NG-17-0235, Attachment 1: Duane Arnold Energy Center, License Amendment Request TSCR-166, Redline Markup of NEI 99-01, Revision 6. Part 2 of 2

Attachment 1: Duane Arnold Energy Center, License Amendment Request TSCR-166, Redline Markup of NEI 99-01, Revision 6. Part 2 of 2

ML17363A072
Person / Time
Site:	Duane Arnold
Issue date:	12/15/2017
From:	NextEra Energy Duane Arnold
To:	Office of Nuclear Reactor Regulation
Shared Package
ML17363A067	List: ML17363A069 ML17363A071 ML17363A072 ML17363A074 ML17363A075 ML17363A076 ML17363A078 ML17363A079 ML17363A082 ML17363A083 ML17363A085 ML17363A086 ML17363A088 ML17363A098 NG-17-0235, Attachment 1: Duane Arnold Energy Center, License Amendment Request TSCR-166, Redline Markup of NEI 99-01, Revision 6. Part 1 of 2 NG-17-0235, Attachment 1: Duane Arnold Energy Center, License Amendment Request TSCR-166, Redline Markup of NEI 99-01, Revision 6. Part 2 of 2 NG-17-0235, Attachment 2: Duane Arnold Energy Center, License Amendment Request TSCR-166, Clean Copy of the Proposed DAEC EAL Scheme NG-17-0235, Duane Arnold Energy Center - Calc No. NEE-323-CALC-003, Documentation of the RU1 Emergency Action Levels NG-17-0235, Duane Arnold Energy Center EAL Classification Matrix Hot Conditions (Modes 1, 2, 3) NG-17-0235, Duane Arnold Energy Center, Calc No. NEE-323-CALC-001, Primary Containment Radiation EAL Threshold Determination NG-17-0235, Duane Arnold Energy Center, Calc No. NEE-323-CALC-002, Dose Rate Evaluation of Reactor Vessel Water Levels During Refueling for EAL Thresholds NG-17-0235, Duane Arnold Energy Center, Calc No. NEE-323-CALC-004, Revised Liquid Radiological EALs Per NEI 99-01 NG-17-0235, Duane Arnold Energy Center, Calc No. NEE-323-CALC-005, Revised Gaseous Radiological EALs Per NEI 99-01 Rev. 06 NG-17-0235, Duane Arnold Energy Center, Calc No. NEE-323-CALC-005, Revised Gaseous Radiological EALs Per NEI 99-01 Rev. 6 NG-17-0235, Duane Arnold Energy Center, Calc No. NEE-323-CALC-006, Correlation of Drywell Radiation Monitors for 300 Uci/Gm Dose Equivalent Iodine NG-17-0235, Duane Arnold Energy Center, License Amendment Request TSCR-166, Adoption of Emergency Action Level Scheme Pursuant to NEI 99-01, Revision 6, Development of Emergency Action Levels for Non-Passive Reactors. NG-17-0235, EAL Classification Matrix Cold Conditions (Modes 4,5, and Defueled)
References
NG-17-0235
Download: ML17363A072 (162)

Text

B'WR DAEC RCS BARRIER THRESHOLDS:

NEI 99 0 I (Revision

6) November 2012 The RCS Barrier is the reactor coolant system pressure boundary and includes the RPV and all reactor coolant system piping up to and including the isolation valves. 1. Primary Containment PressureConditions Loss I.A The (site specific value) primary containment2 psig pressure is the drywell high pressure scram setpoint which indicates a LOCA by automatically initiating the-ECCS or equivalent makeup system . .,_ There is no Potential Loss threshold associated with Primary Containment Pressure.

DeYeleper Netes: 2. RPV Water Level Loss 2.A This v,rater l+ 15 inches e-vel-c orresponds to the top of active fuel (T AF) and is used in the EOPs to indicate challenge to core cooling. The RPV water level threshold is the same as Fuel Clad barrier Potential Loss threshold 2.A. Thus , this threshold indicates a Loss of the RCS barrier and Potential Loss of the Fuel Clad barrier and that appropriately escalates the emergency classification level to a Site Area Emergency.

This threshold is considered to be exceeded when , as specified in the site specific EOPs , RPV water cannot be restored and maintained above the specified level following depressurization of the RPV (either manually , automatically or by failure of the RCS barrier) or when procedural guidance or a lack of low pressure RPV injection sources preclude Emergency RPV depressurization EOPs allow the operator a wide choice of RPV injection sources to consider when restoring RPV water level to within prescribed limits. EOPs also specify depressurization of the RPV in order to facilitate RPV water level control with low-pressure injection sources. In some events , elevated RPV pressure may prevent restoration of RPV water level until pressure drops below the shutoff heads of available injection sources. Therefore , this RCS barrier Loss is met only after either: 1) the RPV has been depressurized , or required emergency RPV depressurization has been attempted , giving the operator an opportunity to assess the capability of low-pressure injection sources to restore RPV water level or 2) no low pressure RPV injection systems are available , precluding RPV depressurization in an attempt to minimize loss of RPV inventory. 133 BWR DA.EC RCS BARRIER THRESHOLDS:

---

NEJ 99 01 (R e ,*isioR 6) No*1 eFRber 2012 The term , "cannot be restored and maintained above ," means the value of RPV water level is not able to be brought above the specified limit (top of active fuel). The determination requires an evaluation of system performance and a v ailability in relation to the RPV water level value and trend. A threshold prescribing declaration when a threshold value cannot be restored and maintained above a specified limit does not require immediate action simply because the current value is below the top of active fuel , but does not permit extended operation beyond the limit; the threshold must be considered reached as soon as it is apparent that the top of active fuel cannot be attained.

134 DAEC RCS BARRIER THRESHOLDS

{cont.): NEI 99 0 I (Revision

6) :Jl,Jovemeer 2012 In high-power A TWS/failure to scram events, EOPs may direct the operator to deliberately lower RPV water level to the top of active fuel in order to reduce reactor power. RPV water level is then controlled between the top of active fuel and the Minimum Steam Cooling RPV Water Level (MSCRWL).

Although such action is a challenge to core cooling and the Fuel Clad barrier , the immediate need to reduce reactor power is the higher priority. For such events, ICs SAS or SS5 will dictate the need for emergency classification.

There is no RCS Potential Loss threshold associated with RPV Water Level. 3. RCS Leak Rat e Loss Threshold 3.A Large high-energy lines that rupture outside primary containment can discharge significant amounts of inventory and jeopardize the pressureretaining capability of the RCS until they are isolated.

If it is determined that the ruptured line cannot be promptly isolated from the Control Room , the RCS barrier Loss threshold is met. Loss Threshold 3 .B Emergency RPV Depressurization in accordance with the EOPs is indicative of a loss of the RCS barrier. If Emergency RPV Depressurization is performed , the plant operators are directed to open safety relief valves (SR Vs) and keep them open. Even though the RCS is being vented into the suppression pool, a Loss of the RCS barrier exists due to the diminished effectiveness of the RCS to retain fission products within its boundary.

Potential Loss Threshold 3 .A Potential loss of RCS based on primary system leakage outside the primary containment is determined from EOP temperature or radiation Max Normal Operating values in areas such as main steam line tunnel , RCIC , HPCI, etc., which indicate a direct path from the RCS to areas outside primary containment.

A Max Normal Operating Limit (MNOL) value is the highest va lue of the identified parameter expected to occur during normal plant operating conditions with all directly associated support and control systems functioning properly.

135 BWR DAEC RCS BARRIER THRESHOLDS:

}lei 99 QI (Re'>'ision

6) }fo*,cember 2012 The indicators reaching the threshold barriers and confirmed to be caused by RCS leakage from a primary system warrant an Alert classification. A primary system is defined to be the pipes , valves, and other equipment which connect directly to the RPV such that a reduction in RPV pressure will effect a decrease in the steam or water being discharged through an unisolated break in the system. An UNISOLABLE leak which is indicated by Max }formal OperatingMNOL values escalates to a Site Area Emergency when combined with Containment Barrier Loss threshold 3.A (after a containment isolation) and a General Emergency when the Fuel Clad Barrier criteria is also exceeded. DAEC RCS BARRIER THRESHOLDS (cont.): De¥eleper Netes: Loss Threshold 3 .l* .. The list of systems included in this threshold should be the high energy lines vmich , if ruptUred and remain uni so lated , can rapidly depressurize the RPV. These lines are typically isolated by actuation of the Leak Detection system. Large high energy line breaks such as Main Steam Line (MSL), High Pressure Coolant Injection (HPCI), Feed 1.vater , Reactor Water Cleanup (RWCU), Isolation Condenser (IC) or Reactor Core Isolation Cooling (RCIC) that are illHSOLABLE represent a significant loss of the RCS barrier. 4. Primary Containment Radiation Loss 4.A The Drywellradiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the primary containment , assuming that reactor coolant activity equals Technical Specification allowable limits. This value is lower than that specified for Fuel Clad Barrier Loss threshold 4.A since it indicates a loss of the RCS Barrier only. There is no Potential Loss threshold associated with Primary Containment Radiation. Develeper Netes: The reading should be determined assuming the instantaneous release and dispersal of the reactor coolant noble gas and iodine inventory , with RCS activity at Tech.'1:ical Specification allowable limits, into the primary containment atmosphere. Using RCS activity at Technical Specification allov,rable limits aligns this threshold v,ith IC SU3. Also , RCS activity at this level *.vill typically result in primary containment 136

llWR RCS BARRIER THRESHOLDS

Jl.+eJ 99 0 I (RevisioR

6) November 2012 In some cases , the site specific physical location and sensitivity of the primary containment radiation monitor(s) may be such that radiation from a cloud of released RC8 gases cannot be distinguished from radiation emanating from piping and components containing elevated reactor coolant activity.

If so , refer to the Developer Guidance for Loss/Potential Loss 5.A and determine if an alternate indication is available.

5. Other Indications T here are no Loss or Potential Loss thresholds associated with Other Indications. Developer Notes: Loss and/or Potential Loss 5.A Developers should determine if other reliable indicators exist to evaluate the status of this fission product barrier ( e.g., review accident analyses described in the site Final Safety Analysis Report, as updated). The goal is to identify any unique or site-specific indications that will promote timely and accurate assessment of barrier status. Any added thresholds should represent approximately the same relative threat to the barrier as the other thresholds in this column. Basis information for the other thresholds may be used to gauge the relative barrier threat level. 6. Emergency Director Judgment Loss 6.A This threshold addresses any other factors that are to be used by the Emergency Director in determining whether the RCS barrier is lost. Potential Loss 6.A This threshold addresses any other factors that may be used by the Emergency Director in determining whether the RCS Barrier is potentially lost. The Emergency Director should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Develeper Netes: 138 BWR DAEC CONTAINMENT BARRIER THRESHOLDS:

NET 99 0 I (RevisioR a) *November 2012 The Primary Containment Barrier includes the drywell , the wetwell , their respective interconnecting paths , and other connections up to and including the outermost containment isolation v alves. Containment Barrier thresholds are used as criteria for escalation of the ECL from Alert to a Site Area Emergency or a General Emergency.

1. Primary Containment Conditions Loss 1.A and 1.B Rapid UNPLANNED loss of primary containment drywell pressure (i.e., not attributable to drywell spray or condensation effects) following an initial pressure increase indicates a loss of primary contairunentdrywell integrit y. Primary containmentDrywell pressure s hould increase as a result of mass and energy release into the primary containment from a LOCA. Thus , primary containmentdrywell pressure not increasing under these conditions indicates a loss of primary containment integrity. These thresholds rely on operator recognition of an unexpected response for the condition and therefore a specific value is not assigned.

The unexpected (UNPLANNED) response is important because it is the indicator for a containment b y pas s condition.

Loss l.C The use of the modifier " direct" in defining the release path discriminates against release paths through interfacing liquid systems or minor release pathways, such as instrument lines, not protected by the Primary Containment Isolation System (PCIS). The existence of a filter is not considered in the threshold assessment.

Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to iodine and/or particulate loading beyond design limits (i.e., retention ability has been exceeded) or water saturation from steam/high humidity in the release stream. Following the leakage of RCS mass into primary containment and a rise in primary containment pressure, there may be minor radiological releases associated with allowable primary containment leakage through various penetrations or system components.

Minor releases may also occur if a primary containment isolation valve(s) fails to close but the primary containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of primary containment but should be evaluated using the Recognition Category RI Cs. 139 DAEC CONTAINMENT BARRIER THRESHOLDS:

Loss l.D -----------------------------------}ffil 99 0 l (ReYisioR

• i) }fovember 2012 EOPs may direct primary containment isolation valve logic(s) to be intentionally bypassed.

e v en if offsite radioactivity release rate limits will be exceeded.

Under these conditions with a valid primary containment isolation signal, the containment should also be considered lost if primary containment venting is actually performed. Intentional venting of primary containment for primary containment pressure or combustible gas control to the secondary containment and/or the environment is a Loss of the Containment.

Venting for primary containment pressure control when not in an accident situation (e.g .. to control pressure below the drywell high pressure scram setpoint) does not meet the threshold condition.

DAEC CONTAINMENT BARRIER THRESHOLDS (cont.): DAEC CONTA~l(ENT BARRIER THRESHOLDS:

Potential Loss 1.A The threshold pressure is the primary containmentTorus internal design pressure.

Structural acceptance testing demonstrates the capability of the primary containment to resist pressures greater than the internal design pressure.

A pressure of this magnitude is greater than those expected to result from any design basis accident and , thus , represent a Potential Loss of the Containment barrier. Potential Loss l .B If hydrogen concentration reaches or exceeds the lower flammability limit , as defined in plant EOPs , in an oxygen rich environment , a potentially explosive mixture exists. If the combustible mixture ignites inside the primary containment , loss of the Containment barrier could occur. Potential Loss l .C The Heat Capacity Temperature Limit (HC+L) is the highest suppression pool temperature from which Emergency RPV Depressurization will not raise:

• Suppression chamber temperature above the maximum temperature capability of the suppression chamber and equipment within the suppression chamber which may be required to operate when the RPV is pressurized , OR 140

---

BWR CONTAINMENT BARRIER THRESHOLDS:

}ffil 99 0 I (Revision

6) Noyember 2012 --Suppression chamber pressure abo v e Primary Containment Pressure Limit A , while the rate of energy transfer from the RPV to the containment is greater than the capacity of the containment vent.

• The HCTL is a function of RPV pressure , suppression pool temperature and suppression pool water level. It is utilized to preclude failure of the containment and equipment in the containment necessary for the safe shutdown of the plant and therefore , the inabilit y to maintain plant parameters below the limit constitutes a potential loss of containment.

141 DAEC CONTAINMENT BARRI E R THRESHOLDS (cont.):1-Develeper Netes: Pot e ntial L oss 1.B 1'1"EI 99 0 I (Revision

6) November 20 I? BWR EPGs/8,,\Gs specifically define the limits associated v,ith eJcplosive miJctures in terms of deflagration concentrations of hydrogen and oxygen. For ~4k VII containments the deflagration limits are "6% hydrogen and 5% oxygen in the drywell or suppression chamber". For ~4k III containments , the limit is the " Hydrogen Deflagration Overpressure Limit". The thr e shold term "explosive miJcture" is synonymous v,rith the EPG/8l.1.G "deflagration limits". Potential Loss 1.C Since the HCTL is defined assuming a range of suppression pool 'Nater levels as low as the elevation of the downcomer openings in ~4k I/II containments , or 2 feet above the elevation of the horizontal vents in a ~4k III containment , it is unnecessary to consider separate Containment barrier Loss or Potential Loss thresholds for abnormal suppression pool water level conditions. If desired , developers may include a separate Containment Potential Loss threshold based on the inability to maintain suppression pool water level above the downcomer openings in I/II containments, or 2 feet above the elevation of the horizontal vents in a Mk III containment with RPV pressure above the minimum decay heat removal pressure , if it 'Nill simplify the assessment of the suppression pool level component of the HCTL. 2. RPV Water Level There is no Loss threshold associated with RPV Water Level. Potential Loss 2.A The Potential Loss threshold is identical to the Fuel Clad Loss RPV Water Level threshold 2.A. The Potential Loss requirement for Primary Containment Flooding indicates adequate core cooling cannot be restored and maintained and that core damage is possible. BWR EPGs/SAGs specify the conditions that require primary containment flooding. When primary containment flooding is required, the EPGs are exited and SAGs are entered. Entry into SA Gs is a logical escalation in response to the inability to restore and maintain adequate core coo l ing. 142 BWR CONTA.INMENT BARRIER THRESHOLDS:

l'>IBI 99 01 (Revision

6) November 2012 PRA studies indicate that the condition of this Potential Loss threshold could be a core melt sequence which, if not corrected , could lead to RPV failure and increased potential for primary containment failure. In conjunction with the RPV water level Loss thresholds in the Fuel Clad and RCS barrier columns , this threshold results in the declaration of a General Emergenc y. DeYelopeF Notes: The phrase , " Primary containment flooding required ," should be modified to agree 1.vith the site specific EOP phrase indicating e>cit from all EOPs and entry to the SA.Gs (e.g., dr)'\vell flooding required , etc.). 3. PFima11' Containment Isolation FailuFeRCS Leak Rate These thresholds address incomplete containment isolation that allows an UNISOLABLE direct release to the environment.

Loss 3.A. The use of the modifier " direct" in defining the release path discriminates against release paths through interfacing liquid systems or minor release path>.vays , such as instrument lines , not protected by the Primary Containment Isolation System (PCIS). The e>cistence of a filter is not considered in the threshold assessment.

Filters do not remove fission product noble gases. In addition , a filter could become ineffective due to iodine and/or particulate loading beyond design limits (i.e., retention ability has been e>eceeded) or ,.vater saturation from steam/high humidity in the release stream. Following the leakage of RCS mass into primary containment and a rise in primary containment pressure , there may be minor radiological releases associated with allov ,z able primary containment leakage through various penetrations or system components. Minor releases may also occur if a primary containm e nt isolation valve(s) fails to close but the primary containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of primary containment but should be evaluated using the Recognition Category A ICs. Loss 3.B EOPs may direct primary containment isolation valve logic(s) to be intentionally bypassed , even if offsite radioactivity release rate limits will be e>rneeded.

Under these conditions with a valid primary containment isolation signal , the contair..rnent should also be considered lost if primary containment venting is actually performed.

Intentional venting of primary containment for primary containment pressure or combustible gas control to the secondary containment and/or the environment is a Loss of the Containment.

Venting for primary containment pressure control 1.vhen not in an accident situation (e.g., to control pressure belov,r the drywell high pressure scram setpoint) does not meet the threshold condition. 143 Loss 3.GA NET 99 01 (Revision

6) November 2012 The Max Safe Operating Limit (MSOL) for Temperature and the Max Safe Operating Radiation Level are each the highest value of these parameters at which neither: (1) equipment necessary for the safe shutdown of the plant will fail , nor (2) personnel access necessary for the safe shutdown of the plant will be precluded.

EOPs utilize these temperatures and radiation levels to establish conditions under which RPV depressurization is required. B,¥R CONTAINMENT BARRIER THRESHOLDS:

The temperatures and radiation levels should be confirmed to be caused by RCS leakage from a primary system. A primary system is defined to be the pipes , valves , and other equipment which connect directly to the RPV such that a reduction in RPV pressure will effect a decrease in the steam or water being discharged through an unisolated break in the system. In combination with RCS potential loss 3.A this threshold would result in a Site Area Emergency.

There is no Potential Loss threshold associated with Primary Containment Isolation Failm:eRCS Leak Rate. 144 DAEC CONTAINMENT BARRIER THRESHOLDS

{cont.):t Develeper Netes: Loss 3.B NEI 99 0 I (RevisioR

6) NoYember 2012 Consideration may be given to specifying the specific procedural step i.vithin the Primary Containment Control EOP that defines intentional venting of the Primary Containment regardless of offsite radioactivity release rate. 4. Primary Containment Radiation There is no Loss threshold associated with Primary Containment Radiation.

Potential Loss 4.A The drywell radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the primary containmentdrywell , assuming that 20% of the fuel cladding has failed. The radiation monitor reading for the torus corresponds to an instantaneous release of all reactor coolant mass directly into the torus. assuming that 20% of the fuel cladding has failed. This level of fuel clad failure is well above that used to determine the analogous Fuel Clad Barrier Loss and RCS Barrier Loss thresholds.

NUREG-1228 , Source E s timations During Incident Response to Severe Nucl e ar Power Plant Ac c ident s, indicates the fuel clad failure must be greater than approximately 20% in order for there to be a major release of radioactivity requiring offsite protective actions. For this condition to exist , there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. It is therefore prudent to treat this condition as a potential loss of containment which would then escalate the emergency classification level to a General Emergency.

De1,rel0per Netes: 1'HJREG 1?28 , Source Estimations During Incident Response to Se*;ere Nuclear Pmver Ph:mt Accidents , provides the basis for using the 20% fuel cladding failure value. Unless there is a site specific analysis justifying a different value , the reading should be determined assuming the instantaneous release and dispersal of the reactor coolant noble gas and iodine inventory associated with ?0% fuel clad failure into the primary containment atmosphere.

B\¥R CONTAINMENT BARRIER THRESHOLDS:

5. Other Indications There is no Loss threshold associated with Other Indications Loss and/or Potential Loss 5.A 145 J!.lEI 99 QI (RevisioR e) J!.loYember 2012 Results obtained from procedure PASAP 7.2, Fuel Damage Assessment, indicate at least 25% fuel clad damage. This subcategory addresses other site specific thresholds that may be included to indicate loss or potential loss of the Containment barrier based on plant specific design characteristics not considered in the generic guidance.

PASAP 7.2 only shows whether fuel damage is greater than or less than 25%, thus this indication is not likely to be declared before containment barrier potential loss 4.A which indicates 20% fuel damage. However, this potential loss threshold adds an additional layer of diversity to the scheme. 146 De*,relaper Notes: Loss and/or Potential Loss 5.A l>IEJ 99 0 I (RevisioA e) November 2012 Developers should determine if other reliable indicators exist to evaluate the status of this fission product barrier (e.g., review accident analyses described in the site Final Safety Analysis Report, as updated). The goal is to identify any uruque or site specific indications that 1.vill promote timely and accurate assessment of barrier status. 1\ny added thresholds should represent apprmcimately the same relative threat to the barrier as the other thresholds in this column. Basis information for the other thresholds may be used to gauge the relative barrier threat level. 6. Emergency Director Judgment Loss 6.A This threshold addresses any other factors that are to be used by the Emergency Director in determining whether the Containment barrier is lost. Potential Loss 6.A This threshold addresses any other factors that may be used by the Emergency Director in determining whether the Containment Barrier is potentially lost. The Emergency Director should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

147 00 '<:t" ......

1 HI l1 Hu . * : ilt J 1i1itlf 11 .L . : ilt I ilf t t lf 1 lf lf * . . <t 0 V) ......

-~-----------Jtlh~ IH!1 tln~Ht-* iii* 11 l . Iii . . t---t-----. 0

• J 11 ll: jJ11I *

• t I~* ll .11 J itl

• 1~ ;* u § ii

PWR FUEL CLAD BARRIER THRESHOLDS:

The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets. RCS OF SC Tube Leakage There is no Loss threshold associated vlith Reg or gG Tube Leakage. Potential Loss I .A NEI 99 01 (RevisioR

6) 1'fovember 2012 This reading indicates a redaction in reactor vessel water level sufficient to allow the onset of heat induced cladding damage. DevelopeF Notes: Potential Loss I .A Enter the site specific reacto r vessel water level value(s) used by EOPs to identify a degraded core cooling condition (e.g., requires prompt restoration action). The reactor vessel level that corresponds to apprmcimately the top of active fuel may also be used. For plants that have implemented Westinghouse Owners Group Emergency Response Guidelines , enter the reactor vessel level(s) used for the Core Cooling Orange Path (including dependencies upon the status ofRCPs , if applicable).

Vlestinghouse ERG Plants Developers should consider including a threshold the same as , or similar to , " Core Cooling Orange entry conditions met" in accordance with the guidance at the front of this section. In accordance with EOPs , there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions , classification using threshold is not warranted.

P'\\'R FUEL CLAD BARRIER THRESHOLDS:

Meeting this threshold result s in a gite Area Emergency because this threshold is identical to Reg Barrier Potential Loss threshold 2.A; both will be m e t. This condition warrants a gite Area Emergency declaration because inadequate Reg heat removal may result in fuel heat up s ufficient to damage the cladding and increase Reg pressure to the point 'Nhere mass ,.vill be lost from the s y stem.Potential Loss I .A. This reading indicates a reduction in reactor vessel water level sufficient to allow the onset of heat induced cladding damage. DevelopeF Notes: Potential Loss I .A Enter the site specific reactor vessel ,.vater level value(s) used by EOPs to identify a degraded core cooling condition (e.g., requires prompt restoration action). The reactor vessel level that corresponds to apprmcimately the top of active fuel may also be used. For plants that have implemented Westinghouse Owners Group Emergency Response Guidelines , enter the reactor vessel level(s) used for the Core Cooling Orange Path (including dependencies upon the status ofRCPs , if applicable). Westinghouse ERG Plants Developers should consider including a threshold the same as , or similar to , "Core Cooling Orange entry conditions met" in accordance with the guidance at the front of this section. In accordance with EOPs , there may be unusual accident conditions during \Vhich operators intentionally reduce the heat removal capability of the steam generators

during these conditions , classification using threshold is not ,.varranted. Devel0peF Notes

155

00 V) -

P~'R CONTAINl\llENT BARRIER THRESHOLDS:

NEI 99 0 I (Revision

6) November 2012 The Containment Barrier includes the containment building and connections up to and including the outermost containment isolation valves. This barri e r also includes the main steam , feedwater , and blowdovm line e)ctensions outside the containment building up to and including the outermost secondary side isolation valve. Containment Barrier thresholds are used as criteria for escalation of the EGL from Alert to a Site A.rea Emergency or a General Emergency.

RCS or SC Tube Leakage Loss 1.A This threshold addresses a leaking or RUPTURED Steam Generator (SG) that is also FAULTED outside of containment.

The condition of the SG , v.'hether leaking or RUPTURED , is determined in accordance with the thresholds for RCS Barrier Potential Loss l .A and Loss 1.A, respectively.

This condition represents a bypass of the containment barrier. FAULTED is a defined term within the NEI 99 01 methodology

this determination is not necessarily depend e nt upon e ntry into , or diagnostic steps within , an EOP. For eJcample , if the pressure in a steam generator is decreasing uncontrollably

[p*lrt oftlw FA ULT ED definition]

and the faulted steam generator isolation procedure is not entered because EOP user rules are dictating implementation of another procedure to address a higher priority condition , the steam generator is still considered FAULTED for emergency classification purposes.

The FAULTED criterion establishes an appropriate lower bound on the size of a steam release that may require an emergency classification. Steam releases of this size are readily observable vlith normal Control Room indications.

Th e lower bound for this aspect of the containment barrier is analogous to the lower bound criteria specified in IC SU3 for the fuel clad barrier (i.e., RCS activity values) and IC SU4 for the RCS barrier (i.e., RCS leak rate values). This threshold also applies to prolonged steam releases necessitated by operational considerations such as the forced steaming of a leaking or RUPTURED steam generator directly to atmosphere to cooldovm the plant , or to driv e an au x iliary (eme r gency) feed water pump. These types of conditions will result in a significant and sustained release of radioactive steam to the environment (and are thus similar to a F AULTED condition).

The inability to isolate the steam flov.1 1.vithout an adverse effect on plant cooldown meets the intent of a loss of containment.

Steam releases associated with the eJcpected operation of a SG pmver operated relief valve or safety relief valve do not meet the intent of this threshold. Such releases may occur intermittently for a short period of time follmving a reactor trip as operators process through emergency operating procedures to bring the plant to a stable condition and prepare to initiate a plant cooldown.

Steam releases associated vlith the unexpected operation of a valve (e.g., a stuck open safety valve) do meet this threshold. 163

---* -------

l/) l,O ......

l OLI S!SU8_ "UUinfOO S!ql U! o asn aq ,(um sp1oqsann iaqio aqi lOJ uo!1uuu~:

a umoou puu ,(1am11 a1omo1d II!JA s1 i1m1ua. qons su uoos su 1am aq PJROm'1 . a 1** o1d sampaoo1d i1m1mado ' oua 1am: .. Mi)H*~ Jlf'IWU!"l"O;)

'+/-NffNIWWI . .

• 0 , .... Ul."' )H0-08 "'IJJO ~-*Oj P.n ',., ss~1 f!HJlf'IIOd 10fPU13 sso1 Pl'*!S*.Rll ss91 e '""'!!OJ O!'fd-o ~Y!)HOni!l J v :se101s .!8doJ*""O o1 suapuroqo UiJlSap O!J!Oads 1uu1d uo pasuq ,eureq )HOWY!"l"O;)

"'11 JO SSOf f'l-O *

• SUOll'JOIJJYI

""'llO . Ul fl<:: '°'q1 qlv* oouun1ooou m " 1a U 90UUfH~ .,~'I' +"ll"' t' . *aouun1niJ ouauaiJ aqi lf! pa.1ap!suoo 1ou s .l .d o11s 1oq10 *sassa1ppu AJOiJa1Uoqns S!lli r.

• oq5'>"fl 9!JIOO-s *, * , 01 d JO SSOf a1001pm 01 papnfOU! aq ,(um lUql Spf . . *vg SSO'J fU!lU9l0d 10/PUU ss

• Ulllfl sse1 ""'1 MOIJ MlJds Jlf'IRIY"'I"""

• op ,ad ~ado oq PJR<>qs 1"'11 jQOQ!d111h"f'1'81GhS

'. r o<l,os 8.!Rsseld omoeds "I!' *'!1 **1",-1 SI )H!O<l,os 0JRSS01d )H8WY!"l"09

"'lJ J! !S . HSS<>.!d )HBWYl!JlYOB S8jl)Hj9ll IB'fl Ollf'ln I"! ;) . p SSO'j f'l!l"O!OJ

"'IJ .-.1"~ OSJV *(A!,1ds )H8WY!")H08

'*~*e) SUlOjS>\S j"'!"OO "1 . '!H091! l!JlYO;) 'OI .!!lfRHIS 10 5" e . S!Pj: sum11puoo AJIU* P"11 Jlf'IWU~ " * * . . . "'11 01 *!'!'l**tdda

!OH '! PIOifS""ll

-: , . . *allisop (1M!I) 1019""1f ""0d heYO!lflfOn,-j S fl . *(<,Hf!M, "!"j.!00

• d , p .:i:I *paqoua1 uo1 m u0111puoo O!J!Oa s pa1!sa ;;r ,. *a a1a1ua aq OSfU uuo san{UA 1a1aurorod su qons suo!r .Po~ uo~ *amssa1d 1uauru!u1uoo O!J!Oads 9l!S :, r *EJiml{ UOl}Uli1UtJ9P g ( URHU;uoo 1 uannouoo v+. .

• l a n om aq ,(um u011uJ1uaouoo ua dW 1ua . mru1m eqi Jatua , (um s1ado1aAaQ Cl Oc JeqweAON:

(9 UO!S!A.l~)

IQ 66 fill{

Figure 9 F 4: P"'R Containment Integrity er Bypass Examples Inside Containment Damper RCP Seal Cooling Auxiliary Buildin g Damper AGE IS LEFT BL ----------

.. I I Process ' 172 I Area : Monitor : '-----------1 }IBI 99 0 I (RevisioR

6) November 2012 NEI 99 01 (Revision

6) *November 2012 10 HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY ICS/EALS 17 3 NEI 99 01 (ReYision

6) }aloYember 2012 Table H 1: Reeegnitien Category "H" Initiating Ceeditiee Matrix UNUSUAL EVENT HUl Confirmed SECURITY CONDITION or threatc Op. A/odes: All HU2 Seismic event greater than OBE levels. Op. Modes: All HU3 Hazardous eveffi:-Op. 1\/odes: All HU4 FIRE potentially degrading the level of safety of the plant. Op. },/ode s: All ALERT HAl HOSTILE ,i\,CTION within th e OW1'1ER CONTROLLED A,REA. or airborn e attack threat within 30 minutes. Op. A/odes: All HAS Gaseous release impeding access to equipment necessary for normal plant operations , cooldovm or shutdovm. Op. A1edes: All SITE},.REA. EMERGENCY HS1 HOSTIL E ACTION \Vithin the PROTECTED l\REl\. Op. 1',wdes: All HA6 Control Room HS6 Inability to evacuation resulting control a key safety in transfer of plant function from outsid e control to alternate the Control Room. locations.

n A ,, ,1 4 11 vp. ureotes: 1 tt Op. },lodes: All 174 GENERAL EMERGENCY HGl HOSTILE A.CTION resulting in loss of physical control of the facility. Op. }.fedes: All -------------------, , Table iRteRded for 1:1se by , EAL developers.

lnclu s ioR iR licensee I ,J * * ,J , uocumeRts 1s Rot requ1reu.

1 L------------------*

UNUSUAL EVENT HU7 Other conditions e)cist which in the judgment of the Emergency Director warrant declaration of a(NO)UE. Op. }.fades: All ALERT HA7 Other conditions exist which in the judgment of the Emergency Director 1,varrant declaration of an Alert. Op. },fed-es:

All ECL: Notification of Unusual Event SITE AREA KMERCENCY HS7 Other conditions exist which in the judgment of the Emergency Director warrant declaration of a Site Area Emergency.

Op. },fades: All Initiating Condition:

Confirmed SECURJTY CONDITION or threat. Operating Mode Applicability:

All Emergency Action Levels: NEI 99 0 I (Revision

6) ~Joyemeer 2012 CENERi<\L EMERGENCY HC7 Other conditions exist which in the judgment of the Emergency Director warrant declaration of a General Emergency.

Op. }.fades: All HU1 Example Emergency Action Levels: (1 or 2 or 3) A SECURJTY CONDITION that does not involve a HOSTILE ACTION as reported by the (site specific security shift supervision).DAEC Security Shift Supervision. Notification of a credible security threat directed at the siteDAEC.

A validated notification from the NRC providing information of an aircraft threat. Definitions:

SECURITY CONDITION:

Any Security Event as listed in the approved security contingency plan that constitutes a threat/compromise to site security, threat/risk to site personnel, or a potential degradation to the level of safety of the plant. A SECURITY CONDITION does not involve a HOSTILE ACTION. HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOST AGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. -terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). 175 l>lEl 99 0 I (Revi s ieA 6) l>J eYember 2012 SAFETY SYST E M: A system required for safe plant operation, cooling down the plant and/or placing it in th e cold shutdown condition, including theincluding the ECCS. These systems are classified as safety-related.

Basis: This IC addresses events that pose a threat to plant personnel or SAFETY SYSTEM equipment , and thus represent a potential degradation in the level of plant safety. Security events which do not meet one of these EALs are adequately addressed by the requirements of 10 CFR-§--73.71 or 10_-CFR--§ 50.72. Security events assessed as HOSTILE ACTIONS are classifiable under ICs HAI, HSI and HGl. Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. C la ssification of these events will initiate appropriate threat-related notifications to plant personnel and GR:Goffsite response organization

s. 176 NEl 99 01 (Revision

6) ~loYember 2012 Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan , Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.

177 NEI 99 0 l (Revision

6) November 2012 EAL HUI .1 references (site specific security shift supervision)DAEC Security Shift Supervision because these are the individuals trained to confirm that a security event is occurring or has occurred.

Training on security event confirmation and classification is controlled due to the nature of Safeguards and 10 CFR § 2.39.Q information.

EAL HUl.2 addresses the receipt of a credible security threat. The credibility of the threat is assessed in accordance with Abnormal Operating Procedure (AOP) 914, Security Events. specific procedare). EAL HUI .3 addresses th e threat from the impact of an aircraft on the plant. The NRC Headquarters Operations Officer (HOO) will commw1icate to the licensee if the threat involves an aircraft.

The status and size of the pl a ne may also be provided by NORAD through the NRC. Validation of the threat is performed in accordance with (site specific procedure)

Abnormal Operating Procedure (AOP) 914, Security Events .. Emergency plans and implementing proc e dures are public documents; therefore , EALs should do not incorporate Security-sensitive information.

This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should beis contained in non public documents such as the Security Plan. Escalation of the emergency classification level would be via IC HAI. Devel0peF Notes: The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force. The (site specific procedure) is the procedure(s) used by Control Room and/or Secarity personnel to determine if a security threat is credible , and to validate receipt of aircraft threat information.

Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security sensitive information.

This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location.

Security sensitive information should be contained in non public documents such as the Security Plan. With due consideration given to the above developer note , EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implement i ng procedures.

Such references should not contain a recognizable description of the event. For eJcarnple , an EAL may be worded as "Security event #2, #5 or #9 is reported by the (site specific security shift supervision)." EGL Assignment Attributes:

3 .1.1.A 178 NEI 99 01 (Revision

6) ~J oyember 2012 ECL: Notification of Unusual Event Initiating Condition:

Seismic event greater than OBE levels. Operating Mode Applicability:

All Example Emergency Action Levels: Seismic event greater than Op era ting Basis Earthquake (OB E) as indicated by.;. HU2 -+----receipt of the Amber Operating Basis Earthquake Light and the wailing seismic alarm on 1C35. Definitions:

DESIGN BASIS EARTHQUAKE (DBE): A DBE is vibratory ground motion for which certain (generally, safety-related) structures, systems, and components must be designed to remain functional.

OPERATING BASIS EARTHQUAKE (OBE): An OBE is vibratory ground motion for which those features of a nuclear power plant necessary for continued operation without undue risk to the health and safety of the public will remain functional.

Bas i s: This IC addresses a seismic event that results in accelerations at the plant site greater than those specified for an Operating Basis Earthquake (OB E t An earthquake greater than an OBE but less than a Safe ShutdownDesign Basis Earthquake (8-SBDBE);! should have no significant impact on safety-related systems, structures and components; however , some time may be required for the plant staff to ascertain the actual post-event condition of the plant (e.g., performs walk-downs and post-event inspections). Given the time necessary to perform walk-downs and inspections, and fully understand any impacts , this event represents a potential degradation of the level of safety of the plant. Event verification with external sources should not be necessary during or following an OBE. Earthquakes of this magnitude should be readily felt by on-site personnel and recognized as a seismic event (e.g., typical lateral accelerations are in mrness of 0.08g). The Shift Manager or Emergency Director may seek external verification if deemed appropriate ( e.g., a call to the + Afl QBE is vibratory gro,rnd motion for which those feat1:1res of a fl1:1elear power 13lant n ecessary for continued 013eration without und1:1e risk to the health and safety of the p1:1blic will remain functional.

i! An 88E is vibratory gro1:1nd motion for *r,rhich certain (generally, safety related) strnctures, S)'Sterns, and co1fl13onents must be designed to remain functional.

179 NEI 99 01 (Revision

6) J>lo't'emser 2012 USGS , check internet news sources, etc.); however, the verification action must not preclude a timely emergency declaration. OBE events are detected in accordance with AOP 901. The OBE is associated with a peak horizontal acceleration of+/- 0.06g. Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or ,SA9SA8. DevelepeF Netes: This " site specific indication that a s e ismic event met or exceeded QBE limits" should be based on the indications , alarms and displays of site specific seismic monitoring equipment.

Indications described in the EAL should b e limit e d to those that are imm e diately available to Control Room persormel and which can be readily assessed.

Indications available outside the Control Room and/or which require lengthy times to assess (e.g., processing of scratch plates or recorded data) should not be used. The goal is to specify indications that can be assessed within 15 minutes of the actual or suspected seismic event. For sites that do not have readily assessable QBE indications within the Control Room , developers should use the follmving alternate EAL (or similar wording). (1) a. b. Control Room personnel feel an actual or potential seismic event. AND The occurrence of a seismic event is confirmed in manner deemed appropriate by the 8hift Manager or Emergency Director.

The EA * .L l .b statement is included to ensure that a declaration does not result from felt vibrations caused by a non seismic source (e.g., a dropped heavy load). The 8hift Manager or E mergency Director may seek e)(ternal verification if deemed appropriate (e.g., a call to the U8G8 , check internet news sources , etc.); however, the verification action must not preclude a timely emergency declaration.

It is recognized that this alternate EAL 1.vording may cause a site to declare an Unusual Ev e nt 1.vhile another site , similarly affected but with readily assessable QBE indications in the Control Room , may not. The above alternate wording may also be used to develop a compensatory EAL for use during periods when a seismic monitoring system capable of detecting an QBE is out of service for maintenance or repair. EGL Assignment Attributes:

3 .1.1. A, 180 NEI 99 01 (ReYision

6) NoYember 2012 HU3 ECL: Notification of Unusual Event Initiating Condition:

Hazardous event~ Operating Mode Applicability:

All Emergency Action Levels: Example Em e Fgeney Aetion Levels: (1 or 2 or 3 or 4 or 5 or 6) Note: EAL HU3.4 does not ap ply to routine traffic imp edi ment s suc h as fog , snow, ice , or ve hicle br eak downs or accidents.

~1 ~2 H LJ 3.3 H[J 3.4 A tornado strike within the PROT ECTED AREA. Internal room or area flooding of a magnitude sufficient to require manual or automatic e l ectrica l isolation of a SAFETY SYSTEM component need e d for the current operating mode. Movement of personn e l within the PROT ECTE D AREA is impeded due to an offsite event involving hazardous materials (e.g., an offsite chemical spill or toxic gas release).

A hazardous event that results in on-site conditions sufficient to prohibit the plant staff from accessing the site via personal vehicles. (£ite specific list of natural or technological hazard events)LakeRiver-level above 757 feet. River Water Supply (RWS) pit low level alarm. Definitions:

PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan. SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as related. Basis: This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant. EAL HU3. l addresses a tornado striking (touching down) within the Protected Area. EA L HU3.2 addresses flooding of a building room or area that results in operators isolating power to a SAFETY SYSTEM component due to water level or other wetting concerns.

C las sification is also required if the water level or related wetting causes an automatic isolation 181 NEI 99 Gl (Re¥isioR

6) No>rember 2G 12 of a SAFETY SYSTEM component from its power source (e.g., a breaker or re l ay trip). To warrant classification, operability of the affected component must be required by Technical Specifications for the current operating mode. EAL HU3 .3 addresses a hazardous materials event originating at an off site location and of sufficient magnitude to impede the movement of personnel within the PROTECTED AREA. EAL HU3 .4 addresses a hazardous event that causes an on-site impediment to vehicle movement and significant enough to prohibit th e plant staff from accessing the s it e using personal vehicles.

Examples of such an event include site flooding caused by a hurricane , heavy rains, up-river water releases, dam fai l ure, etc., or an on-site train derailm ent blocking the access road. This EAL is not intended apply to routine impediments suc h as fog , snow , ice, or vehicle breakdowns or accidents, but rather to more significant conditions such as the Hurricane Andrew strike on Turkey Point in 1992 , the flooding arow1d the Cooper Station during the Midwest floods of 1993 , or the flooding around Ft. Calhoun Station in 2011. EAL HU3.5 addresses the observed effects of flooding in accordance with AOP 902 (Flood). Plant site finished grade is at elevation 757.0 feet. Personnel doors and railroad and truck openings at or near grade would require protection in the event of a flood above elevation 757.0 feet. Therefore, EAL 6 uses a threshold of flood water levels above 757.0 feet. (site specific description). EAL HU3.6 addresses the effects of loss ofriver water make-up capability. The intake structure for the safety-related water supply systems (river water, RHR service water, and emergency service water) is located on the west bank of the Cedar River. River levels below the intake structure inlet or a blockage of the intake would result in a loss of the ability to provide make-up water for safety-related systems. The overflow weir is at elevation 724 feet 6 inches. River level at or below this elevation will result in all river flow being diverted to the safety related water supply systems. The top of the intake structure around the pwnp wells is at elevation 724 feet. If the river water level dropped to this level, the pwnp suction would have no continuous supply. Blockages of the intake structure may result from debris, ice, or aquatic life. A loss of flow into the intake structure, due to a blockage or low river level, will result in the pit level lowering to the alarm setpoint (723.0 feet) and a resulting alarm in the Control Room. Therefore, this EAL uses a threshold of low pit level as a potential substantial degradation of the ultimate heat sink capability.-:

Escalation of the emergency classification level wou ld be based on I Cs in Recognition Categories AR , F , S or C. De"leloper Notes: The "Site specific list of natural or technological hazard events" should include other events that may be a precursor to a more significant event or condition , and that are appropriate to the site location and characteristics.

Notwithstanding the events specifically included as EALs above , a "Site specific list of natural or technological hazard events" need not include short lived events for vrhich the extent of the damage and the resulting consequences can be determined within a relatively short time frame. In these cases , a damage assessment can be performed soon after the event, and the plant staff 1.vill b e abl e to identify potential or actual impacts to plant systems and structures. This will 182 NEI 99 QI (Re¥isioR

6) ~foyember 2Q I 2 enable prompt definition and implementation of compensatory or corrective measures with no appreciable increase in risk to the public. To the e)ctent that a short lived event does cause immediate and significant damage to plant systems and structures , it will be classifiable under the Recognition Category F , Sand C !Cs and EALs. Events of lesser impact v,'ould be expected to cause only small and localized damage. The consequences from these types of events are adequately assessed and addressed in accordance 1.vith Technical Specifications.

In addition , the occmTence or effects of the event may be reportable under the requirements of 10 CFR 50.72. EGL Assignment Attributes:

3 .1. l .i\. and 3 .1.1. C 18 3 1-Jel 99 01 (Revision

6) 1-lovemeer 2012 ECL: Notification of Unusual Event Initiating Condition:

FIRE potentially degrading the level of safety of the plant. Operating Mode Applicability:

All Emergency Action Levels: Example Emergeney Aetien LeYels: (1 or 2 or 3 or 4) Note~: HU4

• The Emergency Director shou ld declare the Unusua l Event promptly upon d eterm ining that the applicable time ha s been excee ded , or will lik ely be exceeded. H LJ 4.1 a. b. a. b. A FIRE is NOT extinguished within 15-minutes of ANY of the following FIRE detection indications:

• Report from the field (i.e., visual observation)

• Receipt of multiple (more than 1) fire alarms or indications

• Field verification of a single fire alarm AND The FIRE is located within ANY of the followingTable H-1 plant rooms or areas:-(site specific list of plant rooms or areas) Receipt of a single fire alarm ~with no other indications of a FIRE}. ----AND The FIRE is located within ANY of the followingTable H-1 plant rooms or areas (site specific list of plant rooms or areas) ----AND c. The existence of a FIRE is not verified within 30-minutes of alarm receipt. A FIRE within the plant or ISFSI [fer plants v.1 ith an ISFSI outside the plant Protected Area] PROTECTED AREA not extinguished within 60-minutes of the initial report , a larm or indication.

A FIRE within the plant or ISFSI [fer plants with a19 ISFSJ o'bltside the plant Protected A-re-a]--PROTECTED AREA that requires firefighting s upport by an offsite fire response agency to extinguish.

Table H-1 Safe ShutdownNital Areas Cate!!orv Area Electrical Power 1G31 DG and Day Tank Rooms, 1G21 DG and Day Tank Rooms, Battery Rooms, Essential Switchgear Rooms, Cable S12reading Room Heat Sink/ Torus Room, Intake Structure, Pum12house Coolant Sunnlv 184 Containment Emergency Systems Other Drvwell. Torus "Jl,JEI 99 01 (RevisieA

6) "Jloleyem.ber 2012 NE, NW. SE Corner Rooms, HPCI Room, RCIC Room, RHR Valve Room, North CRD Area. South CRD Area, CSTs Control Building, Remote Shutdown Panel 1C388 Area, Panel 1 C55/56 Area, SBGT Room 18 5 Definitions:

l>IEI 99 01 (Re11ision

6) l>lo>,*emeer 2012 FIRE: Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is prefe1Ted but is NOT required if large quantities of smoke and heat are observed. PROTECTED AREA: The area under continuous access monitoring and controL and armed protection as described in the s i te Security Plan. Basis: This IC addr es s e s the magnitude and extent of F IRES that may be indicative of a potential degradation of the level of safety of the plant. EAL HU4.1 The int e nt of th e 15-minute duration is to size the FIRE and to discriminate against small FIRES that are readily extinguished (e.g., smold e ring waste paper basket). In addition to a l arms , other indications of a FIRE could be a drop in fire main pressure , automatic activation of a suppression system , etc. Upon receipt , operators will take prompt actions to confirm the validity of an initial fire alarm , indication , or report. For EAL assessment purposes , the emergency declaration clock starts at the time that the initial alann , indication , or report was received, and not the time that a subsequent verification action was performed.

Similarly , the fire duration clock also starts at the time of receipt of the initial alarm, indica t ion or report. EAL HU4.2 This EAL addresses receipt of a single fire alarm , and the existence of a FIRE is not verified (i.e., proved or disproved) within 30-minutes of the alarm. Upon receipt , operators will take prompt actions to confirm the validity of a single fire alarm. For EAL assessment purposes , the 30-minute clock starts at the time that the initial alarm was received , and not the time that a subsequent verification action was performed.

A single fire alarm, absent other indicatio n (s) of a FIRE, may be indicative of equipment failure or a spurious activation , and not an actual FIRE. For this reason , additional time is allowed to verify the validity of the alarm. The 30-minute period is a reasonable amount of time to determine if an actual FIRE exists; however , after that time, and absent information to the contrary , it is assumed that an actual FIRE is in progress.

186 l>lel 99 01 (Revision

6) November 2012 If an actual FIRE is verified by a report from the field , then EAL HU4.1 is immediately applicable , and the emergency must be declared if the FIRE is not extinguished within 15-minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation, and this verification occurs within 30-minutes of the receipt of the alarm , then this EAL is not applicable and no emergency declaration is warranted.

EAL HU4.3 In addition to a FIRE addressed by EAL HU4.1 or EAL HU4.2, a FIRE within the plant or ISFSI PROT ECTE D AREA not extinguished within 60-minutes may also potentially degrade the l evel of plant safety. This basis extends to a FIRE occuning within the PROTECTED AREA of an ISFSI located outside the plant PROTECTED AREA. [£entence for plants with an I8F£I outside the plant Protected Area] EAL HU4.4 If a FIRE within the plant or ISFSI [ferpl:*1nts with *In ISFS! outside thepfant Protected Area] PROTECTED AREA is of sufficient size to require a response by an offsite firefighting agency (e.g., a local town Fire Department), then the le ve l of plant safety is potentially degraded.

The dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts because the fire is beyond the capability of the Fire Brigade to extinguish.

Declaration is not necessary if the agency resources are placed on stand-by, or supporting post-extinguishrnent recovery or investigation actions. Basis-Related Requirements from Appendix Rand NFPA-805 Criterion 3 of Appendix A to 10 CFR 50 states in part that "structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and exp l osions." The Nuclear Safety Goal ("NSG") in NFPA 805, Section 1.3.1 states, " The nuclear safety goal is to provide reasonable assurance that a fire during any operational mode and plant configuration will not prevent the plant from achieving and maintaining the fuel in a safe and stable condition." When considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance because a safe shutdown success path, free of fire damage, must be availab l e to meet the nuclear safety goals, objectives and performance criteria for a fire under any plant operational mode or configuration.

Because fire may affect safe shutdown systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post-fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents.

187 Nel 99 01 (Revision

6) ~lovember 2012 In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of I-hour fire barriers for the enclosure of cable and equipment and associated non-safety circuits of one redundant train (G.2.c). Even though DAEC has adopted the alternate approach provided by NFPA-805 in lieu of the deterministic requirements of Appendix R, the 30-minutes to verify a single alarm as used in EAL HU4.2 is considered a reasonable amount of time to determine if an actual FIRE exists without presenting a challenge to the nuclear safety performance criteria.Basis Related Requirements from Appendix R Appendi)£ R to IO CFR 50, states in part: Criterion 3 of Appendix ,o.._ to this part specifies that "Structures, systems, and components important to safety shall be designed and located to minimize, consistent v1ith other safety requirements, the probability and effect of fires and e)(plosions." '.Vhen considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance to safety because damage to them can lead to core damage resulting from loss of coolant through boil off. Because fire may affect safe shutdovm systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire dan1age to those systems required to mitigate the consequences of design basis accidents.

In addition, Appendix R to IO CFR 50 , requires, among other considerations, the use of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barriers for the enclosure of cable and equipment and associated non safety circuits of one redundant train (G.2.c). /\s used in EAL #2 , the 30 minutes to verify a single alarm is well within this worst case 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> time period. Depending upon the plant mode at the time of the event , escalation of the emergency classification level would be via IC CA6 or ,SA9SA8. De¥elapeF Notes: The "site specific list of plant rooms or areas" should specify those rooms or areas that contain SAFETY SYSTEM equipment.

As noted in the EA.Ls and Basis section , include the term ISFSI if the site has an ISFSI outside the plant Protected Area. EGL Assignment Attributes:

3 .1.1.A 188 ECL: Notification of Unusual Event l>Jel 99 o I (RevisioR e) 1'/oyember 2012 HU-76 Initiating Condition:

Other conditions exist which in the judgment of the Emergency Director warrant declaration of a fN 0 1 UE. Operating Mode Applicability:

All l EHmple Emergency Action Levels: 1 Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which indicate a potential degradation of the l evel of safety of the plant or indicate a security threat to facility protection has been initiated.

No releases ofradioactive material requiring offsite response or monitoring are expected unless further de gradat ion of SAFETY SYSTEMS safety systems occurs. Definitions:

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as related. Basis: This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a NOUE. 189 NEJ 99 01 (Re 1 1ision 6) }lovember 2012 HA1 ECL: Alert Initiating Condition:

HOSTILE ACTION within the OWNER CONTROLLE D AREA or airborne attack threat within 30 minutes. Operating Mode Applicability:

All Examf)le Emergency Action Levels.:.: (1 or 2) A HOSTILE ACTION is occurring or has occurred within the OWNER CONTROLLED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision. A va lid ated notification from NRC of an aircraft attack threat within 30 minutes of the site. Definitions:

HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, exp l osives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civ i l disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). OWNER CONTROLLED AREA: The site property owned by or otherwise under the control of the licensee.

PROJECTILE

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. Basis: This IC addresses the occurrence of a HOSTILE ACTION within the OWNER CONTROLLED AREA or notification of an aircraft attack threat. This event will require rapid response and assistance due to the possibility of the attack pro gressi ng to the PROT ECTE D AREA, or the need to prepare the plant and staff for a potential aircraft impact. Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-re lated event. Security plans and terminology are based on the guidance provided b y NEI 03-12 , Templat e for the Security Plan, Training and Qualification Plan , Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program].

190 NE! 99 0 I (R1wisioA

6) }foyember 2012 As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures ( e.g., evacuation, dispersal or sheltering).

The Alert declaration will also heighten the awareness of Offsite Response Organizations, a llo wing them to be better prepared shou ld it be necessary to consider further actions. This IC does not apply to incidents that are accidental events, acts of civil disobedience , or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters , physical disputes between employees, etc. Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR f-73.71 or 10 CFR f-50.72. EAL HAI .1 is applicable for any HOSTILE ACTION occurring , or that has occurred, in the OWNER CONTROLLED AREA. This includes any action directed against a:a-the ISFSI that which is located outside the plant PROTECTED AREA. EAL HAI .2 addresses the threat from the impact of an aircraft on the plant, and the anticipated arrival time is within 30 minutes. The intent of this EAL is to ensure that threat-related notifications are made in a time l y manner so that plant personnel and GRGoffsite response organization s are in a heightened state ofreadiness.

This EAL is met when the threat-related information has been validated in accordance with ~Abnormal Operating Procedure (AOP) 914, Security Events site specific procedure) . .§.:. The NRC Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft.

The status and size of the plane may be provided by NORAD through the NRC. In some cases, it may not be readily apparent if an aircraft impact within the OWNER CONTROLLED AREA was intentional (i.e., a HOSTILE ACTION). It is expected, although not certain, that notification by an appropriate Federal agency to the site would clarify this point. In this case, the appropriate federal agency is intended to be NORAD , FBI, FAA or NRC. The emergency declaration, including one based on other ICs/EALs, should not be unduly delayed whi l e awaiting notification by a Federal agency. Emergency plans and implementing procedures are public documents; therefore , EALs should do not incorporate Security-sensitive information.

This includes information that may be advantageous to a potential adversary, suc h as the particulars concerning a specific threat or threat location.

Security-sensitive information should be is contained in non public documents such as the Security Plan. Escalation of the emergency classification level would be via IC HS 1. DeYelefJeF Netes: The (site specific security shift supervision) i s the title of the on shift individual responsible for supervision of the on shift security force. E mergency plans and implementing procedures m*e public documents; therefore , EALs should not incorporate Security sensitiv e information. This includes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan. 191

ECL: Alert NEI 99 01 (Revision

6) *November 2012 HA5HA3 Initiating Condition:

Gaseous release impeding access to equipment necessary for normal plant operations , cooldown , or shutdown.

Operating Mode Applicability:

All Example Emergency Action Levels: Note: If the equipment in the listed room or area was already inoperable or out-of-service before the event occurred , then no emergency cla ss ification is warranted.

H v\,~3.1 a. AND Release of a toxic, corros i ve , asphyxiant or flammable gas into ~ANY of the following plant rooms or areas: BUILDING ROOM MODE Reactor Building HPCIRoom 1,2,or3 Reactor Building RCIC Room L 2, or 3 Reactor Building SE or NW Comer Rooms 3 or 4 Reactor Building Pump House ESW I RHRSW Pump Room 3 or 4 ---_(site specific list of plant rooms or areas with entry related mode applicability identified)

b. Entry into the room or area is prohibited or impeded. Definitions:

Basis: This IC addresses an event involving a release of a hazardous gas that precludes or impedes access to equipment necessary to maintain normal plant operation , or required for a normal plant cooldown and shutdown.

This condition represents an actua l or potential substantial degradation of the level of safety of the plant. An Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the gaseo us release. The emergency classification is not contingent upon whether entry is actually necessary at the time of the release. 193

---

" NE! 99 01 (Re11ision

6) N011ember 20 12 Evaluation of the IC and EAL do not require atmospheric sampling; it on l y requires the Emergency Director's judgment that the gas concentration in the affected room/area is sufficient to preclude or significantly impede procedurally required access. This judgment may be based on a variety of factors including an existing job hazard analysis, report of ill effects on personnel, advice from a subject matter expert or operating experience with the same or similar hazards. Access should be considered as impeded if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area ( e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed). An emergency declaration is not warranted if any of the following conditions apply.

• The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the gaseous release).

For example , the plant is in Mode 1 when the gaseous release occurs, and the procedures used for normal operation , cooldown and shutdown do not require entry into the affected room until Mode 4.

• The gas release is a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area ( e.g., fire suppression system testing).

• The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine i nspections).

• The access control measures are of a conservative or precautionary nature, and would not actually prevent or impede a required action. An asphyxiant is a gas capable of reducing the level of oxygen in the body to dangerous levels. Most commonly, asphyxiants work by merely displacing air in an enclosed environment.

_This reduces the concentration of oxygen below the normal level of around 19%, which can lead to breathing difficulties, unconsciousness, or even death. The list of plant rooms or areas in EAL HA~3 .1 was generated from a step-by-step review of IPOI-3, Power Op e rations (35% -100% Rated Power) and IPOI-4, Shutdown.

This EAL does not apply to firefightin g activities that automatically or manually activate a fire suppression system in an area , or to intentional inerting of containment (RWR only). Escalation of the emergency classification level would be via Recognition Category AR , C or F ICs. DeYelaf)eF Notes: The " site specific list of plant rooms or area s v-,*ith entry related mode applicability identified" should specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation , cooldown and shutdown. Do not include rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off normal or emergency condition such as emergency repairs , corrective measures or emergency operations). In addition, the list should specify the plant mode(s) during which entry would be required for each room or area. The list should not include rooms or areas for 1.vhich entry is required solely to perform actions of an administrati ve or record ke e ping natur e (e.g., normal rounds or routin e inspections).

194 NEl 99 01 (Revision

6) l-10 1 ,em:ber 2012 The list need not include the Control Room if adequate engineered safety/design features are in place to preclude a Control Room evacuation due to the release of a hazardous gas. Such features may include, but are not limited to, capability to draw air from multiple air intakes at different and separate locations, inner and outer atmospheric boundaries, or the capability to acquire and maintain positive pressure within the Control Room envelope.

If the equipment in the listed room or area was already inoperable, or out of service, before the event occurred, then no emergency should be declared since the event v1ill have no adverse impact beyond that already allowed by Technical Specifications at the time of the event. EGL A.ssignment Attributes

3.1.2.B 195 196 NEI 99 01 (RevisioH e) 1-Joyember 2012 ECL: Alert NEI 99 01 (Revision

6) November 2012 HA6HA5 Initiating Condition:

Control Room evacuation resulting in transfer of plant control to alternate locations.

Operating Mode Applicability:

All Example Emergency Action Level s: H 65 .1 An ev e nt has result e d in plant control b e in g transferred from the Control Room to specific remote shutdown panels and local control stations)the Remote Shutdown Panel (1C388). Definitions:

Basis: This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations outside th e Control Room. The loss o f the ability to control the plant from the Control Room is considered to be a potential substantial degradation in the level of plant safety. Following a Control Room evacuation , control of the plant will be transferred to alternate shutdown locations. The necessity to control a plant shutdown from outside the Control Room , in addition to responding to the event that required the evacuation of the Control Room , will present challenges to plant operators and other on-shift personnel.

Activation of the ERO and emergency response facilities will assist in responding to these challenges.

Escalation of the emergency classification level would be via IC HS 62_. De;.*elepeF Netes: The "site specific remote shutdown panels and local control stations" are the panels and control stations referenced in plant procedures used to cooldown and shutdovm the plant from a location(s) outside the Control Room. EGL Assignment i\.ttributes:

3.1.2.B 197 ECL: Alert NE! 99 01 (Revision

6) Jl,lo 1 1ember 2012 HA7HA6 Initiating Condition:

Other conditions exist whic h in the judgment of the Emergency Director warrant declaration of an Alert. Operating Mode Applicability:

All l Example Eme,geeeyEmergency Action Leve ls: 1 Other conditions exist which , in the judgment of the Emergency Director, indicate that events are in progress or ha ve occurred wh ich in vo lve an actual or potential substantial degradation of th e level of safety of the plant or a security event that involves probable life threatening risk to s it e personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to b e limited to small fractions of the E PA Protective Action Guideline exposure levels. Definitions:

HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOST AGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). HOST AGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. PROJECTILE:

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. Basis: This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for an Alert. 198 ECL: Site Area Emergency Initiating Condition:

HOSTILE ACTION within the PROTECTED AREA. Operating Mode Applicability:

All Example EmeFgeeeyEmergencv Action Levels: NEI 99 01 (Revision

6) l'lovemaer 2012 HS1 H SI.I A HOSTILE ACTION is occurring or has occuned within the PROTECTED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision. Definitions:

HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land. or water using guns, explosives, PROJECTILEs.

vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activit i es (i.e., this may incl u de violent acts between indiv i duals in the owner controlled area). HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. HOSTILE FORCE: One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction. PROJECTILE:

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan. Basis: This IC addresses the occurrence of a HOSTILE ACTION within the PROTECTED AREA. This event will require rapid response and assistance due to the possibility for damage to plant equipment.

Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. Security plans and terminology are based on the guidance provided by NEI 03-12 , Template for the Security Plan , Training and Qualification Plan , Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.

199 NEI 99 01 (Revision

6) November 2012 As time and conditions allow , these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures ( e.g., evacuation, dispersal or sheltering). The Site Area Emergency declaration will mobilize GR:Goffsite response organization resources and have them available to develop and implement public protective actions in the unlikely event that the attack is successful in impairing multiple safety functions.

This IC does not apply to a HOSTILE ACTION directed at an-the ISFSI PROTECTED AREA which is located outside the plant PROTECTED AREA; such an attack should be assessed using IC HAI. It also does not apply to incidents that are accidental events , acts of civil disobedience , or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft , shots from hunters , physical disputes between employees , etc. Reporting of these types of events is adequately addressed by other EALs , or the requirements of 10 CFR-§-73.71 or 10 CFR-§-50.72. Emergency plans and implementing procedures are public documents; therefore , EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location.

Security-sensitive information should beis contained in non public documents such as the Security Plan. Escalation of the emergency classification level would be via IC HG 1. Develeper Netes: The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force. Emergency plans and implementing procedures are public documents; therefore , EA.Ls should not incorporate Security sensitive information.

This includes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location.

Security sensitive information should be contained in non public documents such as the Security Plan. With due consideration given to the above developer note , EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures. Such references should not contain a recogniz;able description of the event. For mmmple , an EAL may be worded as " Security event #2 , #5 or #9 is reported by the (site specific security shift supervision)

." See the related Developer Note in AppendiJc B, Definitions, for guidance on the development of a scheme definition for the PROTECTED AREA. EGL Assigrnnent Attributes:

3 .1.3 .D 200 NEI 99 01 (Revision

6) "NoYel'l'leer 2012 HS6HS5 ECL: Site Area Emergency Initiating Condition:

Inability to control a key safety function from outside the Control Room. Operating Mode Applicability:

All Example Emergency Action Levels: Note: The Emergency Dir ec tor should declar e t he Site Area Emergency promptly upon determining that (site specific number of20 minut es j has b een exceeded, or will likely be exceeded.

a. b. Definitions:

Basis: An event has resulted in plant contro l being transferred from the Control Room to (site specific remote shutdown pan e ls and_control stations) the Remote Shutdown Panel (1 C388). AND Control of ANY of the following key safety functions is not reestablished within (site specific number of20 minutes j.

• Reactivity control

• Core cooling [PWR] I RPV water level [BWR]

• RCS heat removal This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations , and the control of a key safety function cannot be reestablished in a timely manner. The failure to gain control of a key safety function following a transfer of plant control to alternate locations is a precursor to a challenge to one or more fission product barriers within a relatively short period of time. The determination of whether or not "co ntrol" is established at the remote safe shutdown location(s)Remote Shutdown Panel (1C388-tsm based on Emergency Director judgment.

The Emergency Director is expected to make a reasonable, informed judgment within (the site specific time for transfer)

~20 minutes whether or not the operating staff has control of key safety functions from the remote safe shutdown location(s). AOP 915, " Shutdown Outside Control Room" provides the following CAUTION -"For Control Room evacuation as the result ofa fire, transfer of control at panels JC388. JC389. JC390. JC391. JC392and JC392 is required to be completed within 20 minutes." Escalation of the emergency classification level would be via IC FG 1 or CG 1. 201 Devela~eF Notes: 1-lEI 99 01 (Revision

6) 1-lovember 2012 The "site specific remote shutdovm panels and local control stations" are the panels and control stations referenced in plant procedures used to cooldovm and shutdovm the plant from a location(s) outside the Control Room. The "site specific number of minutes" is the time in which plant control must be (or is e)cpected to be) reestablished at an alternate location as described in the site specific fire response analyses.

i\bsent a basis in the site specific analyses, 15 minutes should be used. Another time period may be used with appropriate basis/justification.

EGL A,ssignment Attributes:

3.1.3.B 2 0 2 ECL: Site Area Emergency NB! 99 01 (Revision

6) November 2012 HS7HS6 Initiating Condition:

Other conditions exist which in the judgment of the Emergency Director warrant declaration of a Site Area Emergency. Operating Mode Applicability:

All Exemple Emergency Action Leve ls: 1 Other conditions exist which in t he judgment of the Emergency Director indicate that events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts, (1) toward site personnel or equipment that could lead to the likely failure of or, (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA Protective Action Guideline exposure levels beyond the site boundary.

Definitions:

HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOST AGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). HOST AGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. PROJECTILE:

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. Basis: This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification le ve l description for a Site Area Emerge nc y. 203 1-J.el 99 01 (ReYision

6) 1-loYember 2012 HG1 ECL: General Emergency Initiating Condition:

HOSTILE ACT I ON resulting in loss of physical control of the facility.

Operating Mode Applicability:

All Example Emergency Action Level s: a. A HOSTIL E ACTION is occurring or has occurred within the PROTECTED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision. AND b. EITHER of the following has occurred:

1. ANY of the following safety functions cannot be controlled or maintained.

• Reactivity control

• Core cooling [PWR] I RPV water level [BWR]

• RCS heat removal OR 2. Damage to spent fuel has occurred or is IMMINENT.

Definitions:

HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. HOSTILE FORCE: One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming. or causing destruction.

IMMINENT:

The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. 204 NEI 99 01 (Revision

6) November 2012 PROJECTILE:

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan. 205 Basis: 206 NEI 99 01 (Revision

6) l>lo;rember 2012 NE! 99 01 (ReYision

6) *November 2012 This IC addresses an event in which a HOSTILE FORCE has taken physical control of the facility to the extent that the plant staff can no longer operate equipment necessary to maintain key safety functions.

It also addresses a HOSTILE ACTION leading to a loss of physical control that results in actual or IMMINENT damage to spent fuel due to 1) damage to a spent fuel pool cooling system (e.g., pumps, heat exchangers, controls, etc.) or , 2) loss of spent fuel pool integrity such that sufficient water level cannot be maintained.

Timely and accurate communications between the DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan , Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.

Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location.

Security-sensitive information should beis contained in non public documents such as the Security Plan. 207 N 0 00 ECL: General Emergency NEI 99 01 (Revision

6) November 2012 H G7HG6 Initiating Condition:

Other conditions exist which in the judgment of the Emergency Director warrant declaration of a General Emergency. Operating Mode Applicability:

All 6 Example Emergency Action Level s: 1 Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occun-ed which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility.

Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area. Definitions

HOSTILE ACTION: An act toward DAEC or its personnel that i ncludes the use of violent force to destroy equipment, take HOST AGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power p l ant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). HOST AGE: A person(s) held as l everage against the station to ensure that demands will be met by the station. IMMINENT:

The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. PROJECTILE:

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. Basis: This IC addresses unanticipated conditions not addressed explicitly elsewhere but that wan-ant declaration of an emergency because conditions exist which are belie ved by the Emergency Director to fall under the emergency classification level description for a General Emergency.

209 11 SYSTEM MALFUNCTION ICS/EALS Nel 99 0 I (RevisieA

6) N evember 2012 Table 8 1: Reeogeition Category "8" Ieitiatieg Condition Matrix UNUSUAL EVENT SUl Loss of all offsite AC power capability to emergeAcy buses for 15 miAutes or longer. Op. l,ledes: 1. 2, 3. !/Pow e r Oper*ltion, St*1rlll-JJ , Hot St*lndhy, Hat Shutdewn SUl UNPLA}l1'1ED lo ss of CoAtrol Room indications for 15 miAutes or loAger. Op. ,~ledes: Power Oper*ltion , Sl*11*tup , Hot St*11uiby , Hot Shtttde;1*11L...1..

3, 4 SUJ Reactor coolaAt activity greater thaA TechAical SpecificatioA allowable limits. Op. l',ledes:

1, 2, 3 , !/Power 0per*ltion , St*11*tll-JJ, Hot St*1nc/.hy

• , Hot Sht1tdawn SU4 RCS leakage for 15 miAutes or loAger. Op. },ledes: 1, 2, 3, !/Power Opel'*ltio19 , St*1rlll-JJ, Ha: St*1ndby, Hat Slnttdewn SUS Automatic or manual (trip [PWRl / scram [BWRl) fails to shutdown the reactor. Op. ,\lodes: Power Operation,]

ALERT SAl Loss of all but oAe AC power s ource to emergeAey b1:1ses for 15 mim1tes or loAger. Op. },lede s: LJ.,_l,_ j_Power Oper*ltion , St*1rtup , Hat Standby , Hot Slw:down SAl UNPLA}l1'1ED loss of Control Room iAdieatioAs for 15 miAutes or longer 1 Nith a sigt1ifieaAt traAsieAt iA progress.

Op. Mades: 1 , 2 , 3 , 4 Power Operation, St*lrtup , Hat St*lndhy , Hat Shutdown SAS A.utomatic or manual (trip [PWR] I scram [BWR]) fails to s hutdo 1.vn the reactor , and subsequent manual actions taken at the reactor control consoles are not succ e ssful in shutting dovm the reactor. Op. }.fades: Power Operation{

SS1 SITE AREA EMERGENCY Loss of al I offsite aAd all oAsite AC power to emergeAey buses for 15 minutes or loAger. Op. ,~ledes: 1, 2 , 3 , !/Power Operation, S:arlll-JJ , Hot St*1ndhy , Hat S!mtdown 885 Inability to shutdovm the reactor causing a challenge to (c ore cooling [PWR] I RPV water level [B WR]) or RC8 heat removal. Op. Aledes: Po-wer Op e r*ltion1 210 GENERAL EMERGENCY SGl ProloAged loss of all offsite aAd all oA s ite AC povter to emergeAey buses. Op. ,~ledes: 1, 2, 3 , !/Power Operation , St*1rtup , Hat Stand-hy*, Hot SlwtdowJ1

.-------------------. 1 Table iAtenaea for use by 1 I 1 EAL developers.

JAcl1:1sioA iA lieeAsee I d . . ,J 1 oeuments 1s Rot requ1reu.

1 L------------------'

UNUSUAL EVENT SU6 Loss of all onsite or offsite eommunications capabilities.

Op. },fades: l. 2. 3. 4Pewer 0pa6ltien, Stctrtblf), Hat Stffl'ldhy, Hat ShMtdawn SU7 Failure to isolate containment or loss of eontainment pressure control. [PWR] Op. },1edes: 1. 2. 3. 1:. Pewer Ope:r6ltien, Sl:6lrtup , Hat Stctndby , Hat S!nlldewn ALERT SITE AREA EMERGENCY NEI 99 01 (ReYisian

6) }foyember 2012 GENERAL EMERGENCY SS8 Loss of all Vital DC SGS Loss of all AC and Si" .. 9 Hazardous event affecting a SAFETY SYSTEM needed for the eurrent operating mode. Op. },1edes: 1. 2. 3. 4.Pewer Ope:r6ltien , Sl:61rtblf), Hat Sl:6lndby , Hat S1n1tdewn pov,*er for 15 minutes or longer. Op. ,".fades: 1. 2. 3. 4Pewe1* Oper6ltien , St61Ftblf), Hat Slct1ldby*, Hat Shutdewn 211 Vital DC power sources for 15 minutes or longer. Op. },1edes: 1. 2. 3. 4Pewer 0pe:r6ltien, S1:61Fh1J3 , Hat Sl61ndby*, Hat Shutdewn 1 Table intended for use by I 1 EAL developers. : Inclusion in licensee I d . . d 1 ocuments 1s not require . ~------------------*

ECL: Notification of Unusual Event Nel YY u 1 (Ke*,1s10R e) November 2012 SU1 Initiating Condition:

Loss of all-ALL offsite AC power capability to emergency essential buses for 15 _-minutes or longer. Operating Mode Applicability:

Power Operation, £tartup, Hot £tandby, Hot £hutdown.L..LJ Example Emergency Action Level s: Note: The Emergency Director should declare the Unusual Event promptly upon determining that 15 minutes has been exceeded , or will likely be exceeded.

S 1.1 Loss of ALL offsite AC power capability to (site specific emergency buses)1A3 AND 1A4 for 15 minutes or longer. Definitions:

Basis: This IC addresses a prolonged loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emergency essential buses-. .,_ This condition represents a potential reduction in the level of safety of the plant. The intent of this EAL is to declare an Notification of Unusual Event when offsite power has been lost and both of the emergency diesel generators have successfully started and energized their respective 4kv essential bus. For emergency classification purposes , "capability" means that an offsite AC power source(s) is available to the emergeney essential buses , whether or not the buses are powered from it. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power. Escalation of the emergency classification level would be via IC SAl. Develeper Netes: The "site specific emergency buses" are the buses fed by offsite or emergeney AC power sources that supply pov,rer to the electrical distribution system that powers £AFETY £Y£TEM£. There is typically 1 emergenc::,*

bus per train of £AFETY £Y£TEM£. At multi unit stations , the EALs may credit eompensatory measures that are proceduralized and can be implemented vrithin 15 minutes. Consider capabilities such as power source cross ties , "swing" generators , other power sources described in abnormal or emergency operating procedures , etc. Plants that have a proceduralized capability to supply offsite AC po1.ver to an 212 provided that the p ru.ne *1... tes* 3.1.1.A . t 6ttnuu

• EGL Assign.men , "l lci l 99 0 l (Ke'iJSJOR a) ' J>foyember 2012

• the EAL . h" O"'er source m uon unit may cred1~ t us p w f 10 CFR 50.63. 213 ECL: Notification of Unusual Event )1.,lbl yy u I lKeYISIOH o) Jl.loYernber 2012 SU2SU3 Initiating Condition:

UNPLANNED loss of Control Room indications for 15 minutes or longer. Operating Mode Applicability:

Power Operation, Startup , Hot Standby, Hot Shutdovm.L_l,_]_

Example Emergency Action Level s: Note: The Emergency Director should declar e the Unusual Event promptly upon determining that 15 minutes ha s been exceeded , or will likely be exceeded.

An UNPLANNED event results in the inability to monitor one or more of the -------following parameters from within the Control Room for 15 minutes or longer. S 3.1 a.

• Reactor Power

• RPV Water -Level

• RPV Pressure

• Primary Containment Pressure

• Suppression Pool Level

• Suppression Pool Temperature r DT H D --, ];_,, r DT H D , J; _,, ,~ .&.\.. ,...-.. _... .... -....... ** ,., I ---. __.. *-**-* Reaetor Power Reaetor Po 1.11*er RP¥ Water be,,cel RGS be 1 vel RP¥ PressUFe RGS Pressure Primary Gontainment Pressure T-0-,,..., T' .: .. 'T' .~.--_...., ... _., ---.-..-.. -..... -. -Suppression Pool bevel bevels in at least Esite speeifie numbefj steam generators Suppression Pool +emperature Steam Generator Au~filiary or -T' ,..J '" T 'C'l -.. -*-Definitions:

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety-related.

UNPLANNED:

A parameter change o r an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient.

The cause of the parameter change or event may be known or unknown. Bas i s: This IC addresses the difficulty associated with monitoring normal plant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant. 214 Nl: H ~Al Ul (:K e YISJOH 6) l>J OYember 2012 As used in this EAL , an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s).

_For example , the reactor power level cannot be determined from any analog , digital and recorder source within the Control Room. 215 Nl:il IJIJ UJ (Kev1s1on

6) *November 2012. An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required.

The event would be reported if it significantly impaired the capability to perform emergency assessments.

In particular, emergency assessments necessary to implement abnormal operating procedures , emergency operating procedures , and emergency plan implementing procedures addressing emergency classification , accident assessment , or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions ofreactivity control, core cooling [PWR] I RPV level [BWR] and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to b e more significant than simply a reportable condition.

In addition , if all indication sources for one or more of the listed paramet ers are lost , then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example , if the va lu e for reactor vessel level [P'NRJ / RPV water level [B'NR] cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer , the availability of other parameter values may be compromised as well. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification l evel would be via IC SA lJ. Devel0peF Notes: In the PVlR parameter list column , the "site specific number" should reflect the minimum number of steam generators necessary for plant cooldown and shutdown.

This criterion may also specify \Vhether the level value should be wide range, narrov,r range or both , depending upon the monitoring requirements in emergency operating procedures. Developers may specify either pressurizer or reactor vessel level in the PWR parameter column entry for RCS Level. The number, type , location and layout of Control Room indications , and the range of possible failure modes , can challenge the ability of an operator to accurately determine, within the time period available for emergency classification assessments , if a specific percentage of indications have been lost. The approach used in this EAL facilitates prompt and accurate emergency classification assessments by focusing on the indications for a selected subset of parameters.

By focusing on the availability of the s pecified parameter values , instead of the sources of those values, the EAL recognizes and accommodates the v<'ide variety of indications in nuclear power plant Control Rooms. Indication types and sources may be analog or digital , safety related or not , primary or alternate, individual meter value or computer group display , etc. A loss of plant annunciators will be evaluated for reportability in accordance with 10 CFR 50.72 (and the associated guidance in NUREG 1022), and reported if it significantly impairs the capability to perform emergency assessments.

Compensatory measures for a loss of annunciation can be readily implemented and may include increased monitoring of main control boards and more frequent plant rounds by non licensed operators. Their alerting function notwithstanding , annunciators do not provide the parameter values or specific component status information used to operate the plant , or process through AOPs or EOPs. Based on these 216 Ne! 99 o I (Kev1s1on

6) ~lovember 2Q 12 considerations, a loss of annunciation is considered to be adequately addressed by reportability criteria , and therefore not included in this IC and EAL. With respect to establishing event s e verity, the respons e to a loss of radiation monitoring data (e.g., process or effluent monitor values) is considered to be adequately bounded by the requirements of 10 CFR 50.72 (and associated guidanc e in l'JUREG 1022). The reporting of this event 1.vill ensure adequate plant staff and NRG awareness , and drive the establishment of appropriate compensatory measures and corrective actions. In addition, a loss of radiation monitoring data , by itself , is not a precursor to a more significant event. Personnel at sites that have a Failure Modes and Effects Analysis (FMEl ... ) included within the design basis of a digital I&C system should consider th e FMEl ... information when developing their site specific EALs. Due to changes in the configurations of SAFETY SYSTEMS , including associated instrumentation and indications , during the cold shutdovm , refueling , and defueled modes , no analogou s IC is included for these modes of operation.

EGL Assignment Attributes:

3 .1.1.l ... 217 2 N el 99 U l (KeVISIOR

6) ~loyemeer 2012 SU3SU4 ECL: Notification of Unusual Event Initiating Condition:

Reactor coolant activity greater than Technical Specification allowable limits. Operating Mode Applicability:

Power Operation, Startup, Hot Standby, Hot Shutdown.L.1..,_]

Example Emergency Action Levels: (1 or 2) (Site specific radiation monitor) reading greater than (site specific value). Pretreatment Offgas System (RM-4104)

Hi-Hi Radiation Alarm. Sample analysis indicates that reactor coolant specific activity is greater than 2.0 µCi/gm dose equivalent I-131 for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or longerSample analysis indicates that a reactor coolant activity value is greater than an allowable limit specified in Technical Specifications.:.-:-

Definitions:

Basis: This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications.

This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant. For EAL SU4.1, RM-4104 Hi-Hi Radiation Alarm has been chosen because it is operationally significant, is readily recognizable by the Control Room Operations Staff, and is set at a level corresponding to noble gas release rate, after 30-minute delay and decay of 1 Ci/sec. For EAL SU4.2, coolant samples exceeding the 2.0 µCi/gm dose equivalent 1-131 concentration require prompt action by DAEC Technical Specifications and are representative of minor fuel cladding degradation.

Escalation of the emergency classification level would be via ICs FAI or the Recognition Category A-R I Cs. DeYelepeF Netes: For EAL #1 Enter the radiation monitor(s) that may be used to readily identify when RCS activity levels exceed Technical Specification allowable limits. This EAL may be developed using different methods and sites should use e)dsting capabilities to address it (e.g., development of new capabilities is not required).

E>mmples of e)cisting methods/capabilities include:

• An installed radiation monitor on the letdovm system or air ejector. 218 f'lel 99 U I (K.eYISIOH e) NoYember 2012 * /' .. hand held monitor or deployed detector reading with pre calculated conversion values or readily implementabl e conversion calculation capability.

The monitor reading values should correspond to an RCS activity level apprmcimately at Technical Specification allowable limits. If there is no existing method/capability for determining this EAL, then it should not be included.

IC evaluation 1.vill be based on EAL #2. For EAL#2 Developers may reword the EAL to include the reactor coolant activity parameter(s) specified in Tech.'lical Specifications and the associated allowable limit(s) (e.g., values for dose equivalent I 131 and gross activity, time dependent or transient values, etc.). If this approach is selected, all RCS activity allowable limi ts should be included.

EGL Assignment Attributes:

3.1.1.A and 3.1.1.B 219 Nel 99 u l (Ke*11s10R a) l>Jovember 2012 SU4SU5 ECL: Notification of Unusual Event Initiating Condition:

RCS leakage for 15 minutes or lon ge r. Operating Mode Applicability:

Power Operation , 8truiup , Hot 8tandby , Hot 8hutdown.L._U Example Emergency Action Levels: (1 or 2 or 3) Note: The Emergency Director should declar e the Unusual Event promptly upon determinin g that 15 minutes h as b ee n exceeded, or wi ll likel y be exceeded.

~1 $2 ~3 RCS unidentified or pr ess ure boundary leakage greater than (site specific value) 10 gpm for 15 minutes or longer. RCS identified leakage greater than (site specific value)25 gpm for 15 minutes or longer. Leakage from the RCS to a lo cat ion outside containment greater than 25 gpm for 15 minutes or longer. Definitions:

UNISOLABLE:

An open or breached system line that cannot be isolated, remotely or locally. Basis: This IC addresses RCS leakage which may be a precursor to a more significant event. In this case , RCS leakage has be en detected and operators , following applicable procedures, have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant. EAL SUS.I and EAL SU5.2 are focused on a loss of mass from the RCS due to " unidentified leakage", "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications).

EAL SU5.3 addresses a RCS mass loss caused by an UNISOLABLE leak through an interfacing system. These EALs thus apply to leakage into the containment , a secondary-side system~ steam generator tube leakage in a PWR) or a location outside of containment.

The leak rate values for each EAL were selected because they are usually observable with normal Control Room indications.

Lesser values typically require time-consuming calculation s to determine (e.g., a mass balance calculation).

EAL SUS.I uses a lower value that reflects the greater significance of unidentified or pressure boundary leakage. 220 Nhl 99 U l (KeYJSJOR o) }lovemeer 2012 The release of mass from the RCS due to the as-designed/expected operation of a relief valve does not warrant an emergency classification.

For PWRs , an emergency classification would be required if a mass loss is caused by a relief valve that is not functioning as designed/expected (e.g., a relief valve sticks open and the line flov,r cannot be isolated). For BV/Rs, aA stuck-open Safety Relief Valve (SRV) or SRV leakage is not considered either identified or unidentified leakage by Technical Specifications and , therefore , is not applicable to this EAL. 221 f>J.el YY U I (Kev1s1on

6) 1'-lo't'ember 2012 The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage , if possible.

Escalation of the emergency classification level would be via I Cs of Recognition Category A-R orF. Developer Notes: EAL # 1 For the site specific leak rate value, enter the higher of 10 gpm or the value specified in the site's Technical Specifications for this type of leakage. EAL #2 For the site specific leak rate value, enter the higher of 25 gpm or the value specified in the site's Tech..'l:ical Specifications for this type of leakage. For sites that have Technical Specifications that do not specify a leakage type for steam generator tube leakage, developers should include an EAL for tube leakage greater than 25 gpm for 15 minutes or longer. EGL Assignment i\.ttributes:

3 .1.1.A 222

N el YY u l (Kev1s10n

6) N011ember 2012 SU5SU6 ECL: Notification of Unusual Event Initiating Condition:

Automatic or manual (trip [PWRJ / scram [B\l/R]) fails to shutdown the reactor. Operating Mode Applicability:

Pov,rer OperationU Nate: A manual action is any operator action , or set of actions , which causes the control rods to be rapidly inserted into the core , and does not include manually driving in control rods or implementation of boron injection strategies.

Example Emergency Action Levels: (1 or 2) Note: A manual action is any operator action , or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies. SU6.1 a. An automatic (trip [PWRJ / scran1 [B'NR]) did not shutdown the reactor. S 6.2 AND b. ANY of the following manual actions taken at 1C05 are successful in lowering reactor power below 5% power a.

• Manual Scram Pushbuttons

• Mode Switch to Shutdown

• Alternate Rod Insertion (ARI)A subsequent manual action taken at the reactor control consoles (1C05) is successful in shutting down the reactor. A manual trip ([PWRJ / scram [BVlR]) did not shutdown the reactor. AND b. EITHER of the following:

1. -ANY of the following subsequent manual actions taken at 1C05 are successful in lowering reactor power below 5% power

• Manual Scram Pushbuttons

• Mode Switch to Shutdown

• Alternate Rod Insertion (ARI)A subsequent manual action taken at the reactor control console (1 C05)s is successful in shutting down the reactor. ---__ OR 224 Definitions:

Basis: JI-lei yy OJ (KeYISIOR

6) 1>1011emeer 2012 2. -A subsequent automatic (trip [PWR] / scram [RWR]) is successful in shutting down the reactor. This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ttriP [PWR] I scram [BWR]) that results in a reactor shutdown, and either a subsequent operator manual action taken at the reactor control consoles or an automatic (trip [PWR] I scram [BWR]) is successful in shutting down the reactor. _This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant. Following the failure on an automatic reactor (trip [PWR] I scram [BWR]), operators will promptly initiate manual actions at the reactor control console s to shutdown the reactor ( e.g., initiate a manual reactor t trip [PWR] I scram [BWR])). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems. 225 Nb! 99 U l (Ke\'ISIOA

6) l>l oyemeer 2012 If an initial manual reactor (trip [PWR] I scram [BWR]) is unsuccessful , operators will promptl y take manual action at another location(s) on the reactor control console s to shutdown the reactor (e.g., initiate a manual reactor (trip [PWR] I scram [BWR])) using a different switch). Depending upon several factors, the initial or subsequent effort to manually (trip [PWR] I scram [BWR]) the reactor , or a concurrent plant condition, may lead to the generation of an automatic reactor ftrip [PWR] I scram [BWR]) signal. If a subsequent manual or automatic (trip [PWR] I scram [BWR]) i s successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems. A manual action at the reactor control console s is any operator action , or set of actions , which causes the control rods to be rapidly inserted into the core ( e.g., initiating a manual reactor ftrip [PWR] I scram [BWR])). This action does not include manually driving in control rods or implementation of boron injection strategies.

Actions taken at back-panels or other locations within the Control Room , or any loc at ion outside the Control Room , are not considered to be "at the reactor control console s". Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action. [BWR] The plant respons e to the failure of an automatic or manual reactor (trip [P\VR] / scram [B\VR]) will vary based upon several factors including the reactor power l evel prior to the event , availability of the condenser, performance of mitigation equipment and actions , other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor , then the emergency classification level will escalate to an Alert via IC SA~§.. Depending upon the plant response , escalation is also possible v i a IC F Al. Absent the plant conditions needed to meet either IC SA~§. or F Al , an Unusual Event declaration is appropriate for this event. The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).A reactor shutdovm is determined in accordance 1.vith applicable Emergency Operating Procedure criteria.

Should a reactor (trip [P'.VR] / scram [BWR]) signal be generated as a result of plant work ( e.g., RPS setpoint testing), the following classification guidance should be applied. I

• If the signal causes a plant transient that should have included an automatic reactor ftrip [P\VR] I scram [BWR]) and the RPS fai l s to automatically shutdown the reactor , then this IC and the EALs are applicable , and should be evaluated.

If the signal does not cause a plant transient and the (trip [PWR] / scram [BWR]) failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not app l icable and no classification is warranted.

DfY.*eleper Netes: This IC is applicable in any Mode in which the actual reactor power level could e>cceed the power level at which the reactor is considered shutdovm.

A PWR 1,vith a shutdown reactor power level that is less than or equal to the reactor power level which defines the lower bound of Power Operation (Mode 1) will need to include Startup (Mode 2) in the Operating Mode Applicability.

For example, if the reactor is considered to be shutdovm at 3% and Pov;er Operation stmis at >5%, then the IC is also applicable in Startup Mode. 226

,"JlH 99 U l (K.eYJSIOH

6) *November 2012 Developers may include site specific EOP criteria indicative of a successful reactor shutdovm in an EAL statement, the Basis or both (e.g., a reactor power level). The term " reactor control consoles" may be replaced with the appropriate site specific term (e.g., main control boards). EGL Assignment Attributes:

3 .1.1.A 22 7

Nel yy u l (K.e*,'ISIOR a) }JoYeffieer 2() J 2 SU6SU7 ECL: Notification of Unusual Event Initiating Condition:

Loss of all-ALL onsite or offsite communications capabilities.

Operating Mode Applicability:

Power Operation, 8tartup, Hot 8tandby, Hot 8hutdown.L._U Example Emergency Action Levels: (1 or 2 or 3) S 7.1 fillL 2 S 7.3 Basis: Los s of ALL of the following onsite communication methods: _* _(site specific list of communications methods) Plant Operations Radio System

• In-Plant Phone System

• Plant Paging System (Gaitronics)

Loss of ALL of the following GROoffsite response organization communications methods: _* _(site specific list of communications methods) DAEC All-Call phone

• All telephone lines (PBX and commercial)

• Cell Phones (including fixed cell phone system)

• Control Room fixed satellite phone system

• FTS Phone system Loss of ALL of the following NRC communications methods: _* _(site specific list of communications methods) FTS Phone system

• All telephone lines (PBX and commercial)

• Cell Phones (including fixed cell phone system)

• Control Room fixed satellite phone system This IC addresses a significant loss of on-site or offsite communications capabilities.

While not a direct challenge to plant or personnel safety , this event warrants prompt notifications to GROoffsite response organization s and the NRC. This IC should be assessed only when extraordinary means are being utilized to make communications possible ( e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points , individuals being sent to offsite locations, etc.). 229

Nel W O I (KeYIS10A e) NeYemaer 2012 EAL SU7 .1 addresses a total loss of the communications methods used in support of routine plant operations.

EAL SU7.2 addresses a total loss of the communications methods used to notify all GRGoffsite response organization s of an emergency declaration.

The GRGoffsite response organization s referred to here are-the State of Iowa, Linn County. and Benton County (see Developer Notes). ---EAL SU7.3 addresses a total loss of the communications methods used to notify the NRC of an emergency declaration. DeYelapeF Nates: EAL #1 The "site specific list of communications methods" should include all communications methods used for routine plant communications (e.g., commercial or site telephones, page party systems, radios, etc.). This listing should include installed plant equipment and components , and not items owned and maintained by individuals.

EA.L #2 The " site specific list of communications methods" should include all communications methods used to perform initial emergency notifications to OROs as described in the site Emergency Plan. The listing should include installed plant equipment and components, and not items ovmed and maintained by individuals.

Example methods are ring dovm/dedicated telephone lines, commercial telephone lines , radios, satellite telephones and internet based communications technology. In the Basis section, insert the site specific listing of the OROs requiring notification of an emergency declaration from the Control Room in accordance 1vvith the site Emergency Plan, and typically within 15 minutes. EAL #3 The "site specific list of communications methods" should include all communications methods used to perform initial emergency notifications to the NRG as described in the site Emergency Plan. The listing should include installed plant equipment and components , and not items ovmed and maintained by individuals.

These methods are typically the dedicated Emergency Notification System (ENS) telephone line and commercial telephone lines. EGL Assignment Attributes:

3 .1.1. C 231

SU7 ECL: Initiating Condition:

AND DevelefJeF Notes: Nb! 99 U ! (KeYI S IOA e) J>l o¥ember 2012 Enter the "site specific pressure" value that actuates containment pressure control systems (e.g., containment spray). A.lso ent e r the site specific containment pressure control system/equipment that should be operating per design if the containment pressure actuation setpoint is reached. If desired , specific condition indications such as parameter values can also be entered (e.g., a containment spray flov,r rate less than a certain value). EAL #2 is not applicable to the U.S. E volutionary Pow e r R e actor (EPR) design. EGL Assignment .Attributes:

3 .1.1.A 23 4

ECL: Alert N hi YY U I (Kev1s1on

6) ~Jovember 2012 SA1 Initiating Condition:

Loss of al!-ALL but one AC power source to emergency essential buses for 15 minutes or longer. Operating Mode Applicability:

Pov,er Operation, Startup, Hot Standby, Hot Shutdown.L..LJ Example Emergency Action Level s: Note: The Emergency Dir e ctor should declare the Alert promptly upon determining that 15_ minutes has been e x ceeded , or will likely be exceeded.

~1 a. AC power capability to (site specific emergency buses)1A3 and 1A4 buses is reduced to a single power source for 15 minutes or longer. AND b. Any MlYANY additional single power source failur e will result in a loss of all ALL AC power to SAFETY SYSTEMS. Definitions:

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as related. Basis: This IC describes a significant degradation of offsite and onsite AC power sources such that an y additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition , the sole AC power source may be powering one , or more than one , train of safetyrelated equipment.

This IC provides an escalation path from IC SUI. An "AC power source" is a source recognized in AOPs and EOPs , and capable of supplying required power to an emergency bus. Some examples of this condition are presented below.

• A loss of all offsite power with a concurrent failure of all but one emergency power source ( e.g., an onsite diesel generator). * ,e.~ loss of all offsite power and loss of all emergency power sources (e.g., onsite diesel generators) 1.vith a single train of emergency buses being back fed from the unit main generator.

• A loss of emergency power sources ( e.g., onsite diesel generators) with a sing le train of essentialemergency buses being-baek:-fed from an offsite power source. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power. Escalation of the emergency classification level would be via IC SS 1. 236 Develeper Netes: !>Hil YY (::l l (K0YISIOH a) ~lo\'ember 2012 For a po,.ver source that has multiple generators, the EAL and/or Basis section should reflect the minimum number of operating generators necessary for that source to provide required power to an AC emergency bus. For e>mmple , if a backup power source is comprised of two generators (i.e., two 50% capacity generators sized to feed 1 A.C emergency bus), the EAL and Basis section must specify that both generators for that source are operating.

The "site specific emergency buses" are the buses fed by offsite or emergency A.C power sources that supply power to the electrical distribution system that pov,<ers SAFETY SYSTEMS. There is typically 1 emergency bus per train of SAFETY SYSTEMS. Developers should modify the bulleted e>mmples provided in the basis section, above, as needed to reflect their site specific plant designs and capabilities. The EALs and Basis should reflect that each independent offsite power circuit constitutes a single povrer source. For example , three independent 345kV offsite power circuits (i.e., incoming power lines) comprise three separate power sources. Independence may be determined from a review of the site specific UFSA.R , SBO analysis or related loss of electrical po1tver studies. The EAL and/or Basis section may specify use of a non safety related power source provided that operation of this source is recognized in AOPs and EOPs , or beyond design basis accident response guidelines (e.g., FLEX support guidelines).

Such power sources should generally meet the "Alternate ac source" definition provided in 10 CFR 50.2. At multi unit stations, the EALs may credit compensatory measures that are proceduralized and can be implemented within 15 minutes. Consider capabilities such as power source cross ties , "swing" generators , other po1,ver sources described in abnormal or emergency operating procedures, etc. Plants that have a proceduralized capability to supply offsite AC power to an affected unit via a cross tie to a companion unit may credit this power source in the EAL provided that the planned cross tie strategy meets the requirements of 10 CFR 50.63. EGL Assignment Attributes:

3 .1.2.B 237 ECL: Alert Ne l 99 u l (Kev1s1on o) November 2012 SA2S A3 Initiating Condition:

UNPLANNED loss of Control Room indications for 15 minutes or lon ger with a significant transient in progress.

Operating Mode Applicability:

Power Operation, Startup, Hot Standby, Hot Shutdownh_U Examp l e Emergency Action Level s: Note: The Emergency Director should declar e the Ale1i promptly upon determining that 15_ minutes has been exceeded, or wi ll lik ely be exceeded. S 3.1 a. An UNPLANNED event results in the inability to monitor one or more of the following parameters from within the Control Room for 15 minutes or longer.

• Reactor Power

• RPV Water Level

• RPV Pressure

• Primary Containment Pressure

• Suppress i on Pool Level -suppression Pool Temperature

• Suppression Pool Temperature AND __ b'--. __ ANY of the following transient events in progress.

D efiniti o ns:

• Automatic or manual runback greater than 25% thermal reactor power

• E lectrical load rejection greater than 25% full electrical load

• Reactor scram [BWR] / trip [PWRJ ._ECCS fSB-actuation

• ._ Thermal power oscillations greater than 10% [BWR]

• 238 Nel YY 01 (Ke111s1on o) 1'l O\'ember 2012 SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as safety-related.

UNPLANNED:

A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient.

The cause of the parameter change or event may be known or unknown. Basis: This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantia l degradation in the l evel of safety of the plant. 239 f'lel W u I (Kev1s1on

6) l>Jo*,emeer 2012 As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog , digital and recorder source within the Control Room. An event involving a loss of plant indications , annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required.

The event would be reported if it significantly impaired the capability to perform emergency asse s sments. In particular, emergency assessments necessary to implement abnormal operating procedures , emergency operating procedures , and emergency plan implementing procedures addressing emergency classification , accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions ofreactivity control , core cooling [PWR] I RPV level [BWR] and RCS heat removal. The lo s s of the ability to determine on e or mor e of these parameters from within the Control Room is considered to be more significant than simply a reportable condition.

In addition , if all indication sources for one or more of the listed parameters are lost , then the ability to determine the values of other SAF E TY SYSTEM parameters may be impacted as well. For example , if the value for reactor vessel level [PWR] I RPV water level [BWR] cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer , the availability of other parameter values may be compromised as well. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification level would be via ICs FSI or IC A&l-RSI. Develeper Netes: In the PWR parameter list column, the "site specific number" should reflect the minimum number of steam generators necessary for plant cooldown and shutdown.

This criterion may also specify whether the level value should be 1.vide range, narrow range or both, depending upon the monitoring requirements in emergency operating procedures.

Developers may specify either pressurizer or reactor vessel level in the PWR parameter column entry for RCS Level. Developers should consider if the "transient events" list needs to be modified to better reflect site specific plant operating characteristics and expected responses. The number, type , location and layout of Control Room indications , and the range of possible failure modes , can challenge the ability of an operator to accurately determine, within the time period available for emergency classification assessments , if a specific percentage of indications have been lost. The approach used in this EAL facilitates prompt and accurate emergency classification assessments by focusing on the indications for a selected subset of parameters.

By focusing on the availability of the specified parameter values, instead of the sources of those values , the EAL recognizes and accommodates the wide variety of indications in nuclear power plant Control Rooms. Indication types and sources may be analog or digital , safety related or not , primary or alternate , individual meter value or computer group display , etc. 240 Nel \.J\.J O l (Kev1s1on

6) *November 2012 A loss of plant annunciators will be evaluated for reportability in accordance with 10 CFR 50.72 (and the associated guidance in NUREG 1022), and reported if it significantly impairs the capability to perform emergency assessments.

Compensatory measures for a loss of annunciation can be readily implemented and may include increased monitoring of main control boards and more frequent plant rounds by non licensed operators.

Their alerting function notwithstanding , annunciators do not provide the parameter values or specific component status information used to op e rate the plant , or process through l..OPs or EOPs. Based on these considerations, a loss of ar..nunciation is considered to be adequately addressed by reportability criteria , and therefore not included in this IC and EA.L. With respect to establishing event severity , the response to a loss of radiation monitoring data (e.g., process or effluent monitor valu e s) is considered to be ad e quately bounded by the requirements of 10 CFR 50.72 (and associated guidance in l'JUREG 1022). The reporting of this event will ensure adequate plant staff and NRG U\vareness , and drive the establishment of appropriate compensatory measures and corrective actions. In addition , a loss of radiation monit o ring data, by its e lf , is not a pr e cursor to a more significant e vent. Personnel at sites that have a Failure Modes and Effects Analysis (FMEA) included within the design basis of a digital I&C system should consider the F MEA information vlhen developing their site specific EA.Ls. Due to changes in the configurations of SAFETY SYSTEMS , including associated instrumentation and indications , during the cold shutdown , refueling , and defueled modes , no analogous IC is included for these modes of operation.

EGL A.ssignment l..ttributes:

3.1.2.B 2 41

ECL: Alert Nel 99 u I (Ke 1 ,r1s1on 6) NoYember 2012 SA5SA6 Initiating Condition:

Automatic or manual (trip [P',\ZR] / scram [BWR]) fails to shutdown the reactor, and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor. Operating Mode Applicability:

Power Operation.L.2 Note: A manual action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core , and does not include manually driving in control rods or implementation of boron injection strategies. l EHm~le EmergeeeyEmergenci,:

Action Level s: 1 a. An automatic or manual (trip [PWR] / scram [BWR]) did not shutdown the reactor. b. Definitions:

Basis: AND ALL of the following manual actions taken at 1C05 are not successful in lowering reactor power below 5% power

• Manual Scram Pushbuttons

• Mode Switch to Shutdown

• Alternate Rod Insertion (ARI)Manual actions taken at the reactor control consoles (1 C05) are not successful in shutting down the reactor. This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ftfip [PWR] I scram [BWR]) that results in a reactor shutdown, and subsequent operator manual actions taken at the reactor control consoles to shutdown the reactor are also unsuccessful.

This condition represents an actual or potentia l substantial degradation of the l evel of safety of the plant. An emergency declaration is requi r ed even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant fai lur e of the RPS. A manual action at the reactor control consoles is any operator action, or set of actions , which causes the control rods to be rapidly inserted into the core ( e.g., initiating a manual reactor ftfip [PWR] I scram [BWR])). This action does not include manually driving in control rods or implementation of boron injection strateg i es. If this action(s) is unsuccessful , operators would immediately pursue additional manual actions at locations away from the reactor control consoles (e.g., locally opening breakers).

_Actions taken at back-panels or other locations within 243 Nel W Ul (Kev1s1on

6) :t-Jo 1 1ember 2012 the Control Room , or an y location outside the Control Room , are not considered to be " at the reactor control consoles.,_-:-244 Nbl 99 Ul (K.eYISIOfl e) NoYemeer 2012 Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action. [BWR] 245 NeL YY u L (Kev1s1on o) l>foyember 2012 The plant response to the failure of an automatic or manual reactor (trip [PWR] I scram [BWR]) will vary based upon several factors including the reactor power level prior to the event, availability of the condenser , performance of mitigation equipment and actions , other concurrent plant conditions, etc. If the failure to shutdown the reactor is prolonged enough to cause a challenge to the core cooling [P\VR] / RPV water level [BWR] or RCS heat removal safety functions , the emergency classification level will escalate to a Site Area Emergency via IC SS~§_. Depending upon plant responses and symptoms, escalation is also possible via IC FS 1. Absent the plant conditions needed to meet either IC SS~§_ or FS 1 , an Alert declaration is appropriate for this event. It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however , this IC and EAL are included to ensure a timely emergency declaration. The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.

Develaper Nates: This IC is applicable in any Mode in which the actual reactor power level could e>weed the pmver level at which the reactor is considered shutdovm.

/' .. PWR ,.vith a shutdown reactor pmver level that is less than or equal to the reactor power level which defines the lower bound of Power Operation (Mode 1) vlill need to include Startup (Mode 2) in the Operating Mode Applicability.

For e>rnmple, if the reactor is considered to be shutdown at 3% and Power Operation starts at >5%, then the IC is also applicable in Startup Mode. Developers may include site specific EOP criteria indicative of a successful reactor shutdown in an EAL statement , the Basis or both (e.g., a reactor pov,er level). The term " reactor control consoles" may be replaced with the appropriate site specific term (e.g., main control boards). EGL Assignment Attributes:

3.1.2.B 246

Nhl 99 U l (Kev1s1on o) *November 2012 SA9SA8 ECL: Alert Initiating Condition:

Hazardous event affecting a SAFETY SYSTEM needed for the current operating mode. Operating Mode Applicability:

Power Operation, Startup, Hot Standby, Hot Shutdovml, 2, 3 Example Emergency Action Level s: Notes:

• If the affected SAFETY SYSTEM train was already inoperable or out of service before the hazardous event occmTed, then this emergency classification is not warranted.

• If the hazardous event only resulted in VISIBLE DAMAGE, with no indications of degraded performance to at least one train of the SAFETY SYSTEM, then this emergency classification is not warranted. ---For a single train SAFETY SYSTEM, degraded performance which results in loss of the safety function of the SAFETY SYSTEM * ~1 a. b. The occurrence of ANY of the following hazardous events:

• Seismic event (earthquake)

• Internal or external flooding event

• High winds or tornado strike

• FIRE

• EXPLOSION

~(site speeifie haz:a-rds)River level above 75 7 feet

• River Water Supply (RWS) pit low level alarm .._

• Other events with similar hazard characteristics as determined by the Shift Manager or Emergency Director AND 1. 2. Event damage has caused indications of degraded performance in one train of a SAFETY SYSTEM needed for the current operating mode. AND EITHER of the following:

• Event damage has caused indications of degraded performance to a second train of the SAFETY SYSTEM needed for the cmTent operating mode,

• Th e ev e nt has resulted in VISIBLE DAMAGE to the second train of a SAFETY SYSTEM needed for the current operating mode, 248

,"l el 99 u l (Ke*,1s10A e) l>leYember 2012

• Loss of the safety function of a single train SAFETY SYSTEM. Event damage has caused indications of degraded performance to a second train of the SAFETY SYSTEM needed for the current operating mode, or The event has resulted in VISIBLE DA.MAGE to the second train of the SAFETY SYSTEM needed for the current operating mode. Loss of the safety function ofa single train SAFETY SYSTEM. 249 Definitions:

N bl L)L) U I (Kev1s1on

6) }lo't'emeer 2012 EXPLOSION:

A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization.

A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion.

Such events may require a post-event inspection to determine if the attributes of an explosion are present. FIRE: Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as related. VISIBLE DAMAGE: Damage to a component or structure that is readily observable without measurements, testing, or analysis.

The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not VISIBLE DAMAGE. EITHER of the following:

1. Event damage has caused indications of degraded performance in at least one train of a SAFETY SYSTEM needed for the current operating mode. OR 2. The event has caused VISIBLE DAl\4AGE to a SAFETY SYSTEM component or structure needed for the current operating mode. Basis: This IC addresses a hazardous event that causes damage to SAFETY SYSTEMS needed for the current operating mode. In order to provide the appropriate context for consideration of an ALERT classification, the hazardous event must have caused indications of degraded SAFETY SYSTEM performance in one train, and there must be either indications of performance issues with the second SAFETY SYSTEM train or VISIBLE DAMAGE to the second train such that the potential exists for this second SAFETY SYSTEM train to have performance issues. In other words, in order for this EAL to be classified, the hazardous event must occur, at least one SAFETY SYSTEM train must have indications of degraded performance, and the second SAFETY SYSTEM train must have indications of degraded performance or VISIBLE DAMAGE such that the potential exists for performance issues. Note that this second SAFETY SYSTEM train is from the same SAFETY SYSTEM that has indications of degraded performance for criteria SA98. l .b.1 of this EAL; commercial nuclear power plants are designed to be able to support single system issues without compromising public health and safety from radiological events. Indications of degraded pe1fom1ance addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available.

The indications of degraded 250 N bl 99 U l (Ke\'1510A e) Novemeer 2012 performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train. 251 f>H~l YY U 1 (Kev1s1on

6) ~l 0 1 ,emeer 2012 VISIBLE DAMAGE addresses damage to a SAFETY SYSTEM train that is not in service/operation and that potentially could cause performance issues. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. This VISIBLE DAMAGE should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train. 252 N el !.J!.J u I (Ke111s1on a) ~loYeR'lber 2012 This IC addresses a hazardous event that causes damage to a SA.FETY SYSTEM , or a structure containing SAFETY SYSTEM components , needed for the current operating mode. This condition significantly reduces the margin to a loss or potential loss of a fission product barrier , and th e refore represents an actual or potential substantial degradation of the level of safety of the f*iW; EAL 1.b. l addresses damage to a SAF E TY SYSTEM train that is in service/operation since indications for it will be r e adily available.

The indications of degraded performance should be significant enough to caus e concern regarding the operability or r e liability of the SAFETY SYSTEM train. EAL l .b.2 addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent thrnugh indications alone , or to a structure containing SAFETY SYSTEM components. Operators will make this d e t e rmination based on th e totality of available event and damage report information.

This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. Escalation of the emergency classification level wou ld be via IC FS 1 or AS+RS 1. De,,ele~eF Notes: For (s ite specific hazards), developers should consider including other significant , site specific hazards to the bulleted list contained in EAL l .a (e.g., a seiche). Nuclear power plant SAFETY SYSTEMS are comprised of two or more separate and redundant trains of equipment in accordance with site specific design criteria.

EGL Assignment Attributes:

3.1.2.B 253 Ne! l)l) u I (KevISIOA a) *November 2012 ECL: Site Area Emergency Initiating Condition:

Loss of ALLall offsite and all-ALL onsite AC power to emergency essential

-buses for 15 minutes or longer. SS1 Operating Mode Applicability:

Power Operation, 8tartup , Hot 8tandby , Hot 8hutdown.L..LJ Example Emergency Action Level s: Note: The Emergency Director should declare the Site Area Emergency promptly upon determining that 15 minutes has been exceeded, or will likely be exceeded.

S 1.1 Loss of ALL offsite and ALL onsite AC power to (site specific emergency buses)1A3 and 1A4 for 15 minutes or longer. Definitions:

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as related. Basis: This IC addresses a total loss of AC power that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. In addition, fission product barrier monitoring capabilities may be degraded under these conditions.

This IC represents a condition that involves actual or likely major failures of plant functions needed for the protection of the public. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. Escalation of the emergency classification level would be via I Cs AG+RG 1 , FG 1 or SG 1. DeYeloper Notes: For a power source that has multiple generators, the EAL and/or Basis section should reflect the minimum number of operating generators necessary for that source to provide adequate pov,rer to an A .. C emergency bus. For e>mmple , if a backup pov,rer source is comprised of two generators (i.e., tv,ro 50% capacity generators sized to feed 1 AC emergency bus), the EAL and Basis section must specify that both generators for that source are operating.

The " site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers 8AFETY 8Y8TEM8. There is typically 1 emergency bus per train of 8AFETY 8Y8TEM8. 254 t>U~I yy u I (KeYISIOA e) }Jo11ember 2012 The EAL and/or Basis section may specify use of a non safety related power source provid~d that operation of this source is controlled in accordance 1~, 1 ith_ abnormal or eme~gency op~rat~ng procedures or beyond design basis accid e nt response gmdelmes (e.g., FLEX suppo~ gm~elmes). Such powe~* sources should generally meet the " Alternate ac sourc e" definition provided m 10 CFR 50.2. At multi unit stations , the EA.Ls may credit compensatory measures that are proceduralize~

and can b e implemented within 15 minutes. Consider capabilities such as pmver source ~ross ties , " sv,ing" generators , other power sources describ e d in abnormal or emerge~cy operatmg procedures , etc. Plants that have a proceduralized capabi~ity

~o supply offs1te _AC power to an affected unit via a cross tie to a companion unit may credit this pmver source m the EAL provid e d that the planned cross tie strat e g y me e ts the requirements of 10 CFR 50.63. EGL Assignment Attributes:

3.1.3.B 255 ECL: Site Area Emergency Nel 99 U l (Kev1s1on

6) l>Jovember 2012 SS8SS2 Initiating Condition:

Loss of ALL Vital DC power for 15 minutes or longer. Operating Mode Applicability:

1, 2, 3 Emergency Action Levels: Note: The Emergency Director should declare the Site Area Emergency promptly upon determining that 15 minutes has been exceeded, or will likely be exceeded.

=S-'!'-=-2'-=.1 __ .Indicated voltage is less than (site specific bus voltage value) 105 VDC on ALL(site specific Vital DC busses) BOTH Div 1 and Div 2 125 VDC buses for 15 minutes or longer. Definitions:

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as related. Basis: This IC addresses a loss of Vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public. Minimum DC bus voltage selected due to automatic trip of the inverters at 105 VDC decreasing.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. Escalation of the emergency classificat i on level would be via I Cs AG-1-RG 1 , FG 1 or SG2. 256 Nb! 1)1) U I (K0YISIOR a) 1>lovember 2012 SS5SS6 ECL: Site Area Emergency Initiating Condition:

Inability to shutdown the reactor causing a challenge to (core cooling [PWR] I RPV water level [BWR]) or RCS heat removal. Operating Mode Applicability:

Pov;er OperationLl Example Emergency Action Levels: S 6.1 a. An automatic or manu a l (trip [PWR] / scram [B\VR]) did not shutdown the reactor. AND b. ALL of the following manual actions taken at 1C05 are not successful in lowering reactor power below 5% power:

• Manual Scram Pushbuttons

• Mode Switch to Shutdown

• Alternate Rod Insertion (ARI)All manual actions to shutdown the reactor have been unsuccessful.

AND c. EITHER of the following conditions exist: _* _(Site specific indication of an inability to adequately remove heat from the core) Reactor vessel waterRPV level cannot be restored and maintained above -25 inches. OR * (Site specific indication of an inability to adequately remove heat from the ~HCL (Graph 4 ofEOP 2) exceeded.

Definitions:

Basis: This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ftrip [PWR] I scram [BWR]) that results in a reactor shutdown, all subsequent operator actions to manually shutdown the reactor are unsuccessful , and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.

257

?>lei YY 01 lKe111s1on o) }J 0 1 ,erneer 2012 In some instances, the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition Category F ICs/EALs.

This is appropriate in that the Recognition Category F ICs/EALs do not address the additional threat posed by a failure to shutdown the reactor. The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shutdown the reactor. The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power). A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria.

Escalation of the emergency classification level would be via IC AG-1-RG 1 or FG 1. DevelepeF Netes: This IC is applicable in any Mode in which the actual reactor power level could e>weed the pov,rer level at which the reactor is considered shutdov,CJ1.

A. P'."VR with a shutdown reactor power level that is less than or equal to the reactor power level which defines the lov,rer bound of P01.v e r Operation (Mode 1) will need to include Stmiup (Mode 2) in the Operating Mode l\pplicability.

For example , if the reactor is considered to be shutdov,n at 3% and Pov,rer Operation stmis at >5%, then the IC is also applicable in Startup Mode. Developers may include site specific EOP criteria indicative of a successful reactor shutdovm in an EAL statement , the Basis or both (e.g., a reactor pmver level). Site specific indication of an inability to adequately remove heat from the core: [BWR] Reactor vessel water level ear.not be restored and maintained above Minimum Steam Cooling RPV Water Level (as described in the EOP bases). [PWR] Insert site specific v alues for an incore/core e>cit thermocouple temperature and/or reactor vessel water level that drives entry into a core cooling restoration procedure (or otherwise requires implementation of prompt restoration actions).

i\ltemately, a site may use incore/core e>cit thermocouple temperatures great e r than 1 , 200°F and/or a reactor vessel water level that corresponds to approximately the middle of active fuel. Plants with reactor vessel level instrumentation that car.not measure dovm to apprmcimately the middle of active fuel should use the lov,rest on scale reading that is not above the top of active fuel. If the lowest on scale reading is above the top of active fuel , then a reactor vessel level value should not be included.

For plants that have implemented Westinghouse Owners Group Emergency Response Guidelines , enter the parameters used in the Core Cooling Red Path. Site specific indication of an inability to adequately remove heat from the RCS: [BWR] Use the Heat Capacity Temperature Limit. This addresses the inability to remove heat via th e main condenser and the suppression pool due to high pool water temperature.

[PWR] Insert site specific parameter s a s sociated with inadequate RCS heat removal via the steam generators.

These parameter s should be identical to those used for the Inadequate Heat Removal threshold Fuel Clad Barrier Potential Loss 2.B and threshold RCS Barrier Potential Loss 2.A in the P'.VR EAL Fission Product Barrier Table. 258 EGL A.ssignment Attributes:

3 .1. 3 .B 259 F>Jel yy u l (Kev 1 s 1 0R 6) ~leYemeer 2012 SS& ECL: Site Area Emergency Initiating Condition:

Loss of all Vital DC power for 15 minutes or longer. Nel yy U I (KeYISIOR

0) J>JOY6FR06F 20)3 Operating

• Mede Applieability:

Povf'e r Operation , Startup , Hot Standby , Hot 8hutdovml, 2 , 3, 4 Example Emergeney Aetien Levels: Note: The Emergency Director should declare the Site A.rea Emergency promptly upon determining that 15 minutes has been e)cceeded , or will likely be exceeded. 1 Indicat e d voltage is less than (site specific bus voltage value) 115 VDC on ALL (site specific Vital DC busses)1(2)

D 01, D 02, D 03, and D 04 for 15 minutes or longer. Basis: SAFETY SYSTEM: /\. system requir e d for safe plant operation, cooling dovm the plant and/or placing it in the cold shutdown condition , including the EGGS. Systems classified as safety related. This IC addresses a loss of Vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold 8hutdovm , this condition involves a major failur e of plant functions ne e ded for th e prot e ction of th e public. Fifteen minutes v,ras selected as a thre s hold to e)cclude transient or momentary power losses. Escalation of the emergency classification level would be via ICs AGlRQl , FGl or 808. Developer Notes: The " site specific bus voltage value" should b e based on the minimum bus voltage necessary for adequate operation of SAFETY SYSTEM equipment. This voltage value should incorporate a margin of at least 15 minutes of operation before the onset of inability to operate those loads. This voltage is usually near the minimum voltage selected when battery sizing is performed.

The typical value for an entire battery set i s apprmcimately 105 VDC. For a 60 cell string of batteries , the cell voltage is approximately 1.75 Volts per cell. For a 58 string battery set , the minimum voltage is apprmcimately 1.81 Volts per cell. The " site specific Vital DC busses" are the DC busses that provide monitoring and control capabilities for SAFETY SYSTEMS. EGL Assignment Attributes:

3.1.3.B 260 Nbl IJIJ U I (KeYISIOR

6) :Jlfoye rneer 2012 SG1 ECL: General Emergency Initiating Condition:

Prolonged loss of all-ALL offsite and ALLall onsite AC power to emergency essential buses. Operating Mode Applicability:

Pov,er Operation, 8tartup, Hot 8tandby, Hot 8hutdown.L._U Example Emergency Action Level s: Note: The Emergency Director should declare the General Emergency promptly upon determining that (site specific hours)4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> has been exceeded , or will likely be exceeded.

a. Loss of ALL offsite and ALL onsite AC power to 1A3 and 1A4 specific emergency buses). AND b. EITHER of the following:

Definitions:

.!.__Restoration of at least one AC emergency essential bus in less than specific hours)4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is not likely. OR * (8ite specific indication of an inability to adequately remove heat from the eerejRPV level cannot be restored and maintained above -25 inches. SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. Systems classified as related. Basis: This IC addresses a prolonged loss of all power sources to AC emergency essential buses. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A prolonged loss of these buses will lead to a loss of one or more fission product barriers. In addition , fission product barrier monitoring capabilities may be degraded under these conditions. The EAL should require declaration of a General Emergency prior to meeting the thresho l ds for IC FG 1. This will allow additional time for implementation of offsite protective actions. Escalation of the emergency classification from Site Area Emergency will occur if it is projected that power cannot be restored to at least one AC emergency essential bus by the end of the analyz:ed 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> station blackout coping period. Beyond this time , plant responses and event trajectory are subject to greater uncertainty, and there is an increased likelihood of challenges to multiple fission product barriers.

261 I N el YY u I (Ke 1 11s1on 6) Noveffiber 2012 The estimate for restoring at least one essentialemergency bus should be based on a realistic appraisal of the situation.

Mitigation actions with a low probability of success should not be used as a basis for delaying a classification upgrade. The goal is to maximize the time available to prepare for, and implement, protective actions for the public. 262 Nbl IJY U I lK0YISIOA

6) 1>lovember 2012 The EAL will also require a General Emergency declaration if the loss of AC power results in parameters that indicate an inability to adequately remove decay heat from the core. De:Yeloper Notes: Although this IC and EAL may be viewed as redundant to the Fission Product Barrier ICs, it is included to provide for a more timely escalation of the emergency classification level. The "site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers SA.FETY SYSTEMS. There is typically 1 emergency bus per train of SAFETY SYSTEMS. The " site specific hours" to restore AC power to an emergency bus should be based on the station blackout coping analysis performed in accordance with 10 CFR § 50.63 and Regulatory Guide 1.15 5, SUltion Biflckout.

Site specific indication of an inability to adequately remove heat from the core: [BWR] Reactor vessel water level cannot be restored and maintained above Minimum Steam Cooling RPV Water Level (as described in the EOP bases). [PWR] Insert site specific values for an incore/core mcit thermocouple temperature and/or reactor vessel 1.vater level that drive entry into a core cooling restoration procedure (or otherwise requires implementation of prompt restoration actions).

Alternately, a site may use incore/core e1(it thermocouple temperatures greater than 1 , 200°F and/or a reactor vessel water level that corresponds to approximately the middle of active fuel. Plants with reactor vessel level instrumentation that cannot measure dovvn to apprm(imately the middle of active fuel should use the lowest on scale reading that is not above the top of active fuel. If the lov,est on scale reading is above the top of active fuel, then a reactor vessel level value should not be included.

For plants that have implemented Westinghouse Ov,rners Group Emergency Response Guidelines , enter the parameters used in the Core Cooling Red Path. EGL Assignment Attributes:

3.1.4.B 263 t>J bl YY u I (Kev1s1on a) 1'lo*;ember 2012 SG8SG2 ECL: General Emergency Initiating Condition:

Loss of all-ALL AC and Vital DC power sources for 15 minutes or longer. Operating Mode Applicability:

Power Operation , Startup , Hot Standby , Hot Shutdovm.L..LJ Example Emergency Action Level s: Note: The Emergency Director should declare the General Emergency promptly upon determining that 15 minutes has b een exceeded , or will likel y be exceeded.

a. Loss of ALL offsite and ALL onsite AC power to (sit e specific emergency

---

+btt1uts-se~sTi) 1A3 and 1A4 for 15_-minutes or longer. AND b. Indicated voltage is less than (site specific bus voltage value) 105 VDC on Abb (site speeifie Vital DC busses) BOTH Div 1 and Div 2 125 VDC buses for 15 minutes or longer. Definitions:

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition , including the ECCS. Systems classified as related. Basis: This IC addresses a concurrent and prolonged loss of both AC and Vital DC power. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control , spent fuel heat removal and the ultimate heat sink. A loss of Vital DC power compromises the ability to monitor and control SAFETY SYSTEMS. A sustained loss of both AC and DC power will le ad to multiple challenges to fission product barriers.

Minimum DC bus voltage s e lected due to automatic trip of the inverters at 105 VDC decreasing. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. The 15-minute emergency declaration clock begins at the point when both EAL thresholds are met. DevelepeF Netes: The "site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typically 1 emergency bus per train of SAFETY SYSTEMS. The " site specific bus voltage value" should be based on the minimum bus voltage necessary for adequate operation of SA.FETY SYST E M equipment.

This voltage value should incorporate a margin of at least 15 minutes of operation before the onset of inability to operate 264 Net YY u I (Kev1s1on e) :t>lo 1 remaer 2012 those loads. This *roltage is usually near the minimum voltage selected when battery sizing is performed.

The typical value for an entire battery set is apprmcimately 105 VDC. For a 60 cell string of batteries , the cell voltage is approximately 1.75 Volts per cell. For a 58 string battery set, the minimum voltage is apprmcimately 1.81 Volts per cell. The " site specific Vital DC busses" are the DC busses that provide monitoring and control capabilities for Si\,FETY SYSTEMS. This IC and EAL were added to Revision 6 to address operating experience from the March , 2011 accident at Fukushima Daiichi. EGL A.ssignment Attributes:

3.1.4.B 265 N E! 99 01 (Rev i sioR 6) : November 20 1 2 APPEND I X A -ACRONYMS AND ABBREVIATIONS AC ...................................................................................................................... A l terna t ing Current A OP ...........................................

...................................................... Abnorma l Opera t i n g P roce d ure A .......................................................................................................................................... I'i PR.14 .................................................................................................... Av e rag e Power Range : M e ter A TWS .......................................................................

............ Anticipated Transie n t Wit h o u t Scram ...................................................................

....................................................................... B &V..' ........................................................................

........................................... Babcock and V..'ilco>E .......................................................................................................................................... B IIT ....................................................................................... Boron Inj e ction Initiation Temperature BW R ............................................................................................................. Boi l i n g Wa t er R eactor C D E ..........................................................................

............................ Committe d D ose E qu ivalent CF R ........................................................................................

.............. Code o f Federa l R eg ul ation s CT~4T/CNMT ............................................................................................................... Containment

.................................................................

......................................................................... C SF .............................................

................................................................... Critical Safety Function ...........................................................................................................

............................... C SFST ..........................................................................

.............. Critical Safety Function Status Tree .....................................

...............................................................................

...................... D Bf ................................................................................................................... D es i g n Ba s is Accid e nt D C .............................................................................................................................. Dir ec t Current EAL .................................................................

.......................................... Emerge n cy Action Level ECCS ............................................................................................ Emergen c y Core Coo l i n g System ECL ................................................................................................ Emerge n cy C l assification Level E O F .................................................................................................. E merge n cy O p eratio n s Fac il ity E OP ............................................................................................... Emerge nc y Opera t ing P roce d ure E P A ............................................................................................. Environme n tal Protectio n Agenc y E P G ............................................................................................... E merge n cy Procedure Guideline

.......................................................................................................................................... E PIP ................................................................................... Eme rg e nc y Plan Impl e m e nting Proc e dur e ............................................

.............................................................................................. E PR ......................................................................................................... E volutionary Povrer Reactor ..................................................................................

........................................................ E PRI ............................................................................................... E lect r ic Pov 1e r Research Institute

.......................................................................................................................................... E RG .................................................................................................. E m e r ge ncy R e sponse Guideline

.......................................................................................................................................... F E M A ................................................................................ Federa l Emerge n cy Manageme nt Agency FSA ..... ................................................................................................... Fina l Sa fe ty Ana l ys i s Report GE ...................................................................................................................... General Emergency HC+L .......................................................................................... Heat Ca p ac i ty Temperature L i mit H P CI .............................................................................................. High Pressure C o o l ant I njection .......................................................................................................................................... H SI ................................................................................................................ Human System Interface I C ....................................................................................

.................................... Initiating Con d ition N E I 99 0 I (ReYi s ion 6) 1'l oYember 2012 .......................................................................................................................................... I D .......................

........................

..........................................

.....................

.................

Inside Diameter IPEEE. ............................ Individual Plant Ex amination o f E xternal Events (Generic Letter gg 20) ISFSI ............

...............................................................

Independent Spent Fuel Storage Installation Keff ................

..................................................................

.. Effective Neutron Multiplication Factor LCO .......................................

..................................

......................

Limiting Condition of Operation

.......................................................................................................................................... L OCA .................................

................................

......................................... Loss of Coolant Accident .......................................................................................................................................... M CR .......................

..............................

................................................................ ~4ain Contro l Room .......................................................................................................................................... M SIV ........................................................................................................ ~4ain St e am Isolation Valve ~4SL ....................................................................................................................... ~4a i n Steam Line mR, mRem, mrem , mREM ............

................................

................

milli-Roentgen E quivalent Man MW .................

................................................................................................................... Megawatt NEI .............................................

................................................................ Nuclear Energy Institute

.......................................................................................................................................... 1'l" PP ...................................................

..............................

...................

................. 1'l" uc l ear Po 1 ,ver Plant .......................................................................................................................

................... N RC ........................................

......................................................... Nuclear Re gulat ory Commission N888 ................................................................................................. Nuclear St e am Supply Syst e m NORAD ......................................

.....................

...... North American Aerospace Defense Command fNOj UE ..........

..............................................

..................................

fN otification O+/-j Unusual Event NUMARC 1 ............................

................

..............

..... Nuclear Management and Resources Council OBE .................................

................

..............................................

........ Operating Basis Earthquake OCA .......................................

......................................................................

Owner Controlled Area .......................................................................................................................................... 0 DCM/ODAM .........................................

................

Off site Dose Cal c ulation (Assessment) Manual ORO ................................................................................................ O ff s ite Response Organization PA ...................................................

........................

................................................

... Protected Area .......................................................................................................................................... P ACS ....................

.................................................................. Priorit y Actuation and Control Syst e m PAG ...........................................................................................

............ Protective Action Guideline

.......................................................................................................................................... P ICS .........................................................

.......................... Process Information and Contro l System PRA/PSA ....................................

Probabilistic Risk Assessment I Probabilistic Safety Assessment PWR ............................

.....................................................................

....... Pressurized W ater Reactor .......................................................................................................................................... P S ........................................................................................................................... Protection System PSIG ...............................................................

..................................

Pounds per Square Inch Gauge R ....................................................................................

.................................................

.... Roent gen .....................................

..................................................................................................... R CC .......................................................................................

....................... Reactor Control Console RCIC ..................................................................................

.............

Reactor Core Isolation Cooling 1 NUMARC was a pr e dec essor organization of th e Nuclear E ner gy Institute (NEI).

NBI 99 0 1 (Re11 i sion 6) ~Joyemeer 2012 RCS ......................

..................

...........................................

.......................... Reactor Coolant System Rem , rem , REM ...........................................

...........................

................ Roentgen Equivalent Man .......................................................................................................................................... R E TS ......................................................................... Radiologica l E fflu e nt T e chnica l Specifications RPS ...............................................................................

..........

.............

... Reactor Protection System RPV .............

......................

........................

..................................................

Reactor Pressure Vessel .......................................................................................................................................... R VLIS ......................................................................... R e actor V e ss e l L e vel In s trumentation System RWCU ...........

...............................................................................................

Reactor Water Cleanup .................................................................................................................................. " ...... s i\R ................................................................................................................ Sa fe ty l..nalysis Report .......................................................................................................................................... s i\.S ..........................................................................................................

Sa fe t y Automation Syst e m ****************************************************************************************************************************************** s BO ........................................................................................................................... S tati o n Blac ko u t SCBA .....................

...................................

.............................

Self-Contained Breathing Apparatus

.......................................................................................................................................... s G .............................................................................................................................. Steam G e nerator ********************************************************************

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • s I ................................................................................................................................ Safety Injection

.......................................................................................................................................... s ICS ..................................................................................... Safety Information and Control System .......................................................................................................................................... s PDS .............................................................................................. Safety Parameter Display System SRO ............................................................................................................ S e nior Reactor Operator TEDE .............................................................................................

Total Effective Dose Eq uival ent T G AF .....................

.........................................................................

.................... Top of Active Fuel TSC ..................................................

........................................................

Technical Support Center .............

................................................................

............................................................. u FSAR ........................

............

..............................................

.. Updat e d F inal S afe ty Analysi s R e port WOG .................................................................................................. Westin g hou s e Owners Group l>IBI 99 01 (Revision

6) l>lovember 2012 APPENDIX B -DEFINITION S NEI 99 01 (Re,,ision

6) November 2012 The following definitions are taken from Title 10, Code of Federal Regulations, and related regulatory guidance documents.

Alert: Events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA P AG exposure levels. General Emergency:

Events are in progress or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA P AG exposure levels offsite for more than the immediate site area. Notification of Unusual E v ent (NOUE yJ.: Events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated.

No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of safety systemsSAFETY SYSTEMS occurs. Site Area Emergency:

Events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts; 1) toward site personnel or equipment that could lead to the likely failure of or; 2) that prevent effective access to , equipment needed for the protection of the public. _Any releases are not expected to result in exposure levels which exceed EPA PAG exposure levels beyond the site boundary. The following are key terms necessary for overall understanding the NEI 99 OlDAEC emergency classification scheme. Emergency Action Level (EAL): A pre-determined , site-specific , observable threshold for an Initiating Condition that , when met or exceeded, places the plant in a given emergency classification level. Emergency Classification Level (ECL ): One of a set of names or titles established by the US Nuclear Regulatory Commission (NRC) for grouping off-normal events or conditions according to (1) potential or actual effects or consequences , and (2) resulting onsite and offsite response actions. The emergency classification levels, in ascending order of severity, are: Notification of Unusual Event (NODE) Alert Site Area Emergency (SAE) General Emergency (GE) + This term is sometimes shortened to Unusual E*,cent (UE) or oilier similar site speeifie terminology.

B-1 NE! 99 01 (Revision

6) ~Joyemeer 2012 Fission Product Barrier Threshold:

A pre-determined, site-specific, observable threshold indicating the loss or potential loss of a fission product barrier. Initiating Condition (IC): An event or condition that aligns with the definition of one of the four emergency classification levels by virtue of the potential or actual effects or consequences.

Selected terms used in Initiating Condition and Emergency Action Level statements are set in all capital letters ( e.g., ALL CAPS). These words are defined terms that have specific meanings as used in this document.

The definitions of these terms are provided below. CONFINEMENT BOUNDARY: (Ins e 1i a sit e specific definition for this term.) Developer Note -The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. This corresponds to the pressure boundary for the Dry Shielded Canister (DSC) shell (including the inner bottom cover plate) bas e metal and associated confinement boundary welds. CONTAINM E NT CLOSURE: Procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under existing plant conditions. For DAEC, this is considered to be Secondary Containment as required by Technical Specifications.

CONTAINMENT CLOSURE: (Insert a site specific definition for this term.) De~/eloper Note Site specific procedurally defin e d actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under existing plant conditions. For DAECs, this is considered to be Secondary Conta i nment as required by Technical Specifications

.The procedurally defined conditions or actions taken to secure containment (primary or secondary for BWR) and its associated structures , systems, and components as a functional barrier to fission product release under shutdown conditions.

DESIGN BASIS EARTHQUAKE (DB E): A DB E is vibratory ground motion for which certain (generally, safety-related) structures, s ys t e ms, and components must be designed to remain functional.

EXPLOSION:

A rapid , violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization.

A release of steam (from high energy lines or components) or an electrical component failure ( caused by short circuits, grounding, arcing , etc.) shou l d not automatically be considered an explosion.

Such events may require a post-event inspection to determine if the attributes of an explosion are present. FAULTED: The term applied to a steam generator that has a steam leak on the secondary side of suffici e nt siz e to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depres s urized. DeYeloper Note This term is applicable to PWRs only. B-2 NEJ 99 01 (Revision

6) *November 2012 FIRE: Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed. HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. HOSTILE ACTION: An act toward a NPPnuclear power plant or its personnel that includes the use of violent force to destroy equipment, take HOST AGES , and/or intimidate the licensee to achieve an end._ This includes attack by air, land , or water using guns, explosives, PROJECTILEs , vehicles, or other devices used to deliver destructive force. _ Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the NPPnuclear power plan t._ Non-terrorism-based EALs should be used to address such activities (i.e.,_-this may include violent acts between individuals in the owner controlled area). HOSTILE FORCE: One or more individuals who are engaged in a determined assault, overtly or by stealth and deception , equipped with suitable weapons capable of killing, maiming, or causing destruction.

IMMINENT:

The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. INDEPENDENT SPENT FUEL STORAGE INSTALLATION (ISFSI): A complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. NORMAL LEVELS: As applied to radiological IC/EA.Ls, the highest reading in the past t\venty four hours eJrnluding the current peak value. OP E RATING BASIS EARTHQUAKE (OB E): An OB E is vibratory ground motion for which those features of a nuclea r power plant n e c ess ary for continued operation without undue risk to the health and safety of the public will remain functional.

OWNER CONTROLLED AREA: (Insert a site specific definition for this term.) DeveleJ_'JeF Nate This term is typically taken to mean the site property owned by , or otherwise under the control of , the licensee.

In some eases , it may be appropriate for a licensee to define a smaller area with a perimeter closer to the plant Prot e cted Area perimeter (e.g., a site with a large OCA where some portions of the boundary may be a signifi c ant distance from the Protected Area). In these eases , developers should consider usin g the boundary defined by the Restricted or Secured Ovmer Controlled i\rea (ROCi\.lSOCA

.). The area and boundary selected for scheme use must be consist e nt with the description of th e sam e area and boundary contained in the Security Plan. PROJECTILE:

An object directed toward a NWnuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. B-3

-~------NEl 99 01 (RevisiaA

6) 1'1aYemJ:>er 2012 PROTECTED AREA:_ (Insert a site specific definition for this term.) DeYelopeF Note This term is typically taken to mean tT he area under continuous access monitoring and control , and armed protection as described in the site Security Plan. REFUELING PATHWAY:_ (Insert a site specific definition for this te1m.) De",relepeF Note This description should include all the cavities , tubes, canals and pools through vmich irradiated fuel may be moved , but not including the reactor vessel. Includes all the cavities, tubes, canals and pools through which irradiated fuel may be moved, but not including the reactor vessel. RUPTURE(D):

The condition of a steam generator in which primary to secondary leakage is of sufficient magnitude to require a safety injection.

DeYelopeF Note This term is applicable to p:wRs only. SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems are classified as safety-related.

DeYelopeF Note This term may be modified to include the attributes of "safety related" in accordance v,ith 10 CFR 50.2 or other site specific terminology , if desired. SECURITY CONDITION:

Any Security Eve nt as li s ted in the approved security contingenc y plan that constitutes a threat/compromise to site security, threat/r isk to site personnel , or a potential degradation to the level of safety of the plant. _A SECURITY CONDITION does not involve a HOSTILE ACTION. SITE BOUNDARY:

That line beyond which the land is neither owned, nor leased, nor otherwise controlled by the Company. UFSAR Figure 1.2-1 identifies the DAEC SITE BOUNDARY.-:-

UNISOLABLE:

An open or breached system line that cannot be isolated, remotely or locally. UNPLANNED:

A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient.

The cause of the parameter change or event ma y be known or unknown. VISIBLE DAMAGE: Damage to a component or structure that is readily observable without measurements , testing, or analysis. _The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not VISIBLE DAMAGE. B-4 B-5 NEI 99 01 (ReYisioR

6) November 2012 NBI 99 0 I (Revision

6) November2012 APPENDIX C -PERMANENTLY DEFUELED STAT IO N ICs/E A Ls Recognition Category PD provides a stand alone set of ICs/EALs for a Permanently Defueled nuclear power plant to consider for use in developing a site specific emergency classification scheme. For development, it was assumed that the plant had operated under a 10 CFR § 50 license and that the operating company has permanently ceased plant operations. Further, the company intends to store the spent fuel within the plant for some period of time. When in a permanently defueled condition, the plant licensee typically receives approval from the NRG for e)cemption from specific emergency planning requirements.

These e>cemptions reflect the lmvered radiological source term and risks associated 1.vith spent fuel pool storage relative to reactor at power operation.

Source terms and accident analyses associated with plausible accidents are documented in the station's Final Safety Analysis Report (FSAR), as updated. As a result, each licensee will need to develop a site specific emergency classification scheme using the NRG approved exemptions , revised source terms , and revised accident analyses as documented in the station's FSAR. Recognition Category PD uses the same ECLs as operating reactors; hov,ever , the source term and accident analyses typically limit the ECLs to an Unusual Event and A.lert. The Unusual Event ICs provide for an increased awareness of abnormal conditions while the Alert ICs are specific to actual or potential impacts to spent fuel. The source terms and release motive forces associated 1.vith a permanently defueled plant would not be sufficient to require declaration of a Site Area Emergency or General Emergency.

A permanently defueled station is essentially a spent fuel storage facility with the spent fuel is stored in a pool of water that serves as both a cooling medium (i.e., removal of decay heat) and shield from direct radiation.

These primary functions of the spent fuel storage pool are the focus of the Recognition Category PD ICs and EALs. Radiological effluent IC and EA.Ls were included to provide a basis for classifying events that car.not be readily classified based on an observable events or plant conditions alone. Appropriate ICs and EA.Ls from Recognition Categories A, C, F, H, and S were modified and included in Recognition Category PD to address a spectrum of the events that may affect a spent fuel pool. The Recognition Category PD ICs and EALs reflect the relevant guidance in Section 3 of this document (e.g., the importance of avoiding both over classification and under classification).

Nonetheless, each licensee will need to develop their emergency classification scheme using the NRG approved e)cemptions, and the source terms and accident analyses specific to the licensee.

Security related events will also need to be considered. C-1 1-Jel 99 0 I (Revision

6) 1-Jovemeer 2012 Table PD 1: Reeegnitien Categery "PD" Initiating Cenditien Matrix UNUSUA .. L EVENT PD AUl Release of gaseous or liquid radioactivity greater than 2 times the (site specific effluent release controlling document) limits for 60 minutes or longer. Op. A/odes: l'>/ot Applicable PD ,A .. U2 Ul'J:PLANNED rise in plant radiation levels. Op. },1odcs: ]Vo! Applicable PD 8Ul Ul'WLANNED spent fuel pool temperature rise. Op. ,Wades: 11/ot Applicable PD HUl Confirmed SECURITY CONDITION or threat. Op. l./odes: ]"lot Applicable PD HU2 Hazardous event affecting SAFETY SYSTEM equipment necessary for spent fuel cooling. Op. Modes: ;vat Applicable PD HU3 Other conditions e>cist v,rhich in the judgment of the Emergency Director warrant declaration of a (NO)UE. Op. A1odcs: ,\Tot Applicable ALERT PD A.Al Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem thyroid CDE. Op. A1odes: 1'lotApplicable PD AA2 U1'WLAN1*l"ED rise in plant radiation levels that impedes plant access required to maintain spent fuel integrity.

Op. },1odes: 11/ot Appliceble PDHAl HOSTILE ACTION 1.vithin the O\VNER CONTROLLED AREA or airborne attack threat \vithin 30 minutes. Op. },lodes: .Vat Applicable PD HA3 Other conditions e>cist \Vhich in the judgment of the Emergency Director warrant declaration of an Alert. Op. }.1odes: AT.at Applicable I Table intenEleEI for 1:1se by , BAL Elevelopers.

Inel1:1sion in lieensee C-2 I ..I * * ..I , uoe1:1ments 1s not req1:11reu. 1 L------------------'

ECL: Notification of Unusual Event NEI 99 01 (RevisioR e) *November 20 J 2 PD AU1 Initiating Condition:

Release of gaseous or liquid radioactivity greater than 2 times the (site specific effluent release controlling document) limits for 60 minutes or longer. Notes: Operating Mode Applieability:

Not A,pplicable Example Emergeney Aetion LeYels: (1 or 2)

• The Emergency Director should declare the Unusual E vent promptly upon determining that 60 minutes has been e)weeded , or will likely be e)weeded.

• If an on g oin g r e lease is d e t e cted and th e re l e as e start time is unknovm , assume that th e release duration has e1rneeded 60 minutes.

• If the effluent flov,r past an effluent monitor is known to have stopped due to actions to isolate the release path , then the effluent monitor reading is no longer valid for classification purposes.

(1) (2) Reading on ANY effluent radiation monitor greater than 2 times the alarm setpoint established by a current radioactivity discharge permit for 60 minutes or longer. Sample analysis for a gaseous or liquid release indicates a concentration or release rate greater than 2 times the (site specific effluent release controlling document) limits for 60 minutes or longer. Basis: This IC addresses a potential decrease in the level of safety of the plant as indicated by a low level radiological release that e)weeds regulatory commitments for an extended period of time (e.g., an uncontrolled release). It includes any gaseous or liquid radiological release , monitored or unmonitored , including those for 1.vhich a radioactivity discharge permit is normally prepared.

Nuclear power plants incorporate design features intended to control the release of radioactive effluents to the environment.

Further, there are administrative controls established to prevent unintentional releases , and to control and monitor intentional releases. The occurrence of an eJc t e nded , uncontroll e d radioacti ve r e l e a se to th e e nvironm e nt is indicativ e of d e gradation in these features and/or controls.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent El ... Ls more fully addresses the spectrum of possible accident events and conditions.

C-1

'S'JVH 9lUJUdes l{l!A\ S9SU9f9J P!Hb!f puu SR09SU13 SS9Jppu Ol SR0913UlUUApU l! pug AUUl S9l!S emos 'SJOlHIOUl 9S9lfl jO t\lH!EttJf!UAU JO 9SR 9lfl UO SUO!ltJl!ill!f t\UU t\jEl:U9p 1 t\flU9fO UO!l09S S!SUEj: puu 'J\J'tl p9~!00SSU 9l{l lUlfl lUUlJOdm!

S! l! '9J0j9J9l{l

'.S}U9Ul9J!Rb9J

• pelUfeJ pelBfeJ est1eo1 1 J9lflO Jo suO!ltJO!J!Oeds fUO!Glf09+/-

AEt pauJaAo13 aEj: lOU ,4:um sJOl!Uom 9Ul0S 'OSF--' 'lSlf Ol{l U! pet3RfOU!

9Ej: Ol paau lOU saop JOl!UOUl Olfl 'asuo lUl{l U! '.pBaJ uuo JOl!GOUl Slfl ltJ~:.+. ,*~01eEt eEl .4:em 9RfUA '1VH p9lUfROfUO u lUlfl pa'i3!:ti13ooeJ S! lI 't'IJ'3fl0 JO S+/-'ffil Olfl m P9lU9S9Jd Sl!Ul!f 9SU9f9Jf9S0p OfEt:UO!fddu lSOUl 9lfl 13U!SR paU!WJ9l9P 9Ej: PfROlfS ~~Ol!lJOUl 9S9lfl J0j .S9RfUA '1VH 'pepRt9m jl . ft-ttt"if3fl0 JO S+/-'.inl Ol{l U! p9Ej:!J0Sap lOG 91U lUl{l SAUmlflUd lU9RlJJ9 U!lU9lOd J8l{l0 l{l!ft, P8lU!;OSSU SJOl!{IOUl palfUlSU!

13U!PRfOU!

JOP!SUOO OSfU AUUl SJadOf8A8fl

't'IJ'3fl0 JO S+/-'.inl 8l{l U! P8Et:!JOSap SJOl!UOW lU9RlJJ8 Ol{l epRfOU! p1noq:s SJOl!UOW P9lS!'1 *si Silfl J0j sp1oq:sell{l JOl!Uow aq:l 13U!lfS!fEttJlS9 J0j pesR: aEl PfROlfS ,4'.13ofopoq:lem t"if3fl0 JO S+/-'ffil Ol{l ~8ltJUdoJddu Sl"ef 'EI lf!puaddl"ef

'es llUd °MITJ e f PUB ec lJUd °MITJ e f 13'9j SfOJ}UOO fuenma Ol palUf8J ~UOlltJfR13aJ luametdw!

Sluawnoop asaq:+/- *Ew3flQj fURuuw UO!lUfROfU3 asoe 9l!Sjj0 8lfl .!. rn 68 .J9ll8'1 ouauae p9lU9W8fdW!

a,*<Bq: lUl{l SlUUfd J0j 'JO ES+/-'ffilj SUO!ltJO!J!Oads fBO~'q:08+/-

1TuaR:lJJ3 fB0!130iO!PB'M 8lfl S! ,Jmiwnoop 13U!fIOJlUOO 9SU8f8J lU8l1lJJ8 omoads 9l!S,, Olf+/- :saJ0N .1ad01al,a(I

• f VV fld 3! U!A 9Ej: p f R:OA\ f9A9f UO!ltJO!J!SSUfO t\OG913J9Ul9 Ol{l jO UO!ltJfUOS5

• E*ola 'swalSAS J9lUN. JOA!J u! a13u~af Ja13uuq:o~fa lUOlf 'SU!Rlp WJOlS OlU! sp!Rb!f aA!lOUO!PUJ jO sn1ds '*13*gj St\UN<l{lUd paJOl!UOW'.ffi UO t\flUfRO!lJUd

'St\9AffiS fUlU9WGOJ!AU9 JO S9S,\fUUU OfdwuS t\Ej: pal~9l9P aJU lUl{l S9SU9f9J P!Rb!f JO SR09SU13 panOJlUOOOO sassaJppB

'1V3 S!lf+/- c# '1V3 *Esu13 OlSUN, 'alSUA\PUJ

'*13*ej S , 4:eA\lflUd esua1a.1 SRORU!lUOO uou WOlj S9SU9f9J l{OlUEl peGUUfd lfl!N, P9ltJ!00SSU 9El AUUO!d,4'.l ll!*\ '1]" , 5 siq:+/- 'llWJed a13JUlfOS!P Al!A!lOUO!PUJ u AEt pal:fS!fEt:UlSa l!W!f Olfl seIB!l c peeo~fe Ol s13u!puaJ JOl!U:w ~O!lU!PUJ lUenma esRuo lUlfl sesua1eJ Al!A!lOUO!PUJ sessaJppu

'1V3 S!lf+/- I# '1V3 1V3 9l{l l99W lOU S90p S9ll1U!W et J0j Sl!lli!f 9SU9f9J S9W!l 13U!P990Jf9 9SU9f9J U 'etdtuuxe J0;1 *pa13UJ9AU JO palUJOJd 9Ej: lOU PfROl:fS S9SU9f9~ *sesodJnd UO!ltJO!J!SSUfO J0j pquA J913UOf OU SI 13mpueJ JOl!UOW lU9RlJJ9 9l{l U9l{l 'lflUd 9SU9f9J Ol{l 9ltJf0S! Ol SUO!lOU Ol enp . . . d ** U911ffi9 Ol{l jf 'P9lfS1fEj:U:1S9 SI lU9WGOJIAU9 peddOlS 9AUlf Ol UA*,Offif S! JOl!UOW lU9Rffi9 UU lSU-mOfj l--------* -* ---. *-* . . a O ud esue OJ u lUl{l S9lURSSU S13U!PU9J JOl!{IOW lUanma uo paSUEj: UO!lUO!J!SSUI3 l c I oz: 1eq1:1:10AoN:

(9 UO!S!A0~)

IO 66 I3N:

~JEI 99 01 (Revis i on 6) ~Jovember 2012 Radiation monitor readings should reflect values that correspond to a ra~iological r~lease eJweeding 2 times a release control limit. The controlling document typ10ally descnb~s methodologies for determining effluent radiation monitor setpoint~;

these methodologies should be used to determine EAL values. In cases where a methodology is not ad~quately defined, developers should determine values consistent with effl_uent control regulat10ns (e.g., 10 CFR Part 20 and 10 CFR Part 50 Appendix I) and related gmdance. For EAL #1 Values in this EAL should be 2 times the setpoint establ~shed by th~ radioactivity discharge permit to 1.varn of a release that is not in compliance v11th the specified_ ,limits. IndeJdng the value in this manner ensures consistency bet>.veen the EAL and the setpomt *established by a specific discharge permit. Developers should research radiation monit_or desi?n d_oc~ments or other information -sources to ensure that 1) the EAL value being considered is withm the usable response and ,display range of the instrument, and 2) there are no automatic featm*e~ that ~O)'. re~der the -monitor reading invalid (e.g., an auto purge feature triggered at a part10ular md10at10n level). It is recognized that the condition described by this ~C may result in a radi_ological effluent value beyond the operating or display range of the mstalled effluent momtor. In those cases, EAL values should be determined with a margin sufficient to ensure that an acc~ate o 1. monitor reading is available.

For eJcample, an EAL monitor r_eading 1:1-ig~ be set at 90 A, to 95 ,i) of the highest accurate monitor reading. This provision notwithstandmg, if the . estimated/calculated monitor reading is greater than apprmcimately 110% of th_e h~gh~st accurate monitor reading, then developers may choose not to include the monitor as an mdicat10n and identify an alternate EAL threshold.

Indications from a real time dose projection system are not included in the generic _Ei':Ls. Many licensees do not have this capability.

For those that do, the capabili~

may not be :.vithi? the scope of the plant Technical Specifications.

A licensee may request to mclude an EnL _usmg real time dose projection system results; approval 1.vill be considered on a case by case basis. Indications from a perimeter monitoring system are not included ~n the generic El\Ls. Many licensees do not have this capability.

For those th~t do, these ~o?itors may not be controlled and maintained to the same level as plant eqmpment, or vnthm _the scope of the plant Technical Specifications.

In addition, readings may b~ influen_ced by env1_ro~ent~l or ~ther factors. /'.. licensee may request to include an EAL usmg a penmeter momtormg system, approval will be considered on a case by case basis. EGL Assignment Attributes:

3.1.1.B C-3 NEI 99 01 (Revision

6) November 2012 PD AU2 ECL: Notification of Unusual Event Initiating Cenditien:

illl"PLA.N}l"ED rise in plant radiation levels. Operating l\{ede .f...pplieability:

Not .Applicable (1) (2) Basis: Example EmeFgeney

} .. etien Levels: (1 or 2) a. b. illl"PLA1'l"NED water level drop in the spent fuel pool as indicated by ANY of the following: (site specific level indications).

illl"PLANNED rise in area radiation levels as indicated by A.NY of the following radiation monitors. (site specific list of area radiation monitors).

A.rea radiation monitor reading or survey result indicates an illl"PLANNED rise of 25 mR/hr over NORMAL LEVELS. This IC addresses elevated plant radiation levels caused by a decrease in water level above irradiated (spent) fuel or other illl"PLANNED events. The increased radiation le 1 rels are indicative of a minor loss in the ability to control radiation levels within the plant or radioactive materials.

Either condition is a potential degradation in the level of safety of the plant. A 1.vat e r level decrease will be primarily determined by indications from available level instrumentation.

Other sources of level indications may include reports from plant personnel or video camera observations (if available).

A significant drop in the water level may also cause an increase in the radiation levels of adjacent areas that can be detected by monitors in those locations.

The effects of plar.ned evolutions should be considered.

Note that EAL #1 is applicable only in cases where the elevated reading is due to an illl"PLANNED water level drop. EAL #2 e>rnludes radiation level increases that result from planned activities such as use of radiographic sources and movement of radioactive waste materials.

Escalation of the emergency classification level would be via IC PD Pn"..l or PD ,i\,A.2. B-1 DeveleIJer Netes: Jl,JEI 99 01 (ReYisioA

6) Jl,Joyember 2012 For EAL #1 £ite specific indications may include instrumentation values such as water level and area radiation monitor readings , and personnel reports. If available, video cameras may allmv for remote observation.

Depending on available instrumentation, the declaration may also b~ based on indications of \Yater makeup rate and/or decreases in the level of a water storage tanlt-For EAL #2 The specified value of 25 mR/hr may be set to another value for a specific application with appropriate justification. EGL Assignment Att1ibutes

3 .1.1.B ECL: Notification of Unusual Event Initiating Cenditiee:

UNPLANJ\mD spent fuel pool temperature rise. OpeFating

• Mede Applieability:

Not Applicable Example EmeFgeney A.etiee Le, 1 els: l'-JEI 99 01 (Revision

6) "J'lfoyember 2012 PD SU1 (1) UNPLAN1'mD spent fuel pool temperature rise to greater than (site specific £._Ft= Basis: This IC addresses a condition that is a precursor to a more serious event and represents a potential degradation in the level of safety of the plant. If uncorrected, boiling in the pool will occur, and result in a loss of pool level and increased radiation levels. Escalation of the emergency classification level 1,vould be via IC PD A.Al or PD A .. A.2. DevelepeF Netes: The site specific temperature should be chosen based on the starting point for fuel damage calculations in the SAR. Typically , this temperature is 125° to 1500-F. Spent Fuel Pool temperature is normally maintained 1.vell below this point thus allowing time to correct the cooling system malfunction prior to classification.

EGL Assignment Attributes:

3 .1.1.A B-3 ECL: Notification of Unusual Event Ieitiatieg C0editi0e:

Confirmed SECURITY CONDITION or threat. Operatieg

• Made Applieability:

Not Applicable Example Emergeaey Aetiae Levels: (1 or 2 or 3) 1-JEI 99 01 (RevisioR

6) 1-loYemher 2012 PD HU1 (1) /',. SECURITY CONDITION that does not involve a HOSTILE ACTION as reported by the (site specific security shift supervision). (2) (3) Basis: Notification of a credible security threat directed at the site. /',. validated notification from the NRG providing information of an aircraft threat. This IC addresses events that pose a threat to plant personnel or the equipment necessary to maintain cooling of spent fuel, and thus represent a potential degradation in the level of plant safety. Security events which do not meet one of these EALs are adequately addressed by the requirements of 10 CFR § 73.71 or 10 CFR § 50.72. Security events assessed as HOSTILE ACTIONS are classifiable llilder IC PD HAI. Timely and accurate communications bet\veen Security Shift Supervision and the Control Room is essential for proper classification of a security related event. Classification of these events vrill initiate appropriate threat related notifications to plant personnel and OROs. SeCUrity plans and terminology are based on the guidance provided by NEI 03 12, TemplBte for !he Seci1rity PiBn , Trnining *l19d QuBiiflcBtien PiBn , &zfcguBrds Centingency PiBn {*Ind Independent Spent Fuel Ster age J,qsf*lll*ltien Security Pregrmn].

EAL # 1 references (site specific security shift supervision) because these are the individuals trained to confirm that a security e'vent is occurring or has occurred. Training on security event confirmation and classification is controlled due to the nature of Safeguards and 10 CFR § 2.39 information. EAL #2 addresses the receipt of a credible security threat. The credibility of the threat is assessed in accordance v,ith (site specific procedure).

EAL #3 addresses the threat from the impact of an aircraft on the plant. The NRG Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft.

The status and size of the plane may also be provided by NORAD through the NRG. Validation of the threat is performed in accordance with (site specific procedure).

Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security sensitive information. This includes information that may be B-4 NEl 99 01 (RevisioR

6) November 2012 advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location.

Security sensitive information should be contained in non public documents such as the Security Plan. Escalation of the emergency classification level would be via IC PD Hl\l. DeYelaper Nates: The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force. The (site specific procedure) is the procedure(s) used by Control Room and/or Security personnel to determine if a security threat is credible, and to validate receipt of aircraft threat information.

Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security sensiti 1 1e information.

This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location.

Security sensitive inforn1ation should be contained in non public documents such as the Security Plan. With due consideration given to the above developer note, El.,Ls may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures.

Such references should not contain a recognizable description of the event. For e1cample, an EAL may be worded as "Security event #2 , #5 or #9 is reported by the (site specific security shift supervision)." EGL Assignment Attributes:

3.1.1.A. B-5 NEI 99 01 (Revision

6) l-Jovember 2012 PD HU2 ECL: Notification of Unusual Event Initiating Condition:

Hazardous event affecting SAFETY SYSTEM equipment necessary for spent fuel cooling. Operating Mode Applieability:

Not Applicable Example Emergeney A.etion Levels: (1) a. b. C. Basis: The occurrence of ANY of the following hazardous events:

• Seismic event (earthquake)

• Internal or eJ{ternal flooding event

• High v,rinds or tornado strike

• FIRE

• EXPLOSION

• (site specific hazards)

• Other events ,vith similar hazard characteristics as determined by the Shift Manager The event has damaged at least one train of a SAFETY SYSTEM needed for spent fuel cooling AND The damaged SAFETY SYSTEM train(s) car.not , or potentially cannot , perform its design function based on EITHER:

• Indications of degraded performance

• VISIBLE DAMAGE This IC addresses a hazardous event that causes damage to at least one train of a SAFETY SYSTEM needed for spent fuel cooling. The damage must be of sufficient magnitude that the system(s) train cannot , or potentially car.not, perform its design function.

This condition reduces the margin to a loss or potential loss of the fuel clad barrier, and therefore represents a potential degradation of the level of safety of the plant. For El\L l .c , the first bullet addresses damage to a SA.FETY SYSTEM train that is in service/operation since indications for it will be readily available.

For EAL l .c , the second bullet addresses damage to a SAFETY SYSTEM train that is not in service/operation or readily apparent through indications alone. Operators 1.vill make this B-6 NEJ 99 01 (Re;cisioA

6) ~lO\'ember 2012 determination based on the totality of available event and damage report information.

This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. Escalation of the emergency classification level could, depending upon the event, be based on any of the Alert ICs; PD fnt\.l, PD AA2, PD HAI or PD HA.3. DeYele~eF Netes: For (site specific hazards), developers should consider including other significant, site specific hazards to the bulleted list contained in EAL 1.a (e.g., a seiche). Nuclear power plant SAFETY SYSTEMS are comprised of two or more separate and redundant trains of equipment in accordance 1.vith site specific design criteria.

EGL Assignment Attributes:

3.1.1.A and 3.1.lC B-7 NEI 99 01 (Revision

6) 1-Joyember 2012 PD HU3 ECL: Notification of Unusual Event Initiating C0editi0e:

Other conditions e>dst vrhich in the judgment of the Emergency Director warrant declaration of a (NO)UE. Of)erating 1\iede Af)f)lieability:

Not Applicable (1) Basis: Examf)le Emergeney A .. etian LeYels: Other conditions e>cist which in the judgment of the Emergency Director indicate that events are in progress or have occurred 1.vhich indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of safety systems occurs. This IC addresses unanticipated conditions not addressed e>cplicitly elsev,here but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a NOUE. B-8 ECL: Alert Jl>JEI 99 0 I (ReYisioA

6) November 2012 PD AA1 Initiating Condition:

Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem thyroid CDE. Openting *Mode },cpplieability:

Not Applicable Example Emergeney Aetion Le,*els: (1 or 2 or 3 or 4) Notes:

• The Emergency Director should declare the Alert promptly upon determining that the applicable time has been .e>rneeded , or will likely be exceeded.

• If an ongoing release is detected and the release start time is unknovm, assume that the release duration has e1rneeded 15 minutes.

• If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer valid for classification purposes.

• The pre calculated effluent monitor values presented in EAL # 1 should be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available.

(1) (3) (4) Reading on ANY of the following radiation monitors greater than the reading shovm for 15 minutes or longer: (site specific monitor list and threshold values) (2) Dose assessment using actual meteorology indicates doses greater than 10 mrem TEDE or 50 mrem thyroid CDE at or beyond (site specific dose receptor point). Analysis of a liquid effluent sample indicates a concentration or release rate that v,ould result in doses greater than 10 mrem TEDE or 50 mrem thyroid CDE at or beyond (site specific dose receptor point) for one hour of e1cposure.

Field survey results indicate EITHER of the following at or beyond (site specific dose receptor point):

• Closed window dose rates greater than 10 mR/hr e1cpected to continue for 60 minutes or longer.

• Analyses of field survey san1ples indicate thyroid CDE greater than 50 rm-em for one hour of inhalation.

Basis: This IC addresses a release of gaseous or liquid radioactivity that results in prajected or actual 1-JEI 99 01 (Revision

6) November 2012 offsite doses greater than or equal to 1% of the EP,i\. Protective Action Guides (PAGs). It includes both monitored and un monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release). Radiological effluent EALs are also included to provide a basis for classifying events and conditions that car.not be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at 1% of the EPA PAG of 1 , 000 rnrem while the 50 rnrem thyroid CDE was established in consideration of the 1 :5 ratio of the EPA PAG for TEDE and thyroid GDE-: Classification based on effluent monitor readings assumes that a release path to the environment is established.

If the effluent flov, past an effluent monitor is known to have stopped due to actions to isolate the release path , then the effluent monitor reading is no longer valid for classification purposes.

DevelepeF Netes: \Vhile this IC may not be met absent challenges to the cooling of spent fuel, it provides classification diversity and may be used to classify events that would not reach the same EGL based on plant conditions alone. The EPA PAGs are e)cpressed in terms of the sum of the effective dose equivalent (EDE) and the committed effective dose equivalent (CEDE), or as the thyroid committed dose equivalent (CDE). For the purpose of these IC/EALs , the dose quantity total effective dose equivalent (TEDE), as defined in 10 CFR § 20 , is used in lieu of" ... sum of EDE and CEDE .... ". The EPA PAG guidance provides for the use adult thyroid dose conversion factors; however, some states have decided to base protective actions on child thyroid CDE. Nuclear power plant !Cs/EA.Ls need to be consistent with the protective action methodologies employed by the States within their EPZs. The thyroid CDE dose used in the IC and EALs should be adjusted as necessary to align with State protective action decision making criteria.

The "site specific monitor list and threshold values" should be determined with consideration of the follov,ing:

• Selection of the appropriate installed gaseous and liquid effluent monitors.

• The effluent monitor readings should correspond to a dose of 10 rnrem TEDE or 50 rnrem thyroid CDE at the " site specific dose receptor point" (consistent with the calculation methodology employed) for one hour of e)cposure.

• Monitor readings will be calculated using a set of assumed meteorological data or atmospheric dispersion factors; the data or factors selected for use should be the same as those employed to calculate the monitor readings for IC PD AUl.

NBI 99 01 (Revis i on 6) Jl,Joyemeer 2012

• The calculation of monitor readings will also require use of an assumed release isotopic miJc; the selected miJc should be the same as that employed to calculate monitor readings for IC PD AUl.

• Depending upon the methodology used to calculate the EAL values, there may be overlap of some values between different ICs. Developers will need to address this overlap by adjusting these values in a manner that ensures a logical escalation in the EGL. The "site specific dose receptor point" is the distance(s) and/or locations used by the licensee to distinguish bet\veen on site and offsite doses. The selected distance(s) and/or locations should reflect the content of the emergency plan, and the procedural methodology used to determine offsite doses and Protective Action Recommendations. The variation in selected dose receptor points means there may be some differences in the distance from the release point to the calculated dose point from site to site. Developers should research radiation monitor design documents or other information sources to ensure that 1) the EAL value being considered is within the usable response and display range of the instrument, and 2) there are no automatic features that may render the monitor reading invalid (e.g., an auto purge feature triggered at a particular indication level). It is recognized that the condition described by this IC may result in a radiological effluent value beyond the operating or display range of the installed effluent monitor. In those cases, EAL values should be determined with a margin sufficient to ensure that an accurate monitor reading is available. For eJcan1ple , an EA.L monitor reading might be set at 90% to 95% of the highest accurate monitor reading. This provision not\vithstanding, if the estimated/calculated monitor reading is greater than apprmcimately 110% of the highest accurate monitor reading, then developers may choose not to include the monitor as an indication and identify an alternate EAL threshold.

Although the IC references TEDE , field survey results are generally available only as a '\vhole body" dose rate. For this reason, the field survey EAL specifies a "closed window" survey reading. Indications from a real time dose projection system are not included in the generic EA.Ls. Many licensees do not have this capability.

For those that do , the capability may not be within the scope of the plant Technical Specifications.

A licensee may request to include an EAL using real time dose projection system results; approval will be considered on a case by case basis. Indications from a perimeter monitoring system are not included in the generic EALs. Many licensees do not have this capability. For those that do, these monitors may not be controlled and maintained to the same level as plant equipment , or within the scope of the plant Technical Specifications. In addition, readings may be influenced by environmental or other factors. A licensee may request to include an EAL using a perimeter monitoring system; approval v,rill be considered on a case by case basis. EGL Assignment Attributes:

3.1.2.C B-11 NE! 99 01 (ReYisioR

6) l>IOYemeer 20 J 2 PD AA2 ECL: Alert Initiating Condition:

illl"PLANNED rise in plant radiation levels that impedes plant access required to maintain spent fuel integrity.

OpeFating Mode } .. pplieability:

Not .Applicable (1) (2) Basis: Example EmeFgeney A.etion Levels: (1 or 2) illl"PLA1'J:NED dose rate greater than 15 mR/hr in ANY of the following areas requiring continuous occupancy to maintain control of radioactive material or operation of systems needed to maintain spent fuel integrity: (site specific area list) illJ:PLAN1':rED Area Radiation Monitor readings or survey results indicate a rise by 100 mR/hr over NORMAL LEVELS that impedes access to ANY of the follov,ing areas needed to maintain control of radioactive material or operation of systems needed to maintain spent fuel integrity. (site specific area list) This IC addresses increased radiation levels that impede necessary access to areas containing equipment that must be operated manually or that requires local monitoring, in order to maintain systems needed to maintain spent fuel integrity. As used here , 'impede' includes hindering or interfering, provided that the interference or delay is sufficient to significantly threaten necessary plant access. It is this impaired access that results in the actual or potential substantial degradation of the level of safety of the plant. This IC does not apply to anticipated temporary increases due to planned events. De,*elopeF Notes: The value of 15mR/hr is derived from the GDC 19 value of 5 rem in 30 days 1.vith adjustment for expected occupancy times. Although Section III.D.3 ofNUREG 0737, Clarification ofTi\{I Action PlaH Requirements, provides that the 15 mR/hr value can be averaged over the 30 days , the value is used here 1<vithout averaging, us a 30 day duration implies an event potentially more significant than an Alert. The specified value of 100 mR/hr may be set to another value for a specific application vfith appropriate justification. EGL Assignment Attributes:

3.1.2.C B-1 2 NEI 99 01 (Revision

6) }Jo 1 ,em0er 2012 PD HA1 ECL: Alert Initiating Condition:

HOSTILE A,CTION 1.vithin the O'.VNER CONTROLLED AREA or airborne attack threat 1,vithin 30 minutes. Operating

• Mode Applieability:

Not Applicable (1) (2) Basis: Example Emergeney A.etion Levels: (1 or 2) A HOSTILE ACTION is occurring or has occurred within the 0'.\'1'rnR CONTROLLED AREA as reported by the (site specific security shift supervision).

A validated notification from NRG of an aircraft attack threat within 3 0 minutes of the This IC addresses the occurrence of a HOSTILE ACTION within the OWl'rnR CONTROLLED A .. ~A or notification of an aircraft attack threat. This event will require rapid response and assistance due to the possibility of the attack progressing to the PROTECTED AREA, or the need to prepare the plant and staff for a potential aircraft impact. Timely and accurate communications between Security Shift Supervision and the Control Room is essential for proper classification of a security related event. Security plans and terminology are based on the guidance provided by NEI 03 12, Templ6ltfJ fer th,e Sec1;1rity Pl6ln, Trnining *Ind Qu6llific6ltion Plan , Safegu6lrds Contingency Pl6ln {8ml Independent Spent Fuel Storege !nsf6lU6ltion Security Progmrn].

As time and conditions allow , these events require a heightened state ofreadiness by the plant staff and implementation of onsite protective measures (e.g., evacuation, dispersal or sheltering).

The Alert declaration will also heighten the awareness of Offsite Response Organizations , allowing them to be better prepared should it be necessary to consider further actions. This IC does not apply to incidents that are accidental events, acts of civil disobedience , or othenvise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. E>mmples include the crash of a small aircraft , shots from hunters , physical disputes between employees , etc. Reporting of these types of events is adequately addressed by other EALs , or the requirements of 10 CFR § 73.71 or 10 CFR § 50.72. EAL #1 is applicable for any HOSTILE ACTION occuning , or that has occurred , in the OVlNER CONTROLLED AREA. This includes any action directed against an ISFSI that is located within the OWNER CONTROLLED AREA. EAL #2 addresses the threat from the impact of an aircraft on the plant, and the anticipated arrival time is within 30 minutes. The intent of this EAL is to ensure that threat related NBI 99 01 (Revision

6) NoYemaer 2012 notifications are made in a timely manner so that plant personnel and OROs are in a heightened state of readiness.

This EAL is met when the threat related information has been validated in accordance with (site specific procedure).

The NRG Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft. The status and size of the plane may be provided by NORAD through the N-RG: In some cases, it may not be readily apparent if an aircraft impact within the OW1'J:ER CONTROLLED AREA was intentional (i.e., a HOSTILE ACTION). It is eJcpected, although not certain, that notification by an appropriate Federal agency to the site would clarify this point. In this case , the appropriate federal agency is intended to be NOR.AD, FBI, Fl'n'\ or NRG. The emergency declaration, including one based on other !Cs/EA.Ls , should not be unduly delayed \Vhile awaiting notification by a Federal agency. Emergency plans and implementing procedures are public documents; therefore, EA.Ls should not incorporate Security sensitive information.

This includes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan. De,*elaper Nates: The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force. Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security sensitive information.

This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan. With due consideration given to the above developer note, EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures.

Such references should not contain a recognizable description of the event. For example , an EAL may be v,rorded as " Security event #2, #5 or #9 is reported by the (site specific security shift supervision)

." See the related Developer Note in Appendix B, Definitions, for guidance on the development of a scheme definition for the 0'.l/l'J:ER CONTROLLED AREA. EGL Assignment Attributes:

3.1.2.D B-14 Nel 99 01 (Revision

6) l>lovem.ber 2012 PD HA3 EGL: Alert Initiating Condition:

Other conditions exist which in the judgment of the Emergency Director warrant declaration of an A.lert. Operating Made 2A .. pplieability:

Not Applicable Example Emergeney Aetiae Le,,els: (1) Basis: Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HQgTJLE ACTION. Any releases are eJcpected to be limited to small fractions of the EPA Protective Action Guideline eJcposure levels. This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions eJcist which are believed by the Emergency Director to foll ooder the emergency classification level description for an Alert. B-15