Resolution of Generic Safety Issues: Issue 156: Systematic Evaluation Program (Rev. 8) ( NUREG-0933, Main Report with Supplements 1–35 )

DESCRIPTION

In 1977, the NRC initiated the Systematic Evaluation Program (SEP) to review the designs of 51 older, operating nuclear power plants. The SEP was divided into 2 phases. In Phase I, the staff defined 137 issues for which regulatory requirements had changed enough over time to warrant an evaluation of those plants licensed before the issuance of the SRP.¹¹ In Phase II, the staff compared the design of 10 of the 51 older plants to the SRP¹¹ issued in 1975. Based on these reviews, the staff identified 27 of the original 137 issues that required some corrective action at one or more of the 10 plants that were reviewed. The staff referred to the issues on this smaller list as the SEP "lessons learned" issues and concluded that they would generally apply to operating plants that received operating licenses before the SRP¹¹ was issued in 1975.

In SECY-84-133,⁸¹⁴ the staff presented the 27 SEP issues to the Commission as part of a proposal for an ISAP, the intent of which was to review safety issues for a specific plant in an integrated manner. Two SEP plants participated in the ISAP pilot efforts. Following the review of these two pilot plants, ISAP was discontinued.

In SECY-90-160,¹⁴⁴³ the staff forwarded for Commission approval a proposed license renewal rule and supporting regulatory documents. In this paper, the staff stated that certain unresolved safety issues could weaken the generic justification of the adequacy of the current licensing bases argument. These issues included SEP topics for 41 older plants that had not been explicitly reviewed under Phase II of the SEP. The Commission requested that the staff keep it informed of the status of the program to determine how the SEP "lessons learned" issues had been factored into the licensing bases of operating plants.

Resolution of the 27 SEP issues was deemed by the staff to be important to the development of the license renewal rulemaking. The key regulatory principle underlying the license renewal rule is that the current licensing bases (CLBs) at all operating nuclear power plants, with the exception of age-related degradation, provide adequate protection to the public health and safety. This principle is reflected in the provisions of the license renewal rule which limit the renewal decision to whether age-related degradation has been adequately addressed to assure continued compliance with a plant's CLB. In order to adopt this approach, the NRC must be able to provide a technical basis for the key principle of license renewal. Accordingly, the rulemaking included a technical discussion documenting the adequacy of the CLB for all nuclear power plants, in both the statement of considerations and in NUREG-1412.¹⁴⁴⁴ However, as discussed in SECY-90-160,¹⁴⁴³ the staff identified a potential weakness in the discussion of the adequacy of the CLB with regard to the 41 older, non-SEP plants. To address this potential weakness, the staff undertook an effort to determine whether or not each SEP issue either had been or was being addressed by other regulatory programs and activities.

The staff completed this effort and placed each SEP issue into one of the following categories: (1) issues that had been completely resolved (i.e., necessary corrective actions had been identified by the staff, transmitted to licensees, and implemented by licensees); (2) issues that were of such low safety significance so as to require no further regulatory action; (3) issues that were unresolved, but for which the staff had identified existing regulatory programs that cover the scope of the technical concerns and whose implementation would resolve the specific SEP issue, such as the Individual Plant Examination (IPE) and the Individual Plant Examination of External Events (IPEEE); and (4) issues that were unresolved and regulatory actions to resolve the issues had not been identified. The 27 SEP issues and applicable regulatory programs were summarized and presented in SECY-90-343.¹³⁵¹ The staff concluded that the 22 SEP issues in Categories 3 and 4 remained unresolved for purposes of justifying the adequacy of the CLB for some portion of the 41 older, non-SEP plants. The following is an evaluation of these 22 issues: nineteen from Category 3 and three from Category 4.

ISSUE 156.1.1: SETTLEMENT OF FOUNDATIONS AND BURIED EQUIPMENT

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The objective of this issue was to ensure that safety-related structures, systems, and components were adequately protected against excessive settlement. The scope included the review of subsurface materials (soils or geologic) and foundations to assess the potential static and seismically-induced settlement of all safety-related structures and buried equipment.

Excessive settlement or collapse of foundations and buried equipment for structures, systems, and components under either static or seismic loading could result in failure of structures, interconnecting piping, control systems or cables, or other equipment (tanks, etc.) such that the capability to safely shut down a plant, or mitigate the consequences of an accident, could be compromised.

There were two specific concerns in this issue: (1) the potential impact of static soil settlements on foundations and buried equipment where the soil may not have been properly prepared; and (2) seismically-induced differential settlement and potential soil liquefaction following a postulated seismic event. These two concerns were limited only to plants that have soil-supported, safety-related structures (including vertical, field-erected tanks) and soil-buried piping and components (including tanks) that have the potential for excessive settlement but were not reviewed to the pertinent SRP¹¹ Sections 2.5.4 and 2.5.5.

For the 41 older, non-SEP plants with OLs issued before 1975, any impact of static settlement on structural foundations (including the foundations of buried components) should become noticeable in the first 5 to 10 years. Thus, any significant settlement would have been revealed already and warranted corrective action. In addition, the ongoing IPEEE program¹³⁵⁴ has elements in its seismic task which requires that, for plants on soil sites, potential seismically-induced settlement and soil liquefaction should be assessed during its implementation.

CONCLUSION

This issue is being addressed by the SRP¹¹ for future plants as well as for operating plants with OLs issued after 1975. For the 51 older, operating plants, this issue was considered resolved for the 10 SEP plants. For the remaining 41 non-SEP, operating plants, any significant static settlement would have been revealed already and warranted corrective action. The concern on the seismically-induced settlement and soil liquefaction for these 41 older, non-SEP operating plants will be addressed during the implementation of the IPEEE Program. Therefore, Issue 156.1.1 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.1.2: DAM INTEGRITY AND SITE FLOODING

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90 -343.¹³⁵¹ The safety concern was the ability of a dam to prevent site flooding and ensure a cooling water supply. The safety features of a dam would normally include remaining stable under all conditions of reservoir operation, controlling seepage to prevent excessive uplifting water pressure or erosion of soil materials, and providing sufficient freeboard and outlet capacity to prevent overtopping. The objective of this issue was to ensure that adequate margins of safety are available under all loading conditions and uncontrolled releases of retained water are prevented. Plants must provide the basis for ensuring that all safety-related structures, systems, and components are adequately protected against flooding that might result from dam failures. Further, review of licensee procedures would determine whether an adequate supply of cooling water exists in the ultimate heat sink during normal and emergency operations. The 41 non-SEP plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

If a dam exists in the vicinity of a nuclear power plant, it will have to meet one of the following criteria:

(1) If the dam provides impoundment for an UHS at a plant or provides flood protection, the dam is an essential part of the plant and the safety of the dam needs to be ensured throughout the life of the plant. The dam has to be designed and remain stable under both static and seismic conditions.^688,916

(2) If the dam provides impoundment only for plant operation, but not as a part of the UHS, there are no regulatory requirements for dam design. However, the flood conditions that could be caused by dam failures should be considered in establishing the design basis flood.⁶⁸⁷ When upstream dams or other features that provide flood protection are present, in addition to the analyses of the most severe floods that may be induced by either hydrometeorological or seismic mechanisms, reasonable combinations of less severe flood conditions and seismic events should be considered in establishing the design basis flood.

The IPEEE Program will address the safety and the flooding effects of dams. Under this program, the safety of dams will be assessed by all licensees in the process of searching for severe accident vulnerabilities due to external events.^1222,1354 If the failure of these dams would have significant consequences, i.e., a breach of an UHS which might lead to a severe accident, they would have to be evaluated and inspected to assess their existing condition and vulnerability to earthquakes. If the failure of an upstream dam could lead to significant flooding at a site, i.e., the postulated flood exceeded the design basis flood and might lead to a severe accident, the effect of flooding will have to be addressed in the IPEEE.

CONCLUSION

The safety concerns of dam integrity and site flooding will be addressed in the implementation of the IPEEE Program at the 41 plants affected by this issue.¹⁵⁷⁵ Therefore, Issue 156.1.2 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.1.3: SITE HYDROLOGY AND ABILITY TO WITHSTAND FLOODS

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The concerns of this issue included identifying the site hydrologic characteristics, the capability of structures important to safety to withstand flooding, the determination of the adequacy of the cooling water supply, and the ISI of water control structures. Hydrologic considerations are the interface of the plant with the hydrosphere, the identification of hydrologic causal mechanisms that may require special plant design, or operating limitations with regard to floods, and water supply requirements. The specific items to be reviewed in this issue were:

(1) Hydrologic Description - To ensure that plant design reflects appropriate hydrologic conditions.

(2) Flooding Potential and Protection - To ensure that the plant is adequately protected against floods.

(3) Ultimate Heat Sink - To ensure an appropriate supply of cooling water is available during normal and emergency shutdowns.

(4) ISI of Water Control Structures - To ensure an adequate inspection program is in place to prevent swater control structure deterioration or failure which could result in flooding or loss of the UHS.

The 41 non-SEP plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

At a nuclear plant, the safety-related structures, systems, and components, identified in accordance with Regulatory Guide 1.29,⁹¹⁶ must be designed to withstand the conditions resulting from the worst probable site-related flood and retain the capability for shutdown and maintenance.⁶⁸⁷ Alternatively, NRC permits licensees not to design against the worst flood conditions for safety-related structures, systems, and components if sufficient warning time is shown to be available to shut down the plant and implement adequate emergency procedures. However, the safety-related structures, systems, and components must be designed to withstand the conditions resulting from a Standard Project Flood (with a flow-rate about 40% to 60% of the PMF).⁶⁸⁷

On June 28, 1991, the NRC requested all licensees to conduct an IPEEE to search for severe accident vulnerabilities due to external events¹²²²; external flooding is one of the events that will be addressed in the IPEEE.¹³⁵⁴ All licensees will have to examine the flood designs and associated flood protection measures at their sites to determine if severe accident vulnerabilities due to external floods exist. Therefore, the above Items 1 and 2 have been addressed in the external flood portion of the IPEEE program.

Item 3 is related to maintaining the functioning of the SWS and the DHR system of a plant. The severe accident vulnerability resulting either from failure or unavailability of the UHS is one of the important items to be examined in the IPE and IPEEE programs.

The NRC will require the affected licensees to upgrade their ISI programs for water control structures where inspection findings and any subsequent analyses reveal inadequacies in meeting the intent of Item 4.

CONCLUSION

The safety concerns of site hydrologic characteristics and the capability of plants to withstand flooding will be addressed in the implementation of the IPE and IPEEE Programs at the 41 plants affected by this issue.¹⁵⁷⁵ Therefore, Issue 156.1.3 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.1.4: INDUSTRIAL HAZARDS

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The objective of this issue was to ensure that the integrity of safety-related structures, components, and systems will not be damaged by potential hazards from nearby transportation, storage, or industrial facilities. Such hazards include: (1) shock waves and thermal flux from nearby explosions of munitions or explosive gases or chemicals; (2) drifting toxic/explosive vapor clouds; (3) aircraft; and (4) missiles that can result from nearby explosions, such as a rocketing chemical tank car. In a few past licensing cases, reactor containment and intake structure hardening and pipeline relocation have been required to ensure safety of the plants. The 41 plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

Regulatory Guide 4.7¹³⁷² and SRP¹¹ Sections 2.2.1, 2.2.2, and 2.2.3 have been used since 1975 in the design of nuclear power plants for protection against industrial hazards. In addition, Regulatory Guides 1.78,¹³⁷³ 1.91,¹³⁷⁴ and 1.95¹³⁷⁵ were issued to provide further regulatory guidance in this area. Prior to the issuance of these criteria, offsite hazards had been an area of long-standing concern and were reviewed on a case-by-case basis.

Supplement 4 to Generic Letter No. 88-20¹²²² required all licensees to conduct an IPEEE to search for severe accident vulnerabilities due to external events. Industrial hazards comprise one of the external events that will be addressed in the IPEEE.¹³⁵⁴

CONCLUSION

Based on past staff reviews, existing review criteria and guidance, and the implementation of the IPEEE program for all plants, the concern for industrial hazards was adequately addressed. Therefore, Issue 156.1.4 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.1.5: TORNADO MISSILES

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ All plants licensed after 1972 were designed for protection against tornadoes. The concern existed, however, that plants constructed prior to 1972 may not be adequately protected, in particular, those reviewed before 1968 when criteria on tornado protection were first developed. The objective of this issue was to ensure that safety structures, systems, and components can withstand the impact of an appropriate postulated spectrum of tornado-generated missiles. The failure of safety-related structures, systems, or components due to a tornado-induced missile could compromise the ability of a plant to safely shut down. The 41 plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

A plant must be designed to remain in a safe condition in the event that the most severe tornado that can be reasonably predicted occurs at the plant site as a result of severe meteorological conditions. All safety-related structures, systems, and components must be designed to withstand the effects of the design basis tornado, tornado-generated missiles, and other tornado-induced effects.^42,916

Under the IPEEE program, all licensees are required to examine their plants to determine if severe accident vulnerabilities due to high winds/tornadoes exist.^1222,1354 The criteria used for plant design (such as the design basis wind speed, parameters of the design basis tornado along with missile spectrum, and the allowable stresses and load combinations) will be examined. The reporting criterion, 10^-6/year CDF, specified for the IPEEE, however, is considered to be less stringent compared to the CDF associated with tornado missiles design criteria (a product of combining the probability of exceedance associated with the design basis tornado and the conditional failure probability associated with engineering design and construction against tornado missiles). Therefore, meeting the objectives of the IPEEE does not mean, in this situation, that current NRC guidelines for tornado design have been met. Thus, the staff believes that any vulnerability associated with tornado missiles will be evaluated and reported in the IPEEE submittals.

CONCLUSION

The safety concern for tornado missiles will be addressed in the implementation of the IPEEE Program at the 41 plants affected by this issue. Therefore, Issue 156.1.5 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.1.6: TURBINE MISSILES

DESCRIPTION

This issue is one of the three Category 4 issues identified by NRR in SECY-90-343.¹³⁵¹ The safety concern was the potential damage from turbine missiles in nuclear plants licensed before 1973.

As a result of turbine disc failures at two nuclear plants and a number of non-nuclear plants prior to 1973, the staff believed that high energy missiles could be generated from steam turbines with the potential for causing failures in safety-related systems. The two areas of concern were: (1) failures at design overspeed because of degraded disc material, poor ISI of flaws, or chemistry conditions leading to SCC; and (2) destructive overspeed failures that would bring into question the reliability of electrical overspeed protection systems, the reliability and testing programs for stop and control valves, and the ISI of valves. For plants licensed after 1973, the safety concerns of this issue were reviewed by the staff as part of its OL activities; turbine overspeed protection designs were found acceptable and the magnitude of the potential damage from turbine missiles was determined to be plant-specific.

CONCLUSION

The safety concerns of this issue were addressed in the evaluation of Issue A-37, which focused primarily on plants licensed prior to November 1976; SRP¹¹ requirements for turbine design were issued for use by CP applicants after this date. Based on the historical failure rate of turbines used in the evaluation, Issue A-37 was determined to have little safety significance. No new data were provided in SECY-90-343¹³⁵¹ that changed this conclusion. Therefore, this issue was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.2.1: SEVERE WEATHER EFFECTS ON STRUCTURES

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ Safety-related structures, systems, and components should be designed to function under all severe weather conditions to which they may be exposed. Meteorological phenomena to be considered include straight winds, tornadoes, snow and ice loads, and other phenomena judged to be significant for a particular site. The objective of this issue was to identify those meteorological conditions which should be considered in the structural reviews to determine the ability of structures to withstand conditions such as flooding, wind, tornadoes, hurricanes, tsunamis, and seiches. The dynamic effects of waves, tornado pressure drop loading, and possible in-leakage due to floods were to be considered. The 41 non-SEP plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

A nuclear power plant must be designed to remain in a safe condition in the event that the most severe weather conditions that can reasonably be predicted at the site occurs. All the safety-related structures must be designed to withstand the effects of the design basis flood, wind, hurricane, tornado, wind/tornado-generated missiles, and other wind/tornado-induced effects.⁹¹⁶

Under the IPEEE Program, all licensees were requested to examine their plants to determine if severe accident vulnerabilities due to floods or high winds/tornadoes exist.^1222,1354 Licensees were expected to examine their design criteria (such as the design flood level, the hydrostatic pressures against the structures, the design basis wind speed, parameters of the design basis tornado along with missile spectrum, and the allowable stresses and load combinations) used for plant structures to determine if the 1975 SRP¹¹ criteria are satisfied. If a plant conforms to these criteria, it will be judged that the contribution to CDF from the effects of severe weather is less than 10^-6/year and the IPEEE screening criterion would be met. Otherwise, additional evaluation will have to be made to establish severe accident vulnerabilities due to the effects of severe weather. The reporting criterion of 10^-6/year CDF specified for the IPEEE will provide a means by which the ability of a nuclear power plant to withstand severe weather conditions can be reviewed and examined for severe weather-induced vulnerabilities.

Snow and ice loads, when accompanied by strong winds, have caused several complete and partial losses of offsite power and the potential of causing severe accidents at a particular site will be evaluated in the IPE program. Snow and ice loads alone, are judged, based on limited PRA experience, to be unlikely to cause significant structural failure that might lead to severe accidents at nuclear power plants.

CONCLUSION

The safety concern of severe weather effects on structures will be addressed in the implementation of the IPEEE program. Therefore, Issue 155.2.1 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.2.2: DESIGN CODES, CRITERIA, AND LOAD COMBINATIONS

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ With the development of nuclear power, provisions addressing nuclear power plants were progressively introduced into codes and standards to which plant buildings and structures are constructed. Because of this evolutionary development, older nuclear power plants conform to a number of different versions of codes and standards, some of which have since undergone considerable revision. There has likewise been a corresponding development of other licensing criteria, resulting in similar non-uniformity in many of the requirements to which plants have been licensed.

Individual SEP plant reviews identified specific areas of structural design code changes for which the previous codes used in the SEP review required greater safety margins than earlier versions of the codes, or for which no original code provision existed. Most plants demonstrated that safety margins in building structures were not significantly lower than those required by the codes and standards used in the SEP review. A few SEP plants required certain modifications to plant structures.

The concern of this issue was to provide assurance that building structures that house systems and components important to safety are capable of withstanding the effects of natural phenomena such as earthquakes,⁹¹⁶ tornadoes (See Issue 156.1.5), hurricanes, and floods without loss of capability to perform their safety function. These events could cause walls or roofs to collapse damaging equipment that perform a safety function, thereby increasing the likelihood of a transient or LOCA.

CONCLUSION

On June 28, 1991, Supplement 4 to Generic Letter 88-20¹²²² was issued requesting all licensees to perform an IPEEE to determine if vulnerabilities to severe accidents initiated by natural phenomena existed.¹³⁵⁴ The as-built structures, systems, and components in conjunction with operating plant conditions will be used to assess the adequacy of plant safety. Although this program does not directly address the effects of specific structural design code changes, it does in part focus on evaluating the capability of building structures to withstand natural phenomena and to search for cost-effective improvements that can be made to either prevent or reduce the impact of severe accidents. Thus, the staff believed that any severe accident vulnerabilities associated with the effects of natura phenomena on building structures will be evaluated and reported in the IPEEE submittals.

The safety concern with respect to the capability of building structures to withstand the effects of natural phenomena will be sufficiently addressed in the implementation of the IPEEE Program at the 53 operating plants (34 PWRs and 19 BWRs) affected by this issue. Therefore, Issue 156.2.2 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.2.3: CONTAINMENT DESIGN AND INSPECTION

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The objective of this issue was to review the inspection program for tendons in prestressed concrete containment structures to determine whether the inspection programs included testing of prestressed tendons, checking for corrosion or relaxation and possible deterioration of prestressed containments, and whether the concrete in the containment dome or walls degraded due to shrinkage or creep. The 41 non-SEP plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

The concerns about the tendons were addressed in Issue 118 which was identified when a dented and leaking tendon grease cap was found during inspection at Farley Unit 2. The generic implications of tendon anchor head failures were studied under Issue 118 and tendon inspection and surveillance programs were developed that could be followed by licensees to mitigate or reduce such problems. The guidance for inspection and surveillance are contained in Regulatory Guides 1.35⁴⁸¹ and 1.35.1.¹³⁶⁰

The containment dome or wall degradation due to shrinkage or creep is an age-related factor and is also addressed in Regulatory Guide 1.35.1.¹³⁶⁰ For license renewal applications, this concern was addressed in Draft Regulatory Guide DE-1009, "Standard Format and Content of Technical Information for Applications to Renew Nuclear Power Plant Operating Licenses," which will resolve the concern when issued in final form.

10 CFR 50 Appendix A (GDC 53), as implemented by Regulatory Guide 1.35,⁴⁸¹ requires that measured tendon forces (guidance provided in Regulatory Guide 1.35.1¹³⁶⁰) be compared with acceptance criteria. This issue was reviewed by the staff for all SEP plants and accepted on a case-by-case basis, as documented in SERs; some of these plants also developed ISI programs.

CONCLUSION

The safety concerns of containment design and inspection at the 41 plants affected by this issue were addressed in the resolution of Issue 118. Beyond the normal life of the plants, the age-related concrete degradation concern will be addressed in the License Renewal Program. Therefore, 156.2.3 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.2.4: SEISMIC DESIGN OF STRUCTURES, SYSTEMS, AND COMPONENTS

DESCRIPTION

This issue is of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The objective of this issue was to review and evaluate the original seismic design (seismic input, analysis methods, design criteria, seismic instrumentation, seismic classification) of safety-related plant structures, systems, and components to ensure the capability of plants to withstand the effects of an earthquake. Further, this issue would verify whether the free field ground motion specified for plant design adequately represents the vibratory ground motion associated with a postulated SSE at each plant. The free field ground motion will be utilized as the input to analyses to verify the design adequacy of structures, piping, and equipment. This review and evaluation will address the SSE only, since it represents the most severe event that must be considered in plant design. The scope of the review includes three major areas: (1) the integrity of the reactor coolant pressure boundary; (2) the integrity of fluid and electrical distribution systems related to safe shutdown; and (3) the integrity of mechanical and electrical equipment and engineered safety features systems (including containment). This issue did not call for a detailed review of all safety-related structures, systems, and components; rather, a sampling approach supported by a set of confirmatory analyses were to be performed. The sample size and confirmatory analyses were to be increased, if necessary. The 41 plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

GDC 2 of Appendix A to 10 CFR 50 requires that nuclear power plant structures, systems, and components important to safety be designed to withstand the effects of natural phenomena without loss of capability to perform their safety functions. An earthquake is one of the natural phenomena whose effects nuclear power plants must be designed to withstand and remain in a safe condition.

In Supplement 4 to Generic Letter No. 88-20,¹²²² licensees were required to conduct an IPEEE to search for severe accident vulnerabilities due to external events. A seismic event is one of the external events that should be addressed in the IPEEE.¹³⁷¹ All licensees will have to review and evaluate the seismic capabilities of their plants (the as-built, as-operated plants) to withstand the earthquake effects well beyond the design basis and to determine if severe accident vulnerabilities due to seismic events exist at their plants. The seismic input has been evaluated by the staff in the Eastern United States Probabilistic Seismic Hazard Program and the results have been factored into the process of determining the seismic review scope in the IPEEE.

The seismic qualification of mechanical and electrical equipment is being resolved by the implementation of the resolution of Issue A-46. A seismic IPEEE can be accomplished by performing either a seismic PRA with enhancements or a seismic evaluation using a seismic margins method with enhancements. The review scope may vary from plant to plant depending on the selected method and the prescribed seismic hazard condition at the site. Even with the minimum effort under the IPEEE seismic program, at least two success paths (a preferred and an alternative) to shut down and maintain a plant in a safe shutdown condition will be evaluated.¹³⁷¹ This process, when using the seismic margins approach, might not provide a detailed review of all safety-related structures, systems, and components, but it will represent a sampling approach, thus fulfilling the objective of Issue 156.2.4. Furthermore, if warranted as a result of staff review, additional analyses on selected safety-related structures, systems, and components can be performed.

CONCLUSION

The safety concerns for the seismic design of structures, systems, and components will be addressed in the implementation of the IPEEE. Therefore, Issue 156.2.4 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.3.1.1: SHUTDOWN SYSTEMS

DESCRIPTION

Issues 156.3.1.1 and 156.3.1.2 were combined and evaluated together. These issues are two of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The 41 plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by these issues.

Issue 156.3.1.1 addressed the capability of plants to ensure reliable shutdown using safety-grade equipment. Systems and components important to safety should be designed, fabricated, installed, and tested to quality standards commensurate with the safety function to be performed. Also, systems and components that are required to withstand the effects of an SSE and remain functional should be classified as Seismic Category I. Due to the evolutionary nature of design codes and standards, the staff believed that operating plants may have been designed to requirements that are not as conservative as those currently required. Systems needed to remove decay heat and reach safe shutdown should have sufficient redundancy to ensure that their function can be accomplished with a loss of offsite power and a single failure. Systems needed to shut down must also remain functional following external events. In addition, the plant operating procedures which direct the use of these systems during normal and abnormal events were to be evaluated.

Issue 156.3.1.2 addressed the review of electrical instrumentation and control features of systems required for safe shutdown, including support systems, to determine whether they met existing licensing requirements. This review was to include the capability and methods of bringing the plant from a high pressure to a low pressure cooling condition, assuming the use of only safety equipment.

The intent of these issues have been met by a number of NRC requirements and initiatives that are already in place to secure reliable plant shutdown capability. These are as follows:

(1) The fire protection rule (10 CFR 50, Appendix R) requires that the capability for shutdown be maintained, in the event of a fire in any location;

(2) The station blackout rule (10 CFR 50.63) requires the capability to cope with a complete loss of AC power and maintain safe shutdown at the same time;

(3) A number of initiatives under the TMI Action Plan⁴⁸ enhance auxiliary feedwater capability, including emergency power provisions;

(4) Improved capability for natural circulation cooldown was required by Generic Letter No. 81-21¹³⁵⁵ and improved TS that enhance RHR operability in all modes were required by Generic Letter Nos. 80-42 and 80-53¹³⁵⁶;

(5) TMI Action Plan⁴⁸ Item I.C.l requires upgraded procedures for emergency conditions, including alternate means of providing a heat sink;

(6) The TMI Action Plan,⁴⁸ as clarified by NUREG-0737,⁹⁸ resulted in the issuance of requirements to licensees to implement Regulatory Guide 1.97⁵⁵ which specifies instrumentation for monitoring important parameters such as pressure, flow, and temperature (Continuing improvements in emergency procedures and training also address these issues);

(7) The resolution of Issue A-46 and the imposition of Generic Letter Nos. 87-02¹⁰⁶⁹ and 87-03¹³⁸⁷ required licensees to address the seismic adequacy of equipment needed to bring a plant to hot shutdown and maintain that condition for a minimum of 72 hours;

(8) The resolution of Issue 99 addressed corrective actions to reduce risk during shutdown with requirements issued in Generic Letter No. 88-17.¹¹⁴⁵ The program described in this letter was included in a broader program described in SECY-91-283¹³⁷⁰ to evaluate the risk associated with shutdown and low power.

The resolution of Issue A-45 spanned the period from March 1981 to September 1988 during which time, extensive, PRA-based determinations of the risk resulting from shutdown cooling system failures at 6 representative operating plants were made. These studies included (but were not limited to) the concerns of Issues 156.3.1.1 and 156.3.1.2. The technical resolution of Issue A-45 was described in SECY-88-260¹¹⁴³ in which the following conclusions were presented:

(1) The risk due to loss of DHR systems could be unduly high for some plants;

(2) DHR failure vulnerabilities and the optimum corrective actions for those vulnerabilities are strongly plant-specific;

(3) Detailed plant-specific analyses under the IPE program, including extension of the IPE program to require consideration of externally-initiated events (anticipated at the time of the resolution of Issue A-45 but since accomplished), will be needed to impose and implement the resolution of this issue.

The staff concluded from the PRA studies that the risk from DHR-related failures might be too high at some plants, but a generic corrective action or a set of actions could not be identified that would both reduce that risk to an acceptable level and be cost-effective at all plants. It was believed, however, that cost-effective plant-specific actions might be possible that would reduce DHR-failure-related risk and it was concluded that the most efficient method to identify any such actions would be through the IPE program.

Appendix 5 of Generic Letter No. 88-20¹²²² provided a specific description of those topics addressed in Issue A-45 and related to internally-initiated events (including those raised in Issues 156.3.1.1 and 156.3.1.2) that are to be considered in the IPE program. The IPE process was extended to include externally-initiated events (IPEEE) upon issuance of Supplement 4 to Generic Letter No. 88-20.¹²²² Section 5 of this supplement specifically described how the IPEEE program was to be used to implement the technical resolution of those topics in Issue A-45 that are related to externally-initiated events.

The studies performed in the resolution of Issue A-45 included the analysis of events that initiate at full power conditions. Although the final results (total risk resulting from DHR-related failures) were increased by 20% for PWRs and 30% for BWRs to account for risk from DHR-related failures, during events that initiate when a plant is not at full power (such as hot standby and cold shutdown), such events were not investigated in detail. The IPE process was consistent with the analyses completed for Issue A-45 in that it only required consideration of events that initiate at full power conditions.

However, detailed attention is currently being paid to DHR failure-related events that initiate at conditions other than full power by an extensive NRC program initiated with the issuance of Generic Letter No. 88-17¹¹⁴⁵ which resulted from an Augmented Inspection Team (AIT) investigation of a 1987 loss-of-DHR event at Diablo Canyon.¹³⁶⁹ This letter required licensees to investigate and, if necessary, improve procedures involving containment isolation and cooling and DHR-related equipment operation methods and training during non-power operations, when the reactor primary coolant inventory is reduced. This work received additional impetus since the issuance of Generic Letter No. 88-17¹¹⁴⁵ by a loss-of-DHR event at the Vogtle nuclear plant. The Vogtle event resulted in the issuance of SECY-91-283¹³⁷⁰ which described all aspects of the extensive program including, but not limited to, the program outlined in Generic Letter No. 88-17.¹¹⁴⁵ Some aspects of the program described in SECY-91-283¹³⁷⁰ will contribute to the imposition and implementation of the resolution of Issue A-45. This program now includes the NRC-sponsored Low Power and Shutdown (LP&S) Program which was originally formulated as part of the NRC response to the Chernobyl event.¹¹⁹⁵ The LP&S work is being performed by BNL and SNL with additional work regarding seismically-initiated events being performed by Future Resources Associates (FRA), Inc. The objectives of the LP&S program were to: (1) assess the frequency and risk of accidents initiated during LP&S modes of operation for two nuclear power plants; (2) compare the assessed frequency and risk with those of accidents initiated during full power operations; and (3) develop new methods for assessing LP&S accident frequency and risk, as necessary.

CONCLUSION

The safety concerns of Issues 156.3.1.1 and 156.3.1.2 were addressed in the resolution of Issue A-45 and in the IPE and IPEEE programs which were supplemented by the Evaluation of Shutdown and Low Power Risk Issues Program described in SECY-91-283.¹³⁷⁰ Therefore, Issues 156.3.1.1 and 156.3.1.2 were DROPPED from further consideration as new and separate issues. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issues.

ISSUE 156.3.1.2: ELECTRICAL INSTRUMENTATION AND CONTROLS

This issue was evaluated with Issue 156.3.1.1 above and DROPPED from further consideration as a new and separate issue.

ISSUE 156.3.2: SERVICE AND COOLING WATER SYSTEMS

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The safety concern was the capability of service and cooling water systems to meet their design objective with adequate margin. This issue was raised to provide assurance that service and cooling water systems are: (1) capable of transferring heat from structures, systems, and components important to safety to the ultimate heat sink; (2) provided with adequate physical separation such that there are no adverse interactions among the systems under any mode of operation; and (3) provided with sufficient cooling water inventory or that adequate provisions for makeup are available. The 41 plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

Concerns for the potential unavailability of SWS were addressed in Issues 51, 130, and 153. Issue 51 was resolved and implemented at operating plants in accordance with Generic Letter No. 89-13.¹²⁵⁹ The resolution identified a recommended improvement in the reliability of open cycle SWS that could result from reducing the potential for flow blockage in safety-related components caused by bivalves, sediment, and corrosion products. This improvement was in the form of an integrated, baseline fouling surveillance and control program for all nuclear power plant open cycle SWS.

Issue 130 was resolved and is being implemented at certain specific plants in accordance with Generic Letter 91-13.¹³⁶⁸ This issue addressed the concerns regarding the SWS reliability of 14 PWRs at multi-unit sites with two SWS trains per unit and a crosstie capability. The resolution identified several cost-effective options that were considered for reducing the risk from loss of SWS (due to causes other than fouling), including a backup means of RCP seal cooling plus additional SWS TS and emergency procedures.

Issue 153 affected all LWRs except those that were addressed in Issue 130. All potential causes of SWS unavailability were to be considered, except those that were resolved and implemented in accordance with Generic Letter No. 89-13.¹²⁵⁹ The resolution plan for Issue 153 was divided into two phases: Phase I, a pilot study; and Phase II, a generic evaluation. The results of Phase I were to be used to determine if an interim resolution was viable and how to proceed with Phase II; Issue B-32 was also addressed in the resolution of Issue 153.

Concerns for the availability of cooling water systems were addressed in the resolution of Issue 143. This issue addressed the potential unavailability of chilled water systems which provide room cooling to maintain adequate environmental temperature for non-safety-related and safety-related equipment. The potential loss of room cooling could affect the operability of the safety-related systems including the SWS system.

CONCLUSION

All of the concerns regarding the performance capability and reliability of service and cooling water systems at the 41 affected plants either have been addressed or are being addressed in the issues discussed above. Additionally, a staff action plan was developed that established NRR as the focal point to ensure that all existing and future SWS issues are adequately addressed.¹³⁶⁷ Therefore, Issue 156.3.2 was DROPPED from further consideration as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.3.3: VENTILATION SYSTEMS

DESCRIPTION

This issue is one of nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ At issue was the adequacy of ventilation systems to provide a safe environment for plant personnel and ESF systems under normal, anticipated transient, and design basis operational conditions. A safe environment is one that is effectively controlled with respect to radiation, heat, humidity, smoke, and toxic gases. Five ventilation systems were identified in SRP¹¹ Section 9.4 to effect ESF equipment and plant personnel: the control room area, spent fuel area, auxiliary and radwaste area, turbine area, and ESF area.

With respect to plant personnel, the concerns about ventilation are grouped under radiation exposure as the first, and exposure to excessive levels of environmental pollutants such as smoke, toxic gases, heat, and humidity as the second. These concerns may be considered for both normal operating and abnormal conditions. For normal conditions, the first concern is addressed by existing regulations in 10 CFR 20 which is quite clear and comprehensive concerning monitoring of restricted and unrestricted areas and radiation limits in each. In particular, 10 CFR 20.106 applies to radioactivity in effluent between restricted and unrestricted areas. Coverage includes limits of concentrations of radioactive material in air as well as water. For applications filed after January 2, 1971, 10 CFR 50.34a requires ALARA programs which are elaborated upon in 10 CFR 50, Appendix I. In addition, 10 CFR 50.34a requires design and installation of equipment "to maintain control over radioactive materials in gaseous and liquid effluent" not only during normal operations but also during expected operational occurrences. 10 CFR 50.36a requires TS on effluent from nuclear power reactors.

For normal operating conditions, the second concern is the responsibility of OSHA whenever the safety of licensed radioactive materials is not involved. This responsibility was outlined in an MOU between OSHA and the NRC issued on October 25, 1988. For abnormal conditions, the second concern comprises potentially unpleasant plant nuisance factors with the exception of the control room and turbine area. One potentially serious atmospheric contaminant in the turbine building and the auxiliary building of PWRs is H₂ with its potential for deflagration or detonation. Issue 106 addressed the role of ventilation systems in the prevention of H₂ deflagration from leaks in the H₂ distribution piping.

Issue 136 addressed the issue of vapor clouds from liquified combustible gases drifting into safety-related air intakes.

Abnormal control room environmental conditions could exist that adversely affect operator performance to a degree sufficient to cause operator-initiated transients. These conditions are within the NRC scope as defined in the above MOU. Conditions affecting mitigation of accidents are also clearly NRC responsibility. The resolution of Issue 83 will address the limits of plant personnel functioning from radiation and toxic gas exposure. The scope of Issue 83 includes "provisions for personnel to remain in the control room as needed to manage accidents which have the potential for offsite and onsite radiological consequences, and protection of control room occupants to the degree necessary to prevent an accident occurring as a result of operator incapacitation." SRP¹¹ Section 6.4, Rev. 2, describes review of the control room ventilation system with the objective of assuring protection for plant operators from the effects of accidental releases of toxic and radioactive gases. A third revision draft is under consideration as part of the resolution of Issue 83. Thus, accident initiation and mitigation capabilities of control room personnel are being addressed with respect to radiation and toxic gas exposure. Control room concerns remaining are high temperature and humidity and smoke.

With respect to high temperature and humidity, the ACRS recommended that "[t]emperature limits should be revised taking into account low air exchange rate, operation of ESF filter system heaters and perspiration." The ACRS considers a temperature limit of 120̊F for the control room as unacceptable; this is a TS limit derived for control room equipment.⁶⁷⁸ Under accident conditions, no NRC requirement exists for temperature limits for reliable performance of control room personnel. However, documentation exists that supports a maximum effective temperature of 85̊F for reliable human performance. (A defined effective temperature includes some combination of dry bulb temperature, relative humidity, and air velocity). Although no accident condition temperature limit has been formalized, SRP¹¹ Section 9.4.1, "Control Room Area Ventilation System," concerns itself in part with "...the comfort of control room personnel during normal operating, anticipated operational transient, and design basis accident conditions." The control room area ventilation system (CRAVS) is reviewed, among other things, with respect to ability to maintain a suitable ambient temperature for control room personnel. The single failure criterion is applied in the CRAVS review. In addition, the CRAVS must function unaffected by loss of equipment that is not seismic Category 1 and the integrated system design must satisfy GDC 2 with respect to earthquakes. The designs are reviewed for protection from floods, hurricanes, tornadoes, internally- or externally-generated missiles, fires, and loss of offsite power. At some plants, the CRAVS is capable of functioning in an internal-filtered recirculation mode of operation.

A survey of 12 plants reported some problems with adequacy and demonstration of adequacy of control room cooling for a postulated 30-day accident period.¹³⁷¹ The plants surveyed were a mix of ages, ranging from some of the oldest to some of the newest. While the problems identified produced no added industry requirements, a recommendation was made for more [staff] attention to detail in evaluations of control room cooling systems design and operations that rely on two separate cooling systems, i.e., a non-safety-related system for normal operations and a safety-related system for emergency operations only. In sum, no additional regulatory requirements or guidance are warranted for investigation with respect to high temperature and humidity vis-a-vis control room personnel under accident conditions.

Issue 143 is to be resolved and will address the importance of ventilation systems on cooling for the operation of ESF equipment. Activities in support of the resolution of Issue 143 will identify the vulnerabilities of safety-related systems and their support systems to the effects of HVAC and chilled water system failures and adverse temperature fluctuations. An evaluation will be made of equipment environmental qualification, equipment room heat load and heat-up rate to identify areas in which a reduction in the dependence of equipment operability on HVAC and room cooling may be required. The control of smoke in plants is being addressed in Issue 148.

CONCLUSION

The safety concerns of Issue 156.3.3 were either being addressed in ongoing staff actions on Issues 83, 106, 136, 143, and 148, or were covered by existing regulations. Therefore, Issue 156.3.3 was DROPPED from further pursuit as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.3.4: ISOLATION OF HIGH AND LOW PRESSURE SYSTEMS

DESCRIPTION

This issue is one of nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ At issue were low pressure systems (such as the RHR systems) that interface with the reactor coolant system through isolation valves. The concern was that systems with low design pressure, in comparison with reactor coolant pressure, will incur damage due to valve failure or inadvertent valve opening.

Issue 105 addressed the possible breach of those interfacing boundaries that are created by a series of PIVs and the consequences of failure of a boundary by mechanical failure, human error, or external event. Thus, Issue 105 covered all interfacing systems, including those identified in Issue 156.3.4. The 41 plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

CONCLUSION

The safety concern of Issue 156.3.4 was addressed in the resolution of Issue 105. Therefore, Issue 156.3.4 was DROPPED from further pursuit as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.3.5: AUTOMATIC ECCS SWITCHOVER

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ Most PWRs require operator action to realign the ECCS for the recirculation mode following a LOCA. Existing guidelines state that automatic transfer to the recirculation mode is preferable to manual transfer. However, a design that provides manual switchover is sufficient provided that adequate instrumentation and information displays are available for the operator to manually transfer from the injection mode to the recirculation mode at the correct time. Automatic in lieu of manual switchover could possibly provide an improvement of ECCS reliability at a cost that could result in a worthwhile safety enhancement. This issue addressed the procedures for manual switchover, the adequacy of available instrumentation, and the possible operator errors associated with the switchover process. The 41 plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

CONCLUSION

All 41 plants affected by this issue were to be considered in the resolution of Issue 24 which was directed at studying the merits of manual, automatic, and semi-automatic ECCS switchover to recirculation. Thus, Issue 156.3.5 was covered in the resolution of Issue 24. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change this conclusion.

ISSUE 156.3.6.1: EMERGENCY AC POWER

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The electrical independence and redundancy of safety-related onsite power sources must meet the single failure criterion. Diesel generators, which provide emergency standby power for safe reactor shutdown in the event of total loss of offsite power, have experienced a significant number of failures over the years that have been attributed to a variety of causes, including failure of the air startup, fuel oil, and combustion air system. The objective of this issue was to review the reliability of protection interlocks and testing of diesel generators to assure that diesel generator systems meet the availability requirements for providing emergency standby power to the engineered safety features, as well as the independence of onsite power distribution systems and features, such as automatic bus transfers and breaker connections, that could affect the independence of redundant trains. The 41 non-SEP plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

CONCLUSION

The safety concern of this issue was addressed in the resolution of Issues A-44, 128, and B-56. The requirements that resulted from the resolution of these three issues will affect the 41 non-SEP plants. In addition, MPAs B-23, "Degraded Grid Voltage," and B-48, "Adequacy of Station Electric Distribution Voltage," have been implemented at several of the 41 plants affected by this issue and will not have to be repeated in the implementation of the resolution of Issue A-44.¹¹⁰⁸ Based on the above considerations, Issue 156.3.6.1 was DROPPED from further pursuit as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.3.6.2: EMERGENCY DC POWER

DESCRIPTION

Historical Background

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343¹³⁵¹ following its study of how the lessons learned from the SEP have been factored into the licensing bases of operating plants. The issue addresses the concern that safety-related DC power system bus voltage monitoring and annunciation may not adequately notify operators of DC bus status. Responses to Generic Letter 91-06¹³⁹⁹ indicated that a significant number of licensees could be affected by the concerns of this issue. Based upon a PRA analysis of the DC power system at six plants, it was concluded that additional DC power system bus voltage monitoring and annunciation for licensed facilities would not have a significant impact on safety and would not be a cost-effective means of increasing plant safety.

This issue addressed the criteria in 10 CFR 50.55a(h) and 10 CFR 50 (GDC 2, 4, 5, 17, 18, and 19) which require that the control room operator be given timely indication of the status of the safety-related DC power system batteries and their availability. The current staff position is that the following separate and independent control room indications and alarms for the Class 1E DC power system status are recommended in order to meet these criteria:

(1) battery disconnect or circuit breaker open alarm (2) battery charger disconnect or circuit breaker open alarm (both input AC and output DC) (3) DC system ground alarm (4) DC bus undervoltage alarm (5) DC bus overvoltage alarm (6) battery charger failure alarm (7) battery discharge alarm (8) battery float charge current ammeter (9) battery circuit output current ammeter (10) battery discharge indicator (11) bus voltage voltmeter

These annunciators and alarms are needed in order to ensure that the control room operators are alerted in the event of DC power system or battery failure. If a less extensive configuration of equipment is used, it is possible that a DC power system or battery failure mode could exist which would not result in the actuation of any alarms or annunciators. In this event, the DC power supply would remain in the degraded condition until a periodic surveillance test or maintenance was performed to identify the condition of the batteries.

Safety Significance

Based upon the SEP reviews, it was apparent that some licensees had received operating licenses without providing the above recommended alarms and annunciators. However, in most cases the licensees in the SEP reviews were able to demonstrate to the staff that modifications were unnecessary. The concern in this issue is that some licensees that were not reviewed in the SEP program might have insufficient annunciators and alarms in the control room to alert the operators to some safety-related DC power supply or battery failure modes, which would increase the likelihood that a DC power supply is unavailable when needed.

PRIORITY DETERMINATION

The issue of control room annunciation and alarms for the safety-related DC power supplies was also addressed in Issue A-30 which was combined with other generic issues involving safety-related power supplies to form Issue 128. Generic Letters 91-06¹³⁹⁹ and 91-11¹⁴⁰⁰ were issued in the resolution of Issue 128; Generic Letter 91-06 addressed the concerns of Issue A-30. Industry organizations such as NUMARC and INPO asserted that most licensees already had alarm and annunciator configurations that were equivalent to the existing staff recommendations which were based in part on industry standards. Therefore, the questions in Generic Letter 91-06¹³⁹⁹ which addressed available alarms and annunciators did not represent a minimum acceptable configuration, but were formulated to provide sufficient information to the staff to determine if licensees had met or adequately addressed the current recommendations.

An INEL review¹⁴⁵⁷ of the responses to Generic Letter 91-06¹³⁹⁹ showed that 42 licensees do not have any separate and independent alarms in the control room for their DC power system. However, these licensees typically had local alarms which were separate and independent, and a single battery condition monitor which alarms in the control room in the event that one or more of the local battery alarms actuate. In addition, the INEL review indicated that 15 licensees have not performed a human factors review of their testing and maintenance procedures, and 5 licensees do not have procedures that specifically prevent simultaneous testing or maintenance of redundant safety-related DC power sources. In most cases, the licensees supplied justification for the discrepancies between their licensed configuration and the current staff position. INEL did not evaluate licensee responses to determine what modifications would be required to adequately resolve the concerns of Issue A-30, and recommended that the staff perform a PRA study to determine the impact on plant safety of existing configurations of safety-related DC power supply annunciation and alarms.

Frequency Estimate

The concern in this issue was that the safety-related DC power supplies might be unavailable because of inadequate control room annunciators and alarms. This concern correlates with the results of NUREG-0666,¹⁶⁴ which included a FMEA and a PRA of a model DC power system. This model system consisted of two independent DC buses each of which were supplied by a single battery charger and had a single battery back-up. In addition, this system had the following alarms and annunciators in the control room: (1) battery charger ground alarm; (2) battery charger AC power supply failure alarm; (3) DC bus undervoltage alarm; (4) battery charger DC ammeter; and (5) battery charger DC voltmeter.

NUREG-0666¹⁶⁴ concluded that battery unavailability is dominated by inadequate maintenance practices and failure to detect battery unavailability due to bus connection faults. By improving battery surveillance, DC power system unreliability could be decreased by a factor of two, and improving maintenance and testing practices could decrease DC power system unavailability by a factor of 10. The report does not quantify a safety benefit which would result from additional alarms or annunciators in the control room, but additional alarms and annunciators would result in the enhancement of surveillance, maintenance and testing capabilities. Additional recommendations were made in NUREG-0666,¹⁶⁴ but these relate to aspects of the DC system which would not be enhanced by the addition of alarms or annunciators, such as the addition of a third DC power train.

In addition to the concerns relating to alarms and annunciators, the responses to Generic Letter 91-06¹³⁹⁹ also identified concerns with the probability of CCF of the DC power supplies. In order to evaluate these two concerns, the PRAs for 6 licensees were reviewed and found to include basic events which modeled the probability of battery unavailability and common cause battery failure. A study was performed to determine the effect on the CDF of decreasing battery unavailability and common cause battery failure probability. This study was performed by the staff using the SARA¹⁴⁵⁶ software. The results are described below.

The assumption was made that improved alarms and annunciators would result in continuous battery condition indication and would essentially result in an undetected battery failure probability of zero, since the operators would be notified of a DC power system failure immediately. However, this approximation would give a greater estimate of the effectiveness of modifications of alarms and annunciators than could actually be obtained. A better estimate of the effect on DC power system reliability resulting from an increase in the number of alarms and annunciators in the control room was obtained by decreasing the battery unavailability from the base case value to a test case value of 10^-6. For the plants considered in this analysis, the base case values ranged from 6.12 x 10^-5 to 7.2 x 10^-4, which reflects an hourly failure rate of approximately 10^-6/hour, and an interval between tests which are capable of detecting a failed battery ranging from 6,120 to 720 hours.

This modification in battery unavailability will also account for any decrease in the battery charger unavailability resulting from the additional hardware. Because the battery must be instantaneously available to supply power if the battery charger fails, the battery unavailability terms in a PRA model are always multiplied by the battery charger unavailability terms. This analysis is conservative because it overestimates the effectiveness of additional alarms and annunciators, which will improve DC power system reliability by a much smaller factor. In addition, this approximation is made under the assumption that the DC power systems have been accurately modeled by PRA analysts for the existing PRAs and is only valid if the configuration of alarms and annunciators modelled by the existing PRAs is less effective than the currently recommended configuration.

CCF of the DC power system can be caused by maintenance activity, the most significant of which is inadvertent connection of redundant trains. Generic Letter 91-11¹⁴⁰⁰ addressed the use of interconnections between Class 1E vital instrument buses and LCOs for Class 1E vital instrument buses. The purpose of this generic letter was to decrease the probability and sources of CCF of redundant Class 1E AC and DC buses and inverters. It was assumed that CCF of the Class 1E buses and inverters has been adequately addressed and the scope of this issue was limited to the batteries and battery chargers.

The SARA¹⁴⁵⁶ software was used to model the effect of decreasing battery unavailability. There are currently nine operating plants which have PRA models which can be used with SARA. These are listed below, in addition to the configuration of the DC power system at the plant.

Plant	Number of 125V DC Batteries	Number of Battery Chargers
Grand Gulf 11318	3	6
Brunswick 1 & 2*	4 (each)	4 (each)
Peach Bottom 2*	4	4
Surry 11318	2 + diesel	2
Sequoyah 11318	2 + diesel + 1 common	2 + 1 common
Oconee-3889	2	3
Zion1318	2 + 1 common	2 + 1 common
Indian Point-2	4	4

* Based on IPE Submittal

Peach Bottom-2: This unit has two independent divisions of safety-related 125V DC power, one of which is required to safely shut down the plant. Each division is comprised of two batteries, each with it's own charger. The control room has 3 of 7 recommended alarms and 1 of 4 recommended annunciators. The Peach Bottom PRA included probability terms for battery unavailability due to common mode failure and unavailability of the individual Unit 2B and 3C battery banks. The terms for the remaining battery banks (2A, 2C, 2D, and 3D) were not included in any significant minimal cutsets, and decreasing these basic event probabilities would have a negligible effect on the CDF. The probability of battery unavailability was estimated in the original PRA to be 0.001.

Peach Bottom-2: Common Mode Battery Failure

Probability	CDF/RY	Change/RY
0.001	3.6 x 10-6	base case
0.000001	3.4 x 10-6	-2.0 x 10-7

Peach Bottom-2: Battery 2B and 3C Failure

Probability	CDF/RY	Change/RY
0.001	3.6 x 10-6	base case
0.000001	3.6 x 10-6	-

Decreasing the probability of common mode battery unavailability by three orders of magnitude would result in a decrease in CDF of 2.0 x 10^-7/year, whereas decreasing the probability of the unavailability of batteries 2B and 3C would result in less than a 10^-7 decrease in CDF.

Grand Gulf-1: This unit has three independent divisions of safety-related 125V DC power, two of which are required to safely shut down the plant. The control room has 1 of 7 recommended alarms and 1 of 4 recommended annunciators. The Grand Gulf PRA included terms for the probability of battery common mode failure and failure of the individual Unit 1A3, 1B3, and 1C3 battery banks. All battery banks were included in significant minimal cutsets.

Grand Gulf-1: Common Mode Battery Failure

Probability	CDF/RY	Change/RY
0.001	2.1 x 10-6	base case
0.000001	1.6 x 10-6	-5.0 x 10-7

Grand Gulf 1 - Loss of Power from Batteries 1A3, 1B3, 1C3

Probability	CDF/RY	Change/RY
0.001	2.1 x 10-6	base case
0.000001	1.9 x 10-6	-2.0 x 10-7

Decreasing common mode battery unavailability by three orders of magnitude would result in a decrease in CDF of 5 x 10^-7/RY, whereas decreasing the unavailability of battery 1A3, 1B3 and 1C3 would result in a decrease of 2 x 10^-7 in CDF.

Brunswick-1 and 2: These units each have two independent divisions of safety-related 125V DC power, one of which is required to safely shut down the plant. Each division is comprised of two independent batteries, each with its own charger. The control room has 5 of 7 recommended alarms and 2 of 4 recommended annunciators. The Brunswick Units 1 and 2 PRAs included terms for the probability of individual battery bank unavailability but not for common cause unavailability. The terms for failure of three of the four batteries were included in some minimal cutsets.

Brunswick-1: Battery Bank 1A1, 1A2, and 1B1 Fault

Probability	CDF/RY	Change/RY
0.00033	2.47 x 10-5	base case
0.000001	2.46 x 10-5	-1.0 x 10-7

Brunswick-2: Battery Bank 2A1, 2A2, and 2B1 Fault

Probability	CDF/RY	Change/RY
0.00033	2.08 x 10-5	base case
0.000001	2.06 x 10-5	-2.0 x 10-7

Units 1 and 2 differed slightly in their response to battery failure rate changes. However, decreasing the unavailability of battery 2A1, 2A2, and 2B1 would result in a decrease of 10^-7/RY and 2 x 10^-7/RY in CDF for Unit 1 and 2, respectively.

Surry-1: This unit has two independent divisions of safety-related 125V DC power, one of which is required to safely shut down the plant. The unit also has dedicated batteries for starting the diesel generators. The control room has 4 of 7 recommended alarms and 1 of 4 recommended annunciators. The Surry PRA included terms for the probability of battery common mode failure and failure of the individual I and II battery banks. Neither the common mode battery failure term or individual battery failure terms were included in any significant minimal cutsets. The assumed battery unavailability was 7.2 x 10^-4, which suggests a 2-month interval between tests that would detect battery problems for the typical failure rate. Because the CDF magnitude cutoff for exclusion of core damage sequences from the group of minimal cutsets is usually less than 10^-8, decreasing battery unavailability or common mode failure probability would result in a negligible decrease in CDF.

Sequoyah-1: This unit has two independent divisions of safety-related 125V DC power, one of which is required to safely shut down the plant. The unit also has dedicated batteries for starting the diesel generators. The control room has zero of 7 recommended alarms and 3 of 4 recommended annunciators. The Sequoyah PRA included probabilities for battery common mode unavailability and unavailability of the individual I and II battery banks. Battery unavailability was initially estimated to be 7.2 x 10^-4, which suggests a two-month surveillance test or maintenance interval for a failure rate of 10^-6/hour. The common mode unavailability was estimated to be 5.8 x 10^-6. Neither the common mode unavailability or individual battery unavailability were included in any significant minimal cutsets. The unavailabilities used in this analysis were slightly lower than those used in other analyses. However, the CDF magnitude cutoff for exclusion of core damage sequences from the group of minimal cutsets is usually less than 10^-8 or less. Therefore, decreasing battery unavailability or common mode failure probability would result in a negligible decrease in CDF.

Oconee-3: This unit has two independent divisions of safety-related DC power, one of which is required to safely shut down the plant. The control room has 1 of 7 recommended alarms and none of 4 recommended annunciators. The Oconee PRA⁸⁸⁹ included terms for unavailability of the individual 1CA, 1CB, 3CA, and 3CB battery banks. The probability of battery unavailability was estimated to be 6.12 x 10^-5, which is based on a one-year surveillance test or maintenance interval and a failure rate of 1.4 x 10^-6/hour. Common mode unavailability was not included in the PRA model. The individual battery unavailability terms were not included in any significant minimal cutsets. The probabilities used in this analysis were significantly greater than those used in other analyses. However, the CDF magnitude cutoff for exclusion of core damage sequences from the group of minimal cutsets is usually less than 10^-8 or less. Therefore, decreasing battery unavailability or common mode failure probability would result in a negligible decrease in CDF.

The average decrease in CDF from the proposed modifications was estimated to be approximately 10^-7/RY.

Consequence Estimate

It was assumed that all affected operating plants had an average remaining life of 20 years, based on their original licenses. It was also assumed that each of these plants would be granted a life extension of 20 years. Thus, the average remaining life for all affected plants was 40 years.

The public risk associated with the event considered in this issue was estimated⁶⁴ to be 6.76 x 10⁶ man-rem and 2.52 x 10⁶ man-rem for BWRs and PWRs, respectively. For BWRs, the total potential risk reduction was estimated to be (6.76 x 10⁶)(10^-7)(40) man-rem/reactor or 27 man-rem/reactor. For PWRs, the total potential risk reduction was estimated to be (2.52 x 10⁶)(10^-7)(40) man-rem/reactor or 10 man-rem/reactor.

Cost Estimate

Improving the control room annunciators and alarms for all safety-related DC power systems at each plant would involve a different amount of effort for each licensee, depending upon the amount of instrumentation currently installed, available space for additional annunciators and alarms, and whether existing raceway could hold additional cables. In addition, new procedures and operator training would be required. This additional hardware would include the following:

(1)	Data transmitters at each battery room. Design, installation and testing assumed to be $100,000/battery room, with 3 battery rooms per facility	$300,000
(2)	Raceway and cable from each battery room to the control room. Design, installation and testing costs assumed to be $100 per linear foot, with 1000 linear feet of raceway per battery room and 3 battery rooms per facility	$300,000
(3)	Control room modifications to add annunciators and alarms. Design, installation and testing assumed to be $100,000/battery, 3 batteries per facility	$300,000
(4)	Procedure changes, drawing changes, training, and administrative costs	$100,000
	TOTAL:	$1,000,000

Value/Impact Assessment

Separate value/impact scores were calculated for PWRs and BWRs.

BWRs: Based on a potential public risk reduction of 27 man-rem/reactor and an estimated cost of $1M/reactor for a possible solution, the value/impact score was given by:

S = 27 man-rem/reactor $1M/reactor = 27 man-rem/$M

PWRs: Based on a potential public risk reduction of 10 man-rem/reactor and an estimated cost of $1M/reactor for a possible solution, the value/impact score was given by;

S = 10 man-rem/reactor $1M/reactor

= 10 man-rem/$M

Other Considerations

(1) It is important to monitor the condition of the safety-related DC power system, including the condition of batteries which may be needed in the event of a station blackout. In addition, it is also necessary to have procedures which minimize the probability of a common cause fault of the safety-related DC power systems. Operating experience so far does not indicate that significant problems exist in this area.

(2) Based upon the results of this study, it could be asserted that the control room alarms and annunciators recommended by the staff in current licensing guidelines do not result in a significant increase in plant safety beyond that realized by existing alarm and annunciator configurations and weekly or quarterly maintenance programs. It should be noted that the empirical battery failure rate of approximately 10^-6/hour, which is used to determine battery unavailability, is dependent upon the frequency of battery failures for systems with existing configurations of control room annunciators and alarms. Therefore, it might not be accurate to conclude that the existing recommendations for annunciators and alarms should be relaxed.

(3) Battery unavailability and CCF are recognized by some licensees to be sufficiently probable so as to require modeling in PRAs. Based upon these PRA models, decreasing the unavailability of the batteries and safety-related DC power supplies by several orders of magnitude over that used in the base case does not result in a significant decrease in CDF for these licensees. This observation must be tempered with the knowledge that licensees currently monitor important DC bus parameters, and that other DC power system design features, such as the number of batteries, have a greater impact on DC power system reliability than the number of alarms and annunciators.

CONCLUSION

Based on the potential public risk reduction, this issue had a low priority ranking for BWRs and was in the drop category for PWRs (see Appendix C). Overall, the issue was given a low priority ranking in March 1993. Consideration of a 20-year license renewal period did not change the priority of the issue.¹⁵⁶⁴ Further prioritization, using the conversion factor of $2,000/man-rem approved by the Commission in September 1995, resulted in an impact/value ratio (R) of $37,037/man-rem which placed the issue in the DROP category.

ISSUE 156.3.8: SHARED SYSTEMS

DESCRIPTION

This issue is one of the nineteen category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The sharing of the ESFS for a multi-unit plant, including onsite emergency power systems and service systems, can result in a reduction of the number and capacity of onsite systems to below that which is needed to bring either unit to a safe shutdown condition, or to mitigate the consequences of an accident. Shared systems for multiple unit stations should include equipment powered from each of the units involved. There were 13 multi-unit sites that could be affected by this issue among the 41 non-SEP plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976.

CONCLUSION

The safety concerns associated with systems that are shared by two or more units at multi-unit sites have been previously identified by the staff. The most important contributors to core damage probability at these sites have been determined to be air, cooling water, and electric power systems. These systems have been adequately addressed in Issues 43, 130, 153, and A-44. Based on these considerations, this issue was DROPPED from further pursuit as a new and separate issue. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change the priority of the issue.

ISSUE 156.4.1: RPS AND ESFS ISOLATION

DESCRIPTION

This issue is one of the three Category 4 issues identified by NRR in SECY-90-343.¹³⁵¹ The safety concern was that, in the event of non-safety system failures, the lack of isolation devices could result in the propagation of faults to safety systems and common cause failures may result. In its study, the staff found that approximately 39 plants at 28 sites were not required to meet IEEE 279-1971³⁹⁷ and have not been reviewed for this safety concern since the time of their licensing.

Non-safety systems generally receive control signals from the RPS and ESF sensor current loops. The non-safety circuits are required to be isolated to ensure the independence of the RPS and ESF channels. Requirements for the design and qualification of isolation devices are quite specific. Evaluation of the quality of isolation devices is not the safety issue of concern; rather, the issue is the existence of isolation devices which will preclude the propagation of non-safety system faults to safety systems.

CONCLUSION

The safety concerns of leakage through electrical isolators in instrumentation circuits and electrical isolation in plants not required to meet IEEE 279-1971³⁹⁷ were addressed in the resolution of Issue 142. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change this conclusion.

ISSUE 156.4.2: TESTING OF THE RPS AND ESFS

DESCRIPTION

This issue is one of the nineteen Category 3 issues identified by NRR in SECY-90-343.¹³⁵¹ The objective of this issue was to review plant designs to ensure that: (1) all ECCS components, including the pumps and valves, are included in the component and system test; (2) the frequency and scope of periodic testing are identified; and (3) the test programs will provide adequate assurance that the systems will function when needed. The 41 plants identified in SECY-90-343¹³⁵¹ that received OLs before 1976 were affected by this issue.

CONCLUSION

A portion of this issue was covered by existing requirements; specifically, ECCS pumps and valves are required to be tested quarterly by the ASME Code in accordance with 10 CFR 50.55(a), unless the NRC grants relief to defer testing until refueling outages. The remainder of this issue was covered in the resolution of Issue 120 which addressed the concern regarding on-line (at-power) testability af protection systems (both the RPS and the ESFS) and the possibility that some plants may not provide complete testing capability at power. In an RES evaluation,¹⁵⁶⁴ it was concluded that consideration of a 20-year license renewal period did not change this conclusion.

ISSUE 156.6.1: PIPE BREAK EFFECTS ON SYSTEMS AND COMPONENTS

DESCRIPTION

Historical Background

In 1967, the AEC published draft GDCs for comment and interim use and, until 1972, the staff's implementation of the GDCs required consideration of pipe break effects inside containment. However, due to the lack of documented review criteria, AEC staff positions continued to evolve. Review uniformity was finally developed in the early 1970s, initiated by a November 9, 1972, note from L. Rogers to R. Fraley, in which a Draft Safety Guide entitled "Protection Against Pipe Whip Inside Containment" was proposed. This Draft Guide contained some of the first documented deterministic criteria that the staff had used for several years (to varying degrees) as guidelines for selecting the locations and orientations of postulated pipe breaks inside containment, and for identifying the measures that should be taken to protect safety-related systems and equipment from the dynamic effects of such breaks. Prior to use of these deterministic criteria, the staff used non-deterministic guidelines on a plant-specific basis. The Draft Safety Guide was subsequently revised and issued in May 1973 as Regulatory Guide 1.46¹⁸ for implementation on a forward-fit basis only.

The AEC issued two generic letters to all licensees and CP or OL applicants regarding pipe break effects outside containment in December 1972¹³⁹ and July 1973. These letters, known as the "Giambusso" and "O'Leary" letters, respectively, extended pipe break concerns to locations outside containment, and provided deterministic criteria for break postulation and evaluation of the dynamic effects of postulated breaks. The letters requested all recipients to submit a report to the staff summarizing each plant-specific analysis of the issue. All operating reactor licensees and license applicants submitted the requested analyses in separate correspondence or updated the SARs for their proposed plants to include the analysis. The staff reviewed the submitted analyses and prepared safety evaluations for all plants. In November 1975, the staff published SRP¹¹ Sections 3.6.1 and 3.6.2 that slightly revised the two generic letters discussed above. Thus, after 1975, the specific structural and environmental effects of pipe whip, jet impingement, flooding, etc., on systems and components relied on for safe reactor shutdown were considered.

As stated above, the AEC/NRC has provided requirements to the industry regarding pipe breaks outside of containment through the issuance of the Giambusso and O'Leary generic letters. Since these requirements are applicable to all the affected plants, pipe breaks outside of containment were judged to be a compliance issue and were not considered in this analysis. Compliance matters are dealt with promptly and do not await the generic issue resolution process. Therefore, the issue of pipe breaks outside of containment for the 41 affected plants was brought to the attention of NRR by separate correspondence.¹⁷⁶¹ The remainder of this evaluation only addressed pipe breaks inside containment.

As a part of its plant-specific reviews between 1975 and 1981, the staff used the guidelines in Regulatory Guide 1.46¹⁸ for postulated pipe breaks inside containment, and SRP¹¹ Sections 3.6.1 and 3.6.2 for outside containment. In July 1981, SRP¹¹ Sections 3.6.1 and 3.6.2 were revised to be applicable to both outside and inside containment, thus eliminating the need for further use of Regulatory Guide 1.46,¹⁸ which was subsequently withdrawn.

Between the period 1983-1987, the general issue of pipe breaks inside and outside containment was revisited in the SEP. The objective of the SEP was to determine to what extent the earliest 10 plants (i.e., SEP-II) met the licensing criteria in existence at that time. This objective was later interpreted to ensure that the SEP also provided safety assessments adequate for conversion of provisional operating licenses (POLs) to full-term operating licenses (FTOLs). As a result of these reviews, plants were required to perform engineering evaluations, TS or procedural changes, and physical modifications both inside and outside containment. Regarding inside containment modifications: of the two SEP-II plants evaluated in this analysis (one BWR and one PWR), the BWR was required to modify four piping containment penetrations and the PWR was required to modify steam generator blowdown piping supports. This indicates there was a wide spectrum of implementation associated with the original reviews of these early plants for pipe breaks inside and outside containment.

As with the above-described evolution of uniform pipe break criteria, electrical systems design criteria were also in a state of development. Prior to 1974, electrical system designs were generally reviewed in accordance with the guidelines provided in IEEE-279; however, significant variations in interpretations of that document resulted in substantial design differences in plants. Specifically, true physical separation of wiring to redundant components was not necessarily accomplished. In 1974, Regulatory Guide 1.75 was published, clarifying the requirements.

An earlier evaluation of this issue resulted in a medium-priority ranking (see Appendix C) with the finding that the scope could be limited to pipe breaks inside containment, since the NRC had already provided requirements regarding outside containment pipe breaks to the industry through the issuance of the Giambusso and O'Leary generic letters. However, the uncertainty in the analysis was much wider than desired for a definitive priority ranking. Thus, the issue appeared to warrant additional analysis to enhance the prioritization. In July 1994, a contract was awarded to INEEL to:

(1) Review pipe failure rate data, pipe break methodologies, and related publications to determine recommended pipe failure rates (initiating events) applicable to the affected SEP-III plants.

(2) Review updated FSARs and related SERs for SEP-II, SEP-III, and for representative non-SEP plants to identify and prioritize potential safety concerns (i.e., accident sequences). Several plant visits and walkdowns were included as part of this review.

(3) Estimate changes to core damage frequencies for accident sequences that are determined to be of high or medium priority.

(4) Identify potential corrective actions and their estimated costs.

The evaluation that follows was based on the results of the INEEL research documented in Draft NUREG/CR-6395..

Safety Significance

GDC 4 is the primary regulatory requirement of concern. It requires, in part, that structures, systems and components important to safety be appropriately protected against the environmental and dynamic effects that may result from equipment failures, including the effects of pipe whipping and discharging fluids. Several possible scenarios for plants that do not have adequate protection against pipe whip were identified as a result of the research performed in support of the enhanced prioritization. Related regulatory criteria include common cause failures, protection system independence, and the single failure criterion.

Possible Solution

Issue generic letters to the affected plants requesting that they perform plant-specific reviews and walkdowns, identify vulnerable pipe break locations, and inform the NRC of proposed corrective actions.

PRIORITY DETERMINATION

Numerous scenarios of potential concern were evaluated. The following were considered important enough to be specifically identified for future consideration. All estimated frequencies and probabilities are mean values.

Frequency Estimate

BWRs

Case 1: Failure of Main Steam or Feedwater Piping Resulting in Pipe Whip and Containment Impact/Failure, with Resultant Failure of All Safety Injection Systems

This event (INEEL BWR Event 1) involved a BWR with a Mark I steel containment; 15 of the 16 affected BWRs were of this design. A DEGB of an unprotected (i.e., no pipe whip restraint or containment liner impact absorber) large reactor coolant recirculation pipe inside containment and near the containment liner might result in puncturing of the liner. The resulting unisolable LOCA steam environment would be introduced into the secondary containment building, possibly disabling the ECCS equipment located there. This scenario would greatly increase the probability of core damage and potential offsite doses.

All of the affected BWRs were more than 10 years old and most used Type 304SS in the primary system piping, a material that was susceptible to IGSCC degradation. It should be noted that piping of this material did not qualify for the extremely low rupture probability (leak-before-break) provision of GDC 4. From NUREG-1150,¹⁰⁸¹ the recirculation loop DEGB frequency for this material was estimated to be 10^-4/RY. The fraction of BWR primary piping inside containment that was either main steam or feedwater was estimated to be 0.4. The fraction of main steam or feedwater piping that can impact the containment metal shell was estimated to be 0.25.

The research performed indicated that there was considerable variation among the affected plants regarding the amount of pipe whip protection provided and the proximity of high energy lines to potential targets of concern, including redundant trains (see Other Considerations). It was assumed that the probability of a main steam or feedwater broken pipe rupturing the containment metal shell was 0.25.

The postulated event may also cause a common mode failure of the ECCS system since much of this equipment was located within the secondary containment and will be exposed to a harsh environment beyond its design basis, or that the ECCS piping will fail due to overpressurization of the containment annulus. In most of the affected plants, the ECCS is located in four different quadrants outside the suppression pool (torus). On the other hand, as stated above, redundant electrical power systems and initiating circuitry may not be physically separated in the older plants. Also, if the ECCS operates initially, the ECCS equipment rooms may not be fully protected from internal flooding as the water from the suppression pool flows out the broken pipe into the secondary containment. Based on these considerations, the mean probability of loss of ECCS function was assumed to be 0.8. Based on the above assumptions, the mean value of change in CDF was 2 x 10^-6/RY.

From WASH-1400,¹⁶ the nearest scenario to that described above was the large LOCA BWR-3 release category involving a large LOCA and subsequent containment failure. However, in the WASH-1400¹⁶ case, the containment failure results from overpressurization, not from pipe whip. Three of the four specific BWR-3 large LOCA accident sequences have an incidence frequency of 10^-7/RY, and the remaining one is 10^-6/RY; 10^-7/RY was chosen as the base case for this analysis.

Case 2: Failure of Recirculation Piping Resulting in Pipe Whip and Containment Impact/Failure, With Resultant Failure of All Emergency Core Cooling Systems

This event (INEEL BWR Event 9) was similar to Case 1 but involved the recirculation system piping. From NUREG-1150,¹⁰⁸¹ the recirculation loop DEGB mean frequency for this material was estimated to be 10^-4/RY. The fraction of BWR primary piping inside containment that is recirculation piping was estimated to be 0.2. The fraction of recirculation piping that can impact the containment metal shell was estimated to be 0.5. It was estimated that the mean probability of a recirculation system broken pipe rupturing the containment metal shell was 0.5. The mean probability of eventual failure of all ECCS by the same modes described for Case 1 was estimated to be 0.8. Based on the above assumptions, the mean value of change in CDF was 4 x 10^-6/RY.

Case 3: Failure of RHR Piping Resulting in Pipe Whip and Containment Impact/Failure, With Resultant Failure of All Emergency Core Cooling Systems

This event (INEEL BWR Event 12) was similar to Cases 1 and 2 but involved the RHR System piping. From NUREG-1150,¹⁰⁸¹ the RHR DEGB frequency for this material was estimated to be 10^-4/RY. The fraction of BWR primary piping inside containment that is RHR piping was estimated to be 0.1. The fraction of RHR piping that can impact the containment metal shell was estimated to be 0.5. The mean probability of a recirculation system broken pipe rupturing the containment metal shell was 0.1. The mean probability of eventual failure of all ECCS by the same modes described for Cases 1 and 2 was estimated to be 0.8. Based on the above assumptions, the mean value of change in CDF/RY was 4 x 10^-7/RY.

Case 4: Failure of Recirculation Piping Resulting in Pipe Whip or Jet Impingement on Control Rod Drive Bundles, Causing Failure by Crimping of Enough Insert/Withdraw Lines to Result in Failure to Scram the Reactor

This case corresponded to INEEL BWR Event 5. From NUREG-1150,¹⁰⁸¹ the recirculation loop DEGB frequency for this material was estimated to be 10^-4/RY. The fraction of BWR primary piping inside containment that is recirculation piping was estimated to be 0.2. The fraction of recirculation piping that can impact or impinge on the CRD lines was estimated to be 0.25. It was estimated that the mean probability of a broken RHR pipe crimping enough CRD lines to prevent a scram (about 5 to 10 adjacent lines) was 1. Based on the above assumptions, the mean value of change in CDF was estimated to be 5 x 10^-6/RY.

Case 5: Failure of RHR Piping Resulting in Pipe Whip or Jet Impingement on Control Rod Drive Bundles, Causing Failure by Crimping of Enough Insert/Withdraw Lines to Result in Failure to Scram the Reactor

This event (INEEL BWR Event 10) was similar to Case 3 but involved the RHR system piping. The research performed indicated that there was considerable variation among the affected plants regarding the amount of pipe whip protection provided and the proximity of high energy lines to potential targets of concern. Walkdowns showed that, in at least one case, a large "unisolable from the RCS" RHR line was routed directly between the two banks of CRD bundles. An RHR pipe break in this vicinity would impinge and/or impact on both banks simultaneously.

From NUREG-1150,¹⁰⁸¹ the RHR DEGB frequency for this material was estimated to be 10^-4/RY. The fraction of BWR primary piping inside containment that consitutes RHR piping was estimated to be 0.1. The fraction of RHR piping that can impact or impinge on the CRD lines was estimated to be 0.25. It was estimated that the mean probability of a broken RHR pipe crimping enough CRD lines to prevent a scram (about 5 to 10 adjacent lines) was 1. Based on the above assumptions, the mean value of change in CDF was 2.5 x 10^-6/RY.

Case 6:Failure of High Energy Piping Resulting in Pipe Whip or Jet Impingement on Reactor Protection or Instrumentation & Control Electrical, Hydraulic or Pneumatic Lines, or Components and Eventually Resulting in Failure of Mitigation Systems and Core Damage

This case corresponded to INEEL BWR Event 14. From NUREG-1150,¹⁰⁸¹ the large LOCA frequency is 10^-4/RY. All high energy piping inside containment was considered. The fraction of high energy piping that can impact or impinge on these lines or components was estimated to be 0.5. The mean probability of a broken high energy line failing some of these lines or components to the extent that core damage results was estimated to be 0.75. Based on the above assumptions, the mean value of change in CDF was 3.8 x 10^-5/RY.

Case 7: Failure of High Energy Piping Resulting in Pipe Whip Impact on Reactor Building Component Cooling Water (RBCCW) System to the Extent That the RBCCW Pressure Boundary is Broken, Potentially Opening a Path to Outside Containment if Containment Isolation Fails to Occur; Also Possible Loss of RBCCW Outside Containment for Mitigation

This case corresponded to INEEL BWR Event 16. From NUREG-1150,¹⁰⁸¹ the large LOCA frequency was 10^-4/RY. All high energy piping inside containment was considered. The fraction of high energy piping that can impact the RBCCW system was estimated to be 0.1. The probability of an HELB broken pipe rupturing the RBCCW system was 0.5. The probability of failure to close of containment isolation check valve was 10^-5; the probability of failure to close of a containment isolation MOV was 3 x 10^-5. These scenarios had a combined total probability of 4 x 10^-5. Since the RBCCW surge tank in the secondary containment is vented to atmosphere and has a relatively small volume, it was assumed that its water inventory will drain quickly; for this reason, the mean probability of opening a path to atmosphere outside containment was 1. Once this scenario proceeds to this point, the RBCCW system in the secondary containment will become unavailable, including the RHR heat exchanger; therefore, the probability of losing the RBCCW function outside containment to the extent that core damage occurs was 1. Based on the above assumptions, the mean value of change in CDF was estimated to be 2 x 10^-8/RY.

The total change in CDF for the above 7 BWR cases was estimated to be 5.2 x 10^-5/RY. For all 16 affected BWRs, ΔCDF was 8.3 x 10^-4/RY.

PWRs

Case 1: Failure of Non-Leak-Before-Break Reactor Coolant System, Feedwater, or Main Steam Piping Resulting in Pipe Whip or Jet Impingement on Reactor Protection or Instrumentation & Control Electrical, Hydraulic or Pneumatic Lines or Components and Eventually Resulting in Failure of Mitigation Systems and Core Damage

This case corresponded to INEEL PWR Event 9. From NUREG-1150,¹⁰⁸¹ the HELB frequency in the above-listed systems was 1.5 x 10^-5/RY. All of the listed high energy piping inside containment was considered. The fraction of high energy piping that can impact or impinge on these lines or components was estimated to be 0.1. The mean probability of a broken high energy line failing some of these lines or components to the extent that core damage results was estimated to be 0.5. Based on the above assumptions, the mean value of change in CDF was 7.5 x 10^-5/RY.

Case 2: Failure of Main Steam or Feedwater Piping Resulting in Pipe Whip and Containment Impact/Failure, with Resultant Failure of All Emergency Core Cooling Systems

This case corresponded to INEEL PWR Event 16. From NUREG-1150,¹⁰⁸¹ the DEGB frequency in feedwater piping was estimated to be 4 x 10^-4/RY; for main steam piping, it was estimated to be 10^-4 /RY. The fraction of feedwater piping that can impact the containment shell was estimated to be 0.1. The fraction of main steam piping was also estimated to be 0.1; this fraction remained 0.1. The mean probability of a feedwater or main steam system broken pipe rupturing the containment metal shell was 0.5. The mean probability of additional I&C or ECCS systems failures to the extent that core damage results was estimated to be 4.8 x 10^-5 for the case involving feedwater piping breaks, and 9.8 x 10^-5 for the case involving main steam piping breaks. Based on the above assumptions, the mean value of change in CDF was 1.4 x 10^-9/RY.

Case 3:Failure of Main Steam or Feedwater Piping Resulting in Pipe Whip Impact on CCW System to the Extent That the CCW Pressure Boundary is Broken, Potentially Opening a Path to Outside Containment if Containment Isolation Fails to Occur; Also Possible Loss of CCW Outside Containment for Mitigation

This case corresponded to INEEL PWR Event 17. From NUREG-1150,¹⁰⁸¹ the DEGB frequency in feedwater piping was estimated to be 4 x 10^-4/RY; for main steam piping, it was estimated to be 10^-4/RY; this combined for a total frequency of 5 x 10^-4/RY. The fraction of feedwater piping that can impact the CCW system was estimated to be 0.1; the fraction of main steam piping was also estimated to be 0.1; this fraction remained 0.1. The probability of a feedwater or main steam system broken pipe rupturing the CCW system was 0.5. The probability of failure to close of containment isolation check valve was 10^-5; the probability of failure to close of a containment isolation MOV was 3 x 10^-5; this combined for a total probability of 4 x 10^-5. Since the CCW surge tank is in the auxiliary building near mitigation equipment, is vented to atmosphere, and has a relatively small volume, it was assumed that its water inventory will drain quickly. For this reason, the mean probability of opening a path to atmosphere outside containment was 1. Once this scenario proceeds to this point, the CCW system outside containment will become unavailable, including the RHR heat exchanger. Therefore, the probability of losing the CCW function outside containment, to the extent that core damage occurs, is 1. Based on the above assumptions, the mean value of change in CDF was 10^-7 /RY.

The total change in CDF for the above three PWR cases was 7.5 x 10^-5/RY. For all 25 affected PWRs, the ΔCDF was estimated to be 1.9 x 10^-5/RY.

Consequence Estimate

TABLE 3.156-1

BWR Offsite Dose Table

NUREG/CR-6395 Event Number	ΔCDF (Event/RY)	WASH-140016 Release Category	WASH-140016 Offsite Dose (Man-rem/Event)	Offsite Dose (Man-rem/RY)
Event 1	2.0 x 10-6	BWR-3	5.1 x 106	10.2
Event 5	5.0 x 10-6	BWR-4	6.1 x 105	3.1
Event 9	4.0 x 10-6	BWR-3	5.1 x 106	20.4
Event 10	2.5 x 10-6	BWR-4	6.1 x 105	1.5
Event 12	4.0 x 10-7	BWR-3	5.1 x 106	2.0
Event 14	3.8 x 10-5	BWR-4	6.1 x 105	23.2
Event 16	2.0 x 10-8	BWR-3	5.1 x 106	0.1
TOTAL:				60.5

For the 16 affected BWRs with an average remaining life of 17 years, the estimated change in offsite dose was (60.5 man-rem/RY)(16 reactors)(17years) or 16,464 man-rem.

TABLE 3.156-2

PWR Offsite Dose Table

NUREG/CR-6395 Event Number	ΔCDF (Event/RY)	WASH-140016 Release Category	WASH-140016 Offsite Dose (man-rem/event)	Offsite Dose (man-rem/RY)
Event 9	7.5 x 10-5	PWR-6	1.5 x 105	11.3
Event 16	1.4 x 10-9	PWR-4	2.7 x 106	0.004
Event 17	1.0 x 10-7	PWR-4	2.7 x 106	0.3
TOTAL:				11.6

For the 25 affected PWRs with an average remaining life of 17 years, the estimated change in offsite dose was (11.6 man-rem/RY)(25 reactors)(17 years) or 4,925 man-rem. Thus, the estimated total offsite dose for the 41 affected plants was (16,464 + 4,925) man-rem or 21,389 man-rem.

Cost Estimate

Industry Cost: Implementation of the possible solution was assumed to require the performance of engineering analyses inside containment, perform system walkdowns, and provide a report to the NRC. Ultimately, it was expected that operating procedures and/or TS will be modified, inservice inspections will be enhanced, or physical modifications will be done either to piping (probably addition of pipe whip restraints or jet shields) or to the inside containment leakage detection system. It is expected that the cost to each plant will be $1M. Therefore, for the 41 affected plants (16 BWRs and 25 PWRs), the total implementation cost was estimated to be $41M. This estimate was based on the presumption that the level of effort at the affected plants would be similar to that which resulted for this issue during the SEP program review of the 10 earliest SEP plants.

NRC Cost: Development and implementation of a resolution was estimated to cost $1M, primarily involving review of industry submittals and possible proposed changes to hardware.

Total Cost: The total industry and NRC cost associated with the possible solution was estimated to be $42M.

Impact/Value Assessment

Based on a potential public risk reduction of 21,389 man-rem and an estimated cost of $42M for a possible solution, the impact/value ratio was given by:

R = $42M 21,389 man-rem

= $1,960/man-rem

Other Considerations

(1) The updated SAR for an SEP-III BWR (i.e., one of the 41 plants potentially affected by this issue) stated that, in the event of a DEGB, the broken pipe would strike the Mark I Containment and deform it significantly. However, another BWR of about the same vintage is known to have been required to add energy absorbing structures to protect the Mark I Containment from pipe whip, prior to receipt of an operating license. Therefore, it appeared that there was considerable variation among the affected plants regarding the amount of pipe whip protection provided.

(2) Pipe breaks have actually occurred in the industry. Examples include a Surry feedwater line break, a WNP-2 Fire System valve structural pressure boundary failure, and a Ft. Calhoun 12" steam line break.

(3) Some suspect configurations were observed in the SEP-III walkdown plants, e.g., at one BWR a very close proximity exists between a large RHR (unisolable from RCS) pipe and both banks of the CRD piping, and at one PWR it appeared that a large volume of piping penetrated the containment near where a large amount of electrical wiring also penetrated the containment. This demonstrated that, even through modest efforts (i.e., sampling walkdowns of a sampling of plants), configurations of potential concern have been identified.

(4) Readily available plant documentation provides very little insights regarding actual proximity of high energy piping and potential targets or concern. The potential lack of adequate separation of redundant system targets (e.g., I&C electrical wiring) is also a concern.

(5) Uncertainty remains a significant factor because of the large scope of this issue. This is because of the large number and types of plants, and significant differences in the specific as-built details applicable to this issue.

(6) Many of the affected plants are either currently applying for life extension or are expected to in the near future. Most of the lead life extension applications will be from the affected plants for many years to come.

(7) Although there is a large apparent disparity between the BWR and PWR cases evaluated, it must be remembered that much of the background of this issue was based on sampling walkdowns, i.e., only selected portions of selected plants were available for these walkdowns. Therefore, it is important to treat the BWR and PWR evaluations equally during the next phase of the evaluation. Also, some of the listed scenarios seem to have low probabilities but potentially high consequences. They should be further evaluated.

(8) Assuming a life extension of 20 years for the 31 affected plants, the public risk reduction would be 35,824 man-rem and 10,725 man-rem for BWRs and PWRs, respectively. This would produce an impact/value ratio of $900/man-rem.

CONCLUSION

Several potential accident scenarios were identified; 7 for BWRs and 3 for PWRs. Mean values for core damage were estimated for each and the cumulative effect of each group was also estimated. The total change in CDF was 8.3 x 10^-4/year for the 16 affected BWRs and 7.5 x 10^-5/RY for the 3 PWR cases. This would give the issue a medium/high priority ranking. For all 25 affected PWRs, ΔCDF/Year was 1.9 x 10^-5, which would also give the issue a high/medium priority ranking. Further evaluations which included estimates of offsite doses and costs for potential solutions showed that the issue has a HIGH priority ranking.³⁹⁹

For BWRs, the accident sequences of interest all involve a pipe whip that penetrates the steel primary containment wall, thereby discharging steam into the gap between that wall and the secondary concrete shield wall. Steam that is discharged into this gap will find its way to the rooms containing the equipment associated with the ECCS, which may fail due to the resulting harsh environment. Consequently, a severe core damage event could result, with the integrity of the primary containment already lost.

To address these scenarios, the staff performed a series of calculations using a nonlinear finite element program to estimate the effect of a pipe whip on the containment wall. The results of these calculations indicated that the containment wall would be dented, but not penetrated.

In the more extreme cases, the dented steel containment wall would touch the concrete shield, but this contact would arrest any further displacement. Based on these calculations, the staff concluded that penetration of the steel wall has an exceedingly low probability of occurrence, and the BWR scenarios can be eliminated from further consideration.

Of the PWR accident scenarios, only one has an estimated frequency high enough to warrant further investigation. That sequence is initiated by a high-energy secondary system pipe break within containment. In such an event, pipe whip or jet impingement would then cause failure of instrumentation or control cables within containment, leading to failure of accident-mitigating systems.

Because of the variation in containment designs for the early PWRs, a generic approach was not possible. Instead, staff from RES and the Office of Nuclear Reactor Regulation (NRR) examined the cabling and piping layout of each SEP PWR that is still operating. In so doing, the staff discovered that some plant designs anticipated the SRP requirements for channel separation and separate penetrations on opposite sides of the containment. In other plant designs, cables were separated from piping by walls, floors, or other structures, or were spatially separated by significant distances. No instance was found where a whipping pipe or fluid jet would directly disable both channels of any safety-significant system. Thus, the staff concluded that the PWR scenario could also be eliminated from further consideration.

A technical assessment report was prepared and transmitted to the Advisory Committee on Reactor Safeguards (ACRS) on July 18, 2007. In addition, the staff met with the ACRS on September 6, 2007, and presented the rationale for closing this issue with no further actions. On September 26, 2007 the ACRS reviewed and formally endorsed the staff's recommendation that GI-156.6.1 be closed and that no further actions by the NRC staff of licensees with respect to this issue are necessary. ¹⁸⁹⁵ The issue was closed in December 21, 2007. ¹⁸⁹⁶ The background information, basis for the closeout, and the staff’s technical assessment was presented in Enclosure 1 to the closure memorandum. ¹⁸⁹⁶

REFERENCES

0011. NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (1st Ed.) November 1975, (2nd Ed.) March 1980, (3rd Ed.) July 1981. 0016. WASH-1400 (NUREG-75/014), "Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," U.S. Atomic Energy Commission, October 1975. 0018. Regulatory Guide 1.46, "Protection against Pipe Whip Inside Containment," U.S. Atomic Energy Commission, May 1973. [7907100189] 0042. Regulatory Guide 1.76, "Design Basis Tornado for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, April 1974. [7907100297] 0048. NUREG-0660, "NRC Action Plan Developed as a Result of the TMI-2 Accident," U.S. Nuclear Regulatory Commission, May 1980, (Rev. 1) August 1980. 0055. Regulatory Guide 1.97, "Instrumentation for Light-Water-Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," U.S. Nuclear Regulatory Commission, December 1975, (Rev. 1) August 1977 [8001240572], (Rev. 2) December 1980 [7912310387], (Rev. 3) May 1983. [8502060303] 0064. NUREG/CR-2800, "Guidelines for Nuclear Power Plant Safety Issue Prioritization Information Development," U.S. Nuclear Regulatory Commission, February 1983, (Supplement 1) May 1983, (Supplement 2) December 1983, (Supplement 3) September 1985, (Supplement 4) July 1986, (Supplement 5) July 1996. 0098. NUREG-0737, "Clarification of TMI Action Plan Requirements," U.S. Nuclear Regulatory Commission, November 1980, (Supplement 1) January 1983. 0139. Letter to W. Dickhoner (Cincinatti Gas & Electric Company) from A. Giambusso (U.S. Nuclear Regulatory Commission), December 18, 1972. [8709240215] 0164. NUREG-0666, "A Probabilistic Safety Analysis of DC Power Supply Requirements for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, April 1981. 0397. IEEE Std 279, "Criteria for Protection Systems for Nuclear Power Generating Stations (ANSI N42.7-1972)," The Institute of Electrical and Electronics Engineers, Inc., 1971. 0399. Memorandum for C. Rossi from A. Thadani, "Prioritization of and Transfer of Responsibility for Generic Safety Issue 156.6.1, 'Pipe Break Effects on Systems and Components Inside Containment,'" July 16, 1999. [9908300234] 0481. Regulatory Guide 1.35, "Inservice Inspection of Ungrouted Tendons in Prestressed Concrete Containments," U.S. Nuclear Regulatory Commission, February 1973, (Rev. 1) June 1974, (Rev. 2) January 1976 [7907100149], (Rev. 3) July 1990 [7809180004]. 0678. Memorandum for W. Dircks from H. Denton, "Control Room Habitability," June 29, 1984. [8407100196] 0687. Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev. 2) August 1977. [7907100225] 0688. Regulatory Guide 1.102, "Flood Protection for Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Rev. 1) September 1976. [7907100372] 0814. SECY-84-133, "Integrated Safety Assessment Program (ISAP)," U.S. Nuclear Regulatory Commission, March 23, 1984. [8404100072] 0889. NSAC-60, "A Probabilistic Risk Assessment of Oconee Unit 3," Electric Power Research Institute, June 1984. 0916. Regulatory Guide 1.29, "Seismic Design Classification," U.S. Nuclear Regulatory Commission, June 1972, (Rev. 1) August 1973 [8003280778], (Rev. 2) February 1976, (Rev. 3) September 1978. [7810030052] 1069. Letter to All Holders of Operating Licenses Not Reviewed to Current Licensing Criteria on Seismic Qualification of Equipment from U.S. Nuclear Regulatory Commission, "Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors, Unresolved Safety Issue (USI) A-46 (Generic Letter 87-02)," February 19, 1987. [ML031150371] 1081. NUREG-1150, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," U.S. Nuclear Regulatory Commission, (Vol. 1) December 1990, (Vol. 2) December 1990, (Vol. 3) January 1991. 1108. NUREG-1109, "Regulatory/Backfit Analysis for the Resolution of Unresolved Safety Issue A-44, Station Blackout," U.S. Nuclear Regulatory Commission, June 1988. 1143. SECY-88-260, "Shutdown Decay Heat Removal Requirements (USI A-45)," U.S. Nuclear Regulatory Commission, September 13, 1988. [8811040098] 1145. Letter to All Holders of Operating Licenses or Construction Permits for Pressurized Water Reactors (PWRs) from U.S. Nuclear Regulatory Commission, "Loss of Decay Heat Removal (Generic Letter No. 88-17) 10 CFR 50.54f," October 17, 1988. [ML082760429] 1195. NUREG/CR-1251, "Implications of the Accident at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the United States," U.S. Nuclear Regulatory Commission, (Vol. 1) April 1989, (Vol. 2) April 1989. 1222. Letter to All Licensees Holding Operating Licenses and Construction Permits for Nuclear Power Reactor Facilities from U.S. Nuclear Regulatory Commission, "Individual Plant Examination for Severe Accident Vulnerabilities—10 CFR § 50.54(f), (Generic Letter No. 88-20)," November 23, 1988 [ML031150465], (Supplement 1) August 29, 1989 [8908300001], (Supplement 2) April 4, 1990 [ML031200551], (Supplement 3) July 6, 1990 [ML031210418], (Supplement 4) June 28, 1991 [ML031150485], (Supplement 5) September 8, 1995. 1259. Letter to All Holders of Operating Licenses or Construction Permits for Nuclear Power Plants from U.S. Nuclear Regulatory Commission, "Service Water System Problems Affecting Safety-Related Equipment (Generic Letter 89-13)," July 18, 1989. [8907180211] 1351. SECY-90-343, "Status of the Staff Program to Determine How the Lessons Learned from the Systematic Evaluation Program Have Been Factored into the Licensing Bases of Operating Plants," U.S. Nuclear Regulatory Commission, October 4, 1990. [9010150030] 1354. NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," U.S. Nuclear Regulatory Commission, June 1991. 1355. Letter to All Licensees of Operating Pressurized Water Nuclear Power Reactors and Applicants for Operating Licenses (Except for St. Lucie, Unit No. 1) from U.S. Nuclear Regulatory Commission, "Natural Circulation Cooldown (Generic Letter No. 81-21)," May 5, 1981. [ML031080586] 1356. Letter to All Operating Pressurized Water Reactors (PWR's) from U.S. Nuclear Regulatory Commission, "Decay Heat Removal Capability (Generic Letter 80-53)," June 11, 1980. [ML100321192] 1360. Regulatory Guide 1.35.1, "Determining Prestressing Forces for Inspection of Prestressed Concrete Containments," U.S. Nuclear Regulatory Commission, July 1990. [9503290310] 1367. Memorandum for W. Russell from A. Thadani, "Task Action Plan for Resolution of Service Water System Problems," June 27, 1991. [9107120290] 1368. Letter to Licensees and Applicants of the Following Pressurized-Water Reactor Nuclear Power Plants: 1. Braidwood Units 1 and 2; 2. Byron Units 1 and 2; 3. Catawba Units 1 and 2; 4. Comanche Peak Units 1 and 2; 5. Cook Units 1 and 2; 6. Diablo Canyon Units 1 and 2; 7. McGuire Units 1 and 2, from U.S. Nuclear Regulatory Commission, "Request for Information Related to the Resolution of Generic Issue 130, 'Essential Service Water System Failures at Multi-Unit Sites,' Pursuant to 10 CFR 50.54(f)—Generic Letter 91-13," September 19, 1991. [ML031140524] 1369. NUREG-1269, "Loss of Residual Heat Removal System, Diablo Canyon Unit 2, April 10 1987," U.S. Nuclear Regulatory Commission, June 1987. 1370. SECY-91-283, "Evaluation of Shutdown and Low Power Risk Issues," U.S. Nuclear Regulatory Commission, September 9, 1991. [9109120134] 1371. NUREG/CR-4960, "Control Room Habitability Survey of Licensed Commercial Nuclear Power Generating Stations," U.S. Nuclear Regulatory Commission, October 1988. 1372. Regulatory Guide 4.7, "General Site Suitability Criteria for Nuclear Power Stations," U.S. Nuclear Regulatory Commission, September 1974, (Rev. 1) November 1975. [7907200072] 1373. Regulatory Guide 1.78, "Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release," U.S. Nuclear Regulatory Commission, June 1974. [8001240567] 1374. Regulatory Guide 1.91, "Evaluations of Explosions Postulated to Occur on Transportation Routes Near Nuclear Power Plants," U. S. Nuclear Regulatory Commission, January 1975, (Rev. 1) February 1978 [8808230010]. 1375. Regulatory Guide 1.95, "Protection of Nuclear Power Plant Control Room Operators Against an Accidental Chlorine Release," U.S. Nuclear Regulatory Commission, February 1975, (Rev. 1) January 1977 [8001240569]. 1387. Letter to All Licensees, Applicants and Holders of Operating Licenses Not Required to be Reviewed for Seismic Adequacy of Equipment Under the Provisions of USI A-46, 'Seismic Qualification of Equipment in Operating Plants,' from U.S. Nuclear Regulatory Commission, "Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors, Unresolved Safety Issue (USI) A-46 (Generic Letter 87-03)," February 27, 1987. [ML031140317] 1399. Letter to All Holders of Operating Licenses from U.S. Nuclear Regulatory Commission, "Resolution of Generic Issue A-30, ‘Adequacy of Safety-Related DC Power Supplies,' Pursuant to 10 CFR 50.54(f) (Generic Letter 91-06)," April 29, 1991. [ML031200665] 1400. Letter to All Holders of Operating Licenses from U.S. Nuclear Regulatory Commission, "Resolution of Generic Issues 48, ‘LCOs for Class 1E Vital Instrument Buses,’ and 49, ‘Interlocks and LCOs for Class 1E Tie Breakers’ Pursuant to 10 CFR 50.54(f) (Generic Letter 91-11)," July 18, 1991. [ML031200668] 1443. SECY-90-160, "Proposed Rule on Nuclear Power Plant License Renewal," U.S. Nuclear Regulatory Commission, May 3, 1990. [9005080305] 1444. NUREG-1412, "Foundation for the Adequacy of the Licensing Bases," U.S. Nuclear Regulatory Commission, December 1991. 1456. NUREG/CR-5303, "System Analysis and Risk Assessment System (SARA) Version 4.0," U.S. Nuclear Regulatory Commission, (Vol. 1) February 1992, (Vol. 2) January 1992. 1457. Letter to C. Rourk (U.S. Nuclear Regulatory Commission) from N. Anderson (Idaho National Engineering Laboratory), "Transmittal of Final Report, "Analysis of Plant Specific Responses for the Resolution of Generic Issue A-30, Adequacy of Safety-Related DC Power Supplies," (FIN D6025) NRA-20-92," July 9, 1992. [9502070242] 1564. Memorandum for W. Russell from E. Beckjord, "License Renewal Implications of Generic Safety Issues (GSIs) Prioritized and/or Resolved Between October 1990 and March 1994," May 5, 1994. [9406170365] 1575. Memorandum for C. Serpan and C. Ader from J. Greeves, "Reference to the U.S. Nuclear Regulatory Commission Dam Safety Program in NUREG-0933," August 12, 1994. [9409060217] 1761. Memorandum for A. Thadani from E. Beckjord, "Generic Issue 156-6.1, 'Pipe Break Effects on Systems and Components,'" October 31, 1994. [9412070254] 1895. Memorandum for L. Reyes from W. Shack, "Proposed Recommendation for Resolving Generic Issue 156.6.1, Pipe Break Effects on Systems and Components Inside Containment," September 26, 2007. [ML072530615] 1896. Memorandum for L. Reyes from B. Sheron, "Closure of Generic Issue GI-156.6.1, 'Pipe Break Effects on Systems and Components inside Containment,'" December 21, 2007. [ML073170185]