NG-18-0090, Response to Request for Additional Information Regarding License Amendment Request (TSCR-166), Adoption of Emergency Action Level Scheme Pursuant to NEI 99-01, Revision 6, Development of Emergency Action Levels for Non-Passive Reactors. (

Response to Request for Additional Information Regarding License Amendment Request (TSCR-166), Adoption of Emergency Action Level Scheme Pursuant to NEI 99-01, Revision 6, Development of Emergency Action Levels for Non-Passive Reactors. (Pa

ML18212A231
Person / Time
Site:	Duane Arnold
Issue date:	07/26/2018
From:	NextEra Energy Duane Arnold
To:	Office of New Reactors
References
NG-18-0090
Download: ML18212A231 (125)

Text

NEI 99 QI (RevisioA

6) }>Joye me er 2Q 12 10 HAZARDS AND OTHER CONDITIONS AFFECTING PLANT SAFETY ICS/EALS 17 9

}>ffil 99 QI (RevisioR e) November 2012 Tal>le H 1: Reeognition CategoFY "H" Initiating Condition MatFix UNUSUAL EVENT HUl Confirmed SECURITY CONDITION or Op. A1edes: All HU2 Seismic e 1 ,rent greater than OBE Op. A1edes: All HUJ Hazardous e¥eflt Op. A1edes: All HU4 FIRE potentially degrading the level of safety of the plant. Op. },1edes: All ALERT HAl HOSTILE ACTION within the OWNER CO~ffROLLED AREA or airborne attack threat *within 30 minutes. Op. },fades: All HA5 Gaseous release impeding access to equipment necessary for normal plant operations, cooldown or shutdo 1 Nn. Op. ,\1edes: All Hf...(i Control Room evacuation resulting in transfer of plant control to alternate locations.

Op. ,\1edes: All SITE AREA EMERGENCY HSl HOSTILE ACTION within the PROTECTED AREA. Op. A1edes: All HS(i Inability to control a key safety function from outside the Control Room. Op. },1edes: All 180 I GENERAL EMERGENCY HGl HOSTILE ACTION resulting in loss of physical control of the facility.

Op. ,\1edes: All Table intended for use by 1 EAL deYelopers.

lnelusion in lieensee : doeurnents is not required.

L------------------J UNUSUAL EVENT HU7 Other conditions exist which in the judgment of the Emergency Director 1tvarrant deelaration of a (NO)UE. Op. J,1odes: All ALERT HA7 Other conditions e>,ist which in the judgment of the Emergency Director warrant deelaration ofan Alert. Op. A/odes: All ECL: Notification of Unusual Event SITE AREA EMERGENCY HS7 Other conditions e>,ist which in the judgment of the Emergency Director warrant deelaration of a Site Area Emergency.

Op. A1ode s: All Initiating Condition:

Confirmed SECURITY CONDITION or threat. Operating Mode Applicability:

All Emergency Action Levels: NE! 99 01 (RevisioR

6) November 2012 GENERAL EMERGENCY HG7 Other conditions e>,ist which in the judgment of the Emergency Director warrant declaration of a General Emergency.

Op. ,\1odes: All HU1 E xample Emergency Action Levels: (1 or 2 or 3) A SECURJTY CONDITION that does not involve a HOSTILE ACTION as reported by the (site specific security shift supervision).DAEC Security Shift Supervision. Notification of a credible security threat directed at the siteDAEC. A validated notification from the NRC providing information of an aircraft threat. Definitions:

SECURITY CONDITION:

Any Security Event as listed in the approved security contingency plan that constitutes a threat/compromise to site security, threat/risk to site personnel, or a potential degradation to the level of safety of the plant. A S E CURITY CONDITION does not involve a HOSTILE ACTION. HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment , take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. -terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). 181

}ffil 99 0 I (Re,*isioA 6) }fo 1 remeer 2012 SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including theincluding the ECCS. These systems are classified as safety-related.

Basis: This IC addresses events that pose a threat to plant personnel or SAFETY SYSTEM equipment , and thus represent a potential degradation in the level of plant safety. Security events which do not meet one of these EALs are adequately addressed by the requirements of 10 CFR f-73.71 or 10_-CFR--§ 50.72. Security events assessed as HOSTILE ACTIONS are classifiable under ICs HAI, HSI and HGl. Timely and accurate communications between DAEC Security Shift Superv i sion and the Control Room is essential for proper classification of a security-related event. Classification of these events will initiate appropriate threat-related notifications to plant personne l and GRGoffsite response organization

s. 182 NEI 99 QI (RevisieA a) !>foveme er 2012 Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan , Training and Qualification Plan , Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.

183 NEI 99 Q 1 (ReYisioA

• i) l'loYeFAeeF 2Q12 EAL HUI.I references (site specific security shift supervision)DAEC Security Shift Supervision because these are the indi vidua l s trained to co nfirm that a security event i s occurring or has occ urr ed. Training on security event confirmation and classification i s controlled due to the nature of Safeguards and 10 CFR § 2.39 Q inform atio n. EAL HUI.2 addresses the receipt of a credib l e security threat. The credibi lity of the threat is assessed in accordance with Abnormal Operating Procedure (AOP) 914, Security Events. specific procedure). EAL HU 1.3 addresses the threat from the impact of an aircraft on the plant. The NRC Headquarters Operations Officer (HOO) wi ll comm unicat e to the li censee i f the threat inv olves an aircraft.

T h e status and size of the plane may also be provided by NORAD through the NRC. Validation of the threat i s performed in accordance w ith (site specific procedure)

Abnormal Operating Procedure (AOP) 914, Security Events . .,. Emergency plans and implementing procedures are public documents; therefore , EALs should do not in corporate Security-sensitive in formation. This includ es information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat l ocat ion. Security-sensitive information should beis contained in non public documents such as the Security Plan. Esca l ation of the emerge n cy class ific ation l eve l wou ld be via IC HA 1. Developer Notes: The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force. The (site specific procedure) is the procedure(s) used by Control Room and/or Security personnel to determine if a security threat is credible, and to validate receipt of aircraft threat information.

Emergency plans and implementing procedures are public documents; therefore, E/\Ls should not incorporate Security sensitive information. This includes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location.

Security sensitive information should be contained in non public documents such as the Security Plan. With due consideration given to the above developer note, EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures.

Such references should not contain a recognizable description of the event. For example , an EAL may be worded as "Security event #2, #5 or #9 is reported by the (site specific security shift supervision)

." EGL Assignment Attributes:

3 .1.1.A 184 NEI 99 0 I (Re 1 1isioR 6) }io¥ember 2012 ECL: Notification of Unusual Event Initiating Condition:

Seismic event greater than OBE levels. Operating Mode Applicability:

All Exa1Rple Emergency Action Levels: H 2.1 Seismic event greater than Operating Basis Earthquake (OBE) as indicated by+ HU2 --+----receipt of the Amber Operating Basis Earthquake Light and the wailing seismic alarm on IC35. Definitions:

DESIGN BASIS EARTHQUAKE (DBE): A DBE is vibratory ground motion for which certain (generally, safety-related) structures.

systems, and components must be designed to remain functional.

OPERATING BASIS EARTHQUAKE (OBE): An OBE is vibratory ground motion for which those features of a nuclear power plant necessary for continued operation without undue risk to the health and safety of the public will remain functional.

Basis: This IC addresses a seismic event that results in accelerations at the plant site greater than those specified for an Operating Basis Earthquake (OBE t. An earthquake greater than an OBE but less than a Safe ShutdownDesign Basis Ear thquake (SSeDBE)i should have no significant impact on safety-related systems, structures and components; however , some time may be required for the plant staff to ascertain the actual post-event condition of the plant (e.g., performs walk-downs and post-event inspections).

Given the time necessary to perform walk-downs and inspections, and fully under sta nd any impacts , this event represents a potential degradation of the level of safety of the plant. Eve nt verification with external sources s hould not be necessary durin g or following an OBE. Ea rthquakes of this magnitude should be readily felt by on-site personnel and recognized as a se ismic event (e.g., typical lateral accelerations are in e>wess of 0.08g). The Shift Manager or E mergenc y Director ma y seek external verification if deemed appropriate ( e.g., a call to the + AR OBE is ¥ibratory grouRd motioR fur whieh those features ofa Ruelear power plaRt Reeessary for eoRtiRued operatioR without uRdue risk to the health aRd safety of the publie will remaiR fuAetioAal.

! AR SSE is Yibratory grouRd motioR fur whieh eertaiR (geRerally, safety related) struetures , systems , aAd eompoReRts must be desigRed to remaiR fuAetioRal.

185 NEI 99 0 I (Re\*ision

6) NoYember 2012 USGS , check internet news so urces , etc.); however , the verification action must not preclude a timely emergency declaration.

OBE events are detected in accordance with AOP 901. The OBE is associated with a peak horizontal acceleration of+/- 0.06g. Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or .£.A.9SA8. De"-1 el0per Netes: This "site specific indication that a seismic event met or exceeded QBE limits" should be based on the indications, alarms and displays of site specific seismic monitoring equipment.

Indications described in the EAL should be limited to those that are immediately available to Control Room personnel and which can be readily assessed. Indications available outside the Control Room and/or 1.vhich require lengthy times to assess (e.g., processing of scratch plates or recorded data) should not be used. The goal is to specify indications that can be assessed within 15 minutes of the actual or suspected seismic event. For sites that do not have readily assessable QBE indications within the Control Room, developers should use the following alternate EAL (or similar 1.vording). (1) a. b. Control Room personnel feel an actual or potential seismic event. The occurrence of a seismic event is confirmed in manner deemed appropriate by the Shift Manager or Emergency Director.

The EAL l .b statement is included to ensure that a declaration does not result from felt vibrations caused by a non seismic source (e.g., a dropped heavy load). The Shift Manager or Emergency Director may seek e><ternal verification if deemed appropriate (e.g., a call to the USGS, check internet nev,rs sources, etc.); howe*,rer, the verification action must not preclude a timely emergency declaration.

It is recognized that this alternate EAL *.vording may cause a site to declare an Unusual Event *while another site , similarly affected but with readily assessable QBE indications in the Control Room, may not. The above alternate

• n<ording may also be used to develop a compensatory EAL for use during periods vrhen a seismic monitoring system capable of detecting an QBE is out of service for maintenance or repair. EGL Assignment Attributes:

3.1.1.A 186 NEI 99 Q 1 (ReYision

6) No 1 1ember 2Ql2 HU3 ECL: Notification of Unu s ual Event Initiating Condition:

Hazardous event.§ Operating Mode Applicability:

All Emergency Action Levels: Example EmeFgeney Aetion Levels: (1 or 2 or 3 or 4 or 5 or 6) Note: E AL HU3.4 does not apply to routine traffic impediments such as fog , snow , ice , or vehicle breakdown s o r accident s. ~1 !k 2 H~J3.3 H LJ 3.4 A tornado strike within the PROTECTED AREA. Internal room or area floodin g of a magnitude sufficient to require manual or automatic electrical isolation of a SAFETY SYSTEM component needed for the current operating mode. Movement of personnel within the PROTECT E D AREA is impeded due to an offsite event involving hazardous materials (e.g., an offsite chemical spill or toxic gas release).

A hazardous event that results in on-site condition s sufficient to prohibit the plant staff from accessing the site via personal vehicles. Definitions:

PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan. SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related

.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the EGGS. Systems classified as safety re l ated. Basis: This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant. EAL HU3.1 addresses a tornado striking (touching down) within the Protected Area. E AL HU3.2 addresses floodin g of a building room or area that results in operators isolating power to a SAFETY SYST E M component due to water level or other wetting concerns.

Classification is also required if the water level or related wetting causes an automatic isolation of a SAF E TY SYSTEM component from its power source ( e.g., a breaker or relay trip). To 187 Jloffil 99 01 (Revision a) Jl,fo,,cember 2012 warrant classification , operability of the affected component must be required by Technical Specifications for the current operating mode. EAL HU3.3 addresses a hazardous materials event orig in ating at an offsite location and of sufficient magnitude to impede the movement of personnel within the PROTECTED AREA. 188 NEI 99 01 (RevisioR e) NoYeR'leer 2012 EAL HU3.4 addresses a hazardous event that causes an on-site impediment to vehicle movement and significant enough to prohibit the plant staff from accessing the site using personal vehicles.

Examples of such an event include site flooding caused by a hurricane , heavy rains, up-river water releases , dam fai lur e , etc., or an on-site train derailment blocking the access road. This EAL is not intended apply to routine impediments such as fog , snow, ice, or ve hicl e breakdowns or accidents , but rather to more s i gnificant conditions such as the Hurricane Andrew strike on Turkey Point in 1992 , the flooding around the Cooper Stat i on during the Midwest floods of 1993, or the flooding around Ft. Ca lh oun Station in 2011. EAL .H..!LL5 addresses (site specific description). . Escalation of the emergency classification l eve l wou ld be based on I Cs in Recognition Categories AR , F, Sor C. De'i'elepeF Netes: The "Site specific list of natural or technological hazard events" should include other events that may be a precursor to a more significant event or condition , and that are appropriate to the site location and characteristics. Notwithstanding the events specifically included as EALs above , a " Site specific list of natural or technological hazard events" need not include short lived events for which the extent of the damage and the resulting consequences can be determined 1.vithin a relatively short time frame. In these cases , a damage assessment can be performed soon after the event, and the plant staff 1.vill be able to identify potential or actual impacts to plant systems and structures.

This 1.vill enable prompt definition and implementation of compensatory or corrective measures with no appreciable increase in risk to the public. To the e>, tent that a short lived event does cause immediate and significant damage to plant systems and structures, it will be classifiable under the Recognition Category f, S and C ICs and EALs. Events of lesser impact would be e>,pected to cause only small and localized damage. The consequences from these types of events are adequately assessed and addressed in accordance with Technical Specifications.

In addition , the occurrence or effects of the event may be reportable under the requirements of 10 CFR 50.72. EGL Assignment Attributes:

3.1.1.A and 3.1.1.C 189 NEI 99 Q l (RtwisieR e) Ne¥ember 2012 HU4 ECL: Not ificati on of U nu s u a l Eve nt Initiating Condition:

F I RE potentially degrading the lev el of safety of the plant. Operating Mode Applicability:

All Emergency Action Levels: Example Emergeeey Aetiee Levels: (1 or 2 or 3 or 4) Note~:

• T h e E m ergency Director s hould declar e the Unusual Eventevent promptl y upon determining that the app li ca ble time ha s b ee n exceede d , or will lik e l y b e excee ded. H LJ 4.l a. A FIRE i s NOT ext in guis h ed w ithin 15-minutes of ANY of the follow in g FIRE d e t ectio n indi catio ns: H 4.2 H 4.4

• Report from the field (i.e., visual observation)

• Receipt of multiple (more than 1) fire alarms or indi cat i o n s

• Fie ld verificat ion of a s in g l e fire a l ar m AND b. The FIRE i s l oca ted w ithin ANY of the followingTable H-1 plant rooms or areas+ a. (site specific list of plant rooms or areas) Receipt of a sing l e fire alarm ~with n o other indications of a FIRE j. ---AND b. The FIRE i s l ocate d w ithin ANY of the followingTable H-1 plant roo m s or areas (site specific I ist of plant rooms or areas) ----AND c. The ex i ste nc e of a FIRE is not verified within 3 0-minut es of a larm receipt. A FIRE w ithin the plant or ISFSI [forplemts wit.Li an ISFSI eutside t,l1ep/a,9t Preteeted Afe.at-PROTECTED AREA n ot ext in g ui s h ed within 60-minutes of the initi a l report , alar m or indication.

A FIRE w ithin the pl ant or ISF SI [for plants wit.Li an ISFSI eutside the plant Pfflteeted Afe.at-PROTECTED AREA that requires firefighting s upp ort by an offs it e fire response agency to extinguish.

Table H-1 Fire Areas 190

• I G31 DG and Day Tank Rooms,

• I G21 DG and Day Tank Rooms,

• Battery Rooms,

• Essential Switchgear Rooms,

• Cable Spreading Room

• Torus Room * ~Intake Structure;

• Pumphouse

• Drywell,

• Torus

• NE. NW. SE Corner Rooms,

• HPCI Room,

• RCIC Room,

• RHR Va l ve Room,

• North CRD Area,

• South CRD Area,

• CSTs

• Control Building,

• Remote Shutdown Panel I C388 Area,

• Panel ICSS/56 Area;

• SBGTRoom 191 Jl,ffil 99 g I (ReyisioR e) jl,fo,,cemeer 2('.)12 Definitions:

NEI 99 0 I (ReYisioR

6) }fo 1 i8FR88F 20] 2 FIRE: Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

PROTECTED AREA: The area under continuous access monitoring and control. and armed protection as described in the site Security Plan. Basis: This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant. E AL HU4.1 The intent of the 15-minute duration i s to size the FIRE and to discriminate against small FIRES that are readi l y extinguished (e.g., smoldering waste paper basket). In addit ion to alarms , other indications of a FIRE cou ld be a drop in fire main pressure , automatic activation of a suppression system , etc. Upon receipt , operators will take prompt actions to confirm the validity of an initial fire alarm , indication , or report. For EAL assessment purposes , the emergency declaration clock starts at the time that the initial alarm , indication , or report was received , and not the time that a subsequent verification action was performed.

Similarly , the fire duration clock also starts at the time ofreceipt of the initial alarm , indication or report. EAL HU4.2 This EAL addresses receipt of a sing l e fire a l arm , and the existence of a FIRE is not verified (i.e., proved or disproved) within 30-minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire a l arm. For EAL assessment purposes , the 30-minute clock starts at the time that the initial alarm was received , and not the time that a subsequent verification action was performed.

A single fire alarm , absent other indication(s) of a FIRE , may be indicative of equipment failure or a spurious activation , and not an actual FIRE. For this reason , additiona l time is allowed to verify the valid it y of the alarm. The 30-minute period is a reasonable amount of time to determine if an actual FIRE exists; however , after that time, and absent information to the contrary , it is assumed that an actual FIRE is in progress.

192

~IBI 99 01 (ReYisioA

6) ~Jovemeer 20 I 2 If an actual FIRE is verified by a report from the field, then EAL HU4.1 is immediately applicable, and the emergency must be declared if the FIRE is not extinguished within 15-minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation , and this verification occurs within 30-minutes of the receipt of the alarm , then this EAL is not applicable and no emergency declaration is warranted.

EAL HU4.3 In addition to a FIRE addressed by EAL HU4.1 or EAL HU4.2, a FIRE within the plant or ISFSI PROTECTED AREA not extinguished within 60-minutes may also potentially degrade the level of plant safety. This basis extends to a FIRE occurring within the PROTECTED AREA of an ISFSI located outside the plant PROTECTED AREA. [Sentence for plants with an ISFSI outside the plant Protested i\rea] EAL HU4.4 If a FIRE within the plant or ISFSI [for plants with tm ISFSI eutside the plant PretectedArea]

PROTECTED AREA is of sufficient size to require a response by an offsite firefighting agency ( e.g., a local town Fire Department), then the level of plant safety is potentially degraded. The dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts because the fire is beyond the capability of the Fire Brigade to extinguish.

Declaration is not necessary if the agency resources are placed on stand-by, or supporting post-extinguishment recovery or investigation actions. Basis-Related Requirements from Appendix Rand NFPA-805 Criterion 3 of Appendix A to 10 CFR 50 states in part that "structures, systems, and components important to safety shall be designed and located to minimize.

consistent with other safety requirements, the probability and effect of fires and explosions

." The Nuclear Safety Goal (" NSG") in NFPA 805, Section 1.3.1 states, "The nuclear safety goal is to provide reasonable assurance that a fire during any operational mode and plant configuration will not prevent the plant from achieving and maintaining the fuel in a safe and stable condition." When considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance because a safe shutdown success path, free of fire damage, must be available to meet the nuclear safety goals, objectives and performance criteria for a fire under any plant operational mode or configuration.

Because fire may affect safe shutdown systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post-fire conditions does not per se impact public safety. the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents.

193 J>ffil 99 O 1 (Re,*isioR e) J>fo*yemaer 2012 In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of I-hour fire barriers for the enclosure of cable and equipment and associated non-safety circuits of one redundant train (G.2.c). Even though DAEC has adopted the alternate approach provided by NFPA-805 in lieu of the deterministic requirements of Appendix R, the 30-minutes to verify a single alarm as used in EAL HU4.2 is considered a reasonable amount of time to determine if an actual FIRE exists without presenting a challenge to the nuclear safety performance criteria.Basis Related Requirements from Appendix R Appendi>l R to 10 CFR 50 , states in part: Criterion 3 of Appendi>, A to this part specifies that "Structures , systems, and components important to safety shall be designed and located to minimize , consistent 1.vith other safety requirements , the probability and effect of fires and e>,plosions." '.¥hen considering the effects of fire, those systems associated 1.vith achieving and maintaining safe shutdovm conditions assume major importance to safety because damage to them can lead to core damage resulting from loss of coolant through boil off. Because fire may affect safe shutdovm systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents.

In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> fire barriers for the enclosure of cable and equipment and associated non safety circuits of one redundant train (G.2.c). As used in EAL #2 , the 30 minutes to verify a single alarm is ,veil within this worst case 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> time period. Depending upon the plant mode at the time of the event, escalation of the emergency classification level wou ld be via IC CA6 or SA-9SA8. De...eloper Notes: The "site specific list of plant rooms or areas" should specify those rooms or areas that contain SAFETY SYSTEM equipment.

As noted in the EALs and Basis section , include the term ISFSI if the site has an ISFSI outside the plant Protected Area. EGL Assignment Attributes:

3 .1.1.A 194 ECL: Notification of Unusual Event NEJ 99 01 (RevisioA

6) ~fo*,<emeer 2012 HU-76 Initiating Condition:

Other conditions exist which in the judgment of the Emergency Director warrant declaration of a fN 0 1 UE. Operating Mode Applicability:

All l Exemple Emergency Action Levels: 1 Other conditions exist which in the judgment of the Emergency Director indicate that events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated.

No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of SAFETY SYSTEMS safety systems occurs. Definitions:

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or p l acing it in the cold shutdown condition, i nc l uding the ECCS. These systems are classified as safety-related

.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdovm condition, including the EGGS. Systems classified as safety re l ated. Basis: This IC addresses unanticipated conditions not addressed explicit l y elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fa ll under the emergency classificat i on level description for a NOUE. 195 NEJ 99 QI (RevisioR

6) No 1 t'0FR00F 2()12 HA1 ECL: Alert Initiating Condition:

HOSTILE ACTION within the OWNER CONTROLLED AREA or airborne attack threat within 30 minutes. Operating Mode Applicability:

All Example Emergency Action Levels.:.: (1 or 2) A HOSTILE ACTION is occurring or has occurred within the OWNER CONTROLLED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision. A validated notification from NRC of an aircraft attack threat within 30 minutes of the site. Definitions:

HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). OWNER CONTROLL E D AREA: The site property owned by or otherwise under the control of the licensee. PROJECTILE

An object directed toward a nuclear power plant that could cause concern for its continued operability , reliability , or personnel safety. Basis: This IC addresses the occurrence of a HOSTILE ACTION within the OWNER CONTROLLED AREA or notification of an aircraft attack threat. Th i s event will require rapid response and assistance due to the possibi l ity of the attack progressing to the PROTECTED AREA, or the need to prepare the plant and staff for a potential aircraft impact. Timely and accurate communications between DAEC Security Sh i ft Supervision and the Control Room is essentia l for proper c l assification of a security-re l ated event. Security plans and terminology are based on the guidance provided by NEI 03-12 , Template for the Security Plan , Training and Qualification Plan , Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.

196 NEI 99 0 I (RevisioA

• i) NoYeFAeer 2012 As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures ( e.g., evacuation , dispersal or sheltering).

The Alert declaration will also heighten the awareness of Offsite Response Organizations, allowing them to be better prepared should it be necessary to consider further actions. This IC does not apply to incidents that are accidental events, acts of civil disobedience , or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft , shots from hunters , physical disputes between employees , etc. Reporting of these types of events is adequately addressed by other EALs , or the requirements of 10 CFR-§-73.71 or 10 CFR-§-50.72. EAL HA I.I is applicable for any HOSTILE ACTION occurring , or that has occurred , in the OWNER CONTROLLED AREA. This includes any action directed against att-the ISFSI that which is located outside the plant PROTECTED AREA. EAL HAI .2 addresses the threat from the impact of an aircraft on the plant, and the anticipated arrival time is within 30 minutes. The intent of this EAL is to ensure that threat-related notifications are made in a timely manner so that plant personnel and GRGoffsite response organization s are in a heightened state of readiness.

This EAL is met when the threat-related information has been validated in accordance with fAbnormal Operating Procedure (AOP) 914, Security Events site specific procedure).§.,_

The NRC Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft.

The status and size of the plane may be provided by NORAD through the NRC. In some cases , it may not be readily apparent if an aircraft impact within the OWNER CONTROLLED AREA was intentional (i.e., a HOSTILE ACTION). It is expected , although not certain , that notification by an appropriate Federal agency to the site would clarify this point. In this case , the appropriate federal agency is intended to be NORAD , FBI , FAA or NRC. The emergency declaration , including one based on other ICs/EALs , should not be unduly delayed while awaiting notification by a Federal agency. Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information.

This includes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location.

Security-sensitive information should be ~contained in non public documents such as the Security Plan. Escalation of the emergency classification level would be via IC HS 1. DevelopeF Notes: The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force. Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location.

Security sensitive information should be contained in non public documents such as the Security Plan. 197

~ffil 99 0 I (Re*,isioA e) urth 8 . November 201? .r1ue cons1aeration given to the abo*c e ., -**~hoR>0 :'*'°'""***

te soloote0 ovoAls Bosoribo~

iElet~el';J'er

• .***. EALs "'"'.I ***teio alpha e, imp ementmg proceaures.

Such references h la n e ec~nty Plan ans associates event. For e:irnm I e s ou not contam a re

• bl . ( * . ----p*e , ao -AL fllay be wer0e8 as " S _eeg,,,za

• Elesenptieo efthe site specific security shift supervision)." ecunty event #2 , #5 or #9 is reportea by the See the relates Developer Note . A

• aevelopment of a scheme aefinition for1:h;*~~~~~~BCgefinitions , for guiaance on the ** }>HROLLBD A~ A eCL Assignment Attributes:

3.1.2.D '..:. n. 198 NEI 99 01 (RevisioR e) ?>lovember 2012 HA5 ECL: Alert Initiating Condition:

Gaseous release impeding access to equipment necessary for normal plant operations , cooldo'+'m , or shutdown. Operating Mode Applieal>ility:

All Example Emergeney Aetion Levels: Note: If the equipment in the listed room or area \Vas already inoperable or out of service before the event occurred , then no emergency classification is warranted.

follo'+'i'ing plant rooms or areas: (site specific I ist of plant rooms or areas 1 Nith entry related mode applicability identified) ,t\..l\JD

b. Entry into the room or area is prohibited or impeded. This IC addresses an event involving a release of a hazardous gas that precludes or impedes access to equipment necessary to maintain normal plant operation, or required for a normal plant cooldown and shutdown. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An Alert declaration is warranted if entry into the affected room/area is, or may be , procedurally required during the plant operating mode in effect at the time of the gaseous release. The emergency classification is not contingent upon whether entry is actually necessary at the time of the release. Evaluation of the IC and EAL do not require atmospheric sampling; it only requires the Emergency Director's judgment that the gas concentration in the affected room/area is sufficient to preclude or significantly impede procedurally required access. This judgment may be based on a variety of factors including an existing job hazard analysis , report of ill effects on personnel, advice from a subject matter ex.pert or operating e>tperience vrith the same or similar hazards. Access should be considered as impeded if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment , such as SCBAs , that is not routinely employed).

An emergency declaration is not 1 Narranted if any of the following conditions apply.

• The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the gaseous release).

For e>rnmple, the plant is in Mode 1 1.vhen the gaseous release occurs , and the procedures used for normal operation , cooldown and shutdown do not require entry into the affected room unti I Mode 4 . 199

h. h address the r , measures 'tV ie . ludes compensate. Y , tern testing). . :~:::;:::*;;;n;e~d;a~c~ftp~,'i~t)~

'~ th~a~t;m:;c;;Efir:es:u:p:p:re:s:s:10:n::S)~:s*:::re:c:o:r:dk:e:e:pm:g

• TAe gas ,el ease IS a.:'~~ efa roam a, area (e.g;j is ef!lfl admiaistrot,ve e, erary iaaeeess, , , rea eat,y is req**ff> d "*euld Rel temp . fer wAieA ,eem,a fRe iRSj)eet10as).

f """'Y """'"'* aA "

• The action I rounds or mu I 'ati, '0 or precau I E norma f consen

• naturee.g., I easures are o a . The aeeess eeRtro* '." ede a required aeheA. d . te daagerous levels. aeUJally preveat er ,mp . tAe level ef eKygea iR !lie ~=s:.i eaviroameat. -!~" al,le ef redue1ag . I eiag aiflA aa eae * ., 4.ieA eaa lea e ' R aspAy,<iaat is a ga s *IIJ' ats werk l,y merely d1Sp ** al !~tel ef al'0uad 19 ,S , " n moni)', asphyxia , n below the nor Mest eem eRtmtiea ef e*) ge """" deatla. reduces the cone I

• unconsciousness , or 200 201 NEI 99 O 1 (RevisieR e) },fovemaer 2012 ECL: Alert NEI 99 01 (RevisioR e) ~fo*refReer 2012 HA6HA5 Initiating Condition:

Control Room evacuation resulting in transfer of plant control to alternate locations.

Operating Mode Applicability:

All Example Emergency Action Level s: H 65.1 An event has resulted in plant control being transferred from the Control Room to specific remote shutdo 1 Nn panels and local control stations)the Remote Shutdown Panel (1 C388). Definitions:

Basis: This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations outside the Control Room. The loss of the ability to control the plant from the Control Room is considered to be a potential substantial degradation in the level of plant safety. Following a Control Room evacuation , control of the plant will be transferred to alternate shutdown locations.

The necessity to control a plant shutdown from outside the Control Room , in addition to responding to the event that required the evacuation of the Control Room , will present challenges to plant operators and other on-shift personnel.

Activation of the ERO and emergency response facilities will assist in responding to these challenges. Escalation of the emergency classification level would be via IC HS 62_. Developer Notes: The "site specific remote shutdovrn panels and local control stations" are the panels and control stations referenced in plant procedures used to cooldown and shutdown the plant from a location(s) outside the Control Room. EGL Assignment Attributes:

3.1.2.B 202 ECL: Alert NEI 99 01 (Re11ision t'i) ~lo*reff!eer 2012 HA7HA6 Initiating Condition:

Other conditions exist which in the judgment of the Emergency Director warrant declaration of an Alert. Operating Mode Applicability:

All l E,ample Eme.-geeeyEmergency Action Leve ls: 1 Other conditions exist which , in the judgment of the Emergency Director , indicate that events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels. Definitions:

HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities

{i.e .. this may include violent acts between individuals in the owner controlled area). HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. PROJECTILE:

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. Basis: This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for an Alert. 203 ECL: Site Area Emergency Initiating Condition:

HOSTILE ACTION within the PROTECTED AREA. Operating Mode Applicability:

All Example EmergeneyEmergency Action Levels: NEI 99 01 (RevisioR e) ~lovemeer 2012 HS1 S 1.1 A HOSTILE ACTION is occurring or has occurred within the PROTECTED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision. Definitions:

HOSTIL E ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns , explosives, PROJECTILEs, vehicles, or other device s used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-ba s ed EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). HOST AGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. HOSTIL E FORCE: One or more individuals who are engaged in a determined assault , overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction.

PROJECTILE:

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. PROTECTED AREA: The area under continuous acce s s monitoring and control, and armed protection as described in the site Security Plan. Basis: This IC addresses the occurrence of a HOSTILE ACTION within the PROTECTED AREA. This event will require rapid response and assistance due to the possibility for damage to plant equipment.

Timely and accurate communications between DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan , Safeguard s Contingency Plan [and Independent Spent Fuel Storage Installation Security Program}.

204 NEI 99 01 (RevisioA

6) NoYemeer 2012 As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures (e.g., evacuation, dispersal or sheltering).

The Site Area Emergency declaration will mobilize GRGoffsite response organization resources and have them available to develop and implement public protective actions in the unlikely event that the attack is successful in impairing multiple safety functions.

This IC does not apply to a HOSTILE ACTION directed at atrthe ISFSI PROTECTED AREA which is located outside the plant PROTECTED AREA; such an attack should be assessed using IC HAI. It also does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft , shots from hunters , physical disputes between employees, etc. Reporting of these types of events is adequately addressed by other EALs , or the requirements of 10 CFR f-73.71 or 10 CFR f-50.72. Emergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information.

This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location.

Security-sensitive information should beis contained in non public documents such as the Security Plan. Escalation of the emergency classification level would be via IC HGl. Develeper Netes: The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force. Emergency plans and implementing procedures are public documents; therefore , EALs should not incorporate Security sensitive information.

This inc l udes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location.

Security sensitive information should be contained in non public documents such as the Security Plan. 'Nith due consideration given to the above developer note , EALs may contain alpha or numbered references to selected ev e nts described in the Security Plan and associated implementing procedures.

Such references should not contain a recognizable description of the event. For e).ample, an EAL may be 1.vorded as " Security event #2 , #5 or #9 is reported by the (site specific security shift supervision)." See the related Developer Note in Appendix B , Definitions , for guidance on the development of a scheme definition for the PROTECTED AREA. EGL i\ssignment Attributes:

3.1.3.D 205 l'JEI 99 QI (Re*,isioR e) }'fo*,emaer 2Q 12 HS6HS5 ECL: Site Area Emergency Initiating Condition:

Inability to control a key safety function from outside the Control Room. Operating Mode Applicability:

All Example Emergency Action Levels: Note: The Emergency Director should declare the Site Area Emergencyevent promptly upon determining that (site specific number the applicable timeof'.20 minutes) has been exceeded , or will likely be exceeded.

a. b. Definitions:

Basis: An event has resulted in plant control being transferred from the Control Room to (site specific remote shutdown panels and_control stations) the Remote Shutdown Panel (1 C388). AND Control of ANY of the following key safety functions is not reestablished within (site specific number of20 minutes).

• Reactivity control

• Core cooling [PWR] I RPV water level [BWR]

• RCS heat removal This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations , and the control of a key safety function cannot be reestablished in a timely manner. The failure to g ain control of a key safety function following a transfer of plant control to alternate locations is a precursor to a challenge to one or more fission product barriers within a relatively short period of time. The determination of whether or not "control" is established at the remote safe shutdown location(s)Remote Shutdown Panel (1 C388-islli based on Emergency Director judgment.

The Emergency Director is expected to make a reasonable , informed judgment within (the site specific time for transfer)

~20 minutes whether or not the operating staff has control of key safety functions from the remote safe shutdown location(s).

AOP 915, " Shutdown Outside Control Room" provides the following CAUTION -" For Control Room evacuation as th e r e sult ofa fir e , transfer of control at panels 1 C388, 1 C389, 1 C390. JC391, JC392and JC392 i s required to be completed within 20 minutes." E scalation of the emergency classification level would be via IC FG I or CG 1. 206 Developer Notes: NEJ 99 01 (ReYisioR

6) No1rember 2012 The "site specific remote shutdown panels and local control stations" are the panels and control stations referenced in plant procedures used to eooldown and shutdown the plant from a location(s) outside the Control Room. The "site specific number of minutes" is the time in which plant control must be (or is expected to be) reestablished at an alternate location as described in the site specific fire response analyses.

Absent a basis in the site specific analyses, 15 minutes should be used. Another time period may be used with appropriate basis/justification.

EGL Assignment Attributes:

3.1.3.B 207 ECL: Site Area E m ergency }ffil 99 QI (Re\1 isioR *i) }loyemeer 2012 HS7HS6 Initiating Condition:

Other conditions ex i s t w hi c h in th e judgment of the E mer ge nc y Dir ec tor warrant declaration of a S it e Area Emerge nc y. Operating Mode Applicability:

Al l E .. mple Emergency Action Level s: 1 Other conditions ex i st w hich in the jud gment of the Emerge nc y Dir ector indicat e t ha t events are in progress or hav e occ urr e d which invol ve act ual or lik e l y major failures of plant f un ct ion s n eede d fo r protection of the public or HOSTILE ACTI O N that r es ult s in int ent i o nal d amage or m a lici o u s acts , (1) toward si t e p erso nnel or eq uipm e nt that could l ead to th e lik e l y fai lur e of or , (2) th at prevent effect i ve access to equipme nt needed fo r the protection of the p ubli c. Any releases are not expected to result in expos ur e l eve l s w hich exceed EPA Protective Action Guideline expos ur e l evels b eyo nd the s it e boundar y. Definitions:

HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individual s in the owner controlled area). HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. PROJECTILE

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. Basis: T hi s IC addresses unanti ci pat e d conditions not ad dr esse d explicitly e l sew h ere but that warrant d e claration of an emergency because conditions exist which are believed b y the E mergenc y Director to fall under the e mer ge nc y classification l eve l d esc ription for a Site Area E mer ge ncy. 208 NE! 99 01 (Re\'isioR 6) ~foYemaer 2012 HG1 ECL: General Emergency Initiating Condition:

HOSTILE ACTION resulting in loss of physical control of the facility.

Operating Mode Applicability:

All Example Emergency Action Level s: H 1.1 a. A HOSTILE ACTION is occurring or has occurred within the PROTECTED AREA as reported by the (site specific security shift supervision)DAEC Security Shift Supervision. AND b. EITHER of the following has occurred:

1. ANY of the following safety functions cannot be controlled or maintained.

• Reactivity control

• Core cooling [PWR] I RPV water level [BWR]

• RCS heat removal OR 2. Damage to spent fuel has occurred or is IMMINENT.

Definitions:

HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). HOST AGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. HOSTILE FORCE: One or more individuals who are engaged in a determined assault, overtly or by stealth and deception.

equipped with suitable weapons capable of killing. maiming. or causing destruction.

IMMINENT:

The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. 209 NEI 99 QI (Re;cisioA a) November 2012 PROJECTILE:

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. PROTECTED AREA: The area under continuous access monitoring and control, and armed protection as described in the site Security Plan. 210 Basis: 211 tffil 99 01 (Re1, 1 isioR fi) tfo1, 1 emeer 2012 NEI 99 C:l 1 (Re,*isioA 6) Novemeer 2C:ll2 This IC addresses an event in which a HOSTILE FORCE has taken physical control of the facility to the extent that the plant staff can no longer operate equipment necessary to maintain key safety functions.

It also addresses a HOSTIL E ACTION leading to a loss of physical control that results in actual or IMMINENT damage to spent fuel due to 1) damage to a spent fuel pool cooling system (e.g., pumps , heat exchangers , controls , etc.) or, 2) loss of spent fuel pool integrity such that sufficient water level cannot be maintained. Timely and accurate communications between the DAEC Security Shift Supervision and the Control Room is essential for proper classification of a security-related event. Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan , Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program].

E mergency plans and implementing procedures are public documents; therefore, EALs should do not incorporate Security-sensitive information.

This includes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location.

Security-sensitive information should beis contained in non public documents such as the Security Plan. 212 Developer Notes: l>ffil 99 Q l (ReYisieA a) l>foi,*ember 2Ql 2 The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force. Emergency plans and implementing procedures are public documents; therefore , EALs should not incorporate Security sensitive information.

This includes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location. Security sensitive information should be contained in non public documents such as the Security Plan. With due consideration given to the above developer note , EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures. Such references should not contain a recognizable description of the event. For e1rnmple , an EAL may be worded as " Security event #2, #5 or #9 is reported by the (site specific security shift supervision)." 8ee the related Developer Note in Appendix.

B , Definitions , for guidance on the development of a scheme definition for the PROTECTED AREA. EGL Assignment Attributes:

3 .1.4 .D 213 ECL: General Emergency l'>ffil 99 01 (ReYisioR

6) NoYember 2012 HG7HG6 Initiating Condition:

Other conditions exist which in the judgment of the Emergency Director warrant declaration of a General Emergency.

Operating Mode Applicability:

All 6 E,ae,ple Emergency Action Leve ls: 1 Other conditions exist which in the judgment of the Emerge ncy Director indicate that events are in progress or have occurred which involve actua l or IMMINENT substantial core degradation or melting with potential for l oss of containment integrity or HOSTILE ACTION that results in an actua l loss of physica l control of the facility.

Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area. Definitions:

HOSTILE ACTION: An act toward DAEC or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included.

HOSTILE ACTION should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on the nuclear power plant. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the owner controlled area). HOSTAGE: A person(s) held as leverage against the station to ensure that demands will be met by the station. IMMINENT:

The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions. PROJECTILE:

An object directed toward a nuclear power plant that could cause concern for its continued operability, reliability, or personnel safety. Basis: This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a General Emergency.

214 11 SYSTEM MALFUNCTION ICS/EALS NEI 99 01 (ReYisieR e) }foyemaer 2012 Table S 1: Reeognition Categorv "S" Initiating Condition Matrix UNUSUAL EVENT SUl Loss of all offsite AC power capability to emergency buses for 15 minutes or longer. Op. },fades: 1. 2. 3. 4Pewer Operetien, Stertup , Het St611'lde:y, Hat 8/mtdewl'l SU2 illlPL",1'll>lED loss of Control Room indications for 15 minutes or longer. Op. ,\fades: Pewer Operetien , Stertup , Hat Stemie;*, Hat 8!1utdewnL...l,_

3. 4 SUJ Reactor coolant actiYity greater tkan Technical Specification allowable limits. Op. },fades: 1. 2. 3. 4Pewer Operntien, Sf6lrtup, Het Stendh;*, Het Shutdewn SU4 RCS leakage for 15 minutes or longer. Op. }.fades: 1. 2. 3, '/Pewer Operetien , Stertup, Het Stendby , Het Shutdem'l SUS Automatic or manual (trip [PWRJ / scram [BWR]) fails to shutdown the reactor. Op. }.lodes: Pewer OpaGltien}

ALERT SAl Loss of all but one AC power source to emergency buses for 15 minutes or longer. Op. },fades: L...1....J...

1:.Pewer Opeffllien , Stertup , Het Sf6lndby, Het 8!1utdewn SA2 ill~PLA1'Jl>ffiD loss of Control Room indications for 15 minutes or longer witk a significant transient in progress.

Op. Mades: 1. 2. 3. 4 Pewer Operetien , Stertup , Het Stendby , Het Shu1dew1q SAS Automatic or manual (trip [PWR] / scram [BWR]) fails to shutdown the reactor, and subsequent manua l actions taken at the reactor control consoles are not successful in shutting down the reactor. Op. }.{edes: Pewer Operetienl_

2 15 SITE A.REA EMERGENCY SS1 Loss of all offsite and all onsite AC pov,rer to emergency buses for 15 minutes or longer. Op. },fades: 1, 2, 3, 4Pewer Operetien, Stertup, Het Stendb;*, Het Shutdewn SSS Inability to shutdovm the reactor causing a challenge to (core cooling [PWR] I R.0 V water level [BWR]) or RC8 heat removal. Op. }.fades: Pewer Operetienl 1 GENERAL EMERGENCY SGl Prolonged loss of all offsite and all onsite AC power to emergency buses. Op. }.fades: 1, 2. 3, 4Pewer Operetien, Stertup, Het Stendh;*, Het 8!1utdewn

---

Table intended for use by 1 EAL developers.

Inclusion in licensee I 0 * . d , ocuments 1s not require . L------------------1 UNUSUAL EVENT SU6 Loss of all onsite or offsite eommunieations eapabilities.

Op. },fades: 1, 2, 3 , 4.Pewer Opereti e n , Stcwtup , Hat St a l'ldhy , Het Slw tde wn SU7 Failure to i s olate eontainment or loss of eontainment pressure eontrol. [PWR] Op. Afade s: 1 , 2 , 3, 1. Pewe,* Operatie,"i , Starh , tp, Het Stendhy , Hat Shi1tdewl'I A,LERT SITE AREA EMERGENCY NEI 99 01 (Re,,*isioR e) },foyemeer 2012 GENER .... L EMERGENCY SS8 Loss of all Vital DC SG8 Loss of all AC and SA9 Ha:mrdous event affeeting a SAFETY SYSTEM needed for the eurrent operating mode. Op. Med es: 1, 2 , 3, 4.Pewer Operatiel'I , Startitp , Hat S:emihy , Hat Shutdewl'1 po 1 Ner for 15 minutes or Op. },fades: 1 , 2, 3, 4Pewer Operetien , Startitp , H e t Standby*, Hat Shutdewl'I 216 Vital DC power souree s for 15 minutes or longer. Op. },1edes: 1, 2, 3, 4Pewer Operetien , St*lrt1,!fJ , Het Stendey , Hat Shutdewn ,-------------------, : Table intended for use b)' I EAL de>,<elopers.

lnelusion in lieensee I d * . d , oeuments ts not require . 1 L------------------J ECL: Notification of Unusual Event NE! 99 0 I (ReYisioR

6) NoYember 2012 SU1 Initiating Condition:

Loss of alt-ALL offsite AC power capability to emergency essential buses for 15_-minutes or longer. Operating Mode Applicability:

Power Operation , Startup , Hot Standby , Hot Shutdown.1..1.,_]_

Example Emergency Action Level s: Note: The E mergency Director should declare the Unusual E~vent promptly upon determining that the applicable time 15 minutes has been exceeded , or will likely be exceeded.

S 1.1 Loss of ALL offsite AC power capability to (site specific emergency buses)1A3 AND 1 A4 buses for 15 minutes or longer. Definitions:

Basis: This IC addresses a prolonged loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emergency essential buses-. .,_ This condition represents a potential reduction in the level of safety of the plant. The intent of this EAL is to declare an Notification of Unusual Event when offsite power has been lost and both of the emergency diesel generators have successfully started and energized their respective 4kv essential bus. For emergency classification purposes , " capability" means that an offsite AC power source(s) is available to the emergency essential buses , whether or not the buses are powered from it. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power. E scalation of the emergency classification level would be via IC SAL De*,zeloper Notes: The " site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typically 1 emergency bus per train of SAFETY SYSTEMS. At multi unit stations , the EALs may credit compensatory measures that are proceduralized and can be implemented 1 within 15 minutes. Consider capabilities such as power source cross ties, " s 1.ving" generators , other power sources described in abnormal or emergenC)' operating procedures , etc. Plants that have a proceduralized capability to supply offsite AC power to an 217 NEl 99 QI (ReyisioR

6) tlo*,<emeer 2Q 12 affeeted unit via a eross tie to a eompanion unit may eredit this power souree in the EAL provided that the planned eross tie strategy meets the requirements of 10 CFR 50.63. EGL Assignment Attributes:

3.1.1.A 218 ECL: Notification of Unusua l Event NEI 99 QI (Re'iisioA

6) No¥ember 2Q 12 SU2SU3 Initiating Condition:

UNPLANNED l oss of Control Room indications for 15 minutes or longer. Operating Mode Applicability:

Power Operation , Startup , Hot Standby , Hot Shutdown.L..LJ Examf)le Emergency Action Level s: Note: The Emergency Director shou ld declare the Unusual E~ve n t promptly up o n determining that the applicable time 15 minutes h as been exceeded , or w ill l ikely be exceeded.

S 3.1 ++-a.--An UNPLANNED event results in the inability to monitor one or more of the Definitions:

Reactor Power R.0 V '.Vater Level RPV Pressure Primary Containment Pressure Suppression Pool Le 1 rel

• Suppression Pool Temperature Suppression Pool Temperature Table S-1 Safety System Parameters

• Reactor power

• RPV Water Level

• RPV Pressure

• Primary Containment Pressure

• Suppression Pool Level

• Suppression Pool Temperature SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are 219

}ffil 99 0 I (ReYisioA

6) N0Ye1'l'!eer 2012 classified as safety-related.A system required for safe plant operation, cooling dovm the plant and/or placing it in the cold shutdovm condition, including the EGGS. Systems classified as safety related. UNPLANNED: A parameter change or an event that is not I) the result of an intended evolution or 2) an expected plant response to a transient.

The cause of the parameter change or event may be known or unknown. Basis: This IC addresses the difficulty associated with monitoring normal p l ant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant. As used in this EAL , an " inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s).

_For example , the reactor power level cannot be determined from any analog , dig i tal and recorder source within the Control Room. 220 NE! 99 0 I (Re,*isioH

6) 1-foyemeer 2012 An event involving a los s of plant indications , annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required.

The event would be reported if it significantly impaired the capability to perform emergency assessments.

In particular , emergency assessments necessary to implement abnormal operating procedures , emergency operating procedures , and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control , core cooling [PWR] I RPV level [BWR] and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition.

In addition, if all indication so urces for one or more of the listed parameters are lost , then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for reactor vessel level [PWR] / RPV water level [BWR] cannot be determined from the indications and recorders on a main control board , the SPDS or the plant computer, the availability of other parameter values may be compromised as well. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication. Esca lation of the emergency classification level would be via IC SA+/-}. De*,releper Netes: In the PWR parameter list column , the "site specific number" should reflect the minimum number of steam generators necessary for plant cooldown and shutdovm. This criterion may also specify whether the level value should be *wide range , narrow range or both , depending upon the monitoring requirements in emergency operating procedures.

Developers may specify either pressurizer or reactor 1 1essel level in the PWR parameter column entry for RCS Le 1 1el. The number , type , location and layout of Control Room indications , and the range of possible failure modes, can challenge the ability of an operator to accurate!)'

determine , within the time period available for emergenC)' classification assessments , if a specific percentage of indications have been lost. The approach used in this EAL facilitates prompt and accurate emergency classification assessment s by focusing on the indications for a selected subset of parameters. By focusing on the availability of the specified parameter values , instead of the sources of those values , the EAL recognizes and accommodates the wide variety of indications in nuclear power plant Control Rooms. Indication types and sources may be analog or digital , safety related or not , primary or alternate , individual meter value or computer group display , etc. /1 , loss of plant annunciators will be evaluated for reportability in accordance

• with 10 CFR 50.72 (and the associated guidance in 1'ruREG 1022), and reported if it significantly impairs the capability to perform emergency assessments.

Compensatory measures for a loss of annunciation can be readily implemented and may include increased monitoring of main control boards and more frequent plant rounds by non licensed operators.

Their alerting function notwithstanding , annunciators do not provide the parameter values or specific component status information used to operate the plant , or process through AOPs or EOPs. Based on these considerations , a loss of annunciation is considered to be adequately addressed by reportability criteria, and therefore not included in this JC and EAL. 221

~ffil 99 QI (RevisieA

6) ~fo>,*emeer 2012 With respect to establishing event severity , the response to a loss of radiation monitoring data (e.g., process or effluent monitor values) is considered to be adequately bounded by the requirements of 10 CPR 50.72 (and associated guidance in NUREG 1022). The reporting of this event 1,vill ensure adequate plant staff and NRG awareness , and drive the establishment of appropriate compensatory measures and corrective actions. In addition , a loss of radiation monitoring data , by itself , is not a precursor to a more significant event. Personnel at sites that have a Failure Modes and Effects Analysis (H,4EA) included within the design basis of a digital I&C system should consider the FMEA information when developing their site specific EALs. Due to changes in the configurations of SAFETY SYSTEMS , including associated instrumentation and indications , during the cold shutdown , refueling , and defueled modes , no analogous IC is included for these modes of operation. EGL Assignment Attributes:

3.1.1.A 222 2 NEI 99 QI (ReYisioR e) Noyemeer 2Q 12 SU3SU4 ECL: Notification of Unusual Event Initiating Condition:

Reactor coolant activity greater than Technical Specification allowable limits. Operating Mode Applicability:

Power Operation , Startup, Hot Standby , Hot Shutdov,mL 2, 3 Example Emergency Action Levels: (1 or 2) (Site specific radiation monitor) reading greater than (site specific value). Pretreatment Off gas System (RM-4104)

Hi-Hi Radiation Alarm. Sample analysis indicates that reactor coolant specific activity is greater than 2.0 µCi/gm dose equivalent 1-131 for 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or longerSample analysis indicates that a reactor coolant activity value is greater than an allowable limit specified in Technical Specifications.,,.,.

Definitions:

Basis: This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications.

This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant. For EAL SU4.1, RM-4104 Hi-Hi Radiation Alarm has been chosen because it is operationally significant is readily recognizable by the Control Room Operations Staff, and is set at a level corresponding to noble gas release rate, after 30-m i nute delay and decay of 1 Ci/sec. F or EAL SU4.2, coolant samples exceeding the 2.0 µCi/gm dose equivalent l-131concentration require prompt action by DAEC Technical Specifications and are representative of minor fuel cladding degradation.

Escalation of the emergency classification level would be via ICs FAl or the Recognition Category A-R I Cs. DevelepeF Netes: For EAL #1 Enter the radiation monitor(s) that may be used to readily identify 1.vhen RCS activity levels e>rneed Technical Specification allovvable limits. This EAL may be developed using different method s and sites should use existing capabilities to address it (e.g., de;, elopment of new capabilities is not required).

E>rnmples of e>C.isting methods/capabilities include:

• An installed radiation monitor on the letdown system or air ejector.

• A hand held monitor or deployed detector reading with pre calculated conversion values or readily implementable conversion calculation capability.

223 l>ffil 99 O 1 (Re*,isioR e) November 2012 The monitor reading values should eorrespond to an RCS aetivity leve l approximate l y at , Teehnieal Specification allowable limits. If there is no e>dsting method/capability for determining this EAL , then it should not be included.

IC evaluation will be based on EAL #2. For EAL#2 Developers may reword the EAL to include the reactor coolant activity parameter(s) specified in Teehnieal Specifieations and the assoeiated allowable limit(s) (e.g., va l ues for dose equ i valent I 131 and gross activity, time dependent or transient va l ues, ete.). If this approach is selected, all RCS aetivity allowable limits should be ineluded. EGL Assignment Attributes:

3 .1.1.A and 3 .1.1.B 224 NEI 99 Ql (RevisioA

6) November 2012 SU4SU5 ECL: Notification of Unusual Event Initiating Condition:

RCS leakage for 15 minutes or longer. Operating Mode Applicability:

Po*.ver Operation , Startup , Hot Standby , Hot Shutdownl..,_Ll Exem13le Emergency Action Levels: (1 or 2 or 3) Note: S 5.1 $2 ~3 The Emergency Director should declare the Unusual E~vent promptl y upon determining that the applicable time 15 minutes has been exceeded, or will likely be exceeded.

RCS unidentified or pressure boundary leakage greater than (site specific Yalue) 10 gpm for 15 minutes or longer. RCS identified leakage greater than (site specific Yalue)25 gpm for 15 minutes or longer. Leakage from the RCS to a location outside containment greater than 25 gpm for 15 minutes or longer. Definitions:

UNISOLABLE:

An open or breached system line that cannot be isolated , remotely or locally. Basis: This IC addresses RCS leakage which may be a precursor to a more significant event. In this case , RCS leakage has been detected and operators , following applicable procedures , have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant. EAL SUS.I and EAL SU5.2 are focused on a loss of mass from the RCS due to " unidentified leakage" , "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications). EAL SU5.3 addresses a RCS mass loss caused by an UNISOLABLE leak through an interfacing system. These EALs thus apply to leakage into the containment , a secondary-side system~ steam generator tube leakage in a PWR) or a location outside of containment.

The leak rate values for each EAL were selected because they are usually observable with normal Control Room indications.

Lesser values typically require time-consuming calculations to determine (e.g., a mass balance calculation).

EAL SUS.I uses a lower value that reflects the greater significance of unidentified or pressure boundary l eakage. 225 tJEI 99 Ql (RevisieR C:i) tl0 1 1em0er 2Q 12 The release of mass from the RCS due to the as-designed

/expected operation of a relief valve does not warrant an emergency classification.

For PWRs , an emergency classification would be required if a mass loss is caused by a relief valve that is not functioning as designed/expected (e.g., a relief valve sticks open and the line flo 1 t't' cannot be isolated). For BWRs , aA stuck-open Safety Relief Valve (SRV) or SRV leakage is not considered either identified or unidentified leakage by Technical Specifications and , therefore , is not applicable to this E AL. 226 227 ~ffil 99 01 (RevisioR

6) ~fo*remeer 2012 NEI 99 Gl (Re,*isioA

6) l>fo*,*emeer 2G 12 The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage , if possible.

Escalation of the emergency classification level would be via ICs of Recognition Category A-R or F. Develof)eF Notes: Ei\L #1 For the site specific leak rate 1 1alue , enter the higher of l O gpm or the Yalue specified in the site's Technical Specifications for this type of leakage. EAL #2 For the site specific leak rate ,,atue, enter the higher of 25 gpm or the value specified in the site's Technical Specifications for this type of leakage. For sites that haYe Technical Specifications that do not specify a leakage type for steam generator tube leakage , developers should include an EAL for tube leakage greater than 25 gpm for 15 minutes or longer. EGL Assignment Attributes:

3.1. l .,", 228

l>JEI 99 0 I (RevisioA

6) l>fo\'emeer 2012 SU5SU6 ECL: Notification of Unusual Event Initiating Condition:

Automatic or manual (trip [PWR] / scram [BWR]) fails to shutdown the reactor. Operating Mode Applicability:

Power Operationl,2 Nate: A manual action is any operator action , or set of actions , \Yhich causes the control rods to be rapidly inserted into the core , and does not include manually driving in control rods or implementation of boron injection strategies.

Exemf)le Emergency Action Levels: (1 or 2) Note: A manual action is any operator action , or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

SU6.1 a. An automatic (trip [PWR] / scram [B'.VR]) did not shutdown the reactor. S 6.2 AND b. ANY of the following manual actions taken at 1C05 are successful in lowering reactor power below 5% power a.

• Manual Scram Pushbuttons

• Mode Switch to Shutdown

• Alternate Rod Insertion (ARI)A subsequent manual action taken at the reactor control consoles (I C05) is successful in shutting down the reactor. A manual trip ([P'.1/R]

/ scram [B'.1/R])

did not shutdown the reactor. AND b. EITHER of the following: 1. -ANY of the following subsequent manual actions taken at l COS are successful in lowering reactor power below 5% power

• Manual Scram Pushbuttons

• Mode Switch to Shutdown

• Alternate Rod Insertion (ARI)A subsequent manual action taken at the reactor control console (1 C05)s is successful in shutting down the reactor. ---__ OR 230 Definitions:

Basis: NEI 99 0 I (Re*,isioA

6) ~lovemeer 2012 2. -A subsequent automatic (trip [PWR] / scram [BWR]) is successful in shutting down the reactor. This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor~ [PWR] I scram [BWR]) that results in a reactor shutdown , and either a subsequent operator manual action taken at the reactor control consoles or an automatic (trip [PWR] I scram [BWR]) is successful in shutting down the reactor._ This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant. Following the failure on an automatic reactor (trip [PWR] I scram [BWR]), operators will promptly initiate manual actions at the reactor control console s to shutdown the reactor (e.g., initiate a manual reactor (trip [PWR] I scram [BWR])). If these manual actions are successful in shutting dov,rn the reactor , core heat generation willscram quickly fall to a level within the capabilities of the plant's decay heat removal systems. 231

---

. ------------------~JBI 99 g I (ReYisioA e) November 2012 If an initial manual reactor (trip [PWR] I scram [BWR]) is unsuccessful , operators will promptly take manual action at another location(s) on the reactor control console s to shutdown the reactor (e.g., initiate a manual reactor (trip [PWR] I scram [BWR])) using a different switch). Depending upon several factors, the initial or subsequent effort to manually (trip [PWR] I scram [BW~]) the reactor , or a concurrent plant condition , may lead to the generation of an automatic reactor ftrtp [PWR] I scram [BWR]) signal. If a subsequent manual or automatic (trip [PWR] I scram [BWR]) is successful in shutting down the reactor , core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems. A manual action at the reactor control console s is any operator action , or set of actions , which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor ftrtp [PWR] I scram [BW1"])). This action does not include manually driving in control rods or implementation of boron injection strategies.

Actions taken at back-panels or other locations with in the Contro l Room , or any loc ation outs ide the Contro l Room , are not cons id ered to be " at the reactor control console s". Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action. [BWR] The plant response to the failure of an automatic or manual reactor (trip [PWR] / scram [BWR]) will vary based upon several factors including the reactor power level prior to the event , availability of the condenser , performance of mitigation equipment and actions , other concurrent plant conditions , etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutt in g down the reactor , then the emerge n cy classification l evel wi ll escalate to an Alert via IC SA:)§. Depending upon the plant response , escalation is a l so possible via IC FAl. Absent the plant conditions needed to meet either IC SA:)§ or FAI , an Unusual Event declaration is appropriate for this event. The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).A reactor shutdovm is determined in accordance

• .vith applicable Emergency Operating Procedure criteria.

Should a reactor (trip [PWR] / scram [BWR]) signa l be generated as a result of plant work (e.g., RPS setpoint testing), the following classification guidance should be applied. I

• If the signal causes a plant transient that should have included an automatic reactor ftrtp [PWR] / scram [BWR]) and the RPS fai l s to automatically shutdown the reactor , then this IC and the EALs are applicab l e, and should be eva lu ated. If the signa l does not cause a plant trans i ent and the (trip [PWR] / scram [BWR]) failure is determined through other means (e.g., assessment oftest results), then this IC and the EALs are not applicab l e and no classification is warranted.

De*1el013er Netes: This IC is applicable in any Mode in which the actual reactor power level could eJrneed the power level at which the reactor is considered shutdown.

A PWR with a shutdown reactor power level that is less than or equal to the reactor power level which defines the lov,er bound of Pov,er Operation (Mode 1) will need to include Startup (Mode 2) in the Operating Mode Applicability.

For example , if the reactor is considered to be shutdov,rn at 3% and Power Operation starts at >5%, then the IC is also applicable in Startup Mode. Developers may include site specific EOP criteria indicative of a successful reactor shutdown in 232 aA EAL staterneAt , the Basis or aoth (e.g., a reactor pov,cer leYel). wm 99 Ql (ReYisioR a) NoYemeer 2Q12 The term " reactor coAtrol coAsoles" may ae replaced with the appropriate site specific term (e.g., rnaiA eoAtrol aoards). EGL AssigArneAt Attriautes:

3.1.1.A 233

1>,'EI 99 QI (Re1, 1 isioA e) l>io't'emeer 2Q 12 SU6SU7 ECL: Notification of Unusual Event Initiating Condition:

Loss of al-I-ALL onsite or offsite communications capabilities. Operating Mode Applicability:

Power Operation , Startup, Hot Standby , Hot Shutdown.L..LJ Example Emergency Action Levels: (1 or 2 or 3) S 7.1 .fill.L 2 S 7.3 Basis: Loss of ALL of the following onsite communication methods: * (site specific list of communications methods) Plant Operations Radio System

• In-Plant Phone System

• Plant Paging System (Gaitronics)

Loss of ALL of the following GRGoffsite response organization communications methods: _* _(site specific list of communications methods) DAEC All-Call phone

• All telephone lines (PBX and commercial)

• Cell Phones (including fixed cell phone system)

• Control Room fixed satellite phone system

• FTS Phone system Loss of ALL of the following NRC communications methods: _* _(site specific list of communications methods) FTS Phone system

• All telephone lines (PBX and commercial)

• Cell Phones (including fixed cell phone system)

• Control Room fixed satellite phone system This IC addresses a significant loss of on-site or offsite communications capabilities.

While not a direct challenge to plant or personnel safety , this event warrants prompt notifications to GRGoffsite response organization s and the NRC. This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant , privately owned equipment , relaying of on-site information via individuals or multiple radio transmission points , individuals being sent to offsite locations , etc.). 235

l>IEI 99 0 I (Re*,isioA

6) NoYemeer 2012 EAL SU7.l addresses a total l oss of the communications methods used in support of routine plant operations. EAL SU7.2 addresses a total loss of the communications methods used to notify all GRGoffsite response organization s of an emergency declaration.

The GRGoffsite response organization s referred to here are-the S t ate of Iowa, Linn County, and Benton County (see Developer Notes). ---EAL SU7.3 addresses a tota l loss of the communications methods used to notify the NRC of an emergency declaration.

DeYelopeF Notes: EAL #1 The " site specific list of communications methods" should include all communications methods used for routine plant communications (e.g., commercial or site telephones , page party systems , radios , etc.). This listing should include installed plant equipment and components , and not items owned and maintained by individuals. EAL #2 The " site specific list of communications methods" should include all communications methods used to perform initial emergency notifications to OROs as described in the site Emergency Plan. The listing should include installed plant equipment and components, and not items ovmed and maintained by individuals.

Ei>cample methods are ring dovm/dedicated telephone lines , commercial telephone lines , radios , satellite telephones and internet based communications technology. In the Basis section , insert the site specific listing of the OROs requiring notification of an emergency declaration from the Control Room in accordance 1 Nith the site Emergency Plan , and typically within 15 minutes. EAL #3 The "site specific list of communications methods" should include all communications methods used to perform initial emergency notifications to the NRG as described in the site E,mergency Plan. The listing should include installed plant equipment and components , and not items ovmed and maintained b)' individuals. These methods are typically the dedicated Emergency Notification System (m-18) telephone line and commercial telephone lines. EGL Assignment Attributes:

3 .1.1.C 237

1'JE I 99 QI (R ev i s i o R e) Novembe r 2Q 1 2 SU7 ECL: Notification of Unusual Event Initiating Condition:

Failure to isolate containment or loss of containment pressure control. [P\"JR] Operating Mode Applicability:

Po,.*,er Operation, Startup, Hot Standby, Hot Shutdov.*n Example Emergency Action Levels: (1 or 2) 1 a. Failure of containment to isolate 'A'hen required by an actuation signal. AND b. ALL required penetrations are not closed within 15 minutes of the actuation signal. 2 a. Containment pressure greater than (site specific pressure).

AND b. Less than one full train of (site specific system or equipment) is operating per design for 15 minutes or longer. Basis: Th is IC addresses a failure of one or more containment penetrations to automatically isolate (close) '.\.'hen required by an actuation signal. It also addresses an event that results in high containment pressure ,,,ith a 239 NE I 9 9 0 I (R ev i s i o R a) No,*embe r 20 1 2 concurrent failure of containment pressure control systems. Absent challenges to another fission product barrier, either condition represents potential degradation of the level of safety of the plant. For EAL 1, the containment isolation signal must be generated as the result on an off normal/accident condition (e.g., a safety injection or high containment pressure);

a failure resulting from testing or maintenance does not warrant classification.

The determination of containment and penetration status isolated or not isolated should be made in accordance v.*ith the appropriate criteria contained in the plant AOPs and EOPs. The 15 minute criterion is included to allow operators time to manually isolate the required penetrations, if possible.

EAL 2 addresses a condition

'Nhere containment pressure is greater than the setpoint at '.*Jhich containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design. The 15 minute criterion is included to allo'I-' operators time to manually start equipment that may not have automatically started, if possible.

The inability to start the required equipment indicates that containment heat removal/depressurization systems (e.g., containment sprays or ice condenser fans) are either lost or performing in a degraded manner. This event ,,.,ould escalate to a Site Area Emergency in accordance

,,.,ith IC FS1 if there ,.,.,ere a concurrent loss or potential loss 240 1>IBI 99 QI (Re,*isioA e) "!>lo'iemeer 2Q 12 of either the Fuel Clad or RCS fission product barriers.

Developer Notes: Enter the "site specific pressure" value that actuates containment pressure control systems (e.g., containment spray). Also enter the site specific containment pressure control system/equipment that should be operating per design if the containment pressure actuation setpoint is reached. If desired, specific condition indications such as parameter values can also be entered (e.g., a containment spray flow rate less than a certain value). EAL #2 is not applicable to the U.S. Evolutionary Po'..ver Reactor (EPR) design. Attributes:

241 ECL Assignment 3.1.1.A 242 ~m, 99 Ql (Re,*isioR e) ~fovemaer 2()12 Ne! 99 0 I (ReYisioA

6) :Jlolo 1 ,em0er 2012 SA1 ECL: Alert Initiating Condition:

Loss of al-l-ALL but one AC power source to emergency essential buses for 15 minutes or longer. Operating Mode Applicability:

Po 1 Ner Operation , Startup , Hot Standby , Hot Slrntdown.1.1..,_J.

Example Emergency Action Leve ls: Note: The Emergency Director should declare the Alert-event promptly upon determining that the applicable time 15_ minutes has been exceeded, or will likely be exceeded. S 1.1 a. AC power capability to (site specific emergency buses) 1A3 and 1 A4 buses is reduced to a single power source for 15 minutes or longer. AND b. Any /\NYANY additional single power source failure will result in a loss of alt ALL AC power to SAFETY SYSTEMS. Definitions:

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdovm condition.

including the EGGS. Systems classified as safety related. Basis: This IC describes a significant degradation of off site and onsite AC power so urces such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the so l e AC power source may be powering one, or more than one , train of safetyrelated equipment.

This IC provides an esca l ation path from IC SUL An "AC power source" is a source recognized in AOPs and EOPs , and capable of supplying required power to an emergency bus. Some examples of this condition are presented below.

• A loss of all offsite power with a concurrent failure of all but one emergency power source ( e.g., an onsite diesel generator).

• A loss of all offsite power and loss of all emergency pO'Ner sources (e.g., onsite diesel generators) 1 Nith a single train of emergency buses being back fed from the unit main generator.

• A loss of emergency power sources (e.g., onsite diesel generators) with a sing l e train of essentialemergency buses being -eaek-fed from an offsite power source. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power. Escalation of the emergency classification level would be via IC SSl. De*;eleper Notes: For a po 1 Ner source that has multiple generators , the EAL and/or Basis section should reflect the minimum number of operating generators necessary for that source to provide required power to 243 Nel 99 QI (Re\1 isioA a) l>lo*,*eme er 2Q 12 an AC emergency bus. For e>rnmple , if a backup pov,er source is comprised of two generators (i.e., two 50% capacity generators sized to feed 1 AC emergency bus), the EAL and Basis section must specify that both generators for that source are operating.

The " site specific emergency buses" are the buses fed by offsite or emergency

/\C po 1 Ner sources that supply power to the electrical distribution system that powers SAFETY 8¥8TEM8. There is typically 1 emergency bus per train of SAFETY 8¥8TEM8. Developers should modify the bulleted e>rnmples provided in the basis section , above , as needed to reflect their site specific plant designs and capabilities.

The EALs and Basis should reflect that each independent offsite pov,er circuit constitutes a single po:wer souroe. For e>rnmple, three independent 345kV offsite power circuits (i.e., incoming power lines) comprise three separate power sources. Independence may be determined from a revie\\' of the site specific UF8AR , 8BO analysis or related loss of electrical power studies. The EAL and/or Basis section may specify use of a non safety related power source provided that operation of this sou roe is recognized in AOPs and EOPs , or beyond design basis accident response guidelines (e.g., FLEX support guidelines).

8uch power sources should generally meet the " Alternate ac souroe" definition provided in 10 CFR 50.2. At multi unit stations , the E ALs may credit compensatory measures that are proceduralized and can be implemented within 15 minutes. Consider capabilities such as power source cross ties, " sv,*ing" generators , other power sources described in abnormal or emergency operating procedures , etc. Plants that have a proceduralized capability to supply offsite AC power to an affected unit Yia a cross tie to a companion unit may credit this power source in the EAL provided that the planned cross tie strategy meets the requirements of 10 CFR 50.63. EGL Assignment Attributes:

3.1.2.B 244 NEI 99 01 (Re\1 isioA e) ~fovemeer 2012 SA2SA3 ECL: Alert Initiating Condition:

UNPLANNED loss of Contro l Room indications for 15 minute s or lon ger wit h a s i gnificant transient in progress.

Operating Mode Applicability:

Power Operation , Startup , Hot Standby , Hot Shutdovml.,_1,_l Example Emergency Action Level s: Note: The Emergency Director should declare the A-left-event promptly upon determining that the applicable time 15_ minutes has been exceeded , or w ill likely be exceeded.

S 3.1 a. An UNPLANNED event results in the inability to monitor one or more Table S-1 parameters from within the Control Room for 15 minutes or longerAn UNPLANl'H3D e'rent results in the inability to monitor one or more of the follo 1 Ning parameters from within the Control Room for 15 minutes or longer. ......-Table S-1 Safety System Parameters

• Reactor power

• RPV Water Level

• RPV Pressure

• Primary Containment Pressure

• Suppression Pool Level

• Suppression Pool Temperature PeweF RPV Water Level R1)V Pressure Primary Containment Pressure Suppression Pool Level Suppression Pool Temperature Suppression Pool Temperature AND -Reactor ___ b __ . __ ANY of the Table S-2 transient events are in progress.

245

-Table S-2 Significant Transients

• Automatic or manual runback greater than 25% thermal reactor power

• Electrical l oad rejection greater than 25% full electrical load

• Reactor scram

• ECCS actuation

• Thermal power oscillations greater than 10% transient eyents in progress.

}>JEI 99 QI (Re\*isioA

6) }>Jo\*emeer 2Q 12 of the following Automatic or manual runback greater than 25% thermal reactor power Electrical load rejection greater than 25% full electrical load Reactor scram [BWR] / trip [PWR] EGGS (81) actuation Thermal power oscillations greater than 10% [BWR] 246 Definitions:

~JEJ 99 0 I (Re\*isieA e) ~Je\1 eme er 2012 SAFETY SYSTEM: A system required for safe plant operation, coo l ing down the p l ant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling dov-m the plant and/or placing it in the cold shutdov,rn condition, including the EGGS. Systems classified as safety related. UNPLANNED:

A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient.

The cause of the parameter change or event may be known or unknown. Basis: This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition , the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant. 247 NEI 99 0 I (RevisioA

6) ])ofo¥emeer 2012 As used in this EAL , an " inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s).

For example , the reactor power level cannot be determined from any analog , digital and recorder source within the Control Room. An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CPR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required.

The event would be reported if it significantly impaired the capability to perform emergency assessments.

In particular , emergency assessments necessary to implement abnormal operating procedures , emergency operating procedures , and emergency plan implementing procedures addressing emergency classification , accident assessment , or protective action decision-making.

This EAL is focused on a selected subset of p l ant parameters associated with the key safety functions of reactivity control , core cooling [PWR] I RPV level [BWR] and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition.

In addition , if all indication sources for one or more of the listed parameters are lost, then the ability to determ i ne the values of other SAFETY SYSTEM parameters may be impacted as well. For example , if the value for reactor vessel level [PW~] I RPV water level [BWR] cannot be determined from the indications and recorders on a main control board , the SPDS or the p l ant computer , the availability of other parameter values may be compromised as well. Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication. Escalation of the emergency classification level would be via I Cs FS 1 or IC AS+RS 1. Developer Notes: In the PWR parameter list column , the " site specific number" should reflect the minimum number of steam generators necessary for plant cooldown and shutdown. This criterion may also specif)' \\'Aether the level value should be vride range, narrow range or both , depending upon the monitoring requirements in emergency operating procedures. Developers may specify either pressurizer or reactor vessel level in the P'.VR parameter column entry for RCS Level. Developers should consider if the "transient events" list needs to be modified to better reflect site specific plant operating characteristics and eJ(pected responses.

The number, type , location and layout of Control Room indications , and the range of possible failure modes , can challenge the ability of an operator to accurately detennine , within the time period available for emergency classification assessments , if a specific percentage of indications have been lost. The approach used in this EAL facilitates prompt and accurate emergency classification assessments by focusing on the indications for a selected subset of parameters.

By focusing on the availability of the specified parameter values , instead of the sources of those values , the EAL recognizes and accommodates the 1.,*ide variety of indications in nuclear power plant Control Rooms. Indication types and sources may be analog or digital, safety related or not , primary or alternate , individual meter value or computer group display , etc. 248 Ne! 99 QI (RevisioR e) Jlolovemeer 2Q 12 A loss of plant annunciators will be evaluated for reportability in accordance with 10 CPR 50.72 (and the associated guidance in NUREG 1022), and reported if it significantly impairs the capability to perform emergency assessments.

Compensatory measures for a loss of annunciation can be readily implemented and may include increased monitoring of main control boards and more frequent plant rounds by non licensed operators.

Their alerting function notwithstanding , annunciators do not provide the parameter values or specific component status information used to operate the plant , or process through AOPs or EOPs. Based on these considerations , a loss of annunciation is considered to be adequately addressed by reportability criteria , and therefore not included in this IC and EAL. With respect to establishing event severity , the response to a loss of radiation monitoring data (e.g., process or effluent monitor values) is considered to be adequately bounded by the requirements of 10 CPR 50.72 (and associated guidance in NUREG 1022). The reporting of this event will ensure adequate plant staff and NRG awareness , and drive the establishment of appropriate compensatory measures and corrective actions. In addition , a loss of radiation monitoring data , by itself , is not a precursor to a more significant event. Personnel at sites that have a Failure Modes and Effects Analysis (FMEA) included within the design basis of a digital J&C s;'stem should consider the FMEA information when developing their site specific EALs. Due to changes in the configurations of 8AFETY 8¥8TEM8 , including associated instrumentation and indications , during the cold shutdown , refue l ing , and defueled modes , no analogous IC is included for these modes of operation.

EGL Assignment Attributes:

3.1.2.B 249

ECL: Alert }ffil 99 0 I (ReYisioA

6) }lo\1 emeer 2012 SA5SA6 Initiating Condition:

Automatic or manual (trip [P'.l/R] / scram [BWR]) fails to shutdown the reactor , and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor. Operating Mode Applicability:

Pov,er Operation.1.....1 Note: A manual action is any operator action , or set of actions , which causes the control rods to be rapidly inserted into the core , and does not include manually driving in control rods or implementation of boron injection strategies. l E,ample EmeFgeeeyEmergency Action Level s: 1 a. An automatic or manual (trip [PWR] / scram [BWR]) did not shutdown the reactor. AND b. ALL of the following manual actions taken at 1 COS are not successful in lowering reactor power below 5% power

• Manual Scram Pushbuttons

• Mode Switch to Shutdown

• Alternate Rod Insertion (ARI)Manual actions taken at the reactor control consoles (1 COS) are not successful in shutting down the reactor. Definitions:

Basis: This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ftrtJ3 [PWR] I s cram [BWR]) that results in a reactor s hutdown , and subsequent operator manual actions taken at the reactor control consoles to shutdown the reactor are also unsuccessful.

This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emer g ency declaration is required even if the reactor is s ubsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RPS. A manual action at the reactor control consoles is any operator action , or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor ftrtJ3 [PWR] I scram [BWR])). This action does not include manually driving in control rods or implementation of boron injection strategies.

If this action(s) is unsuccessful , operators would immediately pursue additional manual actions at locations away from the reactor control consoles (e.g., locally opening breakers).

_Actions taken at back-panels or other locations within the Control Room , or any location outside the Control Room , are not considered to be " at the reactor control consoles.,_-:-251 NEI 99 01 (RevisioA a) l>fovemeer 2012 Taking the Reactor Mode Switch to SHUTDOWN is considered to be a manual scram action. [BWR] 252

NEI 99 0 I (RevisioA

6) ]I,[ 0\'emeer 2012 The plant response to the failure of an automatic or manual reactor (trip [PWR] I scram [BWR]) will vary based upon several factors including the reactor power level prior to the event , availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions , etc. If the failure to shutdown the reactor is prolonged enough to cause a challenge to the core cooling [PWR] / RPV water level [BWR] or RCS heat removal safety functions , the emergency classification level will escalate to a Site Area E mergency via IC SS~§. Depending upon plant responses and symptoms, escalation is also possible via IC FSl. Absent the plant conditions needed to meet either IC SS~§ or FSl, an Alert declaration is appropriate for this event. It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Recognition Category F ICs; however , this IC and EAL are included to ensure a timely emergency declaration. The reactor should be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power).A reactor shutdovm is determined in accordance

• .vith applicable Emergency Operating Procedure criteria.

Develeper Netes: This IC is applicable in any Mode in which the actual reactor power level could exceed the pov,rer level at which t he reactor is considered shutdown.

A PWR *.vith a shutdown reactor power level that is less than or equal to the reactor power level which defines the lower bound of Pmver Operation (Mode l) will need to include Startup (Mode 2) in the Operating Mode Applicability. For example , if the reactor is considered to b e shutdovm at 3% and Power Operation starts at >5%, then the IC is also applicable in Startup Mode. Developers may include site specific EOP criteria indicative of a successful reactor shutdown in an EAL statement , the Basis or both (e.g., a reactor power level). The term " reactor control consoles" may be replaced v r ith the appropriate site specific term (e.g., main control boards). EGL Assignment Attributes

3.1.2.B 254

Nm 99 QI (ReYisioR

6) ~loYemller 2Q 12 SA9SA8 E CL: A l ert Initiating Condition:

Hazar d o u s eve nt affec tin g a SAFETY SYSTEM n ee d e d for th e c u rre nt o p e ratin g m o d e. Operatin g Mode Applicability:

Power Operation , Startup , Hot Standby , Hot Shutdovm.1..1.,_]_

Example Emergenc y A ction Le v el s: Notes: S 8.1

• If the affected SAFETY SYSTEM train was already inoperable or out of service before the hazardot1s event occurred, then this emergency classification is not warranted. -If the hazardous event only resulted in VISIBLE DAMAGE, with no indications of degraded performance to at least one train of the SAFETY SYSTEM, then this emergency classification is not warranted .

• a. AND b. The occurrence of ANY of the Table S-3 hazardous events: ----l Table S-3 Hazardous Events -* Seismic event (earthquake)

• Internal or external flooding event

• High winds o r t ornado strike

• FIRE

• EXPLOSION

• Othe r events w i th s i milar hazard c h aracteristics as determined by the Sh i ft Manager or Emergency Director Director 1. 2. Event damage has caused indications of degraded performance in one train of a SAFETY SYSTEM needed for the current operating mode. AND EITHER of the following:

256

~IEJ 99 Q I (Re,,isioA

6) *Novemeer 2Q 1 2

• Event damage has caused indications of degraded performance to a second train of t h e SAFETY SYSTEM needed for the current operating mode,

• The event has resulted in VfSTBLE DAMAGE to the second train of a SAFETY SYSTEM needed for the current operating mode.;: E 1 ,rent damage has caused indications of degraded performance to a second train of the SAFETY SYSTEM needed for the current operating mode, or The eyent has resu l ted in VISIBLE DAMAGE to the second train of the SAFETY SYSTEM needed for the current operating mode. Loss of the safety function of a single train SAFETY SYSTEM. 257

• ------------------------Definitions:

NEI 99 0 I (ReYisioA e) 1-Jo,,ember 20 12 EXPLOSION:

A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization.

A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion.

Such events may require a post-event inspection to determine if the attributes of an explosion are present. FIRE: Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute FIRES. Observation of flame is preferred but is NOT required if large quantities of smoke and heat are observed.

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, inc l uding the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdov,rn condition, including the BCCS. Systems classified as safety related. VISIBLE DAMAGE: Damage to a component or structure that is readily observable without measurements, testing, or analysis.

The visua l impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not VISIBLE DAMAGE. EITHER of the following:

1. event damage has caused indications of degraded performance in at least one train of a SAFBTY 8Y8TBM needed for the current operating mode. OR 2. The e1,*ent has caused V18IBLB DAMAGE to a SAFBTY 8¥8TBM component or structure needed for the current operating mode. Basis: This IC addresses a hazardous event that causes damage to SAFETY SYSTEMS needed for the current operating mode. In order to provide the appropriate context for consideration of an ALERT classification, the hazardous event must have caused indications of degraded SAFETY SYSTEM performance in one train, and there must be either indications of performance issues with the second SAFETY SYSTEM train or VISIBLE DAMAGE to the second train such that the potential exists for this second SAFETY SYSTEM train to have performance issues. In other words, in order for this EAL to be classified, the hazardous event must occur, at least one SAFETY SYSTEM train must have indications of degraded performance, and the second SAFETY SYSTEM train must have indications of degraded performance or VISIBLE DAMAGE such that the potential exists for performance issues. Note that this second SAFETY SYSTEM train is from the same SAFETY SYSTEM that has indications of degraded performance for criteria SA98.1.b.1 of this EAL; commercial nuclear power plants are designed to be able to support single system issues without compromising public health and safety from radiological events. An event affecting a single-train SAFETY SYSTEM (i.e., there are indications of degraded performance and/or VISIBLE DAMAGE affecting the one train) would not be classified under SA8 because the two-train impact criteria that underlie the EALs and Bases would not be met. If 2 58 Ne! 99 01 (Re;1 isioR e) ~J o*temeer 2012 a n event affects a single-train SAFETY SYST E M, then the emergency cl ass ification should be made based on plant parameters

/symptoms meeting the E ALs for another TC. Depending upon the circ u mstances, classificatio n may also occur based o n Shift Manager/Emergency Director judgement.

Ind i cations of degraded performance addresses damage to a SAFETY SYSTEM tra i n that is i n serv i ce/operation s i nce indications for it wi ll be readily available.

The indications of degraded performance should be significa n t enough to cause concern regarding the operabi l ity or reliability of the SAF E TY SYSTEM train. 259

~JEI 99 QI (ReYisioA e) No,*ember 2Q 12 VISIBLE DAMAGE addresses damage to a SAFETY SYSTEM train that is not in service/operation and that potentially could cause performance issues. Operators will make this determination based on the totality of available event and damage report information.

This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. This VISIBLE DAMAGE should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train. 261 Tl-IE! 99 0 I (Re,,*isioA

6) November 2012 This IC addresses a hazardous event that causes damage to a SAFETY SYSTEM, or a structure containing SAFETY SYSTEM components, needed for the current operating mode. This condition significantly reduces the margin to a loss or potential loss of a fission product barrier , and therefore represents an actual or potential substantial degradation of the level of safety of the EAL l.b.l addresses damage to a SAFETY SYSTEM train that is in serYice/operation since indications for it 1,vill be readily available.

The indications of degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train. EAL 1.b.2 addresses damage to a SAFETY SYSTEM component that is not in service/operation or readily apparent through indications alone, or to a structure containing SAFETY SYSTEM components.

Operators will make this determination based on the totality of available eYent and damage report information.

This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. Escalation of the emergency classification level would be via IC FS 1 or Ml-RS 1. Develeper Netes: For (site specific hazards), developers should consider including other significant, site specific hazards to the bulleted list contained in EAL 1.a (e.g., a seiche). *Nuclear power plant SAFETY SYSTEMS are comprised of t>.¥0 or more separate and redundant trains of equipment in accordance with site specific design criteria.

EGL Assignment ,r\ttributes:

3.1.2.B 262 ECL: Site Area Emergency NEI 99 0 I (Re*,isioR

6) No*,emeer 2012 551 Initiating Condition:

Loss of ALLa-lt offsite and al-I-ALL onsite AC power to emergency essential-buses for 15 minutes or longer. Operating Mode Applicability:

Pov,*er Operation , Startup , Hot Standby , Hot Shutdownl....1.J Example Emergency Action Level s: Note: The Emergency Director should declare the Site Area Emergencyevent promptly upon determining that the applicable time 15 minutes has been exceeded , or will likely be exceeded.

S 1.1 Loss of ALL offsite and ALL onsite AC power to (site specific emergenC)' buses) 1 A3 and 1A4 buses for 15 minutes or longer. Definitions:

SAFETY SYSTEM: A s ystem required for safe plant operation.

cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling do 1.vn the plant and/or placing it in the cold shutdovm condition, including the EGGS. Systems cla s sified a s safety related. Basis: This IC addresses a total loss of AC power that compromises the performance of a ll SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling , containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. In addition, fission product barrier monitoring capabilities may be degraded under these conditions.

This IC represents a condition that involves actual or likely major failures of plant functions needed for the protection of the public. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. Esca l ation of the emergency c l assification l eve l wou ld be via I Cs AG+RG 1 , FG I or SG I. De*;eloper Notes: For a power source that has multiple generators , the EAL and/or Basis section should reflect the minimum number of operating generators necessary for that source to provide adequate power to an AC emergency bus. For e>rnmple , if a backup power source is comprised of two generators (i.e., tv,o 50% capacity generators sized to feed 1 AC emergency bus), the E AL and Basis section must specify that both generators for that source are operating.

The " site specific emergency buses" are the buses fed by offsite or emergency AC power sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typically l emergenC)' bus per train of SAFETY SYSTEMS. 263 _J NBT 99 0 I (RevisioA

6) November 2012 The EAL and/or Basis section rnay specify use of a non safety related power source pro 1 1ided that operation of this source is controlled in accordance with abnorrnal or ernergency operating procedures , or beyond design basis accident response guidelines (e.g., FLEX support guidelines).

Such power sources should generally rneet the "Alternate ac source" definition provided in 10 GFR 50.2. At rnulti unit stations , the EA.Ls rnay credit compensatory rneasures that are proceduralized and can be irnplernented within 15 minutes. Consider capabilities such as power source cross ties, " swing" generators , other po 1.Yer sources described in abnormal or ernergency operating procedures , etc. Plants that have a proceduralized capability to supply offsite AG power to an affected unit via a cross tie to a cornpanion unit may credit this po 1.ver source in the EAL provided that the planned cross tie strategy meets the requirernents of 10 GFR 50.63. EGL Assignrnent Attributes:

3.1.3.B 264 ECL: Site Area Emergency

~JEI 99 0 I (RevisioA

6) November 2012 SS8SS2 Initiating Condition:

Loss of ALL Vital DC power for 15 minutes or longer. Operating Mode Applicability:

l, 2, 3 Emergency Action Levels: Note: The Emergency Director should declare the Site Area Emergenc)'event promptly upon determining that the applicable time 15 minutes has been exceeded, or will likely be exceeded.

~S+=-2~. l __ Indicated voltage is less than (site specific bus voltage value) 105 VDC on ALL(site specific Vital DC busses) BOTH Div 1 and Div 2 125 VDC buses for 15 minutes or longer. Definitions:

SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling do,Yn the plant and/or placing it in the cold shutdown condition, including the EGGS. S)'stems classified as safet)' related. Basis: This IC addresses a loss of Vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown , this condition involves a major failure of plant functions needed for the protection of the public. Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. Escalation of the emergency classification level would be via I Cs AG-1-RG 1 , FG 1 or SG2. 265

~ml 99 Ql (RtwisioA a) No*,emaer 2Q12 SS5SS6 ECL: Site Area Emergency Initiating Condition:

Inability to shutdown the reactor causing a challenge to (core cooling [PWR] I RPV water level [BWR]) or RCS heat removal. Operating Mode Applicability:

Power OperationLl Examf)le Emergency Action Levels: S 6.1 a. b. An automatic or manual (trip [PWR] / scram [BV/R]) did not shutdown the reactor. AND ALL of the following manual actions taken at 1 COS are not successful in lowering reactor power be l ow 5% power:

• Manual Scram Pushbuttons

• Mode Switch to Shutdown

• Alternate Rod Insertion (ARI)AII manual actions to shutdown the reactor have been unsuccessful.

AND c. EITHER of the following conditions exist: Definitions:

Basis: _* _(Site specific indication of an inability to adequately remove heat from the core) Reactor vessel 'NaterRPV level cannot be restored and maintained above -25 inches. * (Site specific indication of an inability to adequately remove heat from the -RGSjHCL (Graph 4 of EOP 2) exceeded.

This IC addresses a failure of the RPS to initiate or complete an automatic or manual reactor ftFtp [PWR] I scram [BWR]) that results in a reactor shutdown , all subsequent operator actions to manually shutdown the reactor are unsuccessful , and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.

In some instances , the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Recognition 266 NE! 99 QI (ReYisieR

6) "t-Je¥ember 2Q 12 Category F ICs/EALs.

This is appropriate in that the Recognition Category F ICs/EALs do not address the additional threat posed by a failure to shutdown the reactor. The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shutdown the reactor. The reactor shou l d be considered shutdown when it is producing less heat than the maximum decay heat load for which the SAFETY SYSTEMS are designed (typically 3 to 5% power). A reactor shutdown is determined in accordance with applicable Emergency Operating Procedure criteria. Esca lati on of the emergency c l assification le ve l would be via IC AG+-RG 1 or FG 1. De*,relof)er Notes: This IC is applicable in any Mode in which the actual reactor povt'er level could e,rneed the power level at vt'hich the reactor is considered shutdown.

A PWR with a shutdown reactor power level that is less than or equal to the reactor power level which defines the lower bound of Power Operation (Mode 1) will need to include Startup (Mode 2) in the Operating Mode Applicability.

For e,rnmple , if the reactor is considered to be shutdown at 3% and Power Operation starts at >5%, then the IC is also applicable in Startup Mode. Developers may include site specific EOP criteria indicative of a successful reactor shutdown in an EAL statement, the Basis or both (e.g., a reactor power level). Site specific indication of an inability to adequately remove h e at from the core: [BWR] Reactor vessel water level cannot be restored and maintained above Minimum Steam Cooling RPV Water Level (as described in the EOP bases). [PWR] Insert site specific values for an incore/core e,cit thermocouple temperature and/or reactor vessel water level that drives entry into a core cooling restoration procedure (or otherwise requires implementation of prompt restoration actions).

Alternately , a site may use incore/core e J lit thermocouple temperatures greater than l , 200 6 F and/or a reactor vessel water level that corresponds to apprmcimatel)

' the middle of active fuel. Plants vt'ith reactor vessel level instrumentation that cannot measure down to approximately the middle of active fuel should use the lowest on scale reading that is not above the top of active fuel. If the lo'Nest on scale reading is above the top of active fuel , then a reactor vessel level value should not be included. For plants that have implemented Westinghouse Owners Group Emergency Response Guidelines , enter the parameters used in the Core Cooling Red Path. Site specific indication of an inability to adequately remove heat from the RCS: [BWR] Use the Heat Capacit)' Temperature Limit. This addresses the inability to remove heat via the main condenser and the suppression pool due to high pool water temperature.

[PWR] Insert site specific parameters associated with inadequate RCS heat removal via the steam generators. These parameters should be identical to those used for the Inadequate Heat Removal threshold Fuel Clad Barrier Potential Loss 2.B and threshold RCS Barrier Potential Loss 2.A in the PWR EAL Fission Product Barrier Table. EGL Assignment Attributes:

3.1.3.B 267 SS8 ECL: Site Area EmergeRcy Initiating Condition:

Loss of all Vital DC power for 15 miRutes or loRger. --------------~ 1%1 99 GI (ReYisioA

6) November 2G 12 Of)erating Mode Af)f)lieability:

Power OperatioR , Startup , Hot 8taRdb;*, Hot 8hutdovm1, 2, 3, 4 Examf)le Emergeney Aetion Levels: Note: The EmergeRcy Director should declare the Site Area EmergeRcy promptly upoR determiRiRg that 15 miRutes has beeR e)weeded, or will likely be e)weeded.

l lAdicated voltage is less thaR (site specific bus voltage value)l 15 VOC OR ALL (site specific Vital DC busses) 1(2) D O l, D 02, D 03, aRd D 04 for 15 miRutes or loRger. Basis+ SAFETY 8Y8TEM: /*, system required for safe plaRt operatioR, cooliRg dowR the plaRt aRd/or placiRg it iR the cold shutdovm coRditioR, iRcludiRg the EGGS. Systems classified as safety related. This IC addresses a loss of Vital DC power which compromises the ability to moRitor aRd coRtrol SAFETY 8Y8TEM8. IA modes above Cold 8hutdowR , this coRditioR iRvolves a major failure of plaRt fuRctioRs Reeded for the protectioR of the public. FifteeR miRutes was s~lected as a threshold to e,wlude traRsieRt or momentary power losses. EscalatioR of the emergeRcy classificatioR level 1 Nould be via ICs AGlB.Ql , FGl or 808. DeYelof)er Notes: The "site specific bus Yoltage value" should be based OR the miRimum bus voltage Recessary for adequate operatioR of SAFETY 8Y8TEM equipmeRt.

This voltage value should iRcorporate a margiR of at least 15 miRutes of operatioR before the oRset of iRability to operate those loads. This voltage is usually Rear the miRimum voltage selected wheR battery siziRg is performed. The typical value for aR eRtire battery set is appFO>(imately 105 VDC. For a 60 cell striRg of batteries , the cell voltage is apprmdmately 1.75 Volts per cell. For a 58 striRg battery set , the miRimum voltage is approximately 1.81 Volts per cell. The " site specific Vital DC busses" are the DC busses that provide moRitoriRg aRd coRtrol capabilities for SAFETY 8Y8TEM8. EGL AssigRmeRt Attributes:

3.1.3.B 268 1'IBI 99 O I (ReYisioR e) NoYemeer 2012 SG1 ECL: General Emergency Initiating Condition:

Prolonged loss of al-l-ALL offsite and ALLalt onsite AC power to emergency essential buses. Operating Mode Applicability

Power Operation , Startup , Hot Standby , Hot ShutdovmL..1.,__J Example Emergency Action Level s: Note: The Emergency Director should declare the General Emergencyevent promptly upon determining that (site specific hours) the applicable time 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> has been exceeded, or will likely be exceeded. a. Loss of ALL offsite and ALL onsite AC power to 1A3 and 1 A4 specific emergency buses). AND b. EITHER of the following:

Definitions:

_* _Restoration of at least one AC emergency essential bus in less than specific hours)4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> is not likely. OR * (Site specific indication of an inability to adequately remo*,e heat from the serejRPV level cannot be restored and maintained above -25 inches. SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the EGGS. Systems classified as safety related. Basis: Th i s IC addresses a prolonged loss of all power sources to AC emergency essential buses. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/press u re control, spent fuel heat removal and the ultimate heat sink. A prolonged loss of these buses will lead to a loss of one or more fission product barriers.

In addition , fission product barrier monitoring capabi l ities may be degraded under these cond i tions. The EAL should require declaration of a General Emergency prior to meeting the thresholds for IC FG 1. This will allow additional time for implementation of offsite protective actions. Escalation of the emergency classification from Site Area Emergency will occur if it is projected that power cannot be restored to at least one AC emergency essential bus by the end of the analyzed 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> station blackout coping period. Beyond this time , plant responses and event trajectory are subject to greater uncertainty, and there is an increased l i kelihood of challenges to multiple fission product barriers.

269

~JEI 99 QI (ReYisioA e) ~Je*remeer 2Q 12 The estimate for restoring at least one essentialemergency bus should be based on a realistic appraisal of the situation.

Mitigation actions with a low probability of success should not be used as a basis for delaying a classification upgrade. The goal is to maximize the time available to prepare for , and implement , protective actions for the public. 270

NEI 99 0 I (RevisioA

6) No¥ember 2012 The EAL will also require a General Emergency declaration if the loss of AC power results in parameters that indicate an inability to adequately remove decay heat from the core. De*,reloper Notes: Although this JG and EAL may be vie*,*,ced as redundant to the Fission Product Barrier IGs , it is included to provide for a more timely escalation of the emergency classification level. The " site specific emergency buses" are the buses fed by offsite or emergency AG pov,*er sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typical I)' 1 emergency bus per train of SAFETY SYSTEMS. The "site specific hours" to restore AG power to an emergency bus should be based on the station blackout coping analysis performed in accordance with 10 GFR § 50.63 and Regulatory Guide 1.155 , Stetien Bkwkeut. Site specific indication of an inability to adequately remove heat from the core: [BWR] Reactor vessel ;vater level cannot be restored and maintained above Minimum Steam Cooling RPV \1/ater Level (as described in the EOP bases). [PWR] Insert site specific values for an incore/core e>dt thermocouple temperature and/or reactor vessel water le*,rel that drive entry into a core cooling restoration procedure (or othervrise requires implementation of prompt restoration actions).

Alternately , a site may use incore/core e>(it thermocouple temperatures greater than l , 200°F and/or a reactor vessel water level that corresponds to appro>(imately the middle of active fuel. Plants with reactor vessel level instrumentation that cannot measure down to approximately the middle of active fuel should use the lowest on scale reading that is not above the top of active fuel. If the lowest on scale reading is above the top of active fuel , then a reactor vessel level value should not be included.

For plants that have implemented Westinghouse Ovmers Group Emergency Response Guidelines , enter the parameters used in the Gore Cooling Red Path. EGL Assignment Attributes:

3.1.4.B 272 NEI 99 0 I (ReYisioR

6) r>Jovemeer 2012 SG8SG2 ECL: General Emergency Initiating Condition:

Loss of al-I-ALL AC and Vital DC power sources for 15 minutes or longer. Operating Mode Applicability:

Power Operation , Startup , Hot Standby , Hot Shutdown.l.,_l,_l Example Emergency Action Level s: Note: The Emergency Director should declare the General Emergencyevent promptly upon determining that the applicable time 15 minutes has been exceeded , or will likely be exceeded.

a. b. Definitions:

Loss of ALL offsite and ALL onsite AC power to (site specific emergency

---b-u ... s-e-s)+-1A3 and 1A4 buses for 15_-minutes or longer. AND Indicated voltage is less than (site specific bus voltage value) 105 VDC on Abb (site speeifie Vital DC busses) BOTH Div 1 and Div 2 125 VDC buses for 15 minutes or longer. SAFETY SYSTEM: A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These systems are classified as safety-related.A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the EGGS. Systems elassified as safety related. Basis: This IC addresses a concurrent and prolonged loss of both AC and Vital DC power. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling , containment heat removal/pressure control , spent fuel heat removal and the ultimate heat sink. A loss of Vital DC power compromises the ability to monitor and control SAFETY SYSTEMS. A sustained loss of both AC and DC power will lead to multiple challenges to fission product barriers.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses. The 15-minute emergency declaration clock begins at the point when both EAL thresholds are met. De,*eleper Netes: The "site specific emergency buses" are the buses fed by offsite or emergency AC pov;er sources that supply power to the electrical distribution system that powers SAFETY SYSTEMS. There is typically l emergency bus per train of SAFETY SYSTEMS. The " site specific bus voltage value" should be based on the minimum bus voltage necessar)' for adequate operation of SAFETY SYSTEM equipment.

This Yoltage value should incorporate a margin of at least 15 minutes of operation before the onset of inability to operate those loads. This voltage is usually near the minimum voltage selected when battery sizing is performed.

273 NE[ 99 0 I (Re*,*isieA a) Nevemeer 20 I 2 The typical value for an entire battery set is apprmlimately l 05 VDC. For a 60 cell string of batteries , the cell voltag e is approximately 1.75 Volts per cell. For a 58 string battery set , the minimum voltage is apprmlimately 1.81 Volts per cell. The " site specific Vital DC busses" are the DC busses that pro11ide monitoring and control capabilities for SAFETY SYSTEMS. This IC and EAL 1.vere added to Revision 6 to address operating experience from the March , 2011 accident at Fukushima Daiichi. EGL Assignment Attributes:

3.1.4.B 2 7 4

}ffil 99 0 I (Re\*isioA e) }fo\1 eme er 20 1 2 APPENDIX A -ACRONYMS AND ABBREVIATIONS AC ......................................................

..........................

...................................... Alternating Current AOP ...............................................................................

..................

Abnormal Operating Procedure A .......................................................................................................................................... r, PFJi.4 ........................................................

............................................ /\verage Po 1.ver Range Meter ATWS ........................

...........................................................

Anticipated Transient Without Scram .......................................................................................................................................... 8 &¥.' ..........................................................

......................................................... Babcock and \l/ilcox ............................................

.............................................................................................. B HT ....................................................................

................... Boron Injection Initiation Temperature BWR ...............................................................

.....................

......................... Boiling Water Reactor CDE ................................................................................

......................

Committed Dose Eq uivalent CFR .........................

........................

..............................

.................

...... Code of Fe deral Re g ul at ions CT~4T/CNMT .................................................................

.............................................. Containment

.......................................................................................................................................... C 8F ....................................................

................

............................

................ Critica l Safety Fu n ction .......................................................................................................................................... C 8F8T ...........................................................

.......................

...... Critical Safety Function Status Tree ..............................................................................

............................................................ D BA .....................................................................

............................................ Design Basis i\ccident DC ...................................................

................................

....................

....................... Direct Curre nt EAL .......................

...................................

..........................................

....... E mergency Action Level ECCS ..................

...............................................

..................

.........

E mer ge nc y Core Cooling System ECL ....................................

......................

.........................

.............

E mer ge nc y Class i fication Level E OF ...................

..........................................

......................

............... E mergenc y Operations Fac ilit y E OP .....................

.....................................

..................

...................

Eme r gency Operating Procedure EPA ......................................................................................

....... Env iron1nental Protection Agency E PG ...........................................................

........................

............

E mer ge nc y Procedure Guideline

..............................................................................

............................................................ E PIP .......................................................

..........................

.. gmergency Plan Implementing Procedure

.......................................................................................................................................... E PR ...............................

.......................................................

................... g yolutionary Po\ver Reactor .......................................................................................................................................... E PRJ ....................................................

.................................

.......... Electric Power Research Institute

.......................................................................................................................................... g RG ...................................................................................

............... Emergency Response Guide l ine .......................................................................................................................................... F EMA .................

..............

...........................

......................

Federal Emergency Management Agency f8AR .......................................................

............................................ fin al Safety Ana l ysis Report GE ...........

................................

...............

......................................

...................... General E mergency HC+L ...................................................................

....................... Heat Capacity Temperature Lim i t HPCI .............

....................

.............................................

................

High Pressure Coo l ant Injection

...............................................

........................................................................................... H 81 .......................................................................

..........

............................... Human System Interface IC .....................................................................................

...............

....................

lnitiating Condition Nel 99 01 (Re\'i s ioA e) T>lo¥efl'leer 2012 ...................................................

.......................................................

................

................ I D ...............

.....................................................................

...........................................

Inside Diameter IP E EE. ............................ Individual Plant E>rnmination of External Events (Generic Letter 88 20) ISFSI ...........................................................................

Independent Spent F u el Storage Installation Keff ....................................................................................

Effective Neutron M ultiplic ation Factor LCO ...............................

.............................

..........................

......... Limiting Conditio n of Operation

...................................................

................

.......................................................................

L OCA .........................................................................................

................. Loss of Coo l ant Accident ****************************************************************************************************************************************** ~4 CR ................................................

.................................

.........................

........... ~4ain Control Room ..................................

..............

.....................

.........................

.....................

.....................

.. ~4 SIV .............

..............

.........................................

.............

....................... ~4ain Steam Isolation Valve ~<ISL ...............

.........................

........................................

................

....................... ~<fain Steam Line mR , mRem , mrem , mREM ....................

................................

........ milli-Roentgen E quivalent Man MW .......................

.................

..................

......................

....................................................

Megawatt NEI ................................

.............................................................................

Nuclear E ner gy Inst itut e ...............

.............

...............................................................................

................

...............

l>+ PP ...........

................

...............................

..........

.............................................

.... l'+uclear Po\ver Plant .......................................................................................................................................... N RC ................................

.......................

.............

...............

..............

N ucl ear Regulatory Commission NSSS ...............................................................

..................................

Nuclear Steam Supply System NORAD ................................

..........................

....... North American Aerospace Defense Com mand fN O)UE ..........................................................

...........

.....................

fN ot ifi cation O ff Unusual Event NUMARC 1 *************************

• • • • • N ucl ear Management and Resources Co un ci l OBE ....................................................

............................

..................

..... Operating Basis Eart hquake OCA .......................

....................

...............

....................

..................

............. Owner Co ntr olled Area .................................

..............

.....................

....................

...................

............................... 0 f)GML ODAM .........................................................

Offsite Dose Calculation (Assessment) Man u al ORO .........................

........................

.................................

..............

Off site Re s ponse Organiz:ation PA ...........

.....................

...............

............

............................................................

....... Protected Area ...................

............

.....................

.....................................

................................................. p ACS .........................

....................

.........................................

Priority Actuation and Centro I System PAG ........................

..................................

........................

...........

.......... Protective Action Guide lin e *************************

• • • • • • • • • • • • • • • • • • • • p JCS ................................................

................................... Proces s Information and Control System PRA/PSA ....................................

Probabilistic Risk Assess m e nt/ Probabilistic Safety Assessment PWR ........................................................................................................

Pressurized Water Reactor ******************

• • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • p S ..........................................................

.................

..................

.............................. Protection System PSIG ........................................................................................

......... Pounds per Square Inch Gauge R .......................................

...................

.................

....................

.......................................... Roentgen ........................................................................

.................................................................. R CC ...........................................................

...........

....................

..........

.......... Reactor Control Console RCIC .....................

.....................................

.....................................

Reactor Core Isolation Coo lin g 1 NUMARC was a predecess or o r ga nization of the Nuc l ear Energy In st itut e (NE I). A-2 NE! 99 0 I (Re¥isioA

6) ~io¥ember 2012 RCS .........................................................................

.......................

............. Reactor Coolant System Rem, rem , REM .....................................................................

................. Roentgen Equivalent Man .........................

...................

.............

.................

................

.............................................

... R ETS ......................

....................

............

.............

...... Radiological Effluent Technical Specifications RPS ................................

................

...............................

.......................... Reactor Protection System RPV ............

....................

...............

.................................

.................

............ Reactor Pressure Vessel ..............................

.................

...........................................................................................

R VLIS ...................

.......................................

...........

.... Reactor Vessel Level Instrumentation System RWCU ......................................................................................

.................... Reactor Water Cleanup ..........................................................................................................................

................ s AR ....................................

......................

............

...............................

........... Safet)' ,<\nalysis Report ***********************************************************

s AS .......................

........................

...........

.....................

................

........... Safety ,<\utomation System .......................

...........................

......................

............................

......................................

s BO .................................................

..............

.............................

..........................

..... Station Blackout SCBA ...............

...................................

................................... Self-Contained Breathing Apparatus

..............................

...............

................

...................

.....................................

..................... s G .........................

.........................

...................................

................

......................... Steam Generator

............................................................................

...................................................

...........

s I ..........................................

...................

...........................

........................................ Safety Injection

............................

...............................................

....................................

.........................

.. s JCS ....................................................................

................. Safety Information and Control System ******************************

s PDS ...................

..........................................................

................. Safety Parameter Display System SRO .................

................................................

...........................................

Senior Reactor Operator TEDE .................................

.........................

...................................

Tota l Effective Dose Equivalent T G AF ............................................................

..............................

........................ Top of Active Fue l TSC ..................

...................................

................

..................................... Technical Support Center ........................

.............................................

..............................

.............

.......................... U FSAR ............................

.....................

...................................

Updated Final Safety Analysis Report \VOG ...................

..........................

.....................................................

\Vestinghouse 0 1.vners Group NEI 99 QI (ReYisioA a) November 2Ql2 APPENDIX B -DEFINITIONS t>i:El 99 0 I (Re.,.isioA

6) }fo.,.ember 2012 The following definitions are taken from T itl e 10 , Code of Federal Regulations, and related regu lat ory guidance documents.

Alert: Events are in progress or have occ urr ed which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA PAG exposure levels. General Emergency: Events are in progress or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actua l lo ss of physical contro l of the facility. Releases can be reasonably expected to exceed EPA PAG exposure levels offsite for more than the immediate site area. Notification of Unusual Event (NOUE)\ Events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated.

No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of safety systemsSAFETY SYSTEMS occurs. Site Area Emergency:

Events are in progress or have occurred which involve actua l or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that resu lt s in intentional damage or malicious acts; 1) toward site personnel or equipment that could lead to the likely failure of or; 2) that prevent effective access to , equipment needed for the protection of the public. _Any releases are not expected to result in exposure levels which exceed EPA PAG exposure levels beyond the site boundary.

The following are key terms necessary for overall understanding the NEI 99 01DAEC emergency classification scheme. Emergency Actio n Level (EAL): A pre-determined , site-specific, observable threshold for a n Initiating Condition that, when met or exceeded , places the plant in a g i ven emergency classification level. Emergency Classification Level (ECL): One of a set of names or titles established by the US Nuclear Regulatory Commission (NRC) for grouping off-normal events or conditio n s according to (1) potential or actual effects or consequences , and (2) resulting onsite and offsite response actions. The emergency classification leve l s , in ascending order of severity , are: Notification of Unusual Event (NOUE) Alert Site Area Emergency (SAE) General Emergency (GE) + This term is sometimes shorteAed to UAusual E.,.eAt (VE) or other similar site speeifie termiAology.

B-1

~lEI 99 01 (Re\*isioR

6) November 2012 Fission Product Barrier Threshold:

A pre-determined, site-specific, observable threshold indicating the loss or potential loss of a fission product barrier. Initiating Condition (IC): An event or condition that aligns with the definition of one of the four emergency classification levels by virtue of the potential or actual effects or consequences.

Selected terms used in Initiating Condition and Emergency Action Level statements are set in all capital letters ( e.g., ALL CAPS). These words are defined terms that have specific meanings as used in this document.

The definitions of these terms are provided below. CONFINEMENT BOUNDARY: (Insert a site speeific definition for this term.) Developer Note -The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. This corresponds to the pressure boundary for the Dry Shielded Canister (DSC) shell (including the inner bottom cover plate) base metal and associated confinement boundary welds. CONTAINMENT CLOSURE: Procedurally defined actions taken to secure containment and its associated structures, systems, and components as a functional barrier to fission product release under existing plant conditions.

For DAEC, this is considered to be Secondary Containment as required by Technical Specifications.

CONTAINMilff CLOSURE: (Insert a site speeific definition for this term.) DeYeloper Note Site speeific proeedurally defined aetions taken to seeure eontainment and its assoeiated struetures, systems, and eomponents as a funetional barrier to fission product release under e>(isting plant eonditions.

For DAECs, this is considered to be Secondary Containment as required by Teehnieal Specifieations.The proeedurally defined eonditions or aetions taken to secure containment (primary or secondary for BWR) and its assoeiated struetures , systems , and eomponents as a functional barrier to fission product release under shutdovm eonditions.

DESIGN BASIS EARTHQUAKE (DBE): A DBE is vibratory ground motion for which certain (generally, safety-related) structures, systems, and components must be designed to remain functional.

EXPLOSION:

A rapid , violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization.

A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding , arcing , etc.) should not automatically be considered an explosion.

Such events may require a post-event inspection to determine if the attributes of an explosion are present. F/\ULTED:

The term applied to a steam generator that has a steam leak on the seeondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to beeome eompletely depressurized.

Developer Note This term is applicable to PV/Rs only. B-2

---

Ne! 99 0 I (RevisioR

6) ~/0 1 ,emaer 2012 FIRE: Combustion characterized by heat and li ght. Sources of smoke such as slipping drive belts or overheated electrica l eq uipm ent do not constitute FIRES. Observation of flame is preferred but is NOT required if l arge quantities of smoke and heat a r e observed. HOSTAGE: A person(s) held as l everage aga in st the stat i on to ensure that demands will be met by the station. HOSTILE ACTION: An act toward a NP-llnuclear power plant or its personnel that includes the use of violent force to destroy equipment , take HOSTAGES , and/or intimidate the lic ensee to ac hi eve an end._ This includes attack by air , land, or water using guns , explos i ves , PROJECTILEs , veh i cles , or other devices used to de li ver destructive force. _Other acts that sat isf y the overa ll int ent may be inc luded. HOSTILE ACTION shou ld not be construed to include acts of civil disobedience or fe l on iou s acts that are not part of a concerted attack on the NPJ!nuclear power plant._ Non-terrorism-b ased EALs should be used to address such activities (i.e.,_-this may include violent acts between individuals in the owner controlled area) .

• HOSTILE FORCE: One or more individuals who are engaged in a determined assau l t , overtly or by stea lth and deception , equ ipp ed with su it ab l e weapo n s capable of killing , maiming , or causing destruction.

IMMINENT:

The trajectory of events or conditions is s u ch that an EAL will be met within a re lativel y short period of time regardless of mitigation or corrective actions. INDEPENDENT SPENT FUEL STORAGE INSTALLATION (ISFSI): A complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. NOR~4AL LEVELS: As applied to radiologieal IG/EALs , the highest reading in the past twenty four hours exeluding the eurrent peak value. OPERA TING BASIS EARTHQUAKE (OBE): An OBE is vibratory ground motion for which those features of a nuclear power plant necessary for continued operat i on without undue risk to the health and safety of the public will remain functional.

OWNER CONTROLLED AREA: (Insert a site speeifie definition for this term.) Developer Note This term is typically taken to mean the site property owned by , or otherw i se und er the co ntrol of , the licensee.

Tn some cases , it may be appropriate for a lieensee to define a smaller area with a perimeter eloser to the plant Proteeted Area perimeter (e.g., a site with a large OGA where some portions of the boundary may be a signifieant distanee from the Proteeted Area). In these eases , developers should eonsider using the boundary defined by the Restricted or Seeured Ovmer Controlled Area (ROGfJSOGA). The area and boundar)'

seleeted for seheme use must be eonsistent 1 ,vith the deseription of the same area and boundary eontained in the Seeurity Plan. PROJECTILE:

An object directed toward a NP-llnuclear power plant that could cause concern for its continued operability , rel i abi lit y, or personnel safety. B-3 NE! 99 QI (RevisieA e) ~Jevemaer 2Q 12 PROTECTED AREA:_ (Insert a site specific definition for this term.) De~relaper Nate This term is typically taken to mean ti he area under continuous access monitoring and control , and armed protection as described in the site Security Plan. REFUELING PATHWAY:_ (Insert a site specific definition for this term.) Develaper Nate This description should include all the cavities, tubes, canals and pools through which irradiated fuel may be moved , but not including the reactor vessel. Includes all the cavities, tubes, canals and pools through which irradiated fuel may be moved, but not including the reactor vessel. RtJPTURE(D):

The condition of a steam generator in 1 , 1 ,rhich primar)' to secondary leakage is of sufficient magnitude to require a safety injection. Develaper Nate This term is applicable to PWRs only. SAFETY SYSTEM: A system required for safe plant operation , cooling down the plant and/or placing it in the cold shutdown condition , including the ECCS. These are typically systems are classified as safety-related.

Develaper Nate This term may be modified to include the attributes of " safety related" in accordance with 10 CFR 50.2 or other site specific terminology, if desired. SECURITY CONDITION:

Any Security Event as listed in the approved security contingency plan that constitutes a threat/compromise to site security , threat/risk to site personnel , or a potential degradation to the level of safety of the plant. _A SECURITY CONDITION does not involve a HOSTILE ACTION. SITE BOUNDARY:

That line beyond which the land is neither owned, nor leased. nor otherwise controlled by the Company. UFSAR Figure 1.2-1 identifies the DAEC SITE BOUNDARY.-: UNISOLABLE:

An open or breached system line that cannot be isolated , remotely or locally. UNPLANNED:

A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient.

The cause of the parameter change or event may be known or unknown. VISIBLE DAMAGE: Damage to a component or structure that is readily observable without measurements , testing , or analysis.

_The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected component or structure.

Damage resulting from an equipment failure and limited to the failed component (i.e., the failure did not cause damage to a structure or any other equipment) is not VISIBLE DAMAGE. B-4 B-5 NEI 99 g I (Re'lisieA e) NeYember 2012 NEI 99 0 I (Re,*isioA

6) ~tOY6fl'l06F 20 J 2 APPENDIX C PERMANENTLY DEFUElED STATION ICs/EAls Recognition Category PD provides a stand alone set of ICs/EALs for a Permanently Defueled nuclear power plant to consider for use in developing a site specific emergency classification scheme. For development , it was assumed that the plant had operated under a 10 CFR § 50 license and that the operating company has permanently ceased plant operations.

Further , the company intends to store the spent fuel within the plant for some period of time. When in a permanently defueled condition , the plant licensee typically receives approval from the NRG for eJ(emption from specific emergency planning requirements.

These eJ(emptions reflect the lowered radiological source term and risks associated 1.vith spent fuel pool storage relative to reactor at power operation.

Source terms and accident analyses associated

\.Vith plausible accidents are documented in the station's Final Safety Anal)1 sis Report (FSAR), as updated. As a result, each licensee will need to develop a site specific emergency classification scheme using the :NRG approved exemptions , revised source terms , and revised accident analyses as documented in the station's FSAR. Recognition Category PD uses the same ECLs as operating reactors; however , the source term and accident analyses typically limit the ECLs to an Unusual Event and Alert. The Unusual Event ICs provide for an increased awareness of abnormal conditions 1.vhile the Alert ICs are specific to actual or potential impacts to spent fuel. The source terms and release motive forces associated with a permanently defueled plant would not be sufficient to require declaration of a Site Area Emergency or General Emergency.

A permanently defueled station is essentially a spent fuel storage facility 1.vith the spent fuel is stored in a pool of water that serves as both a cooling medium (i.e., removal of decay heat) and shield from direct radiation. These primary functions of the spent fuel storage pee I are th e focus of the Recognition Category PD ICs and EALs. Radiological effluent IC and EALs were included to provide a basis for classifying eyents that cannot be readily classified based on an obserYable e\.1 ents or plant conditions alone. Appropriate ICs and EALs from Recognition Categories A, C , F , H , and S 1 ,\.1 ere modified and included in Recognition Category PD to address a spectrum of the events that may affect a spent fuel pool. The Recognition CategOF)'

PD ICs and EALs reflect the relevant guidance in Section 3 of this document (e.g., the importance of avoiding both over classification and under classification).

Nonetheless , each licensee will need to develop their emergency classification scheme using the NRG approved eJ(emptions , and the source terms and accident analyses specific to the licensee.

Security related events will also need to be considered.

C-1 l>lel 99 0 I (Re1t*isioR

6) l>Jo,*emeer 2012 Table PD 1: Reeognition Category "PD" Initiating Condition MatFix UNUSUAL EVENT PD ,A .. Ul Release of gaseous or liquid radioactivit)*

greater than 2 tirnes the (site specific effluent release controlling docurnent) limits for 60 rninutes or longer. Op. },lodes: llfetApplicehlc PD AU2 UNPLA1'J1'ffiD rise in plant radiation levels. Op. A fede s: Ne tA ppli c ehle PD SUl UNPLA1'J1'ffiD spent fuel pool temperature rise. Op. },lodes: l*let Applicehlc PD HUl Confirrned SECURITY C01'JDITI0N or threat. Op. },lodes: ,VetAppliceblc PD HU2 Hazardous event affecting SAFETY SYSTEM equipment necessary for spent fuel cooling. Op. Modes: ,"hlet Appliceblc PD HUJ Other conditions e>dst which in the judgment of the Emergency Director *.varrant declaration of a (NO)UE. Op. },fedes: ,"hlet Applicehlc ALERT PD AAl Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrern TEDE or 50 rnrern thyroid CDE. Op. },fedes: ,"hletAppliceble PD AA2 UNPLA1'J1'mD rise in plant rad i at i on le;*els that irnpedes plant access required to maintain spent fuel integrity.

Op. },fedes: , Vet Applirnble PDHAl HOSTIL E ACTION v,ithin the OW1'J:ER CONTROLLED AREA or airborne attack threat within 30 minutes. Op. },fedes: A'etApplicehle PD HAJ Other conditions e>dst which in the judgrnent of the Ernergency Director warrant declaration of an Alert. Op. },{edes: ,VetAppliceble

,-------------------, : Table intenaea for use by 1 1 BAL aevelopers.

Inclu s ion in licensee C-2 I ..I , , ..I , uocurnents 1s not requ1reu. 1 L------------------J

---~------------ECL: Notification of Unusual Event ~/EI 99 Ql (Revision

6) ~lovomeor 2Ql 2 PD AU1 Initiating Cenditien:

Release of gaseous or liquid radioactivit)

' greater than 2 times the (site specific effluent release controlling document) limits for 60 minutes or longer. Netes: Operating Mede Applieability:

Not Applicable Example Emergeney Aetien Levels: (l or 2)

• The Emergency Director should declare the Unusual Event promptl)' upon determining that 60 minutes has been exceeded , or will likely be exceeded.

• If an ongoing release is detected and the release start time is unlmown , assume that the release duration has e>weeded 60 minutes.

• If the effluent flow past an effluent monitor is knovm to have stopped due to actions to isolate the release path , then the effluent monitor reading is no longer valid for classification purposes. (l) (2) Reading on ,A_._..""JY effluent radiation monitor greater than 2 times the alarm setpoint established by a current radioactiYity discharge permit for 60 minutes or longer. Sample analysis for a gaseous or liquid release indicates a concentration or release rate greater than 2 times the (site specific effluent release controlling document) limits for 60 minutes or longer. Basis: This IC addresses a potential decrease in the level of safety of the plant as indicated by a low level radiological release that e>weeds regulatory commitments for an extended period of time (e.g., an uncontrolled release).

It includes any gaseous or liquid radiological release , monitored or un monitored , including those for which a radioactivity discharge permit is normally prepared.

Nuclear power plants incorporate design features intended to control the release of radioactive effluents to the environment.

Further , there are administrative controls established to prevent unintentional releases , and to control and monitor intentional releases.

The occurrence of an e>(tended , uncontrolled radioactive release to the environment is indicative of degradation in these features and/or controls.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent eALs more fully addresses the spectrum of possible accident events and conditions. C-1 NEI 99 o I (Re*,*isieR e) Jl,levemeer 2012 ti:! te the mes that a release pa ed *ter readiAgs assu . . l'Ae"'A te haYe stepp 8 ffiHOR! !HORI ffi t lflORl!eFIS

' j" dfeF ClassifieatieR

_8*s: ~~:e efflHeRt flew past aR * "":,er rea8iRg is "" leRge, va , ,, AmeAt is estabhs!:ie . at!:i tl=ieA the efflueAt me eA~ ire . . late the release p ' 8HO !0 80!l0RS le 199 8' g 4 times *c: f A purpeses.

I a release exoee IA elassiNea-,e-

-8 Fe, °'""'P**, Aet be prerated er averag; . Releases sheHlf AHies Sees Rel !fleet the llnL. a<liatieR ffi0Riter release liffiits ie, 39"' e* aetivity releases that eause h~:*;::lflit.

+his eAL B' L #1 +his on . . lal,lishe8 By a ro ,0 ' tiRH0HS release pa-" c A :b addresses ra 10 d. aot 11*1ty d1so ar t!:i.,*ays n 2

• s the l1m1t es ffem nen readiAgs te e>,oeed t1~e~ .. :ti:! planAed bato!:i releases "

• iealiy Be as,eeiate n I 8 B " w1ll l}jl ,.. te gas). . that are Seteete ) (e.g., ra8waste, ..as eR!rnlle8 gaseeus er liq~,e ~'::~::,.ys (e.g., spills ef . g, L addresses""" Rlfl0R1te,e ) B* L #2 +his~ I r>'eys paFtieularly 0R * . . *er>**atersystelfls , ete .. , r

• eAta su-. ' I I e IA rn sample aAalyses er eAv1reAm draiAs heat e>wl=iaAgerea rng ra<lieaetive liquids iRte stem, ' . . ... 18 Be via IC PD AA!. esoalatien ef the emer geAoy olassifioatieA le,,el weu N t s* n. h Ra<lielegieal Effl**Rt D""eleper e;,

• eeRtrnlliRg 8ee~ffieRt 19 t

• C:eRerie Leiter 89 91 , +he "site Sfl**ifie effiueRt ,el~aseplaRts that have 11F1pie1HeRte8 le1HeRt "'gulatieRs related . Ii ati eRs (Rll+S) **, <<>* MJ +hese 8eeulfleRts

'"'P. l ' *l'JJrnp,iate, the +eehRieal Si**: ~aleulatieR MaRual (O~C;;.9 ~FR Part 59 , AppeR81K Lt;,:shtles ier this IC. the Offs1te es E 10 CFR Part 2 aA t blisl=iiAg the memter 11 1 eeRtrnls e.g., 18 B *see Jer es* M te ef HOR he8elegy sheu -e -. 1Uff8 er 00C~. RB+8 er ODCM !flat *10,s 8eseriBe8 IR the

• e the offiueRt ffieRI . I . RiteFS sh0Hl8 iRelu e . te8 with ether pete*ti* Listed lfl0 . . t lied lfl0RiteFS ass*~** e e B' L values ier i8er i**iu81Rg IRS a {;M"H If IRelu * , fl e . Develepers

"'"Y al:::~::eriBe8 i* tRe llll+8 er~~.;;,~

Sesokelease lilflit:,v:*::::*

tR>>*ays tRat are

• the 1H0st "PP 1 , Be Belew """ efflueR! pa--.. R 18 Be 8eterlfliAe8 usmg *-I lated BAL value "'a) : R r t Alse , selfle these Fll0Rll0FS s *:i It is reeegaiaee tRat a ea **.1 ROOS 10 Be iRelue.ee IR t * .::.d ,elated the llll'.f8 e, ,?~Ci~ ;Rat ease, the lfl0~te, a~":;e:i!ieatieRs e, ethe~ ~**.:s:.::/eR elearly i8eRtify lfl0R1te, eaR ' .. med By +ee ***

• 1 e BAL aR '" meRiteFS "'"Y *et B: ge,i: is i1Hp0FtaRt that the assee,~~FS . ts* t!:iere43re , bT . f tliese ffi0R

• 1 reqH1re1HeR--, --h seer avaihH ,ty e . . I sos with sepa,a-e a*y li1Hitati0*s

• • t *

• address gaseeus aR8 hqu,e re** 8eme sites m8) . , fiAd it advaAtageeus te u ,..,,,...,...,,.,, ., ~7 {on *'*he 'Feehn,eo.~

{; ' l*o/ P,og,*""'

' I** so,Ha*(*)

wh"* , __ ,. '"""""""'

-~*1 ."'; ',,;;:,,.1

..

• 10 /he P,*~-*"",; *** ;. 1h, ,;,. .... ,.. ** , ' ; ', Ojfeile Do,e c.,"'"'°":'" flh effi,,at memlo,s '" .. *a O By l>JPO ,.1a1, l,re ........ 8 0 h o ***** , ,,.., O Thi, iAol,Oa, ";~**~FR >o.47(1,)(8)

,.; (9). I ofl O CFR SO .S4 (q) .,; H ~:**ilo,s.

the reE!HiremeRtS e J iR miRe the FeE!HIF~lfle~

S h aeeitieR efether efffoeR H De**elepers sheule ceep . Rt , .. heR eeRs1eermg t e . ro * ..,, . .,..., ,e ' . 'S eifieoi,on, ** ' . h e; ss . , $ 'fiec1tief'ls il'I .'he . , . Bl Ejfh:e:?t Teehme~, ~e;t;:, edt!rnl Detc1i!s &j RET. le ti C,ntrelsfer R86He,egie_ . dtfie Releec1ltel'I 8.rr. ee

• EfHipme geRey respeRse e te emer C-2 NEI 99 0 I (Re*,isioA e) Jl,lo*,emeer 2012 Radiati_on mo.niter readings should reflect va l ues that correspond to a radiolo ical release exceedmg 2_times a releas_e ~ontrol limit. The controlling document typical I)~ describes

~eetho:olo~ies fo~ dete~mmmg effluent radiat i on monitor setpoints; these methodologies should .~se to etermme En~ values. In cases where a methodology is not adequate! , defined :***1';1'"" skeelB Beterm1Ae valees eeAsisteAt with effleeAt eeAtrel ,egelatieAs

(/g lQ cf~ art and IO CFR Part 50 Appendix T) and related guidance.

• ., . ~o: EA_L #1 Values in this EAL should be 2 times the setpoint established b , the ::::**elivity 8 15 ei,arge P*Fffi it le wam ef * ,el ease tkat is Aot iA eompl iaAee with tke ;peeifieB ts: Inde)ong the *~alue m this manner ensures consistency betv~*een the EAL and th t

• established by a speeific discharge permit. e se13omt Developers should researeh radiati~n monitor design documents or other information s~uree~ to ensure th~t I) the EAL value bemg considered is within the usable response and displ_a) rang~ of ~he 1~strument , and 2) there are no automatic features that may render the momtor readmg mvahd (e.g., an auto purge feature triggered at a particular indication level). ffl It is recognized that the condition described by this IC may result in a radio l ogical e uen~ :*~ue ~eyond the operating or display range of the installed effluent monitor In those case~~ 1' ;.a u~s sho~ld be determined with a margin sufficient to ensure that an ac.curate mom-or rea-mg 1s a"a1lable Fe I c AL *

• f .* ..r ex.amp e , an en momtor readmg might be set at 90% to 95% o~~he h1g7est accurate m~mtor re~dmg. This provision notwithstanding , if the est1matedrcalculated monitor read mg is greater than approx i mately 110% of the h" h t *t d. h ' 1g es accurate ~oni:~r rea mg , t en developers may choose not to include the monitor as an indication and 1 ent1 'an alternate EAL threshold. , _Indications from a real _time do~~ projection system are not included in the eneric EALs t~aA) heeR;ees Bo AO! ka*,e th!S eapah,hty.

eor those that Bo, tke eapal,ility may A:t ~e ***itkiA * --e scope o-the p l t T h

• I 8 *fi

• 1-~ 1 f d~n :ec mcapec1 cations. A licensee may request to inelude an EAL using rea ,me ose prOJectJon s ystem results; approval ',¥ill be considered on a case by case ;asis. C f; 4 /ndications from a perimeter monitoring system are not included in the generic EA Ls

• any 1censees d~ no~ have this capability.

for those that do , these monitors may not

• T:::o~le~

nd ;amt~med to the ~~me I eve~ as plant equipment , or within the scope of the plant mca 6 ~eCI cations. In add1t10n , readmgs may be influenced by environmental or other actor~. 1 1 1:.~1censee m_ay request to include an EAL using a perimeter monitoring system; a ppro1-a n ii I be considered on a case by case basis. EGL Assignment Attributes:

3.1.l.B C-3 I-8 "cVV Od: JO l \IV 0d :)l l'l!A eq pf ROA\ f9A9f UO!ll'lO!J!SSBfO

,(ouei5J9UJ9 94lj0 UO!ll'JfBOSff "Sf 13!J9ll3W 9lSl3A\ 9A!l0l'lO!Pl'lJ JO weweAOUJ pua S90JROS 0!4de~O!PBJ JO esn se 4ons se9!A!lOl'l peuue1d WOJJ l[RSeJ ll'l4l seseeJOU!

teAet UO!ltJ!PBJ sepn1oxe c# 1\/!I *doJp 1eAet J9ll3M G!IN:N:V1d:Nfl ua Ol enp S! i5U!pl'leJ pelBAete e4l eJe4"A sestJo LI! ,(1uo e1qeo!Jdde S! t# 1\/'3 ll34l 9lON *peJep!suoo eq p1no4s suO!lRfOAe peuutJjdJO Sl99JJ9 e4+/- "SUO!ll'JOOJ eS04l U! SJOl!UOW ,(q pel09l9P eq UB9 lB4l Sl'JeJe lUeoefpl'lJO Sf9A9f UO!ll'l!Pl'lJ e41 U! 9Sl'J9J0U!

ue esneo OSfl'l Al'JUJ f9A9f J9ll3A\ e41 LI! doJp lUl39!J!Ui5!S y *Ee1qef!BABJ!)

suO!ll'JAJesqo tJJeweo oep!A JO f9UU0SJed lUl3fd UJOJj sµodeJ epRfOU! , (l'JUJ SUO!ll'lO!PU!

f0A9f JO S09JROS J94l0 "UO!ll'JlU0WR.llSU!

f9A9f e1qef !l'lAl'l UJOJJ suO!lBO!PU!

,(q peu!UJJelep

, (f!JBW!Jd eq lf!A*, estJeJoep f9A9f J9ll'J,'A y "lUl3Jd 04lj0 Al9jl3S JO J9A0J 04l U! UO!lBPBJi50p J13!lU9lOd 13 S! UO!l!PUOO J94l!3 " SJ13!J9ll3UJ 9A!l0130!Pl'lJ JO lUl3Jd e41 U!4l!N. SJ9A9f UO!ll3!Pl3J fOJlUOO Ol ,(l!f!ql'l e41 U! sso1 JOU!lli 13JO 9A!ll'l0!PU!

eJe s1eAet UO!lB!P13J peseeJOU!

e4+/- *slueAe G'3N:N:V1d:Nfl Je410 JO 1enJ E1ueds) petB!Ptl"!

eAoqtJ 1eAe1 JeltJNr LI! estJeJoep tJ ,(q pesntJo SfeAef UO!ll'l!Pl'lJ lUBfd peltJAete sesseJppl'l

)I S!4+/- "81!IA311Vt"q1f0N JQAO J4ffllli §cJO es!J G3NNV1d:Nfl ue sell'lO!PU!

lfRSeJ , (e,uns JO i5u!peeJ JOl!UOUJ UO!lll!Pl'lJ tJeJv "SJOl!UOW UO!ll'l!PtlJ i3U!MOjf Oj e4uo _;\~TV' , (q pell'JO!PU!

Sl'J SJ9A9f UO!ll'l!Pl'lJ l'J9Jl'J U! 9S!J G3NNV1dN:fl

i5U!A\OIIOJ e4uo :A.NV ,(q pell'lO!PU!

stJ 100d 1eRJ 1ueds e4l LI! doJp 1eAet Je1e;A G3:N:N:V1d:Nfl "t) Ee) Et) lU9Aff jl3RSRUf1 JO UO!lBO!J!lON_

'}.)';I znv ad z l oz JaqwaAON:

(~ IW!S!Aa'd)

LO 66 13:!"1:

Develof)eF Notes: NEI 99 Ql (Re\'isioR e) "!>Jove me er 2Q 12 For EAL #1 Site specific indications may include instrumentation values such as water level and area radiation monitor readings , and personnel reports. If available , video cameras may allow for remote observation.

Depending on available in strumentation , the declaration may also be based on indications of water makeup rate and/or decreases in the lev el of a water storage taflb For EAL #2 The specified value of 25 mR/hr may be set to another value for a specific application with appropriate justification.

EGL Assignment Attributes:

3.1.1.B B-2

~/El 99 QI (ReYisioR

6) November 2012 ECL: Notification of Unusua:I;, E:*,e=n~t

---

~PRO SU 1 Initiating Cenditien:

UNPLA1'H-ffi9 spent fuel pool temperature rise OpeFating Mede A I' . .

• af)f) iealllh*"*

Not A 1* hi ~J

• 1tpp-1cat1-e Example EmeFgeney Aetien Levels: (1) UNPLANNE9 spent fuel I pee temperature rise to greater than (s1*te s *.c: o peClt1C Fr-This IC addresses a condition that. potential degradation in the level o~ s:f:te~ursor to a more serious event and represents

a. occur , and result in a loss of pool level a:d ~fthe plant. T~u.ncorrected , soiling in the pool will . mcreased rad1at1on levels. Escalation of the emer e . g nc~* classification level *would ee via IC pg A A 1 >> .. eloper Notes: ' ** PD AA2. Th

• e site specific temperature should e EGL A

• n.ss1gnment Attrieutes:

3 .1.1.A B-3 ECL: Notification of Unusual Event Initiating Cenditien:

Confirmed SECURITY CONDITION or threat. Operating Mede ,\pplieability:

Not Applicable Example Emergeney Aetien Le~1 els: (I or 2 or 3) NEI 99 QI (ReYisieA

6) l>le¥ember 2Ql 2 PD HU1 (1) A SECURITY CONDITiffi,1 that does not involi,re a HOSTILE ACTION as reported by the (site specific security shift superi,rision).

(2) (3) }ofotification of a credible security threat directed at the site. A validated notification from the NRG providing information of an aircraft threat. Thi_s I~ addre~ses events that pose a threat to plant personnel or the equipment necessary to mamtam cool_mg of spent ~el , and thus represent a potential degradation in the level of plant safet_y. Security events v,rh1ch do not meet one of these EALs are adequately addressed by the requirements of 10 CFR § 73.71 or 10 CFR § 50.72. Security events assessed as HOSTILE ACTiffi,lS are classifiable under IC PD HAl. Timely and accurate communications between Security Shift Supervision and the Control Room is essential for proper classification of a security related event. Classification of these events will initiate appropriate threat related notifications to plant personnel and OROs. Security plans and terminology are based on the guidance provided by NEI 03 12 , Temptatcfor the Security Ptan , Treining e,9d QHelificetion Plen , Se.fcgMerds Contingency Plen {end Independent Spent-Fuel St-orege Instell8tio1~

Security Progrmn}.

EAL #1 references (site specific security shift supervision) because these are the individuals trained to confirm that a security event is occurring or has occurred.

Training on security event confirmation and classification is controlled due to the nature of Safeguards and 1 O CFR § 2.39 information. EAL #2 addresses the receipt of a credible security threat. The credibility of the threat is assessed in accordance with (site specific procedure).

EAL#~ addresses the threat from the impact of an aircraft on the plant. The NRG Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft.

The status and size of the plane may also be provided by NORAD through the NRG. Validation of the threat is performed in accordance with (site specific procedure). Emergency plans and implementing procedures are public documents; therefore , EALs should not incorporate gecurity sensitive information.

This includes information that may be

• B-4 NEI 99 QI (ReYisieA

6) ~Jeyemeer 2Q 12 advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location.

Security sensitive information should be contained in non public documents such as the Security Plan. Escalation of the emergency classification le*,el would be via JC PD HAI. DevelepeF Netes: The (site specific security shift supervision) is the title of the on shift individual responsible for supervision of the on shift security force. The (site specific procedure) is the procedure(s) used by Control Room and/or Security personnel to determine if a security threat is credible , and to validate receipt of aircraft threat information.

Emergency plans and implementing procedures are public documents; therefore , EALs should not incorporate Security sensitive information.

This includes information that may be advantageous to a potential adversary , such as the particulars concerning a specific threat or threat location.

Security sensitive information should be contained in non public documents such as the Security Plan. With due consideration given to the above developer note , EALs may contain alpha or numbered references to selected events described in the Security Plan and associated implementing procedures.

Such references should not contain a recognizable description of the event. For e>rnmple , an EAL may be 't't'Orded as " Security event #2 , #5 or #9 is reported by the (site specific security shift superYision)." EGL Assignment Attributes:

3. I. I .A B-5 Nel 99 o I (ReYisioH G) No,*ember 2012 PD HU2 ECL: Notification of Unusual Event Initiating Cenditien:

Hazardous event affecting SAFHTY SYSTEM equipment necessary for spent fuel cooling. Operating Mede Applieability:

Not Appl i cable Example Emergeney A,etien Le,;els: (]) a. b. C. The occurrence of i+ ...... ~Y of the following hazardous events:

• Seismic event (earthquake)

• Internal or external flooding event

• High winds or tornado strike

• FIRE

• EXPLOSION

• (site specific hazards)

• Other events vrith similar hazard characteristics as determined by the Shift Manager The event has damaged at least one train of a SAFETY SYSTEM needed for spent fuel cooling. AND The damaged SAFETY SYSTEM train(s) cannot , or potentially cannot , perform its design function based on EITHER:

• Indications of degraded performance

• VISIBLE; DAM.AGE This IC addresses a hazardous event that causes damage to at least one tra i n of a SAFHTY SYSTEM needed for spent fuel cooling. The damage must be of sufficient magnitude that the system(s) train cannot , or potentially cannot , perform its design function. This cond i tion reduces the margin to a loss or potential loss of the fuel clad barrier , and therefore represents a potentia l degradation of the level of safety of the plant. For HAL l.c , the first bullet addresses damage to a SAFHTY SYSTHM train that is in service/operation since indications for it will be readily available.

For EAL l.c , the second bullet addresses damage to a SAFETY SYSTHM train that is not in service/operation or readily apparent through indications a l one. Operators will make this B-6 NE[ 99 0 I (Re*,*isieA

6) Jl,fo*,remeer 2012 determination based on the total it)' of available event and damage report information.

This is intended to be a brief assessment not requiring lengthy anal)'Sis or quantification of the damage. Escalation of the emergency classification level could , depending upon the event , be based on any ofthe Alert ICs; PD AAl , PD AA2 , PD HAl orPD HA3. Devel01Jer Netes: For (site specific hazards), developers should consider including other significant , site specific hazards to the bulleted list contained in EAL 1.a (e.g., a seiche). Nuclear power plant SAFETY 8Y8TEM8 are comprised oftvro or more separate and redundant trains of equipment in accordance with site specific design criteria.

EGL Assignment Attributes:

3 .1.1.A and 3 .1.1 C B-7 NEI 99 0 I (RevisioA

6) November 2012 PD HU3 ECL: Notification of Unusual Event Initiating Condition:

Other conditions e>(ist which in the judgment of the Emergency Director warrant declaration of a (NO)UE. Operating Mode Applieability:

Not Applicable Example Emergeney Aetion Levels: (1) Other conditions exist v,hich in the judgment of the Emergency Director indicate that events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated.

No releases of radioactive material requiring offsite response or monitoring are e>(pected unless further degradation of safety systems occurs. This IC addresses unanticipated conditions not addressed e>(plicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the Emergency Director to fall under the emergency classification level description for a NOUE. B-8 ECL: Alert Nel 99 GI (RevisioR

6) J>Jo,*ember 2G 12 PD AA1 Initiating Condition:

Release of gaseous or liquid radioactivit)*

resulting in offsite dose greater than 10 mrem TEDE or 50 mrem thyroid CDE. Operating Mode Applieability:

Not Applicable Example Emergeney Aetion Le*;els: (1 or 2 or 3 or 4) Notes:

• The ?merg~ncy Director should declare the Alert promptly upon determining that the applicable time has been e>(ceeded , or *Nill likely be exceeded.

• If an ongoin~ release is detected and the release start time is unknown , assume that the release duration has exceeded 15 minutes. * ~f the effluent flovr past an effluent monitor is known to haYe stopped due to actions to isolate the release path , then the effluent monitor reading is no longer *ralid for classification purposes.

• The pre calculated effluent monitor Yalues presented in EAL #l should be used for emergency classific~ion assessments until the results from a dose assessment us i ng actual meteorology are aYa1Jable.

(1) (3) (4) Read~ng on ANY of the following radiation monitors greater than the reading shown for 15 mmutes or longer: (site specific monitor list and threshold values) (2) Dose assessment

~sing actual meteorology indicates doses greater than 10 mrem TEDE or 50 mrem thyroid CDE at or beyond (site specific dose receptor point). " I . f 1*

• n:na y~1s o a1qu1d effluent sample indicates a concentration or release rate that would resul_t m doses greater than 10 mrem TEDE or 50 mrem thyroid CDE at or beyond (site specific dose receptor po int) for one hour of e>(posure.

Field surve~ results indicate EITHER of the follovring at or beyond (site specific dose receptor point):

• Closed windov, dose rates greater than 10 mR/hr e>(pected to continue for 60 minutes or longer.

• Analyse_s of fie.Id survey samples indicate thyroid CDE greater than 50 mrem for one hour of mhalat1on.

Basis: This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual B-9 NEI 99 QI (Re¥isioR e) November 2Q 12 ef fsite deses greater thaR er equal te 1% efthe BPA Preteetive Aet~eR Gui~esd(PAGs).

1! eludes beth meRitered aRd uR meRitered releases. Releases ef this magmtu _e r~preseR , aR iR ae tual er peteRtial substaRtial degradatieR efthe level ef s~fi:ty efthe pl~Rt_as md1::!eedR~?o1~ed dielegieal release that sigRifieaRtly e , weeds regulatery l1m1ts (e.g., a s1gmfieaRt ra re lease). R adiele ieal efflueRt EALs are alse iReluded te previde a basis for ela_ssifyiRg eveRts _a~d aRElitia~s that eaRRat be "'&<lily ar app_ropriate~y

• ~*s:ifiatpressed iR terms ef the sum efthe effe~tive des~ equivaleRt (EDE) eemmitted effeetive dese equivaleRt (CEDE), er as the thyre1d eemm1tted

~ese ::i~a~eRt (CDH). Far the perpase afthese ICIBALs , the Elase ~~aRtity ta~~~:~~*~'k

.... ". equivaleRt (TEDE), as defiRed iR 10 CFR § 20 , 1s used m lieu ef ... sum e The EPA PAG guidaRee prevides fer the use adul_t thyreid ~ese eew~ersieR faeters; he"'e"er seme states haYe deeided te base preteetive aetwRs eR eh_Ild thyre1d CD~. Nuelear , ., v 1' t IC LE, A Ls Reed te be eeRsisteRt with the preteetive aet1eR methedeleg1es emple) ed pewer p-aR s , n

• h IC d EAL sheuld be b , the States withiR their EPZs. The thyreid COE des~ used i_R _t e a~, s. a~justed as Reeessary te aligR *Nith State preteetive aetwR dee1swR makmg entena. The " site speeifie meRiter list aRd thresheld values" sheuld be determiRed with eeRsideratieR ef the follewiRg:

• SeleetieR ef the apprepriate iRstalled gaseeus aRd liquid effl~et~ meRitc;~DE er 50 mrem

• The efflueRt meRiter r e adiRgs sheuld eerrespeRd te a dese mr~m . thyreid COE at the " site speeifie dese reeepter peiRt" (eeRs1steRt with the ealeulat1eR methedelegy empleyed) fer eRe heur ef expesure. .

• MeRiter readiRgs will be ealeulated usiRg a set ef assumed meteereleg1eal data er ~tmespherie dispersieR faeters; the data er faeters seleeted for use sheuld be the same as these empleyed te ealeulate the meRiter readiRgs fer TC PD AUl

• B-10 Nm 99 01 (Re\*isioA e) Noyember 2012

• The calculation of monitor readings will also require use of an assumed release isotopic mi>E:; the selected mi>E: should be the same as that employed to calculate monitor readings for TC PD AUi.

• Depending upon the methodology used to calculate the EAL values , there may be overlap of some values between different ICs. Developers will need to address this overlap by adjusting these values in a manner that ensures a logical escalation in the EGL. The " site specific dose receptor point" is the distance(s) and/or locations used by the licensee to distinguish bet>.veen on site and offsite doses. The selected distance(s) and/or locations should reflect the content of the emergency plan , and the procedural methodology used to determine offsite doses and Protecfr, , e Action Recommendations. The variation in selected dose receptor points means there may be some differences in the distance from the release point to the calculated dose point from site to site. Developers should research radiation monitor design documents or other information sources to ensure that 1) the EAL value being considered is within the usable response and display range of the instrument , and 2) there are no automatic features that may render the monitor reading invalid (e.g., an auto purge feature triggered at a particular indication level). It is recognized that the condition described by this IC may result in a radiological effluent value beyond the operating or display range of the installed effluent monitor. In those cases , EAL values should be determined 1,vith a margin sufficient to ensure that an accurate monitor reading is available.

For e>rnmple , an EAL monitor reading might be set at 90% to 95% of the highest accurate monitor reading. This provision nohvithstanding, if the estimated/calculated monitor reading is greater than approximately 110% of the highest accurate monitor reading , then developers may choose not to include the monitor as an indication and identify an alternate EAL threshold.

Although the IC references TEDE , field survey results are generally available only as a " whole body" dose rate. For this reason , the field sur*,ey EAL specifies a " closed window" survey reading. Indications from a real time dose projection system are not included in the generic EALs. Many licensees do not have this capability.

For those that do , the capability may not be within the scope of the plant Technical Specifications.

A licensee may request to include an EAL using real time dose projection system results; approval will be considered on a case by case basis. Indications from a perimeter monitoring system are not included in the generic EA.Ls. Many licensees do not have this capability.

For those that do, these monitors may not be controlled and maintained to the same level as plant equipment , or 1 ,vithin the scope of the plant Technical Specifications.

In addition , readings may be influenced by environmental or other factors. A licensee may request to include an EAL using a perimeter monitoring S)'Stem; approval 1 Nill be considered on a case by case basis. EGL Assignment Attributes:

3.1.2.C B-11

• uO!ltlO!.J!lSRf 0ltl!JdOJddtJ 4l!'t\ UO!ltlO!(ddu 9!J!90ds u JOj 0R(UA J04l0UU Ol l0S 0q AUW J4fflW 00 I JO 0R(UA P0!J!00dS 04:+/- *µef'y' Utl Utl4l lUtl9!J!U~!S 0JOW ,(((tl!lU0lOd lU0A0 Utl S0!(dW! UO!ltlJRP

,(tlp Ot u SU 'i3U!i3UJ0AU lR04l!M 0J04 pesn S! 0RfUA 04l 's,(up Ot 04l J0AO pei3UJ0AU eq ueo 0R(tlA J4fflW s l 04l lU4l S0P!AOJd 'SJbl:OUl:Od:fl'lhO't[

bl:19fd UfJ_l}O~'l}'VJ,f{)

bl:fJ.1}190lf!,l19f:)

'LtlO O'inlflN:JO r*ffrn uO!l908 4zlno4l(V

• s0W!l ,(ouudnooo peloedJ(e JOJ wewlsnfpu 4WA s,(up Or U! weJ 5 JO en(tJA 6 l ;)GD 04l WOJJ p0A!Jep S! J4fflWS I JO 0n1eA 04:+/- .lUU[d 04l JO ,(l9JUS JO f 0A0( 04l JO UO!lUPU.1:i30p (U!lUUlSqns (tl!lU0lOd JO (tlRlOtl 04l U! Sl(RS0J lU4l SS090U p0J!tldW!

S!4l S! ll *sseooe lUtl(d AJtJSS090U U0lU0J4l AilUUO!J!Uzl!S Ol lU0!0!J.JRS S! AU!0P JO 00U0J0jJ0lU!

04l lU4l pep!AOJd 'i3U!J0J.10lU!

JO zlu!J0PU!4 sepRfOU! ,epedw!, '0J04 pesn sv *,(l!Jzl0lU!

f0RJ lU0ds U!tllU!tlW Ol pepeeu SW0lS , (s U!tllU!tlW Ol J0pJO U! 'zlU!JOl!UOW (UOO( S0J!Rb0J lU4l JO A((URUUU:I p0lUJ0dO eq lSRW lU4l lU0Wd!nbe i3U!U!UlU09 seeJe Ol SS099tl AJtJSS000U epedw! lU4l S(0A0( UO!lU!PtlJ peseeJOU!

S0SS0Jppe

)f 5!4+/- *,(l!lzl0lU!

(0Rj lU0dS U!tllU!tlW Ol pepeeu SW0lS,(S JO UO!lUJedo JO (U!J0lUW 01.!lOUO!PUJ JO IOJlUOO U!UlU!UW Ol pepeeu seeJtJ zlu!A\.O((Oj 04uo X~v' Ol sseooe s0pedw! lU4l S'lili\'.3:9 9VJ,~ON: J0Ao J4fflW 001 ,(q 0S!J u 0lUO!PU! Sl(RS0J ,(01t1ns 10 szlu!pu01 JOl!UOJ,'{

UO!lU!PU1f ueJy G'.3:N:N: V1dN:fl :Al!Ji30lU!

(0RJ lU0dS U!UlU!UW Ol pepeeu SW0lS,(s JO UO!lUJedo JO (tl!J0lUW 0A!l0tlO!PtlJ JO (OJlUOO U!tllU!tlW Ol ,(ouednooo SRORU!lUOO i3U!l!Rb0J SU0JU i3U!MO()Oj 04lJO :A.NV U! 14mw s [ UU4l J0lU0.l:i3 0lUJ 0sop G'.3:N:N:V1dN:fl Ee) Et) *,(l!.l:i30lU!

(0Rj lU0dS U!tllU!tlW Ol p0l!Rb0J SS099U lUUJd sepedw! lU4l S(0A0( UO!lU!PUJ lUUJd U! 0S!J G'.3:N:N:V1dN:fl

HO!J!f)HO.)

~H!JU!J!HI Z'f/'f/ Cd cl Ol JaqwaAON:

(~ lcl0!5!>'*0"M) t O 66 13:N:

ECL: Alert Ne! 99 0 I (RevisioA e) ~lovemeer 2012 PD HA1 Initiating Condition:

HOSTILE i\CTION v,'ithin the OWNER CONTROLLED AREA or airborne attack threat 1.vithin 30 minutes. Operating Mode Applieability:

Not Applicable Example Emergeney Aetion Levels: (1 or 2) (1) (2) A HOSTILE ACTION is occurring or has occurred within the OWNER CONTROLLED AREA as reported by the (site specific security shift supervision).

/*, validated notification from NRG of an aircraft attack threat 1 Nithin 30 minutes of the This IC addresses the occurrence of a HOSTILE ACTION within the O\l/NER CONTROLLED AREA or notification of an aircraft attack threat. This event v,ill require rapid response and assistance due to the possibility of the attack progressing to the PROTECTED AREA , or the need to prepare the plant and staff for a potential aircraft impact. Timely and accurate communications bet\Neen Security Shift Supervision and the Control Room is essential for proper classification of a security related event. Security plans and terminology are based on the guidance provided by NET 03 12 , Templ8tc fer the Security Plan , Trainil'lg end Qualificetion Plan , Sejegbu1rds Co1'1tingenc;*

Plen {end Independent Spent Fuel Storege Instelletion Security Progreni}. As time and conditions allow , these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures (e.g., evacuation , dispersal or sheltering).

The Alert declaration will also heighten the awareness of Offsite Response Organizations , allowing them to be better prepared should it be necessary to consider further actions. This IC does not apply to incidents that are accidental events , acts of civil disobedience , or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. E>rnmples include the crash of a small airoraft , shots from hunters , physical disputes between employees , etc. Reporting of these types of events is adequately addressed by other EA.Ls , or the requirements of 10 CFR § 73.71 or 10 CFR § 50.72. EAL #1 is applicable for any HOSTILE ACTION occurring , or that has occurred , in the O\V1'mR CONTROLLED AREA. This includes any action directed against an TSfST that is located within the OW1'mR CONTROLLED AREA. EAL #2 addresses the threat from the impact of an airoraft on the plant , and the anticipated arrival time is within 30 minutes. The intent of this EAL is to ensure that threat related B-13 NEI 99 0 I (RevisioA

6) November 2012 notifications.

are made in a timely manner so that plant personnel and OROs are in a heightened state of read mess. This EAL is met when the threat related information has been validated in accordance with (site specific procedure). !he NRG He~dquarters Operations Officer (HOO) 'Nill communicate to the licensee if the threat =*es an aircraft.

The status and size of the plane may be provided by NOR/\.D through the In some cases , it may not be readily apparent if an aircraft impact 1.vithin the O\l/NER CONTR?LLED A~A ~vas intentional (i._e., a HOSTILE ACTION). It is e),pected , although not c_ertam , that not1fica~1on by an appropnate Federal agency to the site would clarify this point. In this case , the appropnate federal agency is intended to be NORAD , FBI , FAA or }iRC. The em~rgenc):

?eclar~ion , _including one based on other ICs/EALs , should not be unduly delayed while awaitmg not1ficat10n by a Federal agency. Em:rgency plans and implementing procedures are public documents; therefore , EALs should no: , mcorporate Security ~ensitive information.

This includes information that may be ad" antageo~s to a pot:nt1al a~v.ers~ry , such as the particulars concerning a specific threat or threat location. Secunty sens1t1ve mformation should be contained in non public documents such as the Security Plan. Denio per Notes: The (si_t~ specific securi~y shift supervision) is the title of the on shift individual responsible for superv1s1on of the on shift security force. Em:rgenC)'

plans and implementing procedures are public documents; therefore , EALs sh~, uld not mcorporate S:curity sensitive information. This includes information that may be ad rantageo~s to a pot:ntial a~v.ers~ry , such_as the particulars concerning a specific threat or threat location.

Security sens1t1ve mformat1on should be contained in non public documents such as the Securit)' Plan. urth d *d * * ,r1ue cons1 erat1on given to the above developer note , EALs may contain alpha or ~umbered ~eferences to selected events described in the Security Plan and associated

-1mplementmg procedures.

Such references should not contain a recognizable description of the e','.ent.

Fo_r exampl~, an EAL may be worded as " Security event #2 , #5 or #9 is reported by the *(site specific secunty shift supervision)." See the related Developer Note in Appendi>, B , Definitions , for guidance on the development of ,a scheme definition for the OWNER CONTROLLED AR~A. EGL Assignment Attributes:

3.1 .2.D B-14 NE! 99 Ql (ReYisioA 1:i) NO'>'emeer 2Q 12 PD HA3 ECL: Alert Initiating Canditian:

Other conditions e>(ist 1tvhich in the judgment of the Emergency Director warrant declaration of an Alert. Operating Made Applieability:

Not Applicable Example Emergeney Aetian L~1 els: (1) Other conditions e>(ist v,hich in the judgment of the Emergenc;'

Director indicate that events are in progress or have occurred *which invohe an .actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. An;' releases are expected to be limited to small fractions of the EPA ProtectiYe Action Guideline exposure leYels. This IC addresses unanticipated conditions not addressed explicitly else'tvhere but that 1 Narrant declaration of an emergency because conditions e>(ist which are belie't 1 ed by the Emergency Director to fall under the emergency classification level description for an Alert. B-15