ~ EOP Emergency Operating Procedure j ESF Essential Safeguards Features. ESW Essential Service Water 1 FBI Federal Bureau ofInvestigation HPIC - High Pressure Injection Cooling INTK Intake Structure . j] I.OCA Loss of Coolant Accident LPCI Low Pressure Coolant Injection NRC- Nuclear Regulatory Commission OSP Off Site Power PA Protected Area . PORY Power Operated Relief Valve PRA Probabilistic Risk Assessment psi Pounds Per Square Inch PWR Pressurized Water Reactor 1 RB Reactor Building I RC Reactor Containment RCIC Reactor Core Isolation Cooling RCS Reactor Coolant System RHR ReactorHeat Removal 4 i RHRSW Residual Heat Removal Service Water . -!- RPS ReactorPmtection System RW Radwaste Building l RWST Refueling Water Storage Tank SAIC Science Applications Intemational Corporation . SAS Samad y Alarm Station y SCP Safeguards Contingency Plan ' SFP Security Force Personnel SL Shift Lieutenant SNGS Sunshine Nuclear Generating Station SS Shift Supervisor - -l SSRS Secondary Steam Relief Valve l STA Shift Technical Advisor
-)
l:
-TB- Turbine Building ;
- TBD To Be Determined 1 TNT Trinitrotoluene
,I Q
_-____m__.___-___-__._-a.-__________.___2.._-___-___m
SAIC 01503\89 TSM Transient Mitigation Systems VA Vital Ama VAA Vital Area Analysis VAC Voltage Alternating Curmnt VDC Voltage Direct Curmnt 1 l Xkk
7..
' SAIC OlV)3\89 :
, o EXECUTIVE
SUMMARY
- 1. < t. . - .
- The purpose of this report is to provide a methodology which could be used by operators ' .i~
of licensed nuclear power reactors in contingency planning for a land vehicle bomb, should . ' such a threat arise. The' security systems at nuclear power plants are designed to protect ' 3
- against the design basis threat specified in.10 CFR Part 73. That design basis threat does < 'l not include aland vehicle bomb. . .
~
~
The six step methodology presented in this report can be applied by a licensee to gain an-understanding of factors to be considered in contingency planning for a possible land - vehicle bomb. The methodology provides a structured framework for:L.1) examining the '
. potential vulnerability of a plant to a postulated land vehicle bomb, and 2) developing; contingency planning stategies for dealmg with such a possibility. The six steps are:
(1) Identify system options available to establish and maintain safe " shutdown conditions (Section 2). (2) Identify buildings containing components and equipment associated with each system option (Section 3). (3) Determine " survivability envelopes" for the systems options (Section ' 3). d (4) q Review site features to determine land. Vehicle access approach paths and distances (Section 4). I! 1: (5) Identify short-range measures to limit or thwart vehicle access and protect and preserve preferred systems options (Section 5). - j (6) Prepare plans and make advance arrangements to facilitate the 1 short-range contingency measures in the event a land vehicle bomb' threat arises (Section 5 and Appendix A).
- )
II L l
-i
- l
'i s
i L a a e l [. .l e . 1 L 1 4 h ____immm_'m'________m _ . _ _ _ _ _ _ . _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ , _mm __ __m __ _ __ __ __ m___._
~
' SAIC 01V)3\89i SECTION 1
, INTRODUCTION 1.1 . PURPOSE-The purpose of this report is to provide a methodology which could be used by operators oflicensed nuclear power reactors in contingency planning for a land vehicle bomb, should such a threat arise. I '. 2 NUCLEAR POWER PLANT DESIGN BASIS The design basis for nuclear power plants includes a wide range of events that are postulated to occur. The basic minimum external loading conditions used for design of safety-related structures and certain expued equipment are derived from USNRC-Regulatory Guide 1.76 (Ref.1), USNRC Standard Review Plan 3.3.2 (Ref. 2), and USNRC Regulatory Guide 1.91 (Ref. 3). l The security systems at nuclear power plants are designed to protect against the design
. basis threat specified in 10 CFR Part 73 (Ref. 4).
1.3 APPROACH 1 ' l The six step methodology presented in this report can be applied by a licensee to gain an understandmg of factors to be considered in contingency planning for a land vehicle bomb. The six steps are: (1) Identify system options available to establish and maintain safe shutdownconditions(Sectico2). (2) Identify buildings containing components and equipment associated with each system option (Section 3). (3) Determine " survivability envelopes" for the systems options (Section 3). (4) Review site features to determine land vehicle access approach paths [ and distances (Section 4). (5) Identify short-range measures to limit or thwart vehicle access and protect and preserve preferred systems options (Sect'.m 5). l (6) Prepare plans and make advance arrangements to facilitate the short-range contingency measures in the event a land vehicle bomb i threat arises (Section 5 and Appendix A). 1-1
SAIC 01V)M9 Example applications of.the methodology for a Boiling Water Reactor (BWR) and' Pressurized Water Reactor (PWR) are contained in sections 6 and 7, respectively. An: example of contingency plan changes necessary for implementation of this methodology is shown at Appendix A. Appendix B provides a bibliography. 1.4 SECTION 1 REFERENCES
- 1. Regulatory Guide 1.76, " Design Basis Tornado for Nuclear Power Plants,"
April,1974.
- 2. USNRC Standard Review Plan 3.3.2, " Tornado Loadings," NUREG-0800.
- 3. USNRC Regulatory Guide 1.91, " Evaluation of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants," Rev.1, February 1978.-
l
- 4. Code of Federal Regulations 10 CFR Part 73, " Physical Pmtection of Plants and Materials," U.S. Nuclear Regulatory Commission.
1 1 i 1-2 1 .. .. .
SAIC ONm89 l SECTION 2 l SYSTEM OPTIONS FOR ESTABLISHING AND MAINTAINING SAFE SIIUTDOWN The first step in the planning methodology is to identify front-line and support systems that could be used to establish and maintain a safe shutdown condition in the event a land vehicle bomb threat was to arise. The output of this step is a collection of system options, each of which includes a set of systems that is capable of establishing and maintaining a safe shutdown condition. Several techniques are available for identifying the system options. A relatively simple approach focuses on identifying potential sources of a release of radioactive material and the safety functions associated with preventing a significant release of radioactive material. This approach utilizes the plant safety functions that are identified in NUREG-0737, Supplement 1 (Ref.1) and in NUREG/CR-2631 (Ref. 2). 'A more rigorous approach is to perform a detailed fault tree analysis along the lines of a Probabilistic fJsk Assessment (PRA), without assigning probabilities, or Vital Area Analysis (VAA). If a ?RA or VAA has already been performed for a particular plant the results can be applied to contingency planning. Other studies that may be useful m identifying systems of importance are station blackout coping
" n analyses and Wl5ifm&st an. Plantmmwvnw.c.
Evaluadons. Given the range of land vehicle bomb sizes being considered for contingency planning purposes, it will be postulated that a land vehicle bomb will not initiate a loss of coolant accident (LOCA) involving primary coolant system piping or interfacing piping inside the primary containment structure. This assumption should be examined on an individual plant basis because there may be instances of pipmg outside containment that, if breached, would result in a LOCA that cannot be isolated. By assuming that a LOCA does not occur the analysis can treat the land vehicle bomb attack as a transient initiator, and focus on protecting systems for mitigating transients. Transients ofinterest include, but are not limited to, loss of off-site power, loss of main steam and power conversion system, loss of heat sink, and release from radioactive waste systems. 2.1 FRONT.LINE SYSTEMS One approach to the identification of front-line systems uses the NUREG-0737, Supplement 1 (Ref.1) definition of the five safety functions that a plant must satisfy in all operating modes: (a) reactivity control, (b) reactor core cooling and heat removal from the primary system, (c) Reactor coolant system integrity, (d) containment integrity, and (e) radioactivity release control. The specific plant systems that can be used to satisfy each function should ~ be identified. The intent is to develop a matrix showing the primary and backup systems. available to perform each safety function and te, identify any opportunities for recovery actions if the primary and backup systems are disabled. Unorthodox measures for decay heat removal, such as feed and bleed /PWR) or containment flooding (BWR) can also be considered when developing the systera matrix. 2-1
, R
, 'l 3 ,
.SAIC OlV)3\89 j
. +q If the critical safety function approach is used to identify the systems ofimportance, some -' l assumptions may be applicable for the purposes of contingency planning. One, it is highly c '
d unlikely that the land vehicle bomb will interfere with the plant's ability to scram the reactor. : j Therefore,it can be assumed that the immediate reactivity functicn is satisfiede Also, as long .
should be documented in some suitable form. System dependencies could be summarized in ' '
terms of a matrix or a system dependency diagram as used in the NUREG-1150 PRAs (Ref. i 5). Figure 2-4 shows an example system dependency diagram. Note that important system .
i dependencies also should be included in PRA or VAA models that may be available for a i particular plant, i i
1 2.3 IDENTIFICATION OF AVAILABLE SYSTEM OPTIONS Using the above front-line and support system information, a set of available system options for achieving safe shutdown can be developed. In each system option all required safety _
functions should be satisfied. However, it should be noted that in most cases if the core .
cooling and RCS integrity functions are satisfied, then the containment integrity function will not be ch.allenged. If containment integrity is satisfied the radMvity control function, as it i
relates to releases from the reactor core, will probably be satisfied.~ Other potential sources .
of release, such as spent fuel and radioactive waste systems, should also be examined to determine if significant release could result from a land vehicle bomb attack. It should be '
noted that prior VAA studies have concluded that radioactive waste systems do not contain enough activity to cause a release in excess of 10 CFR Part 100 limits.1 The amount of :
activity present in spent fuel storage is a function of burnup and time ~since refueling.-
The determination of system options should be based on a consistent' understanding of-contingency plan success. For example, if a plant can stay in " hot" shutdown or standby for r an extended period of time then this may qualify as a success. If a plant cannot stay hot for an extended period of time it would be necessary to establish cold shutdown for a success .
path to be achieved. Factors that go into this determination should include, but not be limited to, the capacity of available water sources, capacity of available heat sinks (e.g.,
period of time before suppression cooling must be established in a BWR), and battery capacity. The ability to replenish water supplies via hose connections or tank trucks, and to -
recharge batteries using portable diesels can be considered.
e 1 2-7 i I
. a --.______.m.__.___ -_ _m ___2..- - _ _ _ . . _ _ ___m__..___m_-__-_m_ _____._ _____.-___ __-____._ -.__-____m___ _ _ . _ . m _ ._.__m m ___.___ - _ _ _ _ m _ ____ __ __ _m _ _ _ _ .
l SAIC" 01/03/89 1 l , ~ TRANSENT MmGATE SYSTEMS
< . Event Descript. ion DISABLED j
m e- Event label (used by fhult tree f analysis computer ccdes) '( l
. OR Gate. Any input to the' gate..:
= must occur for the gate event-(N ~ to occur -
) l AND Gate. Allinputs to the gate
= must occur for the gate event -
to occur f 1 i Undeveloped event.- Further ; ;
= development of the event j can be performed i
j Figure 2-3. Definition of Symbols Used in Fault Trees. 2-8 b
( l t REACTOR CORE-ISOLATION COOUNG
-SYSTEM
( D' i W l oc asonasv i POWEA A g O D nec ACTUATION a v EMERGENCY SERV 6CE WATER COQUNGX1H2)
.......... ...q ).................. l ROOM F
, ...............qp ...............,
l i Dependency Diaram is Shown Using Fadure Lo08. ' NDependency Not Requesd During Short Term Operation. calRoom Cochng Can Also Se Performe, By Openm0 Doors. Figure 2-4. Example System Dependency Diagram. 2-9
. _ _ _ _ _ . . _ _ _ _ . _ - _ - - - - - - - - - - - - - - - - - - - - - - - - - - " ^
SAIC 0N)3\89 After compiling the list of system options each option should be ranked based on engineering or operational considerations, such as: (a) a better quality water source is used, (b) only one AC and/or DC load group is needed, (c) depressurizing the~ RCS is not required. The resulting prioritized list of system options should be included in contingency - procedures to familia:-ize the operator with the degree of flexibility available in dealing with the land vehicle bomb, shodd such a threat arise. 2.4 SECTION 2 REFERENCES
- 1. NUREG-0737, Supplement 1, " Requirements for Emergency Response Capability," NRC Generic Letter No. 82-33, December 17,1982.
- 2. Gallup, D.R. and Vannoni, M.G., "A legical Framework for Identifying -
Equipment Important to Safety in Nucl ar Power Plants," NUREG/CR-2631, Sandia National Laboratories, July 1983.
- 3. NUREG/CR-2300, "PRA Procedures Guide, A Guide to the Performance of Probabilistic Risk Assessment for Nuclear Power Plants," American Nuclear -
Society, Institute of Electrical and Electronics Engineers, January 1983.
- 4. NUREG/CR-2815, "Probabilistic Safety Analysis Procedures Guide," Brookhaven National Laboratory, August 1985.
- 5. NUREG-1150, " Reactor Risk Reference Document," U.S. Nuclear Regulatory Commission," February 1987.
- 6. NUREG/CR-4550, Volume 1, " Analysis of Core Damage Frequency From Intemal Events: Methodology Guidelines," Sandia National Laboratories, September 1987.
- 7. Vamado, B.G. and Ortiz, N.R., " Fault Tree Ans. lysis for Vital Area Identification,"
NUREG/CR-0809, Sandia National Laboratories, June 1979.
- 8. NUREG-1178, " Vital Equipment / Area Guidelines Study: Vital Area Committee Report," U.S. Nuclear Regulatory Commission, February 1988.-
2-10
SAIC 01/03/89 f I SECTION 3 PROTECTING PLANT SYSTEM OPTIONS I The next two steps in the methodology is to examine the locations of essential equipment and l the ability of structures to survive a bomb blast. The purpose of these steps is to characterize the system options identified in the previous step by their inherent ability to withstand effects of a threatened land vehicle bomb. The major variables of concern in this step are the size of the explosive and the strength of the structures. Explosive size can be expressed in terms of pounds of trinitrotoluene (TNT). Structure strength can be expressed in terms of static wall capacity, as discussed in Section 3.3. Static wall capacity is the ability of a wall to resist a given loading. Based on the site's - tornado and seismic zones, all safety related structures rnust be designed with a certain static wall capacity. For the purposes of contingency planning, the tornado or seismic zone wall capacity can be assumed, or a more detailed analysis can be performed. Such an analysis can also address the issue of tolerable damage, that is, damage that would not ordinarily be acceptable for continued plant operation, such as cracks that exceed the basis on which the structure was designed, but will still permit safe shutdown. 3.1 PLANT SURVIVAL ZONES A survival zone is defined as an area of some radius out from each wall of a structure, such that if an explosion takes place outside of the zone the structure will not be unacceptably damaged. The radius of the survival zone area is also known as the safe standoff distance. Standoff distances are calculated based on the blast resistance of each structure, as discussed in Section 3.3. Survival zones should be defined for all structures containing equipment in the system options. An initial approach is to define zone boundaries based on the perimeter walls of buildings. A more detded araalysis can be performed to define survival zone boundaries based on actual structural parameters and propagation of blast effects to the interior of the building and to safety equipment contained within the building. It is recommended that outside building walls be used for an initial determination of survival zones.- l 3.2 LOCATION OF SYSTEMS IN RELATION TO TIIE DEFINED SURVIVAL ZONES For each system option the associated survival zones must be identified. For example, one potential system option for a BWR involves use of the reactor core isolation cooling (RCIC) system for core cooling and inventory control, supported by the station batteries. The l survival zones associated with this system option may be represented by the reactor building l zone (which contains the RCIC piping, valves, pumps and controls) and the turbine building zone (which may contain the batteries and supporting switchgear). An additional zone for the Condensate Storage Tank can be added, but the suppression pool inside the remor building represents an alternate water source. l 3-1
SAIC 01/03/89 The result is the conversion of the list of system options deve!oped in Section 2 to a list of survival zones that represent the protection of available system options for safe shutdown. 3.3 BLAST LOADING ESTIMATES A methodology for calculating standoff distance, which is defined as the minimum distance from a structure that a given magnitude of explosion will not cause damage to the structure, can be found in NUREG/CR-2462 (Ref.1). The standoff distance is calculated with the following formula (Ref.1): R=F f W W3 2 P s
\ )
where R= standoff distance in feet F = ductility factor W= TNT equivalent of explosive in Ibs ps = static wall capacityin psi It is suggested in NUREG/CR-2462 that a duculity of 3 is most appropriate for this type of . l analysis. The major variables in this calculation are de size of the explosive and the static wall capacity of the structure. The static wall capaci,ty can be simply assumed to be the minimum allowed for the plant's tornado zone or seismic zone. However, it should be noted that a number of conservative assumptions svere made in deriving this formula. If the standoff distances determined by applicatio of this formula can be achieved, no further calculations are necessary. If not, ma cmg more detailed calculations may be necessary. NUREG/CR
-2462 contains a methodology for more realistic calculations of standoff distances. A more direct approach to determine blast effects which does not rely directly on static wall capaciues is provided in the Southwest Research Institute Blast Vulnerability Guide (Ref. 2).
In reality, most equipment is located within rooms in the interior of their respective buildings. Determimng the blast and fragment loadmg on specific equipment within interior rooms requires detailed knowledge of the architectural details and therefore must be calculated on a site-by-site basis. A realistic, commercially available approach for performing calculations of blast effect using computer modeling and graphics was presented at the 2pth annual INMM meeting (Ref. 3). Appendix B also provides several references pertaining to bomb / blast effects. Once the standoff distance for each structure is calculated, the size of the survival zones is established. For the purposes of contingency planning a simplified plot plan of the site should be prepared, showing the major structures, roads, and fences. Then, the surviva'. zones should be overlaid on the site plan. This will provide an idea of the degree of vulnerability of the structures which house essential systems. The drawing of the survival zones can take into account blast shielding by other buildings. 3-2
SAIC 01/03/89 The result is the cenversion of the list of system options developed in Section 2 to a list of survival zones that represent the protection of available system options for safe shutdown. 3.3 BLAST LOADING ESTIMATES A methodology for calculating standoff distance, which is defined as the minimum distance from a strvtu.: that a given magnitude of explosion will not cause damage to the structure, can be found in NUREG/CR-2462 (Ref.1). The standoff distance is calculated with the following formula (Ref.1): R=F rwS1/3 2 P s
\ )
where R= standoff distance in feet F = ductility factor W= TNT equivalent of explosive in Ibs ps = static wall capacity in psi it is suggested in NUREG/CR-2462 that a ductility of 3 is most appropriate for this type of l analysis. The major variables in this calculation are the size of the explosive and the static wall capacity of the structure. The static wall capacity can be simply assumed to be the mmimum allowed for the plant's tornado zone or seistnic zone. However, it should be noted that a number of conservative assumptions were made in deriving this formula. If the standoff distances determined by application of this formula can be achieved, no funher calculations are necessary. If not, ma dng more detailed calculations may be necessary. NUREG/CR
-2462 contains a methodology for more realistic calculations of standoff distances. A more direct approach to determine blast effects which does not rely directly on static wall capacities is provided in the Southwest Research Institute Blast Vulnerability Guide (Ref. 2).
In reality, most equipment is located within rooms in the interior of their respective l buildings. Determimng the blast and fragment loading on specific equipment within interior l rooms requires detailed knowledge of the architectural details and therefore must be calculated on a site by-site basis. A realistic, commercially available approach for performing calculations of blast effect using computer modeling and graphics was presented at the 2pth annual INMM meeting (Ref. 3). Appendix B also provides several references penaiaing to bomWblast effects. Once the standoff distance for each structure is calculated, tre size of the survival zones is establit.hed. For the purposes of contingency planning a simplified plot plan of the site should be prepared, showing the major structures, roads, and fences. Then, the survival zones should be overlaid on the site plan. This will provide an idea of the degree of vulnerability of the structures which house essential systems. The drawmg of the survival zones can take into account blast shielding by other buildings.
- For ductility = 3, Fp = 54. Other ductility factors are tabulated in NUREG/CR-2462.
3-2 l
. ~ - .
SAiC 01/03/89 3.4 SURVIVAL ENVELOPES In Section 3.2 each system option was associated with a set of survival zones. Using the standoff distances calculated above, a survival envelope can be determined for each option. Each envelope will be bounded in all directions by the maximum standoff distance of each survival zone that extends in that direction. Each envelope repmsents an area such that. if an explosion occurs outside, at least one system option will survive to ensure saf: shutdown. For the purposes of contingency planning the survival envelopes should be overlaid on the site plan. 3.5 SECTION 3 REFERENCES 1. i Kennedy, R.P., Blejwas, T.E., and Bennett, D.E., " Capacity of Nuclear Power Plant Structures to Resist Blast Loadings," NUREG/CR-2462, Sandia National Laboratories, September 1983.
- 2. Whitney, M.G., Ketchum, D.E., Poleyn, M.A., " Blast Vulnerability Guide,"
Southwest Research Institute (ptepared for the Naval Civil Engineering Laboratory), October,1987.
= 3. Massa, R.J., et al.,"BombCAD - A New Tool for Bomb Defense in Nuclear Facilities," Proceedings of the 29th Annual Meeting of the Institute of Nuclear Material Management, June,1988.
3-3
l' SAIC 01503\89 ) I SECTION 4 SELECTION OF PREFERRED SYSTEM OPTIONS BASED ON PLANT LAYOUT l The results of the first two steps of the methodology is identification of a set of survival envelopes that facilitate the protection of systems and equipment required for safe shutdown. The system options, and hence the survival envelopes, Mve been ranked based i on engineering and operational considerations. The third step of the methodology involves ! examination of the physical characteristics of the site, inclading existing security features, in order to choose the system option or options that can be most readily protected from attack. Then tradeoffs can be performed between the operational concerns and security concems to choose the preferred system options. 4.1 AVENUES OF APPROACH All credible approach paths forland vehicle bombs should be defined. Lhdible approaches include existing roads and off-road approaches over open terrain in the vicinity of the site. All credible approach paths should be noted on the site plan drawing along with the survival envelopes. Features of the plant that would impede vehicle travel, such as berms, recesses, buildings, and equipment, should also be idenufied. 4.2 RELATIONSHIP OF SURVIVAL ENVELOPES AND AREAS ACCESSIBLE TO LAND VEHICLE BOMBS By overlaying the survival envelopes on a site plan that shows access routes and security features, information can be gained about the relative vulnerability of each system option. For example, survival enyt. lopes that fall completely within the plant security fence are preferable to envelopes that extend beyond the fence. Also, envelopes that are not readily accessible to vehicles have advantages over those that are more accessible. Locations iuidt, survival envelopes that are accessible to a land vehicle bomb, or that vehicles might be expected to reach without the installation of additional barriers, should be identified. There may be some areas on the plant site that are common to all survival envelopes and are accessible to a land vehicle bomb. These areas are important because they offer the potential for a land vehicle bomb to disable all available system options for establishing and maintaining a safe shutdown. It should be the goal of the contingency plan to preserve the integrity of at least one complete survival envelope. The plant should identify envelopes that contain the preferred option (or options) and develop contingency measures that will enhance the like,lihood that these options will survive a vehicle bomb attack. It should be noted that the most prefemble system option from an operational standpoint may be the more vulnerable to attack than other options. For example, options that require off-site power may have larger envelopes than options that utilize on-stte emergency power. It is the intent of the methodology to identify, prior to 4-1
SAIC 0lV)M9 an event, several options for dealing with mcovery from or pmtection of the plant from the vehicle bomb, and preserving as much flexibility as possible depending on the particular circumstances. In pmparing contingency measures to preserve these options consideration should be given to the relative case in which the envelopes can be protected. Factors to consider include whether a survival envelope is entirely within die control of the security force, and whether a survival envelope encompasses existing site features in the owner
-controlled area that afford some protection against vehicle bombs (i.e., structures in the owner-controlled area, site topography).
1 1 4-2
u y -
, y .
% ,v v
! SAIC 0N).%89 :
~
k k 1 SECTION' 5 L ' CONTINGENCY MEASURES TO PRESERVE THE PREFERRED: ' ' SYSTEM . OPTIONS The' first four steps of th'e methodology result in the shlection of preferred system options : that take into account engineering and operational features of plant systems and the location and vulnerability of key equipment. The last.two steps of the methodology involve the; identification of and rearrangements for q=cific contingency measures that can be taken if : the NRC determines that an increased state of readiness is necessary. .'Diese measures fall j into three major categories: 1) measures to increase plant operational readiness,2) changes
. to current plant operating mode, and 3) security measures to restrict vehicle access." These topics are discussed below. >
5.1 OPERATIONAL MEASURES TO INCREASE PLANT READINESSi , The plant should identify measures to increase system availability or operating flexibility. This includes alterations to nonnal system lineups to place them in a transient mitigation mode, curtailing plant activities that could limit system or component operability, and-arrange for additional backup equipment. NUREG/CR-2585 (Ref.1) identifies many. methods for restoring key plant safety functions if the installed primary and backup systems are disabled. NUREG/CR-2585 could be used as a sourcebook for contingency planning.' The following is a list of example measures that may be appropriate depending on the - circumstances: Minimize the impact of maintenance and testing on the availability of systems l that are usable in establishing ar.d maintaining a safe shutdown condition.' Put back in service any equipment that has been teniper rHy taken out l of service for maintenance or testing. .. Postpone maintenance or testing activities that would take equipment out of service. .
~
. ~I Ensure that engineered safety fearures systems are aligned for e ency
! operation, if such alignment would not increase vulnerability to a L l caused by theland vehicle bomb.
~
Confirm that FCCS subsystems are aligned for injection. . j Confirm tt a
- CIC system valves are open (BWR). .1 Confirm thw Auxiliary Feedwater System valves are open (PWR).
Maximim the short-term heat sink available for absorbing decay heat load.' -j Increase condensate storage tank water level to maximum. . Increase suppression pool water level to maximum allowed level 1 (BWR). . . 1 Reduce suppression pool temperature to the minimum allowed ? i Engeture (BWR). _ _ Increase waterlevelin the u
. pool makeup) to maximum LWR).~ (pper containment pool (for suppression .
' ' ~
l j J 5-1 _----.---_---.---...a.N.._N_.._
1 SAIC 0W)3\89 Maximize the availability of ultimate heat sink systems. Start emergency service water system pumps - Flush emergency service water system pump discharge strainers. Maximize the readiness of suppon systems. Fill diesel fuel oil day tanks and long-term diesel fuel oil storage tanks to maximum. Charge instrument and service air accumulators to maximum. Pre-position on, site emergency equipment that may be needed to suppon any conungency acnons: _g i nentinns Portable fans Switchgearrooms Bauery rooms -
' Pump rooms
' Portable 125 VDC generator - Battery rooms Portable submersible pumps Various locations TBD Notify pre-selected off-site vendors of the potential need for delivery of the following types _ of supplies and equipment:
Portable 480 VAC generator Power cables Portable air-conditioning units Flexible ventilation duct work Fire hose Diesel fuel (tank truck) Water (tank truck) Bottled high-pressure gas Contingency barriers 5.2 CHANGES TO PLANT OPERATING MODE I L For any initial plant operating state (i.e., power operation, startup, hot or cold shutdown, or refueling), actions that could be taken by the plant operators to alter the plant operating state . and thereby enhance the ability of the plant to withstand a land vehicle bomb attack should j be identified for potential use m, specific situations. Actions of this type may include: 1)- ! reduce power or shut down from normal power operation to reduce post-attack decay heat load, 2) maximize available heat sinks, 3) terminate an in-progress reactor startup,4) 3 terminate refueling activities and reestablish containment integrity (if an equipment hatch is - ! open), and 5) heat up on decay heat to the point where systems not dependent on' service ' water can be used for decay heat removal. J 5-2
- l
- - - 1
SAIC 0N)3\89 1 5.3 MEASURES FOR LIMITING VEHICLE ACCESS Methods for determining an appropriate standoff distance and survival envelope perimeter are described in Section 3. Once the survival envelopes have been determined and land avenues of approach analyzed, contingency procedures need to be developed and personnel trained in those procedures in order to compensate for perceived vulnerabilities. Specifically, procedures need to be developed which address: 1) evacuation of all but essential vehicles and personnel,2) deployment of contingency barriers, and 3) placing security force personnel and equipment on the perimeter of the survival zone to restrict vehicle traffic into and within the site. The primary means of limiting vehicle access is through the use of contingency barriers. The objective of a barrier is to channel, slow down, or stop a vehicle; Channeling he vehicle prevents it from leaving a prescribed route. Obstacles placed in the pathway can ' slow or stop the approaching vehicle, can force the driver to reveal his intentions, and can give the security force more time to react to an attempted penetration. Arrangements can be made with off-site companies and organizations for equi can be used as batriers (e.g., local cement companies, constructions firms). The type of pment which contingency barriers to be used for a particular site will depend upon the site configuration and the resources available. For example, items such as concrete pipes,55-gallon drums, and large rocks can be moved into appropriate positions, and heavy duty equipment like bulldozers may be used as a barrier or to create ditches and berms. Additionally, preplanned purchase or construction of contingency barriers may be applicable. In applying barriers it is useful to consider three zones: the approach zone, the impact zone, and the survival zone. The approach zone provides an area where vehicles can be slowed down for identification and search. It also provides an area where the driver's intent may be discerned. Ba riers can be erected alongside the road to prevent any attempt to circumvent checkpoints and roadway barriers. At the end of the approach zone a manned checkpoint is established. Those vehicles authorized to proceed are searched here before being allowed ' enry into the impact zone. The impact zone is that area between the manned checkpoint and a moveable barrier capable of stopping further penetration into the survival zone (e.g.,- bulldozer). The survival zone (Section 3.1) is' defined as an area of some radius from the wall of a structure, such that if an explosion takes place outside the zone, the structure will not be damaged. 5.4 SECTION 5 REFERENCE
- 1. Lobner, Peter, " Nuclear Power Plant Damage Control Measures and Design Changes for Sabotage Protection," NUREG/CR-2585, Science Applications ,
' International Corp., May 1982.
{
. b 5-3
SAIC 01503\89 SECTION 6 EXAMPLE APPLICATION OF THE METHODOLOGY TO THE SUNSHINE ' BWR PLANT 6.1 OVERVIEW OF EXAMPLE This section illustrates how the methodology can be applied to a BWR plant. The Sunshine BWR plant is a fictitious plant that is modeled after a typical BWR/4 plant. This section documents the process of applying the methodology to the Sunshine BWR plant. The subsections are designed to follow the preceding sections of this report. For example, Section 6.2 documents the application of Section 2, the selection of system options for safe shutdown. Section 6.3 applies to Section 3, etc. Examples of modifications to the SCP from this application are included in Appendix A. 6.2 PRINCIPLE CONTINGENCY PLANNING CONSIDERATIONS AT THE SUNSHINE BWR PLANT Sources of radioactive material at the Sunshine BWR plant include the reactor core, the spent fuel in storage in the spent fuel pool, new fuel, and the radioactive waste system. The inventory of radioactive material available in new fuel and the radioactive waste system is insufficient to cause a significant release with consequences comparable to the 10 CFR Part 100 dose guidelines (Ref.1). Therefore these sources are not significant concerns as land vehicle bomb targets. The inventory of radioacdve material in spent fuel decays after reactor shutdown and often remains a potential source of a significant release for a period of a month or more following refueling. The reactor core is the primary concern as :he source of a potential release initiated by a land vehicle bomb. The balance of this section identifies system options associated with preventing a significant release from the reactor core. 6.2.1 Front Line Systems This section defines the systems that need to be considered in contingency planning following a land vehicle bomb attack. Systems should be available to provide the following functionr: Reactivity control Reactor core cooling and heat removal from the primary system Reactorcoolant systemintegrity If these functions cannot be provided then the following additional functions may be needed: i Containmentintegrity Radioactivity control l 6-1
.,t
- - _ _ - _ . - - - - - - - - - - - - - - - - - - - - - - ^ - - - " - - ' ~ ~~
SAIC 0IV)3\89 Table 6-1 shows the particular systems used at the Sunshine BWR plant to satisfy these functions. The table assumes a transient occurs when the plant is in a " hot" condition, (i.e., power, startup, or hot shutdown). The primary system is listed along with a backup system. 6.2.2 Support Systems Each of the front-line systems identified above require supponing systems or functions, such as electric power, control, cooling, etc. Table 6-2 identifies the types of suopon functions and systems available at the Sunshine BWR plant. Table 6-3 shows the relationship between the front-line systems and the suppon systems, effectively matching each fmnt-line system with its required suppon systems. In this example, it is assumed that station batteries can suppon design loads for up to 6 hours without recharging. Systems supported by DC power only may remaia operable up to the point where the batteries arr s ,$nausted. Extended operation will require power fmm the AC system via the battery chargers, or ponable einergency generators specifically intended for supponing the DC power system. 6.2.3 Preferred System Options The following is a list of system options, ranked in order of preference. Each option assumes that the RPS operates to scram the reactor. Each option also assumes the plant will stay in ar. extended hot shutdown state. The RHR system must be added to each option to go to cold shutdown. Each option assumes that containment heat removal and radioactivity control are not required unless the systems for decay heat removal, inventory control, and pressure control fail to perform their functions. System Ootion Derriotion 1 off site power, main feedwater system, power conversion system 2 RCIC, steam relief to suppression pool 3 RCIC and RHR operating in steam condensing mode 4 HPCI, steam relief to suppression pool 5 ADS, LPCI 6 ADS, Core Spray
.]
6-2
i Table 6-1. Safety Functions and Associated Front-line Systems for the Sunshine BWR Plant. PRIMARY BACKUP SAFETY. SUB- MITIGATING. MITIGATING FUNCTION FUNCTION SYSTEM, SYSTEMS } ). Reactivity Reactor Shutdown RPS and scram Standbyliquid Control (Scram) portion of control control system
- rod system -
Reactor Core RCS Inventory Main feedwater RCIC system Cooling and Heat Contml system injecting from CST f Removal from or suppression pool the Primary System HPCI system i injecting from CST or suppression pool l RCS Pressure Safety /reliefvalves ADS Control RCS Heat Sink Main steam and power RCIC Steam (via main turbine or Condensing turbine bypass system) (short-term) Suppression pool Suppression pool plus RHR system operating in contamment cooling mode Reactor Coolant RCS Pressure Same as above Same as above System Integrity Control Containment Containment RHR system operating Drywellchillers
. Integrity Heat Removal in containment coo'dng mode Containment Same as above Same as above Pressure Control :
Containment Automatic actuation of Remote-manual Isolation isolation valves . actuation ofisolation valves - Containment Not required for Cleanup transient mitigation Radioactivity Standby gas treatment Normalventilation Control system cleanup system 6-3
.j '. I a
Table 6-2 Support Functions and Systems for the Sunshine BWR j j Plant. 1 PRIMARY-' BACKUPJ SAFETY SUB- - MITIGATING ' MITIGATING. ' FUNCTION FUNCTION SYSTEM SYSTEM ' q AC Power - Motive Power 4160/480 VAC system 4160/480 VAC system L ,
, supplied from offsite suppled from diesel'.
power (OSP) . generators , Li' Instrument and 120 VAC system' 120 VAC system , Control Power supplied via inverters - : supplied fiom 480 : from 125/250 VDC. .VAC System System DC Power 125/250 VDC systr9 125/250 VDC system supplied via battery ' . supplied from station , chargers from - batteries - 4160/480 VAC System. ; Essential Diesel Cooling Essential Service . ESW system operating Equipment Water System closed-loop with ! Cooling operating open-loop emergency cooling - tower Pump Cooling Same as above - Same as above ntRoom Same as above Same as above gi Decay Heat RHR Service RHRSW System Rig spoolpiece to ! Removal (RHR Wate: Service operting closed-loop supply via HeatExchanger operating with emergency ESW System Cooling) open-loop cooling tower System Automatic System-level manual- Component-level manual Actuation actuation actuation (i.e., actuate actuation (i.e., actuate - logic RCIC, ADS, etc.) . - individual pump or valve. remotely orlocally - Pneumatic Diesel starting Air stait accumulators . . Aircompressors to Power recharge accumulators Valve power Service air system DaAmul accumulators Instrument air Same as above i 1 6-4 \ ._ _ -= -
E ke i a i j j j e Li i l' 1 g
- j. I
! 1 f l l l 5 I g 3 5
.! A 8 8 rl d
I ! e : g j j- 1 1 83 .
),
. . . . v j3jj - - - - - - - -
.h 11- -
g a-s 3 E !}<5
- g h *
- a g '8 f h hj u u s u u n n u m x x xx x x e . -
h g a l o
-Io E
x E '.' zE lr !. i E r. , gg go x x x x gm j,3 .g. - - - - x u
$j g g ., - - - -- - x x x x x x l 5 gg - - - - - - - - - - n - -
! ex - - l 9 ag. xx x - - x - e h ${n u u n u u - u n x - t 5 p _ - rg _1 E y; , 3 j -} . p <- y se ,'j,,} ],t < < . .j -j ii a n j j
,j
!! Il !! !visis J, j i -
mm ininissi s si a . 1+1!i1 s 8 !! !<!!! 1 ntw ' i 1
.'6-5 -l
SA... ! 01W3\89 6.3 PROTECTING SYSTEM OPTIONS AT THE SUNSHINE BWR. PLANT This section examines the locations of essential equipment and the ability of structures to survive a land vehicle bomb blast. For a given structure tc> be affected there must be a direct line of sight between the explosion and a wdl of the structure, (i.e., vnere grouped fairly close together, one building is assumed to shield another building from the direct effects of the blast.). Figure 6-1 shows a simplified plot plan for site. 6.3.1 Plant Survival Zones A survival zone is defined as an area of some radius out from each wall of a structure, such that if an explosion takes place outside of the zone the structure will not be damaged. The radius of the survival zone area is also known as the safe standoff distance. Standoff distances will be calculated in Section 6.3.3, based on the blast resistance of each structure. Survival zones have been established for the following major structures'- reactor building - (RB), turbine building (TB), diesel generator building (DG), condensate storage tank (CST), and intake structure (INTK). A survival zone has not been established for the . switchyard because a large area of the plant as well as off-site areas are associated with off-site power. 6.3.2 Location of Essential Equipment For each system option identified in Section 6.2 the applicable survival zones are identified. Clearly the reactor building is importam to all stmegies because it contains the RCS and its interfaces witn core cooling systems. Therefe e. the CST zone is omitted from RCIC and HPCI options because the suppression pool c s be used as a water source. The turbine building is required in all strategies because .ne control room, emergency switchgear looms, and battery rooms are located inside. In system option 2 utilizing the RCIC system, the control room can be replaced by the remote shutdown panel inside the radwaste building. However, since the RCIC reqaires the Division A battery the turbine building is still important to option 2. Therefore, the radwaste building is omitted from option 2. Most of the equipment associated with the RCIC and ECCS, particularly the pumps, is below grade and therefore is assumed to be protected. However, some piping and power control cable runs are at grade level in tie reactor building, making these systems vulnerable to an explosion within the reactor building's survival zone. I 6-6 '
7 NORTH i a 1 8 - _. Building Building Gontros Room Diesel Genormor Turbine Building Building Moe. h Feues F 7 r.suara iound Sudichyard w J Adrriensstralen Bullomg y ~ m. Screen Structure l RIVER Figure 6-1. Simpilfled Plot Plan of Sunshine BWR Plant l l 6-7 s
~
c w. . ,g
'SAIC ON)3\89 '
The following is a list of survival zones required for each system option. Both' front-1)ne ' al.d support systems are considered.~ System Ootion a Survival hnen -
'l RB, TB, off-site power (OSP) 2 RB,TB' 3 RB, TB,' DG, INTK '
4 RB,TB 5 RB, TB, DG, INTK ' 6 RB, TB, DG, INTK a q a. 6.3.3 Blast Loading 'of Structures 'L y , a Since the Sunshine plant is located in Tornado Zone I, all structures are built, as as -. minimum to withstand a static overpressure of 3.0 psi. , NUREG/CR-2462 (Ref. 2)' provides guidance for calculating static overpressure for more sturdy s:ructures. The ' 1.j' reactor building, with 24 inch thick concrete walls and a maximum wall span of 26 feeth T has a static wall capacity of 4.5 psi. The diesel generator building, with 24 inch tid:k walls ; and a span of 19 feet, has a static wall capacity of 7.5 psi. All other structures are assurned - 1
- to be designed for the 3.0 psi tomado requirement.
The standoff distance for each structure is calculated with the following formula:' ., F W g/3 j R-F p2 s -
\ )
where R - standoff distance in feet '
\
F = ductility factor-W= TNT equivalent of explosive - 1 ps = static wall: capacity -in psi j fq Reference 2 suggests a ductility of 3 is most appropriate for this analysis. Figure 6-2 shows an example standoff distance for each structure overlaid on the simplified j plot plan. The curves were drawn assuming shielding by other buildings.- i j 1 l 6-8 1
> NORTS s
l 1
- T l
/ \ s
/\ /
Ng T , }/ ...ct.,
/ I n.d . .
Building Building 4 _. f- /
/ *....
O**' , . ,
" '"8 Turbine SulldinD h C / 'I
** ***4 l '**8 y'
88" l =l ri
/
K
"\ /
/s.n.w.rd
/
[ s K Administr.tlon Building e 7 ~ i ni .=. N. Screen Structure i RWER 1 1 4 i Figure 6-2. - Survival Zones for Sunshine Plant Structures 6-9
SAIC ON)3W9 6.3.4 Survival Envelopes Given the survival zones required for each system option, and the standoff distance for each zone, a set of envelopes has been developed which represent the overall survival zone - for each system option. Figure 6-3 shows the survival envelopes overlaid on the simplified plot plan. i 6.4 SELECTION OF PREFERRED SYSTEM OPTIONS BASED ON PLANT LAYOUT AT THE SUNSHINE BWR PLANT 6.4.1 Avenues of Approach 3 The Sunshine BWR plant site has two access roads, the main road from the north and an auxiliary access road from the south. The plant is bordered on the west by hills and on the east by the river, so the two access roads are the only credible approach paths for land vehicles. 6.4.2 Relationship of Survival Envelopes and Areas Accessible to land Vehicle Bombs Figure 6-3 shows that all of the system options share a common minimum survival envelope, with options 3,5, and 6 having a more extensive envelope. Therefore, the . contingency plan will be designed to protect the minimum survival envelope. This will ensure that a viable system option will be available to achieve a safe shutdown. The smallest survival envelopes are for system options 2 (RCIC) and 4 (HPCI). These options require protection of only the reactor and turbine buildings. Other survival envelopes also contain these buildings, so options 2 and 4 represent the minimum area for protection. From an operational standpoint, option 2 is preferred over all options except the use of normal systems that rely on off-site power. If a potential bomb attack should Leave off-site power available, then option 1 would be preferred. The survival envelopes depicted in Figure 6-3 reflect the approach of establishing survival zones based on exterior walls of buildings. In reality, most equipment is located within rooms in the interior of their respective buildings. To determine the blast effects on an interior wall it can be conservatively assumed that if the blast occurs within the standoff ; distance of the first wall the second wall will see the blast as if the first wall were not ' present. If the strength of the interior wall is such that its standoff distance is inside the standoff distance of the exterior wall (taking into account the distance between the two walls) then the survival envelopes can be drawn relative to the interior wall, resulting in smaller envelopes. 6-10 ,
i
--+ wonrn I
i 4 ALL
/ ~
[ ,
} f - N l 8 l
,/ ,
)- f au
~
\ % " n-ausre t ,
*u j switenyaro umarm \
- 3. Building
}
l _ 2,4.1 OSP 2,4,1.OS P y y ~ . aman.- m Scre.n ', mure l news, i l 1 I Figure 6-3. Survival Envelopes for Sunshine Plant 6-11
SAIC 01503\89 6.5 CONTINGENCY MEASURE TO PRESERVE THE PREFERRED SYSTEM OPTIONS AT THE SUNSHINE BWR PLANT If appropriate toMert notification the plant and security staff should increase plant readiness. Examples of measures th could be implemented are presented in this section. Using this approach, the survival envelopes for options 2 (RCIC) and 4 (HPCI) can be 1 made smaller than those shown in Figure 6-3. The RCIC and HPCI pump rooms are both below grade in the reactor building, and are assumed to be protected. The most vulnerable portion of these systems is piping that rises through pipe chases to grade level then. enters the drywell, The RCIC pipe chase is in the southeast corner of the reactor building and the HPCI pipe chase is in the southwest corner of the reactor building, as shown in Figure 6-4 Both pipe chases are enclosed by 2 foot thick concrete walls with a static wall capacity of 4.5 psi, the same as the exterior walls of the reactor building. The walls of the pipe chases i are no closer than 30 feet from an exterior wall, therefore, the portions of survival envelopes 2 and 4 that face the reactor building can be brought in 30 feet. This assumes that the interior wall sees the blast as if the exterior wall did not exist. The turbine building survival zone is relevant because the control room, switchgear rooms, and battery rooms are all inside the turbine building. All of these rooms are in a vertical row, with the switchgear and battery rooms below the contml room. These rooms are enclosed by concrete walls with a static wall capacity of 3.0 psi, the same as the exterior walls of the turbine building. The interior walls are no closer than 50 feet from an exterior wall, therefore, the portions of the survival envelopes that face the turbine building can be brought in 50 feet. 6.5.1 increase Plant Readiness Consistent with the requirements in the Sunshine plant Technical Specifications, the following measures can be taken: Minimize the impact of maintenance and testing on the availability of systems that are usable in establishing and maintaining a safe shutdown condition. Put back in service any equipment that has been temporarily taken out of service for maintenance or testing. Postpone maintenance or testing activities that would take equipment out of service. Ensure that engineered safety features systems are aligned for emergency operanon. Confirm that ECCS subsystems are aligned forinjection. j Confirm that RCIC system valves are open. ' 6-12 1
HPCI Drywell Pipe Chase Reactor I Vessel Radwaste Building RCC RHR Pipe Pipe Chase Chase m ww Steam Tunnel Turbine Building i l I I Figure 6-4. Layout of Reactor Building l at Grade Level. I 6-13
r .s g< s
. SAIC OlV)M9 :
o , ., , Maximize the short-term heat hink aVailable for absorbing decay heat load.' Increase condensate storage tank waterlevel to maximum. - L - Increase suppression pool water level to maximum allowed level. .
' Reduce suppression pool temperature to the minimum allowed.-
temperature. .
. Increase waterlevelin the u
- pool makeup) to maximum.' pper containment pool (for suppression T
*. Mavimi= the availabilityNultimate heat sink systems. , .
.- Start emergency service water system pumps ' . _ _ .
Flush emergency service water system pump discharge strainers Maximize the readiness of support systems.- .. . Fill diesel fuel oil day tanks and long-term diesel fuel oil storage - tanks to maximum.s ~ .. Charge instrument and service air accumulators to' maximum. - Pre-position on-site emergency equipment. Igna' Locations Portable fans -Switchgear rooms Battery rooms LPump moms Portable 125 VDC generator Battety rooms ' Portable submersib e pumps (TBD)f a Notify pre-selected off-site vendors of the potential need for delivery of the following supplies and equipment: Itun Vendor hhonc.
^
- Portable 480 VAC generator (TBD) (TBD) -
Powercables (TBD); - (TBD) . Portable air-conditioning units (TBD) (TBD) L Flexible ventilation ductwork - (TBD) ' (TBD) . Fire hose (TBD):: (TBD) Dieselfuel(tank truck) (TBD) ~( TBD) , Water (tank truck) (TBD) - ' (TBD)'- ! Bottled high- nessure gas - (TBD) (TBD), Contingency )arriers (TED) ; - (TBD) a q t l
.l 1
}
,l
'l 1
3 6 o
SAIC 01'03\89 6.5.2 Changes to Plant Operating Mode If appropriate to the alert notification, the operators will place the plant in a safe shutdown condition. This involves the following, bawd on initial operating mode: If plant is at power, shutdown and initiate decay heat removal. If m startup, terminate and rerum to shutdown state. Ifin refueling, terminate refueling activities and reestablish RCS and contamment integrity. 6.5.3 Measures for Limiting Vehicle Access The main areas of concern are the regions south and west of the reactor building, and north and southeast of the turbine building,in which all survival enveloxs overlap. To reduce the amount of traffic entering the site, the south gate will be closed and locked and a temporary barrier to traffic will be placed outside the gate. All traffic will be required to use the north gate, and a temponry barrier designed to slow the speed of vehicles approaching the gate will be set up 50 feet outside the gate. The barriers will be created from 55 gallon drums filled with sand. Armed security personrel will be posted at both barriers. All traffic entering the plant will be searched for explosives. 6.7 SECTION 6 REFERENCES
- 1. 10 CFR Part 100.
- 2. Kennedy, R.P., Blejwas, T.E., and Bennett, D.E., " Capacity of Nuclear Power Plant Structures to Resist Blast I.oadings," NUREG/CR-2462, Sandia National Laboratories, September 1983.
i 6-15
o
~ SAIC ON)3\89 ~
SECTION 7 EXAMPLE APPLICATION OF THE METHODOLOGY.TO .THE - MOONGLOW PWR PLANT 7.1- OVERVIEW OF EXAMPLE This section illustrates how the methodology can be applied to a PWR plant. The Moonglow PWR plant is a fictitious plant that is modeled after a typical Wesunghouse 4-loop,2-unit plant._ This section documents the process of applying the methodology to'the Moonglow PWR plant. The subsections are designed to follow the preceding sections of this report. For example, Section 7.2 documents the application of Section 2, the selection of system options for safe shutdown.' Section 7.3 applies to Section 3, etc. 7.2 PRINCIPLE CONTINGENCY PLANNING CONSIDERATIONS AT-- THE MOONGLOW PWR PLANT Sources of radioactive material at the Moonglow PWR plant include the reactor core, the spent fuel in storage in the spent fuel pool, new fuel, and the radioactive waste system. The inventory of radioactive material avadable in new fuel and the radioactive waste system is - insufficient to cause a significant release with consequences co nparable to the 10 CFR Part 100 dose guidelines (Ref.1). Therefore these soumes are not significant concerns as land vehicle bomb targets. The inventory of radioactive material in spent fuel decays after reactor shutdown and often remains a potential source of a sigr.ificant release for a period of a l month or more following refueling. The reactor core is the prunary concem as the souwe of. j a potential release initiated by a land vehicle bomb. The balance of this section identifies system options associated with preventing a significant release from the reactor core.
)
7.2.1 Front-Line Systems I This section defm' es the systems that must be considered in contingency planning for a land i vehicle bomb alert. A Vital Area Analysis has been performed for Moonglow I and 2. The VAA fault tree identifies the following systems that are required for transient mitigation: Reactor Protection System for initiating a reactor scram Main steam and power conversion system or auxiliary feedwater system and ; secondary steam relief system for decay heat removal
- l Charging system for RCS makeup and reactor coolant pump seal cooling f -
Pressurizer heaters for RCS pressure control I - Instrumentation systems to support the information needs of the control j room operators. .; 1 7-1 i E ,i I
+, .
SAIC 0N)3\89 '
' These systems, along with their support systems, novide the capability to maintain each unit ;
. in an extended hot shutdown condition. The fol. owing brief descriptions of these systems -
focusing on the requirements for successful operation as identified in the VAA are provided.' " } l The main steam and power conversion system, following reactor shutdown,' transfers heat to : the ultimate heat sink via' the condenser and the circulating water systemt The system ( ;. requires off-site powerin order to' operate. The Auxiliary Feedwater (AFW) System consists of two rnotor-driven pumps, designated AL and B, and one turbine-driven pump, designated C. ' Any one pump can provide a sufficient . flow of makeup water to at least two of four steam generator to provide adeq uate decay heat a transfer to the atmosphere via the secoreigy steam relief system . Motor-driven pump A is . ' powered by AC train A.EMotor-driven pump B is powered by AC train B. Turbme-driven pump C is powered by steam from steam lines B and C, but requires DC power from DC _ train A to open and control the turbine control valves. Water sources for the ~AFW pumps are either the condensate storage tank (CST) or the Essential Service Water (ESW) system. Pump cooling is provided locally. Pump room cooling'can be accomplished by propping - open the doors,if necessary.
~
The charging system, part of the Chemical and Volume Control System (CVCS), consists of '
.two centrifugal charging pumps, designated A and B, and one positive displacement'-
charging pump, designated C. Any one pump can provide sufficient RCS makeup andx reactor coolant seal cooling. Pump A is powered by AC train A, pump B is powered by AC train B, and pump C is powered by non-lE bus X. Centrifugal charging pump cooling is : required and is provided by the ESW system, which also provides pump. room cooling. Water sources for the charging pumps are the two boric acid tanks or the refueling water -
~
storage tank (RWST). Pressurizer heaters are powered by non-1E AC power. They can be bonnected to Class IE ' , 480 volt AC buses A and B during emergencies. One bank of pressurizer heaters, powered-by either bus A or B, can provide sufficient RCS pressure control. ' There are two trains of 120 volt AC instrumentation power, designated A'and B.' Train A is - i required when "A" components are used, train B is required when "B" components are used. Each 120 volt AC bus can be powered by either the 480 volt AC bus or the 125 volt DC bus of the same train. ' j 7.2.2 Support Systems 1 The above front-line system descriptions refer to various required supporting systems or j functions, namely AC power, DC power, and ESW. The following brief descriptions of i these systems focusing on the requirements for successful operation as identified in the VAA - are provided. AC power can be provided by off-site power, or by two diesel' generators, A and B. The . diesel generators require fuel, cooling, lubrication, ventilation, high pressure air for starting, and DC power for' starting and control.' Seven day fuel supplies are store <1 in underground tanks and are therefore considered protected from land vehicle bombs. -~ Diesel cooling is 7-2 4 j! l y g >;
1 1 SAIC 0IV)3\89 / 1 provided by the respective train of the ESW system. Lubrication is provided by a dedicated ii system for each diesd. Ventilation is provided by ductwork to the roof of the diesel wing of ' '! the auxilia.:y building. Stat:ing air is provided by a storage accumulator for each diesel. { i DC power is provided by batteries. The batteries have a rated capacity of two hours with . full loads, but with load sheddmg their capacity can be extended to approximately four hours for support of AFW and instrumentation. If the event lasts more than four hours the ll i batteries will seguire recharging, normally from the respective AC train through a battery charger. ! The ESW system consists of two independent trains, A and B, each with one pum?. A cross-tie is provided between the two trains. The ESW system operates in a closed Loop, taking suction from and discharging to the cooling tower basin. Each train can cool all of the heat loads of the same train. In this analysis the heat loads ofinterest arr the charging pumps and room coolers and the diesel generators.' The ESW system also cools the containment fan coolers,if necessary. Either ESW train can also provide water to the^ suction of the AFW pumps. ESW pumps A and B are powered by AC trains A and B, ! respectively. ! 7.2.3 Preferred. System Options . A set of ten system options, applicable to each unit,is shown in Table 7-1. These options are listed in order of operational preference. For example, it is undesirable to inject raw water from the ESW system into the steam generators, so the CST is the preferred water source for the AFW system. It should be noted, however, that options utilizing the diesel g generators require the ESW system for diesel cooling, so the ESW system will also be available as an AFW water source. Certain assumptions have gone into Table 7-1. First, since all AFW pumps are in the same ! area of the auxiliary building, for the purposes of this analysis no effort has been made to ' differentiate between the pumps. The same is true for the charging pumps, except that as l long as off-site power is available the positive displacement pump is preferred because it l does not require ESW cooling. Also, it is expected tht pumps of the same electrical load j group (e.g., AFW A, charging A, ESW A) will be utilized together. j i I 7-3 e
0 X X X X X X X 1 - t 9 X X X X X X X n l a P X X X X X X X 8 R W P X X X X X X X 7 w l o g X n 6 X X X X X X o o M X X X 5 X X X X e - ht t a 4 X X X X X X n w o 3 X X X X X X d t u h S 2 X X X X X e f a i S X X r 1 X X X f o s M ' n E o T G M i t S N S E p Y T S I G R O M M R O S E N E T Y m T O T A A S e S I S S Y H R R t s M Y R C E E y E S E S R N T S T N V R O E A S E
. Y O N T F G G W 1 S I
T O A S N L E C C M K I E C 7 E R W E N G S I e T D T A R R E V E E S A I R l b O T E D a R W E W W Y S E H W E S P O F F F C Y T P Y A A D O C
~
L R G I C R P N
& R R R N O A O A O I A F E E I T
T M I L O F G C T G N C A I F R I T I S R E A E X T W A R S F E S E T U S S H O W F M S R S A C E C B R O E E Y" I
SAIC 0IV)3\89 ' 7.3 PROTECTING SYSTEM OPTIONS AT THE MOONGLOW PWR PLANT This section examines the locations of essential equipment and the ability of structures to survive a land vehicle bomb blast. For a given structure to be affected there must be a direct line of sight between the explosion and a wr.Il of the stmeture, (i.e., one building is assumed to shield another building from the effects of the blast.). Figure 7-1 shows a simplified plot l plan for site. 7.3.1 Plant Survival Zones A survival zone is defined as an area of some radius out from each wall of a structure, such that if an explosion takes place outside of the zone the structum will not be damaged. The radius of the survival zone area is also known as the safe standoff distance. Standoff distances will be calculated in Section 7.3.3, based on the blast resistance of each stmeture. Survival zones have been established for the following areas: Unit I reactor containment (RC1) Unit I diesel generator area, containing the diesel generators and switchgear,
- in the southwest comer of the auriliary building (DG1)
Unit 1 CVCS area, containing the charging pumps and boric acid tanks, in the northwest corner of the auxiliary building (CVCSI) Unit I refueling water storage tank (RWSTI) Unit I condensate storage tank (CSTI) Unit I turbine building, containing the steam and power conversion system (TB1) Unit 2 reactorcontainment(RC7) Unit 2 diesel generator area, containing the diesel generators and switchgear, in the southeast corner of the auxiliary building (DG2) Unit 2 CVCS area, containing the charging the northeast corner of the auxiliary CVCS2) building (pumps and boric acid tanks, in Unit 2 refueling water storage tank (RWST2) Unit 2 condensate storage tank (CST 2) Unit 2 turbine building, containing the steam and power conversion system (TB2) Common ESW pumphouse (ESW). Survival zones have not been established for the control room and the AFW pump areas because they are far enough removed from exterior walls to be considered protected from land vehicle bombs. A survival zone has not been established for the switchyard because a large area of the plant as well as off-site areas are associated with off-site power. ; i 7-5
; ~ ~
M TH-2: M2 3: Cookg Tower Unt i l
Coolm0 Tamer 2: ESW Purmhouse
;r JC J:
5: M g Ovc8 cvce yng g - Unt2
' Refus6ng Waner Une 1 W3 W% Wome FW Fuel Storage Tar
- 1:
Sieraso tann Bios. wg O & W 8% A BidO-Unt 2 Q. > Conosmale unt 1 Storage Tate b O ***' = ***' . . a a
= O 1r wi
* "'ee a unn 2 T=e n DG DG Candonomie m
l I- n r Comew
,; Anom -
c gI s wa,e
,, I I"
' J Turbmo Building
,c Tu B s= l l
, B=0 n a
1L i: Warehouse i<
- i. - . .. . .
~
memn BidO- j I l Figure 7-1. Simplified Plot Plan of Moonglow PWR Plant 7-6 l 1 . _ _ _ _____m. _ _ _ _ _ - . _
SAIC ON)3\89 7.3.2 Location of Essential Equipment i For each system option identified in Section 7.2 the applicable survival zones are identified.- Clearly the reactor containment is imponant to all strategies because it contains the RCS and its interfaces with core cooling systems. Also, the diesel generator area is required in all . strategies, including off-site power strategies, because it contains the class 1E switchgear. The following is a list of survival zones required for each system option for Unit 1. A similar list can be compiled for Unit 2. System Ootion Survival 7431c1 1 RC1, TB1, CVCSI, DG1, OSP (off-site power) l 2 RCI, TB1, CVCSI, RWST1, DG1, OSP 3 RCl, CST 1, CVCSI, DGI, OSP l 4 RCl, CST 1, CVCSI, RWST1, DGl OSP 5 RC1, ESW, CVCSI, DGI, OSP 6 RC1, ESW, CVCS1, RWST1, DG1, OSP - 7 RCl, CST 1, CVCSI, DGI, ESW 8 RCl, CST 1, CVCSI, RWST1, DGI, ESW 9 RC1, ESW, CVCSI, DG1 10 RC1, ESW, CVCSI, RWSTI, DG1 7.3.3 Blast Loading of Structures Since the Moonglow plant is located in Tornado Zone I, all structures are built, as a minimum to withstand a static overpressure of 3.0 psi. NUREG/CR-2462 (Ref. 2) provides guidance for calculating static overpressure for more sturdy structures. The auxiliary building and ESW pumphouse, with 24-inch thick concrete walls and a maximum wall span of 26 feet, each have a static wall capacity of 4.5 psi. The reactor containment, with 48-inch thick walls, has a static wall capacity of 12.0 psi. All cther structures are assumed to be designed for the 3.0 psi tomado requirement. i 7-7
SAIC ON13\89 The standoff distance for each structure is calculated with the following formula: R=r / W W3 2 P s
% )
where R= standoff distance in feet F = ductility factor W" TNT equivalent of explosive in Ibs ps = static wall capacity in psi Reference 2 suggests a ductility of 3 is most appropriate for this analysis. Figure 7-2 shows the standoff distance for each structure overlaid on the simplified plot plan. The curves were drawn assuming shielding by other buildings.' 7.3.4 Survival Envelopes Given the survival zones required for each system option, and the standoff distance for each zone, a set of envelopes has been developed which represent the overall survival zone for each system option. Figure 7-3 shows the survival envelopes overlaid on the simplified plot plan. 7.4 SELECTION OF PREFERRED SYSTEM OPTIONS BASED ON PLANT LAYOUT AT THE MOONGLOW PWR PLANT ' 7.4.1 Avenues of Approach The Moonglow PWR plant site has one access road, entering the plant from 'the south. The plant is surrounded by generally flat terrain, so off-road approach may be credible. The nearest navigable waterway is the Moonglow River, approximately one-half mile away to the north. 1 7-8 s
')
j 5)
- I
.l 1 "
u
, ". - gdORTH - i a
_Tauer s
. !i Unt1-l' I c og Tauer. ,
Pu ouse - ,, ! 7 ie N 'I k'
,: / At .Nf- if -/ T- '
1;
/ I-h 1
[ f I it - CV(81 y il 3; p y g .m CVCBP P'
- i. 7- Ame - Ases % 3:
'.i 3
- une t uer S .'.'
Fuad Bide. Fuel \ Dids-3' / & W-O Unn t
,RWST i: I ung g Tl t Unt t IN. URE 2
'TI2 'l CST f 1 A""' .
' ' ""- '~ ***' * =
A Oi , - #w
- m. -=
ARw-
>O uai r -
, . CST. T m- Amt Asse g T1 l *
- n it -
r , Como u
- n ,n - n-j '{
s
\ 8""*r*' - -
g N
/]:"
. Tu-. .. '
g Tu . . g / i I t a
.)
u w. .. n
'4__ --
?l,_ .
-_._.- j
- )
a Sieg. ! l l 1 Figure 7-2. Survival Zones for Moonglow Plant Structures. 'i 1 t .,
-79 l
1 l
popyg 6.8.7.8.0.10 s , M2 s l l Cadmg Tamer
.\
Unit l' 0 eng 1.2.3.4 T 6.6,7.8.9.10 i 6.8.7.8.9. 4.6.8.10 at i / /' \ % i: g 2.4.8.8.10 _ g,g,p 3*I '
= ue 1,6.0 -
1: 1 Aree Ane I : WI MI
- Unn i RWST Fuad FuW
\ i.'
Unn i O AUna 1 p% ,A W2 O m2 2.6.10 h h ; 2.6.10 m CST ( ,, t " Copa.
\ O- = =
Cont. Ow2 / 6.9 a w
,, ue CST lors DG *** **" 00 T
g,g ic
'k it
, Cente 1.2-i ir
\r 8.10 Roont-8, 0 /
l' Swneyans W1 Tuttme Bulleng *2
]n t ; y g 3.4,7.8 p i, s.4.7.s # n i _ _
a
- e iK 1: NM ]L ic t. 1
- 1
,_- s - - - - >
1,2 1.2 86d0-1 Nose: Envelopes 1 thmuch 6 also requwe o, Wee power. Figum 7-3. Survival Envelopes for Moonglow Plant 7-10
SAIC 01V)3N89 7.4.2 Relationship of Survival Envelopes and Areas Accessible to land Vehicle Bombs Figure 7-3 shows the survival envelopes for each system option. The' envelopes were developed by combining all survival zones in a particular system option. Figure 7-3 shows the survival envelopes overlaid on the site plot plan. The survival envelopes for options 1 through 6 also include areas associated with off-site power. Therefore, these opuons may be accessible to land vehicle bombs. Of the'other options, which utilize the emergency diesel generators, the envelopes for options 7,8, and 10 extend slightly outside the security fence in the area north of the trailers. However, this area can only be accessed by off-road vehicles. Due to the potential difficulty in protecting off-site power, system options 7 through 10 are - preferred over options 1 through 6. From an operational standpoint, using the CA" as an AFW water source is preferred to using the ESW system, therefore options 7 and 8 are - preferred over options 9 and 10. Option 7 is preferred over option 8 because the boric acid tanks are preferred over the RWST as a water source for the charging pumps. It should be noted that option 9 involves the survival envelope with the smallest area. 7.5 CONTINGENCY MEASURES TO PRESERVE THE PREFERRED SYSTEM OPTIONS AT THE MOONGLOW PWRPLANT 1 If appropriate to the alert notification the plant and security staff should increase plant readiness. Examples of measures that could be implemented are presented in this section. 7.5.1 Increase Plant Readiness Consistent with the requirements in the Moonglow Plant Technical Specifications, the following e:asures will be taken: Muumize the impact of maintenance and testing on the availability of systems that are usable in establishing and maintaining a safe shutdown condition. Put back in service any equipment that has been temporarily taken out of service for maintenance or testing. Postpone maintenance or testing activities that would take equipment out of service. Ensure that engineered safety features systems are aligned for emergency I operation. Confirm that ECCS subsystems are aligned forinjecron. Isolate non-emergency portions of the CVCS. l i . Increase CST, RWST, and boric acid tank levels to maximum. l 7-11 ! i 4 ____________J
SAIC OlV)M9 Maximize the availability of ultimate heat sink systems. Stan emergency service water system pumps Flush emergency service water system pump discharge strainers. Maximize the readiness of suppon systems. Fill diesel fuel oil day tanks and long-term diesel fuel oil storage tanks to maximum. Charge instrument and service air accumulators to maximum. Pre-position on-site emergency equipment.- 12m Locations Portable fans Switchgear rooms Battery rooms Pump rooms Portable 125 VDC generator Battery rooms Portable submersible pumps (TBD) Notify pre-selected off-site vendors of the potential need for delivery of the following supplies and equipment: IMm yfggigt Phone Portable 480 VAC generator (TBD) (TBD) Power cables (TBD). . (TBD) Portable air-conditioning units (TBD) (TBD) Flexible ventilation ductwork (TBD) (TBD) Fire hose (TBD) (TBD) Desel fuel (tank tmck) (TBD) (TBD) W' er (tank truck) (TBD) (TBD) Bottled high-pressure gas (TBD) (TBD) l Contingency barriers (TBD) (TBD) 1 7.5.2 Changes to Plant Operating Mode If appropriate to the alert notification, the operators will place the plant in a safe shutdown i condition. This involves the following, based on initial operating mode: If plant is at power, shutdown and initiate decay heat removal. If m startup, terminate and return to shutdown state. Ifin refuehng, terminate refueling activities and reestablish RCS and contammentintegrity.
,. a
(
SAICOIND3\89 ). I 7.5.3 Measures for Limiting Vehi& Access For the preferred system options 7 through 10, the survival envelopes are almost entirely within the security fence. It will be necessary to prohibit access to the off-road area north of the trailers on the east side of the site. Also, a temporary barrier will be set up near the main gate in order to reduce the speed of traffic entering the site. All traffic entering the plant will be searched for explosives. Within the fence the main areas of concern are north of the turbine buildings. Temporary . barriers will be set up to limit vehicle access into these areas. I i 7.6 SECTION 7 REFERENCES
- 1. 10 CFR Pan 100.
- 2. Kennedy, R.P., Blejwas, T.E., and Bennett, D.E., " Capacity of Nuclear Power Plant Structures to Resist Blast Loadings," NUREG/CR-2462, Sandia National Laboratories, September 1983.
7-13
, SAIC ON)M9 APPENDIX A SAMPLE MODIFICATIONS TO A - SAFEGUARDS CONTINGENCY PLAN TABLE OF CONTENTS Paragranh M bgg A.1 Purpose A-2 A.2 Background and Scope A-2 A.3 Responsibility Matrices A-2 ' l A.4 Implementing Procedures A'-5 A.4.1 Event 9: Fire, Explosion, and Other Catastrophe ' A-5 A.4.2 Event 14: Land Vehicle Bomb Alert A-10 l Tables A-1 Responsibility Matrix for Event 9: Fire Explosion, or other Catastrophe A-3 A-2 Responsibility Matrix for Event 14: Land Vehicle Bomb Alen A-4 A-1
SAIC ON)3\89 APPENDIX A SAMPLE MODIFICATIONS TO A l SAFEGUAR.DS CONTINGENCY. PLAN A.1 PURPOSE The purpose of this appendix is to provide the reader with examples of modifications to a hypothetical Safeguards Contingency Plan (SCP) that would be appropriate for addressing a land vehicle bomb, should such a threat arise. A.2 BACKGROUND AND SCOPE Operators of nuclear power plants are req uired by 10 CFR Pan 73, Appendix C, to develop safeguards contingency plans which deal with the perceived danger to licensee personnel and property from radiological sabotage and oven attacks. Events 1 through 13 listed below are typically found in existing SCPs. Event 14 could be added to cope with a land vehicle bomb alert and Event 9 can be modified to cope with the detonation of a land vehicle bomb.
- 1. Loss or Degradation of Physical Security Systems Hostage Situation.
- 2. Loss of Security Coraputer Power.
- 3. Loss or Degradation of Communication Systems.
- 4. Loss or Degradation of Security Force.
- 5. Threat Against the Station.
- 6. Discovery ofIntruders or Attack.
- 7. Internal Disturbance.
- 8. Hostage Situation.
- 9. Fire, Explosion or Other Catastrophe.
- 10. Discovery of Sabotage Devices or Evidence of Sabotage.
I 1. Civil Disturbance.
- 12. Security Alen.
- 13. Tam xr Alarm Annunciation.
- 14. Lanc Vehicle Bomb Alert.
An SCP identifies the actions of a station's security force members, emergency, and managerial personnel. Also identified, is the assistance to be provided by the Local Law Enforcement Agencies (LLEA), the State Police, and Federal Agencies. The sequential actions of an SCP event may contain branch points to ducct execution of actions outlined in other procedures (e.g., the procedure for another SCP event or a procedure from the. ' emergency plan). This appendix contains example responsibility matrices and the implementing procedures ) for Events 9 and 14. J A.3 RESPONSIBILITY MATRICES The responsibility matrices for Event 9 and Event 14 are contained in Table A-1 and A-2, respectively. These matrices tie together the functions being perfonned by the plant operational elements that could be directly involved in a land vehicle bomb alen. A-2
SAIC 014329 i Table A-1. Responsibility Matnx for Event 9: Fire Explosion, or Other Catastrophe. I INDICATIONS PERSON
SUMMARY
OF ACTIONS ' RESPONSIBLE j Fir e, explosion, or other 1 CASSAS Notny Shift Supervisor (SS) and Snitt Lieutenant (SL). j catastrophe. CAS/SAS I notified by observer. 2 SNft Deutenant Dispatcfi Secunty Force Personnel (SFP) to scene. 3 SFP Determine location and make preliminary damage assessmant report to SL. , 4 Shift Lieutenant Inform SS of location and preliminary assessnvant of damage. 5 s Classify event and notify NRC and other appropiate egences. l Implement assembly and acmuntability. Evacuate if appropriate. 6 Shift usutenant if directed by SS. Inicate site evacuation procedures. 7 5 Direct impleme,ntation of Event to (Security Alert) or Event 12 (Evidence of Sabotage) as appropriate. 8 Shift Usutenant implement Event 10 (Security Alert) or Event 12 (Evidence of Sabotage), as directed by SS. 9 CASSAS Assist SS with nonficatons as directed.
]'
10 SS* Open TSC and EOF, as appropriate. Consult With the Shift Technical Advisor l (STA) for engineenng decisions and mitiganon strateges. 11 Shift Lieutenant Direct SFP to establish traffic control points. l 12 SFP Estabhsh traffic contr9 < oints. 13 5 Direct implementtoon of emergency pro dures, as appropriate. j 14 Shift Lieutenant implement emergency procedures as directed by SS. 15 5 Obtain off-site emerDency vehicle support. 16 Shift Ueutenant h possible, direct SFP to deploy to protect vital aress. 17 SFP Deploy to protect vital areas. 18 Shift Ueutenant Direct SFP to estabish off-site assembly point. Recall off duty SFPs. 19 SFP Establisn off-site assembly point as directed by SS. 20 Shift Ueutenant Direct SFP to restrict plant & mess to emerDency vehicles and expedite them. 21 SFP Expedite entry of emergency vehicles and stop all other incoming traffic. Keep one lane open ony for emergency vehicles. 22 CASEAS Assist Shift Lieutenant with personnel accountability. 23 Shift Ueutenant Keep SS informed on acmuntability status. EVENT TERMINATED l 24 5 Enter recovery phase. Notfy NRC of resolution of event. Inform Shift Ueutenant of status. 2S Shift Lieutenant File security incident report.
*SS may assume position of Ernergency Coordinator and sorne responsibilities may shift to the TSC or EOF, IAW emergency plans.
A-3
SAIC 01103'.89 i Table A 2. Responsibility Matrix for Event 14: Land Vehde Bomb Threat. j INDICATIONS PERSON
SUMMARY
OF ACTIONS RESPONSIBLE i information received 1 CASSAS Notify Shift Supervisor (SS) and Shift Usutenant or evidence noted of bomb threat. CAS/SAS 2 S Evaluate threat and consult with Shift boutenant regarding threat credibilty. j notified by observer. Classify event and notify NRC and other appropnate agences. j THREAT IS CREDIBLE 3 Shift Deutenant Notify LLEA, FBI, and EOD as drected by Sp. 4 S Place plant in safe mode. 5 Shift Lieutenant Contact offsite companies for continency barrer material. Direct SFP to deploy contingency barriers and protect survival zones 6 S Implement essembly and eccountabilty, as newssary. 7 SFP Set up deck polo, establish barriers, and stop and search a:I incoming vehicles. j 8 S Evacuate et out essential personnel. > 0 Shift Lieutenant initiate personnel accountability and other ernergency procedures as directed by SS. Direct SFP to deploy to protect the PA and vital areas. ' 10 SFP Deploy and increase patrol of PA and vital areas. 11 Shift Ueutenant Direct SFP to establish off-s.te assembly point. I l 12 SFP Establish offsite assembly point and traffic control as directed by Shift Ueutenant. 13 Shitt Ueutenant Recall off duty SFP, 14 S Obtain offsite emergency support. l 15 Shift Ueutenant Direct SFP to restrict entry to plant to emergency vehicles and expedite their entry. 16 SFP Expedito entry of emergency vehides and stop all other incoming traffic. Keep one lane open only for emergency vehicles. 17 Shift Ueutenant Establish personnel accountability. 18 CASSAS Assist Shift Ueutenant with personnel accountability. 19 Shift Ueutenant Keep SS informed of amountability progress. Executo Event 9 It devim is detonated. 20 SFP Assist fire, medical, LLEA, and EOD units as they respond. Expedito and esmrt entry of emergency vehicles and stop all other incoming traffic. 21 S Er.ter recovery phase. ' j i 22 Shift Ueutenant File security incident report.
*SS may assume position of Emergency Coordinator and some responsibiltnes may shift to the TSC or EOF IAW emergency plans. ;
I A-4
] - SAIC ON)3\89.: ,
j D t A.4' IMPLEMENTING PROCEDURES . l ' The implementing procedures for Event 9 and Event 14 follow as paragraphs A.4.1 and A.4.2, respectively, for the hypothetical Sunshine Nuclear Generating Station (SNGS). l l A.4.1 . Event 9: Fire, Explosion, or Other Catastrophe. I. PURPOSE This procedure is designed to provide an orderly, effective means of coping with potential i and actual threats to the plant that may occur as a result of fire, explosion, or other condition that may necessitate site evacuation. II. DISCUSSION This procedure applies to all SNGS Personnel. A fire, explosion, or other catastrophic event may threaten public safety and plant integrity. Therefore, to prevent or minimize adverse consequences, timely and proper implementation is critical. A. Preparation The SNGS Safeguards Contingency Plan and Emergency Plan includes provisions to respond to catastrophic events on a timely, effective, and organized manner. .The plans l identify on-site and off-site response resources, establish clear cut levels of authority, and J define the decisions and actions necessary to achieve the following objectives.
- 1. Assess the event for reactor plant and security implications. J
- 2. Implement procedures to place the plant in a safe mode of operation.
- 3. Implement procedures to minimize security vulnerability.
- 4. Notify off-site agencies in accordance with the SNGS Emergency Plan. l S. Assemble and account for all station personnel. !
- 6. Evacuate non-essential personnel, if deemed appropriate.
- 7. Resolve the situation and implement recovery procedures.
j B. Evacuation When it is determined that lives or health of plant personnel are threatened, evacuation may be necessary. The objectives of a successful evacuation are to:
- 1. Assemble and account for all station personnel.
- 2. Conduct safe and timely removal of non-essential station personnel.
- 3. Maintain station security.
C. Command and Control The SNGS Emergency Operations Facility (EOF) is designated as the control centers for response activities under this procedure. The Shift Supervisor (SS), or the Emergency Coordinator (EC) if an emergency is declared in accordance with the SNGS Emergency A-5
SAIC OD03\89 Plan, is responsible for implementation of this procedure and overan coordination of SNGS activities during this event. Reports to or rec:uests for assistance from local, State and Federal agencies shall be directed and controlled by the SS/EC. The SS/EC shall determine the level of off-site assistance necessary from off-site agencies (Federal, State and local) an implement requests for assistance in accordance with existing Letters of Agreements, SNGS Emergency Plan and governmental guidelines. l III. REFERENCES A. Sunshine Nuclear Generating Station Security Plan. B. Sunshine Nuclear Generating Station Safeguards Contingency Plan. C. Sunshine Nuclear Generating Station Emergency Plan and Procedures. D. 10 CFR Part 73.55; 10 CFR Part 73; Appendix C. IV. EVENT DEFINITION A fire, explosion or other catastrophe is a disruptive, destructive emergency which may have been accidental or intentionally caused to divert attention and response resources in order to gain access to protected and vital Areas to commit sabotage. Effective response must therefore include provisions to ensure that the capability to identify and respond to concurrent contingency events is maintained. V. RESPONSIBILITIES A. Station Personnel are responsible for immediate and complete reporting of all relevant information regarding a fire, explosion, or other catastrophe to the Shift Supervisor (normally accomplished through the CAS/SAS) B. Shift Suoervisor (SS) is responsible for operating the plant in a safe and secure manner. He/she shall take overall charge of station acuvities under this procedure. He\she shall assume the position of Emergency Coordinator (EC) if an event is declared LAW the SNGS Emergency Plan and carry out all duties and responsibilities as defined in the SNGS Emergency Plan and Implementing procedures until formally relieved by authorized emergency response personnel. C. Shift Lieutenant (SLt under the direction of the SS/EC, is responsible for coordination of the security operations, including armed response (as appropriate), conducting orderly assemble and accountability pmcedures, conducting safe evacuation of a station personnel to designated evacuation sites, maintaining station integrity and implementing any directives required by the SS/EC. A4
SAIC 01\03\a9 D. Central and Secondarv Alarm Stations (CAS/SAS), under the direction of the secudty Shift Lieutenant, are responsible for directing initial security response, controlling plant access, and assisting in stanon accountability, assembly and evacuation effons. l E. Ooerations Personnel, under the direction of the SS, are responsible for implementing reactor plant procedures and actions to ent.ue a safe and stable reactor plant mode of operation. F. Security Forte Personnel (SFP). under the direction of the SL, are responsible for controlling access during emergencies, assisting off-site response personnel, maintaining station integrity, assisting with site evacuation and implementmg directives of the SL. VI. PROCEDURES A. Shift Lieutenant 1. Dispatch SFP to location and make a preliminary damage assessment being particularly alert for evidence of intruders, sabotage, or other unusual or suspicious conditions. Receive situation repons. 2. Notify and consult with the SS to evaluate the situation, extent of damage, areas affected, potential for concurrent threat to plant safety / security, and necessity for evacuation.
- 3. If the event may be or is known to be security-related, or has created a security vulnerability, direct execution of Event 10 (Evidence of Sabotage) or Event 12 (Security Alert), as ap propriate.
- 4. If directed, notify LLEA, State Po). ice, and Federal agencies in accordance with SNGS Letters of Agreement and govemmental guidelines.
- 5. If directed, order and facilitate evacuation of non-essential personnel and those in areas threatened or affected by the event. Account for all personnel in accordance with Emergency Plan Procedure EOP-3, Personnel Accountability, and EOP-4 Site Evacuation.
- 6. Direct the establishment of traffic control points in parking lots and access roads, the stopping of all incoming traffic except emergency response vehicles, and that one larie of the access road be kept open to expedite emergency vehicles.
- 7. Direct that access to the station be permitted only to off-site assistance personnel, and that the entry of off-site emergency response personnel be facilitated and escorted to the designated area.
- 8. Call in additional SFP for traffic contml and apply compensatory measures to maintain an adequate level of plant security.
- 10. When the event is detennised to be resolved, no continuing security threat exists, and the SS/EC has entered the recovery phase.
- a. Insure all non-essential off-site assistance personnel have left the station pmtected zones.
- b. If directed by SS/EC insure agencies contacted are appraised of the event situation / resolution.
- c. Insure orderly transition to normal security operations.
- d. File Security Incident / Violation Repons, as necessary.
l A-7
SAIC OlV)3\89 B. Shift Supervisor
- 1. Receive all available information regarding the event, consult with Operations personnel and the SL to assess extent of damage, areas affected, and >otential threat to plant safety.
- 2. Imp ement EOP-1, Event Classification and Notification Procedures in accordance with the SNGS Emergency Plan / Contingency Event Reporting Procedure. Provide frequent updates.
- 3. Direct Operations personnel to place the reactor plant in safe and stable mode of o)eration. Implement other actions to provide maximum safety and relia sility of reactor plants systems and components, as appropriate.
- a. Secure maintenance, repair, or testing activities and return systems / components to operational status.
- b. Verify Engineered Safety Features are operadonal and pmperly aligned.
- c. Insure adequate water supplies for decay heat removal.
- d. Maximize readiness of station support systems.
- c. As allowed by 3rocedures and technical specifications, insure maximum relia 3ility and flexibility of reactor plant and support systems, e.g., system cmss connections operational, spool pieces installed, power supplies in most reliable alignment.
- f. Pre-position emergency personnel and equipment.
- g. Notify pre-selected vendors of potential need for supplies and equipment.
- 4. If appropriate, direct Operations personnel to assist SFP investigating the cause of a fire or explosion, and to determine whether it may have been security-related.
- 5. If necessary, direct the SL to evacuate non-essential personnel and those in areas threatened or affected by the event, in accordance with Emergency Procesures EOP-3 and EOP-4.
- 6. If the event is reported to have possibly been security-related, implement Event 10 (Evidence of Sabotage) or Event 12 (Security Alen) procedures
- 7. Open the TSC or EOF as apropriate and consult with the Shift Technical Advisor for engineering decisions and mitigation strategies.
- 8. When the event is resolved, no continuing security threat exists, and it is agreed between all appropriate agencies, then enter the recovery phase and return to normal operatmg conditions.
D. Central and Secondarv Alarm Stations (CAS/SAS) CAS:
- 1. Direct initial security force response until relieved by the SL
- 2. Assist with assemble, accountability and evacuation.
- 3. Facilitate plant access by off-site emergency response personnel.
- 4. Control plant access to pmhibit unauthorized entry and allow rapid entry of response teams and emergency personnel.
- 5. Implement SL duectives.
SAS:
- 1. If required, implement CAS procedures.
- 2. Implement SL directives.
A-8
.. . . . . . - . - - - - - - 4.
SAIC OlV)3\89 E. Security Force Personnel
- 1. SFP assigned to parking lots, access road:
l
- a. Establish traffic contml points.
i
- b. Stop all incoming traffic except LLEA, fire-fighting, and medical vehicles.
- c. Ensure one lane of the access road is kept open at all times.
- d. Establish an assembly point for evacuees.
- 2. SFP assigned to admit emergency response personnel:
- a. Keep the gate clear of all obstmetions and vehicles.
- b. Admit only emergency response vehicles.
- c. Record for each entering vehicle the agency involved, number of persons, and license plate number.
1
- 3. Protected Area Portal Officers:
As directed, upgrade access controls and admit no visitors without specific approval.
- 4. Others:
Implement actions as directed to maintain site security in the event of concurrent threats, and to assist off-site assistance persont el. l A.4.2 Event 14 Land Vehicle Bomb Alert l I. PURPOSE l This procedure is designed to provide an orderly and effective means of responding to a I land vehicle bomb alert, should such a threat arise. l II. DISCUSSION This procedure applies to all SNGS personnel. It is to be used in conjunction with other SCP and Emergency Plan procedures. This implementing procedures outlines those actions that should be taken by plant personnel should a land vehicle bomb alert be received up until such time as a land vehicle bomb attack occurs. Once a fire, explosion, or other catastrophic activity occurs then the procedure for Event 9 is implemented. l A-9
SAIC 01\03\89 III. REFERENCES A. Sunshine Nuclear Generating Station Security Plan B. Sunshine Nuclear Generating Station Safeguards Contingency Plan. C. Sunshine Nuclear Generating Station Emergency Plan and Procedures. D. 10 CFR 73,55; 10 CFR 73; Appendix C. IV. EVENT DEFINITIONS A land vehicle bomb alert occurs when information is received by the station that an explosive laden vehicle may attempt to penetrate the Protected Area or otherwise impact plant operations. V. RESPONSIBILITIES A. Station Personnel are responsible for immediate and complete reporting of all relevant information regarding a fire, explosion, or other catastrophe to the Shift Supervisor. B. Shift Suoervisor (SS) is responsible for operating the plant in a safe and secure manner. He shall take overall charge of station activities under this procedure. He shall assume the position of Emergency Coordinator (EC) if an emergency is declared in accordance with the SNGS Emergency Plan and carry out all duties and responsibilities as defined in the SNGS Emergency Plan and Implemennng procedures until formally relieved by authonzed emergency response personnel. C. Shift Lieutenant (SL). under the direction of the SS/EC, is responsible for coordination of the security operations, including armed response (as appropriate), conducting orderly assemble and accountability procedures, conducting safe evacuation of a station personnel to designated evacuation sites, maintaining station integrity and implementing any directives required by the SS/EC. D. Central and Seconetary Alarm Stations (CAS/SAS), under the direction of the security Shift Lieutenant, are responsible for directing initial security response, controlling plant access, and assisting in stanon accountability, assembly and evacuation efforts. E. Ooerations Personry,1, under the direction of the SS, are responsible for implementing reactor plant procedures and actions to ensue a safe and stable reactor plant mode of operation. F. Security Force Personnel (SFP). under the direction of the SL, are responsible for controlling access during emergencies, assisting off-site response personnel, maintaining station integrity, assisting with site evacuation and implemennng directives of the SL A-10
SAIC ON)399 l l VI. PROCEDURES A. Station Personnel
- 1. Receive threat information, either by telephone, in person or by letter / note.
l (Threats could be received by any employee of SNGS.) . I i
- a. Document allinformation received.
I
- b. Attempt to determine specifics of the threat:
Time of attack. Type and quantity of explosives. Type of vehicle to be used. Caller's name and where the call is made fmm. l
- Caller's voice characteristics.
Backgmund noise to help in identifying the call origination location.
- 2. Notify the SS with allinformation.
B. Shift SuoervisorEmercency Coordinator
- 1. Receive all information, consult with SL and others as necessary to assess the land vehicle bomb alen.
- 2. Implement EOP-1, Event Classification and Notificatica Procedures,in accordance with the SNGS Emergency Plan / Contingency Event Reponing Procedure. Provide frequent updates. Request assistance from off-site agencies, as necessary, in accordance with Letters of Agreement, SNGS Emergency Plan and governmental guidelines.
- 3. Direct Operations personnel to place the reactor plant in safe and stable mode of o)eration. Implement other actions to provide maximum safety and reliabi ity of reactor plant systems and components, as appropriate.
- a. Secure maintenance, repair, or testing activities and return systems / components to operational status,
- b. Verify Engineered Safety Features are operational and properly aligned.
- c. Insme ade
- d. Maxinuze.quate water supplies for decay heat removal.
- adiness of station suppon systems.
- e. As allowed by procedures and technical speciScations insure maximum reliability and flexibility of reactor plant and suppon systems, e.g., system cross connections, operational, spool pieces installed, power supplies in most reliable alignment.
- f. Pre-position emergency personnel and equipment.
- g. Notify pre-selected vendors of potential need for supplies and eqmpment.
- 4. If determined necessary to protect station personnel, implement assembly and accountability. Considerevacuation of non-essential personnel.
- 5. Implement Security Alen (Event 12) procedures.
- 6. If required, direct SL to open EOF, insuring available for safe occupancy, and to obtain emergency vehicle suppon escon.
- 7. When the event is resolved, no continuing security threat exists, and it is agreed between all appropriate agencies, then enter the recovery phase and return to normal operaung conditions.
A-ll
SAIC OlV)3\89 C. Shift Lieutenant
- 1. Assist SS with evaluation of threat.
- 2. If directed, notify LLEA, State Police, and Federal agencies in accordance with SNGS Letters of Agreement, SNGS Emergency, Plan and governmental guidelines. Coordinate efforts between assistmg off site agencies and station personnel.
- 3. Contact off-site companies for delivery of contingency barriers and related materials.
- 4. Direct SFP to deploy contingency bar'iers to prevent unauthorized vehicle access.
- 5. If directed, implement Security Alert (Event 12) procedures.
- 6. Direct SFP to establish checkpoint (s) and a safe distance perimeter.
Restrict access to emergency vehicles only.
- 7. If directed, implement assembly and accountability procedures.
- 8. If directed, implement evacuation of non-essential personnel procedures.-
- 9. Implemes Fire, Explosion, or Other Catastrophe (Event 9) procedute if a device is detonated.
- 10. When the event is determined to be resolved, no continuing security threat -
exists, and the SS/EC has entered the recovery phase:
- a. Insure all non-essential off-site assistance personnel have left the station projected zones.
I b. If directed by SS/EC insure agencies contacted are appraised of the I event situationhesolution.
- c. Insure orderly transition to normal security operations.
- d. File Security IncidentNiolation Reports, as necessary.
l D. Central and Secondarv Alarm Stations (CAS/SAS) CAS:
- 1. Direct initial security force response until relieved by the SL.
- 2. Assist with assemble, accountability and evacuation.
- 3. Facilitate plant access by off-site emergency response personnel.
- 4. Control plant access to prohibit unauthorized entry and allow rapid entry of response teams and emergency personnel.
- 5. Implement SL directives.
SAS:
- 1. If required, implement CAS procedures.
- 2. Implement Shift Lieutenant directives.
A-12 I
l SAIC 01503\89 E. Security Force Personnel (
- 1. Erect contingency barriers and establish checkpoints.
- 2. Stop and search allincoming vehicles.
- 3. Position security forces and patmls in predesignated defensive podons.
- 4. Integrate site security force action with LLEA for trafnc control r.ad other related activities.
- 5. Establish art assembly point for evacuees.
t l \ l A-13
SAIC 01\03\89 I- APPENDIX B l ) TOPICAL BIBLIOGRAPHY OF SAFEGUARDS REFERENCES l l TABLE OF CONTENTS ) l TITLE PAGE 1 l B.1 General Safeguards References B-2 B.2 Safeguards Measures - Physical Protection B-2 B.3 Safeguards Measures - Damage Control B-2 B.4 Safeguards Measures - Plant, System, and Component Design Changes B-3 B.5 Safeguards Measures. Human Factors B-3 B.6 Insider Threat B-4 B.7 Oatsider Threat B-4 B.8 Vital Area Analysis B-5 B.9 Other Safegnanis Analysis Methodologies B-5 I B.10 Security Plans B-6 B.11 Security Force B-6 B.12 Safeguards Equipment B7 l B.13 Safety /SafeguardsInterface B-8 B.14 Transportation Safeguards B-8 B.15 Industrial Sabotage B-8 B.16 Bomb / Blast Effects B-9 B-1
SAIC 01\03\89 APPENDIX B TOPICAL BIBLIOGRAPHY OF SAFEGUARDS REFERENCES B.1 General Safeguards References
- 1. Goldman, L.A. and 1.obner P.R., "A Review of Selected Methods for Protecting Against Sabotage by an Insider," NUREG/CR 2643, Science Applications Intemational Corporation, August 1982.
- 2. Varnado, G.B., et al., " Reactor Safegrards System Assessment and Design," S AND77-0644, Sandia National Laboratories, June 1978.
- 3. SAND 75-0504, " Safety and Security of Nuclear Power Reactors to Acts of Sabotage," Sandia Nanonal Laboratories, March 1976.
- 4. Bennett, C.A., Murphy, W.M. and Sherr, T.S., " Societal Risk Approach to Safeguards Design and Evaluation," ERDA-7, U.S. Department of Energy, June 1975.
B.2 Safeguards Measures - Physical Protection
- 1. Gurican, G.M., "A Combined Security and RE+M System Operational Experience at the D.C. Cook Nuclear Plant," S.M. Stoller Corporation, ANS Workshop on Power Plant Security, Savannah, GA, April 24-27,1983.
- 2. Winblad, A.E., et al., "An Integrated Sabotage Protection System Concept," SAND 82 2963C, Sandia National Laboratories, April 1983.
- 3. Paulus, W.K., " Generic Physical Protection 14gic Trees," SAND 79-1382, Sandia National Laboratories, October 1981.
- 4. Imbner, P., et al., " Light Water Reactor Operations Control Analysis (U),"
SAI/LI 79:1112.1, Science Applications Intemational Corporation, September 1979.
- 5. HCP/DO789-01, "A Systematic Approach to the Conceptual Design of Physical Protection Systems for Nuclear Facilities," U.S. Depanment of Energy, May 1978.
B.3 Safeguards Measur:s - Damage Control
- 1. Imbner, P.R., " Damage Control and Des i gn Changes as Elements of an Integrated Sabotage Pmtection System," Science Applications Intemational Corporation, ANS on Power Plant Security, Savannah, Georgia, April 24-27, 1983.
- 2. Lobner, P., Goldman, L. Horton, W. and Finn S., " Ranking of Light Water Reactor Systems for Sabotage Protection," SAND 82-7053, Science Applications Intemational Corporation, July 1982.
B-2
I SAIC0lV)3N89
- 3. Imbner, P., " Nuclear Power Plant Damage Control Measures and Design Changes for Sabotage Protection," NUREG/CR-2585, Science i Applications International Corporation, May 1982.
4 Ericson, C.M. and Vamado, G.B., " Nuclear Power Plant Design Concepts for Sabotage Protection," NUREG/CR-1345, Sandia National Laboratories, January 1981. B.4 Safeguards Measures - Plant, System, and Component Design Changes
- 1. Ericson, C.M., " Nuclear Power Plant Design Concepts for Sabotage Protection -Phase 2," SAND 83-0851C, Sandia National Laboratories, 1983.
- 2. Lobner, P.R., " Damage Control and Design Changes r.s Elements of an Integrated Sabotage Protection System," Science Applications Intemational Corporation, ANS Workshop on Power Plant Security, Savannah, Georgia, April 24-27,1983.
- 3. Level Design Changes for Pmtection Against Sabotage by an Insider (U),"
NUREG/CR-2693, Science Applications International Corporation, August 1982. 4 Imbner, P., " Nuclear Power Plant Damage Control Measures and Design Changes for Sabotage Protection," NUREG/CR-2585, Science Applications Intemational Corporation, May 1982.
- 5. Ericson, C.M. and Varnado, G.B., " Nuclear Power Plant Design Concepts for Sabotage Pmtection," NUREG/CR-1345, Sandia National l Laboratories, January 1981.
- 6. NUREG-0144, SAND 76-0637, " Summary Report of Workshop on Sabotage Pmtection in Nuclear Power Plant Design," Sandia National Laboratories, February 1977.
B.5 Safeguards Measures -Human Factors
- 1. Imbner, P.R., " Human Factots Considerations Applicable to Sabotage Protection for Nuclear Plants," Transactions of the American Nuclear Society, Vol. 47, pp.165, November 1984.
- 2. O'Brien, J.N. and Fainberg, A., "Long-Term Research Plan for Human Factors Affecting Safeguards at Nuclear Power Plants," NUREG/CR-3520, Vols. I and II,Brookhaven National Laboratory, April 1984.
- 3. Perry, R., et al., " Security Clearance Criteria and Insider Motivations,"
BHARC-400/81/004, Battelle Human Affairs Research Council, April 1981. B-3
SAIC ON)329
- 4. O'Brien, J.N., " Stress and Duress Detection for NRC-Licensed Facilities:
A Constitutional and Regulatory Analysis," NUREG/CR 1032, BNL-NUREG 51090, Bmokhaven hational Labonitory, September 1979.
- 5. Fainberg, A., " Stress and Duress Monitoring at NRC-Licensed Facilities,"
NUREG/CR-1031, BNL-NUREG-51089, Brookhaven National I l Laboratory, September 1979, 1 B.6 InsiderThreat
- 1. Goldman, L.A. and Lobner, P.R., "A Review of Selected Methods for Pmtecting Against Sabotage by an Insider," NUREG/CR-2643, Science Applications International Corporation, August 1982.
- 2. l.cbner, P., et al., " Component Vulnerabilities and Com :>onent-Level Design Changes for Protection Against Sabotage by an Ensider(U),"
NUREG/CR-2693, Science Apphcations International Corporation, August 1982.
- 3. Bennett, H.A., " Reactor Safeguards Against Insider Sabotage," hTREG/
CR-2546, Sandia National Laboratories, June 1982.
- 4. Lobner, P.R., "A Conceptual Integrated Safeguards System for Protection Corporation, ANS Workshop on Power Plant Security, Oakbrook, Illinois, October 5-8,1980.
- 5. Goldman, L.A., Horton, W. and Lobner, P.R., " Operations Controls as an Approach for Protecting Against Sabotage by an Insider," Science Applications International Co tion, ANS Workshop on Power Plant Security, Oakbrook, Illinois, tober 5-8,1980.
- 6. Lobner, P.R., et al., " Component Vulnerability (U)," SAI/LJ 79:258, Science Applications International Corporation, February 1979.
B.7 OutsiderThreat
- 1. Harris, L., " Inspection Guide for Vulnerability Analysis of Nuclear Sites Against Outsider Threats," SAI-84/1583, Science Applications International Corporation, April 1984
- 2. deLeon, P., et al., " Attributes of Potential Criminal Adversaries of U.S.
Nuclear Pmgrams," R-2225-SL, Rand Corporation, February 1978.
- 3. Chester, C.V., " Estimates of Thrrats to the Public from Termrist Acts Against Nuclear Facilities," Nuclear Safety, Volume 17, No. 6 p. 659, November-December 1976.
B-4
SAIC OlV)3\89 B.8 Vital Area Analysis
- 1. Horton, W.H. and Lobner, P.R., " Enhancing the Usefulness of Vital Area Analyses for Nuclear Power Plants," Science Applications Intemational Corporation, INMM 26th Annual Meeting, Albuquerque, NM, July 22-25, 1985.
- 2. Stack, C.W. and Hill, M.S., "A SETS User's Manual for Vital Area Analysis," NUREG/CR-3134, Sandia National Laboratories, April 1984.
- 3. Finn, S., Horton, W., Lobner, P. and Mahn, J., " Technical Basis for and Description of Function Level Generic Fault Trees for Light Water Reactors," SAND 82-7720, Science Applications hternational Corporation, 1983.
- 4. Finn, S., Horton, W., " Generic Modeling Approach for Fluid Systems in Light Water Reactors," SAND 82-7219 (3 volumes), Science Applications Interna'ional Corporation,1983.
- 5. Finn, S. and Horton, W., " Generic Modeling Approach for Major Components in Light Water Reactors," S AND82-7032 (3 volumes),
Science Applications Intemational Corporation,1983.
- 6. Boudreau, J M. and Haarman, R.A., " Reactor Sabotage Vulnerability and Vital Equipment identification," LA UR-82-2831, Los Alamos National Laboratory, October 1982.
- 7. Richardson, J.M., " Rank Ordering of Vital Areas Within Nuclear Power Plants," NUREG/CR-255), Sandia National Laboratories June 1982.
- 8. Varnado, G.B. and Haarman, R.A., " Vital Area Analysis for Nuclear Power ," LA-UR-80-2407, Los Alamos National Laboratory August 1980.
- 9. Stack, C.W. and Francis, K.A., " Vital Area Analysis Using SETS,"
NUREG/CR-1487, S/.ND80-1095, Sandia National Laboratories, May 1980.
- 10. Varnado, G.B. and Ordz, N.R., " Fault Tree Analysis for Vital Area Identification," NUREG/CR-0809, Sandia National Laboratories, June 1979.
B.9 Other Safeguards Analysis Methodologies
- 1. NUREG/CR-1381, "A Methodology for Evaluatin;; Sateguards Capabilities for Licensed Nuclear Facilities - Final Report," Sandia National La%ratories, May 1980.
- 3. NUREG/CR-1310. " Human Effects Aspects in Simulating Hostile Attacks Against Nuclear Facilities," Sandia National Laboratories, March 1960.
B5
SAIC OlV)3N89
- 4. Engi, C., et al., "Pathfinding Simulation (PATHS) User's Guide,"
NUREG/CR-1589, Sandia National Laboratories, September 1981. L 5. S AND80-0058, " POST: A Subroutine for Path Ordering of Sabotage Targets," Sandia National Laboratories, May 1980. 6. Hulme, B.L., "The Region Adjacency Graph in Sabotage Studies," SAND 76-0574, Sandia National Laboratories, October 1976.- B.10 Security Plans
- 1. USNRC Regulatory Guide 5.54, " Standard Format and Content of Safeguards Contingency Plans for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, March 1978.
- 2. USNRC Regulatory Guide 5.62, " Reporting of Physical Security Events,"
U.S. Nuclear Regulatory Commission, Febuary 1981.
- 3. NUREG-0908, " Acceptance Criteria for the Evaluation of Nuclear Power Reactor Security Plans," U.S. Nuclear Regulatory Commission, August 1982.
B.11 Security Force
- 1. USNRC Regulatory Guide 5.20, " Training, Equipping, and Qualifying of Guards and Watchmer.," U.S. Nuclear Regulatory Commission, June 1974.
- 2. Floyd, W. and Kers, C., " Security Personnel Training and Qualification Criteria," NUREG-0674, U.S. Nuclear Regulatory Commission,1980.
- 3. NUREG-0576, " Nuclear Power Reactor Security Personnel Training and Qualification Plan Reviewer Workbook (Interim)," U.S. Nuclear Regulatory Commission, July 1979.
- 4. NUREG-0464, " Site Security Personnel Training Manual," U.S. Nuclear Regulatory Commission,1979.
- 5. Baehr, C.G., et al., " Tactical Implementation Package," NUREG/CR-2400, Sandia National Laboratories,1982.
- 6. Cadwell, J., " General legal Problems Affecting Nuclear Guard Tactical Responses," Brookhaven National Laboratory, ANS Workshop on Power Plant Security, Oakbrook, Illinois, October 5 8,1980.
- 7. NUREG/CR-0485, Vehicle Access and Searth Training Manual," Mason &
Hanger-Silas Mason Co., November 1979.
- 8. NUREG/CR-0484, " Vehicle Access and Control Planning Document," Mason
& Hanger-Silas Mason Co., November 1979.
B-6
SAIC 0l\03\89 B.12 Safeguards Equipment
- 1. Mangan, C.L., "The DOE Intrusion Detection Systems Handbook," Nuclear Safety, Vol. 20, No.1, p. 44, January - February 1979.
- 2. Prell, J.A., " Interior Intrusion Alarm Systems," NUREG-0320, U.S. Nuclear Regulatory Commission, February 1978. r
- 3. SAND 76-0554, " Intrusion Detection Systems Handbook," Sandia Laboratories, November 1976, revised, October 1977.
- 4. USNRC Regulatory Guide 5.7, " Entry / Exit Control for Protected Areas, Vital Areas and Material Access Areas," U.S. Nuclear Regulatory Commission, May 1980.
- 5. SAND 77-1033, " Entry Control Systems Handbook," Sandia National Laboratories, September 1977.
- 6. USNRC Regulatory Guide 5.12, General Use of Locks in the Protection and Control of Facilities and Special Nuclear Materials," U.S. Nuclear Regulatory Commission, November 1973.
- 7. Fainberg, A. and Bieber, A.M., " Barrier Penetration Data Base," NUREG/CR-0181, Rev.1., Brookhaven National Laboratory, November 1981.
- 8. NUREG/CR-1378, " Hardening Existing Strategic Special Nuclear. Material Storage Facilities," U.S. Army Material Systems Analysis Activity, Aberdeen Proving Ground, MD, June 1980.
- 9. SAND 77-0777, " Barrier Technology H.andbook," Sandia National Laboratories, October 1977.
- 10. Moore, R.B., " Barrier Penetration Tests," NBS Technical Note 837, U.S.
Department of Commerce, National Bureau of Standards, June 1974.
- 11. SAND 78-1785, " Safeguards Control and Communications Systems Handbook," Sandia National Laboratories, May 1979.
- 12. NUREG/CR-1327, " Security Lighting - Planning Document for Fixed Site Facilities," Mason & Hanger - Silas Mason Co., April 1980.
- 13. Wilson, C.W., et al., " Remote Response Mechanisms," NUREG/CR-1142, Union Carbide Corporation, April 1980.
- 14. NUREG/CR-0509, " Emergency Power Supplies for Physical Security Systems," Union Carbide Corporation, October 1979.
B-7
SAIC OlV)3\89 i B.13 S rety/SafeguardsInterface
- 1. Byers, K.R., et al., " Safety / Security Tnterface Assessments at Commercial Nuclear Power Plants," PNL-S A-12932, Battelle Pacific Nortl est Laboratories, July 1985.
- 2. Cardwell, R.G., et al., "The Role of Security During Safety-Kelated Emergencies at Nuclear Power Plants," NUREG/CR-3251, Union Carbide Corporation,1984.
- 3. NUREG-0992, " Report of the Committee to Review Safeguards Requimments at Power Reactors," U.S. Nuclear Regulatory Commission, May 1983.
- 4. Callaghan, V.M., " Safety Functions: Role in Security and Safety Interfacing,"
Combustion Engineering,Inc., ANS Workshop on Power Plant Security, Savannah, GA, April 24-27,1983.
- 5. Leahy, T.J., and Young, J., " Assessing the Impact of Access Control Systems on Plant Operations," Energy Incorporated. ANS Workshop on Power Plant Security, Savannah, GA, April 24-27,1983.
- 6. Moul, C.A., " Security During Safety-Related Emergencies at Nuclear Power Plants," NUSAC,Inc., ANS Workshop on PowerPlant Security, Savannah, GA, April 24-27,1983.
B.14 Transponation Safeguards
- 1. NUREG/CR-0364, " Simulating Banier Penetration During Combat," Sandia National Laboratories, April 1980.
- 2. NUREG/CR-0641, SOURCE: A Convoy Ambush Simulation Code," Sandia NationalLaboratories, May 1980.
B.15 Industrial Sabotage
- 1. Fullwood, R.R., and Erdmann, R., "On the Use of Fault Tree and Decision Tree Analysis to Protect Against Industrial Sabotage," Pro:cedings of the 16th Annual Meeting of the Institute of Nuclear Materials Management, INMM Journal, Vol. IV, No. 3, Fall 1975.
- 2. Tumer, S.E., et al., " Industrial Sabotage in Nuclear Power Plants," Nuclear Safety, Vol. 2, No. 2, p.107, March-April 1970.
- 3. McCullough, C.R., et al., "An Appraisal of the Potential Hazard of Industrial Sabotage in Nuclear Power Plants," SNE-51, Southern Nuclear Engineering, July 1968.
B-8
SAIC 01V)3\89 l B.16 Bomb / Blast Effects l l 1. Kennedy, R.P., Blejwas, T.E. and Bennett, C.E., " Capacity of Nuclear Power Plant Structures to Resist Blast Loadings," NUREG/CR-2462, Sandia National Laboratories, September 1983.
- 2. Kott, C.A., et al., " Hazard to Nuclear Power Plants from Large Liquefied Natural Gas (LNG) Spills on Water," NUREG/CR-2490, Argonne National Laboratory, November 1981.
- 3. Southwest Research Institute, "A Manual for the Prediction of Blast and Fragment Loadings on Structures," Two Volumes, November 1980.
I
- 4. USNRC Regulatory Guide 1.91, Revision 1, " Evaluation of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plar,ts," US l
Nuclear Regulatory Commission, February 1978. 1
- 5. Linderman, R.B., et al., " Design of Structures for Missile Impact," BC-TOP A, Revision 2, Bechtel National Corporation, September 1974.
- 6. Weihle, C.K. and Bockholt, J.L., " Blast Response of Five NFSS Buildings,"
SRI Project 1219, Stanford Research Institute, October 1971.
- 7. Army, United States. " Demolition Materials," (TM 9-1375-200), Washington, D.C.: Department of the Army,1964.
- 8. Army, United States. " Engineering Field Data," (FM 5-34). Washington, D.C.:
Department of the Army,1976.
- 9. Army, United States. " Explosives and Demolitions," (FM 5-25),1986.
- 10. Army, United States, Materiel Command. Engineering Design Handbook,
" Principles of Explosive Behavior," (AMCP 706-180). Washington, D.C.:
United States Army Materiel Command,1972.
- 11. Army and Air Force, United States. " Military Explosives (TM 9- 1300-214 and TO 11A-1-34)." Washingw 4, D.C.: Departments of the Array and the Air Force,1967.
- 12. An.ny, Navy, and the Air Force, United States. " Structures to Resist the Effects of Accidental Explosions (TM 5-1300 NAVFAC P-397, AFM 88-22)."
Washington, D.C.: Departments of the Army, Navy, and Air Force,1969.
- 13. Assheton, Ralph. " History of Explosions on Which the American Table of Distances was Based, Including Other Explosions of Large Quantities of Explosives." Wilmington, Delaware: Charles L. Story Co.,1930.
- 14. Baker, W.E., et al. " Explosion Hazards and Evaluation." New York: Elsevier Science,1983.
B-9
, SAIC OlV)3\89
- 15. Case, Stuan W., and Dennis J. Reutter. " Explosive Overpressure Measurements of Selected Improvised Devices." Washington, D.C.: Scien*ific Analysis Section, FBI Laboratory,1986.
- 16. Defense Research Institute. " Proceedings of the Conference on Securing Installations Against Car Bomb Attack." Arlington, Va: Defense Research Institute,1986.
- 17. McLean, Donald B. ed. " British Textbook of Explosives." Forest Grove, Oregon: Normount Technical Publications,1971.
- 19. Mullins, B. P. and S. S. Penner. " Explosions, Detonations, Flammability and Ignition. " New York, New York: Pergamon Press, Inc.,1959.
- 21. Navy, United States, Naval Ordnance Systems Command. " Demolition Materials (NAVORD OP 2212)." Naval Ordnance Systems Command,1968.
- 22. Salamanca, Beth A. " Vehicle Bombs: Death on Wheels." Fighting Back:
Winning the War Against Terrorism. Eds. Neil C. Livingstone and Terrell E. Arnold. Lexington, Massachusetts: D.C. Heath and Company,1986.
- 23. Southwest Research Institute. "A Manual for the Prediction of Blast and Fragment Lo-dings on Structures. 2 Volumes." United States Dept. of Commerce, National Technical Information Service,1980.
- 24. State, United States Department of. " Improvised Explosive Devices," Security Guidelines September 1985. United States Department of State,1985.
- 25. American Defense Preparedness Association. " Proceedings of the Joint Government 4r.dustry Symposium on Physical Security." 1985.
- 26. Army, United States, Military Police School. "Use of Barriers (To Deny High Speed Approach) in Countenng Terrorism Situations (Field Circular 19-112 August 1984)." Fon McClellan, Alabama: United States Anny Military Police School,1984.
- 27. Gray, Kenneth O. " Countermeasures Against High-Speed Car-Bomb Attack,"
Falls Church, Va.: TRW Command Suppon Division Security and Antiterrorism Systems.
- 28. Sena, Patrick A. " Security Vehicle Barriers." Sandia Report 84-2593, November 1985.
- 29. " Terrorist Vehicle Bomb Survivability Manual." Naval Civil Engineering Laboratory, Port Hueneme, CA, May 1988.
- 30. " Securing U.S. Army Site Access Points." Prepned for the Conference, Securing Installations Against Car Bomb Attack, Washington, D.C., May 15-17,1986 by William F. Webb, Black and Veatch Engineers and Architects, Kansas City, Missouri.
B-10
SAIC 0lV)349
- 31. ' Vehicle Access Control as Related to Countermeasures Against High Speed Car Bomb Attack." Kenneth O. Gray, TRW. Prepared for the Conference, Securing Installations Against Car Bomb Attack, Washington, D.C.. May 15-17, 1986.
- 32. " Engineering Guidelines for New Office Buildings." Weidlinger Associates, Revised August 1985.
- 33. Whitney, M.G., Ketchum, D.E., Poleyn, M.A., " Blast Vulnerability Guide,"
Southwest Research Institute, October,1987.
- 34. Kinny, G.F., Graham, KJ., " Explosive Shocks in Air," Springer-Verlag, New York,1985.
- 35. Hoffman, AJ., "The Effects of Altitude on the Peak Pressure in Normally Reflected Air Blast Waves," Ballistics Research Labs., Tech. Note No. 787, 1953.
I B-11
'I 4--
'..t ,
.1
- 7. c
(,
'6:
l ( 4 A a, . si f i i i I i 1
-I i '4 i i I '
i ac1W
._, g .
.- ' a-q %ar
l l
'. I l ENCLOSURE 4 i
4 I j l e l
BACKFIT ANALYSIS CONTINGENCYPLANNINGFORLAN]_VEHICLEBOMB Item 1: Statement of the specific objective that the proposed backfit is designed to achieve; Response: The objective of the proposed action is to have all power reactor licensees develop short-range contingency plans for use in the event that a credible land vehicle bocib threat arises. i 1 l l l ENCLOSURE 4
m , Item 2: General description of the activity that would be required of' the licensee or applicant in order to complete the backfit; Response: Power reactor licensees would be required to supplement safeguards contingency plans and procecures currently required by 10 CFR Part 73, Appendix C, with short-range plans and procedures to protect against a' land vehicle bomb. threat.. An acceptable method of developing these plans and procedures could. include the following: (1) Identify system options available to establish and
~
maintain safe shutdown conditions. (2) Identify buildings containing components and equipment associated with each system option. (3) Determine " survivability envelopes" for the system options.. (4) Review site features to determine land vehicle access
- approach paths and distances.
1 (5) Identify short-range measures to limit or thwart vehicle access and protect and preserve preferred system options. (6) Prepara plans and make advance arrangements to facilitate the short-range contingency measures in the-event a land vehicle bomb threat arises. Short-range planning for security actions could include such items as advance arrangements to facilitate rapid emplacement of emergency temporary vehicle barriers to limit and control land vehicle access. The proposed action does not affect the design-basis threat in. 10 CFR 73.(a) and does not imply any need to alter physical protection currently required by 10 CFR 73.55. ENCLOSURE 4
Item 3: Potential change in the risk to the public from the accidental . ;u offsite release cf radioactive material;. Response: The risk to the public from sabotage-induced offsite release of radioactive material..is ; dominated by the probability.that 1 radiological sabotage would be at. tempted;.. The probability of:an1 l attempt cannot be quantified.- There has not.been.a' credible. vehicle bomb threat against the commercial nuclear industry-in the past, nor is there any' indication that such a threat; exists:today... To. .. 'j the extent that a credible vehicle bomb' threat:could develop;in'the. ' future, the proposed short-term contingency planning would help to limit the. risk to the public during the transition to permanent protective measures warranted by. the new threat' environment.~ -
'l 4
o l 1 g o 1 1 1 , l l
~!
l 4 ENCLOSURE 4 j i l l
.I a
i i Item 4: Potential impact on radiological exposure of facility employees;- ! i Respon.se: The proposed action is restricted to planning and has no impact i on radiological exposure of facility employees, except to the i extent that it could reduce the chance of radiological release j resulting from a land vehicle bomb. ! i l 4 l l 1 . 1 4 i i l l EllCLOSilRE 4 i l l w__-__-___________
Item 5: Installation and continuing costs associated with the backfit,. ' includingthecostof(cilitydowntimeorthecostofconstruction '! delay; Response: There are no installation costs, contingency costs, facility downtime,' 'I or construction delays associated with this action. .q . The only costs are for analysis 'and preparation' of. contingency plans and procedures. The estimated average burden hours for the requested- m; contingency planning. is estimated to be in the range of 350 to 500 ; man-hours per power reactor site--(assuming, that multiple units at onesitearesimilar'indesignandconstruction),.includingassessment .; of the new requirements, analyzing options, and preparing-contingency 1 plans and procedures. 1 s i. l i l l 1 i i
'I .
i 1 L l 5- ENCLOSURE 4 i l 4 6 -
s i l l i Item 6: The potential' safety impact of changes. in plant or operational complexity,. including.the relationship to proposed and existing regulatory requirements; Response: The backfit does not alter the plant or operational complexity; I t' . . does not involve a reduction in the. margin of safety as.neither plant design nor, operating procedures are changed. In addition, it does. not alter any safety-related design bas',s of the facility.;
.Therefore, the backfit neither creates the possibility of'a new or .
different kind of accident nor does it. involve an increase in the probability or consequence of an accident previously evaluated. J l l l i 1 1 l l i l i i 1 i i El4 CLOSURE 4 I i
s - j H i Item 7: The estimated resource burden on the NRC associated with the proposed backfit and the availability.of such resources; ! 4 1 Response: The estimated resource burden on the NRCLis expected to.be l- , staff-day per reactor site for inspection of contingency plans- I and procedures. This will be a one-time inspection to. ensure: l that licensees have addressed the land vehicle' bomb in their
~
contingency plans. (A Temporary Instruction will be issued for NRC inspectors).. Subsequent inspection effort will be subsumed i
.in NRC's routine inspection. program addressing safeguards '
contingency plans (Inspection Procedure 8'.601)- l
.q 1'
1 1 l
. I I
3 i ENCLOSURE 4 j i
ltem 8: The potential impact of differences in facility type, design, or age on the relevance and practicality of the proposed backfit; Response: Differences in facility type, design, or age have no significant impact on the relevancy and practicality of the proposed backfit. l I i
~B- ENCLOSURE 4
_~
-q Item 9: Whether the proposed backfit is-interim or final and, if interim, 1 the justification for imposing the proposed backfit on an interim.
basis. Response: On the basis of current kncwledge and circumstances, th'e proposed-backfit is-final. If a credible land vehicle bomb threat materialized in the future, the staff would recommend that. the safeguards contingency , procedures developed as a result of this sction be implemented as- ) an interim measure pending permanent protective actions for dealing; j with the new threat environment.. J l I 1 1
- l l
i ENCLOSURE 4
i] 1 1
Conclusion:
Because the proposed generic' letter would require preparation 1 of new contingency procedures related to operation of a nuclear d power reactor, a backfit analysis has been prepared pursuant .to j 10 CFR 50.109. - In the analysis, the staff- finds that to the 1 extent that a credible vehicle bomb threat could-' develop in the j future, the proposed short-term . contingency planning could . ;y significantly increase.the overall protection of the public- i health and safety or,the common defense and security and that: l the direct'and indirect costs of. implementing-the backfit are i justified in view of the' potential increased protection.
-i o) i l
-l l
i I 1
)
i I
-l ENCLOSURE 4 ;
I l
..e
?
ENCLOSURE 5 1
i
" ^
/.**scw*[c, ., UNITED 57 ATES
/' ,
% NUCLE AR REGULATORY COMMISSION
{ I h ASHINGTON.D.C. J0666 j June 16. 1988 SicalTAe* MEMORANDUM FOR: Victor Stello, Jr. Executive Director for Operations TROM: b 'TS A5 J. Chilk, Secretary Samuel b SUEL7ECT: ' SECY-88-127 - CONTINGENCY pIANNING' TO COUNTERACT POSSIBLE SURFACE VEHICLE THREAT This is to advise you that the Commission (with all Commissioners agreeing, except as noted) has approved the following:
/g g7;// 1) For Category 1 fuel facilities, no further actions are necessary to protect against a surface vehicle bomb; /fCD //ER 2) Development of generic contingency plans for povar-reactors for use by the NRC staff in the event that a vehicle bomb threat arises; (EDO) (SECY Suspense: 12/31/88)
A'RR 3) A requirement for licensees to develop short range contingency plans (Option 3A). (Commissioner Carr disagrees and does not believe the Commission needs to impose any requirements, short or long range on power reactor licensees.) (EDO) (SECY Suspense: 12/31/86) N88 4) The staff should complete review of the issues related to the water borne vehicle bomb and provide a paper to i the Commission by December 31, 1988. Chairman tech also believes that the NRC staff should develop guidance for licensees on what would be envisioned in long range contingency plans, and he would encourage licensees to consider option 4, with the view that some are more vulnerable than others.
s
-2 Commissioner Rogers would encourage, but not require, license'es to pursue option 3b on long range contingency planning.
Additional couents of Conissioners were provided to you with copies of their vote sheets. ec: Chairman Zech Cor:=issioner Roberts , Conissioner.Carr com issioner Rogers OGC GPA ACRS c l l k
b El:CI.0SURE 6 i e
i i i i I l LIMITED DISTRIBUTION May 10, 1989 l SECY-88-327 For: The Commissioners From: Victor Stello, 'Jr. , Executive Director for Operations l
Subject:
CONTINGENCY PLANNING TO COUNTERACT POSSIBLE SURFACE YEHICLE THREAT Purpcse: To provide the Comission with a renge of options and a recommendation for contingency planning which could be taken to counteract a surface vehicle threat, as requested by Staff { Requirements Memorandum (SRM), dated February 24, 1988 (Enclosure 1). Sumary: This paper discusses threat considerations as they might assist the Comission in selecting from a range of options presented for consideration. There appears to be no need to require the development of any aeditional licensee contingency plans at this time. Rather, a recommendation is made which would require development of contingency plans by the staff to assist in promptly providing comprehensive guidance and infomation to licensees for possible actions in responding to a surface vehicle threat. t
Background:
Comission Papers SECY-86-101, dated March 31, 1986, i 1 (Enclosure 2) and SECY-86-101A, (CONFIDENTIAL) dated June 12, 1986, entitled " Design Basis Threat - Options for , Consideration," provided the Commission with staff reconsnen-dations based on considerations arising from the use of ( i vehicle bombs in the Middle East and their possible impact on I the domestic threat situation.
.l CONTACT:
R. Eurnett, NM55 49-23365 J. Partlow, hRR ! 49-20903 , LIMITED DISTRIBUTION I i
Commissioners 2 l SECY-86-101A contained a reccanendation by the staff to defer previous recomended actions (Option 4 of SECY-86-101) which would have required power reactors and certain fuel cycle facilities to develop security response plans for both near ; and long-tem contingencies if any significant change to the < domestic threat environment occurred. The Comission ! approved the recomended deferral of this option pending receipt of additional infomation from the Executive Branch. - The briefing provided to the Comission on December 22, 1957-by the Executive Branch (NSC, FBI, CIA, DOE), satisfied the Comission as to the continuing validity of the design basis threat statements and resulted in the issuance of the SRM j identified above. It should be noted that the present design basis threats and safeguards requirements were developed as a prudent step in the absence of a known credible threat to the nuclear industry. There has been no credible vehicle bomb threat against the comercial nuclear industry in the past, nor is there any indication that such a threat exists today. Therefore, any change to the design' basis threat for j radiological sabotage, and the corresponding development of added requirements would be for reasons of additional conservatism and prudence. Although the-existing design basis threats do not specifically include adversarial use of vehicles, they do not preclude adversarial use of all types of transportation, including boats, to gain access to the protected area. The purpose of the protected area barrier at power reattors is to tid detection rather than to prevent adversarial entry. . As used in this paper, the tem surface vehicle refers to land-based vehicles only. However, a preliminary resource estimate on research needed to begin -! development of the water-borne vehicle issue is included. Discussion: FUEL FACILITIES- ) At the present time, requirements for vehicle denial systems at protected area barriers to preclude use of.a vehicle in a ; I theft attempt have been proposed and have undergone public i coment. The use of vehicle denial systems at fuel ' facilities using or possessing unirradiated highly enriched uranium (Category I) is intended solely to achieve compa' ability with the DOE for protection against theft of r i weapons-useable material. Such systems may also provide. i a degree of protection against radiological sabotage l comitted via a vehicle bomb, (see Option 5' under OPTIONS FOR l POWER REACTORS). However, the threat at Category I fuel l facilities if one of thef t of special nuclear material (SNM) ; rather than radiological sabotage. i 1 2
Comissicra rs 3 Assuming a worse case scenario in which the wall of a vault was destrcyed, there would not be any significant offsite release. Furthermore, licensee security plans re::uire the irposition of appropriate compensatory measures to assure-continued protection of SNM. Accordingly, the staff does net believe further actions are necessary at Category I fuel facilities to protect against a surface vehicle bomb. OPTIONS FOR POWER REACTORS The following options represent a consolidation of options previously presented under SECY-86-101 (Options 4 and 5 described below) new options (Options 1, 2, and 6 described below) specifically responsive to the SRM dated February 24, 19EE and e modified option from SECY-86-101 (Option 3 described below).
- 1. Maintain Present Posture i
In the staff's opinion, an analysis of information received from the intelligence community does not justify { a revision to the design basis threat for radiological ] sabotage at this time. Since there has been no change in ! the threat environment, any change to our requirements would not be justified purely on that basis.
- 2. NRC Contingency Plans This opti6n entails staff action to assure that NRC incident response programs adequately address contingency rians in response to the threat of a surface vehicle bomb.
Staff action would be directed to assure the development ? of guidance and procedures for staff use if an emergency of this nature were to arise.
- 3. Licensee Contingency Plans
- a. Short Range Licensee Plans Under this option, licensees would be expected to !
accomplish contingency planning for temporary emergency ! measures to be implemented in response to a surface vehicle bomb threat. i l 1 -_ _ _ _ _ _ - _ _ _ _ _ ~
Commissioners 4 In particular, licensees would be requested to identify protective measures that could be taken with locally available resources to defend against a surface vehicle bomb attack were such a threat to materialize. i
- b. Lono Rance Licensee plans In addition to short range contingency plans, this option would involve development of site-specific plans for permanent measures to protect against surface vehicle bomb attack, but stop short of implementation. Planning would include surveys, engineering analysis, design and related activities resulting in detailed specifications for site-specific protection. Licensees would invoke these plans and begin construction and installation of permanent protection measures, if warranted, based upon future NRC notice of need due to change in the threat envirorynent.
l
- 4. Vehicle Denial System for Surface Vehicles Using j Poodway Access {
l This option would revise the design basis threat
- and provice for a vehicle denial system only in the innediate ]i area of existing vehicle gates. Supplemental denial j systems include hydraulic barriers; concrete bollards (i.e., heavy posts anchored in the ground); planters or other structural obstacles that would provide increased 3 penetration resistance near vehicle gates and woald j present a possible deterrent effect. The remaining l protected area perimeter would remain vulnerable to i vehicle penetration. (See SECY-86-101 for additional i backgroundunderOption2.) )
- 5. Vehicle Denial System for Surface Vehicles at Protected Area l l This option would revise the design basis threat
- and provide for a vehicle denial system for the land portion of the protected area perimeter. System components would include those identified in 0ption 4 plus cabling in the i
1
*10 CFR 73.1(a)(1)(D) would be modified to add a road vehicle as a tool for breaching perimeter barriers. This modification would not include j l vehicle-delivered explosives. It should be noted that SECY-86-101 states that l altnough adoption of options equivalent to either Option 4 er 5 above would !
increase the level of security, there might not be e substantial overall increase in the public health ar'd safety. , i
a i l I Corrn ssioners 5 4 i fence, and additional bo11ards and revetments. This system l would deny vehicle access to the protected area at the i existing protected area boundaries. (See SECY-86-101 for l edd?tional background under Option 3.) j
- f. Protection Aceinst Surface Vehicle Bombs This option would revice the design basis threat" and !
provide for a surface vehicle denial system and any other steps necessary to mitigate the effects of a design.. basis explosives charge. METHODS FOR REGULATORY ACTION AND DESIGN / IMPLEMENTATION l CONSIDERATION 5 e General 0 l All options requiring action, whether by the NRC or by j licensees would require NRC to establish design standards 4 (i.e., vehicle weight and speed or explosives weight). For ! Optiens 3 through 6, licensees would necessarily have to , de.elop site-specific information (i.e., site layouts, site j hardening features, calculation of desired standoff distances, etc.) to permit development of actions necessary to mitigate damage from a vehicle bomb attack. Data are already available regarding the issue as to the design basis l vehicle and vehicle denial techniques. Three months 1 additional research by the NRC related to design basis ) explosives would be required. If study of the new initiative i of water-borne vehicle bombs is pursued, design vehicle and i explosives data for this issue would require an estimated six I months of research and study. One aspect of this issue I requiring resolution involves how to implement vehicle denial systems on public waterways while preserving public water { rights. i In the staff's opinion, the adoption of Options 3a, 3b, 4, 5 j or 6 may present difficulties in justifying backfitting, i Based upon staff opinion, change to the regulatory base is' ; l unwarranted because no change to the threat environment has occurred. Under these circumstances it may be difficult to satisfy the " substantial additional safety requirements for the regulatory analysis portion of a backfit analysis. I "10 CFR 73.1(a)(1)(D) would be modified to include vehicle-delivered explosives. i i i i _ ____ _____- _ _ -_ - - - - w
q
~
Commissioners 6 Option 2 (NPC Contingency Plans) The development of a contingency plan for staff use would entail the expenditure of 0.2 to 0.5 FTE cf staff resources cepending on the degree of detail included. Ortion 3a (Short Range Licensee plans) The ado; tion of Option 3a could entail voluntary licensee actions. They could be encouraged to prepare written plans which would be subject to limited inspection activities. The staff does not believe that it would be necessary for litersees to submit plans for review and approval under Option 3a. Limited inspection could be conducted to see if licensees had initiated appropriate plans to satisfy NRC direction. However, staff would be required to develop standard planning factors, acceptance criteria, and inspection guidance. It is estimated that licensees could develop short range piens within 180 days after NRC development of planning factors and guidance. Actual implementation of such plans, if presented with a credible threat would be incremental, beginning with notification of response personnel, both cn and offsite. The desired time for full implementation should be no more than 12 hours after notification. Option 3b (Lon; Ran;e Licensee plans) Similar to Option 3a, the staff believes adoption of Option 3b could entail voluntary licensee action with no need for plan submittel, review, and approval. As stated above, staff would be required to develop standard planning factors, acceptance criteria, and inspection guidance. It is estimated that development of long range licensee plans under Option 3b would require 26 months (after NRC guidance development) and an additional 14 months would be required for full implementation if the Comission decided to require such action. l l
Corrissioners 7 Option 4 (Vehicle Denial System for Surface Vehicles Using Roaoway Access) Adoption of this option would require modification to 10 CFR 73.1(a)(1)'(D) to add a road vehicle as a tool for breaching perimeter barriers at roadway access points. This. modification would not include vehicle'-delivered explosives. Initial licensee costs are estimated to be 5100K-1200K/ facility with an annual maintenance cost of
$10K-$20K/ facility. NpC staff effort for rule development and plan review is estimated to be 6-8 SY. The elapsed time through implementation is estimated to be 34 months.
Option 5 (Vehicle Denial System for Surface Vehicles at Protected Area) i Adoption of this option would require modification to 10 CFR 73.1(a)(1)(D) to add a road vehicle es a tool for breaching perimeter barriers. This modification would not include vehicle-delivered explosives. Initial licensee costs are estimated to be $500K-$1000K/ facility with an annual maintenance cost of $25K-$50K/fac111ty. NRC staff effort for rule development and plan review is estimated to be 8-10 SY. The elapsed time through implementation is estimated to be 40 months. Option 6 (Protection Acainst Surface Vehicle Bombs) Under this option, 10 CFR 73.1(a)(1)(D) would be modified to include vehicle-delivered explosives. Implementation estimates have not been developed by the staff for this option. Some facilities may not be able to provide sufficient standoff within their present owner-controlled areas without taking additional steps to mitigate the effects of an explosion, it may not be possible to provide sufficient standoff distances l at certain sites due to the existence of public lands, rail- ) - roads, highways, and private property surrounding the site. l Criteria development end site-specific reviews would be necessary to further develop this option. CURRENT INDUSTRY INITIATIVES The staff recently conducted an informal telephone survey of Regional offices to estimate the extent to which power reactor licensees may have initiated some action as a result cf NRC Information Notice 64-07,
- Design Basis Threat and Eeview of Vebicular Access Controls."
L__ - - _.
a
\
Con-i s sione rs 8 i 1 Limited measures have reportedly been taken by approximately one third of the power reactor sites, e.g., installin j concrete barriers-(" Jersey Bounces " posts, bumpers, g . subster.tial concrete !, labs or pots); installing aircraft - j , cable in protected area fencing; reinforcing gates; installing double fencing or guard rails; and conducting-vulnerability studies or contingency planning reviews. DOE POSTURE As quoted from its letter of March 14, 1988, the DOE position is: DDE requires security contingency planning measures to address possible adversaries' actions against DOE facilities based on DOE's generic threat statement assumptions. Steps taken by DOE over the past few years to upgrade protection consistent with its generic threat statement, provide some mitigation against attack which might include a truck bomb. Mitigation measures include such activities as physical security upgrades-(hardening of buildings, vehicle barriers around sites), provisions for area isolation, means of restricting vehicle movement within the sites, dedicated response forces, frequent drills and exercises, the authority-to use deadly force, and air space restrictions. Design and implementation of these measures reflect site-specific considerations. Recommendations: That the Comission:
- 1. Approve a) For Category I fuel facilities, staff recommendation that no further actions are necessary to protect against a surface vehicle bomb.
b) For power reactors. Option 2: Approve development of contingency plans for use by the NRC staff in the ! event that a vehicle bomb threat were to arise. !
'I 1
)
i
- - , - - - - - - - - - - - - - _ _ - - - _ _ - - - . . . - - - - - - . - - - - - - - - .b
] ?
-i Cemis t icr.e rs 9 i l
i n ! 1
- 2. Note that the Offices of Nuclear Material Safety and '
Safeguards and Nuclear Reactor Regulation have concurred on.. this paper; the Office.of the' General Counsel has reviewed -i
.this paper and has'no legal objection. I
'f- 7, .M/' r n-
/
ctor Stello, - . 3 Executive Director for Operations
Enclosures:
- 1. 2/24/88 Memo to V. Stello fm 5. Chill
- 2. SECY-86-101 l l
Co=issitners' co=ents or consent should be provided directly ! i to the Ofi:cc c.f the Secretary by c.o.b. Wednesday, May 25, 1988.- i Co=issien Staf f Of fice comments,- if any, should be submitted ) to the Comissicners NLT Wednesday, May 18, 19BB,-with an infor-r,ati:n ecpy to the Office of tne Secretary. If the paper is of such a nature that it requires ~ additional ~ time for analytical rev:,ev and comment, the Commissioners and the Secretariat should be apprised of when comments may be expected. DISTE!EUTION: Commissioners I OGC
-1 OIA GPA EDO )
ACRS i SECY i l 1 l 1
)
4 I I
i 1 IN RESPONSE,-PLEASI i'
# ** *" % RETER TO: MB71222 / 'c, UNITED ST ATE s
[ " , ,.
') e NUCLE AR REGULATORY COMMISSION usmeto .o.c sosu ACTION - Thompson, NM15 1 f
g r ! Cys: Stello i Tebruary 24, 1988 TtyiOY
'% * . . * *E . Rehm {
Murley I D" *'*'*** LIMITED DISTRIBUTION Murray ) stena" MEMORANDUM TOR: Victor Stello, Jr. Executive Director for Operations - gc., ggt I TROM: Df'uelJ.Chilk, c Secretary CLJ 4
SUBJECT:
STATT REQUIREMENTS - BRIETING BY EXECUTIVE 69 B RAN CH , 10:00 A.M., TUESDAY, DECEMBER 22, 1987, CHAIRMAN'S CONTERENCE ROOM, D.C. OTTICE jF b,s' (CLOSED--EX. 1) . The Commission was briefed by members of the Executive Branch and the NRC staff on the NSC's December 16, 1987, response to the NPC's letter of July 1985 to Mr. McTarlane. The Ccmmission requested that the staff continue its close contacts with the Executive Branch agencies and advise the Commissien premptly of any changes in its assessment of the present threat level at NRC licensed facilities. The Commissien (with Chairman Zech and Commissioners Carr and ) Rogers agreeing) requested that the staff provide a Commission paper discussing a range of options for paper contingency planning which could be taken to counteract a possible surface vehicle threat up to and including a vehicle bomb at power reactors and Categcry I fuel cycle facilities. The staff sheuld provide their recommended regulatory directive and a proposed method for implementation as well as a summary of any current industry initiatives. The Commission vould also like ; to hear specifically what the Department of Energy has done in ' terms of mitigation and contingency planning. l' (EDO) (SECY Suspense 3/16/88) Commissioners Roberts and Bernthal do not beli' eve that an options paper is necessary; they believe that the staff should prepare fer Cc= mission approval an appropriate regulatory directive that would require licensees to prepare contingency plans that would serve as a basis for action to respond to notification of a vehicle bomb threat. Commissioner Roberts believes that this action is prudent and is dictated by a need that the utility and especially those at the plant site be informed and' ready in the unlikely event of an actual threat. i ec: Chairman Zech
,, Commissioner Roberts Commissioner Bernthal Commissioner Carr Commissioner Rogers OGC (H Street)
GPA ENCLOSURE 1
p.m..,8
?
i M'\ .. f ri . Ls.....j
'>&f !
March 31, 199E POUCY ISSUE stcr-ss-toi (Notation Vote) 1 Fe-: The Commissioners { 1 Fro ~: Vitter Stello, Jr. Acting Executive Director for Operations Subiect: DESIGN BASIS THREAT - OPTIONS FOR C0tlSIDERATION Purocse: To provide the staff's evaluation of options identified in the staff requirements memorandum of February 7,1986 concerning the design basis threat. An additional option has been included in response to Commissioner Bernthal's request in the memorandum of February 12, 1966 to discuss ' contingency" planning. Ea c k:round: On January 28, 1986 the staff briefed the Commission on the status of on-going activities related to current deliberations on the design basis threat. In response to the staff's presentation, the Conmission requested a staff evaluation of specific options the Com.ission desired to consider further, along with a staff recommendation. Each option is identified and discussed below. In addition, the issue of open vehicle gates and unchecked vehicle access at nuclear power facilities was raised at ' the January 28th neeting. In the interest of clarity, Enclosure I provides details concerning present practice regarding vehicle access controls at operating power reactors. (The Connission's request regarding clearances for tilI1 ARC . personnel has been addressed by March 19, 1986 memo to the Chairman.) f Octions: 1. Await Other Acency Response i T1,is option would pe'mit an NRC decision regarding the I design basis threat that would reflect national level ' policy guidance. The response might provide specific . guidance for necessary actions and pemit an NRC approach to the issue that is consistent with other federal
. a;encies. This option vould avoid the possibility-of prenature action or implementation of policy ;
CONTACT: J. J. Cavidson, INSS
~
42-74708 D. J. Kasun, tv.SS 42-74771 ENCLOSURE 2
4
~
inconsistent with national guidence. On !! arch A,1985 contact was made regarding the status of the response to issues raised by the IRC. The response indicated that the matter was being pursued with other federal agencies. No follow-on response date was identified. The disadvantage of this option is that it could further delay a Commission decision. Also the possibility exists that the final response might not provide substantive guidance. In regard to our interactions with the Ocpertecnt of Ercrgy on comparability, a response to Secretary Herrington was forwarded on March 14, 1986. On the natter of compara-bility we reconnended that the effort proceed without any further delay.
- 2. Vehicle Denial System for Roadway Access to Power Reactor Sites .
This option would revise the design basis threat
- and provide for a vehicle denial system only in the immediate area of existing vehicle gates. Supplemental denial systems include hyJraulic barriers, concrete bo11ards-(i.e., heavy posts anchored in the ground), planters or other 5tructural obstacles that would provide increased penetration resistance near vehicle gates, and a possible deterrent effect. The remaining protected area perimeter would remain vulnerable to vehicle penetration.
Existing safeguards systems and. plant structural design features at power reactors already provide some defenses against vehicle attack. Even though perimeter chain link fences will not prevent vehicle intrusions, the current requirement of prompt response by guards armed with shoulder-fired weapons would limit actions of intruders. Furthermore, staff believes that the design features that enable safety-related equipment to withstand floods and - tornadoes, and structures to withstand eart! Qakes, etc., would also protect :against danage from the vehicle used as a battering ran at most facilities. Accordingly, while the' addition of vehicle barriers would . improve the defensive posture of the site, they might not constitute a substantial overall . increase in the public health ~ and safety.
- kb CFE 73.1 would be r'odified to add a road vehicle as a tool for breaching vehicle gates. This edification would not include vehicle delivered explosives.
-___m___--._ _ _ _ _ _ . _
, 1 Cost estimates and an implementation plan are contained in ;
Enclosures 2 and 3, respectively. ll 3 Vehicle Denial System for Land Access to Power Reactor Si te s This option would revise the design basis threat
- and provide ,
for a vehicle denial system for the land portion of the ; protected area perimeter. System components would include- l those identified in Option 2, plus cabling in the fence, and additional bollards and revetments. This system would j deny vehicle access to the protected area at the existing ! protected area boundaries. + However, as noted under Option 2, operating reactors by virtue of design features already protect against natural disasters. These same features also provide some degree of protection against~ damage from a vehicle. The addition of a circunferential vehicle denial ystem would certainly increase the level of security, however would only incrementally contribute to the public hecith and safety for the same reasons stated under Option 2. Cost estimates and an implementation plan are contained ) in Enclosures 2 and 3, res pectivelys i
- 4. Security Pesponse Planning (For protection against vehicle l transported explosives at power reactors and fuel cycle j sites - Commissioner Bernthal's February 12, 1986 menorandum)
This option would provide for security response plans with-out revising the design basis threat .for both near and long-term contingencies in the event that any significant change , to the domestic threat environment occurred. Such planning would enable licensees to quickly respond with temporary . , security measures to a new threat while preplanned permanent l systems were installed. Near-term planning would include rearrangements for rapidly establishing temporary vehicle
*10 CFR 73.1 would be modified' to add a road vehicle as a tool for breaching the protected area barrier at any point accessible to such a vehicle. This modification would not include vehicle delivered explosives.
~:.s.
e s
r i 4
' barriers, e.g.. the use of readily available large' trucks. !
Preplanning for permanent systens would require the licensee ! to identify those systems and complete the necessary engi. l neering design, drawings, surveys and purchase order spect. fications. Such planning might not be possible at certain sites because public lands, highways, railroads and private-property might fall within the required standoff'20ne. ~] ! Response plans would require periodic review and
. upda ting. Additional information is provided in l Enclosures 2 and 3. i i
Bac kfit Considerations j Options 2, 3 and 4 are considered to be potential backfits under 10 CFR 50.109. However, it does not appear (although- ' the required analysis has not been prepared) that these proposed new requirements meet the criteria necessary to support a backfit action. j Fecommendetion: In response to the Commission's request for a staff recommen. detion on the specific options identified by the Cmanission (and Commissioner Eernthal), the staff reconnends Option 1 ( Aveit Other Agency Respense) and. Option' 4 -(Security Response Planning).
. .-,..ne .
f'~
, .;;, .,' ?' ., b -. ,'.,*.7, Victor Stello, Jr..
Acting Executive Director for Operations Enclosures :
- 1. Vehicle Access Controls
- 2. Estimated Cost of Options
- 3. Implementation of Options J
1 i
*'(
l i 4 I Commissioners' co=ments or consent should be provided directly . ) te the Office of the Secret: ty by c.o.b. Wednesday, April 16, ;
)
1986. i Cc= mission Staff Office comments, if any, should be submitted j to the Commissioners NLT Wednesday, April 9, 1986, with an i information copy to the Office of the Secretary. If the paper is of such a nature that it requires additional time for analytical review and comment, the Commissioners and the Secretariat should be apprised of when comments may be expected. i DISTRIBUT CN: Co= mis sione rs ! OGC , l OPE 01 OCA OIA OPA RIGIONAL CTTICES 1 EDO ELD j ACRS ASLEP ASLAP SECY I l 4 l l .,,
=
l
- 8. lacktreurd
~
During a January 26, 1986 Commission meeting on the design basis threat, Com=issioner Bernthal stated that be had observed several instances of open vehicle gates and unchecked vehicle access into power reactor sites. j This analysis addresses these concerns. ! 1 I Current R e q u i r eme nt s ! 11. Regulations in Part 73 require for plants with operating licenses that vital equipment be protected by at least two physical barriers, one of which is normally a fence around the perimeter. In addition, means to detect penetration of the protected area must be provided, usually by electronic devices. Co=sitzents to these requirements are contained in licensee approved security plans. An open, unattended vehicle gate would be a severe violation of both the security' plan and tht regulations. l Other regulations in Part 73 require that personnel entering a protected l area (including vehicle operators) be identified and searched prior to entry. The vehicle itself must be searched (cab, engine compartment, undercarriage and cargo area) for items that could be used for sabo-tage purposes, and upon entry into the protected area be escorted by a member of the security organization. Commitments to these safeguards are also found in licensees security plans. l A licensee that pernitted a vehicle to enter a protected area unchecked , l vould be guilty of seven violations related to the rules governing: l l 1
- authorization for entry perimeter barrier
- intrusion detection
- driver identification
- driver search
- vehicle search
- vehicle escort III. Com=ents Tre= Regional Safeguards Personnel Regietal safeguards personnel have stated that they are unaware of any l instances at plants with operating licenses of vehicle gates being I "left open", or of vehicles entering a protected area unchecked and un- -
searched.* Standard procedure for vehicle entry involves: ,
- stopping the vehicle n.
%Certain allevances are made for security vehicles en duty, emergency vehicles, and dedicated licensee work vehicles.
ENCLOSURI 1 l
t
- 2.
- l
)
- identifying and searching the driver and passengers
- searching the vehicle
- assigning an escort
- opening the vehicle gate under the surveillance of armed guards l
- closing the gate .
1 Note that empicyee vehicles are excluded from entry into the protected area. ' IV. Conclusion - l Based cn information from Regional safeguards personnel no specific- j instances of uncited violations of vehicle access were identified. It i should be noted that control requirements apply at the protected area of I power reactors (and fuel plants) that have operating licens es. These re- f' quirements do not apply to plants und+r construction or at the boundary of the ovner controlled area that surrounds but is outside of the site protected area. s b l l 9 e
'O s },
e
1 J ( j I
)
i m' , 5 4
- r. -<
a - m o E w u d
- .m 2
1 i
=8 a 3 G
C a 2 ,- 5 W E E -
- E' "
G u .5 w 5
- f = Ep' 9
< m5 m W
w G w a -
= C E
- E g g m
M w mMa C m m
~
. ae
= = = v s W E, ee u e .
e w
.- g E w e
5 .- 5 . t g . .
;- s 2 - o - a . s .c 8
v . = g< W .a_ . .- m - _, v .. E i
- S W 3 * "' ~
E c" w # ek i nE5 MG E 5 5 g m g 5 .' 3a e < - . m < w ,_
- u =
m v m. m o g e x 3 5 E w w a g w = I b a S E a a 8 *e E= 8= i *- 2 m - W = u g W t 5a < s
< g g eiE .
8 a J d' a e E ~ 5 * ' g a E. E$
*5-i e
=
=8 ----o 5 O M E g*s.
g EE5-
-_ o m -l .
g, g l
= m v Eo v "8 W < *s $e =, W g' a
w 5 e ~
* *, s b e cv E M 5 % >
a:-
- e a o == < m -o v - a e, a: w a 55 8 -~ t E 8 3 g .* *
- 2 =
- a. u m
o u w
= 2
= --
- .- E .. m w .
w e.
=$$tm m
. . 1 o o o o a Y a o l E .
E l E
- 2 1 i
en n
.E 3 I
ENCLOSURE 2
a
. .]
i
} ,
M i E J 1
.C 1
& 1 L 1 O l W
W W i E J
& l
" CC ll C -
6 j CC C 4
>= 4 i
. CC W 4 3 E 3 o w W o u . w su
*= . E ao m CL W J >
W k W W >W p aC N"' i W aC E > U M M i W cc p. w E- t E M C E E W 4 W M 2- E W 3 E >= E U E w
< 8 ga:
E C 5 A 5 8J at E E O 5 A. EE
~
O j C et - 6 W. W W i M C E A A C 1
. t c W = E . A U D '
N W C C 4 en g #
" J L en O M M W
a
- w t= .D R 6 E 1 L et 8 :: E CL e < E *= !
o >= *C E W m e' 3 * >= l M *='* La.8 >= E E gr u 44 M E -
> CC > W 8L aC >= >= W '
E .Z W C ==
> C .,,,a . W- O p f5 W w
- W '
> -I c,. = W # 2 to E
- E < O - m W g ee e. c. J W aC 1
>= W W E E U > W W m E . > W l W >= >= aC C
- s. W >= m e .R= W W U W b.- O
> W W O 6 >= U C E E e CC P* >= et C E E W sK E E O M eg W Q C w et8 - M 4 Q W
E U *= = E E C L 6 a. - w 2. W W w E Ce C - W U w m w E - ac ' w > , O C W D E O. W W E *** t* W W W *$ 1 W U W & W V
==
C M W wCL M gt' J g Oc g E m W E W
- g,,
=J L j CC = 6 E "cc C E CE' aut w o y > g g et to ,
O C == W C < Q >= p A p. >= 66 e Q > W J 6 .& Oa E M w o -
- W C C C A M E 3 a to a W C >- oc to e U m C.-
t C
** W >= E F t== 6f'8 >* 2 E E E es> W W l W C 6 M C W E
- C2 > U et C .,3 C >= cc >= i CC W C w *= C M w ,,a ,,,J go eo E C to E J O V W C et 4 Cl go a gg >= c w w
c W =J 8 aC, t- E O
>- w A
w w m
* <, p w co( ==
W e-. - J -l U W W N J =J
< C O g o-w ,,,J w . Oc w *= < M 6 ag ,,J U aC ,,J A w
O p-. U W >= >= C D M. 6 >= E gg w >= w c6 E A M M th C K E W M 8C W C w > ta > W ( '
>=
to E E E O E w O W
*==
A O tr *= m e8> eC
- to 50 l 3 kWg go e c w en @{ oi=
C o o C o e o o E w to
.= . CE 1 o
W J. W 5 m
>=' E.c p
b .
%O. = ., .
1
. , j 1.
en '
- 4 8
c \ b b
- # w -
5 S e s 5 - E g g = . . . 1 g o - g -= = = ,
-W E e E
., g - *
=@
c3g I ! *= I- E E
$ *'E e N I-" C -8 !
!l =
3 3 e=5 4 W W .
~ E2*
a WEEa xs-
= 5 -E 1
n m=a=g5 Eg * - 5 c eE c m x
~
m = ~
~
~s
~
w u.. g a m -c iE W - k _, 5, E ~ m = =
- W 5 .a ea ,3 5 OE>E
.c : E 2 * "i # gM 0; *t E 8 m -m ce5as s a = .= 8 5 m g
o
=
e
- 3 W 0
r.
=
o 5 E
= R m o - e
=
S 0
~
t E W E s xa .m= g
~
9
< s v m aeE I ! e.,
J
< eC E * " &"" .h o W d o 3 n.
b E ' M 5B w N .$ .k_
~
3 w d, .h ' M
. t w w .- = w <
- - o o _,
o u . o w 5 s e M EE o yW 5e *
- a=W
..m s"i2
& 5 E 5 o u,
8<=u WE ma-5 5 ga - - S & t; e
- v *- - E v < w ..
mc x "E" Em - = u. o sw 5.4 - w g E E =. E W = i' o = f j f & $ .b Y N M i E E l l . 6$
1 i
ENCLOSURE 3
l E
,; ~ 2= }
e f e k I i I a l e
- M M C M llIll E >= E &
< L K
- a i
.J .J aC A A & W i'
% O A 6- 67 E to ,
O M + C O N j
>=
E E E W 9 1 i C
- W
- C > I ta == m E sa . == J E >= >== CL E >= >= 4 ,
C
.J
( E W O J J
>=
U W O i A ( EX' W A E A E EL % > W 6 CA W W >== W L E W EL to E C O w 4 E L M .J > C w Z .J Ca. J E 1 A W EA 4 C E W 4 . i l to E 4 J ll= s.= >= J W 4
*=ce M L C 4 L E D sa: W == . l C' E E CL E O E
> W c o CL = W
>=
===
E == b < D E M Cr Ea== E O W W C W E D >= O O E E E U E 4 A >= W P1 C C = C M N >= Q 2 l>= W i i
== W E W E A 6 W D < U r= ]
C E ( C 2 40 > W M M M e
>=
4 i E A C W E W D C C E C U M W e== C U *=e A W M M i
.h E Sun b E eus S.
( W O O C E 1 E E E a: >= A >= .J
- C S.
4 w dh. M === EB W W SC e . * *
- l
- A S J3 U T Y E I" b e ,. 4
4 I ENCLOSURE 2 SUPPLEMENTAL INFORMATION l
, q l
':j y ENCLOSURE 2 o l
l SUPPLEMENTAL INFORMATION. d QUESTIONS.FROM PART IV.B 0F THE CRGR. CHARTER'- 4
~
The following requirements apply for proposals to reduce existing requirements ~ or positions as well as proposals to increase requirements or positions. Each. package submitted to the CRGR for review'shall include twenty (20) copies of. the following information: j QUESTION (1): The proposed generic requirements or staff position as it is proposed to be sent out to licensees. t' i..
RESPONSE
The proposed generic requirement is fully discussed in the_ proposed Commission Paper and generic letter. In summary, all power reactor facilities will be I l required to include in their safeguards contingency. plans short . term actions- ' that could be taken to. protect against attempted radiological sabotage involving a land vehicle bomb if such a threat were to materialize. Such contingency planning could involve, but not be limited to, procedures and' advance arrangements-for increases in security and in the operational readiness of a plant. The 4 proposed requirement does not imply any need to alter physicel. protection systems : established under 10 CFR'73.55. l 1 l j QUESTION (ii): Draft staff papers or other underlying staff documents l l l i l
.l
______ _______ _ _ ____-__ _______ . _ - _ _ _ _ _ _ - -- ._-_--____-__--_____a
y m
' Supplemental Information ,, '
.j supporting. the- requirements. or staff. positions. (Acopy-of all materials referenced in the document shall be made.
available upon request to the-CRGR staff. Any committee member i may request CRGR staff to obtain a. copy of any referenced material.forhisorheruse.) RESPONSE: q A. Draft paper from the Executive Director for Operations, to the Commissioners.'
Subject:
Contingency Planning to' Counteract Possible Surface Vehicle Threat, with enclosures. ,
]
i OUESTION (iii): Each proposed requirement or ' staff position shall contain-the sponsoring office's position as to whether the propos-al would increase requirements or staff pcsitions,'imple-ment edsting requirements or staff positions, or. would-relax existing requirements or staff positions.
RESPONSE
The proposed' staff position would represent an increase in requirements. l Contingency plans and procedures have not previously been required to consider surface vehicle bombs.
- -- _m-_.u_____m m_._____
Supplemental Information QUESTION (iv): The proposed method of implementation along with the concur-rence (and any comments) of OGC on the method proposed.
RESPONSE
Pursuant to 10 CFR Part 73, Appendix C, safeguards contingency implementing procedures need not be submitted to the Commission for approval, but will be inspected by the NRC staff on a periodic basis. It is intended that inspection of these procedures will be included in routine inspections commencing approx-imately six months from the date of the generic letter. If conforming changes are necessary to the first four categories of information in the contingency plan (Background, Generic Planning Base, Licensee Planning Base, and Pesponsi-bility Matrix), they may be made in accordance with 10 CFR 50.54(p)(2), since providing for additional contingency planning would not decrease the effec-tiveness of contingency plans. A representative of OGC's Division of Rulemaking and Fuel Cycle informally concurred in this method of implementation and helped to draft the generic letter. Formal OGC legal review is being sought concurrent with CRGR review. 0GC comments will be considered during final revisions to the generic letter. 4 QUESTION (v): Regulatory analyses generally conforming to the directives and guidance of NUREG/BR-0058 and NUREG/CR-3568.
il - Supplemental Information - ' RESPONSE: 'l The backfit analysis performed for this-proposed backfit generally conforms-to the directives and guidance of NUREG/BR-0058, "RegulatoryJ Analysis. Guide z ,
-i lines of the U.S. Nuclear Regulatory Commission," and NUREG/CR-3568, "A' !
Handbook for Value-Impact Assessment." Due.to the inherent difficulties;of: i quantifying the sabotage threat, the analysis does not attempt to estimate the j reduced core melt probability due to the proposed backfit. The'backfit-analysis is included as Enclosure 4'to the draft Commission Paper.. QUESTION (vi): Identification of the category _ of reacto'r plants to'which the
. generic requirement; or staff position 154 to apply (that is, whether it is to apply to new plants only new OLs' only, OLs after a certain date, OLs before a certain'date, all.0Ls, all 1
plants under construction, all' plants, all water.' reactors', all PWRs only, some vintage types such as WR 6 and 4. jet pump and nonjet pump plants, etc.).
RESPONSE
l 'l Tne proposed backfit will apply to all commercial power reactor facilities.. y
, QUESTION (vii): For each such category of reactor plants, an evaluation j which demonstrates how the action should be prioritized I and schec:uled in light of other ongoing regulatory activi-ties. The evaluation shall document for consideration ]
l l _-________.-_-____.---__LA
q Supplemental Information -5 '
]
tj information available concerning any of the followingi factors as may be appropriate and any other information relevant and material to the proposed action: l QUESTION (vii)(a): Statement'of the specific objectives that the proposed l 1 action isl designed to achieve;
RESPONSE
I The objective of the proposed backfit is to ensure. that all. commercial reactor facilities have prepared contingency plans for short term actions t'o deal with a possible vehicle bomb threat, should one arise. l
.\ '
QUESTION (vii)(b): General description of the activity that would be required by the licensee or applicant in order to complete.the action;
RESPONSE
Reactor licensees following the methodology suggested in the. guidance (NUREG/CR-5246, enclosure 3 to the attached Commission Paper) to be supplied . with the generic. letter would be expected to: l ,
- 1) Identify system options available to establish and maintain safe shutdown conditions, j 1
_ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ . _ _ . _ a
Supplemental Information 2) Identify buildings containin', components and equipment associated with each systein option. l l 3) Determine " survivability envelopes" for the system options.
- 4) Review cite features to determine land vehicle access approach paths and distances.
- 5) Identify short-range measures to limit or thwart vehicle eccess and protect and preserve preferred system options.
- 6) Prepare plans and make advance arrangements to facilitate the short-range contingency measures in the event a land vehicle bomb threat arises.
- 7) Prepare appropriate contingency procedures.
This activity may also require licensees to modify portions of their site-specific contingency plans. QUESTION (vii)(c): Potential change in the risk to the public from the accidental offsite release of radioactive material;
I
- 1 Lj Supplemental Information -
RESPONSE: i
'l The risk to the public from sabotage-induced offsite release of radioactive ~j material is dominated by the probability that radiological sabotage.would be attempted. The probability of an attempt cannot be quantified. There'han'not. j been a credible vehicle bomb threat against the commercial nuclear industry in the past, nor is there any' indication that such a threat exists' today. To l the extent that a credible vehicle bomb threat could develop in the future, _
the proposed short-term contingency planning would help limit risk to the public .i during the transition to permanent protective measures warranted by the new threat environment, s QUESTION (vii)(d): Potential impact on radiological exposure of facility-employees and other onsite workers. _ RESPONSE: The proposed action is restricted to planning and has no impact on radiological exposure of facility employees, except to the extent that it could reduce the chance of radiological release resulting from a land-vehicle bomb. QUESTION (vii)(e): Installation and continuing costs associated with the action, including the cost of facility downtime or the cost of construction delay; e
- - - - - . . - - . . + - - . - _ - - - ~ . - . - - .
_ - . _ _ _ ~ _ _ _ . . _ - - -
Supplemental Information l The only costs are for analysis and preparation of contingency plans and procedures.- The estimated average burden hours for the requested contingency planning is estimated to be in the range of 350 to 500 man-hours per' power reactor site (assuming that multiple units at one site are similar in design and construction), iricluding assessment of the new requirements, analyzing options, and preparing contingency plans and procedures. QUESTION (vii)(f): The potential safety impact of changes in plant or operational complexity, including the relationship to proposed and existing regulatory requirements and staff positions;
RESPONSE
The backfit does not alter the plant or operational complexity. It does not involve a reduction in margin of safety since neither plant design nor operating procedures are changed. In eddition, it does not alter any safety-related design basis of the fecility. Therefore, the backfit neither creates the possibility of a new or different kind of accident nor does it involve an increase in the probability or con-l- sequence of an accident previously evaluated. 1 __m.m_______ _ -___
1 Supplemental Information QUESTION (vii)(g): The estimated resource burden on the NRC associated with the proposed action and the availability of such resources;
RESPONSE
The estimated resource burden on the NRC is expected to be one staff-day per-reactor site for inspection of contingency plans and procedures. This will-be a one-time inspection to ensure that licensees have addressed the land vehicle bomb in their contingency plans. A Temporary Instruction will be. issued for NRC inspectors within six months of the issuance of.the generic letter. Subsequent-inspection effort will be subsumed in NRC's routine inspection _ program addressing safeguards contingency plans. (Inspection Procedure 81601) J l QUESTION (vii)(h): The potential impact of differences in facility type, design or age on the relevancy.and practicality of the proposec action;
RESPONSE
Differences in facility type, 6esign or age have no significant impact on.the relevancy and practicality of the proposed backit. ')' i QUESTION'(vii)(i): Whether the proposed action is lr.tcrim or final, and if interim, the justification for irr. posing the proposed l action on an interim basis. j l i _ - - - ._-_______-__a
'l Supplemental Information j l
RESPONSE
Based on current knowledge and circumstances, the proposed backfit is final. .j If a credible land vehicle bomb threat materialized in the future, staff would i recommend that the safe' guards contingency procecures developed as a result of j 1 this action be implemented as an interim measure pending permanent protective i actions for dealing with the new threat environment. I QUESTION (viii): for each evaluation conducted pursuant to 10 CFR 50.109,- ' the proposing office director's determination, together with the rationale for the determination based on the I considerationsofparagraphs(i)through(vii)above,that . (a) there is a substantial increase in the overall protection of public health and safety or.the common defense and security to be derived from the proposal; j and (b) the direct and indirect costs of implementation, for l I the facilities affected, are justified in view of this increased protection. l i L , i I _ _ _ - _ - - _ _ _ - _ - _ _ _ _ _ - _ - _ - - - _ - - _ _ _ _ _ _ _ A
Supplemental Information" . RESPONSE: Improvements in safeguards requirements are not amenable to the conventional cost / benefit analysis approach. .This is because radiological sabotage cannot be quantified in terms of overall' contributions'to core melt probabilities except in terns of gross assumptions as to the probability of sabotage attempt. To the extent that a credible vehicle bomb threat could develop in the future, the proposed short-term contingency planning could significantly_ increase the overall protection of.the public health and safety or the common defense and security end the direct costs of-implementing the backfit are justified in view of the' potential increased protection, QUESTION (ix): For each evaluation conducted for proposed relaxations ~or' decreases in current requirements or. staff positions, the-proposing office director's determination. together with the rationale for the deterr.:ination based on the considerations of paragraphs (1) through (vii) above, that
)
(a) the puMic health and safety and the common' defense and
~
security would be adequately protected if. the proposed reduction in requirements or positions were implemented, l-and I (b) the cost savings attributed to the action would be sub- -) J ster.tial enough to justify tehing the action. l 4 i _- __-_a_=___ _ _ _ A
Suppleraental Ir: formation RESPONSE: This question is not applicable in that the proposed action would represent an increase in current requirements. 1 l I i i _ _ _ _ _ _ _ _ _ _ _ _ -}}