Text

Enclosure 3 to Fple Letter SBK-L-06227 - Ealdbd, Rev a, Seabrook Emergency Action Level Design Basis Document
	ML073110423
Person / Time
Site:	Seabrook
Issue date:	10/17/2007
From:	Young D; Florida Power & Light Energy Seabrook
To:	; Office of Nuclear Reactor Regulation
References
	SBK-L-06227 EALDBD, Rev A
	Download: ML073110423 (141)
	v • d • e

EALDBD Rev. A FPL Energy Seabrook Station Emergency Action Level Design Basis Document for Seabrook Station January 2006 Prepared by: Date:

David Young Approved by: Date:

Sue Perkins-Grew

EALDBD Rev. A TABLE OF CONTENTS PAGE DEVELOPMENT OF EMERGENCY ACTION LEVELS 1.1 Regulatory C ontext ................................................................................................... .. 3 1.2 Definitions Needed To Develop EAL Methodology .................................................... 4 1.3 Recognition Categories .............................................................................................. 5 1.4 Emergency Class Descriptions ................................................................................... 7 1.5 Emergency Class Thresholds ..................................................................................... 9 1.6 Emergency Action Levels ........................................... 10 1.7 Treatment Of Multiple Events and Emergency Class Upgrading .............................. 12 1.8 Emergency Class Downgrading ................................................................................ 12 1.9 Classifying Transient Events ..................................................................................... 12 1.10 Cold Shutdown/Refueling IC/EALs ............................................................................ 13 1 .1 1 IS F S I IC /E A Ls ............................................................................................................... 14 1.12 Operating Mode Applicability ..................................................................................... 14 1.1 3 D efin itio ns ............................................................................................................... 15 INITIATING CONDITIONS MATRICES (EAL descriptions follow each matrix)

Category A Abnormal Rad Levels/Radiological Effluent ................................................. 19 Category C Cold Shutdown./ Refueling System Malfunction........................................... 34 Category E Events Related to ISFSI Malfunction ............................................................ 61 Category F Fission Product Barrier Degradation ............................................................. 63 Category H Hazards and Other Conditions Affecting Plant Safety ................................... 74 Category S System Malfunction ......................................................................................... 103 APPENDICES Appendix A, Basis for Radiological Effluent Initiating Conditions ............................................ 127 Appendix B - Not used Appendix C, Basis for Cold Shutdown/Refueling Initiating Conditions ..................................... 135 Appendix D - Not used Appendix E, Basis for ISFSI Initiating Conditions ................................................................... 138 Page 2 10/17/07

EALDBD Rev. A 1.0 DEVELOPMENT OF EMERGENCY ACTION LEVELS 1.1 Regulatory Context Title 10, Code of Federal Regulations, Part 50 provides the regulations that govern emergency preparedness at nuclear power plants. Nuclear power reactor licensees are required to have NRC-approved "emergency response plans" for dealing with "radiological emergencies." The requirements call for both onsite and offsite emergency response plans, with the offsite plans being those approved by FEMA and used by the State and local authorities. This document deals with the utilities' approved onsite plans and procedures for response to radiological emergencies at nuclear power plants, and the links they provide to the offsite plans.

Section 50.47 of Title 10 of the Code of Federal Regulations (10 CFR 50.47), entitled "Emergency Plans," states the requirement for such plans. Part (a)(1) of this regulation states that "no operating license will be issued unless a finding is made by NRC that there is reasonable assurance that adequate protective measures can and will be taken in the event of a radiological emergency."

The major portion of 10 CFR 50.47 lists "standards" that emergency response plans must meet.

The standards constitute a detailed list of items to be addressed in the plans. Of particular importance to this project is the fourth standard, which addresses "emergency classification" and "action levels." These terms, however, are not defined in the regulation.

10 CFR 50.54, "Conditions of licenses," emphasizes that power reactor licensees must "follow, and maintain in effect, emergency plans which meet the standards in Part 50.47(b) and the requirements in Appendix E to this part." The remainder of this part deals primarily with required implementation dates.

10 CFR 50.54(q) allows licensees to make changes to emergency plans without prior Commission approval only if: (a) the changes do not decrease the effectiveness of the plans and (b) the plans, as changed, continue to meet 10 CFR 50.47(b) standards and 10 CFR 50 Appendix E requirements. The licensee must keep a record of any such changes. Proposed changes that decrease the effectiveness of the approved emergency plans may not be implemented without application to and approval by the Commission.

10 CFR 50.72 deals with "Immediate notification requirements for operating nuclear power reactors." The "immediate" notification section actually includes three types of reports: (1) immediately after notification of State or local agencies (for emergency classification events);

(2) one-hour reports; and, (3) four-hour reports.

Although 10 CFR 50.72 contains significant detail, it does not define either "Emergency Class" or "Emergency Action Level." But one-hour and four-hour reports are listed as "non-emergency events," namely, those which are "not reported as a declaration of an Emergency Class."

Certain 10CFR50.72 events can also meet the Unusual event emergency classification if they are precursors of more serious events. These situations also warrant anticipatory notification of state and local officials. (See Section 3.7, "Emergency Class Descriptions".)

By footnote, the reader is directed from 10 CFR 50.72 to 10 CFR 50 Appendix E, for information concerning "Emergency Classes."

Page 3 10/17/07

EALDBD Rev. A 10 CFR 50.73 describes the "Licensee event report system," which requires submittal of follow-up written reports within thirty days of required notification of NRC.

10 CFR 50 Appendix E, Section B, "Assessment Actions," mandates that emergency plans must contain "emergency action levels." EALs are to be described for: (1) determining the need for notification and participation of various agencies, and (2) determining when and what type of protective measures should be considered. Appendix E continues by stating that the EALs are to be based on: (1) in-plant conditions; (2) in-plant instrumentation; (3) onsite monitoring; and (4) offsite monitoring.

10 CFR 50 Appendix E, Section C, "Activation of Emergency Organization," also addresses "emergency classes" and "emergency action levels." This section states that EALs are to be based on: (1) onsite radiation monitoring information; (2) offsite radiation monitoring information; and, (3) readings from a number of plant sensors that indicate a potential emergency, such as containment pressure and the response of the Emergency Core Cooling System. This' section also states that "emergency classes" shall include: (1) Unusual events (UNUSUAL EVENTs), (2) Alert, (3) Site Area Emergency, and (4) General Emergency.

These regulations are supplemented by various regulatory guidance documents. A significant document that has dealt specifically with EALs is NUREG-0654/FEMA-REP-1, "Criteria for Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness in Support of Nuclear Power Plants," October 1980.

Recognition Category E (Events Related to ISFSI) is applicable to licensees using their 10 CFR 50 emergency plan to fulfill the requirements of 10 CFR 72.32. The emergency classifications for Recognition Category E are those provided by NUREG 0654/FEMA Rep.1 in accordance with 10 CFR 50.47. The classification of an ISFSI event under provisions of a 10 CFR 50.47 emergency plan should be consistent with the definitions of the emergency classes as used by that plan. A site-specific analysis would make this determination, but in most cases it is expected that classification of an Unusual Event would be appropriate. It is expected that the initiating conditions germane to a 10 CFR 72.32 emergency plan (described in NUREG-1 567) are subsumed within 10 CFR 50.47 emergency plan's classification scheme.

1.2 Definitions Used in Developing EAL Methodology The following definitions apply to the Seabrook Station EAL methodology:

EMERGENCY CLASS: One of a minimum set of names or titles, established by the Nuclear Regulatory Commission (NRC), for grouping off-normal nuclear power plant conditions according to (1) their relative radiological seriousness, and (2) the time-sensitive onsite and off-site radiological emergency preparedness actions necessary to respond to such conditions. The existing radiological emergency classes, in ascending order of seriousness, are called:

" Unusual event

" Alert

" Site Area Emergency

" General Emergency Page 4 10/17/07

EALDBD Rev. A INITIATING CONDITION (IC): One of a predetermined subset of nuclear power plant conditions where either the potential exists for a radiological emergency, or such an emergency has occurred.

Discussion:

In NUREG-0654, the NRC introduced, but does not define, the term "initiating condition." Since the term is commonly used in nuclear power plant emergency planning, the definition above has been developed and combines both regulatory intent and the greatest degree of common usage among utilities.

Defined in this manner, an IC is an emergency condition which sets it apart from the broad class of conditions that may or may not have the potential to escalate into a radiological emergency. It can be a continuous, measurable function that is outside technical specifications, such as elevated RCS temperature or falling reactor coolant level (a symptom). It also encompasses occurrences such as FIRE (an event) or reactor coolant pipe failure (an event or a barrier breach).

EMERGENCY ACTION LEVEL (EAL): A pre-determined, site-specific, observable threshold for a plant Initiating Condition that places the plant in a given emergency class. An EAL can be: an instrument reading; an equipment status indicator; a measurable parameter (onsite or offsite); a discrete, observable event; results of analyses; entry into specific emergency operating procedures; or another phenomenon which, if it occurs, indicates entry into a particular emergency class.

Discussion:

The term "emergency action level" has been defined by example in the regulations, as noted in the above discussion concerning regulatory background. The term had not, however, been defined operationally in a manner to address all contingencies. There are times when an EAL will be a threshold point on a measurable continuous function, such as a primary system coolant leak that has exceeded technical specifications for a specific plant.

At other times, the EAL and the IC will coincide, both identified by a discrete event that places the plant in a particular emergency class. For example, "Train Derailment Onsite" is an example of an "Unusual Event" IC in NUREG-0654 that also can be an event-based EAL.

1.3 Recognition Categories ICs and EALs can be grouped in one of several schemes. This generic classification scheme incorporates symptom-based, event-based, and barrier-based ICs and EALs.

Page 5 10/17/07

EALDBD Rev. A The symptom-based category for ICs and EALs refers to those indicators that are measurable over some continuous spectrum, such as core temperature, coolant levels, containment pressure, etc. When one or more of these indicators begin to show off-normal readings, reactor operators are trained to identify the probable causes and potential consequences of these "symptoms" and take corrective action. The level of seriousness indicated by these symptoms depends on the degree to which they have exceeded technical specifications, the other symptoms or events that are occurring contemporaneously, and the capability of the licensed operators to gain control and bring the indicator back to safe levels.

Event-based EALs and ICs refer to occurrences with potential safety significance, such as the failure of a high-pressure safety injection pump, a safety valve failure, or a loss of electric power to some part of the plant. The range of seriousness of these "events" is dependent on the location, number of contemporaneous events, remaining plant safety margin, etc.

Barrier-based EALs and ICs refer to the level of challenge to principal barriers used to assure containment of radioactive materials contained within a nuclear power plant. For radioactive materials that are contained within the reactor core, these barriers are: fuel cladding, reactor coolant system pressure boundary, and containment. The level of challenge to these barriers encompasses the extent of damage (loss or potential loss) and the number of barriers concurrently under challenge. In reality, barrier-based EALs are a subset of symptom-based EALs that deal with symptoms indicating fission product barrier challenges. These barrier-based EALs are primarily derived from Emergency Operating Procedure (EOP) Critical Safety Function (CSF) Status Tree Monitoring (or their equivalent). Challenge to one or more' barriers generally is initially identified through instrument readings and periodic sampling. Under present barrier-based EALs, deterioration of the reactor coolant system pressure boundary or the fuel clad barrier usually indicates an "Alert" condition, two barriers under challenge a Site Area Emergency, and loss of two barriers with the third barrier under challenge is a General Emergency. The fission product barrier matrix described in Category F is a hybrid approach that recognizes that some events may represent a challenge to more than one barrier, and that the containment barrier is weighted less than the reactor coolant system pressure boundary and the fuel clad barriers.

Symptom-based ICs and EALs are most easily identified when the plant is in a normal startup, operating or hot shutdown mode of operation, with all of the barriers in place and the plant's instrumentation and emergency safeguards features fully operational as required by technical specifications. It is under these circumstances that the operations staff has the most direct information of the plant's systems, displayed in the main control room. As the plant moves through the decay heat removal process toward cold shutdown and refueling, barriers to fission products are reduced (i.e., reactor coolant system pressure boundary may be open) and fewer of the safety systems required for power operation are required to be fully operational. Under these plant operating modes, the identification of an IC in the plant's operating and safety systems becomes more event-based, as the instrumentation to detect symptoms of a developing problem may not be fully effective; and engineered safeguards systems, such as the Emergency Core Cooling System (ECCS), are partially disabled as permitted by the plant's Technical Specifications.

Page 6. 10/17/07

EALDBD Rev. A Barrier-based lCs and EALs also are heavily dependent on the ability to monitor instruments that indicate the condition of plant operating and safety systems. Fuel cladding integrity and reactor coolant levels can be monitored through several indicators when the plant is in a normal operating mode, but this capability is much more limited when the plant is in a refueling mode, when many of these indicators are disconnected or off-scale. The need for this instrumentation is lessened, however, and alternate instrumentation is placed in service when the plant is shut down.

It is important to note that in some operating modes there may not be definitive and unambiguous indicators of containment integrity available to control room personnel. For this reason, barrier-based EALs should not place undue reliance on assessments of containment integrity in all operating modes. Generally, Technical Specifications relax maintaining containment integrity requirements in modes 5 and 6 in order to provide flexibility in performance of specific tasks during shutdown conditions. Containment pressure and temperature indications may not increase if there is a pre-existing breach of containment integrity. At most plants, a large portion of the containment's exterior cannot be monitored for leakage by radiation monitors.

Several categories of emergencies have no instrumentation to indicate a developing problem, or the event may be identified before any other indications are recognized. A reactor coolant pipe could break; FIRE alarms could sound; radioactive materials could be released; and any number of other events can occur that would place the plant in an emergency condition with little warning. For emergencies related to the reactor system and safety systems, the ICs shift to an event based scheme as the plant mode moves toward cold shutdown and refueling modes. For non-radiological events, such as FIRE, external floods, wind loads, etc., as described in NUREG-0654 Appendix 1, event-based ICs are the norm.

In many cases, a combination of symptom-, event- and barrier-based ICs will be present as an emergency develops. In a loss of coolant accident (LOCA), for example:

" Coolant level is dropping; (symptom)

There is a leak of gome magnitude in the system (pipe break, safety valve stuck open) that exceeds plant capabilities to make up the loss; (barrier breach or event)

Core (coolant) temperature is rising; (symptom) and

" At some level, fuel failure begins with indicators such as high coolant activity samples, etc.

(barrier breach or symptom) 1.4 Emergency Class Descriptions There are three considerations related to emergency classes. These are:

(1) The potential impact on radiological safety, either as now known or as can be reasonably projected; (2) How far the plant is beyond its predefined design, safety, and operating envelopes; and (3) Whether or not conditions that threaten health are expected to be confined to within the site boundary.

Page 7 10/17/07

EALDBD Rev. A The ICs deal explicitly with radiological safety impact by escalating from levels corresponding to releases within regulatory limits to releases beyond EPA Protective Action Guideline (PAG) plume exposure levels. In addition, the "Discussion" sections below include offsite dose consequence considerations which were not included in NUREG-0654 Appendix 1.

UNUSUAL EVENT: Events are in process or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of safety systems occurs.

Discussion:

Potential degradation of the level of safety of the plant is indicated primarily by exceeding plant technical specification Limiting Condition of Operation (LCO) allowable action statement time for achieving required mode change. Precursors of more serious events should also be included because precursors do represent a potential degradation in the level of safety of the plant. Minor releases of radioactive materials are included. In this emergency class, however, releases do not require monitoring or offsite response (e.g., dose consequences of less than 10 millirem).

ALERT: Events are in process or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels.

Discussion:

Rather than discussing the distinguishing features of "potential degradation" and "potential substantial degradation," a comparative approach would be to determine whether increased monitoring of plant functions is warranted at the Alert level as a result of safety system degradation. This addresses the operations staffs need for help, independent of whether an actual decrease in plant safety is determined. This increased monitoring can then be used to better determine the actual plant safety state, whether escalation to a higher emergency class is warranted, or whether de-escalation or termination of the emergency class declaration is warranted. Dose consequences from these events are small fractions of the EPA PAG plume exposure levels, i.e., about 10 millirem to 100 millirem TEDE.

SITE AREA EMERGENCY: Events are in process or have occurred which involve an actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts; (1) toward site personnel or equipment that could lead to the likely failure of or; (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA Protective Action Guideline exposure levels beyond the site boundary.

Page 8 10/17/07

EALDBD Rev. A Discussion:

The discriminator (threshold) between Site Area Emergency and General Emergency is whether or not the EPA PAG plume exposure levels are expected to be exceeded outside the site boundary. This threshold, in addition to dynamic dose assessment considerations discussed in the EAL guidelines, clearly addresses NRC and offsite emergency response agency concerns as to timely declaration of a General Emergency.

GENERAL EMERGENCY: Events are in process or have occurred which involve actual or imminent substantialcore degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area.

Discussion:

The bottom line for the General Emergency is whether evacuation or sheltering of the general public is indicated based on EPA PAGs, and therefore should be interpreted to include radionuclide release regardless of cause. In addition, it should address concerns as to uncertainties in systems or structures (e.g. containment) response, and also events such as waste gas tank releases and severe spent fuel pool events postulated to occur at high population density sites. To better assure timely notification, EALs in this category must primarily be expressed in terms of plant function status, with secondary reliance on dose projection. In terms of fission product barriers, loss of two barriers with loss or potential loss of the third barrier constitutes a General Emergency.

1.5 Emergency Class Thresholds The most common bases for establishing these boundaries are the technical specifications and setpoints for each plant that have been developed in the design basis calculations and the Final Safety Analysis Report (FSAR).

For those conditions that are easily measurable and instrumented, the boundary is likely to be the EAL (observable by plant staff, instrument reading, alarm setpoint, etc.) that indicates entry into a particular emergency class. For example, the main steam line radiation monitor may detect high radiation that triggers an alarm. That radiation level also may be the setpoint that closes the main steam isolation valves (MSIV) and initiates the reactor trip. This same radiation level threshold, depending on plant-specific parameters, also may be the appropriate EAL for a direct entry into an emergency class.

In addition to the continuously measurable indicators, such as coolant temperature, coolant levels, leak rates, containment pressure, etc., the FSAR provides indications of the consequences associated with design basis events. Examples would include steam pipe breaks, MSIV malfunctions, and other anticipated events that, upon occurrence, place the plant immediately into an emergency class.

Page 9 10/17/07

EALDBD Rev. A Another approach for defining these boundaries is the use of a plant-specific probabilistic safety assessment (PSA - also known as probabilistic risk assessment, PRA). A PSA has been completed for Seabrook Station. PSAs can be used as a good first approximation of the relevant ICs and risk associated with emergency conditions for existing plants. Generic insights from PSAs and related severe accident assessments which apply to EALs and emergency class determinations are:

1. Prolonged loss of all AC power events are extremely important. This would indicate that should this occur, and AC power is not restored within 15 minutes, entry into the emergency class at no lower than a Site Area Emergency, when the plant was initially at power, would be appropriate. This implies that precursors to loss of all AC power events should appropriately be included in the EAL structure.

2. For severe core damage events, uncertainties exist in phenomena important to accident progressions leading to containment failure. Because of these uncertainties, predicting containment integrity may be difficult in these conditions. This is why maintaining containment integrity alone following sequences leading to severe core damage may be an insufficient basis for not escalating to a General Emergency.

3. EAL methodology must be sufficiently rigorous to cover risk-significant sequences such as containment bypass, large LOCA with early containment failure, station blackout greater than 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months (e.g., LOCA consequences of Station Blackout), and reactor coolant pump seal failure.

Another critical element of the analysis to arrive at these threshold (boundary) conditions is the time that the plant might stay in that condition before moving to a higher emergency class. In particular, station blackout coping analyses performed in response to 10 CFR 50.63 and Regulatory Guide 1.155, "Station Blackout," is used to determine whether a Site Area Emergency or a General Emergency is indicated. The time dimension is critical to the EAL since the purpose of the emergency class for state and local officials is to notify them of the level of mobilization that may be necessary to handle the emergency. This is particularly true when a "Site Area Emergency" or "General Emergency" is imminent.

Regardless of whether or not containment integrity is challenged, it is possible for significant radioactive inventory within containment to result in EPA PAG plume exposure levels being exceeded even assuming containment is within technical specification allowable leakage rates.

With or without containment challenge, however, a major release of radioactivity requiring offsite protection actions from core damage is not possible unless a major failure of fuel cladding allows radioactive material to be released from the core into the reactor coolant.

NUREG-1228, "Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents," indicates that such conditions do not exist when the amount of clad damage is less than 20%.

1.6 Emergency Action Levels With the emergency classes defined, the thresholds that must be met for each EAL to be placed under the emergency class can be determined. There are two basic approaches to determining these EALs. EALs and emergency class boundaries coincide for those continuously measurable, instrumented ICs, such as radioactivity, core temperature, coolant levels, etc. For these ICs, the EAL will be the threshold reading that most closely corresponds to the emergency class description using the best available information.

Page 10 10/17/07

EALDBD Rev. A For discrete (discontinuous) events, the approach will have to be somewhat different. Typically, in this category are internal and external hazards such as FIRE or earthquake. The purpose for including hazards in EALs is to assure that station personnel and offsite emergency response organizations are prepared to deal with consequential damage these hazards may cause. If, indeed, hazards have caused damage to safety functions or fission product barriers, this should be confirmed by symptoms or by observation of such failures. Therefore, it may be appropriate to enter an Alert status for events approaching or exceeding design basis limits such as Operating Basis Earthquake, design basis wind loads, FIRE within VITAL AREAs, etc. This would give the operating staff additional support and improved ability to determine the extent of plant damage. if damage to barriers or challenges to Critical Safety Functions (CSFs) have occurred or are identified, then the additional support can be used to escalate or terminate the Emergency Class based on what has been found. Of course, security events must reflect potential for increasing security threat levels.

Plant emergency operating procedures (EOPs) are designed to maintain and/or restore a set of CSFs which are listed in the order of priority for restoration efforts during accident conditions.

The Seabrook Station CSF set includes:

0 Subcriticality 0 Core cooling

Heatsink

Pressure-temperature-stress (RCS integrity) 0 Containment

RCS inventory

Emergency Coolant Recirculation

Radiation/RDMS Display There are diverse and redundant plant systems to support each CSF. By monitoring the CSFs instead of the individual system component status, the impact of multiple events is inherently addressed, e.g., the number of operable components available to maintain the critical safety function.

The EOPs contain detailed instructions regarding the monitoring of these functions and provides a scheme for classifying the significance of the challenge to the functions. In providing EALs based on these schemes, the emergency classification can flow from the EOP assessment rather than being based on a separate EAL assessment. This is desirable as it reduces ambiguity and reduces the time necessary to classify the event.

As an example, consider that the Westinghouse Owner's Group (WOG) Emergency Response Guidelines (ERGs) classify challenges as YELLOW, ORANGE, and RED paths. If the core exit thermocouples exceed 1100 degrees F or 725 degrees F with low reactor vessel water level, a RED path condition exists. The ERG considers a RED path as "... an extreme challenge to a plant function necessary for the protection of the public ..." This is almost identical to the present NRC NUREG-0654 description of a site area emergency "... actual or likely failures of plant functions needed for the protection of the public ..." It reasonably follows that if any CSF enters a RED path, a site area emergency exists. A general emergency could be considered to exist if core cooling CSF is in a RED path and the EOP function restoration procedures have not been successful in restoring core cooling.

Page 11 P.10/17/07

EALDBD Rev. A Although the majority of the EALs provide very specific thresholds, the STED/SED must remain alert to events or conditions that lead to the conclusion that exceeding the EAL threshold is imminent. If, in the judgment of the STED/SED, an imminent situation is at hand, the classification should be made as if the thresholds has been exceeded. While this is particularly prudent at the higher emergency classes (as the early classification may provide for more effective implementation of protective measures), it is nonetheless applicable to all emergency classes.

1.7 Treatment Of Multiple Events And Emergency Class Upgrading The emergency class declared is based on the highest EAL reached. For example, two Alerts remain in the Alert category. Or, an Alert and a Site Area Emergency is a Site Area Emergency.

Although the majority of the EALs provide very specific thresholds, the STED/SED must remain alert to events or conditions that lead to the conclusion that exceeding the EAL threshold is imminent. If, in the judgment of the STED/SED, an imminent situation is at hand, the classification should be made as if the thresholds has been exceeded. While this is particularly prudent at the higher emergency classes (as the early classification may provide for more effective implementation of protective measures), it is nonetheless applicable to all emergency classes.

1.8 Emergency Class Downgrading Another important aspect of usable EAL guidance is the consideration of what to do when the risk posed by an emergency is clearly decreasing. Seabrook Station uses a combination approach involving recovery from General Emergencies and some Site Area Emergencies and termination from Unusual Events, Alerts, and certain Site Area Emergencies causing no long-term plant damage. Downgrading to lower emergency classes adds notifications but may have merit under certain circumstances.

1.9 Classifying Transient Events, For some events, the condition may be corrected before a declaration has been made. For example, an emergency classification is warranted when automatic and manual actions taken within the control room do not result in a required reactor trip. However, it is likely that actions taken outside of the control room will be successful, probably before the STED/SED classifies the event. The key consideration in this situation is to determine whether or not further plant damage occurred while the corrective actions were being taken. In some situations, this can be readily determined, in other situations, further analyses (e.g., coolant radiochemistry sampling, may be necessary).

If the emergency-related indications completely clear before a declaration of an emergency classification level has been made, then no emergency classification is required. The Shift Manager shall notify the Emergency News Manager within one hour of the termination of the emergency-related indications that emergency-related indications briefly existed, but cleared prior to the declaration of an emergency classification. The Emergency News Manager will initiate state notifications per good neighbor notification procedures. The event shall be reported to the NRC in accordance with 10 CFR 50.72 and 50.73 per the Regulatory Compliance Manual, and within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of the event.

Page 12 10/17/07

EALDBD Rev. A If emergency-related indications are received and later cleared, and after the fact it is determined that an emergency classification was warranted but not made, then no emergency classification is required. The Shift Manager shall notify the Emergency News Manager within one hour of discovery that an emergency classification was warranted but not declared and that emergency-related indications no longer exist. The Emergency News Manager will initiate state notifications per good neighbor notification procedures. The event shall be reported to the NRC in accordance with 10 CFR 50.72 and 50.73 per the Regulatory Compliance Manual, and within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of the event.

If emergency-related indications are received and reduce in. severity, such that the emergency classification went from an earlier higher level to a current lower level, the current lower level emergency should be declared. State and NRC notifications shall be made in accordance with Procedure ER 1.2.

Reporting requirements of 10 CFR 50.72 are applicable and the guidance of NUREG-1022, Rev. 1, Section 3 should be applied.

1.10 Cold Shutdown/Refueling IC/EALs Generic Letter 88-17, Loss of Decay Heat Removal, SECY-91-283, Evaluation of Shutdown and Low Power Risk Issues, SECY-93-190, Regulatory Approach to Shutdown and Low-power Operation, NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States, and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management, all address nuclear power plant safety issues that are applicable to periods when the plant is shutdown. These evaluations identify a number of variables which significantly affect the probability and consequences of losing decay heat removal capability during shutdown periods. In addition, NUREG-1449 discusses that the need to respond appropriately, including emergency classification and notification, still exists during cold-shutdown and refueling conditions. Both SECY-93-190 and NUREG-1449 have been reviewed and issues concerning shutdown effects on declaring emergencies have been addressed.

Given the variability of plant configurations (e.g., systems out-of-service for maintenance, containment open, reduced AC power redundancy, time since shutdown) during these periods, the consequences of any given initiating event can vary greatly. For example, a loss of decay heat removal capability that occurs at the end of an extended outage has less significance than a similar loss occurring during the first week after shutdown. Compounding these events is the likelihood that instrumentation necessary for assessment may also be inoperable. The cold shutdown and refueling EALs are based on performance capability to the extent possible with consideration given to RCS integrity, containment closure, and fuel clad integrity for the applicable modes.

The initiating conditions and example emergency actions levels associated directly with Cold Shutdown or Refueling safety function are presented in Recognition Category C, Cold Shutdown/Refueling. The EALs are consistent with the public risk associated with the other events represented in the Fission Product Barrier Matrix and in other sections of this document.

Page 13 10/17/07

EALDBD Rev. A 1.11 ISFSI IC/EALs An Independent spent fuel storage installation (ISFSI) is a complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. The Final Rule governing Emergency Planning Licensing Requirements for Independent Spent Fuel Storage Facilities (Federal Register Volume 60, Number 120 June 22, 1995, Pages 32430-32442) indicated that a significant amount of the radioactive material contained within a cask must escape its packaging and enter the biosphere for there to be a significant environmental impact resulting from an accident involving the dry storage of spent nuclear fuel. Formal offsite planning is not required because the postulated worst-case accident involving an ISFSI has insignificant consequences to the public health and safety.

1.12 Operating Mode Applicability The plant operating mode that existed at the time that the event occurred, prior to any protective system or operator action initiated in response to the condition, is compared to the mode applicability of the EALs. If an event occurs, and a lower or higher plant operating mode is reached before the emergency classification can be made, the declaration shall be based on the mode that existed at the time the event occurred.

For events that occur in Cold Shutdown or Refueling, escalation is via EALs that have Cold Shutdown or Refueling for mode applicability, even if Hot Shutdown (or a higher mode) is entered during any subsequent heat-up. In particular, the Fission Product Barrier Matrix EALs are applicable only to events that initiate in Hot Shutdown or higher.

Recognition Category C completely replaces Recognition Category S when in Cold Shutdown and Refueling modes. It should be noted that Recognition Category A and H IC/EALs still apply when in Cold Shutdown and Refueling modes. Recognition Category F is not applicable to Cold Shutdown and Refueling modes.

MODE APPLICABILITY MATRIX Recognition Category Mode A C E F H S 1 - Operating X X X X X 2 - Startup X X X X X 3 - Hot Standby X X X X X 4 - Hot Shutdown X X X X X 5 - Cold Shutdown X X X X 6 - Refueling X X X X Defueled X X X X Page 14 10/17/07

EALDBD Rev. A 1.13 Definitions In the IC/EALs, selected words have been set in all capital letters. These words are defined terms having specific meanings as they relate to this procedure. Definitions of these terms are provided below.

AFFECTING SAFE SHUTDOWN: Event in progress has adversely affected functions that are necessary to bring the plant to and maintain it in the applicable HOT or COLD SHUTDOWN condition. Plant condition applicability is determined by Technical Specification LCOs in effect.

Example 1 : Event causes damage that results in entry into an LCO that requires the plant to be placed in HOT SHUTDOWN. HOT SHUTDOWN is achievable, but COLD SHUTDOWN is not. This event is not "AFFECTING SAFE SHUTDOWN."

Example 2: Event causes damage that results in entry into an LCO that requires the plant to be placed in COLD SHUTDOWN. HOT SHUTDOWN is achievable, but COLD SHUTDOWN is not. This event is "AFFECTING SAFE SHUTDOWN."

ANTICIPATED TRANSIENT WITHOUT SCRAM (ATWS): an ATWS is a postulated anticipated operational occurrence (such as loss of feedwater, loss of load, or loss of off-site power) that is accompanied by a failure of the Reactor Protection System (RPS) to shutdown the reactor (neutron flux < 5%).

BOMB: refers to an explosive device suspected of having sufficient force to damage plant systems, or structures.

CIVIL DISTURBANCE: is a large group of persons violently protesting station operations or activities at the site.

CONFINEMENT BOUNDARY: is the barrier(s) between areas containing radioactive substances and the environment.

EXPLOSION: is a rapid, violent, unconfined combustion, or catastrophic failure of pressurized equipment that imparts energy of sufficient force to potentially damage permanent structures, systems, or components.

EXTORTION: is an attempt to cause an action at the station by threat of force.

FAULTED: (PWRs) in a steam generator, the existence of secondary side leakage that results in an uncontrolled decrease in steam generator pressure or the steam generator being completely depressurized.

FIRE: is combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIREs. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

HOSTAGE: is a person(s) held as leverage against the station to ensure that demands will be met by the station.

Page 15 10/17/07

EALDBD Rev. A HOSTILE ACTION: An act toward an NPP or its personnel that includes the use of violent force to destroyequipment, takes hostages, and /or intimidates the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, projectiles, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the NPP. Nonterrorism-based EALs should be used to address such activities, (e.g., violent acts between individuals in the owner, controlled area.)

HOSTILE FORCE: One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction.

IMMEDIATELY DANGEROUS TO LIFE AND HEALTH (IDLH): A condition that either poses an immediate threat to life and health or an immediate threat of severe exposure to contaminants which are likely to have adverse delayed effects on health.

INTRUSION / INTRUDER: is a person(s) present in a specified area without authorization.

Discovery of a BOMB in a specified area is indication of INTRUSION into that area by a HOSTILE FORCE.

LOWER FLAMMABILITY LIMIT (LFL): The minimum concentration of a combustible substance that is capable of propagating a flame through a homogenous mixture of the combustible and a gaseous oxidizer.

NORMAL PLANT OPERATIONS: activities at the plant site associated with routine testing, maintenance, or equipment operations, in accordance with normal operating or administrative procedures. Entry into abnormal or emergency operating procedures, or deviation from normal security or radiological controls posture, is a departure from NORMAL PLANT OPERATIONs.

PROTECTED AREA: is an area which normally encompasses all controlled areas within the security protected area fence (site-specific).

RUPTURED: (PWRs) in a steam generator, existence of primary-to-secondary leakage of a magnitude sufficient to require or cause a reactor trip and safety injection.

SABOTAGE: any deliberate act directed against the plant, or against a component of the plant, which could directly or indirectly endanger the public health and safety by exposure to radiation.

SIGNIFICANT TRANSIENT: is an UNPLANNED event involving one or more of the following:

(1) automatic turbine runback >25% thermal reactor power, (2) electrical load rejection >25%

full electrical load, (3) Reactor Trip, (4) Safety Injection Activation, or (5) thermal power oscillations >10%

STRIKE ACTION: is a work stoppage within the PROTECTED AREA by a body of workers to enforce compliance with demands made on (site-specific). The STRIKE ACTION must threaten to interrupt NORMAL PLANT OPERATIONs.

UNPLANNED: a parameter change or an event that is not the result of an intended evolution and requires corrective or mitigative actions.

Page 16 10/17/07

EALDBD Rev. A VALID: an indication, report, or condition, is considered to be VALID when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

VISIBLE DAMAGE: is damage to equipment or structure that is readily observable without measurements, testing, or analysis. Damage is sufficient to cause concern regarding the continued operability or reliability of affected safety structure, system, or component. Example damage includes: deformation due to heat or impact, denting, penetration, rupture, cracking, paint blistering. Surface blemishes (e.g., paint chipping, scratches) should not be included.

VITAL AREA: is any area, normally within the PROTECTED AREA, which contains equipment, systems, components, or material, the failure, destruction, or release of which could directly or indirectly endanger the public health and safety by exposure to radiation.

Page 17 10/17/07

EALDBD Rev. A INITIATING CONDITION MATRIX Recognition Category A Abnormal Rad Levels / Radiological Effluent ALERT "9 A 3 4 ormaI Rad LevelslRadlologlc Any UNPLANNED release of Actual or projected offsite Actual or projected offsite Any UNPLANNED release gaseous or liquid dose > 100 mRem TEDE dose > 1,000 mRem TEDE of gaseous or liquid radioactivity to the or 500 mRem Thyroid CDE or 5,000 mRem Thyroid radioactivity to the environment > 200 times the Op. Modes: All CDE environment > 2 times the ODCM limits for >60 ODCM limits for >ý15 Op. Modes: All minutes minutes Op. Modes:All- 'Op. Modes: All Damage to irradiated fuel or loss of water level that has or will result in the uncovering of irradiated fuel outside the reactor vessel Op. Modes: All Unexpected increase in Release of radioactive plant radiation material or increases in Op. Modes: All radiation levels within the facility that impedes operation of systems required to maintain safe operations or to establish or maintain cold shutdown Op. Modes: All Page 19 10/17/07

EALDBD Rev. A ABNORMAL RAD LEVELS/RADIOLOGICAL EFFLUENT Initiating Condition -- UNUSUAL EVENT Any UNPLANNED release of gaseous or liquid radioactivity to the environment > 2 times the ODCM limits for a 60 minutes Operating Mode Applicability: All Emergency Action Levels:

1. a. VALID reading on any of the following effluent monitors > 2 times the value of the current high-alarm setpoint for 60 minutes or longer.

" RM-6509-1 (WTT Disch)

RM-6521-1 (TB Sump)

RM-6519-1 (SG Blowdown)

" RM-6473-1 (WT LIQ EFF)

RM-6528-4 (WRGM rate)

AND

b. The discharge flow to the environment is not isolated within-60 minutes.

OR 2: Confirmed sample analysis for a gaseous or liquid release indicates concentrations or release rates > 2 times ODCM allowable limits, with a release duration of 60 minutes or longer.

Limits are specified in ODCM, Part A, Section 6 (liquid) and Section 7 (gaseous)

Basis:

Refer to Appendix A for a detailedbasis of the radiologicaleffluent IC/EALs.

This IC addresses a potential or actual decrease in the level of safety of the plant as indicated by a radiological release that exceeds regulatory commitments for an extended period of time.

Nuclear power plants incorporate features intended to control the release of radioactive effluents to the environment. Further, there are administrative controls established to prevent unintentional releases, or control and monitor intentional releases. These controls are located in the Offsite Dose Calculation Manual (ODCM). The occurrence of extended, uncontrolled radioactive releases to the environment is indicative of degradation in these features and/or controls.

Page 20 10/17/07

EALDBD Rev. A The ODCM multiples are specified in ICs AUM and AA1 only to distinguish between non-emergency conditions, and from each other. While these multiples obviously correspond to an offsite dose or dose rate, the emphasis in classifying these events is the degradation in the level of safety of the plant, NOT the magnitude of the associated dose or dose rate. Releases should not be prorated or averaged. For example, a release exceeding 4x ODCM limits for 30 minutes does not meet the threshold for this IC.

UNPLANNED, as used in this context, includes any release for which a radioactivity discharge permit was not prepared, or a release that exceeds the conditions (e.g., minimum dilution flow, maximum discharge flow, alarm setpoints, etc.) on the applicable permit. The STED/SED should not wait until 60 minutes has elapsed, but should declare the event as soon as it is determined that the release duration has or will likely exceed 60 minutes. Also, if an ongoing release is detected and the starting time for that release is unknown, the STED/SED should, in the absence of data to the contrary, assume that the release has exceeded 60 minutes.

EAL #1 addresses radioactivity releases, that for whatever reason, cause effluent radiation monitor readings to exceed two times the ODCM limit and releases are not terminated within 60 minutes. This alarm setpoint may be associated with a planned batch release, or a continuous release path. In either case, the setpoint is established by the ODCM. Indexing the EAL threshold to the ODCM setpoints in this manner insures that the EAL threshold will never be less than the setpoint established by a specific discharge permit.

EAL #2 addresses uncontrolled releases that are detected by sample analyses, particularly on unmonitored pathways, e.g., spills of radioactive liquids into storm drains, heat exchanger leakage in river water systems, etc.

EALs #1 and #2 directly correlate with the IC since annual average meteorology is required to be used in showing compliance with the ODCM and is used in calculating the alarm setpoints.

Reference:

ODCM Page 21 10/17/07

EALDBD Rev. A ABNORMAL RAD LEVELS/RADIOLOGICAL EFFLUENT Initiating Condition -- UNUSUAL EVENT Unexpected increase in plant radiation Operating Mode Applicability: All Emergency Action Levels:

1. a. VALID indication of uncontrolled water level decrease in the reactor refueling cavity, spent fuel pool, or fuel transfer canal with all irradiated fuel assemblies remaining covered by water.

AND

b. UNPLANNED and VALID reading increase on one of the following Area Radiation Monitors.

RM-6535-A-1, Containment Manipulator Crane

RM-6535-B-1, Containment Manipulator Crane

RM-6549-1, FSB Spent Fuel Range Low

RM-6518-1, FSB Spent Fuel Range Hi OR

2. UNPLANNED and VALID increase in an Area Radiation Monitor reading by a factor of 1000 over normal* levels.

Normal levels can be considered as the highest reading in the past twenty-four hours excluding the current peak value.

Basis:

This IC addresses increased radiation levels as a result of water level decreases or events that have resulted, or may result, in unexpected increases in radiation dose rates within plant buildings. These radiation increases represent a loss of control over radioactive material and may represent a potential degradation in the level of safety of the plant.

In light of Reactor Cavity Seal failure incidents at two different PWRs, explicit coverage of these types of events via EAL #1 is appropriate given their potential for increased doses to plant staff.

Classification as a Unusual Event is warranted as a precursor to a more serious event.

Indications may include instrumentation such as water level and local area radiation monitors, and personnel (e.g., refueling crew) reports. If available, video cameras may allow remote observation. Depending on available level instrumentation, the declaration threshold may need to be based on indications of water makeup rate or decrease in refueling water storage tank level.

Page 22 10/17/07

EALDBD Rev. A While a radiation monitor could detect an increase in dose rate due to a drop in the water level, it might not be a reliable indication of whether or not the fuel is covered. For example, the reading on an area radiation monitor located on the refueling bridge may increase due to planned evolutions such as head lift, or even a fuel assembly being raised in the manipulator mast. Generally, increased radiation monitor indications will need to combined with another indicator (or personnel report) of water loss. For refueling events where the water level drops below the reactor vessel flange classification would be via CU2. This event escalates to an Alert per IC AA2 if irradiated fuel outside the reactor vessel is uncovered. For events involving irradiated fuel in the reactor vessel, escalation would be via the Fission Product Barrier Matrix for events in operating modes 1-4.

EAL #2 addresses. UNPLANNED increases in in-plant radiation levels that represent a degradation in the control of radioactive material, and represent a potential degradation in the level of safety of the plant. This event escalates to an Alert per IC AA3 if the increase in dose rates impedes personnel access necessary for safe operation.

Reference:

UFSAR Section 12.3 Page 23 10/17/07

EALDBD Rev. A ABNORMAL RAD LEVELS/RADIOLOGICAL EFFLUENT Initiating Condition -- ALERT Any UNPLANNED release of gaseous or liquid radioactivity to the environment > 200 times the ODCM limits for > 15 minutes Operating Mode Applicability: All Emergency Action Levels:

1 a. VALID reading on any of the following effluent monitors > 200 times the value of the current high-alarm setpoint for 15 minutes or longer.

" RM-6509-1 (WTT Disch)

RM-6521-1 (TB Sump)

" RM-6519-1 (SG Blowdown)

RM-6473-1 (WT LIQ EFF)

RM-6528-4 (WRGM rate)

AND

b. The discharge flow to the environment is not isolated within 15 minutes.

OR

2. a. VALID reading of > 10 mR/hr on one or more main steam line radiation monitors for 15 minutes or longer.

RM-6481-1 (A)

RM-6482-1 (B)

RM-6482-2 (C)

RM-6481-2 (D)

AND

b. Release path to the environment from affected steam line, e.g., open ASDV or SRV, line is faulted, open steam supply to 1-FW-P-37A, etc.

OR

3. Confirmed sample analysis for a gaseous or liquid release indicates concentrations or release rates > 200 times ODCM allowable limits, with a release duration of 15 minutes or longer.

Limits are specified in ODCM, Part A, Section 6 (liquid) and Section 7 (gaseous)

Basis:

Refer to Appendix A for a detailed basis of the radiologicaleffluent IC/EALs.

Page 24 10/17/07

EALDBD Rev. A This IC addresses a potential or actual decrease in the level of safety of the plant as indicated by a radiological release that exceeds regulatory commitments for an extended period of time.

Nuclear power plants incorporate features intended to control the release of radioactive effluents to the environment. Further, there are administrative controls established to prevent unintentional releases, or control and monitor intentional releases. These controls are located in the Offsite Dose Calculation Manual (ODCM). The occurrence of extended, uncontrolled radioactive releases to the environment is indicative of degradation in these features and/or controls.

The ODCM limit multiples are specified in ICs AU1 and AA1 only to distinguish between non-emergency conditions, and from each other. While these multiples obviously correspond to a offsite dose or dose rate, the emphasis in classifying these events is the degradation in the level of safety of the plant, NOT the magnitude of the associated dose or dose rate. Releases should not be prorated or averaged.

UNPLANNED, as used in this context, includes any release for which a radioactivity discharge permit was not prepared, or a release that exceeds the conditions (e.g., minimum dilution flow, maximum discharge flow, alarm setpoints, etc.) on the applicable permit. The STED/SED should not wait until 15 minutes has elapsed, but should declare the event as soon as it is determined that the release duration has or will likely exceed 15 minutes. Also, if an ongoing release is detected and the starting time for that release is unknown, the STED/SED should, in the absence of data to the contrary, assume that the release has exceeded 15 minutes.

EAL #1 addresses radioactivity releases that for whatever reason cause effluent radiation monitor readings that exceed two hundred times the alarm setpoint established by the radioactivity discharge permit. This alarm setpoint may be associated with a planned batch release, or a continuous release path. In either case, the setpoint is established by the ODCM.

Indexing the EAL threshold to the ODCM limits in this manner insures that the EAL threshold will never be less than the setpoint established by a specific discharge permit.

The monitor reading in EAL #2 was calculated using the ODCM methodology for determining effluent radiation monitor setpoints. Refer to SEP# 2006013 for EPCALC-06-02.

EALs #1 and #2 directly correlate with the IC since annual average meteorology is required to be used in showing compliance with the ODCM and is used in calculating the alarm setpoints.

EAL #3 addresses uncontrolled releases that are detected by sample analyses, particularly on unmonitored pathways, e.g., spills of radioactive liquids into storm drains, heat exchanger leakage in river water systems, etc.

Due to the uncertainty associated with meteorology, emergency implementing procedures should call for the timely performance of dose assessments using actual (real-time) meteorology in the event of a gaseous radioactivity release of this magnitude. The results of these assessments should be compared to the ICs AS1 and AG1 to determine if the event classification should be escalated. Classification should not be delayed pending the results of these dose assessments.

Reference:

UFSAR Section 11.5 Page 25 10/17/07

0 EALDBD Rev. A ABNORMAL RAD LEVELS/RADIOLOGICAL EFFLUENT Initiating Condition -- ALERT Damage to irradiated fuel or loss of water level that has or will result in the uncovering of irradiated fuel outside the reactor vessel Operating Mode Applicability: All Emergency Action Levels:

1. An UNPLANNED and VALID high-alarm, or reading in excess of the current high-alarm setpoint, on one or more of the following radiation monitors:

" RM-6518-1, FSB High Range

" RM-6562-1, FSB Vent

RM-6535A-1, Manip Crane

RM-6535B-1, Manip Crane OR

2. An irradiated fuel assembly is uncovered in the reactor refueling cavity, spent fuel pool or fuel transfer canal.

Basis:

This IC addresses specific events that have resulted, or may result, in unexpected increases in radiation dose rates within plant buildings, and may be a precursor to a radioactivity release to the environment. These events represent a loss of control over radioactive material and represent a degradation in the level of safety of the plant. These events escalate from IC AU2 in that fuel activity has been released, or water levels are decreasing. This IC applies to spent fuel requiring water coverage and is not intended to address spent fuel which is licensed for dry storage.

EAL #1 addresses radiation monitor indications of significantly decreased water level.

Increased readings on ventilation monitors may be indication of a radioactivity release from the fuel, confirming that damage has occurred. Increased background at the monitor due to water level decrease may mask increased ventilation exhaust airborne activity and needs to be considered. While a radiation monitor could detect an increase in dose rate due to a drop in the water level, it might not be a reliable indication of whether or not the fuel is covered. For example, the monitor could in fact be properly responding to a known event involving transfer or relocation of a source, stored in or near the fuel pool or responding to a planned evolution such as removal of the reactor head. Application of these Initiating Conditions requires understanding of the actual radiological conditions present in the vicinity of the monitor.

Page 26 10/17/07

EALDBD Rev. A In EAL #2, indications may include instrumentation such as water level and local area radiation monitors, and personnel (e.g., refueling Crew) reports. If available, video cameras may allow remote observation. Depending on available level indication, the declaration threshold may need to be based on indications of water makeup rate or decrease in refueling water storage tank level.

Escalation, if appropriate, would occur via IC AS1 or AG1 or STED/SED judgment.

Reference:

UFSAR Sections 11.5 and 12.3 Page 27 10/17/07

EALDBD Rev. A ABNORMAL RAD LEVELS/RADIOLOGICAL EFFLUENT Initiating Condition -- ALERT Release of radioactive material or increases in radiation levels within the facility that impedes operation of systems required to maintain safe operations or to establish or maintain cold shutdown Operating Mode Applicability: All Emergency Action Levels:

1. VALID radiation monitor or survey readings > 15 mR/hr in the Control Room, the Central Alarm Station (CAS) or the Secondary Alarm Station (SAS).

OR

2. UNPLANNED and VALID radiation monitor or survey readings > 1 R/hr in areas requiring infrequent access to maintain plant safety functions.

Diesel Generator Building

Remote Safe Shutdown Panels

Main Steam & Feedwater Pipe Chases

Emergency Feedwater Pumphouse

Condensate Storage Tank Enclosure

Turbine Building Basis:

This IC addresses increased radiation levels that impede necessary access to operating stations, or other areas containing equipment that must be operated manually or that requires local monitoring, in order to maintain safe operation or perform a safe shutdown. It is this impaired ability to operate the plant that results in the actual or potential substantial degradation of the level of safety of the plant. The cause and/or magnitude of the increase in radiation levels is not a concern of this IC. The STED/SED must consider the source or cause of the increased radiation levels and determine if any other IC may be involved. For example, a dose rate of 15 mR/hr in the control room may be a problem in itself. However, the increase may also be indicative of high dose rates in the containment due to a LOCA. In this latter case, an SAE or GE may be indicated by the fission product barrier matrix ICs.

This IC is not meant to apply to increases in the containment dome radiation monitors as these are events which are addressed in the fission product barrier matrix ICs. Nor is it intended to apply to anticipated temporary increases due to planned events (e.g., incore detector movement, radwaste container movement, depleted resin transfers, etc.)

Page 28 10/17/07

EALDBD Rev. A The value of 15mR/hr is derived from the GDC 19 value of 5 rem in 30 days with adjustment for expected occupancy times. Although Section III.D.3 of NUREG-0737, "Clarificationof TMI Action Plan Requirements", provides that the 15 mR/hr value can be averaged over the 30 days, the value is used here without averaging, as a 30 day duration implies an event potentially more significant than an Alert.

The station has set an annual administrative control limit for TEDE dose of 1 Rem. For areas requiring infrequent access, the 1 R/hr (Locked High Rad Area) is based on radiation levels which result in exposure control measures intended to maintain doses within normal occupational exposure guidelines and limits (i.e., 10 CFR 20), and in doing so, will impede necessary access. As used here, impede, includes hindering or interfering provided that the interference or delay is sufficient to significantly threaten the safe operation of the plant.

Reference:

Page 29 10/17/07

EALDBD Rev. A ABNORMAL RAD LEVELS/RADIOLOGICAL EFFLUENT Initiating Condition -- SITE AREA EMERGENCY Actual or projected offsite dose > 100 mRem TEDE or 500 mRem Thyroid CDE Operating Mode Applicability: All Emergency Action Levels:

Note: If dose assessment results are available at the time of declaration,the classification should be based on EAL #2 instead of EAL #1. While necessary declarationsshould not be delayed awaiting results, the dose assessment should be initiated/ completed in order to determine if the classificationshould be subsequently escalated.

1. VALID reading on one or more of the following radiation monitors that exceeds, or is expected to exceed, the reading shown for 15 minutes or longer:

RM-6528-4 (WRGM rate): 2.85E+7 uCi/sec

" RM-6481 -1 " (MSL A): See below

RM-6482-1" (MSL B): See below

RM-6482-2" (MSL C): See below

RM-6481-2" (MSL D): See below Tsd < 1 hr 130 mR/hr 1 hr < Tsd < 2 hrs 100 mR/hr 2 hr.s < Tsd < 5 hrs 50 mR/hr TSd > 5 hrs 20 mR/hr

With release path to the environment from affected steam line, e.g., open ASDV or SRV, line is faulted, open steam supply to 1-FW-P-37A, etc.

OR

2. Dose assessment using actual meteorology, and the actual or projected duration of the release, indicates doses > 100 mRem TEDE or 500 mRem thyroid CDE at or beyond the site boundary.

OR

3. Field survey results indicate closed window dose rates > 100 mR/hr expected to continue for more than one hour at or beyond the site boundary; OR analyses of field survey samples indicate thyroid CDE of > 500 mRem for one hour of inhalation at or beyond the site boundary.

Basis:

Refer to Appendix A for a detailed basis of the radiologicaleffluent IC/EALs.

Page 30 10/17/07

EALDBD Rev. A This IC addresses radioactivity releases that result in doses at or beyond the site boundary that exceed a small fraction of the EPA Protective Action Guides (PAGs). Releases of this magnitude are associated with the failure of plant systems needed for the protection of the public. While these failures are addressed by other ICs, this IC provides appropriate diversity and addresses events which may not be able to be classified on the basis of plant status alone, e.g., fuel handling accident in spent fuel building.

The TEDE dose is set at 10% of the EPA PAG, while the 500 mR thyroid CDE was established in consideration of the 1:5 ratio of the EPA PAG for TEDE and thyroid CDE.

The STED/SED should not wait until 15 minutes has elapsed, but should declare the event as soon as it is determined that the release duration has or will likely exceed 15 minutes.

The monitor list in EAL #1 includes the monitors on the effluent pathways capable of generating a release sufficient to cause doses at or beyond the site boundary that exceed 100 mR TEDE or 500 mR Thyroid CDE for the actual or projected duration of the release. The EPA PAGs are expressed in terms of the sum of the effective dose equivalent (EDE) and the committed effective dose equivalent (CEDE), or as the thyroid committed dose equivalent (CDE). For the purpose of these IC/EALs, the dose quantity total effective dose equivalent (TEDE), as defined in 10 CFR 20, is used in lieu of "...sum of EDE and CEDE...."The EPA PAG guidance provides for the use adult thyroid dose conversion factors.

The monitor reading EALs were determined using a dose assessment method that back calculates from the dose values specified in the IC. The meteorology and source term used were the same as those used for determining the monitor reading EALs in ICs AU1 and AA1.

This protocol maintains the intervals between the EALs for the four classifications. Since doses are not monitored in real-time, a release duration of one hour was assumed, and the EALs based on a site boundary dose rate of 100 mR/hour whole body or 500 mR/hour thyroid, whichever is more limiting. Refer to SEP# 2006013, EPCALC-06-02.

Since dose assessment is based on actual meteorology, whereas the monitor reading EALs are not, the results from these assessments may indicate that the classification is not warranted, or may indicate that a higher classification is warranted. For this reason, emergency implementing procedures call for the timely performance of dose assessments using actual meteorology and release information. If the results of these dose assessments are available when the classification is made (e.g., initiated at a lower classification level), the dose assessment results override the monitor reading EALs. Classification should not be delayed pending the results of these dose assessments.

Reference:

UFSAR Section 11.5 Page 31 10/17/07

EALDBD Rev. A ABNORMAL RAD LEVELS/RADIOLOGICAL EFFLUENT Initiating Condition -- GENERAL EMERGENCY Actual or projected offsite dose > 1,000 mRem TEDE or 5,000 mRem Thyroid CDE Operating Mode Applicability: All Emergency Action Levels:

Note: If dose assessment results are available at the time of declaration,the classification should be based on EAL #2 instead of EAL #1. While necessary declarationsshould not be delayed awaiting results, the dose assessment should be initiated/ completed in order to determine if the classificationshould be subsequently escalated.

1. VALID reading on one or more of the following radiation monitors that exceeds, or is expected to exceed, the reading shown for 15 minutes or longer:

RM-6528-4 (WRGM rate): 2.85E+8 uCi/sec

RM-6481-1" (MSL A): See below

RM-6482-1" (MSL B): See below

" RM-6482-2" (MSL C): See below

RM-6481-2" (MSL D): See below Tsd < 1 hr 1,310 mR/hr 1 hr < Tsd 2 hrs 1,060 mR/hr 2 hrs < Td 5 hrs 570 mR/hr 5 hr.s < Tsd < 10 hrs 220 mR/hr Tsd > 10 hrs 50 mR/hr

With release path to the environment from affected steam line, e.g., open ASDV or SRV, line is faulted, open steam supply to 1-FW-P-37A, etc.

OR

2. Dose assessment using actual meteorology, and the actual or projected duration of the release, indicates doses > 1,000 mRem TEDE or 5,000 mRem thyroid CDE at or beyond the site boundary.

OR

3. Field survey results indicate closed window dose rates > 1000 mR/hr expected to continue for more than one hour at or beyond the site boundary; OR analyses of field survey samples indicate thyroid CDE of > 5,000 mRem for one hour of inhalation, at or beyond site boundary.

Page 32 10/17/07

EALDBD Rev. A Basis:

Refer to Appendix A for a detailedbasis of the radiologicaleffluent IC/EALs.

This IC addresses radioactivity releases that result in doses at or beyond the site boundary that exceed the EPA Protective Action Guides (PAGs). Public protective actions will be necessary.

Releases of this magnitude are associated with the failure of plant systems needed for the protection of the public and likely involve fuel damage. While these failures are addressed by other ICs, this IC provides appropriate diversity and addresses events which may not be able to be classified on the basis of plant status alone. It is important to note that, for the more severe accidents, the release may be unmonitored or there may be large uncertainties associated with the source term and/or meteorology.

The STED/SED should not wait until 15 minutes has elapsed, but should declare the event as soon as it is determined that the release duration has or will likely exceed 15 minutes.

The monitor list in EAL #1 includes the monitors on the effluent pathways capable of generating a release sufficient to cause doses at or beyond the site boundary that exceed the EPA Protective Action Guides (PAGs). The EPA PAGs are expressed in terms of the sum of the effective dose equivalent (EDE) and the committed effective dose equivalent (CEDE), or as the thyroid committed dose equivalent (CDE). For the purpose of these IC/EALs., the dose quantity total effective dose equivalent (TEDE), as defined in 10 CFR 20, is used in lieu of "...sum of EDE and CEDE...."The EPA PAG guidance provides for the use adult thyroid dose conversion factors.

The monitor reading EALs were determined using a dose assessment method that back-calculates from the dose values specified in the IC. The meteorology and source term used were the same as those used for determining the monitor reading EALs in ICs AUM and AA1.

This protocol maintains the intervals between the EALs for the four classifications. Since doses are not monitored in real-time, a release duration of one hour was assumed, and the EALs based on a site boundary dose of 1,000 mR/hour whole body or 5,000 mR/hour thyroid, whichever is more limiting. Refer to SEP# 2006013 - EPCALC-06-02.

Since dose assessment is based on actual meteorology, whereas the monitor reading EALs are not, the results from these assessments may indicate that the classification is not warranted, or may indicate that a higher classification is warranted. For this reason, emergency implementing procedures call for the timely performance of dose assessments using actual meteorology and release information. If the results of these dose assessments are available when the classification is made (e.g., initiated at a lower classification level), the dose assessment results override the monitor reading EALs. Classification should not be delayed pending the results of these dose assessments.

Reference:

UFSAR Section 11.5 Page 33 10/17/07

EALDBD Rev. A INITIATING CONDITION MATRIX Recognition Category C Cold Shutdown/Refueling System Malfunction UNUUA E*E ALERT 17 - MTRIý,YTBI,7-TW7.ý Or I- T!Tmý-t" I Cold ShutdownlRefuelinng System Malfunction RCS leakage Loss of RCS inventory Loss of RCS inventory affecting Loss of RCS or reactor vessel Op. Mode: 5 Op. Mode: 5 core decay heat removal inventory with irradiated fuel in capability the reactor vessel AND Op. Mode: 5 containment challenged Op. Modes: 5, 6 UNPLANNED loss of reactor Loss of reactor vessel inventory Loss of reactor vessel inventory vessel inventory with irradiated with irradiated fuel in the reactor affecting core decay heat fuel in the reactor vessel vessel removal capability with irradiated Op. Mode: 6 Op. Mode: 6 fuel in the reactor vessel Op. Mode: 6 Loss of all offsite power to AC Loss of both AC emergency buses emergency buses for> 15 for > 15 minutes minutes Op. Modes: 5, 6, Defueled Op. Modes: 5, 6 UNPLANNED loss of decay heat Inability to maintain plant in cold removal capability with irradiated shutdown with irradiated fuel in the fuel in the reactor vessel reactor vessel Op. Modes: 5, 6 Op. Modes: 5, 6 Fuel clad degradation Op. Mode: 5 UNPLANNED loss of all onsite or offsite communications.

capabilities Op. Modes: 5, 6 UNPLANNED loss of required DC power for > 15 minutes Op. Modes: 5, 6 Inadvertent criticality Op Modes:, 5, 6.

Page 34 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT RCS leakage Operating Mode Applicability: 5 Emergency Action Levels:

1. RCS unidentified or pressure boundary leakage > 10 gpm.

OR

2. RCS identified leakage > 25 gpm.

Basis:

This IC is included as a Unusual Event because it is considered to be a potential degradation of the level of safety of the plant. The 10 gpm value for the unidentified and pressure boundary leakage was selected as it is sufficiently large to be observable via normally installed instrumentation (e.g., Pressurizer level, RCS loop level instrumentation, etc...) or reduced inventory instrumentation such as level hose indication. Lesser values must generally be determined through time-consuming surveillance tests (e.g., mass balances). The EAL for identified leakage is set at a higher value due to the lesser significance of identified leakage in comparison to unidentified or pressure boundary leakage. Prolonged loss of RCS Inventory may result in escalation to the Alert level via either IC CA1 or CA4.

The difference between CU1 and CU2 deals with the RCS conditions that exist between cold shutdown and refueling mode applicability. In cold shutdown the RCS will normally be intact and RCS inventory and level monitoring means such as Pressurizer level indication and makeup volume control tank levels are normally available. In the refueling mode the RCS is not intact and reactor vessel level and inventory are monitored by different means.

Expanded basis for these assumptions is provided in Appendix C.

Page 35 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT UNPLANNED loss of reactor vessel inventory with irradiated fuel in the reactor vessel Operating Mode Applicability: 6 Emergency Action Levels:

1 a. UNPLANNED reactor coolant level decrease below the reactor vessel flange as indicated by:

1-RC-LI-9405 < 0", and/or

1-SF-LI-2629 < 0" AND

b. 15 minutes has elapsed with reactor coolant level below the reactor vessel flange.

AND

c. Irradiated fuel in the reactor vessel.

OR

2. a. Loss of reactor vessel inventory as indicated by unexplained increases in sump and/or tank levels.

AND

b. Reactor vessel level cannot be monitored.

AND

c. Irradiated fuel in the reactor.vessel.

Basis:

This IC is included as a Unusual Event because it may be a precursor of more serious conditions and, as result, is considered to be a potential degradation of the level of safety of the plant. Refueling evolutions that decrease RCS water level below the reactor vessel flange are carefully planned and procedurally controlled. An UNPLANNED event that results in water level decreasing below the reactor vessel flange warrants declaration of a Unusual Event due to the reduced RCS inventory that is available to keep the core covered. The allowance of 15 minutes was chosen because it is reasonable to assume that level can be restored within this time frame using one or more of the redundant means of refill that should be available. If level cannot be restored in this time frame then it may indicate a more serious condition exists.

Page 36 10/17/07

EALDBD Rev. A Continued loss of RCS Inventory will result in escalation to the Alert level via either IC CA2 or CA4.

The difference between CUl and CU2 deals with the RCS conditions that exist between cold shutdown and refueling modes. In cold shutdown the RCS will normally be intact and standard RCS inventory and level monitoring means are available. In the refueling mode the RCS is not intact and reactor vessel level and inventory are monitored by different means.

In the refueling mode, normal means of core temperature indication and RCS level indication may not be available. Redundant means of reactor vessel level indication will normally be installed (including the ability to monitor level visually) to assure that the ability to monitor level will not be interrupted. However, if all level indication were to be lost during a loss of RCS inventory event, the operators would need to determine that reactor vessel inventory loss was occurring by observing sump and tank level changes. Sump and tank level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS leakage. Escalation to Alert would be via either CA2 or RCS heatup via CA4.

EAL 1 involves a decrease in RCS level below the top of the reactor vessel flange that continues for 15 minutes due to an UNPLANNED event. This EAL is not applicable to decreases in flooded reactor cavity level (covered by AU2 EAL1) until such time as the level decreases to the level of the vessel flange. If reactor vessel level continues to decrease then escalation to CA2 would be appropriate.

Expanded basis for these assumptions is provided in Appendix C.

Reference:

OS1000.09, Refueling Operation OS1000.12, Operation With RCS At Reduced Inventory/Midloop Conditions Page 37 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT Loss of all offsite power to AC emergency buses for greater than 15 minutes Operating Mode Applicability: 5 and 6 Emergency Action Levels:

1. Both AC emergency busses E5 AND E6 are not powered from an offsite source for > 15 minutes.

AND

2. Power restored to at least one AC emergency bus (E5 OR E6) from an emergency diesel generator or SEPS.

Basis:

Prolonged loss of AC power reduces required redundancy and potentially degrades the level of safety of the plant by rendering the plant more vulnerable to a complete Loss of AC Power (e.g., Station Blackout). Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

1-EDE-SWG-5 (E5) and 1-EDE-SWG-6 (E6) are the 4.16 kV emergency buses for Train A and Train B respectively. These buses supply all safety-related loads (e.g., ECCS equipment).

This Initiating Condition is not met if either Bus E5 or E6 is energized from the Supplemental Emergency Power System (SEPS).

The SEPS primary function is to supply power to one 4.16 kV emergency bus, EDE-SWG-5 (E5) or EDE-SWG-6 (E6), in the event of a loss-of-offsite-power (LOOP) and both EDGs fail to start and load. In addition (SEPS) provides back up power to the emergency buses when one of the emergency diesel generators (EDG) is out of service for up to fourteen days. SEPS can be used when it is anticipated that one of the EDGs will be inoperable for longer than the technical specification allowable outage time (AOT) of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The design of the SEPS is capable of providing the required safety-related loads in the event of a loss of offsite power if both emergency diesel generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (SI, CBS, CVI, Cl, etc.). In addition to providing power to the required loads, the total combined output of the SEPS system can supply either the RHR pump or the SI pump and one set of pressurizer heaters. These design conditions are based on Probabilistic Risk Evaluation (PRA) EE-03-007.

Page 38 10/17/07

EALDBD Rev. A The SEPS consists of two 4.16 kV generators which use diesel fuel engines as the prime mover. The generator sets (gensets) SEPS-DG-2-A and SEPS-DG-2-B are capable of automatically starting, synchronizing together and energizing the SEPS electrical bus. When SEPS is supplying power and connected to emergency buses E5 or E6, the SEPS DGs can be paralleled with offsite when offsite power is restored.

The use of the SEPS is recognized in the Emergency Operating Procedures.

Reference:

UFSAR Section 8.3.1, AC Power Systems Page 39 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT UNPLANNED loss of decay heat removal capability with irradiated fuel in the reactor vessel Operating Mode Applicability: 5 and 6 Emergency Action Levels:

1. An UNPLANNED event results in RCS temperature > 2000 F.

OR

2. Loss of all RCS temperature and reactor vessel level indication for > 15 minutes.

Basis:

This IC is included as a Unusual Event because it may be a precursor of more serious conditions and, as a result, is considered to be a potential degradation of the level of safety of the plant. In cold shutdown the ability to remove decay heat relies primarily on forced cooling flow. Operation of the systems that provide this forced cooling may be jeopardized due to the unlikely loss of electrical power or RCS inventory. Since the RCS usually remains intact in the cold shutdown mode a large inventory of water is available to keep the core covered. In cold shutdown the decay heat available to raise RCS temperature during a loss of inventory or heat removal event may be significantly greater than in the refueling mode. Entry into cold shutdown conditions may be attained within hours of operating at power. Entry into the refueling mode procedurally may not occur for 80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months or longer (per Technical Specifications) after the reactor has been shutdown. Thus the heatup threat and therefore the threat to damaging the fuel clad may be lower for events that occur in the refueling mode with irradiated fuel in the reactor vessel (note that the heatup threat could be lower for cold shutdown conditions if the entry into cold shutdown was following a refueling). In addition, the operators should be able to monitor RCS temperature and reactor vessel level so that escalation to the alert level via CA4 or CA1 will occur if required.

During refueling the level in the reactor vessel will normally be maintained above the reactor vessel flange. Refueling evolutions that decrease water level below the reactor vessel flange are carefully planned and procedurally controlled. Loss of forced decay heat removal at reduced inventory may result in more rapid increases in RCS/reactor vessel temperatures depending on the time since shutdown. Escalation to the Alert level via CA4 is provided should an UNPLANNED event result in RCS temperature exceeding the Technical Specification cold shutdown temperature limit.

Page 40 10/17/07

EALDBD Rev. A Unlike the cold shutdown mode, normal means of core temperature indication and RCS level indication may not be available in the refueling mode. Redundant means of reactor vessel level indication are therefore procedurally installed to assure that the ability to monitor level will not be interrupted. However, if all level and temperature indication were to be lost in either the cold shutdown of refueling modes, EAL 2 would result in declaration of a Unusual Event if either temperature or level indication cannot be restored within 15 minutes from the loss of both means of indication. Escalation to Alert would be via CA2 based on an inventory loss or CA4 based on exceeding its temperature criteria.

The STED/SED must remain attentive to events or conditions that lead to the conclusion that exceeding the EAL threshold is imminent. If, in the judgment of the STED/SED, an imminent situation is at hand, the classification should be made as if the threshold has been exceeded.

Expanded basis for these assumptions is provided in Appendix C.

Page 41 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT Fuel clad degradation Operating Mode Applicability: 5 Emergency Action Levels:

1. Reactor coolant sample activity value > LCO for Technical Specification 3/4.4.8.

Basis:

This IC is included as a Unusual Event because it is considered to be a potential degradation in the level of safety of the plant and a potential precursor of more serious problems.

Page 42 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT UNPLANNED loss of all onsite or offsite communications capabilities Operating Mode Applicability: 5 and 6 Emergency Action Levels:

1. Loss of all of the following onsite communications capabilities affecting the ability to perform routine operations.

Telephones

Gai-Tronics

Plant Radio System OR

2. Loss of all of the following offsite communications capabilities.

" Nuclear Alert System (NAS)

" Backup NAS (Zetron/Nextel unit)

" Emergency Notification System (ENS)

" Telephones Basis:

The purpose of this IC and its associated EALs is to recognize a loss of communications capability that either defeats the plant operations staff ability to perform routine tasks necessary for plant operations or the ability to communicate problems with offsite authorities. The loss of offsite communications ability is expected to be significantly more comprehensive than the condition addressed by 10 CFR 50.72.

The availability of one method of ordinary offsite communications is sufficient to inform state and local authorities of plant problems. This EAL is intended to be used only when extraordinary means (e.g., relaying of information from radio transmissions, individuals being sent to offsite locations, etc.) are being utilized to make communications possible.

The list for onsite communications loss encompasses those systems used for routine plant communications.

The list for offsite communications loss encompasses those systems used for communications with offsite authorities.

Page 43 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT UNPLANNED loss of required DC power for > 15 minutes Operating Mode Applicability: 5 and 6 Emergency Action Levels:

1. UNPLANNED voltage indications of < 105V on both vital DC buses associated with the Protected Train.

Train A- 11A and 11C

TrainB-11Band11D AND

2. 15 minutes has elapsed without a sustained reading of 105V or greater on at least one Protected Train vital DC bus.

Train A- 11Aor 11C

TrainB-11Bor11D Basis:

The purpose of this IC and its associated EALs is to recognize a loss of DC power compromising the ability to monitor and control the removal of decay heat during Cold Shutdown or Refueling operations. This EAL is intended to be anticipatory in as much as the operating crew may not have necessary indication and control of equipment needed to respond to the loss.

UNPLANNED is included in this IC and EAL to preclude the declaration of an emergency as a result of planned maintenance activities. Routinely plants will perform maintenance on a Train related basis during shutdown periods. It is intended that the loss of the operating (operable) train is to be considered. If this loss results in the inability to maintain cold shutdown, the escalation to an Alert will be per CA4.

Per DBD-ED-05, the DC bus voltage range within which the 125 Volt DC system is considered operable is 105 volts minimum to 140 volts maximum. The vital DC Buses (Switchgear) are SWG-1 1A and 11 C for Train A and SWG-1 1B and 11D for Train B.

Reference:

UFSAR Section 8.3.2, DC Power System Procedure OS1248.01, Loss of a Vital 125 VDC Bus Procedure VPRO F5278, Loss of All Vital DC Power DBD-ED-05, 125 VDC System Page 44 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT Inadvertent criticality Operating Mode Applicability: 5 and 6 Emergency Action Level:

1. An UNPLANNED sustained positive startup rate observed on nuclear instrumentation.

Basis:

This IC addresses criticality events that occur in Cold Shutdown or Refueling modes (NUREG 1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States) such as fuel mis-loading events and inadvertent dilution events. This IC indicates a potential degradation of the level of safety of the plant, warranting an Unusual Event classification. This IC excludes inadvertent criticalities that occur during planned reactivity changes associated with reactor startups (e.g., criticality earlier than estimated) which are addressed in the companion IC SU8.

This condition can be identified using the startup rate monitor. The term "sustained" is used in order to allow exclusion of expected short-term positive startup rates from planned fuel bundle or control rod movements during core alterations. These short-term positive startup rates are the result of the increase in neutron population due to subcritical multiplication.

Escalation would be by STED/SED Judgment.

Page 45 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- ALERT Loss of RCS inventory Operating Mode Applicability: 5 Emergency Action Levels:

1. Loss of RCS inventory as indicated by RVLIS full range < 64%.

OR

2. a. RCS level cannot be monitored for > 15 minutes.

AND

b. RCS inventory loss is indicated by unexplained sump and/or tank level increases.

Basis:

These EALs serve as precursors to a loss of ability to adequately cool the fuel. The magnitude of this loss of water indicates that makeup systems have not been effective and may not be capable of preventing further reactor vessel level decrease and potential core uncovery. This condition will result in a minimum classification of Alert.

The RVLIS value was calculated in EPCALC-06-04; refer to SEP# 2006021, dated May 8, 2006. Outside of RVLIS, station instrumentation limits valid RCS level indication in Mode 5 to

-95". This is approximately 5" above the bottom of the hot legs. Levels below -95" cannot be monitored and meet the intent of EAL #2.a.

In cold shutdown the decay heat available to raise RCS temperature during a loss of inventory or heat removal event may be significantly greater than in the refueling mode. Entry into cold shutdown conditions may be attained within hours of operating at power or hours after refueling is completed. Entry into the refueling mode procedurally may not occur for 80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months or longer (per Technical Specifications) after the reactor has been shutdown. Thus the heatup threat and therefore the threat to damaging the fuel clad may be lower for events that occur in the refueling mode with irradiated fuel in the reactor vessel (note that the heatup threat could be lower for cold shutdown conditions if the entry into cold shutdown was following a refueling).

The above forms the basis for needing both a cold shutdown specific IC (CA1) and a refueling specific IC (CA2).

Page 46 10/17/07

EALDBD Rev. A In the cold shutdown mode, normal RCS level and reactor vessel level instrumentation systems will normally be available. However, if all level indication were to be lost during a loss of RCS inventory event, the operators would need to determine that reactor vessel inventory loss was occurring by observing sump and tank level changes. Sump and tank level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS leakage. The 15-minute duration for the loss of level indication was chosen because it is half of the CS1 Site Area Emergency EAL duration.

The 15-minute duration allows CA1 to be an effective precursor to CS1. Significant fuel damage is not expected to occur until the core has been uncovered for greater than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per the analysis referenced in the CG1 basis. Therefore this EAL meets the definition for an Alert emergency.

The difference between CA1 and CA2 deals with the RCS conditions that exist between cold shutdown and refueling mode applicability. In cold shutdown the RCS will normally be intact and standard RCS inventory and level monitoring means are available. In the refueling mode the RCS is not intact and reactor vessel level and inventory are monitored by different means.

If reactor vessel level continues to decrease then escalation to Site Area will be via CSI.

Expanded basis for these assumptions is provided in Appendix C.

Page 47 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- ALERT Loss of reactor vessel inventory with irradiated fuel in the reactor vessel Operating Mode Applicability: 6 Emergency Action Levels:

1. Reactor vessel level cannot be monitored for > 15 minutes.

AND

2. Reactor vessel inventory loss is indicated by unexplained sump and/or tank level increases.

AND

3. Irradiated fuel in the reactor vessel.

Basis:

These EALs serve as precursors to a loss of heat removal. The magnitude of this loss of water indicates that makeup systems have not been effective and may not be capable of preventing further reactor vessel level decrease and potential core uncovery. This condition will result in a minimum classification of Alert.

Station instrumentation limits valid RCS level indication in Mode 6 to -95". This is approximately 5" above the bottom of the hot legs. Levels below -95" cannot be monitored and meet the intent of EAL #1.

In cold shutdown the decay heat available to raise RCS temperature during a loss of inventory or heat removal event may be significantly greater than in the refueling mode. Entry into cold shutdown conditions may be attained within hours of operating at power or hours after refueling is completed. Entry into the refueling mode procedurally may not occur for 80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months or longer (per Technical Specifications) after the reactor has been shutdown. Thus the heatup threat and therefore the threat to damaging the fuel clad may be lower for events that occur in the refueling mode with irradiated fuel in the reactor vessel (note that the heatup threat could be lower for cold shutdown conditions if the entry into cold shutdown was following a refueling).

The above forms the basis for needing both a cold shutdown specific IC (CA1) and a refueling specific IC (CA2).

Page 48 10/17/07

EALDBD Rev. A In the refueling mode, normal means of reactor vessel level indication may not be available.

Redundant means of reactor vessel level indication will be normally installed (including the ability to monitor level visually) to assure that the ability to monitor level will not be interrupted.

However, if all level indication were to be lost during a loss of RCS inventory event, the operators would need to determine that reactor vessel inventory loss was occurring by observing sump and tank level changes. Sump and tank level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS leakage. The 15-minute duration for the loss of level indication was chosen because it is half of the CS2 Site Area Emergency EAL duration.

The 15-minute duration allows CA2 to be an effective precursor to CS2. Significant fuel damage is not expected to occur until the core has been uncovered for greater than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per the

analysis referenced in the CG1 basis. Therefore this EAL meets the definition for an Alert.

The difference between CA1 and CA2 deals with the RCS conditions that exist between cold shutdown and refueling mode applicability. In cold shutdown the RCS will normally be intact and standard RCS inventory and level monitoring means are available. In the refueling mode the RCS is not intact and reactor vessel level and inventory are monitored by different means.

If reactor vessel level continues to decrease then escalation to a Site Area Emergency will be via CS2.

Expanded basis for these assumptions is provided in Appendix C.

Page 49 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- ALERT Loss of both AC emergency buses for > 15 minutes Operating Mode Applicability: 5, 6 and Defueled Emergency Action Levels:

1 BOTH AC emergency buses E5 AND E6 are de-energized.

AND

2. 15 minutes has elapsed with BOTH AC emergency buses E5 AND E6 de-energized.

Basis:

Loss of all AC power compromises all plant safety systems, requiring electric power including RHR, ECCS, Containment Heat Removal, Spent Fuel Heat Removal and the Ultimate Heat Sink. When in cold shutdown, refueling, or defueled mode the event can be classified as an Alert, because of the significantly reduced decay heat, lower temperature and pressure, increasing the time to restore one of the emergency buses, relative to that specified for the Site Area Emergency EAL. Escalating to Site Area Emergency IC SS1, if appropriate, is by Abnormal Rad Levels / Radiological Effluent, or STED/SED Judgment ICs. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Consideration should be given to operable loads necessary to remove decay heat or provide Reactor Vessel makeup capability when evaluating loss of AC power to essential buses. Even though an essential bus may be energized, if necessary loads (i.e., loads that if lost would inhibit decay heat removal capability or Reactor Vessel makeup capability) are not operable on the energized bus then the bus should not be considered operable.

1-EDE-SWG-5 (E5) and 1-EDE-SWG-6 (E6) are the 4.16 kV emergency buses for Train A and Train B respectively. These buses supply all safety-related loads (e.g., ECCS equipment).

Refer to UFSAR Section 8.3.1, AC Power Systems, for additional information. Under this Initiating Condition, both trains of safety-related equipment are unavailable, i.e., a station blackout exists.

This Initiating Condition is not met if either Bus E5 or E6 is energized from the Supplemental Emergency Power System (SEPS).

Page 50 10/17/07

EALDBD Rev. A The SEPS primary function is to supply power to one 4.16 kV emergency bus, EDE-SWG-5 (E5) or EDE-SWG-6 (E6), in the event of a loss-of-offsite-power (LOOP) and both EDGs fail to start and load. In addition (SEPS) provides back up power to the emergency buses when one of the emergency diesel generators (EDG) is out of service for up to fourteen days. SEPS can be used when it is anticipated that one of the EDGs will be inoperable for longer than the technical specification allowable outage time (AOT) of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The design of the SEPS is capable of providing the required safety-related loads in the event of a loss of offsite power if both emergency diesel generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (SI, CBS, CVI, Cl, etc.). In addition to providing power to the required loads, the total combined output of the SEPS system can supply either the RHR pump or the SI pump and one set of pressurizer heaters. These design conditions are based on Probabilistic Risk Evaluation (PRA) EE-03-007.

The SEPS consists of two 4.16 kV generators which use diesel fuel engines as the prime mover. The generator sets (gensets) SEPS-DG-2-A and SEPS-DG-2-B are capable of automatically starting, synchronizing together and energizing the SEPS electrical bus. When SEPS is supplying power and connected to emergency buses E5 or E6, the SEPS DGs can be paralleled with offsite when offsite power is restored.

The use of the SEPS is recognized in the Emergency Operating Procedures.

Reference:

UFSAR Section 8.3.1, AC Power Systems Page 51 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- ALERT Inability to maintain plant in cold shutdown with irradiated fuel in the reactor vessel Operating Mode Applicability: 5 and 6 Emergency Action Levels:

1. a. An UNPLANNED event results in RCS temperature > 2000 F.

AND

b. Containment integrity is not established as tracked by Procedure OS1 056.03, Containment Penetrations.

AND

c. The RCS is not intact.

OR

2. a. An UNPLANNED event results in RCS temperature > 2000 F for > 20 minutes'.

AND

b. Containment integrity is established as tracked by Procedure OS1056.03,

'Containment Penetrations.

AND (c or d)

c. The RCS is not intact.

OR

d. Reactor vessel level is < -36".

OR

3. An UNPLANNED event results in RCS temperature > 2000 F for > 60 minutes'.

OR

4. An UNPLANNED event results in an RCS pressure increase of > 10 psig.

Page 52 10/17/07

EALDBD Rev. A Note 1: if an RCS heat removal system is in operation within this time frame and RCS temperature is being reduced then this EAL is not applicable.

Basis:

EAL 1 addresses complete loss of functions required for core cooling during refueling and cold shutdown modes when neither CONTAINMENT CLOSURE nor RCS integrity are established.

RCS integrity is in place when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). No delay time is allowed for EAL1 because the evaporated reactor coolant that may be released into the Containment during this heatup condition could also be directly released to the environment.

Per Technical Specifications, Cold Shutdown temperature limit is 2000 F.

EAL 2 addresses the complete loss of functions required for core cooling for > 20 minutes during refueling and cold shutdown modes when CONTAINMENT CLOSURE is established but RCS integrity is not established or RCS inventory is reduced (e.g., mid loop operation in PWRs). As in EAL 1, RCS integrity should be assumed to be in place when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). The allowed 20 minute time frame was included to allow operator action to restore the heat removal function, if possible. The allowed time frame is consistent with the guidance provided by Generic Letter 88-17, "Loss of Decay Heat Removal" (discussed later in this basis) and is believed to be conservative given that a low pressure Containment barrier to fission product release is established. Note 1 indicates that EAL 2 is not applicable if actions are successful in restoring an RCS heat removal system to operation and RCS temperature is being reduced within the 20 minute time frame.

Per Procedure OS1000.12, Operation With RCS At Reduced Inventory/Midloop Conditions, the RCS is considered to be at "reduced inventory" when reactor vessel level is -36".

EALs 3 and 4 address complete loss of functions required for core cooling for > 60 minutes during refueling and cold shutdown modes when RCS integrity is established. As in EAL 1 and 2, RCS integrity should be considered to be in place when the RCS pressure boundary is in its normal condition for the cold shutdown mode of operation (e.g., no freeze seals or nozzle dams). The status of CONTAINMENT CLOSURE in this EAL is immaterial given that the RCS is providing a high pressure barrier to fission product release to the environment. The 60 minute time frame should allow sufficient time to restore cooling without there being a substantial degradation in plant safety. The pressure increase covers situations where, due to high decay heat loads, the time provided to restore temperature control, should be less than 60 minutes. Note 1 indicates that EAL 3 is not applicable if actions are successful in restoring an RCS heat removal system to operation and RCS temperature is being reduced within the 60 minute time frame assuming that the RCS pressure increase has remained less than the site specific pressure value.

Escalation to Site Area would be via CS1 or CS2 should boiling result in significant reactor vessel level loss leading to core uncovery.

Page 53 10/17/07

EALDBD Rev. A This IC and its associated EALs are based on concerns raised by Generic Letter 88-17, "Loss of Decay Heat Removal." A number of phenomena such as pressurization, vortexing, steam generator U-tube draining, RCS level differences when operating at a mid-loop condition, decay heat removal system design, and level instrumentation problems can lead to conditions where decay heat removal is lost and core uncovery can occur. NRC analyses show that sequences that can cause core uncovery in 15 to 20 minutes and severe core damage within an hour after decay heat removal is lost.

A loss of Technical Specification components alone is not intended to constitute an Alert. The same is true of a momentary UNPLANNED excursion above 2000 F when the heat removal function is available.

The STED/SED must remain alert to events or conditions that lead to the conclusion that exceeding the EAL threshold is imminent. If, in the judgment of the STED/SED, an imminent situation is at hand, the classification should be made as if the threshold has been exceeded.

Expanded basis for these assumptions is provided in Appendix C.

Page 54 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- SITE AREA EMERGENCY Loss of RCS inventory affecting core decay heat removal capability Operating Mode Applicability: 5 Emergency Action Levels:

1. a. Reactor vessel level cannot be monitored for > 30 minutes.

AND

b. Loss of reactor coolant inventory as indicated by unexplained sump and/or tank level increases, or erratic source range monitor indication.

OR

2. a. RVLIS Full Range < 63%

AND

b. Containment integrity is not established as tracked by Procedure OS1056.03, Containment Penetrations.

OR

3. a. RVLIS Full Range < 55%

AND

b. Containment integrity is established as tracked by Procedure OS1056.03, Containment Penetrations.

Basis:

Under the conditions specified by this IC, continued decrease in reactor vessel level is indicative of a loss of inventory control. Inventory loss may be due to an reactor vessel breach, pressure boundary leakage, or continued boiling in the reactor vessel.

The RVLIS values were calculated in EPCALC-06-04; refer to SEP# 2006021, dated May 8, 2006. Outside of RVLIS, station instrumentation limits valid RCS level indication in Mode 5 to

-95". This is approximately 5" above the bottom of the hot legs. Levels below -95" cannot be monitored and meet the intent of EAL #1 .a.

Page 55 10/17/07

EALDBD Rev. A In cold shutdown the decay heat available to raise RCS temperature during a loss of inventory or heat removal event may be significantly greater than in the refueling mode. Entry into cold shutdown conditions may be attained within hours of operating at power or hours after refueling is completed. Entry into the refueling mode procedurally may not occur for 80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months or longer

{per Technical Specifications) after the reactor has been shutdown. Thus the heatup threat and therefore the threat to damaging the fuel clad may be lower for events that occur in the refueling mode with irradiated fuel in the reactor vessel (note that the heatup threat could be lower for cold shutdown conditions if the entry into cold shutdown was following a refueling).

The above forms the basis for needing both a cold shutdown specific IC (CS1) and a refueling specific IC (CS2).

In the cold shutdown mode, normal RCS level and reactor vessel level indication systems (RVLIS) will normally be available. However, if all level indication were to be lost during a loss of RCS inventory event, the operators would need to determine that reactor vessel inventory loss was occurring by observing sump and tank level changes. Sump and tank level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS leakage.

The 30-minute duration allows sufficient time for actions to be performed to recover needed cooling equipment and is considered to be conservative given that level is being monitored via CS1 and CS2. An effluent release is not expected with closure established.

Thus, declaration of a Site Area Emergency is warranted under the conditions specified by the IC. Escalation to a General Emergency is via CGlor radiological effluent IC AG1.

Expanded basis for these assumptions is provided in Appendix C.

Reference:

OS1000.09, Refueling Operation OS1000.12, Operation With RCS At Reduced Inventory/Midloop Conditions Page 56 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- SITE AREA EMERGENCY Loss of reactor vessel inventory affecting core decay heat removal capability with irradiated fuel in the reactor vessel Operating Mode Applicability: 6 Emergency Action Levels:

1. Reactor vessel level cannot be monitored.

AND

2. Irradiated fuel in the reactor vessel is uncovered as indicated by any combination of the following:

RM-6535A-1 (Manipulator Crane) off-scale high

RM-6535B-1 (Manipulator Crane) off-scale high

Erratic source range monitor readings

" Visual observation (e.g., closed circuit TV)

AND

3. Containment integrity is established as tracked by Procedure OS1056.03, Containment Penetrations.

Basis:

Under the conditions specified by this IC, continued decrease in reactor vessel level is indicative of a loss of inventory control. Inventory loss may be due to an reactor vessel breach or continued boiling in the reactor vessel.

Station instrumentation limits valid reactor vessel level indication in Mode 6 to -95". This is approximately 5" above the bottom of the hot legs. Levels below -95" cannot be monitored and meet the intent of EAL #1.

In cold shutdown the decay heat available to raise RCS temperature during a loss of inventory or heat removal event may be significantly greater than in the refueling mode entry into cold shutdown conditions may be attained within hours of operating at power or hours after refueling is completed. Entry into the refueling mode procedurally may not occur for 80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months or longer (per Technical Specifications) after the reactor has been shutdown. Thus the heatup threat and therefore the threat to damaging the fuel clad may be lower for events that occur in the refueling mode with irradiated fuel in the reactor vessel (note that the heatup threat could be lower for cold shutdown conditions if the entry into cold shutdown was following a refueling).

The above forms the basis for needing both a cold shutdown specific IC (CS1) and a refueling specific IC (CS2).

Page 57 10/17/07

EALDBD Rev. A As water level in the reactor vessel lowers, the dose rate above the core will increase. The dose rate due to this core shine will result in off-scale high readings on the Containment Manipulator Crane radiation monitors. Additionally, post-TMI studies indicated that the installed nuclear instrumentation will operate erratically when the core is uncovered and that this should be used as a tool for making such determinations.

An radiological release is not expected with containment integrity established.

Thus, declaration of a Site Area Emergency is warranted under the conditions specified by the IC. Escalation to a General Emergency is via CG1 or radiological effluent IC AG1.

Expanded basis for these assumptions is provided in Appendix C.

Page 58 10/17/07

EALDBD Rev. A SYSTEM MALFUNCTION Initiating Condition -- GENERAL EMERGENCY Loss of RCS or reactor vessel inventory with irradiated fuel in the reactor vessel AND containment challenged Operating Mode Applicability: 5 and 6 Emergency Action Levels:

1. Loss of reactor vessel inventory as indicated by unexplained sump and/or tank level increase.

AND

2. a. RVLIS Full Range < 55% for > 30 minutes.

OR

b. Reactor vessel level cannot be monitored with indication of core uncovery for > 30 minutes as evidenced by any combination of the following:

RM-6535A-1 (Manipulator Crane) off-scale high

RM-6535B-1 (Manipulator Crane) off-scale high

Erratic source range monitor readings

Visual observation (e.g., closed circuit TV)

AND

3. CONTAINMENT integrity is challenged as indicated by one or more of the following:

Containment integrity is not established as tracked by Procedure OS1056.03, Containment Penetrations

Containment pressure > 52 psig

Containment H2 concentration > 6%

Basis:

For EAL 1 in the cold shutdown mode, normal RCS level and reactor vessel level instrumentation systems will normally be available. However, if all level indication were to be lost during a loss of RCS inventory event, the operators would need to determine that reactor vessel inventory loss was occurring by observing sump and tank level changes. Sump and tank level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS leakage.

Page 59 10/17/07

EALDBD Rev. A For EAL 1 in the refueling mode, normal means of reactor vessel level indication may not be available. Redundant means of reactor vessel level indication will be normally installed (including the ability to monitor level visually) to assure that the ability to monitor level will not be interrupted. However, if all level indication were to be lost during a loss of RCS inventory event, the operators would need to determine that reactor vessel inventory loss was occurring by observing sump and tank level changes. For both cold shutdown and refueling modes sump and tank level increases must be evaluated against other potential sources of leakage such as cooling water sources inside the containment to ensure they are indicative of RCS leakage.

EAL 2 represents the inability to restore and maintain reactor vessel level to above the top of active fuel. Fuel damage is probable if reactor vessel level cannot be restored, as available decay heat will cause boiling, further reducing the reactor vessel level.

The RVLIS value was calculated in EPCALC-06-04; refer to SEP# 2006021, dated May 8, 2006. Outside of RVLIS, station instrumentation limits valid reactor vessel level indication in Modes 5 and 6 to -95". This is approximately 5" above the bottom of the hot legs. Levels below -95" cannot be monitored and meet the intent of EAL #2.b.

These example EALs are based on concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal, SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues, NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States, and, NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. A number of variables, (e.g., mid-loop, reduced level/flange level, head in place, or cavity flooded, RCS venting strategy, decay heat removal system design, vortexing pre-disposition, steam generator U-tube draining) can have a significant impact on heat removal capability challenging the fuel clad barrier. Analysis in the above references indicates that core damage may occur within an hour following continued core uncovery therefore, conservatively, 30 minutes was chosen.

The GE is declared on the occurrence of the loss or imminent loss of function of all three barriers. Based on the above discussion, RCS barrier failure resulting in core uncovery for 30 minutes or more may cause fuel clad failure. With the CONTAINMENT breached or challenged then the potential for unmonitored fission product release to the environment is high. This represents a direct path for radioactive inventory to be released to the environment. This is consistent with the definition of a GE.

In the early stages of a core uncovery event, it is unlikely that hydrogen buildup due to a core uncovery could result in an explosive mixture of dissolved gasses in CONTAINMENT.

However, CONTAINMENT monitoring and/or sampling should be performed to verify this assumption and a General Emergency declared if it is determined that an explosive mixture exists.

Expanded basis for these assumptions is provided in Appendix C.

Reference:

Severe Accident Computational Aid CA-3, Hydrogen Flammability in Containment UFSAR Section 3.8.1.3 Page 60 10/17/07

EALDBD Rev. A INITIATING CONDITION MATRIX Recognition Category E Events Related to ISFSI Malfunction Events Related to ISFSIlMalfunction E-HU1 Damage to a loaded cask CONFINEMENT BOUNDARY Op. Mode: All Page 61 10/17/07

EVENTS RELATED TO ISFSI Initiating Condition -- UNUSUAL EVENT Damage to a loaded cask CONFINEMENT BOUNDARY Operating Mode Applicability: All Emergency Action Level:

1. Any indication that the CONFINEMENT BOUNDARY of a loaded dry cask storage container has been lost.

Basis:

An Unusual Event in this IC is categorized on the basis of the occurrence of an event of sufficient magnitude that a loaded cask CONFINEMENT BOUNDARY is damaged or violated.

This includes classification based on a loaded fuel storage cask CONFINEMENT BOUNDARY loss leading to the degradation of the fuel during storage or posing an operational safety problem with respect to its removal from storage.

Page 62 10/17/07

INITIATING CONDITION MATRIX Recognition Category F Fission Product Barrier Degradation ALERT ANY Loss or ANY Potential Loss or Potential Loss of Loss of ANY Iwo Baamers Loss of EITHER Fuel Clad ANY Two Barriers AND Loss or Potential Loss i OR RCS Barriers of Third Barrier OD.

f Modes: 1. 2. 3 and 4 t

Oo. Modes: 1. 2. 3 and 4 i - i Op. Modes: 1, 2, 3 and 4 NOTES

1. The logic used for these initiating conditions reflects the following considerations:

The Fuel Clad Barrier and the RCS Barrier are weighted more heavily than the Containment Barrier. Unusual Event ICs associated with RCS and Fuel Clad Barriers are addressed under System Malfunction ICs.

At the Site Area Emergency level, there must be some ability to dynamically assess how far present conditions are from the threshold for a General Emergency. For example,. if Fuel Clad and RCS Barrier "Loss" EALs existed, that, in addition to offsite dose assessments, would require continual assessments of radioactive inventory and containment integrity. Alternatively, if both Fuel Clad and RCS Barrier "Potential Loss" EALs existed, the STED/SED would have more assurance that there was no immediate need to escalate to a General Emergency.

The ability to escalate to higher emergency classes as an event deteriorates must bemaintained. For example, RCS leakage steadily increasing would represent an increasing risk to public health and safety.

2. Fission Product Barrier ICs must be capable of addressing event dynamics. An imminent (i.e., within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ) Loss or Potential Loss should result in a classification as if the affected threshold(s) are already exceeded, particularly for the higher emergency classes.

Page 63 10/17/07

FISSION PRODUCT BARRIER DEGRADATION MATRIX Modes 1, 2, 3 and 4 Fuel Clad Barrier Reactor Coolant System Barrier Containment Barrier Sub-Category Potential Loss Loss Potential Loss Loss Potential Loss Loss Core Cooling Orange Red (wIRCS press> 300 psig)

RCS Integrity 1.CSF Status OR Core CoolingRed OR Containment Red Emergency Coolant Recirculation Orange SHeat SinkRed HeatSinkRed

1. a.CoreExitTCs l,100"FF..

AND ,:.

b. FR-C. 1 noteffective within15minutes..

2. Core ExitTCs Core ExitTCs 2:7250 F Core ExitTCs a 1,1000F 2. a.Core ExitTCsD - 725'FF AND b.RVtIS tollrange level540%

AND. . . .-,

c.FR-C.1 noteffective within15minutes.

RVLIS dynamic head

044% with4RCPs running 030%

5 with 3RCPs running 3.Reactor Vessel Level 5 20%with2RCPsrunning

013% with1RCPrunning, or RVILS fullrange level 040%

5 withnoRCPrunning RCSactivity > 300uCdgm DoseEqurvalent 4.RCSActivity 1-131(asdetermined perProcedure SCS0925.ot, Reactor CoolantPostAccident

_____________________ ~~~~~Sampling)____________________

Unisolableleak > thecapacity of one

5. RCSLeakage centitgal ch'argingpump inthenormal RCSsubcooling <401F duetoanRCSleak 44%wth4RCs chargini mode

1. RUPTURED SIGisalsoFAULTED outside of containment EntryintoProcedure E-3 OR 6.SC Rupture or Fault 2. Pnrmaryeto-Secondary leakrate> 10gpm withnonisolable steam release from Saffected SIG totheenvironment

1. Cnmt. pressure'> 52psigandincreasing OR 1. Rapid unexplained pressure decrease

2. Cnmt. hydrogen concentration2:6% following initialincrease 7.Containment Pressure SlOR OR

3. a.Crnmt pressure > 18psig 2. Containment pressure response not AND consistent with LOCA conditions

. .. . . ...... .. pti NoCS Building Spray (CBSn

8. Containment PostLOCA Radiation Monitors tost-LOCA Radiation Maondtors Post-LOCA Rudiation Monitors RadiatitonMonitor .~________________ RM-6576A-1 orRM-6576B- 1Ž95 Rlhr RM-076A-1 or RM-6576B3- 1>16 Rfhr RM-6576A-1 or RM-6576B-1 Ž1,305 Pthr _________________

Isolation Isolation G......nmt. Valve(s) notclosed ANDdire.ct

9. Containment Valves .spathway o the environment existsafterCarot iga intheopinion condition of theSTED/SEsoaio Ayoclbnithopno th TDSDAny of theSTEDISEDthatindicates AnnyconditionintheopopinoonftheheTED/SEI)

D/Ethatindic aPotential 0e Anycondition LessoftheFuelClad intheoiinfhSElE Anyconditioninthe opinionsoftheSTEDlSED Anycondition in theopinion a Potential Lossofthe condicatio

.an i topn ofthe SontaneD/

10.STEDaD nofithetFuelitCladnneramera thatmetindirert(cosioss PotenlaialrrLosshaofntheteRCaSothatilindicatesheRCS thatctindicostesftae tatsindcatRsS tthatS Bosser t thesiContainment indicatestaiamLossariof (consider tomonitor inability barrer). Bamrer(consider inability tomonitor bamier). (considerinability to monitor barrier). monitorharrier). Brir(osdriaiiyt oio are)

Barrier Status Fuel Clad Potential Loss Enter/

Fuel Clad Loss Enter/

RCS Potential Loss : EnterV RCS Loss S Enter 6

Containment Potential Loss Enter Containment Loss Enter Page 64 10/17/07

FISSION PRODUCT BARRIER DEGRADATION MATRIX Modes 1, 2, 3 and 4 Emergency agassi*iaýtn LIElerrt E*IIE AM. Alert Enter a checkmark in all the blanks to the dght for each "Potential Loss" or "Loss" noted above. When all checkmarks have been entered, note each column that has all blanks checked. Read up or down that column to determine the emergency classification.

Page 65 10/17/07

Basis Information for Recognition Category F Fission Product Barrier Degradation FUEL CLAD BARRIER EALs:

The Fuel Clad Barrier is the zircalloy tubes that contain the fuel pellets.

1. Sub-Category: CSF Status A RED path indicates an extreme challenge to a safety function. An ORANGE path indicates a severe challenge to a safety function.

" A Core Cooling (C) ORANGE path indicates that the core cooling function is under severe challenge and that some clad damage may occur. This condition represents a "Potential Loss" of the Fuel Clad Barrier.

" A Heat Sink (H) RED path indicates that the heat sink function is under extreme challenge, a precursor to cladding damage. This condition represents a "Potential Loss" of the Fuel Clad Barrier.

" A Core Cooling (C) RED path indicates that the core cooling function is under extreme challenge, and that most or all liquid inventory has been lost from the RCS (and that steam in the core is superheated). This condition represents a "Loss" of the Fuel Clad Barrier.

2. Sub-Category: Core Exit TCs The "Potential Loss" EAL reading of 7250 F reflects the value from the Core Cooling ORANGE path EAL. The conditions leading to an ORANGE path (core exit thermocouple and reactor vessel level values) indicate that some clad damage may occur.

The "Loss" EAL reading of 1,1000 F reflects the value from the Core Cooling RED path EAL. This temperature indicates that most or all liquid inventory has been lost from the RCS (and that steam in the core is superheated).

Reference:

CSFST F-0.2, Core Cooling (C)

3. Sub-Category: Reactor Vessel Level The "Potential Loss" EAL is defined by the Core Cooling - ORANGE path. The values in this EAL are consistent with the CSFST values.

" RVLIS dynamic head < 44% with 4 Reactor Coolant Pumps running

" RVLIS dynamic head 5 30% with 3 Reactor Coolant Pumps running

" RVLIS dynamic head 5 20% with 2 Reactor Coolant Pumps running

" RVLIS dynamic head 5 13% with 1 Reactor Coolant Pump running

" RVLIS full range level 5 40% with no Reactor Coolant System Pump running There is no "Loss" EAL corresponding to this item because it is better covered by the other Fuel Clad Barrier "Loss" EALs.

Reference:

CSFST F-0.2, Core Cooling (C)

Page 66 10/17/07

Basis Information for Recognition Category F Fission Product Barrier Degradation

4. Sub-Category: RCS Activity There is no "Potential Loss" EAL for this item.

This "Loss" EAL uses the value of 300 liCi/gm 1131 dose equivalent (DEI-131).

Assessment by the NEI/NUMARC EAL Task Force indicates that this amount of coolant activity is well above that expected for iodine spikes and corresponds to less than 5%

fuel clad damage. This amount of radioactivity indicates significant clad damage and thus the Fuel Clad Barrier is considered lost. The DEl-1 31 activity value for an RCS sample is determined through implementation of Procedure CS0925.01, Reactor Coolant Post Accident Sampling.

5. Sub-Category: RCS Leakage Not applicable.

6. Sub-Category: S/G Rupture or Fault Not applicable.

7. Sub-Category: Containment Pressure Not applicable.

8. Sub-Category: Containment Radiation Monitor There is no "Potential Loss" EAL associated with this item.

The specified reading indicates the release of reactor coolant, with elevated activity indicative of fuel damage, into the containment. The reading was calculated assuming the instantaneous release and dispersal of the reactor coolant noble gas and iodine inventory associated with a concentration of 300 VtCi/gm dose equivalent 1-131 into the containment atmosphere. Reactor coolant concentrations of this magnitude are several times larger than the maximum concentrations (including iodine spiking) allowed within technical specifications and are therefore indicative of fuel damage. The specified value is higher than the Containment Radiation Monitor reading used for the RCS barrier Loss EAL. Thus, this EAL indicates a loss of both the fuel clad barrier and a loss of RCS barrier. Refer to SEP #2006012 for EPCALC-06-01.

9. Sub-Category: Containment Isolation Valves Not applicable.

Page 67 10/17/07

Basis Information for Recognition Category F Fission Product Barrier Degradation

10. Sub-Category: STED/SED Judgment This EAL addresses any other factors that are to be used by the STED/SED in determining whether the Fuel Clad barrier is lost or potentially lost. In addition, the inability to monitor the barrier should also be incorporated in this EAL as a factor in STED/SED judgment that the barrier may be considered lost or potentially lost. (See IC SG1 for additional information.)

Page 68 10/17/07

Basis Information for Recognition Category F Fission Product Barrier Degradation RCS BARRIER EALs:

The RCS Barrier includes the RCS primary side and its connections up to and including the pressurizer safety and relief valves, and other connections up to and including the primary isolation valves.

1. Sub-Category: CSF Status A RED path indicates an extreme challenge to a safety function. An ORANGE path indicates a severe challenge to a safety function.

" An RCS Integrity (P) RED path indicates that the RCS integrity function is under severe challenge. This condition represents a "Potential Loss" of the RCS Barrier if RCS pressure is > 300 psig. A P Red with RCS pressure -<300 psig will result in operators exiting Procedure FR-P.1, Response to Imminent Pressurized Thermal Shock Conditions, and returning to procedure and step in effect. The technical basis for this position can be found in Westinghouse Direct Work No. DW-92-032.

" A Heat Sink (H) RED path indicates that the heat sink function is under extreme challenge. This condition represents a "Potential Loss" of the RCS Barrier.

There is no "Loss" EAL associated with this item.

2. Sub-Category: Core Exit TCs Not applicable.

3. Sub-Category: Reactor Vessel Level Not applicable.

4. Sub-Category: RCS Activity Not applicable.

5. Sub-Category: RCS Leakage The "Potential Loss" EAL is based on the inability to maintain normal liquid inventory within the Reactor Coolant System (RCS) by normal operation of the Chemical and Volume Control System which is considered as one centrifugal charging pump discharging to the charging header. A second charging pump being required is indicative of a substantial RCS leak.

The "Loss" EAL addresses conditions where leakage from the RCS is greater than available inventory control capacity such that a loss of subcooling has occurred. The loss of subcooling is the fundamental indication that the inventory control systems are inadequate in maintaining RCS pressure and inventory against the mass loss through the leak.

Page 69 10/17/07

Basis Information for Recognition Category F Fission Product Barrier Degradation

6. Sub-Category: S/G Rupture or Fault There is no "Potential Loss" EAL associated with this item.

The "Loss" EAL addresses RUPTURED SG(s) for which the leakage is large enough to cause actuation of ECCS (SI). This is consistent to the RCS Barrier "Potential Loss" EAL #2. This condition is described by "entry into E-3 required by EOPs". By itself, this EAL will result in the declaration of an Alert. However, if the SG is also FAULTED (i.e.,

two barriers failed), the declaration escalates to a Site Area Emergency per Loss of the Containment Barrier, Sub-Category 6, EAL #1 or #2.

Reference:

Emergency Response Procedure E-3, Steam Generator Tube Rupture

7. Sub-Category: Containment Pressure Not applicable.

8. Sub-Category: Containment Radiation Monitor The specified reading indicates the release of reactor coolant to the containment. The reading was calculated assuming the instantaneous release and dispersal of reactor coolant with activity concentration at Technical Specification operating limits into the containment atmosphere. The specified value is less than the Containment Radiation Monitor reading used for the Fuel Clad Barrier Loss EAL. Thus, this EAL would be indicative of an RCS leak only. If the radiation monitor reading increased to those specified by the Fuel Clad Barrier Loss EAL, fuel damage would also be indicated.

Refer to SEP #2006012 for EPCALC-06-01.

There is no "Potential Loss" EAL associated with this item.

9. Sub-Category: Containment Isolation Valves Not applicable.

10. Sub-Category: STED/SED Judgment This EAL addresses any other factors that are to be used by the STED/SED in determining whether the RCS barrier is lost or potentially lost. In addition, the inability to monitor the barrier should also be incorporated in this EAL as a factor in STED/SED judgment that the barrier may be considered lost or potentially lost. (See also IC SG1 for additional information.)

Page 70 10/17/07

Basis Information for Recognition Category F Fission Product Barrier Degradation CONTAINMENT BARRIER EALs:

The Containment Barrier includes the containment building, its connections up to and including the outermost containment isolation valves. This barrier also includes the main steam, feedwater, and blowdown line extensions outside the containment building up to and including the outermost secondary side isolation valve.

1. Sub-Category: CSF Status A RED path indicates an extreme challenge to a safety function. An ORANGE path indicates a severe challenge to a safety function.

Conditions leading to a Containment (Z) RED path result from RCS barrier and/or Fuel Clad Barrier Loss. Thus, this EAL is primarily a discriminator between Site Area Emergency and General Emergency representing a "Potential Loss" of the third barrier.

Seabrook Station has implemented a CSFST for Emergency Coolant Recirculation (referred to as the F tree). As presented in the F tree, a severe challenge to this safety function occurs when the criterion "RWST and Containment levels in expected region" is not met. If this occurs, the F tree is evaluated as ORANGE. An F ORANGE path is equivalent to the NEI 99-01 generic EAL guidance of containment "sump level response not consistent with LOCA conditions". This condition represents a "Loss" of Containment.

Reference:

CSFST F-0.7, Emergency Recirculation (F)

2. Sub-Category: Core Exit TCs Procedure FR-C.1, Response to Inadequate Core Cooling, addresses the recovery of the core cooling critical safety function. The procedure is considered effective if the core exit thermocouple temperatures are decreasing or if reactor vessel water level is increasing. A direct correlation to the C CSFST can be made if the effectiveness of the restoration procedures is also evaluated as stated below.

Severe accident analyses (e.g., NUREG-1 150) have concluded that function restoration procedures can arrest core degradation within the reactor vessel in a significant fraction of the core damage scenarios, and that the likelihood of containment failure is very small in these events. Given this, it is appropriate to provide a reasonable period to allow function restoration procedures to arrest the core melt sequence. Whether or not the procedures will be effective should be apparent within 15 minutes. The STED/SED should make the declaration as soon as it is determined that the procedures have been, or will be ineffective.

The selected core exit thermocouple temperatures and reactor vessel levels were chosen to be consistent with the Core Cooling Critical Safety Function Status Tree.

Page 71 10/17/07

Basis Information for Recognition Category F Fission Product Barrier Degradation The conditions in this "Potential Loss" EAL represent an imminent core melt sequence which, if not corrected, could lead to vessel failure and an increased potential for containment failure. In conjunction with the Core Cooling (C) and Heat Sink (H) criteria in the Fuel and RCS barrier columns, this EAL would result in the declaration of a General Emergency -- loss of two barriers and the potential loss of a third. If the function restoration procedures are ineffective, there is no "success" path.

There is no "Loss" EAL associated with this item.

Reference:

CSFST F-0.2, Core Cooling (C)

3. Sub-Category: Reactor Vessel Level Not applicable.

4. Sub-Category: RCS Activity Not applicable.

5. Sub-Category: RCS Leakage Not applicable.

6. Sub-Category: S/G Rupture or Fault This "Loss" EAL recognizes that SG tube leakage can represent a bypass of the containment barrier as well as a loss of the RCS barrier. The first "Loss" EAL -addresses the condition in which a RUPTURED steam generator is also FAULTED. This condition represents a bypass of the RCS and containment barriers. In conjunction with RCS Barrier "loss" EAL #3, this would always result in the declaration of a Site Area Emergency.

The second "Loss" EAL addresses SG tube leaks that exceed 10 gpm in conjunction with a nonisolable release path to the environment from the affected steam generator.

The threshold for establishing the nonisolable secondary side release is intended to be a prolonged release of radioactivity from the RUPTURED steam generator directly to the environment. This could be expected to occur when the main condenser is unavailable to accept the contaminated steam (i.e., SGTR with concurrent loss of offsite power and the RUPTURED steam generator is required for plant cooldown or a stuck open relief valve). If the main condenser is available, there may be releases via air ejectors, gland seal exhausters, and other similar controlled, and often monitored, pathways. These pathways do not meet the intent of a nonisolable release path to the environment.

These minor releases are assessed using Abnormal Rad Levels / Radiological Effluent ICs.

Users should realize that the two "Loss" EALs described above could be considered redundant. This was recognized during the development process. The inclusion of an EAL that uses Emergency Operating Procedure terms like "ruptured and faulted" adds Page 72 10/17/07

Basis Information for Recognition Category F Fission Product Barrier Degradation to the ease of the classification process and has been included based on this human factor concern.

A pressure boundary leakage of 10 gpm was used as the threshold in IC SUS, RCS Leakage, and is deemed appropriate for this EAL. For smaller breaks, not exceeding the normal charging capacity threshold in RCS Barrier "Potential Loss" EAL #2 (RCS Leak Rate) or not resulting in ECCS actuation in EAL #3 (SG Tube Rupture), this EAL results in a Unusual Event. For larger breaks, RCS barrier EALs #2 and #3 would result in an Alert. For SG tube ruptures which may involve multiple steam generators or unisolable secondary line breaks, this EAL would exist in conjunction with RCS barrier "Loss" EAL

3 and would result in a Site Area Emergency. Escalation to General Emergency would be based on "Potential Loss" of the Fuel Clad Barrier.

7. Sub-Category: Containment Pressure Rapid unexplained loss of pressure (i.e., not attributable to containment spray or condensation effects) following an initial pressure increase indicates a "Loss" of containment integrity. Containment pressure and sump levels should increase as a result of the mass and energy release into containment from a LOCA. Thus, sump level or pressure not increasing indicates containment bypass and a "Loss" of containment integrity. Sump level responses are evaluated under the "CSF Status" Sub-Category (see F Orange).

For the "Potential Loss" EALs:

The value of 52 PSIG is based on the containment design pressure.

A hydrogen concentration of 6% or more within Containment will sustain a global burn.

The third EAL represents a potential loss of containment in that containment pressure is greater than the Containment Building Spray (CBS) actuation setpoint of 18 psig; however, neither CBS train is functioning. The primary method of containment pressure control and heat removal is lost.

Reference:

UFSAR Section 3.8.1.3 Technical Specification 3/4.3, Instrumentation (see Table 3.3-4)

Severe Accident Computational Aid CA-3, Hydrogen Flammability in Containment

8. Sub-Category: Containment Radiation Monitor The specific reading indicates significant fuel damage well in excess of the EALs associated with both loss of Fuel Clad and loss of RCS Barriers. A major release of radioactivity requiring offsite protective actions from core damage is not possible unless a major failure of fuel cladding allows radioactive material to be released from the core into the reactor coolant.

Regardless of whether containment is challenged, this amount of activity in containment, if released, could have such severe consequences that it is prudent to treat this as a potential loss of containment, such that a General Emergency declaration is warranted.

Page 73 10/17/07

Basis Information for Recognition Category F Fission Product Barrier Degradation NUREG-1228, "Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents," indicates that such conditions do not exist when the amount of clad damage is less than 20%. The radiation monitor reading corresponds to 20% fuel clad damage. Refer to SEP #2006012 for EPCALC-06-01.

There is no "Loss" EAL associated with this item.

9. Sub-Category: Containment Isolation Valves This EAL is intended to address incomplete containment isolation that allows direct release to the environment. It represents a "Loss" of the containment barrier.

There is no "Potential Loss" EAL associated with this item.

10. Sub-Category: STED/SED Judgment This EAL addresses any other factors that are to be used by the STED/SED in determining whether the Containment barrier is lost or potentially lost. In addition, the inability to monitor the barrier should also be incorporated in this EAL as a factor in STED/SED judgment that the barrier may be considered lost or potentially lost. (See also IC SG1 for additional information.)

Page 74 10/17/07

INITIATING CONDITION MATRIX Recognition Category H Hazards and Other Conditions Affecting Plant Safety kisaind Other-Conditions Affec Ilant Safety Natural and destructive Natural and destructive phenomena affecting the phenomena affecting the plant PROTECTED AREA VITAL AREA Op. Modes: All Op. Modes: All FIRE within PROTECTED AREA FIRE or EXPLOSION affecting the boundary not extinguished within operability of plant safety systems 15 minutes of detection required to establish or maintain Op. Modes: All safe shutdown Op. Modes: All Release of toxic, corrosive, Release of a toxic, corrosive, asphyxiant or flammable gases asphyxiant or flammable gas within deemed detrimental to normal or contiguous to a VITAL AREA operation of the plant affecting equipment required to Op. Modes: All maintain safe operations, or establish or maintain safe shutdown Op. Modes: All Confirmed security event which Confirmed security event in a plant indicates a potential degradation PROTECTED AREA in the level of safety of the plant Op. Modes: All Op. Modes: All Notification of HOSTILE ACTION Notification of HOSTILE ACTION Security event resulting in loss within the OCA within the PROTECTED AREA of physical control of the facility Op. Modes: All Op. Modes: All Op. Modes: All Notification of an airbome attack threat Op. Modes: All Control Room evacuation has Control Room evacuation has been initiated been initiated and plant control Op. Modes: All cannot be established Op. Modes: All Other conditions existing which Other conditions existing which in Other conditions existing which Other conditions existing which in the judgment of the the judgment of the STED/SED in the judgment of the in the judgment of the STED/SED warrant declaration warrant declaration of an Alert STED/SED warrant declaration STED/SED warrant declaration of an Unusual Event Op. Modes: All of Site Area Emergency of General Emergency Op. Modes: All Op. Modes: All Op. Modes: All Page 75 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- UNUSUAL EVENT Natural and destructive phenomena affecting the PROTECTED AREA Operating Mode Applicability: All Emergency Action Level:

1 a. Vibratory ground motion is felt and recognized as an earthquake based on a consensus of control room operators on duty at the time.

OR

b. Vibratory ground motion detected by seismic monitoring instrumentation is validated as an earthquake.

1) The yellow "EVENT" light is lit on seismic monitoring control panel 1-SM-CP-58.

AND

2) The occurrence of an earthquake is confirmed with the National Earthquake Information Center (or other source deemed reliable by the Shift Manager).

OR

2. a. Report by plant personnel of tornado within PROTECTED AREA boundary.

OR

b. Winds speeds > 100 mph as indicated by site meteorological instrumentation (or other source deemed reliable by the Shift Manager).

OR

3. Vehicle crash that causes VISIBLE DAMAGE to plant structures within PROTECTED AREA boundary that contain functions and systems required for safe shutdown of the plant.

OR

4. Report by plant personnel of an unanticipated EXPLOSION within PROTECTED AREA boundary resulting in VISIBLE DAMAGE to permanent structure or equipment.

OR Page 76 10/17/07

5. Report of main turbine rotating component failure resulting in VISIBLE DAMAGE to the turbine casing or to the generator seals.

OR

6. Uncontrolled flooding in any of the following areas of the plant that has the potential to affect safety-related equipment needed for the current operating mode.

Condensate Storage Tank Enclosure

Containment

Control Building

Cooling Tower

Diesel Generator Building

Emergency Feedwater Pump House

Equipment Vault

Fuel Storage Building

Primary Auxiliary Building

Service Water Pump House

Steam and Feedwater Pipe Chases

North Tank Farm

Turbine Building OR

7. The National Weather Service has issued a Hurricane Warning for areas that include the Town of Seabrook.

Basis:

The Emergency Action Levels under this IC are categorized on the basis of the occurrence of an event of sufficient magnitude to be of concern to plant operators. Areas identified in the EALs define the location of the event based on the potential for damage to equipment contained therein. Escalation of the event to an Alert occurs when the magnitude of the event is sufficient to result in damage to equipment contained in the specified location.

The earthquake covered by EAL #1 may cause damage to some portions of the site, but should not affect ability of safety functions to operate. Method of detection can be based on instrumentation, validated by a reliable source, or operator assessment. As defined in the EPRI-sponsored "Guidelines for Nuclear Plant Response to an Earthquake", dated October 1989, a "felt earthquake"is:

An earthquake of sufficient intensity such that: (a) the vibratory ground motion is felt at the nuclear plant site and recognized as an earthquake based on a consensus of control room operators on duty at the time, and (b) for plants with operable seismic instrumentation, the seismic switches of the plant are activated. The seismic switches are set at an acceleration of about 0.01g.

Reference:

VPRO D5452, Seismic Event in Progress UFSAR Section 3.7(B).4, Seismic Instrumentation Page 77 10/17/07

EAL #2 is based on the assumption that a tornado striking (touching down) or high winds within the PROTECTED AREA may have potentially damaged plant structures containing functions or systems required for safe shutdown of the plant.

The design basis wind velocity for Category I structures is 110 mph (UFSAR Section 3.3.1.1).

The range of the installed wind speed translator associated with the station meteorological tower is 0 to 100 mph, i.e., current station meteorological instrumentation supports a maximum readout value for wind speed of 100 mph. For EAL 2b, the EAL value is set at 100% of the maximum readout value, i.e., 100 mph. This is conservative in that the assigned value is less than the structural design limit of 110 mph. -*

Reference:

DBD-MET-1, Meteorological Monitoring System UFSAR Section 2.3, Meteorology If wind-related damage is confirmed visually or by other in-plant indications, the event may be escalated to Alert.

EAL #3 is intended to address crashes of vehicle types large enough to cause significant damage to plant structures containing functions and systems required for safe shutdown of the plant. If the crash is confirmed to affect a plant VITAL AREA, the event may be escalated to Alert.

For EAL #4 only those EXPLOSIONs of sufficient force to damage permanent structures or equipment within the PROTECTED AREA should be considered. No attempt is made in this EAL to assess the actual magnitude of the damage. The occurrence of the EXPLOSION with reports of evidence of damage is sufficient for declaration. The STED/SED also needs to consider any security aspects of the EXPLOSION, if applicable.

EAL #5 is intended to address main turbine rotating component failures of sufficient magnitude to cause observable damage to the turbine casing or to the seals of the turbine generator. Of major concern is the potential for leakage of combustible fluids (lubricating oils) and gases (hydrogen cooling) to the plant environs. Actual FIREs and flammable gas build up are appropriately classified via HU2 and HU3. Generator seal damage observed after generator purge does not meet the intent of this EAL because it did not impact normal operation of the plant. This EAL is consistent with the definition of a Unusual Event while maintaining the anticipatory nature desired and recognizing the risk to non-safety related equipment. Escalation of the emergency classification is based on potential damage done by missiles generated by the failure, or in conjunction with a steam generator tube rupture. These latter events would be classified by the radiological ICs or Fission Product Barrier ICs.

EAL #6 addresses the effect of flooding caused by internal events such as component failures, equipment misalignment, or outage activity mishaps. The areas include those areas that contain systems required for safe shutdown of the plant that are not designed to be wetted or submerged. Escalation of the emergency classification is based on the damage caused or by access restrictions that prevent necessary plant operations or systems monitoring.

EAL #7 covers phenomena that can be precursors of more serious events.

Page 78 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- UNUSUAL EVENT FIRE within PROTECTED AREA boundary not extinguished within 15 minutes of detection Operating Mode Applicability: All Emergency Action Levels:

1. FIRE in the PROTECTED AREA.

AND

2. FIRE not extinguished within 15 minutes of control room notification or verification of a control room alarm.

Basis:

The purpose of this IC is to address the magnitude and extent of FIREs that may be potentially significant precursors to damage to safety systems. As used here, Detection is visual observation and report by plant personnel or sensor alarm indication. The 15 minute time period begins with a credible notification that a FIRE is occurring, or indication of a VALID fire detection system alarm. Verification of a fire detection system alarm includes actions that can be taken with the control room or other nearby site-specific location to ensure that the alarm is not spurious. A verified alarm is assumed to be an indication of a FIRE unless it is disproved within the 15 minute period by personnel dispatched to the scene. In other words, a personnel report from the scene may be used to disprove a sensor alarm if received within 15 minutes of the alarm, but shall not be required to verify the alarm.

The intent of this 15 minute duration is to size the FIRE and to discriminate against small FIREs that are readily extinguished (e.g., smoldering waste paper basket). The intent of this IC is not to include buildings (i.e., warehouses) or areas that are not contiguous (in actual contact with or immediately adjacent) to plant VITAL AREAs. This excludes FIREs within administration buildings, waste-basket FIREs, and other small FIREs of no safety consequence.

Escalation to a higher emergency class is by IC HA4.

Page 79 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition - UNUSUAL EVENT Release of toxic, corrosive, asphyxiant or flammable gases deemed detrimental to normal operation of the plant Operating Mode Applicability: All Emergency Action Levels:

1. a. Report or detection of an uncontrolled release of toxic, corrosive, asphyxiant or flammable gases that could enter or has entered the Owner Controlled Area.

AND

b. An abnormal or emergency operating procedure has been entered, or a deviation from normal security or radiological controls posture has occurred.

OR

2. Report by Local, County or State Officials for evacuation or sheltering of site personnel based on an offsite event.

Basis:

This IC is based on the existence of uncontrolled releases of toxic or flammable gas that may enter the Owner Controlled Area (site boundary) and affect normal plant operations. It is intended that releases of toxic or flammable gases are of sufficient quantity, and the release point of such gases is such that normal plant operations would be affected. This would preclude small or incidental releases, or releases that do not impact structures needed for plant operation. The EALs are intended to not require significant assessment or quantification. The IC assumes an uncontrolled process that has the potential to affect plant operations, or personnel safety.

The Occupational Safety and Health Administration (OSHA) defines an immediately dangerous to life or health concentration in their hazardous waste operations and emergency response regulation as follows:

An atmospheric concentration of any toxic, corrosive or asphyxiant substance that poses an immediate threat to life or would cause irreversible or delayed adverse health effects or would interfere with an individual's ability to escape from a dangerous atmosphere.

[29 CFR 1910.120]

Escalation of this EAL is via HA3, which involves a quantified release of toxic or flammable gas affecting VITAL AREAs.

Page 80 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition - UNUSUAL EVENT Confirmed security event which indicates a potential degradation in the level of safety of the plant Operating Mode Applicability: All Emergency Action Levels:

1. A Code Yellow is reported by security shift supervision.

OR

2. A credible, site specific security threat notification.

OR

3. A validated notification from the NRC providing information of an aircraft threat.

Basis:

Reference is made to security shift supervision because these individuals are the designated personnel on-site qualified and trained to confirm that a security event is occurring or has occurred. Training on security event classification confirmation is closely controlled due to the strict secrecy controls placed on the plant Safeguards Contingency Plan.

EAL 1 is based on site Security Plans. Security events which do not represent a potential degradation in the level of safety of the plant, are reported under 10 CFR 73.71 or in some cases under 10 CFR 50.72.

The intent of EAL 2 is to ensure that appropriate notifications for the security threat are made in a timely manner.

The intent of EAL 3 is to ensure that notifications for the security threat are made in a timely manner and that Offsite Response Organizations and plant personnel are at a state of heightened awareness regarding the credible threat. This EAL is met when a plant receives information regarding an aircraft threat from NRC. Should the threat involve an airliner (airliner is meant to be a large aircraft with the potential for causing significant damage to the plant) then escalation to Alert via HA7 would be appropriate if the airliner is less than 30 minutes away from the plant. The status and size of the plane may be provided by NORAD through the NRC.

It is not the intent of this EAL to replace existing non-hostile related EALs involving aircraft.

The determination of "credible" is made through use of information found in the Safeguards Contingency Plan or site procedures.

Page 81 10/17/07

A higher initial classification could be made based upon the nature and timing of the threat and potential consequences. The licensee shall consider upgrading the emergency response status and emergency classification in accordance with the Safeguards Contingency Plan and Emergency Plans.

Page 82 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition - UNUSUAL EVENT Other conditions existing which in the judgment of the STED/SED warrant declaration of an UNUSUAL EVENT.

Operating Mode Applicability: All Emergency Action Level:

1. Other conditions exist which in the judgment of the STED/SED indicate that events are in process or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of safety systems occurs.

Basis:

This EAL is intended to address unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the STED/SED to fall under the Unusual Event emergency class.

From a broad perspective, one area that may warrant STED/SED judgment is related to likely or actual breakdown of site-specific event mitigating actions. Examples to consider include inadequate emergency response procedures, transient response either unexpected or not understood, failure or unavailability of emergency systems during an accident in excess of that assumed in accident analysis, or insufficient availability of equipment and/or support personnel.

Page 83 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- ALERT Natural and destructive phenomena affecting the plant VITAL AREA Operating Mode Applicability: All Emergency Action Levels:

1 a. The yellow "EVENT" light is lit on seismic monitoring control panel 1-SM-CP-58.

AND

b. The red "OBE" light is lit on seismic monitoring control panel 1-SM-CP-58.

AND

c. Vibratory ground motion is felt and recognized as an earthquake based on a consensus of control room operators on duty at the time.

OR

2. Tornado or high winds > 100 mph within PROTECTED AREA boundary resulting in

1) VISIBLE DAMAGE to any of the following buildings and areas, or

2) Control Room indication of degraded performance of safety-related systems within these buildings and areas.

Condensate Storage Tank Enclosure

Containment

Control Building

Cooling Tower

Diesel Generator Building

Emergency Feedwater Pump House

Equipment Vault

Fuel Storage Building

Primary Auxiliary Building

Service Water Pump House

Steam and Feedwater Pipe Chases

North Tank Farm

Turbine Building OR Page 84 10/17/07

3. Vehicle crash within PROTECTED AREA boundary resulting in

1) VISIBLE DAMAGE to any of the following buildings and areas, or

2) Control Room indication of degraded performance of safety-related systems within these buildings and areas.

Condensate Storage Tank Enclosure

Containment

Control Building

Cooling Tower

Diesel Generator Building

Emergency Feedwater Pump House

Equipment Vault

Fuel Storage Building

Primary Auxiliary Building

Service Water Pump House

Steam and Feedwater Pipe Chases

North Tank Farm

Turbine Building OR

4. Turbine failure-generated missiles resulting in VISIBLE DAMAGE to or penetration of any of the following buildings and areas.

Condensate Storage Tank Enclosure

Containment

Control Building

Cooling Tower

Diesel Generator Building

Emergency Feedwater Pump House

Equipment Vault

Fuel Storage Building

Primary Auxiliary Building

Service Water Pump House

Steam and Feedwater Pipe Chases

North Tank Farm

Turbine Building OR

5. Uncontrolled flooding in any of the following areas of the plant that results in

1) degraded safety system performance as indicated in the control room, or

2) creates industrial safety hazards (e.g., electric .shock) that precludes access necessary to operate or monitor safety equipment.

Page 85 10/17/07

Condensate Storage Tank Enclosure

Containment

Control Building

Cooling Tower

Diesel Generator Building

Emergency Feedwater Pump House

Equipment Vault

Fuel Storage Building

Primary Auxiliary Building

Service Water Pump House

Steam and Feedwater Pipe Chases

North Tank Farm

Turbine Building Basis:

The EALs in this IC escalate from the Unusual Event EALs in HU1 in that the occurrence of the event has resulted in VISIBLE DAMAGE to plant structures or areas containing equipment necessary for a safe shutdown, or has caused damage to the safety systems in those structures evidenced by control indications of degraded system response or performance. The occurrence of VISIBLE DAMAGE and/or degraded system response is intended to discriminate against lesser events. The initial "report" should not be interpreted as mandating a lengthy damage assessment prior to classification. No attempt is made in this EAL to assess the actual magnitude of the damage. The significance here is not that a particular system or structure was damaged, but rather, that the event was of sufficient magnitude to cause this degradation.

Escalation to higher classifications occur on the basis of other ICs (e.g., System Malfunction).

Seismic events of this magnitude could result in a plant VITAL AREA being subjected to forces beyond design limits, and thus damage may have occurred to plant safety systems. See EPRI-sponsored "Guidelines for Nuclear Plant Response to an Earthquake", dated October 1989, for information on seismic event categories.

Reference:

UFSAR Section 3.7(B).4, Seismic Instrumentation The design basis wind velocity for Category I structures is 110 mph (UFSAR Section 3.3.1.1).

The range of the installed wind speed translator associated with the station meteorological tower is 0 to 100 mph, i.e., current station meteorological instrumentation supports a maximum readout value for wind speed of 100 mph. For EAL 2, the EAL value is set at 100% of the maximum readout value, i.e., 100 mph. This is conservative in that the assigned value is less than the structural design limit of 110 mph. Wind loads of this magnitude can cause damage to safety functions.

Reference:

DBD-MET-1, Meteorological Monitoring System EAL #s 2, 3, 4, 5 specify site-specific structures or areas containing systems and functions required for safe shutdown of the plant.

EAL #3 is intended to address crashes of vehicle types large enough to cause significant damage to plant structures containing functions and systems required for safe shutdown of the plant.

Page 86 10/17/07

EAL #4 is intended to address the threat to safety related equipment imposed by missiles generated by main turbine rotating component failures. This EAL is, therefore, consistent with the definition of an ALERT in that if missiles have damaged or penetrated areas containing safety-related equipment the potential exists for substantial degradation of the level of safety of the plant.

EAL #5 addresses the effect of internal flooding that has resulted in degraded performance of systems affected by the flooding, or has created industrial safety hazards (e.g., electrical shock) that preclude necessary access to operate or monitor safety equipment. The inability to operate or monitor safety equipment represents a potential for substantial degradation of the level of safety of the plant. This flooding may have been caused by internal events such as component failures, equipment misalignment, or outage activity mishaps. The areas included contain systems required for safe shutdown of the plant, that are not designed to be wetted or submerged.

Page 87 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- ALERT FIRE or EXPLOSION affecting the operability of plant safety systems required to establish or maintain safe shutdown Operating Mode Applicability: All Emergency Action Level:

1. FIRE or EXPLOSION in any of the following areas:

Condensate Storage Tank Enclosure

Containment

Control Building

Cooling Tower

Diesel Generator Building

Emergency Feedwater Pump House

Equipment Vault

Fuel Storage Building

Primary Auxiliary Building

Service Water Pump House

Steam and Feedwater Pipe Chases

North Tank Farm

Turbine Building AND

2. Plant personnel report VISIBLE DAMAGE to permanent structures or equipment within the affected area, or Control Room indication of degraded performance of safety-related systems within the area.

Basis:

The listed areas contain functions and systems required for the safe shutdown of the plant.

Escalation to a higher emergency class, if appropriate, will be based on System Malfunction, Fission Product Barrier Degradation, Abnormal Rad Levels / Radiological Effluent, or STED/SED Judgment ICs.

This situation (equipment damaged by fire) is not the same as removing equipment for maintenance that is covered by a plant's Technical Specifications. Removal of equipment for maintenance is a planned activity controlled in accordance with procedures and, as such, does not constitute a substantial degradation in the level of safety of the plant. A FIRE / EXPLOSION is an UNPLANNED activity and, as such, does constitute a substantial degradation in the level of safety of the plant. In this situation, an Alert classification is warranted.

Page 88 10/17/07

The inclusion of a "report of VISIBLE DAMAGE" should not be interpreted as mandating a lengthy damage assessment prior to classification. No attempt is made in this EAL to assess the actual magnitude of the damage. The occurrence of the EXPLOSION with reports of evidence of damage is sufficient for declaration. The declaration of an Alert and the activation of the Technical Support Center will provide the STED/SED with the resources needed to perform these damage assessments. The STED/SED also needs to consider any security aspects of the EXPLOSIONs, if applicable.

Page 89 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- ALERT Release of a toxic, corrosive, asphyxiant or flammable gas within or contiguous to a VITAL AREA affecting equipment required to maintain safe operations, or establish or maintain safe shutdown Operating Mode Applicability: All Emergency Action Levels:

1. Report or detection of a toxic, corrosive, asphyxiant or flammable gas release within a VITAL AREA, or areas contiguous (in actual contact with or immediately adjacent) to a VITAL AREA.

AND

2. a. The operability of safety-related equipment is compromised due to personnel access restrictions.

OR

b. The operability of safety-related equipment is compromised due to potential or actual effects from the gas.

Basis:

This IC is based on gas concentrations that affect the safe operation of the plant. This IC applies to VITAL-AREAS, and buildings and areas contiguous to VITAL AREAs. The intent of this IC is not to include buildings or areas that are not contiguous or immediately adjacent to plant VITAL AREAs (e.g., a warehouse).

EAL #1 is met if there is a significant release of gas. Siqnificant means that the quantity of gas released could reasonably be expected to pose a threat to the safety of plant personnel or the operability of safety-related equipment.

EAL #2 is met if safety-related equipment cannot be operated when required, or the functionality of the equipment is (or will be) significantly impaired. These effects may be realized through restrictions placed on personnel access (e.g., local actions cannot be performed) or operation of equipment (e.g., stopping operation of a pump over concern that the electric motor may ignite a flammable gas).

It is appropriate that increased monitoring be done to ascertain whether consequential damage has occurred. Escalation to a higher emergency class, if appropriate, will be based on System Malfunction, Fission Product Barrier Degradation, Abnormal Rad Levels / Radioactive Effluent, or STED/SED Judgment ICs.

Page 90 10/17/07

[This page intentionally left blank]

Page 91 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- ALERT Confirmed security event in a plant PROTECTED AREA Operating Mode Applicability: All Emergency Action Levels:

1. Security shift supervision reports one of the following events.

a. Explosive device (bomb) found inside the Protected Area.

OR

b. An act of Radiological Sabotage has occurred.

Radiological Sabotage means any deliberate act directed against the plant, or against a component of the plant, which could directly or indirectly endanger the public health and safety by exposure to radiation.

Basis:

This class of security events represents an escalated threat to plant safety above that contained in the Unusual Event.

Reference is made to security shift supervision because these individuals are the designated personnel on-site qualified and trained to confirm that a security event is occurring or has occurred. Training on security event classification confirmation is closely controlled due to the strict secrecy controls placed on the plant Security Plan.

The definition of radiological sabotage is derived from 10 CFR 73.2.

Page 92 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- ALERT Control Room evacuation has been initiated Operating Mode Applicability: All Emergency Action Level:

1. Entry into Procedure OS1 200.02 for control room evacuation.

Basis:

With the control room evacuated, additional support, monitoring and direction through the Technical Support Center and/or other emergency response facility is necessary. Inability to establish plant control from outside the control room will escalate this event to a Site Area Emergency.

Reference:

Procedure OS1200.02, Safe Shutdown and Cooldown from the Remote Safe Shutdown Facilities Page 93 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- ALERT Other conditions existing which in the judgment of the STED/SED warrant declaration of an Alert.

Operating Mode Applicability: All Emergency Action Level:

1. Other conditions exist which in the judgment of the STED/SED indicate that events are in process or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels.

Basis:

This EAL is intended to address unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the STED/SED to fall under the Alert emergency class.

Page 94 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- ALERT Notification of an airborne attack threat Operating Mode Applicability: All Emergency Action Level:

1. A validated notification from the NRC of an airliner attack threat < 30 minutes away.

Basis:

The intent of this EAL is to ensure that notifications for the security threat are made in a timely manner and that offsite response organizations and plant personnel are at a state of heightened awareness regarding the credible threat. This EAL is met when the station receives information regarding an airliner attack threat from NRC and the airliner is less than 30 minutes away from the station.

This EAL is intended to address the contingency of a very rapid progression of events due to an airborne hostile attack such as that experienced on September 11, 2001. This EAL is not premised solely on the potential for a radiological release. Rather the issue includes the need for assistance due to the possibility for significant and indeterminate damage from such an attack. Although vulnerability analyses show NPPs to be robust, it is appropriate for offsite response organizations to be notified and encouraged to activate (if they do not normally) to be better prepared should it be necessary to consider further actions. Airliner is meant to be a large aircraft with the potential for causing significant damage to the plant. The status and size of the plane may be provided by NORAD through the NRC.

Page 95 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition -- ALERT Notification of HOSTILE ACTION within the OCA Operating Mode Applicability: All Emergency Action Level:

1. A notification from the site security force that an armed attack, explosive attack, airliner impact or other HOSTILE ACTION is occurring or has occurred within the OCA.

Basis:

This EAL is intended to address the potential for a very rapid progression of events due to a hostile attack including:

" air attack (airliner impacting the OCA)

land-based attack (hostile force progressing across licensee property or directing projectiles at the site)

waterborne attack (hostile force on water attempting forced entry, or directing projectiles at the site)

BOMBs This EAL is not intended to address incidents that are accidental or acts of civil disobedience, such as hunters or physical disputes between employees within the OCA or PA. That initiating condition is adequately addressed by other EALs.

This EAL is not premised solely on adverse health effects caused by a radiological release.

Rather the issue is the immediate need for assistance due to the nature of the event and the potential for significant and indeterminate damage. Although security officers are well trained and prepared to protect against HOSTILE ACTION, it is appropriate for Offsite Response Organizations to be notified and encouraged to begin activation (if they do not normally) to be better prepared should it be necessary to consider further actions.

This EAL is intended to address the contingency for a very rapid progression of events due to an airborne hostile attack such as that experienced on September 11, 2001 and the possibility for additional attacking aircraft. It is not intended to address accidental aircraft impact as that initiating condition is adequately addressed by other EALs. This EAL is not premised solely on the potential for a radiological release. Rather the issue includes the need for assistance due to the possibility for significant and indeterminate damage from additional attack elements.

Although vulnerability analyses show NPPs to be robust, it is appropriate for Offsite Response Organizations to be notified and to activate in order to be better prepared to respond should protective actions become necessary. If not previously notified by NRC that the aircraft impact was intentional, then it would be expected, although not certain, that notification by an appropriate Federal agency would follow. In this case, appropriate federal agency is intended to Page 96 10/17/07

be NORAD, FBI, FAA or NRC. However, the declaration should not be unduly delayed awaiting Federal notification. Airliner is meant to be a large aircraft with the potential for causing significant damage to the plant. The status and size of the plane may be provided by NORAD through the NRC.

This IC/EAL addresses the immediacy of an expected threat arrival or impact on the site within a relatively short time. The fact that the site is an identified attack candidate with minimal time available for further preparation requires a heightened state of readiness and implementation of protective measures that can be effective (onsite evacuation, dispersal or sheltering) before arrival or impact.

Page 97 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition - SITE AREA EMERGENCY Control Room evacuation has been initiated and plant control cannot be established Operating Mode Applicability: All Emergency Action Levels:

1. Control room evacuation has been initiated.

AND

2. Control of the plant cannot be established per Procedure OS1200.02 within 15 minutes.

Basis:

Expeditious transfer of safety systems has not occurred but fission product barrier damage may not yet be indicated. The intent of this IC is to capture those events where control of the plant cannot be reestablished in a timely manner. The determination of whether or not control is established at the remote shutdown panel is based on STED/SED judgment.

The intent of the EAL is to establish control of important plant equipment and knowledge of important plant parameters in a timely manner. Primary emphasis should be placed on those components and instruments that supply protection for, and information about, safety functions.

These functions are reactivity control (ability to shutdown the reactor and maintain it shutdown),

RCS inventory (ability to cool the core), and secondary heat removal (ability to maintain a heat sink).

Escalation of this event, if appropriate, would be by Fission Product Barrier Degradation, Abnormal Rad Levels/Radiological Effluent, or STED/SED Judgment ICs.

Reference:

Procedure OS1200.02, Safe Shutdown and Cooldown from the Remote Safe Shutdown Facilities Page 98 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition - SITE AREA EMERGENCY Other conditions existing which in the judgment of the STED/SED warrant declaration of Site Area Emergency Operating Mode Applicability: All Emergency Action Level:

1. Other conditions exist which in the judgment of the STED/SED indicate that events are in process or have occurred which involve an actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts; (1) toward site personnel or equipment that could lead to the likely failure of or; (2) that prevent effective access to equiprfment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA Protective Action Guideline exposure levels beyond the site boundary.

Basis:

This EAL is intended to address unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the STED/SED to fall under the emergency class description for Site Area Emergency.

Page 99 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition - SITE AREA EMERGENCY Notification of HOSTILE ACTION within the PROTECTED AREA Operating Mode Applicability: All Emergency Action Level:

1. A notification from the site security force that an armed attack, explosive attack, airliner impact, or other HOSITLE ACTION is occurring or has occurred within the PROTECTED AREA.

Basis:

This class of security events represents an escalated threat to plant safety above that contained in the Alert IC in that a hostile force has progressed from the Owner Controlled Area to the Protected Area.

Although NPP security officers are well trained and prepared to protect against HOSTILE ACTION, it is appropriate for Offsite Response Organizations to be notified and encouraged to begin preparations for public protective actions (if they do not normally) to be better prepared should it be necessary to consider further actions.

This EAL is intended to address the potential for a very rapid progression of events due to a dedicated attack. It is not intended to address incidents that are accidental or acts of civil disobedience, such as hunters or physical disputes between employees within the OCA or PA.

That initiating condition is adequately addressed by other EALs. HOSTILE ACTION identified above encompasses various acts including:

air attack (airliner impacting the protected area)

"land-based attack (hostile force penetrating protected area)

"waterborne attack (hostile force on water penetrating protected area)

"BOMBs breaching the protected area This EAL is intended to address the contingency for a very rapid progression of events due to an airborne hostile attack such as that experienced on September 11, 2001 and the possibility for additional attacking aircraft. It is not intended to address accidental aircraft impact as that initiating condition is adequately addressed by other EALs. This EAL is not premised solely on the potential for a radiological release. Rather the issue includes the need for assistance due to the possibility for significant and indeterminate damage from additional attack elements. It is appropriate for Offsite Response Organizations to be notified and to activate in order to be better prepared to respond should protective actions become necessary. If not previously notified by NRC that the aircraft impact was intentional, then it would be expected, although not certain, that notification by an appropriate Federal agency would follow. In this case, appropriate federal agency is intended to be NORAD, FBI, FAA or NRC. However, the Page 100 10/17/07

declaration should not be unduly delayed awaiting Federal notification. Airliner is meant to be a large aircraft with the potential for causing significant damage to the plant. The status and size of the plane may be provided by NORAD through the NRC.

This EAL addresses the immediacy of a threat to impact site vital areas within a relatively short time. The fact that the site is under serious attack with minimal time available for additional assistance to arrive requires offsite response organization readiness and preparation for the implementation of protective measures.

Licensees should consider upgrading the classification to a General Emergency based on actual plant status after impact.

Page 101 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition - GENERAL EMERGENCY Security event resulting in loss of physical control of the facility Operating Mode Applicability: All Emergency Action Level:

1. A HOSTILE FORCE has taken control of plant equipment such that plant personnel are unable to operate equipment required to maintain safety functions.

Basis:

This IC encompasses conditions under which a HOSTILE FORCE has taken physical control of VITAL AREAs (containing vital equipment or controls of vital equipment) required to maintain safety functions, and control of that equipment cannot be transferred to and operated from another location. These functions are reactivity control (ability to shutdown the reactor and maintain it shutdown), RCS inventory (ability to cool the core), and secondary heat removal (ability to maintain a heat sink). If control of the plant equipment necessary to maintain safety functions can be transferred to another location, then the above initiating condition is not met.

This EAL should also address loss of physical control of spent fuel pool cooling systems if imminent fuel damage is likely (e.g., freshly off-loaded reactor core in pool).

Loss of physical control of the control room or remote shutdown capability alone may not prevent the ability to maintain safety functions per se. Design of the remote shutdown capability and the location of the transfer switches should be taken into account.

Page 102 10/17/07

HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY Initiating Condition - GENERAL EMERGENCY Other conditions existing which in the judgment of the STED/SED warrant declaration of General Emergency.

Operating Mode Applicability: All Emergency Action Level:

1. Other conditions exist which in the judgment of the STED/SED indicate that events are in process or have occurredwhich involve actual or imminent substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area.

Basis:

This EAL is intended to address unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the STED/SED to fall under the General Emergency class.

Page 103 10/17/07

INITIATING CONDITION MATRIX Recognition Category S System Malfunction Malfunction Loss of all offsite power to AC Power to AC emergency buses Loss of both AC emergency Prolonged loss of both AC emergency buses for > 15 reduced to a single power source buses for > 15 minutes emergency buses minutes for > 15 minutes such that any Op. Modes: 1, 2, 3, 4 Op. Modes: 1, 2, 3, 4 Op. Modes: 1, 2, 3, 4 additional single failure would result in station blackout.

Op. Modes: 1, 2, 3, 4 ATWS and manual trip from the ATWS and manual trip from the ATWS and manual trip from the MCB was successful MCB was NOT successful MCB was NOT successful, AND Op. Modes: 1, 2, 3 Op. Modes: 1, 2 extreme challenge to Core Cooling or Heat Sink Op. Modes: 1, 2 Inability to reach required Loss of all vital DC power for shutdown within Technical > 15 minutes Specification limits Op. Modes: 1, 2, 3, 4 Op. Modes: 1, 2, 3, 4 UNPLANNED loss of most or all UNPLANNED loss of most or all Inability to monitor a safety system annunciation or safety system annunciation or SIGNIFICANT TRANSIENT in indication in the Control Room indication in Control Room with progress for > 15 minutes either (1) a SIGNIFICANT Op. Modes: 1, 2, 3, 4 Op. Modes: 1, 2, 3, 4 TRANSIENT in progress, or (2) compensatory non-alarming indicators are unavailable Op. Modes: 1, 2, 3, 4 Fuel clad degradation Op. Modes: 1, 2, 3, 4 RCS leakage Op. Modes: 1, 2, 3, 4 UNPLANNED loss of all onsite or offsite communications capabilities Op. Modes: 1, 2, 3, 4 Inadvertent criticality Op Modes: 3, 4 Page 104 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT Loss of all offsite power to AC emergency buses for > 15 Minutes Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. BOTH AC emergency busses E5 AND E6 are not powered from an offsite source for > 15 minutes.

AND

2. Power restored to at least one AC emergency bus (E5 OR E6) from an emergency diesel generator or SEPS.

NOTE - If only one power source is available to energized bus or buses, refer to IC SA5.

Basis:

Prolonged loss of AC power reduces required redundancy and potentially degrades the level of safety of the plant by rendering the plant more vulnerable to a complete Loss of AC Power (e.g., Station Blackout). Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

1-EDE-SWG-5 (E5) and 1-EDE-SWG-6 (E6) are the 4.16 kV emergency buses for Train A and Train B respectively. These buses supply all safety-related loads (e.g., ECCS equipment).

EAL #2 gives credit to the Supplemental Emergency Power System (SEPS).

The SEPS primary function is to supply power to one 4.16 kV emergency bus, EDE-SWG-5 (E5) or EDE-SWG-6 (E6), in the event of a loss-of-offsite-power (LOOP) and both EDGs fail to start and load. In addition (SEPS) provides back up power to the emergency buses when one of the emergency diesel generators (EDG) is out of service for up to fourteen days. SEPS can be used when it is anticipated that one of the EDGs will be inoperable for longer than the technical specification allowable outage time (AOT) of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The design of the SEPS is capable of providing the required safety-related loads in the event of a loss of offsite power if both emergency diesel generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (SI, CBS, CVI, Cl, etc.). In addition to providing power to the required loads, the total combined output of the SEPS system can supply either the RHR pump or the SI pump and one set of pressurizer heaters. These design conditions are based on Probabilistic Risk Evaluation (PRA) EE-03-007.

Page 105 10/17/07

The SEPS consists of two 4.16 kV generators which use diesel fuel engines as the prime mover. The generator sets (gensets) SEPS-DG-2-A and SEPS-DG-2-B are capable of automatically starting, synchronizing together and energizing the SEPS electrical bus. When SEPS is supplying power and connected to emergency buses E5 or E6, the SEPS DGs can be paralleled with offsite when offsite power is restored.

The use of the SEPS is recognized in the Emergency Operating Procedures.

Reference:

UFSAR Section 8.3.1, AC Power Systems Page 106 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT Inability to reach required shutdown within Technical Specification limits Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Level:

1. The plant is not brought to a required operating mode within the time specified by a Technical Specification LCO Action Statement.

Basis:

Limiting Conditions of Operation (LCOs) require the plant to be brought to a required shutdown mode when the Technical Specification required configuration cannot be restored. Depending on the circumstances, this may or may not be an emergency or precursor to a more severe condition. In any case, the initiation of plant shutdown required by the site Technical Specifications requires a one hour report under 10 CFR 50.72 (b) Non-emergency events.

The plant is within its safety envelope when being shut down within the allowable action statement time in the Technical Specifications. An immediate Unusual Event is required when the plant is not brought to the required operating mode within the allowable action statement time in the Technical Specifications. Declaration of a Unusual Event is based on the time at which the LCO-specified action statement time period elapses under the site Technical Specifications and is not related to how long a condition may have existed.

Other required Technical Specification shutdowns that involve precursors to more serious events are addressed by other System Malfunction, Hazards, or Fission Product Barrier Degradation ICs.

Page 107 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT UNPLANNED loss of most or all safety system annunciation or indication in the Control Room for > 15 minutes Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. UNPLANNED loss of approximately 75% or more of UA annunciators for > 15 minutes.

OR

2. UNPLANNED loss of approximately 75% or more of Main Control Board indications for

> 15 minutes.

OR

3. UNPLANNED loss of approximately 75% or more of radiation monitor indications for > 15 minutes.

Basis:

This IC and its associated EAL are intended to recognize the difficulty associated with monitoring changing plant conditions without the use of a major portion of the annunciation or indication equipment. Recognition of the availability of computer based indication equipment is considered (e.g., SPDS, plant computer, etc.).

The UA annunciators assist the operator in determining the cause of a reactor trip or safety injection. A following set of essential parameters is also monitored.

" Reactor Trip Signals

" ESF Actuation Signals

" Certain Technical Specification Deviations

" Important Systems It is estimated that if approximately 75% of the safety system annunciators or indicators are lost, there is an increased risk that a degraded plant condition could go undetected. It is not intended that plant personnel perform a detailed count of the instrumentation lost but use the value as a judgment threshold for determining the severity of the plant conditions.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Due to the limited number of safety systems in operation during cold shutdown, refueling, and defueled modes, no IC is indicated during these modes of operation.

Page 108 10/17/07

It is recognized that most plant designs provide redundant safety system indication powered from separate uninterruptable power supplies. While failure of a large portion of annunciators is more likely than a failure of a large portion of indications, the concern is included in this EAL due to difficulty associated with assessment of plant conditions. The loss of specific, or several, safety system indicators should remain a function of that specific system or component operability status. This will be addressed by the specific Technical Specification. The initiation of a Technical Specification imposed plant shutdown related to the instrument loss will be reported via 10CFR50.72. If the shutdown is not in compliance with the Technical Specification action, the Unusual Event is based on SU2.

This Unusual Event will be escalated to an Alert via IC SA4 if a transient is in progress during the loss of annunciation or indication.

Reference:

UFSAR Section 7.5, Safety-Related Display Instrumentation Page 109 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT Fuel clad degradation Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. VALID reading > 2,670 mRlhr on the letdown radiation monitor, RM-6520-1.

OR-

2. Any RCS activity value > Technical Specification allowable limits as indicated by Chemistry Department sampling results.

Basis:

This IC is included as a Unusual Event because it is considered to be a potential degradation in the level of safety of the plant and a potential precursor of more serious problems.

The value shown EAL #1 was calculated in EPCALC-06-03; refer to SEP# 2006020, dated April 17, 2006.

EAL #2 addresses coolant samples exceeding coolant technical specifications. Escalation of this IC to the Alert level is via the Fission Product Barrier Degradation Monitoring ICs. Though the referenced Technical Specification limits are mode dependent, it is appropriate that the EAL's be applicable in modes 1 through 4, as they indicate a potential degradation in the level of safety of the plant.

The companion IC to SU4 for the Cold Shutdown/Refueling modes is CU5.

Page 110 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT RCS leakage Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. RCS unidentified or pressure boundary leakage > 10 gpm.

OR

2. RCS identified leakage > 25 gpm.

Basis:

This IC is included as a Unusual Event because it may be a precursor of more serious conditions and, as result, is considered to be a potential degradation of the level of safety of the plant. The 10 gpm value for the unidentified and pressure boundary leakage was selected as it is observable with normal control room indications. Lesser values must generally be determined through time-consuming surveillance tests (e.g., mass balances). The EAL for identified leakage is set at a higher value due to the lesser significance of identified leakage in comparison to unidentified or pressure boundary leakage. In either case, escalation of this IC to the Alert level is via Fission Product Barrier Degradation ICs.

Page 111 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT UNPLANNED loss of all onsite or offsite communications capabilities Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. Loss of all of the following onsite communications capabilities affecting the ability to perform routine operations.

Telephones

Gai-Tronics

Plant Radio System OR

2. Loss of all of the following offsite communications capabilities.

" Nuclear Alert System (NAS)

" Backup NAS (Zetron/Nextel unit)

" Emergency Notification System (ENS)

" Telephones Basis:

The purpose of this IC and its associated EALs is to recognize a loss of communications capability that either defeats the plant operations staff ability to perform routine tasks necessary for plant operations or the ability to communicate problems with offsite authorities. The loss of offsite communications ability is expected to be significantly more comprehensive than the condition addressed by 10 CFR 50.72.

The availability of one method of ordinary offsite communications is sufficient to inform state and local authorities of plant problems. This EAL is intended to be used only when extraordinary means (e.g., relaying of information from radio transmissions, individuals being sent to offsite locations, etc.) are being utilized to make communications possible.

The list for onsite communications loss encompasses those systems used for routine plant communications.

The list for offsite communications loss encompasses those systems used for communications with offsite authorities.

Page 112 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- UNUSUAL EVENT Inadvertent criticality OPERATING MODE APPLICABILITY 3 and 4 Emergency Action Level:

1. An UNPLANNED sustained positive startup rate observed on nuclear instrumentation.

Basis:

This IC addresses inadvertent criticality events. While the primary concern of this IC is criticality events that occur in Cold Shutdown or Refueling modes (NUREG 1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States), the IC is applicable in other modes in which inadvertent criticalities are possible. This IC indicates a potential degradation of the level of safety of the plant, warranting a Unusual Event classification. This IC excludes inadvertent criticalities that occur during planned reactivity changes associated with reactor startups (e.g., criticality earlier than estimated). The Cold Shutdown/Refueling IC is CU8.

This condition can be identified using startup rate instrumentation. The term "sustained" is used in order to allow exclusion of expected short-term startup rates from planned control rod movements. These short-term positive startup rates are the result of the increase in neutron population due to subcritical multiplication.

Escalation would be by the Fission Product Barrier Matrix, as appropriate to the operating mode at the time of the event, or by STED/SED Judgment.

Page 113 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- ALERT ATWS and manual trip from the MCB was successful Operating Mode Applicability: 1, 2 and 3 Emergency Action Levels:

1. Indication(s) exist that a reactor trip setpoint has been exceeded.

AND

2. An automatic reactor trip did not occur.

AND

3. A manual reactor trip from the MCB was successful as indicated by neutron flux < 5%.

Basis:

This Initiating Condition addresses the Anticipated Transient Without Scram (ATWS) event.

This condition indicates failure of the automatic protection system to trip the reactor. This condition is more than a potential degradation of a safety system in that a front line automatic protection system did not function in response to a plant transient and thus the plant safety has been compromised, and design limits of the fuel may have been exceeded. An Alert is indicated because conditions exist that lead to potential loss of fuel clad or RCS.

Reactor protection system setpoint being exceeded, rather than limiting safety system setpoint being exceeded, is specified here because failure of the automatic protection system is the issue.

A "successful" manual reactor trip is any set of actions by the reactor operator(s) at the Main Control Board which causes control rods to be rapidly inserted into the core. The 5% neutron flux indication of reactor shutdown was selected to be consistent with the Subcriticality (S)

Critical Safety Function Status Tree and emergency operating procedures. Failure of a manual trip would escalate the event to a Site Area Emergency.

Page 114 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- ALERT UNPLANNED loss of most or all safety system annunciation or indication in Control Room with either (1) a SIGNIFICANT TRANSIENT in progress, or (2) compensatory non-alarming indicators are unavailable Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. a. UNPLANNED loss of approximately 75% or more of UA annunciators for > 15 minutes.

OR

b. UNPLANNED loss of approximately 75% or more of Main Control Board indications for

> 15 minutes.

OR

c. UNPLANNED loss of approximately 75% or more of radiation monitor indications for >

15 minutes.

AND

2. Either of the following: (a or b)

a. A SIGNIFICANT TRANSIENT is in progress.

OR

b. Compensatory non-alarming indications are unavailable.

Basis:

This IC and its associated EAL are intended to recognize the difficulty associated with monitoring changing plant conditions without the use of a major portion of the annunciation or indication equipment during a transient. Recognition of the availability of computer based indication equipment is considered (e.g., SPDS, plant computer, etc.).

"Planned" loss of annunciators or indicators includes scheduled maintenance and testing activities.

It is estimated that if approximately 75% of the safety system annunciators or indicators are lost, there is an increased risk that a degraded plant condition could go undetected. It is not intended that plant personnel perform a detailed count of the instrumentation lost but use the value as a judgment threshold for determining the severity of the plant conditions.

Page 115 10/17/07

The UA annunciators assist the operator in determining the cause of a reactor trip or safety injection. A following set of essential parameters is also monitored.

" Reactor Trip Signals

" ESF Actuation Signals

" Certain Technical Specification Deviations

" Important Systems It is recognized that most plant designs provide redundant safety system indication powered from separate uninterruptable power supplies. While failure of a large portionof annunciators is more likely than a failure of a large portion of indications, the concern is included in this EAL due to difficulty associated with assessment of plant conditions. The loss of specific, or several, safety system indicators should remain a function of that specific system or component operability status. This will be addressed by the specific Technical Specification. The initiation of a Technical Specification imposed plant shutdown related to the instrument loss will be reported via 10 CFR 50.72. If the shutdown is not in compliance with the Technical Specification action, the Unusual Event is based on SU2.

"Compensatory indications" in this context includes computer-based information such as the Video Alarm System (VAS), Safety Parameter Display System (SPDS), etc. If both a major portion of the annunciation system and all computer monitoring are unavailable, the Alert is required.

Due to the limited number of safety systems in operation during cold shutdown, refueling and defueled modes, no IC is indicated during these modes of operation.

This Alert will be escalated to a Site Area Emergency if the operating crew cannot monitor the transient in progress and compensatory non-alarming indications are unavailable.

Reference:

UFSAR Section 7.5, Safety-Related Display Instrumentation Page 116 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- ALERT Power to AC emergency buses reduced to a single power source for > 15 minutes such that any additional single failure would result in station blackout Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. At least one AC emergency bus is energized - Bus E5 AND/OR Bus E6.

AND

2. Only one power source is available to the energized bus/buses such that the loss of this source would result in a station blackout.

AND

3. 15 minutes has elapsed with only one power source available.

Basis:

This IC and the associated EALs are intended to provide an escalation from IC SU1. The condition indicated by this IC is the degradation of the offsite and onsite power systems such that any additional single failure would result in a station blackout.

1-EDE-SWG-5 (E5) and 1-EDE-SWG-6 (E6) are the 4.16 kV emergency buses for Train A and Train B respectively. These buses supply all safety-related loads (e.g., ECCS equipment).

Refer to UFSAR Section 8.3.1, AC Power Systems, for additional information.

The following examples of this condition are provided.

" Loss of offsite power with a concurrent failure of one emergency diesel generator.

" Loss of offsite power coincident with a loss of both emergency diesel generators, followed by rapid restoration of one offsite power source.

" Loss of offsite power coincident with a loss of both emergency diesel generators, followed by successful start of the Supplemental Emergency Power System (SEPS).

The SEPS primary function is to supply power to one 4.16 kV emergency bus, EDE-SWG-5 (E5) or EDE-SWG-6 (E6), in the event of a loss-of-offsite-power (LOOP) and both EDGs fail to start and load. In addition (SEPS) provides back up power to the emergency buses when one of the emergency diesel generators (EDG) is out of service for up to fourteen days. SEPS can be used when it is anticipated that one of the EDGs will be inoperable for longer than the technical specification allowable outage time (AOT) of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

Page 117 10/17/07

The design of the SEPS is capable of providing the required safety-related loads in the event of a loss of offsite power if both emergency diesel generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (SI, CBS, CVI, Cl, etc.). In addition to providing power to the required loads, the total combined output of the SEPS system can supply either the RHR pump or the SI pump and one set of pressurizer heaters. These design conditions are based on Probabilistic Risk Evaluation (PRA) EE-03-007.

The SEPS consists of two 4.16 kV generators which use diesel fuel engines as the prime mover. The generator sets (gensets) SEPS-DG-2-A and SEPS-DG-2-B are capable of automatically starting, synchronizing together and energizing the SEPS electrical bus. When SEPS is supplying power and connected to emergency buses E5 or E6, the SEPS DGs can be paralleled with offsite when offsite power is restored.

The use of the SEPS is recognized in the Emergency Operating Procedures.

The subsequent loss of this single power source would escalate the event to a Site Area Emergency in accordance with IC SS1.

Reference:

UFSAR Section 8.3.1, AC Power Systems Page 118 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- SITE AREA EMERGENCY Loss of both AC emergency buses for > 15 minutes Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. BOTH AC emergency buses E5 AND E6 are de-energized.

AND

2. 15 minutes has elapsed with BOTH AC emergency buses E5 AND E6 de-energized.

Basis:

Loss of all AC power compromises all plant safety systems requiring electric power including RHR, ECCS, Containment Heat Removal and the Ultimate Heat Sink. Prolonged loss of all AC power will cause core uncovering and loss of containment integrity, thus this event can escalate to a General Emergency. The time duration of 15 minutes was selected to exclude transient or momentary power losses.

1-EDE-SWG-5 (E5) and 1-EDE-SWG-6 (E6) are the 4.16 kV emergency buses for Train A and Train B respectively. These buses supply all safety-related loads (e.g., ECCS equipment).

Refer to UFSAR Section 8.3.1, AC Power Systems, for additional information.

Under this Initiating Condition, both trains of safety-related equipment are unavailable, i.e., a station blackout exists. This Initiating Condition is not met if either Bus E5 or E6 is energized from the Supplemental Emergency Power System (SEPS).

The SEPS primary function is to supply power to one 4.16 kV emergency bus, EDE-SWG-5 (E5) or EDE-SWG-6 (E6), in the event of a loss-of-offsite-power (LOOP) and both EDGs fail to start and load. In addition (SEPS) provides back up power to the emergency buses when one of the emergency diesel generators (EDG) is out of service for up to fourteen days. SEPS can be used when it is anticipated that one of the EDGs will be inoperable for longer than the technical specification allowable outage time (AOT) of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The design of the SEPS is capable of providing the required safety-related loads in the event of a loss of offsite power if both emergency diesel generators fail to start and load. During these events it is assumed that there is no seismic event or an event that requires safeguards actuation (SI, CBS, CVI, CI, etc.). In addition to providing power to the required loads, the total combined output of the SEPS system can supply either the RHR pump or the SI pump and one set of pressurizer heaters. These design conditions are based on Probabilistic Risk Evaluation (PRA) EE-03-007.

Page 119 10/17/07

The SEPS consists of two 4.16 kV generators which use diesel fuel engines as the prime mover. The generator sets (gensets) SEPS-DG-2-A and SEPS-DG-2-B are capable of automatically starting, synchronizing together and energizing the SEPS electrical bus. When SEPS is supplying power and connected to emergency buses E5 or E6, the SEPS DGs can be paralleled with offsite when offsite power is restored.

The use of the SEPS is recognized in the Emergency Operating Procedures.

Escalation to General Emergency is via Fission Product Barrier Degradation or IC SG1.

Reference:

UFSAR Section 8.3.1, AC Power Systems Page 120 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- SITE AREA EMERGENCY ATWS and manual trip from the MCB was NOT successful Operating Mode Applicability: 1 and 2 Emergency Action Levels:

1. Indication(s) exist that a reactor trip setpoint has been exceeded.

AND

2. An automatic reactor trip did not occur.

AND

3. A manual reactor trip from the MCB was NOT successful as indicated by neutron flux >

5%.

Basis:

This Initiating Condition addresses the Anticipated Transient Without Scram (ATWS) event.

A manual trip is considered "not successful" if action away from the Main Control Board was required to trip the reactor (e.g., local opening of the reactor trip breakers). The 5% neutron flux indication of reactor shutdown was selected to be consistent with the Subcriticality (S)

Critical Safety Function Status Tree and emergency operating procedures.

Under these conditions, the reactor is producing more heat than the maximum decay heat load for which the safety systems are designed. A Site Area Emergency is indicated because conditions exist that lead to imminent loss or potential loss of both fuel clad and RCS. Although this IC may be viewed as redundant to the Fission Product Barrier Degradation IC, its inclusion is necessary to better assure timely recognition and emergency response.

Escalation of this event to a General Emergency would be via Fission Product Barrier Degradation or STED/SED Judgment ICs.

Page 121 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- SITE AREA EMERGENCY Loss of all vital DC power for > 15 minutes Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Level:

1. Voltage indications are < 105V on all vital DC buses (11A, 11 B, 11C and 11D) for> 15 minutes.

Basis:

Loss of all DC power compromises ability to monitor and control plant safety functions.

Prolonged loss of all DC power will cause core uncovering and loss of containment integrity when there is significant decay heat and sensible heat in the reactor system. Escalation to a General Emergency would occur by Abnormal Rad Levels/Radiological Effluent, Fission Product Barrier Degradation, or STED/SED Judgment ICs.

Per Engineering DBD-ED-05, the DC bus voltage range within which the 125 Volt DC system is considered operable is 105 volts minimum to 140 volts maximum. The vital DC Buses (Switchgear) are SWG-1 1A and 11C for Train A and SWG-1 1B and 11D for Train B.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Reference:

1. UFSAR Section 8.32, DC Power System

2. Procedure OS1248.01, Loss of a Vital 125 VDC Bus

3. Procedure VPRO F5278, Loss of All Vital DC Power

4. DBD-ED-05, 125 VDC System Page 122 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- SITE AREA EMERGENCY Inability to monitor a SIGNIFICANT TRANSIENT in progress Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. a. Loss of approximately 75% or more of UA annunciators.

OR

b. Loss of approximately 75% or more of Main Control Board indications.

OR

c. Loss of approximately 75% or more of radiation monitor indications.

AND

2. Compensatory non-alarming indications are unavailable.

AND

3. Complete loss of the ability to monitor all Critical Safety Functions.

AND

4. SIGNIFICANT TRANSIENT in progress.

Basis:

This IC and its associated EAL are intended to recognize the inability of the control room staff to monitor the plant response to a transient. A Site Area Emergency is considered to exist if the control room staff cannot monitor the Critical Safety Functions during a transient.

The UA annunciators assist the operator in determining the cause of a reactor trip or safety injection. A following set of essential parameters is also monitored.

U Reactor Trip Signals U ESF Actuation Signals U Certain Technical Specification Deviations U Important Systems Page 123 10/17/07

It is estimated that if approximately 75% of the safety system annunciators or indicators are lost, there is an increased risk that a degraded plant condition could go undetected. It is not intended that plant personnel perform a detailed count of the instrumentation lost but use the value as a judgment threshold for determining the severity of the plant conditions.

"Compensatory non-alarming indications" include analog/digital readouts, and computer-based information such as the Video Alarm System (VAS) or Safety Parameter Display System (SPDS).

SIGNIFICANT TRANSIENT: is an UNPLANNED event involving one or more of the following:

(1) automatic turbine runback >25% thermal reactor power, (2) electrical load rejection >25%

full electrical load, (3) Reactor Trip, (4) Safety Injection Activation, or (5) thermal power oscillations >10%

"Planned" and "UNPLANNED" actions are not differentiated since the loss of instrumentation of this magnitude is of such significance during a transient that the cause of the loss is not an ameliorating factor.

Reference:

UFSAR Section 7.5, Safety-Related Display Instrumentation.

Page 124 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- GENERAL EMERGENCY Prolonged loss of both AC emergency buses Operating Mode Applicability: 1, 2, 3 and 4 Emergency Action Levels:

1. BOTH AC emergency buses E5 AND E6 are de-energized.

AND

2. One or more of the following conditions exist: (a or b or c)

a. Restoration of at least one bus (E5 or E6) within four (4) hours is not likely.

OR

b. Core Cooling ORANGE path.

OR

c. Core Cooling RED path.

Basis:

Loss of all AC power compromises all plant safety systems requiring electric power including RHR, ECCS, Containment Heat Removal and the Ultimate Heat Sink. Prolonged loss of all AC power will lead to loss of fuel clad, RCS, and containment. The value of four (4) hours to restore AC power is based on the station blackout coping analysis performed in conformance with 10 CFR 50.63. Although this IC may be viewed as redundant to the Fission Product Barrier Degradation IC, its inclusion is necessary to better assure timely recognition and emergency response.

This IC is specified to assure that in the unlikely event of a prolonged station blackout, timely recognition of the seriousness of the event occurs and that declaration of a General Emergency occurs as early as is appropriate, based on a reasonable assessment of the event trajectory.

The likelihood of restoring at least one emergency bus should be based on a realistic appraisal of the situation since a delay in an upgrade decision based on only a chance of mitigating the event could result in a loss of valuable time in preparing and implementing public protective actions.

Page 125 10/17/07

1-EDE-SWG-5 (E5) and 1-EDE-SWG-6 (E6) are the 4.16 kV emergency buses for Train A and Train B respectively. These buses supply all safety-related loads (e.g., ECCS equipment).

Refer to UFSAR Section 8.3.1, AC Power Systems, for additional information.

Under these conditions, fission product barrier monitoring capability may be degraded. Although it may be difficult to predict when power can be restored, it is necessary to give the STED/SED a reasonable idea of how quickly (s)he may need to declare a General Emergency based on two major considerations:

1. Are there any present indications that core cooling is already degraded to the point that Loss or Potential Loss of Fission Product Barriers is imminent (per FPB EALs)? This is determined by using Core Cooling CSFST criteria. WOG guidance defines a Core Cooling ORANGE path as a severe challenge to core cooling. This condition would indicate that core cooling is "degraded" before the onset of fuel clad barrier failure. The selected values for core exit thermocouples and reactor vessel level reflect station-specific criteria for a Core Cooling ORANGE path. These same values are used in FPB monitoring.

2. If there are no present indications of such core cooling degradation, how likely is it that power can be restored in time to assure that a loss of two barriers with a potential loss of the third barrier can be prevented?

Thus, indication of continuing core cooling degradation must be based on Fission Product Barrier monitoring with particular emphasis on STED/SED judgment as it relates to imminent Loss or Potential Loss of fission product barriers and degraded ability to monitor fission product barriers.

Reference:

1. UFSAR Chapter 8, Section 4, Compliance with 10 CFR 50.63, Loss of All Alternating Current Power (Station Blackout)

2. CSFST F-0.2, Core Cooling (C)

Page 126 10/17/07

SYSTEM MALFUNCTION Initiating Condition -- GENERAL EMERGENCY ATWS and manual trip from the MCB was NOT successful, AND extreme challenge to Core Cooling or Heat Sink Operating Mode Applicability: 1 and 2 Emergency Action Levels:

1. Indication(s) exist that a reactor trip setpoint has been exceeded.

AND

2. An automatic reactor trip did not occur.

AND

3. A manual reactor trip from the MCB was NOT successful as indicated by neutron flux >

5%.

AND

4. Either of the following: (a or b)

a. Core Cooling RED path.

OR

b. Heat Sink RED path.

Basis:

This Initiating Condition addresses the Anticipated Transient Without Scram (ATWS) event.

A manual trip is considered "not successful" if action away from the Main Control Board was required to trip the reactor (e.g., local opening of the reactor trip breakers). The 5% neutron flux indication of reactor shutdown was selected to be consistent with the Subcriticality (S)

Critical Safety Function Status Tree and emergency operating procedures.

Under the conditions of this IC and its associated EALs, efforts to bring the reactor subcritical have been unsuccessful and, as a result, the reactor is producing more heat than the maximum decay heat load for which the safety systems were designed. This condition, coincident with indications of an extreme challenge to either the Core Cooling or Heat Sink functions, is a precursor for a core melt sequence. In this situation, core degradation may occur rapidly. For this reason, the General Emergency declaration is intended to be anticipatory of the fission product barrier matrix declaration to permit maximum offsite intervention time.

Page 127 10/17/07

Appendix A Basis for Radiological Effluent Initiating Conditions Introduction This appendix supplements the basis information provided in Section 5 for initiating conditions AU1, AA1, AS1, and AGI. This appendix will be structured into seven major sections. They are:

1. Purpose of the effluent ICs/EALs and their relationship to other ICs/EALs

2. Explanation of the ICs

3. Explanation of the example EALs and their relationship to the ICs

4. Interface between the ICs/EALs and the Offsite Dose Calculation Manual (ODCM)

5. Monitor setpoints versus EAL thresholds.

6. The impact of meteorology

7. The impact of source term A.1 Purpose of the Effluent ICs/EALs ICs AU1, AA1, AS1, and AG1 provide classification thresholds for UNPLANNED and/or uncontrolled releases of radioactivity to the environment. In as much as the purpose of emergency planning at nuclear power plants is to minimize the consequences of radioactivity releases to the environment, these ICs would appear to be controlling. However, classification of emergencies on the basis of radioactivity releases is not optimum, particularly those classifications based on radiation monitor indications. Such classifications can be deficient for several reasons, including:

In significant emergency events, a radioactivity release is seldom the initiating event, but rather, is the consequence of some other condition. Relying on an indication of a release may not be sufficiently anticipatory.

The relationship between an effluent monitor indication caused by a release and the offsite conditions that result is a function of several parameters (e.g., meteorology, source term) which can change in value by orders of magnitude between normal and emergency conditions and from event to event. The appropriateness of these classifications is dependent on how well the parameter values assumed in pre-establishing the classification thresholds match those that are present at the time of the incident.

Primary emphasis is intended to be placed on plant conditions in classifying emergency events.

Effluent ICs were included, however, to provide a basis for classifying events that cannot be readily classified on the basis of plant condition alone. Plant condition ICs are included to address the precursors to radioactivity release in order to ensure anticipatory action. The effluent ICs do not stand alone, nor do the plant condition ICs. The inclusion of both categories more fully addresses the potential event spectrum and compensates for potential deficiencies in either. This is a case in which the whole is greater than the sum of the parts.

From the discussion that follows, it should become clear how the various aspects of the effluent ICs/EALs work together to provide for reasonably accurate and timely emergency classifications. While some aspects of the radiological effluent EALs may appear to be potentially unconservative, one also needs to consider IC/EALs in other recognition categories that compensate for this condition.

Page 128 10/17/07

A.2. Initiating Conditions There are four radiological effluent ICs. The IC and the fundamental basis for the ultimate classification for the four classifications are:

General (AGI) Offsite Dose Resulting from an Actual or Imminent Release of Gaseous Radioactivity Exceeds 1000 mR TEDE or 5000 mR Thyroid CDE for the Actual or Projected Duration of the Release Using Actual Meteorology.

Site Area (AS1) Offsite Dose Resulting from an Actual or Imminent Release of Gaseous Radioactivity Exceeds 100 mR TEDE or 500 mR Thyroid CDE for the Actual or Projected Duration of the Release.

Alert (AA1) Any UNPLANNED Release of Gaseous or Liquid Radioactivity to the Environment that Exceeds 200 Times Radiological Technical Specifications for 15 Minutes or Longer.

Unusual Event (AU1) Any UNPLANNED Release of Gaseous or Liquid Radioactivity to the Environment that Exceeds Two Times Radiological Technical Specifications for 60 Minutes or Longer.

The fundamental basis of AU1 and AA1 ICs differs from that for AS1 and AG1 ICs. It is important to understand the differences.

" The Radiological Effluent Technical Specifications (RETS) (similar controls are included in the ODCMs of those facilities that implemented Generic Letter 89-01) are associated with particular offsite doses and dose rate limits. For showing compliance with these limits, facility Offsite Dose Calculation Manuals (ODCM) establish methodologies for establishing effluent monitor alarm setpoints, based on defined source term and meteorology assumptions.

" AU1 and AA1 are NOT based on these particular values of offsite dose or dose rate but, rather, on the loss of plant control implied by a radiological release that exceeds a specified multiple of the RETS release limits for a specified period of time.

" The RETS multiples are specified only to distinguish AU1 and AA1 from non-emergency conditions and from each other. While these multiples obviously correspond to an offsite dose, the classification emphasis is on a release that does not comply with a license commitment for an extended period of time.

" While some of the example EALs for AU1 and AA1 use indications of offsite dose rates as symptoms that the RETS may be exceeded, the IC, and the classification, are NOT concerned with the particular value of offsite dose. While there may be quantitative inconsistencies involved with this protocol, the qualitative basis of the EAL, i.e., loss of plant control, is not affected.

" The basis of the AS1 and AG1 ICs IS a particular value of offsite dose for the event duration. AG1 is set to the value of the EPA PAG. AS1 is a fraction (10%) of the EPA PAG.

As such, these ICs are consistent with the fundamental definitions of a Site Area and General Emergency.

Page 129 10/17/07

A.3 Emergency Action Levels There are three typical example EALs:

Effluent Monitor ReadinQs: These EALs are pre-calculated values that correspond to the condition identified in the IC for a given set of assumptions.

Field Survey Results: These example EALs are included to provide a means to address classifications based on results from field surveys.

Dose Assessment Results: These example EALs are included to provide a means to address classifications based on dose assessments.

A.3.1 Effluent Monitor Readings These EALs are pre-calculated values that correspond to the condition identified in the IC for a given set of assumptions. The degree of correlation is dependent on how well the assumed parameters (e.g., meteorology, source term, etc.) represent the actual parameters at the time of the emergency.

AS1 and AG1 Classifications should be made under these EALs if VALID (e.g., channel check, comparison to redundant/diverse indication, etc.) effluent radiation monitor readings exceed the pre-calculated thresholds. In a change from previous versions of this methodology, confirmation by dose assessments is no longer required as a prerequisite to the classification. Nonetheless, dose assessments are important components of the overall accident assessment activities when significant radioactivity releases have occurred or are projected. Dose assessment results, when they become available, may serve to confirm the validity of the effluent radiation monitor EAL, may indicate that an escalation to a higher classification is necessary, or may indicate that the classification wasn't warranted. AS1 and AG1 both provide that, if dose assessment results are available, the classification should be based on the basis of the dose assessment result rather than the effluent radiation monitor EAL.

AU1 and AA1 ODCMs provide a methodology for determining default and batch-specific effluent monitor alarm setpoints pursuant to Standard Technical Specification (STS) 3.3.3.9. These setpoints are intended to show that releases are within STS 3.11.2.1. The applicable limits are 500 mrem/year whole body or 3000 mrem/year skin from noble gases. (Inhalation dose rate limits are not addressed here since the specified surveillance involves collection and analysis of composite samples. This after-the-fact assessment could not be an made in a timely manner conducive to accident classification.) These setpoints are calculated using default source terms or batch-specific sample isotopic results and annual average X/Q. Since the meteorology data is pre-defined, there is a direct correlation between the monitor setpoints and the RETS limits.

Although the actual X/Q may be different, NUREG-1022, Event Reportinq Guidelines 10 CFR 50.72 and 50.73, provided "...Annualaverage meteorological data should be used for determining offsite airborneconcentrationsof radioactivityto maintain consistency with the technical specifications (TS) for reportabilitythresholds." The ODCM methodology is based on long term continuous releases. However, its use here in a short term release situation is appropriate. Remember that the AU1 and AA1 ICs are based on a loss of plant control indicated by the failure to comply with a multiple of the RETS release limits for an extended period and that the ODCM provides the methodology for showing compliance with the RETS.

Page 130 10/17/07

To obtain the EAL thresholds, multiply the ODCM setpoint for each monitor by 2 (AU1) or 200 (AA1). It would be preferable to reference "2 x ODCM Setpoint" or "200x ODCM Setpoint"as the EAL threshold. In this manner, the EAL would always change in step with changes in the ODCM setpoint (e.g., for a batch or special release. In actual practice, there may be an "warning" and a "high" alarm setpoint. The setpoint that is closest in value to the RETS limit should be used. Facility ODCMs may lower the actual setpoint to provide an administrative "safety margin". Also, if there is more than one unit or release stack on the site, the RETS limits may be apportioned. Two possible approaches to obtain the EAL thresholds are:

The "2x" and "200x" multiples could be increased to address the reduced setpoints.

For example, if the stack monitor were set to 50% of the RETS limit, the EAL threshold could be set to "4x" and "400x" the setpoint on that monitor.

The reduced setpoints could be ignored and the "2x" and "200x" multiples used as specified. While numerically conservative, using a single set of multipliers would probably be desirable from a human engineering standpoint.

In a change from previous versions of this methodology, confirmation by dose assessments is no longer required as a prerequisite to the classification. While assessments with real meteorology may have provided a basis for escalating to AS1 (or AG1), the assessments could not confirm the AU1 or AA1 classifications since compliance with the RETS is demonstrated using annual average meteorology - not - actual meteorology.

Nonetheless, dose assessments are important components of the overall accident assessment activities when significant radioactivity releases have occurred or are projected. Dose assessment results, when they become available, may indicate that an escalation to a higher classification is necessary. AS1 and AG1 both provide that, if dose assessment results are available, the classification should be based on the basis of the dose assessment result rather than the effluent radiation monitor EAL.

In typical practice, the radiological effluent monitor alarms would have been set, on the basis of ODCM requirements, to indicate a release that could exceed the RETS limits. Alarm response procedures call for an assessment of the alarm to determine whether or not RETS have been exceeded. Utilities typically have methods for rapidly assessing an abnormal release in order to determine whether or not the situation is reportable under 10 CFR 50.72. Since a radioactivity release of a magnitude comparable to the RETS limits will not create a need for offsite protective measures, it would be reasonable to use these abnormal release assessment methods to initiate dose assessment techniques using actual meteorology and projected source term and release duration.

A.3.2 Perimeter Monitor, Field Survey Results, Dose Projection Results AS1 and AGI The perimeter monitor and field survey results are included to provide a means for classification based on actual measurements. There is a 1:1 correlation (with consideration of release duration) between these EALs and the IC since all are dependent on actual meteorology.

Dose projection result EALs are included to provide a basis for classification based on results from assessments triggered at lower emergency classifications. If the dose assessment results are available at the time that the classification is made, the results should be used in Page 131 10/17/07

conjunction with this EAL for classifying the event rather than the effluent radiation monitor EAL.

Although the IC references TEDE and thyroid CDE as criteria, field survey results and perimeter monitor indications will generally not be reported in these dose quantities, but rather in terms of a dose rate. For this reason, the field survey EALs are based on a P-7 dose rate and a thyroid CDE value, both assuming one hour of exposure (or inhalation). If individual site analyses indicate a longer or shorter duration for the period in which the substantial portion of the activity is released, the longer duration should be used for the field survey and/or perimeter monitor EALs.

AUM and AAM As discussed previously, the threshold in these ICs is based on exceeding a multiple of the RETS for an extended period. The applicable RETS limit is the instantaneous dose rate provided in Standard Technical Specification (STS) 3.11.2.1. While these three EALs are also expressed in dose rate, they are dependent on actual meteorology. However, compliance with the RETS is demonstrated using annual average meteorology. Due to this, the only time that there would be a 1:1 correlation between the IC and these EALs is when the value of the actual meteorology matched the annual average -- an unlikely situation. For this reason, these EALs can only be indirect indicators that the RETS may be exceeded. The three example EALs are consistent with the fundamental basis of AU1 and AA1, that of a uncontrolled radioactivity release that indicates a loss of plant control. A dose rate, at or beyond the site boundary, greater than 0.1 mR/hr for 60 minutes or 10.0 mR/hr for 15 minutes is consistent with this fundamental basis, regardless of the lack of numerical correlation to the RETS. The time periods chosen for the Unusual Event AU1 (60 minutes) and Alert AA1 (15 minutes) are indicative of the relative risks based on the loss of ability to terminate a release.

The numeric values shown in AU1 and AA1 are based on a release rate not exceeding 500 mrem per year, converted to a rate of: 500 + 8766 = 0.057 mR/hr. If we take a multiple of 2, as specified in the Unusual Event threshold, this equates to a dose rate of about 0.11 mR/hr, which rounds to the 0.1 mR/hr specified in AUI. Similarly for the AA1 EALs, we obtain 10 mR/hr.

A.4 Interface Between ODCM and ICs/EALs For AU1 and AA1, a strong link was established with the facility's ODCM. It was the intent to have the AU1 and AA1 EALs indexed to the ODCM alarm setpoints. This was done for several reasons:

To allow the EALs to use the monitor setpoints already in place in the facility ODCM, thus eliminating the need for a second set of values as the EALs. The EAL could reference "2x ODCM Setpoint" or "200x ODCM Setpoint" for the monitors addressed in the ODCM. Extensive calculations would only be necessary for monitors not addressed in the ODCM.

To take advantage of the alarm setpoint calculational methodology already documented in the facility ODCM.

" To ensure that the operators had an alarm to indicate the abnormal condition. If the monitor EAL threshold was less than the default ODCM setpoint, the operators could be in the position of having exceeded an EAL and not knowing it.

Page 132 10/17/07.

" To simplify the IC/EAL by eliminating the need to address planned and UNPLANNED releases, continuous or batch releases, monitored or unmonitored releases. Any release that complies with the radiological effluent technical specifications (RETS) (or ODCM controls for utilities that have implemented GL 89-

01) would not exceed a monitor EAL threshold.

" To eliminate the possibility of a planned release (e.g., containment / drywell purge) resulting in effluent radiation monitor readings that exceed an classification threshold that was based on a different calculation method. ODCMs typically require specific alarm setpoints for such releases. If the release can be authorized under the provisions of the ODCM/RETS, an emergency classification is not warranted. If the monitor EAL threshold is indexed to the ODCM setpoint (e.g., "...2 x ODCM setpoint... ') the monitor EAL will always change in step with the ODCM setpoint.

Although the ODCM is intended to address long term routine releases, its use here for short term releases is appropriate. The IC is specified in terms of a release that exceeds RETS for an extended period of time. Compliance to the RETS is shown using the ODCM methodology.

A.5 Setpoints versus Monitor EALs Effluent monitors typically have provision for two separate alarm setpoints associated with the level of measured radioactivity. (There may be other alarms for parameters such as low sample flow.) These setpoints are typically established by the facility ODCM. As such, at most sites the values of the monitor EAL thresholds will not be implemented as actual alarm setpoints, but would be tabulated in the classification procedure. If the monitor EAL thresholds are calculated as suggested herein they will be higher than the ODCM alarm setpoints by at least a factor of two (i.e., AU1). This alarm alerts the operator to compare the monitor indication to the EAL thresholds.

A.6 The Impact of Meteorology The existence of uncertainty between actual event meteorology and the meteorology assumed in establishing the EALs was identified above. It is important to note that uncertainty is present regardless of the meteorology data set assumed. The magnitude of the potential difference and, hence, the degree of conservatism will depend on the data set selected. Data sets that are intended to ensure low probability of under-conservative assessments have a high probability of being over-conservative. For nuclear power plants, there are different sets of meteorological data used for different purposes. The two primary sets are:

For accident analyses purposes, sector X/Q values are set at that value that is exceeded only 0.5% of the hours wind blows into the sector. The highest of the 16 sector values is the maximum sector X/Q value. The site X/Q value is set at that value that is exceeded only 5%

of the hours for all sectors. The higher of the sector or site X/Q values is used in accident analyses.

For routine release situations, annual average X/Q values are calculated for specified receptor locations and at standard distances in each of the 16 radial sectors. In setting ODCM alarm set points, the annual average X/Q value for the most restrictive receptor at or beyond the site boundary is used. The sector annual average X/Q value is normalized for the percentage of time that the wind blows into that sector. In an actual event, the wind direction may be into the affected sector for the entire release duration. Many sites experience typical sector X/Qs that are 10-20 times higher than the calculated annual average for the sector.

Page 133 10/17/07

In developing the effluent EALs, the NUMARC EAL Task Force elected to use annual average meteorology for establishing effluent monitor EAL thresholds. This decision was based on the following considerations.

" Use of the accident X/Qs, may be too conservative. For some sites, the difference between the accident X/Q and the annual average EI/Q can be a factor of 100-1000.

With this difference in magnitude, the calculated monitor EALs for AS1 or AG1 might actually be less than the ODCM alarm setpoints, resulting in unwarranted classifications for releases that might be in compliance with ODCM limits.

" The ODCM and the RETS are based in part on annual average X/Q (non-normalized). ODCMs already provide alarm setpoints based on annual average X/Q that could be used for AU1 and AA1.

" Use of a X/Q more restrictive than the D/Q used to establish ODCM alarm setpoints could create a situation in which the EAL value would be less than the ODCM setpoint. In this case, the operators would have no alarm indication to alert them of the emergency condition.

Use of one X/Q value for AU1 and AA1 and another for AS1 and AG1 might result in monitor EALs that would not progress from low to high classifications. Instead, the AS1 and AA1 EALs might overlap.

The impact of the differences between the assumed annual average meteorology and the actual meteorology depends on the particular EAL.

" For the AU1 and AA1 effluent monitor EALs, there is no impact since the IC and the EALs are based on annual average meteorology by definition.

" For the field survey, perimeter monitor, and dose assessment results EALs in AS1 and AG1, there is no impact since the IC and these EALs are based on actual meteorology.

" For the AS1 and AG1 effluent monitor EALs, there may be differences since the IC is based on actual meteorology and the monitor EALs are calculated on the basis of annual average meteorology or, on a site specific basis, one of the more conservative derivatives of annual average meteorology. This is considered as acceptable in that dose assessments using actual meteorology will be initiated for significant radioactivity releases. Needed escalations can be based on the results of these assessments. As discussed previously, this delay was deemed to be acceptable since in significant release situations, the plant condition EALs should provide the anticipatory classifications necessary for the implementation of offsite protective measures.

For the field survey, perimeter monitor, and dose assessment results EALs in AU1 and AAM, there is an impact. These three EALs are dependent on actual meteorology. However, the threshold values for all of the AU1 and AA1 EALs are based on the assumption of annual average meteorology. If the actual and annual average meteorology were equal, the IC and all of the EALs would correlate. Since it is likely that the actual meteorology will exceed the annual average meteorology, there will be numerical inconsistencies between these EALs and the IC. The three example EALs are consistent with the fundamental basis of AU1 and AA1, that of a uncontrolled radioactivity release that indicates a loss of plant control. A dose rate, at or beyond the site boundary, greater than 0.1 mR/hr for 60 minutes or 10.0 mR/hr for 15 minutes is consistent with this fundamental basis, regardless of the lack of numerical correlation to the RETS.

Page 134 10/17/07

A.7 The Impact of Source Term The ODCM methodology should be used for establishing the monitor EAL thresholds for these ICs. The ODCM provides a default source term based on expected releases.

For AS1 and AG1, the bases suggests the use of the same source terms used for establishing monitor EAL thresholds for AU1 and AA1. This guidance is provided to avoid potential overlaps between effluent monitor EALs for AA1 and AS1.

As with meteorology, assessment of source terms has uncertainty. This uncertainty is compensated for by the anticipatory classifications provided by ICs in other recognition categories.

Page 135 10/17/07

Appendix C Basis for Cold Shutdown/Refueling Initiating Conditions Introduction Planning assumptions addressed in the development of the Category C IC/EALs are:

1. Variability of Initial Conditions - There will be a wide variability of initial conditions for the events addressed herein due to different plant configurations that could occur during shutdown periods. During power operations, the Fission Product Barrier Matrix classifies events on the loss or challenge to the fission product barriers. During shutdown conditions, these barriers may have intentionally been defeated. For this reason, these EALs are function and performance-based to the extent possible.

2. Redundancy and Diversity of Instruments - The redundancy and diversity of instruments typically used during power operations may be unavailable during shutdown periods. For example, core exit thermocouples are disconnected prior to removing the reactor vessel head. Loss of forced decay heat removal flow may then render RCS loop or RHR inlet temperature instruments readings invalid. For this reason, these EALs provide for alternative time-based EALs in addition to the instrumentation EALs.

3. Available Decay Heat - The potential for core damage is directly related to the amount of decay heat available. Events that occur earlier in shutdown will have the potential for greater consequence than will events that occur later in shutdown. This threshold would be reached sooner for events that occur early in a shutdown than those that occur late in a shutdown. For this reason, these EALs provide thresholds based on temperature increase.

The core damage potential is a function of the latent heat available and the capability of systems to remove the heat. During shutdown evolutions redundancy of many system components may have been intentionally decreased to facilitate maintenance therefore potentially increasing the probability that an event could lead to core damage.

Available decay heat decreases from time of core shutdown. Approximately 6% of full power core thermal heat is available immediately after shutdown. At 30 days from shutdown, available decay heat is approximately 0.1% reactor power. Therefore the threat of core damage due to decay heat generation decreases over time. Typically, refueling mode is not entered until 80 hours9.259259e-4 days 0.0222 hours 1.322751e-4 weeks 3.044e-5 months after shutdown effectively limiting the availability of decay heat.

4. Release Potential - The radionuclide inventory in the core is approximately 0.6 Ci/watt following extended operation at power. Thus, at shutdown, the core inventory for a typical 3000 Mwt reactor may be as much as 1.8E9 Ci, of which more than 1.0E7 Ci is iodine. With

.the 8.3 day half-life of 1-131, there is a potential for significant radioactivity release well into a shutdown period.

INITIATING CONDITIONS The four initiating conditions classify the shutdown event on the basis of the Potential Loss or Loss of one or more of the cold shutdown barrier functions.

Page 136 10/17/07

General Emergency (GE)

The GE is declared on the occurrence of the loss of function of all three barriers. If all three barriers are lost, the ability to maintain fission product inventory within the containment no longer exists. This represents a direct path for radioactive inventory to be released to the environment. This is consistent with the definition of a GE.

Site Area Emergency (SAE)

The two IC/EALs identified as SAE events are considered to involve the actual or likely losses of plant functions needed for the protection of the public. These IC/EALs represent a loss of one fission product barrier with the potential or actual loss of a second barrier. Additionally the IC/EALs address the status of the containment boundary in the classification scheme. The fact that these IC/EALs call for a SAE reflects the lower latent energy available to cause core melt.

These IC/EALs also reflect the decreased availability of motive force for release of core activity in the unlikely event that fuel damage should occur. This is consistent with the fundamental definition of an SAE.

Alert The four IC/EALs identified as Alert events are considered to represent substantial degradation in the level of safety of the plant. This is consistent with the fundamental definition of an Alert.

Unusual event (UNUSUAL EVENT)

The eight IC/EALs identified as Unusual Event events are considered to represent potential degradation in the level of safety of the plant. This is consistent with the fundamental definition of an Unusual Event.

EXAMPLE EALs The Recognition Category C example IC/EALs are based on concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal, SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues, NUREG-1 449, Shutdown and Low-Power Operationat Commercial Nuclear Power Plantsin the United States, and, NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management. A number of variables, such as initial vessel level, or shutdown heat removal system design, can have a significant impact on heat removal capability challenging the fuel clad barrier. The Loss example EAL represents the inability to restore and maintain reactor vessel level to above the top of active fuel. Fuel damage is probable if reactor vessel level cannot be restored, as available decay heat will cause boiling, further reducing the reactor vessel level.

CU1, CU2, CU4, CA1, CA2, and CA4 IC/EALs are provided to serve as precursors to a loss of heat removal due to loss of inventory or function. CS1 and CS2 example EALs represent a significant loss of RCS inventory. The magnitude of this loss of water indicates that makeup systems have not been effective and may not be capable of preventing further reactor vessel level decrease and potential core uncovery. EAL modifiers such as "for X minutes" are used when indications of level are unavailable to indicate the lack of a success path to restore inventory and the potential for core uncovery. In the context of CS1 and CS2 EALs, "containment closure" is the action taken to secure primary or secondary containment and its associated structures, systems, and components as a functional barrier to fission product Page 137 10/17/07

release under existing plant conditions. CG1 example EALs indicate that core uncovery due to loss of inventory has occurred for a period that could result in core damage. Additionally EALs that describe challenge to the Containment Barrier are included.

Page 138 10/17/07

Appendix E Basis for ISFSI Initiating Conditions Introduction An Independent Spent Fuel Storage Installation (ISFSI) is a complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. An ISFSI which is located on the site of another facility may share common utilities/services and be physically connected with the other facility yet still be considered independent provided, that such sharing of utilities and services or physical connections does not: (1) Increase the probability or consequences of an accident or malfunction of components, structures, or systems that are important to safety; or (2) reduce the margin of safety as defined in the basis for any technical specification of either facility.

A Dry Cask Storage System (DCSS) may be used to store spent nuclear fuel under either a site-specific or general license to operate an ISFSI. At present, any holder of an active reactor operating license under 10 CFR Part 50, has the authority to construct and operate an ISFSI under the provisions of the general license. Requirements for construction and pre-operational activities of such an ISFSI are discussed in Subparts K and L of 10 CFR Part 72. The requirements for pursuing a site-specific ISFSI license are discussed in Subparts B and C of 10 CFR Part 72.

At Seabrook Station, the ISFSI is also referred to as Dry Cask Storage.

E.1 Purpose of the ISFSI IC/EALs The analysis of potential onsite and offsite consequences of accidental releases associated with the operation of an ISFSI is contained in NUREG-1 140, A Regulatory Analysis on Emergency Preparedness for Fuel Cycle and Other Radioactive Material Licensees. NUREG-1140 concluded that the postulated worst-case accident involving an ISFSI has insignificant consequences to the public health and safety. This evaluation shows that the maximum offsite dose to a member of the public offsite due to an accidental release of radioactive materials would not exceed 1 rem effective dose equivalent or an intake of 2 milligrams of soluble uranium (due to chemical toxicity).

The Final Rule governing Emergency Planning Licensing Requirements for Independent Spent Fuel Storage Facilities was posted in the Federal Register on June 22, 1995 (Federal Register Volume 60, Number 120 June 22, 1995, Pages 32430-32442). The rule indicated that a significant amount of the radioactive material contained within a cask must escape its packaging and enter the atmosphere for there to be a significant environmental impact resulting from an accident involving the dry storage of spent nuclear fuel. There are two primary factors that protect the public health and safety from this unlikely dry storage radioactive material release event.

The first deals with regulatory requirements imposed on the design for the cask. Regulatory requirements have sufficient safety margins so that (during normal storage cask handling operations, off-normal events, adverse environmental conditions, and severe natural phenomena) the casks can not release a significant part of its inventory to the atmosphere.

Page 139 10/17/07

The second factor deals with the cask general design criteria. The cask criteria requires that 1) design provides confinement safety functions during the unlikely but credible design basis events, 2) the fuel clad must be protected against degradation that leads to gross rupture, and

3) the fuel must be retrievable. These general design criteria place an upper bound on the energy a cask can absorb before the fuel is damaged. No credible dynamic events were identified that could impart such significant amounts of energy to a storage cask after that cask is placed at the ISFSI. The second factor also considers the lack of dispersal mechanisms and the age of the spent fuel. There is no significant dispersal mechanism for the radioactive material contained within a storage cask. Spent fuel required to be stored in an ISFSI must be cooled for at least 1 year. Based on the design limitations of most cask systems, the majority of spent fuel is cooled greater than 5 years. At this age, spent fuel has a heat generation rate that is too low to cause significant particulate dispersal in the unlikely event of a cask confinement boundary failure. Consequently, formal offsite planning is not required because the postulated worst-case accident involving an ISFSI has insignificant consequences to the public health and safety.

10 CFR 72.32 provides two means for satisfying its requirements. 10 CFR 72.32 (a) requires that the application for an ISFSI be accompanied by an Emergency Plan. 10 CFR 72.32 (c) allows that the emergency plan required by 10 CFR 50.47 for a nuclear power reactor licensed for operation by the Commission shall be deemed to satisfy the requirements for an ISFSI located on the site or located within the exclusion area as defined in 10 CFR 100. 10 CFR 72.32 (a) requires that an ISFSI Emergency Plan include a classification system for classifying accidents as "alerts". In contrast to the 10 CFR 72.32 requirements, regulations governing 10 CFR 50.47 emergency plans specify four emergency classes: (1) unusual events, (2) alert, (3) site area emergency, and (4) general emergency, and require a determination of the adequacy of onsite and offsite emergency plans. 10 CFR 72.212(b)(6) requires that a general licensee review its reactor emergency plan to determine if its effectiveness is decreased and make necessary changes.

The expectations for offsite response to an "alert" classified under a 10 CFR 72.32 emergency plan are generally consistent with those for a unusual event in a 10 CFR 50.47 emergency plan, i.e., to provide assistance if requested. Even with regard to activation of a licensee's emergency response organization (ERO), the ERO for a 10 CFR 72.32 emergency plan is not that prescribed under a 10 CFR 50.47 emergency plan, e.g., no Emergency Technical Support.

Consequently, the "alerts" contemplated by 10 CFR 72.32, have been classified as Unusual Events herein. To do otherwise could lead to an inappropriate response posture on the part of offsite response organizations.

NUREG-1567, Standard Review Plan for Spent Fuel Dry Storage Facilities, descriptions of initiating events appear below:

" Fire onsite that might affect radioactive material of systems important to safety

" Severe natural phenomenon projected to occur that might affect radioactive material or systems important to safety (e.g., flood, tsunami, hurricane, tidal surge, hurricane force winds)

Severe natural phenomenon or other incidents have occurred that may have affected radioactive material or systems important to safety, but initial assessment is not complete (e.g., beyond design basis earthquake, flood, tsunami, hurricane, tidal surge, hurricane force winds, tornado missiles, explosion, release of flammable gas) 0 Elevated radiation levels or airborne contamination levels within the facility indicate severe loss of control (factor of 100 over normal levels)

Page 140 10/17/07

" Ongoing security compromise (greater than 15 minutes)

Accidental release of radioactivity within building confinement barrier (pool or waste management facility)

Discovery of condition that creates a criticality hazard

" Other conditions that warrant precautionary activation of the licensee's emergency response organization Note that 10 CFR 72.32 also discusses emergency planning license application requirements for Monitored Retrievable Storage Facilities (MRS) and for ISFSls that may process and/or repackage spent fuel. 10 CFR 72.32 (b) requires that an Emergency Plan for an MRS or one of these more complex ISFSls include a classification system for classifying accidents as "alerts" or "site area emergencies." NUREG-1567 provides a list of events that may initiate a site area emergency at one of these facilities. However, these facilities are beyond the scope of this discussion.

NUREG-1536, Standard Review Plan for Dry Cask Storage Systems, provides guidance for performing safety reviews of applications for approval of spent fuel DCSS. The principal purposes of the DCSS Standard Review Plan (SRP) are to ensure the quality and consistency of staff reviews and to establish a well-defined basis from which to evaluate proposed changes in the scope of reviews.

Accidents and events associated with natural phenomena may share common regulatory and design limits. By contrast, anticipated occurrences (off-normal conditions) are distinguished, in part, from accidents or natural phenomena by the appropriate regulatory guidance and design criteria. For example, the radiation dose from an off-normal event must not exceed the limits specified in 10 CFR Part 20 and 10 CFR 72.104(a), whereas the radiation dose from an accident or natural phenomenon must not exceed the specifications of 10 CFR 72.106(b).

Accident conditions may also have different allowable structural criteria.

According to NUREG 1536, the following accidents should be evaluated in the SAR. Because of the NRC's defense-in-depth approach, each should be evaluated regardless of whether it is highly unlikely or highly improbable. These do not constitute the only accidents that should be addressed if the SAR is to serve as a reference for accidents for the site-specific application.

Others that may be derived from a hazard analysis could include accidents resulting from operational error, instrument failure, lightning, and other occurrences. Accident situations that are not credible because of design features or other reasons should be identified and justified in the SAR.

Section 2.0-V.2.b(3) - Accident Conditions (a) Cask Drop (b) Cask Tipover (c) Fire (d) Fuel Rod Rupture (e) Leakage of the Confinement Boundary (f) Explosive Overpressure (g) Air Flow Blockage

Section 2.0-V.2.b(4) - Natural Phenomena Events (a) Flood (b) Tornado (c) Earthquake (d) Burial under Debris Page 141 10/17/07

(e) Lightning (f) Other natural phenomena events (including seiche, tsunami, and hurricane)

The emergency classifications used are those provided by NUREG 0654/FEMA Rep.l.

Unusual Event classifications provide an increased awareness for abnormal conditions. The source term and motive force available at a simple ISFSI is insufficient to warrant classifications above the Unusual Event level using the 10 CFR 50 emergency classification scheme.

Section 3.3 of NUMARC/NESP-007 emphasizes the need for accurate assessment and classification of events. It is intended that primary emphasis be placed on observable conditions in classifying emergency events. For an ISFSI, these conditions are primarily associated with the CONFINEMENT BOUNDARY of a loaded fuel storage cask.

E.2. Initiating Conditions Unusual Event (E-HU1) Damage to a loaded cask CONFINEMENT BOUNDARY.

The STED/SED has the discretion to classify events based on the classification level definitions. This discretion should be used when conditions or events are observed and no specific IC/EAL is apparent. The Unusual Event will heighten awareness of the abnormal condition. Natural phenomena events and accident conditions are classified at the Unusual Event level in the event that a loaded cask CONFINEMENT BOUNDARY is damaged or violated.

Page 142 10/17/07

SBK-L-06227, Enclosure 3 to Fple Letter SBK-L-06227 - Ealdbd, Rev a, Seabrook Emergency Action Level Design Basis Document

Contents

Text

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Navigation menu

SBK-L-06227, Enclosure 3 to Fple Letter SBK-L-06227 - Ealdbd, Rev a, Seabrook Emergency Action Level Design Basis Document

Text

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Reference:

Navigation menu

Search