TSTF-22-06, Technical Specifications Task Force - Request for a Workshop to Discuss the Interaction of Natural Phenomena Protection Design Features and Operability

Technical Specifications Task Force - Request for a Workshop to Discuss the Interaction of Natural Phenomena Protection Design Features and Operability

ML22189A144
Person / Time
Site:	Technical Specifications Task Force
Issue date:	07/08/2022
From:	Joyce R, Lueshen K, Richards A, Sparkman W, Vaughan J AP1000 Owners Group (APOG), BWR Owners Group, Babcock & Wilcox Co, PWR Owners Group, Technical Specifications Task Force, Westinghouse
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
TSTF-22-06
Download: ML22189A144 (13)

Text

TECHNICAL SPECIFICATIONS TASK FORCE TSTF A JOINT OWNERS GROUP ACTIVITY July 8, 2022 TSTF-22-06 PROJ0753 Attn: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Request for a Workshop to Discuss the Interaction of Natural Phenomena Protection Design Features and Operability The Technical Specifications Task Force requests that the NRC staff participate in a workshop to discuss the relationship between plant design features that protect against natural phenomena and the operability of Technical Specifications (TS) systems.

Nuclear plants are designed to withstand the effects of natural phenomena, such as external flooding, high winds, tornado missiles, and earthquakes, but natural phenomena are not typically explicitly considered in the analysis of design basis accidents and transients upon which the TS are based. The TS state that a system is operable if it can perform its specified safety function and any necessary support systems are capable of performing their related support functions, but there is no definitive guidance on whether protection from natural phenomena is a specified safety function or related support function.

The publication of NEI 18-03, "Operability Determination," and a revision of the NRC's Inspection Manual Chapter (IMC)-0326 of the same title, led the industry to consider the relationship between natural phenomena protection design features and TS operability. The enclosure describes our research and conclusions.

The TSTF would like to arrange an in-person workshop with the NRC staff to discuss the relationship between natural phenomena protection design features and TS operability, gain the staff's feedback on the industry research, benefit from the staff's insights, and identify opportunities to establish durable guidance on this issue. The TSTF is leading this activity for the industry because operability is the central concept in the TS.

The TSTF will work with our NRC Project Manager to identify a date and time of mutual convenience. We look forward to working with you on this important issue.

11921 Rockville Pike, Suite 100, Rockville, MD 20852 Phone: 804-339-7034 Administration by EXCEL Services Corporation

TSTF 22-06 July 8, 2022 Page 2 Should you have any questions, please do not hesitate to contact us.

Andrew M. Richards, Jr. (PWROG/W) Ryan M. Joyce (BWROG)

Kevin Lueshen (PWROG/CE) Jordan L. Vaughan (PWROG/B&W)

Wesley A. Sparkman (PWROG/AP1000) cc: Michelle Honcharik, Technical Specifications Branch Victor Cusumano, Technical Specifications Branch

Relationship Between Natural Phenomena Protection Design Features and Operability I. Overview The purpose of this document is to discuss the relationship between Technical Specifications (TS) operability and the requirements to design a plant to withstand natural phenomena.

A natural phenomenon has the potential to affect plant safety. 10 CFR 50, Appendix A, General Design Criterion 2, states, "Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornados, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions."1 These natural phenomena are grouped into four categories for the purposes of this paper:

• External flooding (floods, hurricane, tsunami, local intense precipitation, seiches),

• High winds (tornados, hurricanes, straight winds, derechos),

• Tornado missiles, and

• Earthquakes The TS state that a system is operable if it can perform its specified safety function and any necessary support systems are capable of performing their related support functions. Protection from natural phenomena is not called out in the Standard TS (STS) or Bases as a specified safety function or required support function required for operability. However, the NRC and the industry have sometimes considered TS systems inoperable due to lack of protection from natural phenomena.

The publication of NEI 18-03, "Operability Determination," and a revision of the NRC's Inspection Manual Chapter (IMC)-0326, "Operability Determinations," have resulted in a reconsideration of previous positions regarding natural phenomena protection in order to provide a supportable, consistent approach in the future.

Industry Conclusion The industry reached the following conclusion based on our research of the licensing basis for operating plants. Nuclear plants are designed to withstand the effects of natural phenomena as described in GDC 2. NEI 18-03 and the NRC's IMC-0326 recognize that structures, systems, and components (SSCs) may have design functions that do not perform a specified safety function or necessary and related support function required for TS operability, and those design functions are not within the scope of an operability determination.

The TS do not impose operational restrictions based on the ability to withstand a contemporaneous natural phenomenon and an accident. Unless explicitly required by the TS, the lack of natural phenomena protection for a TS system does not render that system inoperable.

The lack of protection against natural phenomena would be a design deficiency addressed through the licensee's Corrective Action Program. Should a natural phenomenon occur and render TS equipment incapable of performing its specified safety function, the TS equipment 1

Earlier versions of the General Design Criteria included similar requirements. A plant's implementation of the applicable General Design Criteria is discussed in the Updated Final Safety Analysis Report.

Page 3

Relationship Between Natural Phenomena Protection Design Features and Operability would be inoperable, and the TS Actions would be followed. However, a postulated natural phenomenon would not render TS equipment inoperable.

II. Analysis A. General Design Criterion Applicability The applicable criterion related to natural phenomena is 10 CFR 50, Appendix A, General Design Criterion (GDC) 2 - Design bases for protection against natural phenomena, which states:

Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornados, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these structures, systems, and components shall reflect: (1) Appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena and (3) the importance of the safety functions to be performed.

The NRC's February 28, 2019, memorandum from Ho K. Nieh, Director, NRC Office of Nuclear Reactor Regulation, to the NRC Regional Administrators, titled, "Closeout of Low Safety Significant/Low Risk Concerns - Tornado-Generated Missile Protection," states, "The General Design Criteria (GDC) of Appendix A to Part 50 of Title 10 of the Code of Federal Regulations (10 CFR), as well as the pre-GDC, were intended to provide a basis for judging the adequacy of the preliminary design of the facility at the construction permit stage and the detailed design and construction at the operating license stage. The GDC were not intended to be living requirements for the control and operation of nuclear power plants." (Emphasis added).2 The licensee's detailed design of the facility, which is documented in the Updated Final Safety Analysis Report (UFSAR), discusses the facility's design with respect to GDC 2 and would describe the "appropriate combinations," if any, of natural events and accident conditions.

However, these design requirements are not intended to be operational constraints, which are described in the TS.

The NRC's Standard Review Plan (SRP) discusses seismic design, wind loading, tornado missiles, and flooding in Chapter 3, "Design of Structures, Components, Equipment, and Systems." There is no discussion of natural phenomena in SRP Chapter 16.0, "Technical Specifications." A search of the SRP for discussion of TS requirements related to natural phenomena found few references, which are discussed below. The conclusion reached is the 2

Note this position supersedes earlier NRC positions described in Regulatory Issue Summary 2013-04 and 2005-20, as well as a memorandum from Thomas E. Murley, titled Relationship Between the General Design Criteria (GDC) and Technical Specifications, dated January 24, 1994.

Page 4

Relationship Between Natural Phenomena Protection Design Features and Operability NRC's guidance on implementing GDC 2 is based on design, and not on operational restrictions in the TS.

B. 10 CFR 50.36, "Technical Specifications" 10 CFR 50.36 requires each license authorizing operation of a nuclear power plant to contain TS.

10 CFR 50.36(b) states, "The technical specifications will be derived from the analyses and evaluation included in the safety analysis report, and amendments thereto, submitted pursuant to

§ 50.34."

10 CFR 50.36(c)(2) describes "Limiting Conditions for Operation," which is the relevant regulation regarding operability. It states, "Limiting conditions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility." The phrase "lowest functional capability or performance levels of equipment required for safe operation of the facility," is clarified in the requirements in 10 CFR 50.36(c)(2)(ii),

which requires an LCO to be established for each item meeting one or more of the four listed criteria. Those criteria are:

• Criterion 1. Installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary.

• Criterion 2. A process variable, design feature, or operating restriction that is an initial condition of a design basis accident or transient analysis that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

• Criterion 3. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

• Criterion 4. A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety.

None of these criteria discuss protection from natural phenomena.

C. Operability Requirements Operable/Operability, as defined in the STS, is:

A system, subsystem, division, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety function(s) and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication, and other auxiliary equipment that are required for the system, subsystem, division, component, or device to perform its specified safety function(s) are also capable of performing their related support function(s).

As defined, operability refers to the capability to perform a specified safety function(s).

Page 5

Relationship Between Natural Phenomena Protection Design Features and Operability NEI 18-03 provides the following industry accepted definition of specified safety function.

A Specified Safety Function (SSF) is a function of controlling importance to safety assumed to be performed by a system, structure, or component (SSC) in the analyses and evaluations summarized in the Updated Final Safety Analysis Report (UFSAR), typically Chapters 6 and 15 or the plant-specific equivalent chapters.

These specified safety functions are needed to obviate the risk of an immediate threat to the public health and safety. SSFs are the subset of all SSC functions that meet one or more criterion in 10 CFR 50.36(c)(2)(ii), as described in the NRC's Final Policy Statement on Technical Specifications Improvement, unless otherwise stated in the docketed plant specific SSF scope. Consequently, the SSFs may not be all of the SSC functions described in the UFSAR. The plant specific SSF scope derives from the functions and design conditions for performance relied on by the licensee and the NRC when the Technical Specifications (TS) were prepared, submitted, reviewed, and approved. For plants with Standard Technical Specifications, these functions are typically discussed in the TS Limiting Condition for Operation (LCO) Bases.

The NEI 18-03 definition of specified safety function recognizes that not all design functions are specified safety functions. This concept is echoed in the NRC's IMC-0326. For example, IMC-0326, Section 03.01, "Scope of SSC for Operability Determinations," states:

SSCs may also have design functions that do not perform a necessary and related support function for TS SSCs. These design functions are not within the scope of an OD [Operability Determination].

Based on the above, to affect TS operability there must be a link between a plant's design for protection from natural phenomena, the accident analysis design and licensing basis typically described in Chapters 6 and 15 of the UFSAR, and the ability of a TS SSC to meet one or more criterion in 10 CFR 50.36(c)(2)(ii).

D. Required Support Functions The industry and the NRC have long agreed that the need for necessary required support systems that are not the subject of a specific LCO or Surveillance Requirement (SR) is situational. For example, room cooling of an ECCS pump room may be a required support system in July but may not be in January. The NRC has used the example of heat tracing on pipes, which may be required for operability in the winter but not when it is warmer.

Based on this understanding, the inability of a support system to perform its natural phenomena protection function does not render the supported system inoperable unless the natural phenomenon occurs and renders the system incapable of performing its specified safety function.

E. Addressing Non-Conformances with Natural Phenomena Design Features If it is discovered that a design requirement related to natural phenomena protection is not met, the issue is entered into the licensee's Corrective Action Program, tracked, and corrected either by modifying the plant to match the design requirement or by changing the design requirement Page 6

Relationship Between Natural Phenomena Protection Design Features and Operability following the appropriate regulatory change process. If the design requirement was explicitly required by the TS, the operability of the affected system would be evaluated.

F. Sequential Events If a natural phenomenon occurred and rendered a system inoperable, the condition would be treated like an inoperability due to any other cause. For example, if a tornado missile damaged a diesel generator, the diesel generator would be declared inoperable, and the TS Actions would be followed. If an analyzed accident subsequently occurred, it would be no different than if the diesel generator were inoperable for maintenance when an accident occurred. The TS are structured on the assumption that, while unlikely, an accident could occur while in a TS Action.

If an analyzed accident occurred and subsequently a natural phenomenon occurred for which the plant construction was not compliant with the design basis, it would be addressed like any other post-accident equipment failure. The plant would be in a shutdown condition and the emergency operating procedures address post-accident equipment failures.

Therefore, differences between the plant design and construction related to protection from natural phenomena is a design deficiency addressed under the CAP and requires no special treatment as a TS inoperability.

G. Risk-Informed TS The TS LCOs are based on the safety analyses in the UFSAR and include deterministic assumptions such as the single failure criteria. Some LCOs are included under 10 CFR 50.36(c)(2)(ii)(D) as requirements that operating experience or probabilistic risk assessment has shown to be significant to public health and safety, but continue to use the deterministic single failure criteria.

Probabilistic risk assessment (PRA) has been used to improve TS. In particular, PRA has been used to extend Completion Times or to manage SR Frequencies, while the associated LCOs continue to be based on the deterministic assumptions of the accident analysis. This creates a dichotomy in that PRA considers events that are not addressed in the accident analysis, such as fires and natural phenomena, and considers multiple failures, so that the LCO assumptions and the Completion Time or SR Frequency determination assumptions are not consistent.

For example, TSTF-505, "Provide Risk-Informed Extended Completion Times," permits calculation of a Risk-Informed Completion Time (RICT). The guidance in Regulatory Guide 1.200, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

includes consideration of natural phenomena and fires, as well as the probability of multiple simultaneous failures. However, the RICTs are only applicable if the LCO is not met and the LCO continues to be based on the deterministic licensing basis.

TSTF-372, "Addition of LCO 3.0.8, Inoperability of Snubbers," established LCO 3.0.8. Per LCO 3.0.8, if a required snubber is not capable of performing an associated support function, it must be restored within the specified period (72 or 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />) or the supported system LCO is not met. TSTF-427, "Allowance for Non-Technical Specification Barrier Degradation on Supported System OPERABILITY," established LCO 3.0.9. Per LCO 3.0.9, if a required barrier is not Page 7

Relationship Between Natural Phenomena Protection Design Features and Operability capable of performing an associated support function, it must be restored within the specified period (30 days) or the supported system LCO is not met. Both TSTF-372 and TSTF-427 utilized PRA to determine the appropriate delay time before declaring the supported system inoperable and considered risks not included in the accident analysis, such as fires and floods.

TSTF-372 and TSTF-427 did not consider whether snubbers or barriers were necessary support systems for TS systems; they only established actions if a snubber or barrier is determined by the licensee to be a necessary support system and it is incapable of providing the support function.

In summary, the consideration of natural phenomena in risk assessments when establishing TS Completion Times or Surveillance Frequencies does not change the basis for whether the LCO is met.

H. Safety Considerations Licensees have extensively studied the effect of natural phenomena at the request of the NRC, beginning with Generic Letter 88-20, "Individual Plant Examination of External Events for Severe Accident Vulnerabilities," and most recently in response to the Fukushima Dai-ichi accident lessons-learned that added capabilities to maintain key plant safety functions following a large-scale natural disaster and required updating evaluations on the potential impact from seismic and flooding events. These studies and others have demonstrated that the plant risk associated with natural phenomena is low compared to other plant risks. As a result, the resolution of a nonconformance in the plant design related to protection from natural phenomena should be addressed under the plant's Quality Assurance Program and not the Technical Specifications. As stated in the NRC's "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors," the Commission's policy is that, "The purpose of Technical Specifications is to impose those conditions or limitations upon reactor operation necessary to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to the public health and safety by identifying those features that are of controlling importance to safety and establishing on them certain conditions of operation which cannot be changed without prior Commission approval." (Emphasis added). The protections from natural phenomena are not "of controlling importance to safety," and do not warrant being treated as TS requirements.

III. Consideration of Specific Phenomena A. External Flooding Considerations Regulatory guidance to address flooding concerns at nuclear power plants is provided in Regulatory Guide (RG) 1.59, "Design Basis Floods for Nuclear Power Plants," as well as RG 1.102, "Flood Protection for Nuclear Power Plants." Both documents refer to RG 1.29, "Seismic Design Classification," to identify the applicable SSCs that require flood protection.

Both documents are focused on the design aspects; RG 1.59 is focused on developing the design basis flood and RG 1.102 is focused on the design of flood protection to address the design basis flood.

Neither RG 1.59 nor RG 1.102 discuss the combination of a design-basis flood in conjunction with other accidents. Likewise, GDC 2 requires the design basis to reflect "appropriate Page 8

Relationship Between Natural Phenomena Protection Design Features and Operability combinations of the effects of normal and accident conditions with the effects of the natural phenomena." Therefore, to satisfy GDC 2, any appropriate combination of an accident with flooding would be reflected in the plants UFSAR and would be evaluated in the accident analyses typically contained in Chapters 6 and 15.

Although RG 1.102 discusses the potential for a flooding technical specification if circumstances dictate, the improved Standard Technical Specifications (STS) for each reactor type do not contain flooding TS requirements, which further supports that flooding protection is not necessary for an SSC to perform its specified safety function under normal and accident conditions.

Both RG 1.59 and RG 1.102 refer to designing the plant with hardened protection while also providing an alternative to hardened protection. Specifically, RG 1.102 states:

Temporary flood barriers, such as sandbags, plastic sheeting, portable panels, etc.,

which must be installed prior to the advent of the DBFL [design basis flooding level] are not acceptable for issuance of a construction permit. However, unusual circumstances could arise after construction that would warrant consideration of such barriers.

Inherent within this statement is an acknowledgement that if flood protection is available for a specific SSC, then satisfying the original flooding design basis is not required. Therefore, the flooding design basis aspects are not necessarily an aspect that is required for an SSC to perform its specified safety function. The only time that flooding conditions could result in TS inoperability is when the flooding condition physically renders TS equipment incapable of performing its specified safety function. As described by RG 1.59, RG 1.102, and GDC 2, the flooding prevention aspects are design aspects, and as described in NEI 18-03, not all design functions are necessarily a specified safety function.

In summary, the lack of external flooding protection for a TS system does not render that system inoperable unless flooding occurs and causes the TS system to be unable to perform its specified safety function.

B. High Winds Meeting the requirements of GDC 2 provides assurance that SSCs important to safety will withstand the most severe wind loads without loss of capability to perform their intended safety functions. Accordingly, NRC Standard Review Plan, Section 3.3.1, "Wind Loading," requires the plant to be designed to withstand anticipated high winds. Regulatory Guide 1.117, "Protection Against Extreme Wind Events and Missiles for Nuclear Power Plants," provides guidance for identifying those structures, systems, and components of light-water-cooled reactors that should be protected from the effects of the worst-case extreme winds (tornados and hurricanes) and wind-generated missiles, so that they remain functional. Neither the SRP Section 3.3.1 nor Regulatory Guide 1.117 discuss the need for TS requirements or operability.

In particular, Regulatory Guide 1.117 uses the term "functional" instead of "operable."

Nuclear power plants are designed to withstand high wind conditions, but the TS do not impose operational restrictions based on the ability to withstand a contemporaneous wind event and Page 9

Relationship Between Natural Phenomena Protection Design Features and Operability accident. This is reflected in the STS for each reactor type in that there are no explicit TS requirements. The only time that high wind conditions could result in TS inoperability is when the condition renders TS equipment incapable of performing its intended safety function. For example, wind speed and barometric pressure can affect BWR secondary containment differential pressure. When these conditions result in the inability to meet TS requirements, secondary containment is inoperable.

Hurricanes constitute a subset of the High Winds category. 10 CFR 50.63, "Loss of all alternating current power," required the submittal to the NRC of information related to station blackout events. Regulatory Guide 1.155 "Station Blackout" and NUMARC 87-00 "Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," provided guidance to address 10 CFR 50.63. The Statements of Consideration for 10 CFR 50.63, dated June 21, 1988, concluded that NUMARC 87-00 was acceptable to the staff.

The NUMARC 87-00 evaluation process determines the offsite power design characteristic group based on plant weather, grid, and switchyard features. To comply with 10 CFR 50.63, plants which are potentially affected by hurricane conditions have procedurally established actions to begin site preparations 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to anticipated hurricane arrival and to place the plant in safe shutdown at least two hours before the anticipated hurricane arrival at the site so that major decay heat loads can be dissipated using non-emergency plant equipment prior to the occurrence of a loss of offsite power. This approach recognized that the hurricane risk itself does not render SSCs inoperable, but rather prudent actions were established because the increased potential that offsite power could become inoperable. Accordingly, no TS requirement to shut down in anticipation of a hurricane was established.

In summary, the lack of protection from high winds for a TS system does not render that system inoperable unless high winds render a TS SSC LCO or SR not met (such as secondary containment differential pressure) or causes the TS system to otherwise be unable to perform its specified safety function.

C. Tornado Missiles A tornado event generating external missiles is a design basis requirement described in Chapter 3 of the UFSAR. The design and licensing basis for tornado missile protection is not described in either Chapter 6 or 15 of a plants UFSAR.

Nuclear power plants are designed to withstand tornados and external missiles generated from a tornado, but the TS do not impose operational restrictions based on the ability to withstand a contemporaneous tornado and accident. This is reflected in the STS for each reactor type in that there are no explicit TS requirements for tornado missile protection. The only time that a tornado generated missile could result in TS inoperability is when a tornado missile renders TS equipment incapable of performing its intended safety function. For example, an unprotected condensate storage tank (the water supply for Auxiliary Feedwater) that is struck from an external missile may lose volume below the TS required capacity causing the condensate storage tank to be inoperable. However, this inoperability would be based on an actual tornado missile, not based on a hypothesized scenario.

Page 10

Relationship Between Natural Phenomena Protection Design Features and Operability For those plants with condensate storage tanks susceptible to external tornado missile impact, it is typical for an alternate protected source of water to be documented during plant licensing.

This requirement may be in the TS and explicitly linked to tornado missile protection. Although the NUREG-1431 STS contain an action to verify the availability of alternate backup sources of water in the event of an inoperable condensate storage tank, this action is not associated with tornado missile protection but to ensure necessary back up water sources to allow the extended time to restore the condensate storage tank.

The NRC's February 28, 2019, memorandum from Ho K. Nieh, Director, NRC Office of Nuclear Reactor Regulation, to the NRC Regional Administrators, titled, "Closeout of Low Safety Significant/Low Risk Concerns - Tornado-Generated Missile Protection," stated, "NRR's position is that this issue, based on both these insights and the experience to date, when plant-specific considerations such as tornado missile probabilities are considered, is typically of very low safety significance and well below a level where adequate protection would be in question."

(Emphasis added.) The NRC's "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors," states the Commission's policy as, "The purpose of Technical Specifications is to impose those conditions or limitations upon reactor operation necessary to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to the public health and safety by identifying those features that are of controlling importance to safety and establishing on them certain conditions of operation which cannot be changed without prior Commission approval." (Emphasis added). This policy and the 2019 memorandum support a conclusion that tornado missile protection is not a specified safety function required for operability of TS systems. As tornado missiles are of low safety significance, protection is not required for adequate protection. TS are reserved for limitations to prevent an immediate threat to public health and safety and it is concluded that tornado missile protection is not required by the TS.

In summary, the lack of tornado missile protection for a TS system does not render that system inoperable unless explicitly required by the TS, or a tornado missile renders the TS system unable to perform its specified safety function.

D. Earthquakes The Commission's Final Policy Statement on Technical Specifications Improvements for Nuclear Power Plants states that, "The purpose of Technical Specifications is to impose those conditions or limitations upon reactor operation necessary to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to the public health and safety by identifying those features that are of controlling importance to safety and establishing on them certain conditions of operation which cannot be changed without prior Commission approval."

An "immediate threat to the public health and safety," can only result from a radiological release event.

Licensees are not required to consider a seismic event concurrent with an accident, transient, or anticipated operational occurrence (AOO) that could lead to radioactive release (i.e., a radiological event). On April 25, 1986, in the case of San Luis Obispo Mothers for Peace, et al.,

v. U. S. Nuclear Regulatory Commission, the United States Court of Appeals, District of Columbia Circuit, decided "that the possibility that an earthquake would occur at the plant Page 11

Relationship Between Natural Phenomena Protection Design Features and Operability contemporaneously with an independently caused radiological release is too small to require specific consideration." The court decision also noted that, "The possibility that an earthquake would disrupt a response to a radiological emergency is so extremely low as to be, for any practical purpose, nonexistent." The court considered "contemporaneously" to mean, for example, "within the space of a single week during the life of the plant." (The decision may be found in its entirety at http://openjurist.org/789/f2d/26.) Therefore, the lack of seismic protection for an SSE does not represent an immediate threat to public health and safety, and it is not necessary to postulate a seismic event concurrent with the need of a TS SSC to perform its specified safety function.

10 CFR 50, Appendix A, defines a "safe shutdown earthquake" (SSE) as "that earthquake which is based upon an evaluation of the maximum earthquake potential considering the regional and local geology and seismology and specific characteristics of local subsurface material. It is that earthquake which produces the maximum vibratory ground motion for which certain structures, systems, and components are designed to remain functional. " The statement that the systems "are designed to remain functional" makes clear that the ability to withstand an SSE is a design criterion. There is no reference to maintaining operability of systems.

The NRC's July 8, 1985, memorandum from Dennis Crutchfield, Assistant Director for Safety Assessment, to the Regional Administrators, titled, "Technical Specification Operability Requirements," states, "the fact that safety related structures, systems, and components are designed to remain functional during a Safe Shutdown Earthquake (SSE) and assure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safe condition or the capability to mitigate the consequences of accidents, as a design basis event the SSE is not assumed to occur simultaneous with accidents" (emphasis added).

Regulatory Guide 1.29 describes as seismic Category I those SSCs that must be designed to remain functional if the SSE occurs. The RG does not discuss TS or require Category I SSCs to be subject to TS operability. If it were to be determined that the equipment needed to shutdown following an SSE was not seismically qualified, the condition would be addressed through the CAP and not by the TS.

In 1996 Public Service Electric & Gas requested a change to the Hope Creek design basis to permit crediting a non-seismically qualified service water discharge path in the Loss of Cooling Accident analyses. The NRC denied the request in a Safety Evaluation dated December 24, 1996. The evaluation stated, "The regulations do not specifically address nor do they require the simultaneous postulation of an SSE [safe shutdown earthquake] and a design basis accident (unless it can be caused by the SSE). However, the NRC's regulations and guidelines clearly stipulate that structures, systems, and components necessary to mitigate the effects of a LOCA shall be designed to SC-I requirements. Reliance on only safety-related SC-I equipment following a LOCA is also consistent with staff practice prior to issuance of the associated regulations and guidelines. The purpose of the requirement for reliance on only safety-related SC-I equipment, following a LOCA, is not to protect against a concurrent SSE and LOCA, but to provide assurances that post-accident equipment is high in quality and, therefore, highly reliable." (Emphasis added.)

Page 12

Relationship Between Natural Phenomena Protection Design Features and Operability There were two significant initiatives where the NRC weighed in on the seismic requirements of SSCs that required site-specific responses:

• The NRC addressed seismic qualification as part of GSI A-46, which established criteria for safe shutdown following an earthquake. In response to the Individual Plant Examination of External Events (IPEEE), licensees developed a Safe Shutdown Equipment List (SSEL) documenting the SSCs credited with remaining functional during and after an SSE. The NRC did not require the SSEL SSCs be included in the TS, or that their seismic capacity be a facet of operability if the SSCs were in the TS.

• As a result of the Fukushima accident, the NRC directed a seismic hazard re-evaluation for all sites and issued a series of orders related to the ability to withstand a seismic event. Once again, the NRC did not require any changes to the TS related to mitigating a seismic hazard and there was no change to the application of TS operability related to seismic capability.

In summary, the lack of seismic protection for a TS system does not render that system inoperable unless a seismic event occurs and renders the TS system unable to perform its specified safety function.

Page 13