ML073480143

2007/12/10-Petition for Leave to Intervene with Contentions and Request for Hearing: Exhibit X

ML073480143
Person / Time
Site:	Indian Point
Issue date:	12/10/2007
From:	Shapiro S - No Known Affiliation, Public Health & Sustainable Energy (PHASE), Rockland County Conservation Association, Sierra Club, Atlantic Chapter, State of NY, State Assembly, Westchester Citizens Awarenesss Network (WestCAN)
To:	Klein D E, McDade L G Atomic Safety and Licensing Board Panel, NRC/Chairman
SECY RAS
Shared Package
ML073480129	List: ML073480134 ML073480143
References
50-247-LR, 50-286-LR, ASLB 07-858-03-LR-BD01, RAS 14773
Download: ML073480143 (858)

Text

{{#Wiki_filter:I EXHIBIT X.-$0 April 25, 2003 MEMORANDUM TO: Chairman Diaz FROM: Hubert T. Bell Inspector General IRAI

SUBJECT:

NRC ENFORCEMENT OF REGULATORY REQUIREMENTS AND COMMITMENTS AT INDIAN POINT, UNIT 2 (CASE NO. 01-01S)Attached is an Office of the Inspector General (OIG), U.S. Nuclear Regulatory Commission (NRC) Event Inquiry that addresses the NRC's oversight of operations at the Indian Point, Unit 2 nuclear power plant in Buchanan, New York.Please call me if you have any questions regarding this Event Inquiry. This report is furnished for whatever action you deem appropriate. Please notify this office within 90 days of what action, if any, you take based on the results of the Event Inquiry.

Attachment:

As stated cc w/attachment: Commissioner Dicus Commissioner McGaffigan Commissioner Merrifield W. Travers, EDO April 25, 2003 MEMORANDUM TO: Chairman Diaz FROM: Hubert T. Bell Inspector General IRA/

SUBJECT:

NRC ENFORCEMENT OF REGULATORY REQUIREMENTS AND COMMITMENTS AT INDIAN POINT, UNIT 2 (CASE NO. 01-01S)Attached is an Office of the Inspector General fOIG), US. Nuclear Regulatory Commission (NRC) Event Inquiry that addresses the NRC's oversight of operations at the Indian Point, Unit 2 nuclear power plant in Buchanan, New York.Please call me if you have any questions regarding this Event Inquiry. This report is furnished for whatever action you deem appropriate. Please notify this office within 90 days of what action, if any, you take based on the results of the Event Inquiry.

Attachment:

As stated cc w/attachment: Commissioner Dicus Commissioner McGaffigan Commissioner Merrifield W. Travers, EDO Distribution:(Linda's C:\ORPCheckout\FileNETML031200172.wpd) Case File 01-01S BCC: OPA (5 copies)OCA (5 copies)SECY NRC PDR Historical File AIGI r/f, memo only HBeII, memo only B. Dwyer G. Mulley R. Bucci ADAMS Accession No.: ML031200172 OIG OIG OIG OIG OIG R.Bucci (VOB) G.Mulley (GAM) B.Dwyer (BCD) D.Lee (DCL) H.Bell (HTB)04/25 /03 04/24 /03 04/25 /03 04/25/03 04/25 /03 Official File Copy 3

• NRC ENFORCEMENT OF REGULATORY REQUIREMENTS AND COMMITMENTS AT INDIAN POINT, UNIT 2 Case No. 01-01S/ RAI /RA/Veronica 0. Bucci, Special Agent George A. Mulley, Jr., Senior Level Assistant for Investigative Operations

/RA/Brian C. Dwyer Assistant Inspector General for Investigations NRC ENFORCEMENT OF REGULATORY REQUIREMENTS AND COMMITMENTS AT INDIAN POINT, UNIT 2 Case No. 01-01S April 25, 2003 TABLE OF CONTENTS Page BASIS AND SCO PE .......................................................... 2 BACKGRO UND .... ........................................................ 3 D ETA ILS ................................................................... 5 I. NRC OVERSIGHT OF IP2'S PROGRESS TOWARD FULFILLING TWO 1997 DESIGN BASES COMMITMENTS ......................... 5 O IG FINDING .............................................. 8 II. NRC'S RESPONSE TO REPORTED DISCREPANCIES BETWEEN RPS DESIGN DRAWINGS AND AS-BUILT CONFIGURATION ................ 9 O IG FINDING ............................................ 14 II1. NRC REGULATORY OVERSIGHT OF IP2'S CAP: 1995-2001 .......... 16 O IG FINDING ............................................ 20 IV. NRC'S UTILIZATION OF THE SMM PROCESS TO HEIGHTEN ATTENTION AT iP2 ............................................. 22 O IG FINDING ....................... ..................... 25 APPENDIX A:

SUMMARY

OF IP2 RPS CONDITION REPORTS .................... 27 APPENDIX B: CHRONOLOGY OF SIGNIFICANT INSPECTIONS AND OVERSIGHT AT I P2, 1995 -2003 ............................................ 29 APPENDIX C:

SUMMARY

OF ESCALATED ENFORCEMENT ACTION FROM 1995-2000 ............................................... 36 BASIS AND SCOPE The Office of the Inspector General (OIG) initiated this inquiry in response to a Congressional request that OIG examine issues concerning U.S. Nuclear Regulatory Commission (NRC)oversight of operations at the Indian Point 2 (IP2) nuclear power facility in Buchanan, New York.The request referred specifically to "internal Con Ed/Indian Point 2 condition reports" made public in a January 2001 petition review board meeting that "may include information which indicates that the plant operator may be in violation of a commitment made back in 1997 regarding design bases requirements." The Congressional request also focused on issues raised by an engineering consultant hired by the licensee who had recently resigned his position due 4o a differing professional opinion regarding the plant's Reactor Protection System. The request noted that one of the more lengthy condition reports cited discrepancies between design drawings and the aS-built configuration of the Reactor Protection System.Based on the above concerns, OIG initiated an Event Inquiry to examine: I. NRC's oversight of IP2's progress toward fulfilling two design bases commitments made to the NRC in 1997. These commitments were made in response to NRC's 1996 request for information concerning plant programs and processes for controlling and maintaining operations within the facility's design bases.II. NRC's response to the specific concerns raised by an IP2 engineering consultant pertaining to discrepancies between design drawings and the as-built configuration of the Reactor Protection System.Ill. NRC's oversight of IP2's corrective action program between 1995 and 2001.IV. NRC's utilization of its Senior Management Meeting process to heighten attention to IP2.2-7 BACKGROUND NRC's Regulation of Power Plants -Overview of Terms Used in This Report Nuclear power plants are required to adhere to U.S. Nuclear Regulatory Commission (NRC)regulations to ensure their safe operation. These regulations include requirements that power plants operate in accordance with their current license, which includes (1) the plant's technical specifications, (2) license conditions, ý3) licensee commitments made in response to NRC Generic Letters and Bulletins, and (4) the Final Safety Analysis Report (FSAR).1 Design bases information identifies the specific functions to be performed by a power plant's structures, systems, and components as well as associated design parameters. In addition, plants are required to have a corrective action program (CAP) that enables them to identify, prioritize, and correct problems in a timely manner. Power plants manage their CAP by maintaining a database of action items, or condition reports, which describe particular plant conditions in need of repair or attention. Plants typically prioritize these condition reports based on safety significance and address them accordingly. NRC provides oversight of nuclear power plants to ensure that plants are operating safely. The agency conducts reactor inspections to determine whether power plants are in compliance with agency requirements. Inspections range from routine, baseline inspections 2 to inspections beyond the baseline which may focus on areas of declining plant performance. The agency issues sanctions (i.e., enforcement actions) -such as Notices of Violation (NOV), 3 fines, or orders to modify, suspend, or revoke licenses -when plants are out of compliance. In 2000, NRC implemented a Reactor Oversight Process (ROP), which was intended to be substantially different from the previous oversight process and to take into account improvements in the performance of the nuclear industry over the past 25 years and improved approaches of inspecting and evaluating the safety performance of NRC-licensed plants. Under this process, inspection findings are evaluated for risk significance using pre-established criteria. Plants that fail to meet certain safety objectives, as determined by performance indicators and inspection findings, are to receive increased inspection activity, focusing on areas of declining performance and may be subject to enforcement action.1The FSAR is a licensing document that provides a description and safety analysis of the site, the design, design bases and operational limits, normal and emergency operation, potential accidents, predicted consequences of such accidents, and the means proposed to prevent or mitigate the consequences of such accidents. When the FSAR has been updated, it is referred to as the updated FSAR, or UFSAR.2 Baseline inspections are common to all nuclear power plants; NRC's baseline inspection program is the normal inspection program performed at all nuclear power plants. The program focuses on plant activities that are"risk significant," that is, those activities and systems that have a potential to trigger an accident, can mitigate the effects of an accident, or increase the consequences of a possible accident.3 An NOV formalizes a violation by identifying a requirement and how it was violated.3 Between 1986 and 2001, NRC also used its semiannual Senior Managers Meetings (SMM)4 as a means to increase attention to plants with persistent operational problems. During these meetings, the agency's senior managers reviewed certain plants experiencing declines in performance. Participants decided whether to increase oversight of subject plants and, if so, by what means. For example, a SMM decision might require a plant to undergo additional inspections, or the staff could issue a "trending letter" to advise a licensee that NRC had taken note of declining plant performance, or designate the plant as in need of heightened NRC attention (e.g., designation as an Agency Focus Plant).One way in which nuclear power plants fulfill NRC expectations is through regulatory commitments. Regulatory commitments are non-binding statements made by licensees to NRC indicating they will take specific actions, for example, to verify the accuracy of UFSAR information, and they typically reflect the means by which licensees will accomplish the commitment (e.g., in a certain timeframe, following a specific approach). The Indian Point Nuclear Power Plant, Unit 2 (IP2), is one of two operating pressurized water reactors located in Buchanan, NY, 24 miles north of New York City. IP2 began commercial operations in August 1974. The Consolidated Edison Company of New York, Inc. JConEd), owned IP2 until September 6, 2001, when the plant was purchased by Entergy Nuclear Operations, Inc. NRC's Region I office 5 provides oversight for IP2.4 The Senior Management Meeting (SMM) program which required semiannual meetings of NRC senior managers was replaced in 2001 by the Agency Action Review Meeting (AARM) program. The AARM is an annual meeting of NRC senior managers under the Reactor Oversight Process. This meeting essentially replaces the SMM under NRC's previous oversight process.5NRC has four regional offices that conduct inspections of nuclear reactors within regional boundaries. NRC's Region I provides regulatory oversight for IP2 and other nuclear facilities within the northeast region of the United States.4 DETAILS I. NRC OVERSIGHT OF IP2'S PROGRESS TOWARD FULFILLING TWO 1997 DESIGN BASES COMMITMENTS Overview of Design Bases Nuclear power plants are designed so that internal and external events (e.g., loss of coolant accident, fire, earthquake) will not jeopardize plant safety or threaten the health and safety of the public. A plant's design bases in part describe how the plant will cope'with various accidents and emergencies. Plant structures, systems, and components (SSC) must be built in accordance with design requirements that will enable the plant to meet its design bases and, consequently, to withstand such accidents and emergencies. Plant operators are expected to not make plant modifications to safety related systems without having performed NRC required safety analyses, which are needed to prove the modification will not affect the plant's ability to meet its design bases requirements. Furthermore, when modifications are made, they are supposed to be reflected in the plant's design bases documents, which link each plant SSC to its design bases and original design requirements. Design bases documents include such information as industry, regulatory, and manufacturer criteria for plant systems and information generally contained in the UFSAR specifying system functions and requirements, component functions and requirements, interface requirements from supporting and supported systems, applicable accident analysis assumptions related to the systems, and plant design drawings and calculations. NRC Requests Licensee Feedback on Design Bases Issues NRC team inspections during 1995 and 1996 identified concerns regarding the ability of NRC licensees to maintain and implement the design bases at certain plants. To learn more about the scope and extent of the problems among operating nuclear power reactors, the staff proposed that all licensees be required to provide information regarding the availability and adequacy of design bases information. To that end, on October 9, 1996, NRC issued a letter to each NRC reactor licensee in accordance with Title 10, Part 50, Section 54ff), Code of Federal Regulations (10 CFR 50.54(f)) requesting that each licensee submit under oath a written response within 120 days describing and discussing the effectiveness of its programs and processes for controlling and maintaining operations within the facility's design bases. The stated purpose of the letter was "to require information that will provide the U.S. Nuclear Regulatory Commission (NRC) added confidence and assurance that flicensee plants] are operated and maintained within the design bases and any deviations are reconciled in a timely manner." Specifically, NRC found it problematic that some licensees had failed to (1) appropriately maintain or adhere to plant design bases, (2) appropriately maintain or adhere to the plant licensing basis, (3) comply with the terms and conditions of licenses and NRC regulations, and (4) assure that the UFSARs properly reflect the facilities. According to the letter, "The extent of the licensees' failures to maintain control and to identify and correct the failures .in a timely manner is of concern because of the potential impact on public health and safety should safety systems not respond to challenges from off-normal and accident conditions." 5 i0 NRC Reviews Overall Response Subsequent to NRC's receipt and review of all licensee responses to the October 9, 1996, letter, the staff issued SECY-97-160, 6 which described a four-phased approach which NRC had undertaken to review the licensee responses to the 10 CFR 50.54(f) request. The SECY described the completion of the first three phases and concluded that all licensees had established programs and procedures to maintain the design bases of their facilities. However, SECY-97-160 also recommended certain plant-specific, final-phase followup activities to address the staffs concerns about either (1) the performance of certain licensees in controlling facility design bases or (2) the need to validate the effectiveness of a particular element of a licensee's design control program.A manager in the NRC's Office of Nuclear Reactor Regulation (NRR) told OQG that the request began with a high level of agency concern that there were widespread problems pertaining to the accuracy of plant UFSARs and there was a heightened awareness that these problems needed to be resolved as quickly as possible. However, as licensee efforts to address these concerns unfolded, NRC staff recognized that this effort was more resource intensive than had initially been anticipated, and staff allowed licensees to have more time to complete these efforts.IP2 Responds to NRC Design Bases Request In response to NRC's October 1996 10 CFR 50.54(f) request to ConEd regarding IP2, the licensee made two specific commitments. In its February 13, 1997, letter that conveyed these commitments to NRC, ConEd stated its intent "to voluntarily initiate and complete" an UFSAR review program. The program was scheduled for completion within 24 months. The UFSAR review program was to include (1) verification of the accuracy of the UFSAR design bases information, (2) assessment to confirm that the UFSAR design bases information was properly reflected in plant operation, maintenance, and test procedures, (3) review of the UFSAR to identify and resolve any internal disagreements or inconsistencies which could impact the design bases, and (4) development of a process to enhance overall the UFSAR accessibility. In its second commitment, ConEd stated it would continue its "Design Basis Document (DBD)Initiative" to review and update existing design bases documents and create new ones if needed. The continuation of the DBD Initiative was to include supplementation of 22 DBDs with a combination of additional DBDs and added information on interfacing systems. This effort was also to be completed in 24 months.IP2 Extends Completion Date In a letter dated February 17, 1999 <24 months after the initial commitments were made), ConEd provided an update to NRC concerning the commitments it had made pursuant to NRC's 1996 request. The letter reported that both the UFSAR verification effort and DBD initiative were underway; the UFSAR effort was approximately 65 percent complete and the 6 SECY 97-160, "Staff Review of Licensee Responses to the 10 CFR 50.54(f) Request Regarding the Adequacy and Availability of Design Bases Information," dated July 24, 1997.6 I I supplementation of 6 of 27 DBDs was in progress. The letter also changed the completion date of both commitments: December 31, 1999, for the former and December 31, 2002, for the latter.OIG learned that NRC is not expected to formally approve changes in commitment completion dates such as the one described above. According to the NRR manager, commitments are often schedule or process related (e.g., licensee commitment to fix something by a specific time or in a particular manner) and changes in completion dates are not necessarily problematic. For example, the manager said, a rule may say to fix something in a timely manner and the licensee will commit to do so within 2 months. However, if the licensee fails to make the 2-month deadline, the licensee may adjust the timeframe to another date that NRC would consider timely.-The-NRR-manager~and-Region I staff told-OIG-that after IP2 became-involved in these efforts, all parties realized that the 2-year timeframe that ConEd initially committed to was unrealistic. A number of plants, including 1P2, required additional time to complete their review and NRC staff generally viewed these extensions as reasonable. PIG also learned that with regard to ConEd's schedule change for the UFSAR commitment, Region I staff felt IP2's progress toward fulfilling the commitment was proceeding in a timely manner and that the schedule change was reasonable. In June 2000, ConEd provided NRC with a new projected completion date of March 31, 2001, for its commitment to verify the accuracy of the UFSAR, and ConEd reported that it still anticipated completing its DBD initiative by December'31, 2002.On December 31, 2002, Entergy forwarded correspondence to NRC modifying the completion date for the original commitment that was due on December 31, 2002, to a revised commitment date of December 31, 2003. According to the Region I Administrator and staff, the modification of the completion date was reasonable and acceptable. The Region I Administrator said he considered these deferrals to be appropriate given that numerous, more significant operational and design-related issues emerged over this period requiring extensive licensee management attention and resources. Region I Oversees IP2 Progress in Fulfilling Design Bases Commitments According to a Region I Branch Chief, he visited IP2 on April 3, 2001, and verified for himself that the UFSAR update was "essentially done" and that ConEd was "just wrapping up loose ends." The Branch Chief drew this conclusion based on a presentation ConEd gave him describing the methodology for and status of the UFSAR effort. Additionally, he stated that his conclusion was supported by a series of NRC inspections conducted at IP2 since the initial commitment that confirmed progress was being made. OIG reviewed NRC inspection reports from October 1997 through August 2002 and found that some of the NRC inspections specifically looked at the UFSAR and DBD efforts through baseline and special inspections. These reports reflected inspectors' observations that progress continued to be made in these efforts.7 I 12-The Branch Chief also explained to OIG that when Entergy took over as the licensee for IP2 in September 2001, it assumed ConEd's commitment to complete its DBD Initiative by December 31, 2002, without modifying the completion date. Entergy incorporated the commitment into its "Fundamentals and Improvement Plan" for IP2. With regard to the status of the DBD commitment, the Branch Chief said he visited the plant in May 2002 at which time the plant had completed the review of 22 of the 27 DBDs and planned to complete 3 more by the end of 2002.According to NRC Inspection Report No. 05-247/2002-010, dated August 28, 2002, which reported results of a supplemental and problem identification and resolution (PI & R) inspection from June 17 through July 19, 2002, Entergy had revised its schedule for completing the DBD effort. According to the inspection report, two remaining DBDN (fire protection and electrical separation) would be completed in 2003, rather than by December 2002. The inspection team concluded that the schedule modification-was reasonable. OIG FINDING In February 1997, ConEd responded to NRC's 10 CFR 50.54(f) request for information by committing to two separate 24-month efforts at IP2. In the first of these two commitments to NRC, ConEd stated its intent to initiate and complete an UFSAR review program and in its second commitment, ConEd stated it would continue its IP2 DBD Initiative to review and update existing design basis documents and create new ones if needed. Although ConEd initially committed to complete both efforts in 2 years, ConEd revised its projected completion dates two times for the first effort. The UFSAR review program, initially expected to be completed by February 1999, was extended to December 1999, and finally completed by April 2001. The completion date for the second effort was also revised twice, once by ConEd and the second time by Entergy Nuclear Operations, Inc., IP2's current license holder. The DBD Initiative, initially slated for completion by February 1999, was extended to December 2002, and is now expected to be finished by December 31, 2003. OIG found that the NRC staff did not object to the time extensions because it believed each extension was reasonable, given other significant operational problems at the plant, the effort that was required to fulfill the commitments, and the licensee's steady, but slow, progress in addressing them.8 II. NRC'S RESPONSE TO REPORTED DISCREPANCIES BETWEEN RPS DESIGN DRAWINGS AND AS-BUILT CONFIGURATION The Reactor Protection System The Reactor Protection System (RPS), a system described by NRC staff as "very safety significant" to nuclear power plant operations, is designed to detect a problem in the plant and, if the problem is serious enough, cause the plant to trip (i.e., to automatically shut down in an emergency situation). According to NRC staff, the system can be manually or automatically activated to initiate a plant shutdown. Staff said that to ensure that the reactor will shut down when necessary, the RPS features multiple, independent equipment and components. Any individual RPS component, therefore, could be significant. Furthermore, RPS interfaces with many other safety systems for process monitoring of safety parameters such as reactor coolant-pressure;temperature and -flow, pressurizer level, steam-generator-evel, and reactor-building pressure. As a result, staff said, deficiencies in other systems could have an effect on RPS's ability to operate during an event.The Region I Administrator told 0IG it is a significant problem if the as-built configuration of a system, such as the RPS, is inconsistent with what is needed for the system to be functional. He said it is of lesser significance, but still important, when a system's as-built configuration is inconsistent with design drawings but is still functional. He explained that in either case, inconsistencies between system configurations and design drawings may be indicators that other issues within the system warrant attention. IP2 Condition Reports Identify Design Bases Discrepancies OIG learned that in February 2001, a ConEd engineering consultant raised an allegation to Region I' pertaining to design bases discrepancies between design drawings and the as-built configuration of the RPS. The allegation referred to 13 IP2 condition reports (CR) that IP2 plant personnel, including the engineering consultant, had written to describe these issues. These CRs were a subset of a larger number (more than 300) of CRs written on RPS between 1998 and 2001.7 This subset of CRs identified circumstances in which the system's wiring violated statements in the UFSAR. For example, the CRs identified instances of wires associated with computer and alarm circuits being in close proximity of and sometimes in the same cable tray as the wires associated with the trip and logic circuits. The CR reported that these as-built wiring configurations were in conflict with UFSAR wiring separation criteria.OIG reviewed summaries of the 13 CRs raised in the allegation. Eight of the 13 (CRs 199803574, 199902835, 199903445,199904968, 200007597, 200009499, 200009641, 200010125) focused on:* Quality assurance requirements for design verifications,*Wiring changes resulting from modifications that could not be located, and 4 Wiring configurations not in accordance with UFSAR separation requirements. 7 As context, both regional staff and the IP2 engineering consultant told OIG that roughly 10,000 CRs were being written per year during this timeframe concerning IP2 conditions perceived by licensee staff as in need of attention. 9 A ninth condition report (CR 200100327) summarized the eight preceding CRs. The remaining four condition reports (CRs 199900478, 199902274, 200008415, and 200008818) documented additional examples of related RPS wiring discrepancies. (See Appendix A for a listing of the 13 CRs and a description of the issues covered in each.)The engineering consultant told OIG that while employed at IP2 he wrote CR 200100327 as a summary after becoming aware of the eight earlier CRs. These eight CRs summarized documented deficiencies such as wiring separation issues, wiring configurations not in accordance with design drawings, and cable splices not identified on drawings.The engineering consultant told OIG that he was concerned that collectively these issues warranted a higher level of attention than ConEd had determined was appropriate and that he had raised the matter with ConEd management. Specifically, he explained, he wanted ConEd to-perform another Operability Determination (OD) on the RPS to determine whether the system in its current configuration was operable. He told OIG that prior to his writing of CR 200100327, ConEd performed an OD (OD 00-018) on RPS that addressed a subset of the issues raised in CR 200100327. However, he explained that in his opinion that OD did not go far enough to assess the functional changes that may have resulted from the as-found wiring conditions. Dissatisfied with ConEd's response to the issues he raised, and concerned that ConEd would downgrade CR 200100327 from Significance Level (SL) 2 to an SL3, 8 the engineering consultant formally raised the matter to Region I as an allegation. NRC's Response to RPS Design Bases Discrepancies OIG reviewed documentation of NRC's response to the issues raised by the engineering consultant and learned that NRC: (1) inspected several RPS deficiencies prior to the engineering consultant's allegation, (2) conducted an inspection focused specifically on the RPS wiring discrepancies described in CR 200100327, and (3) responded directly, in writing, to the engineering consultant on the outcome of NRC's review of the concerns he raised in his allegation. In the following three sections, OIG describes each of these efforts, which OIG learned, collectively addressed each of the 13 CRs mentioned in the engineering consultant's allegation. (1) NRC Inspects RPS Deficiencies OIG learned that prior to receipt of the allegation from the ConEd engineering consultant, and during the course of escalated regulatory activities by Region I subsequent to a steam 8 1P2 CRs were ranked on a scale of 1 through 4, with SLI assigned the highest level of significance. The engineering consultant explained to OIG that CRs assigned a higher SL would receive a more heightened response from ConEd. For example, CRs assigned as SL2 were required to receive a formal Operability Determination, while this was not a requirement for CRs assigned as SL3.10 generator tube rupture that occurred at IP2 in February 2000,9 a team of Region I inspectors conducted a 7-week inspection of "engineering, operations and maintenance, radiation protection, security, and weld radiographs associated with the steam generator replacement project." Inspection activities included a review of a sample of RPS open corrective action items relating to the RPS's nonconformance with design drawings and the UFSAR.OIG reviewed the inspection report findings pertaining to the RPS review. The inspection report (IR 05-247/2000-014), dated January 2001, described the RPS issue as follows: The issue involved the licensee's observation that wiring within the protection racks did not always conform with the statements contained in the UFSAR and electrical separation criteria contained in drawing A208685. Specifically, the licensee found instances of wires associated with computer and alarm circuits being in close proximity-of, and-sometimes-in the same-cableitray as-,the wires-associatedwith the trip and logic circuits. The licensee also identified examples of switch contacts originally reserved for logic and trip function being used for computer and alarm functions. All potential interactions involved a single train of protection logic and low energy and low voltage circuits.According to the NRC inspection report, the inspector reviewed three CRs mentioned in the engineering consultant's allegation (CRs 200007597, 200008818, and 200009499) related to RPS logic rack wiring separation concerns, OD 00-018 (dated November 28, 2000), and OD supporting documentation. Based on this review, the report concluded, "There were no significant findings associated with this issue." The Region I inspector who conducted the review told OIG that the inspection was focused on ensuring that the discrepant conditions reported in the three CRs did not affect the safe operation of the RPS. Although the inspector acknowledged to OIG that it was better to review all open issues and CRs related to a particular system and to sample closed CRs, the inspector explained that he did not do so because of the limited scope of the review coupled with limited manpower resources and time. The Region I Administrator explained to OIG that this sampling of RPS issues was part of a larger review of deficiencies and corrective actions that needed to be addressed at the plant.(2) NRC Inspects RPS Wiring Discrepancy Issues Described in CR 200100327 OIG learned that following the engineering consultant's allegation pertaining to the RPS, NRC inspectors revisited the issues that the consultant had collectively recorded in CR 200100327 and documented their findings in a June 2001 inspection report (IR 05-247/2001-005) which described the Region I inspectors' review of: Corrective actions taken by ConEd to address issues raised in CR 200100327; 9 On February 15, 2000, IP2 experienced a steam generator tube rupture in one of the plant's four steam generators, which resulted in a minor radiological discharge to the atmosphere. 11 ConEd's February 12, 2001, OD 01-002, "Ensuring the Functional Capability of a System (RPS) or Component," to determine whether the bases used in the OD were valid and accurate;Safety Evaluation 99-160-EV to change the UFSAR such that wire separation between safety and non-safety wires was no longer required; and RPS open condition reports.These inspection efforts are described below.Corrective Actions Taken to Address CR 200100327 IssuesýOIG reviewed IR 05-247/201-005',-which-described Regjion I's exa-ination dofthe licensee's corrective actions associated with CR 200100327 and the eight feeder CRs, and corrective actions pertaining to CR 200008415 and one additional CR not referenced in the allegation. The inspection report indicated that as background for the inspection, NRC reviewed CRs 199900478 and 199902274, which had been referenced in the allegation. According to the inspection report, inspectors also: Reviewed a ConEd evaluation titled, "SL-2 Evaluation for CR 200100327 on the Reactor Protection System," dated March 7, 2001, to confirm that this evaluation addressed appropriate root causes, contributing causes, compensatory actions and the proposed corrective actions.# Attended a Corrective Action Review Board (CARB) meeting which reviewed and discussed the evaluation.

1. Reviewed the list of ICA (Implementation of Corrective Actions ) for CR 200100327 to confirm that the listed corrective actions adequately addressed the root causes and the concerns raised in CR 200100327.

• Reviewed a sample of corrective actions and issues to determine whether these corrective actions were timely and appropriate to address the issues.* Reviewed the rationale provided for delayed corrective actions.* Reviewed IP2 documents to confirm that on February 12, 2001, ConEd had generated OD 01-002, "Ensuring the Functional Capability of a System (RPS) or Component," to demonstrate that the RPS can perform its safety function, in spite of the combined wiring and documentation deficiencies.
• Reviewed IP2 documents to confirm that on March 12, 2001, ConEd completed a'safety evaluation to address the wiring separation issue regarding RPS wiring configuration conformance with the UFSAR.12-I Based on this review, the inspectors found no issues that would render the RPS incapable of performing its intended safety function.

Specifically, the inspection report stated that no findings of significance were identified. ConEd's Operability Determination (OD) 01-002, "Ensuring the Functional Capability of a System (RPS) or Component" According to IR 50-247/2001-005, ConEd generated OD 01-002 "to demonstrate that the RPS could perform its safety function." OIG learned that Region I inspectors reviewed OD 01-002 to determine whether the bases used in the determination were valid and accurate. The inspectors also reviewed supporting documents used in the OD to verify that the data and bases were accurately translated. Supporting documents reviewed included RPS test procedures and test results, a modification for replacing 88 relays in the RPS, and a sample of CRs associated with RPS wiring issues. CRs reviewed included CR 200008818-and two additional CRs not mentioned by the alleger. Based on their review of this issue, the Region I inspectors again concluded that there were "no findings of significance." Safety Evaluation 99-160-EV Inspection report 50-247/2001-005 noted that in March 2001, ConEd generated a safety evaluation (SE 99-160-EV) to change the UFSAR so that wire separation between safety and non-safety wires would no longer be required and "safety and non-safety wires can run together within a panduit inside the RPS cabinet." However, according to the Region I inspectors, the safety evaluation did not provide sufficient rationale to justify the change to the UFSAR.According to the inspection report, this matter was not resolved during the inspection and was referred to NRR for review. OIG learned that the results of NRR's review were documented in IR 50-247/2001-010, dated December 17, 2001. In that inspection report, NRR acknowledged that SE 99-160-EV failed to address certain relevant issues; however, NRR concluded that the wiring separation between safety and non-safety wires inside the RPS cabinets was not a design requirement for IP2 and was in compliance with industry standards. Consequently, the wiring configuration at IP2 met design requirements and the issue was closed.RPS Open Condition Reports As part of this inspection effort, inspectors also reviewed the RPS condition report history since 1998 and found that since that time more than 300 CRs had been written on the RPS. As of March 9, 2001, 47 CRs remained open in the database, some for almost 3 years. ConEd's records indicated that of the 47 CRs, 3 were ranked as SL4; 37 were ranked as SL3; and 7 were ranked as SL2. The inspection report stated that in response to the inspectors' concerns about possible combined operability or functional effects from the 47 open CRs, ConEd performed an overall assessment of the 47 open CRs and concluded that no functional problems existed. The inspectors reviewed a sample of four CRs to confirm that there were no combined effects that could challenge the functionality of the RPS. The selected CRs were, based on the inspectors' judgement, most likely to yield inspection findings. Based on this review, the inspectors again identified no findings of significance. 13 (3) Region I Response to Engineering Consultant's Allegation In a letter dated July 19, 2001, Region I formally responded to the ConEd engineering consultant who wrote CR 200100327 and who subsequently raised the RPS-related issues to Region I. The letter summarized the consultant's RPS-related concerns as presented in CR 200100327, relayed NRC's inspection findings (from IR 50-247/2001-005) pertaining to these concerns, and described the licensee's actions to address them. In its letter to the engineering consultant, Region I addressed the consultant's concern that "there is a lack of response effort and inadequate corrective actions in response to concerns [the consultant] raised regarding deficiencies in the design record and configuration control of the Reactor Protection System (RPS)." The Region I letter also addressed the consultant's concern that OD 00-018"adequately addressed RPS wire separation and isolation issues, but not the broader concerns" (i.e., loss of design control due to wiring configurations). The letter explained that in response to these concerns, NRC completed an inspection of RPS wiring issues at IP2 on May 4, 2001, that was documented in IR 50-247/2001-005. The letter also explained that to address the "broader issue for the RPS wiring," ConEd completed an RPS operability determination (OD 01-002) on February 12, 2001, completed a root cause evaluation for CR 200100327, entitled, "SL-2 Evaluation for CR 200100327 on the Reactor Protection System," on March 7, 2001, and established a corrective action program to address other broader aspects of the RPS wiring deficiencies. In its conclusion to the consultant's concern about RPS configuration control/design record deficiencies, the letter stated,... your concern was partially substantiated. There were design control weaknesses at IP-2. However, at the time of our inspection, ConEd had established a corrective action plan to address the broader issue as described above [i.e., loss of design control].Further, our inspection did not uncover any issues that would render the RPS incapable of performing its intended safety function.The letter also addressed the consultant's concern that CR 200100327, initially assigned an SL of 2, would be reassigned an SL of 3 and that, as a result, ConEd would not conduct an OD "or otherwise address the broader operability issue raised by the lack of quality control in the changes made to the RPS." The letter explained that (1) the licensee did, in fact, complete an OD for the RPS (OD 01 -002), which "addressed some important wiring issues;" (2) NRC's inspection did not identify any issues that would affect the functionality of the RPS; and (3) CR 200100327 remained as an SL2 CR.The Region I inspectors responsible for reviewing the concerns identified by the engineering consultant told OIG that they did not find anything that would render the RPS inoperable. OIG FINDING Beginning as early as 1998, ConEd identified problems associated with the IP2 RPS wiring configurations and generated internal CRs to document the findings. These CRs identified circumstances in which the system's wiring violated statements in the UFSAR.Thirteen CRs identifying (or reiterating) such wiring discrepancies were presented 14 19 formally to the NRC as an allegation by an IP2 engineering consultant who was concerned that collectively the RPS wiring discrepancies warranted a higher level of attention than the licensee had determined was appropriate. OIG learned that Region I performed two inspections relative to these issues and the NRC's Office of Nuclear Reactor Regulation documented its review in a third inspection report. In addition, Region I responded directly to the engineering consultant in a letter dated July 19, 2001.OIG determined that the NRC appropriately responded to the allegations presented to Region I by the engineering consultant. OIG's review of the three inspection reports and Region I's response to the engineering consultant determined that while NRC validated some of the issues the consultant had raised, the agency repeatedly concluded there were no "findings of significance" related to the RPS wiring issues and that ConEd had appropriate measures in place to address the conditions. 15 III. NRC REGULATORY OVERSIGHT OF IP2'S CAP: 1995 -2001 Overview of IP2 Operational Problems Between 1995 and 2001, IP2 experienced a series of operational problems, attributed in part to deficiencies in IP2's corrective action program (CAP) (i.e., its program to self-identify and resolve plant problems). For example,* In 1995, plant personnel cleaned a turbine using grit. The grit caused significant damage to the internal components of a heater drain tank pump and migrated unchecked throughout the feedwater system, surfacing 2 years later and causing valves to operate erratically. -.... NRC inspections conducted~betweenA1996-and1 997 identified various-issues, including weaknesses in corrective actions taken to address problems identified by the plant. As a result, in May 1997, NRC issued an NOV citing IP2 for nine violations of NRC requirements, six of which were attributed to corrective action violations.

• In the fall of 1997, IP2 voluntarily shut down to address a large backlog of equipment, programmatic, and performance problems.

The plant remained out of service until September 1998.In 1998, in NRC Evaluation Team Report 05-247/1998-005, NRC noted that IP2 had identified problems with its CAP in that its corrective action processes were cumbersome and inefficient, many corrective actions were untimely, and completed actions were typically not revisited to determine whether they had achieved their goal.In August 1999, IP2 experienced a significant reactor trip, or shutdown, partly due to weaknesses in its CAP.+ In February 2000, IP2 experienced a steam generator tube rupture, also partly attributed to weaknesses in the plant's CAP.4 In May 2000, NRC categorized IP2 as an Agency Focus Plant, a status that denotes a need for increased oversight by NRC.+ In 2001, NRC found that IP2 continued to experience problems in its CAP, including issues pertaining to its RPS.Significance of the Corrective Action Program NRC inspects many aspects of nuclear power plants to ensure their safe operation, including the licensees' ability to identify and correct conditions that may affect plant performance and safety. Title 10 of the Code of Federal Regulations, Chapter 50 (10 CFR 50), Appendix B, directs licensees to have a program to assess problems in plant operations and to ensure that timely and effective corrective actions take place. Therefore, it is the licensee's responsibility to implement a program to identify and resolve problems at its facility. Historically this has been referred to as the nuclear power plant's CAP.16 NRC Region I staff told OIG that overall plant performance is greatly determined by the effectiveness of a licensee's-CAP. Staff told OIG that they expect licensees to be aggressive in identifying concerns and appropriately correcting problems, but they recognize that every plant has problems that need to be addressed. When a CAP is effective, staff said, a licensee is able to identify, prioritize, and quickly resolve conditions that may have a negative impact on plant operations. Staff said they have found that the better performing plants are very aggressive at correcting deficiencies. These plants are also proactive in conducting preventive maintenance and in monitoring plant equipment and conditions. As a result, staff said, those licensees have more durable solutions to their problems than poorer performing plants.Several staff members interviewed by OIG observed a direct connection between ineffective CAPs and NRC's identification of a plant as an NRC Watch List'0 Plant. According to one staff member, in every case where a plant had problems or became an NRC Watch List Plant, there was a corresponding weakness.in the licensee's ability to identify, evaluate, and correct problems, as well as a weakness in assessing the effectiveness of actions.The Region I staff told OIG that if NRC lost confidence in a licensee's CAP, the agency would seriously consider whether the licensee should be permitted to operate.NRC Identifies Repeated Problems With IP2 CAP OIG was told by the Region I Administrator and staff that between 1995 and 2001, NRC dedicated significant resources to conduct inspections, document findings, and issue sanctions at IP2, yet problems persisted at the plant. Many of the inspections identified problems with IP2's CAP; however, despite heightened levels of NRC attention to these weaknesses, problems related to corrective actions remained unresolved. [See Appendix B for a chronology detailing the significant inspection activity and other oversight efforts performed at IP2 by NRC during this period.]According to Region I staff, between April 1995 and February 2001, NRC conducted 20 special team inspections at 1P2, logging 5,870 inspection hours dedicated to engineering and problem identification and resolution (PI&R)." By comparison, the average number of hours devoted to these types of inspections at other single unit 1 2 Region I nuclear power plants during the same period was 3,854. Furthermore, between 1995 and 2001, IP2 received 13 enforcement actions, 9 of which identified corrective action issues and 8 of which resulted in monetary fines. [See Appendix C for additional information on these 13 enforcement actions.] This expenditure of inspection resources at IP2 was NRC's response to a perceived downward performance trend 1 0 In 1999, there was a change in NRC terminology; Watch List plants are now referred to as Agency Focus Plants.11NRC: now refers to the CAP as problem identification and resolution (PI&R). This Event Inquiry, which covers a time period during which the term used to describe the process changed, refers to the process as CAP.1 2 According to a Region I Branch Chief, the term "single unit" generally refers to a nuclear power plant site with only one operating reactor inside the protected area fence. Although there are two operating units at the Indian Point site (IP2 and IP3), Region I treats IP2 as a single unit site due to its past regulatory performance problems.This results in the allocation of more inspection resources at IP2 than would be the case if the plant were treated as a dual-unit site.17 that was occurring during the 1995-1999 time frame. According to NRC Region I staff, between 1995 and 2000, overall IP2 performance was not considered very good. Staff said that during that time period, IP2 had problems related to the plant's CAP.Region I staff told OIG that it viewed 1995 as a downward turning point for the plant and recalled the grit intrusion event that occurred that year as an example of this decline. Between October 1996 and April 1997, NRC staff conducted four inspections of IP2, which resulted in the issuance of an NOV in May 1997 based on nine violations of NRC requirements. The inspections included an Integrated Performance Assessment Process (IPAP) and three routine inspections conducted by the NRC resident inspectors. Problems identified during the inspections included weaknesses in IP2's design control which, staff explained, pertained to the availability and completeness of design bases information and problems with the CAP.The Region-1 Administrator toldOIG that following February-1 997-there-wasa series of-events that occurred at IP2, coupled with NRC's inspection findings, that reinforced his concerns about IP2's declining performance. He told OIG that the NRC subsequently sent a message to ConEd management by issuing fairly significant civil penalties and a confirmatory action letter (CAL).1 3 Additionally, he met with ConEd's Chief Executive Officer to address NRC's concerns about IP2's declining performance, the decline in overall effectiveness of management oversight, and a perception that management tolerated problems rather than aggressively identifying and correcting them.Consequently, ConEd management responded to Region I by documenting actions it planned to take to arrest the performance declines and to improve the quality of these activities. These detailed action plans were included in a program that ConEd identified as the Strategic Improvement Program.Declining Systematic Assessment of Licensee Performance Scores According to the Region I Administrator and Region I staff, the Region's concerns about IP2's performance in 1996 were documented in NRC's Systematic Assessment of Licensee Performance (SALP) scores and periodic SALP reports for IP2. The SALP was an NRC evaluation of plant performance conducted every 12 to 24 months within the parameters of NRC's inspection program. The report included a numerical rating of the plant in four categories -plant operations, maintenance, engineering, and plant support -as well as a narrative discussion of performance in each area.In the SALP report covering the period from September 17, 1995, through February 15, 1997, Region I staff noted that overall performance at IP2 declined. Performance in the areas of.operations and plant support were rated as generally effective and some elements were very good; however, performance declined in maintenance and substantively declined in engineering. The SALP report noted many equipment problems were due to the poor condition 1 3 CALs are letters issued by NRC to licensees or vendors to emphasize and confirm a licensee's or vendor's agreement to take certain actions in response to specific issues.18 of a number of systems. Licensee management was involved in many plant activities and made operational decisions, but management oversight was at times ineffective regarding overall efforts to identify, evaluate, and correct problems.IP2 Shuts Down To Address Backlog of Problems OIG learned that following repetitive failures of safety-related electrical breakers, IP2 voluntarily shut down to address a large backlog of equipment, programmatic, and performance problems.This outage lasted from October 1997 until September 1998. According to NRC staff, IP2 used this period to try to better identify and correct these deficient conditions at the plant.Instead of conducting a planned Operational Safety Team Inspection (OSTI)1 4 of IP2, NRC permitted ConEd to hire a team of independent experts to conduct an Independent Safety Assessment (ISA) of the power plant in the springof 1998. NRC assembled a special NRC Evaluation Team (NET) to gauge the validity and effectiveness of the ISA and review the outcome. The NET observed and evaluated the IP2 ISA from March 30 through May 7, 1998, to assess the validity of the ISA conclusions and to determine whether the ISA had fulfilled NRC's intent to obtain an OSTI-type performance assessment. According to the NET report, the ISA achieved noteworthy insights, including the identification of problems with IP2's CAP.Specifically, the ISA found that the CAP was cumbersome and inefficient, many corrective actions were untimely, and completed actions were typically not revisited to see whether they had achieved their intended impact. According to an NRC staff member who participated in the review, IP2's CAP "was not working very well at all." Subsequent to the ISA findings, ConEd developed plans to improve station performance and, according to the regional staff and inspection reports, IP2's performance began slowly to improve following plant startup in September 1998. According to the NRC staff, inspection reports, and other docketed correspondence between NRC and ConEd, substantial changes were made to IP2's CAP during this period. However, although progress was made, a number of problems remained that required continued licensee management attention. IP2 Experiences Two Significant Events In August 1999, IP2 experienced a reactor trip, or shutdown, a risk-significant event that NRC staff characterized as preventable and partly attributable to weaknesses in IP2's CAP. The reactor trip was caused partly by a condition involving repetitive problems with one channel of RPS's over-temperature/delta-temperature circuitry. The condition, which existed since January 1999, had not been promptly identified, the cause of the condition had not been determined, and corrective actions had not been taken. According to the Region I Administrator, while the August 1999 event challenged safe operation, safety margins were maintained at an acceptable level.1 4 At the time, OSTIs were conducted to supplement normal inspections for special purposes such as to verify that a plant operator has properly prepared the staff and theplant for resumption of power operations after an extended shutdown. These inspections were performed by either a headquarters or regional team and typically consist of a 2-week onsite inspection conducted by a team of seven inspectors and a team leader.19 In February 2000, IP2 experienced yet another significant problem attributed to weaknesses in IP2's CAP: a steam generator tube ruptured in one of its four steam generators, resulting in a leak that allowed pressurized radioactive water, which acts to cool the reactor, to mix with non-radioactive water in the steam generator. The power plant was manually shut down following the event. This resulted in a minor radiological discharge to the atmosphere. CAP Problems Persist at IP2 In an NRC inspection report (IR 05-24712001-002) issued in 2001, the Region I inspection team again noted weaknesses in IP2's CAP. According to the report, IP2's progress to effect change continued to be slow. The report "noted problems similar to those that have been previously identified at the IP2 facility, including those in the areas of design control, human and equipment performance, PI&R, and emergency preparedness." When interviewed by OIG, Region Istaff attributed 1P2's CAP problems to a large backlog of problems -any one of which might not appear significant. Staff said that IP2 was able to identify problems but was frequently ineffective at prioritizing and correcting them and determining their root cause. Staff attributed this specifically to a cultural problem at IP2 that was not recognized by ConEd management until after the August 1999 event. Staff described this culture as one in which ConEd management did not emphasize or encourage staff efforts to prioritize the correction of problems and identify root causes.The Region I Administrator and staff acknowledged that the improvements at IP2 were slow, and in some respects limited, but steady. The Region I Administrator told OIG that IP2 met NRC's minimum regulatory requirements and there was never a situation where the margins of safety had been reduced to a point where the plant was unsafe. He added that as a regulator one has to work within the regulatory framework and distinguish between conditions that are unsafe and conditions that involve weaknesses in performance. The Region I Administrator and staff repeatedly emphasized to OIG that the increased inspections and aggressive oversight never identified a situation where IP2 was unsafe.The Region I Administrator explained to OIG that IP2's rate of improvement above fundamental protection of public health and safety is determined by the plant management. The licensee determines the type and amount of resources that it will apply to facilitate improved performance. The licensee also makes personnel selections at the plant and it is ultimately up to the individuals hired to make these improvements and effect change. The Region I Administrator told OIG that he continually pressed ConEd management to strengthen the margins of safety at lP2 by conducting numerous inspections and special assessments and by communicating the Region's findings to ConEd in a clear and direct manner.OIG FINDING Between 1995 and 2001, IP2 experienced a series of operational problems, attributed in large part to deficiencies in 1P2's CAP. OIG found that during this period, Region I dedicated significant resources to conduct inspections, document findings, and issue sanctions, yet problems persisted at the plant. Between April 1995 and February 2001, NRC conducted 20 special team inspections at 1P2, logging 5,870 inspection hours dedicated to engineering and problem identification and resolution. Furthermore, 20 2,S between 1995 and 2001, Region I issued 13 enforcement actions to IP2. Many of the inspections identified problems with IP2's CAP. However, despite heightened levels of NRC attention to these weaknesses, problems at IP2 remained unresolved. OIG found that in spite of the intensified regulatory oversight by Region I, IP2 was only able to achieve limited improvement in plant performance. 21 IV. NRC'S UTILIZATION OF THE SMM PROCESS TO HEIGHTEN ATTENTION AT IP2 Senior Management Meeting Process Between 1986 and 2001, NRC held Senior Management Meetings (SMM) semiannually to allow NRC .senior managers to focus agency attention on those plants of highest concern and to monitor licensee efforts to recognize and resolve performance problems. According to the March 1997 version of NRC Management Directive (MD) 8.14, "Senior Management Meeting (SMM)," the primary goal of an SMM was to identify declining trends in the operational safety of individual plants so that early corrective actions could be implemented. OIG was told by senior NRC managers that the SMM offered a means to communicate NRC's concerns to licensees with poor or adverse performance trends.During the SMM, the senior NRC managers could opt not to take action regarding a particular plant or they could choose to take one of several actions to heighten oversight. For example, senior managers could choose to issue a Trending Letter to advise a licensee that NRC had taken notice of declining plant performance and that if performance did not improve, the plant might be placed on the NRC's Watch List. Or, the managers could choose to place a plant directly on the Watch List. A plant placed on the Watch List received increased oversight from NRC in the form of additional inspections, letters expressing agency concerns about declining performance, and other types of regulatory attention. According to the NRC staff, designation as a Watch List plant could also bring significant public attention to a licensee and could result in a negative economic impact for the utility. These potential negative consequences would motivate a licensee to improve plant performance. Senior Management Meetings were chaired by the NRC Executive Director for Operations. Participants typically included the Deputy Executive Director for Regulatory Programs; Deputy Executive Director for Regulatory Effectiveness, Program Oversight, Investigations and Enforcement; Deputy Executive Director for Management Services; Regional Administrators; Directors of the Offices of Nuclear Reactor Regulation, Analysis and Evaluation of Operational Data, Nuclear Material Safety and Safeguards, Nuclear Regulatory. Research, Enforcement, Investigation, and State Programs; and senior managers from the Office of the General Counsel.Region I Administrator Seeks SMM Action on IP2 OIG learned that paralleling NRC's inspection activity at IP2 from 1997 through 2000 was a series of attempts by the Region I Administrator to further heighten NRC oversight at the plant through the agency's SMM process. At the June 1997 SMM, the Region I Administrator presented his concerns regarding the declining performance of IP2 that was the result of significant equipment, human performance, and technical support performance issues that were apparent in late 1996. NRC Regional Administrators and senior managers told OIG that at the June 1997 SMM, the Region I Administrator made "a strong presentation" regarding IP2's performance and his belief that IP2 should be designated as a Watch List plant. However, the senior managers decided not to designate IP2 as a Watch List plant but to continue providing the heightened level of regional oversight underway at the time. According to the senior managers, and based on minutes of the SMM proceedings, the information presented at the SMM did not identify a situation where the plant was unsafe, a safety system was inoperable, or 22-2)-7 adverse trends were apparent. Thus, the senior managers determined that IP2 did not warrant agency-level action.During the SMM held in January 1998, the Region I Administrator again presented IP2 for discussion asserting that there had been little change in performance in most respects over the prior 6 months; that recent inspections raised additional concerns with respect to performance; that NRC inspectors, rather than ConEd, continued to identify many of the performance problems, particularly in operations and engineering; and that equipment and human performance issues continued to be of concern. Additionally, the informality of processes contributed to problems observed in several areas, including technical specification implementation, procedural adherence, problem identification, and timely effective resolution of issues. OIG learned that this time, the consensus of the senior managers was to conduct a diagnostic-type review to obtain additional information on the plant's condition and not to issue a trending letter or put the plant on the Watch List. Again, the senior managers believed that Region I did not identify a situation where the plant was unsafe or a safety system was inoperable; however, they acknowledged that IP2 continued to exhibit performance weaknesses, and they noted that a definitive improvement trend was not apparent.In July 1998, the Region I Administrator again presented IP2 at the SMM in the belief it should be designated as a Watch List Plant. He asserted that the performance at IP2 was largely unchanged during the preceding 6 months with respect to human performance and the control of plant activities. Additionally, the 1998 Independent Safety Assessment (ISA) conducted by ConEd identified some important deficiencies and weaknesses that existed at IP2 particularly in the areas of management and operations. Despite the Region I Administrator's presentation, the SMM again declined to designate IP2 a Watch List plant. This time, the SMM decided to maintain, rather than increase, the level of attention to allow the licensee a period of time to execute its performance improvement initiatives. The senior managers recognized that tP2 continued to have performance weaknesses, but again they believed that Region I did not identify a situation where the plant was unsafe or a safety system inoperable. IP2 was not discussed during the April 1999 SMM. The Region I Administrator told OIG that he did not recommend that IP2 be presented for discussion because it had experienced no significant events since the last time he presented the plant for SMM discussion. He felt that in 1999, performance weaknesses still existed but that IP2 was no worse than in preceding years and was, in fact, slowly improving. He said he still would have preferred SMM action; however, he felt he lacked a basis for presenting the plant at the SMM.SMM Designates 1P2 as Agency Focus Plant in May 2000 In May 2000, the Region I Administrator presented IP2 at the SMM after the occurrence of two significant events at the plant, the August 1999 reactor trip and the February 2000 steam generator tube rupture. OIG learned that overall, the events and related findings during this assessment period represented issues that were of substantial significance; therefore, the senior managers categorized 1P2 as an Agency Focus Plant under the revised SMM process." 5 1 5 1n April 1999, the Commission approved SECY 99-086, "Recommendations Regarding the Senior Management Meeting Process and Ongoing Improvements to Existing Licensee Performance Assessment Processes.' SECY 99-086 eliminated the "Watch List" and proposed that during SMM meetings, participants would 23 According to the SMM minutes, the senior managers concluded that the broad performance issues that had existed at IP2 for the past several years revealed a number of deficiencies in the plant's CAP and that IP2 improvement initiatives yielded some progress but, overall, were limited in remedying the underlying problems.According to the Region I Administrator, the August 1999 and February 2000 events revealed the depth of IP2's performance problems and were evidence of the significant issues discussed at previous SMMs. Region I staff echoed this sentiment to the OIG, questioning why -given the inspection history, the identified problems, the NRC man-hours at the plant, and the history of civil penalties -IP2 was not put on the Watch List sooner.Current Status of IP2 Region I staff has informed OIG that since March 2001, NRC has provided a significant amount of oversight and inspection effort at IP2. The Region I staff performed 12,950 hours of inspection activity at IP2 between March 1, 2001, and March 1, 2003, compared to an average of 8,297 hours at other single unit sites in Region I. (See Appendix B for a chronology of NRC inspection activity at IP2 during this time period.) Of the 12,950 hours of inspection performed at IP2 during this 2-year period, 2,216 hours were focused on engineering and PI&R compared to an average of 1,077 hours devoted to these areas at other single-unit Region I sites. The staff informed OIG that these figures indicate that during this period, IP2 has received about 1.5 times as much inspection as the average for other single-unit sites and about 2 times as much inspection pertaining to engineering and PI&R.Annual assessments of plant performance 1 6 performed since the plant was categorized as an Agency Focus Plant in May 2000 indicate that IP2 performance has been improving, albeit slowly, since that time. NRC's annual assessment of plant performance for April 2, 2000, to March 31, 2001, found that while IP2 met all cornerstone objectives, it remained in the Multiple/Repetitive Degraded Cornerstone column of the NRC's ROP Action Matrix. According to the Region I staff, that assessment noted a number of issues in design control, equipment reliability, PI&R, and human performance. While some performance improvements were noted, progress was considered slow and limited in some areas. Region I staff noted that as of December 31, 2001, IP2 remained in the Multiple/Repetitive Degraded Cornerstone column of the Action Matrix.determine whether a plant warranted Agency Focus (characterized by NRC Executive Director for Operations and Commission involvement, e.g., issuance of an order), Regional Focus (managed by the regional administrator, e.g., issuance of a confirmatory action letter), or routine oversight. 16Under the ROP, NRC assesses licensee performance in various ways, including quarterly plant performance assessments based on inspection findings and performance indicator data. Regional offices conduct a more comprehensive review after the second quarter of the year (mid-cycle) to assist in planning inspections forthe next 6 to 12 months. The regions also conduct an annual (end-of-cycle) review after the fourth quarter of the year to develop an annual performance summary for each plant and to plan inspections for the next 12 months. NRC uses an Action Matrix to assist staff in reaching objective conclusions regarding licensees' safety performance. The matrix allows for plants to be categorized into five possible results categories, or matrix columns, which indicate the plant's level of performance and the agency's required response. Categories (from lowest to highest performance) are (1) Unacceptable Performance, (2) Multiple/Repetitive Degraded Cornerstone, (3) Degraded Cornerstone, (4)Regulatory Response, and (5) Licensee Response.24 Significant inspection activity continued during 2002, including an augmented PI&R inspection and supplemental team inspection in June and July 2002. dIG was told that in August 2002, IP2 had made sufficient progress to justify removal of the plant from the Multiple/Repetitive Degraded cornerstone into the Degraded Cornerstone column of the Action Matrix. dIG was told by the Region I Administrator that on February 7, 2003, NRC completed its end-of-cycle plant performance assessment of IP2 covering performance from January 1, 2002, through December 28, 2002. NRC concluded that during that time period, IP2 continued to operate in a manner that preserved public health and safety.The Region I Administrator and staff told OIG that Region I fully utilized the regulatory tools it had available to deal with IP2. The Region I Administrator said that although the plant was never unsafe, improvement in IP2's performance might have been swifter had the plant been designated a "Watch List" plant by the SMM earlier. This designation would have sent a powerful message to the licensee concerning the need for improved performance. -The Region I Administrator commented that while the agency's senior managers designated the plant as an "Agency Focus Plant" in May 2000, this occurred after the plant had reversed its downward trend and, in fact, the designation had a relatively small impact on recent plant operations because the plant's declining performance had already been arrested as a result of earlier actions taken by the NRC. The Region I Administrator also noted that SMM deliberations were always thorough but that decisions were inherently difficult given the complexity of issues involved.Additionally, the Region I Administrator commented to dIG that Entergy's purchase of IP2 in September 2001, had a considerable impact on plant performance. According to the Region I Administrator, Entergy conducted its own self-assessment of IP2 and subsequently committed significant resources to the plant. Furthermore, Entergy had experience operating other nuclear power plants, was aware of the need to inject resources to improve plant performance, and had those resources available. Entergy also understood the need to bring top management talent to operate the plant, which it did. According to the Region I Administrator, this shift in ownership facilitated the IP2 improved performance trend.The Region I Administrator considered IP2's improvement as an NRC "regulatory success story." He stated that NRC's aggressive oversight and intervention arrested the decline in early 1996 and prevented IP2 from ever getting to the point where it was unsafe to operate. He acknowledged that IP2's improvement has been slow at times and often uneven, but that, overall, plant performance has steadily improved. In his view, the conditions that led to 1P2's poor performance in the mid-1990s developed over a number of years and, therefore, required time to resolve. He credited NRC oversight efforts performed at IP2 since 1996 with having caused the plant to reverse its downward performance trend and begin its slow progress toward the performance improvement reflected in the NRC's recent assessment letters.OIG FINDING On four occasions between 1997 and 2000, the Regiofi I Administrator sought additional NRC oversight for IP2 by seeking to have NRC's senior managers place IP2 on NRC's Watch List via the agency's Senior Management Meeting process. However, it was not until May 2000, after the August 1999 reactor trip and the February 2000 steam 25 generator tube rupture, that NRC senior managers agreed that this form of heightened attention was appropriate. In May 2000, IP2 was classified as an Agency Focus Plant.Subsequent to being so designated, NRC annual assessments of plant performance indicated that IP2 had improved. OIG concurs with the Region I Administrator and his staff that placing IP2 on the Watch List sooner might have sufficiently motivated the licensee to cause earlier improved performance. 26 APPENDIX A Summary of IP2 RPS Condition Reports CR 199803574 identified a discrepancy between the RPS wiring configuration and a description in section 7.2.2.9 of the UFSAR of isolation between safety signals and annunciator and/or computer signals. Contrary to the UFSAR statement that "The center and front decks of RPS logic relays are used for annunciator and computer signals respectively," 22 RPS logic relays were found to violate this criterion. CR 199900478 identified discrepancies between design drawings and the as-built configuration with respect to contact state associated with interposing relays for the low autostop oil pressure protection scheme. The corrective action for this condition involved revision of four drawings to-reflect the field condition. ... .CR 199902274 identified "minor" inconsistencies affecting 14 RPS and ESF drawings.Corrective action involved revising the affected drawing based on comments received from an outside contractor who was tasked with the drawing review.CR 199902835 identified three distinct discrepancies between plant drawings and the as-built condition. These discrepancies involved: RPS logic relays used to block the "Source Range High Influx at Shutdown" annunciator, drawings showing RPS relay contact configuration different from the as-built condition, and incorrect RPS relay nomenclature on plant drawings.The corrective action for this CR was limited to revising the affected drawings to agree with the as-found condition. CR 199903445 was initiated because the drawing revisions prepared in response to CR 199902835 were in error. This CR also identified an additional drawing error in which the drawing showed the incorrect RPS relay contacts used for the Source Range High Flux at Shutdown annunciator block.CR 199904968 identified another discrepancy between the design drawings and the as-found configuration of the RPS. This discrepancy involved contacts from RPS relay P10-2 that are used to defeat the Source Range Loss of Detector Voltage annunciator above 10% reactor power which are not shown on plant drawings. The corrective action for this CR involved a field verification of the configuration and revision of the affected drawing to reflect the as-found condition. CR 200007597 identified a number of potential internal wiring related discrepant conditions in the reactor protection racks. Isolated cases of wire routing and/or terminations were observed to be inconsistent with routing/separation requirements stated 4n the UFSAR. In response to this CR an Operability Determination (OD) 00-018 was issued to address the wiring routing/separation issues. The OD determined that the RPS was operable.CR 200008415 identified drawing discrepancies between Westinghouse RPS wire lists and field conditions, however, an operability determination concluded that this did not constitute an operability concern.27 372-CR 200008818 identified a broken contact in a reactor trip relay, unidentified, unterminated switchboard wire with exposed lugs in RPS cabinets, and a mixing of wiring associated with computer/logic/annunciator functions. The broken contact has been repaired. A 200-degree hold was placed on this CR. The "Operability Review Note" by the Watch Engineer stated "200 degree hold for loose wires, etc." The response to the unterminated (loose) wire issue was not addressed. The engineer who responded to the 200H action stated that he considered the unterminated wire a housekeeping issue and therefore, did not address it as part of the 200H response.CR 200009499 identified additional conditions in which the wiring in the RPS racks violated statements in the UFSAR. The CR stated that "Wires (in RPS Racks 4 and 5) were carelessly strewn through multiple wire ways," and "Had the original design been followed, there would have been no mixing (of circuit functions) and there would have also been half as many new wires to mix." These issues were addressed in Operability Determination 00-018 which was conducted on CR 200007597 which found that the RPS was operable.CR 200009641 identified six issues related to RPS wiring deficiencies or discrepancies, three of which were similar to or a repeat of issues identified in previous CRs. The new issues included a wire associated with an NIS power range logic relay with a splice that is not represented on plant drawings and single cable containing both 125 VDC logic protection power and 118 VAC instrument bus power. Both of these issues were addressed in Operability Determination 00-018.CR 200010125 identified discrepancies between design drawings and the as-built configuration of the RPS. This CR also identified other CRs that described similar inconsistencies between design drawings and RPS wiring. A review of the corrective action associated with these CRs revealed that the CR actions were typically closed by revising the plant drawings to reflect the as-found configuration without performing a safety evaluation to determine the impact of the change on the design and licensing basis. In some cases the as-found condition affected the system design as depicted in the UFSAR text and/or figures. This CR also identified errors made in drawings as part of the corrective action for CR 199904968. Furthermore, this CR identified discrepancies between drawings and the as-found RPS wiring that had not been previously identified. CR 200100327 summarized numerous issues identified in eight previously submitted CRs that documented a lack of configuration control and quality control of changes to the RPS wiring since 1998. The concerns raised in CR 200100327 were categorized as quality assurance requirements for design verifications, wiring changes resulting from modifications that could not be located and wiring separation not in accordance with the UFSAR. The eight CRs summarized in CR 200100327 are CR 200010125, CR 199803574, CR 199904968, CR 199902835, CR 199903445, CR 200007597, CR 200009499 and CR 200009641. 28 APPENDIX B Chronology of Significant Inspections and Oversight at IP2, 1995 -20031 March 14, 1995 April 12, 1995 August 28, 1995 October 26, 1995-January-28, 1997 January 31, 1997 February 21, 1997 March 31, 1997 May 1, 1997 May 9, 1997 June 19, 1997 June 1997 June 1997 July 8, 1997 July 26, 1997 July 28, 1997 August 6, 1997 August 8, 1997 August 23, 1997 August 25, 1997 September 29, 1997 Inspection Report (IR) 1995-01, special safety inspection of AFW digital controller failure.IR 1994-017 service water self-assessment inspection. IR 1995-080, Operational Safety Team Inspection. SALP report issued.IR 1996-080, Integrated Performance Assessment Process (IPAP).Confirmatory Action Letter (CAL) issued.CAL closed.Final SALP report issued.Plant shutdown for refueling outage..IR 1997-003 integrated inspection. IR 1997-005, special inspection conducted for stuck open MSSV.1P2 discussed at Senior Management Meeting (SMM).Regional'Administrator meets with ConEd Chief Executive Officer.Plant startup from refuel outage.Generator load rejection and reactor trip.Reactor trip.Shutdown.IR 1997-008, special inspection of outage issues.Reactor trip due to reactor coolant pump breaker testing logic error.Plant startup.I R 1997-010, special inspection of load reject and reactor trip.1Information in this chronology was provided to OIG by Region 1.29 October 14, 1997 December 12, 1997 January 1998 January 1998 February 13, 1998 March 26, 1998 March 26, 1998 April 27, 1998 May 1998 June 3, 1998 June 26, 1998 June 1998 July 9, 1998 July 1998 September 16, 1998 September 21, 1998 October 16, 1998 October 23, 1998 November 3, 1998 January 29, 1999 April 1999 Plant shut down due to repetitive DB50 circuit breaker failures.IR 1997-012, integrated inspection report, resident inspection and specialist review of safety-related breaker problems.IP2 discussed at SMM.Performance letter issued to ConEd -decision made to perform Operational Safety Team Inspection/Independent Safety Assessment. IR 1997-013, special inspection of 480 Vac Breaker failures.CAL 1-98-005 due to issues discovered during shut down not related to circuit breakers.IR 1998-201, design inspection. NRC restart action plan for IP2 issued.Independent Safety Assessment performed by ConEd.IR 1998-005, NRC Evaluation Team (NET).IR 1998-006, special inspection focusing on corrective actions regarding plant restart issues.Emergency preparedness exercise.Revised NRC CAL 1-98-005 issued March 26, 1998.IP2 discussed at SMM.IR 1998-012, followup NRC NET evaluation team inspection. Reactor startup.IR 1998-008, special Inspection of corrective action associated with restart issue.IR 1998-014, NRC integrated inspection. IR 1998-016, NRC special inspection of high efficiency particulate air (HEPA) filter deterioration. IR 1998-018 NRC 40500 Corrective Action Program Inspection. Plant Performance Review.30 June 1999 August 19,1999 August 31, 1999 September 14, 1999 September 23, 1999 September 1999 October13, 1999 October 19, 1999 October 1999 October 1999 November 23, 1999 December 21, 1999 December 1999 January 5, 2000 January 7, 2000 February 1, 2002 February 15, 2000 March 1, 2000 March 14, 2000 March 2000 March 2000 April 28, 2000 ConEd external assessments of operations, work control, and maintenance departments. IR 1999-004 NRC team inspection report (Core Engineering Team).Reactor trip and loss of offsite power.Management meeting -Augmented Inspection Team (AIT) interim results.Public exit meeting -AIT exit meeting.Emergency preparedness exercise.Reactor startup.IR 1999-008, AIT.IR 1999-013, AIT follow up team inspection commenced. Mid-cycle plant performance review letter issued.Public Meeting -IP2 performance assessment results from September 1999 plant performance review.Results of the follow-up inspection to the AIT (1999-013). IP2 Recovery Plan actions transferred to Business Plan.IR 1999-014. Results of enforcement follow up of AIT for August 31, 1999 trip.Drafted charter for the formation of the Indian Point Unit 2 oversight panel (IPOP).Drafted IP2 oversight strategy.Reactor trip -steam generator tube failure (SGTF).SGTF meeting.SGTF public meeting.Formation of IP2 communications team.Plant performance review letter.NRC AIT SGTF IR 2000-002 issued.31 3 CP May 23, 2000 June 25, 2000 July 10, 2000 July 27, 2000 August 3-4, 2000 August 31, 2000 September 11, 2000 September 26, 2000 September 2000 October 2, 16, 2000 October 5, 2000 October 10, 2000 October 11, 2000 October 16, 2000 October 25, 2000 October 31, 2000 November 1, 2000 November 6, 2000 November 8, 2000 November 14, 2000 November 16, 2000 November 16, 2000 IP2 discussed at SMM; letter issued characterizing IP2 as an "Agency Focus" plant.Public meeting.IR 2000-007, AIT SGTF follow-up. IR 2000-010, NRC SGTF special inspection. Regional Administrator site visit.IR 20.00-010, SGTF special inspection. NRC Agency Focus Meeting. (Regional Administrator and NRR Deputy Director Site Visit)Regulatory conference on SGTF "red" finding.Ongoing regional management briefings on cornerstone deficiencies, and plant performance issues throughout restart.Problem Identification and Resolution (PI&R) inspection. EDO brief to discuss content of "Agency Focus" letter.Assessment follow up (Agency Focus Update) letter.ROP meeting held in Cortland Town Hall.Operator requalification Inspection. NRC -ConEd management meeting.Significant Determination Process repanel (final determination of "red or yellow" finding for SGTF issues).IP2 SGTF Lessons Learned Task Force (LLTF) report issued.NRC on-site restart readiness reviews.Mid Cycle review meeting conducted. RI review of four system readiness reviews.Public meeting.NRC noted that the independent 125 VDC SSFA team performed a high quality review.32-3-7 November 20, 2000 November 27, 2000 November 29, 2000 December 1, 2000 December 4, 2000 December 6, 2000 December 11, 2000 December 18, 2000 December 20, 2000 December 22, 2000 December 30, 2000 January 2, 2001 January 5, 2001 February 9, 2001 February 26 -May 4, 2001 February 27, 2001 March 1-2, 2001 March 9, 2001 April 3, 2001 April 10, 2001 Issued red finding and Notice of Violation (NOV) for the poor SG inspection program that led to the SGTF.NRC safety system readiness review inspection on the Safety Inspection system.Mid cycle performance review and inspection plan letter issued.Region I senior management site visit to IP2.PI&R inspection report.EDO briefing.Plant heat up above 200 degrees -restart inspection begun.IR 2000-014 design issues inspection. NRC replied to ConEd's request for extension to respond to the red finding and NOV.NRC Region I issues NRC review efforts/status letter.Plant restarted. Turbine trip due to low SG level.Regional Administrator visits Congresswoman Kelly.95003 multiple degraded cornerstone supplemental inspection. IR 2001-005, review reactor protection system (RPS) design issues.Chilling effect letter issues.Regional Administrator site visit and public exit meeting for 95003 inspection. Chairman site visit with Regional Administrator and Executive Director for Operations. Division of Reactor Safety (DRS) branch chief visit to IP2 -UFSAR verification project status.IR 2001-002, (95003 Inspection) supplemental inspection report issued.33 June 18, 2001 July 23, 2001 July 23, 2001 October 22, 2001 November 5, 2001 November 27, 2001 December 7, 2001 December 16, 2001 January 28, 2002 February 7, 2002 March 21, 2002 March 21, 2002 June 24, 2002 November 4, 2002 December 9, 2002 December 2002 -February 2003 IR 2001-007, emergency preparedness (EP) exercise review and supplemental inspection of licensee actions to address three findings in the EP cornerstone area.IR 2001-007, review of 2001 design engineering business plan and scope and 50.54 (f) commitment status.IR 2001008, review of 2001 Design Engineering Business Plan Scope and 50.54(f) commitment status.IR 2002013, NRC on-site to do initial inspection of the failure of three of six crews on licensed operator (LOR) examinations and to observe facility evaluate seventh crew; crew fails: four of seven = yellow finding.IR 2001 -010, review of licensee's safety injection (SI) safety system functional assessment (SSFA) and PI&R inspection. IR 2001-011, NRC observes facility-led evaluation of an operating crew;while onsite, conducts regular-hours control room (CR) observations. IR 2001-011, NRC- led evaluation of another operating crew; while onsite, conducts regular-hours CR observations. IR 2001-011, NRC- led evaluation of 4 staff RO licenses.IR 2001-014, review of licensee's self assessment and Fundamentals Improvement Plan (FIP), including the Design Basis Initiative (DBI).IR 2002-007, NRC observes facility-administered evaluations (High Intensity Training (HIT).IR 2002-007, NRC observes facility-administered evaluations (HIT)..IR 2002-009, supplemental inspection to review causes and corrective actions for yellow finding related to operator requalification. IR 2002-010, augmented PI&R inspection, reviewed performance issues related to the multiple degraded cornerstone designation, progress implementing the FIP, and review of the degraded control room west wall fire barrier.IR 2002-007, review of reactor protection system (RPS) wiring verification. IR 2003-002, PI&R team inspection. IR 2003-003 and IR 2003-005 (both draft), team inspections to review TI 2515/148 and various other security issues.34 3 ci January 27, 2003 IR 2003-004 (draft), engineering team inspection reviewed design and performance capability of component cooling water and offsite power supplies.35 APPENDIX C Summary of Escalated Enforcement Action from 1995-2000 1996-01, Enforcement Action 96-089, Significance Level JSL) III 10 CFR 50.59 (SL III) and 50.72 (SL IV)Repair activities on central control room roof left ventilation system in unanalyzed condition for 2 months. Inadequate corrective actions.1996-04, Enforcement Action 96-272, SL IV Criterion XVI (SL IV) and Technical Specification (TS) 6.8.1. (SL IV)1) Failure to maintain proper configuration control over containment isolation valve, contrary to procedure requirements.

2) Failure to preform required safety evaluation on procedure change.1996-07, Enforcement Action 97-031, SL IlI ($50,000 civil penalty)Criterion XVI (SL Ill)Inadequate measures were taken to assure that the cause of each condition was determined and corrective action taken to preclude repetition.

1) Repeated surveillance test failures associated with the TDAFW pump's steam admission valve and discharge flow control valves. Valve damage subsequently identified.

2) Preconditioning of TDAFW pump by blowing down steam traps prior to testing.Adequate engineering review was not performed to support pump operability.

3) Multiple surveillance test failures associated with alternate safe shutdown system power transfer switches for the 23 and 24 service water pumps.4) Untimely identification of degradation of PAB filter/fire deluge system control panel and associated circuits.

System was incapable of performing design function. Poor implementation of an alarm response procedure's required actions.1996-08, Enforcement Action 97-113, SL III ($50,000 civil penalty)Criterion XVI (SL Ill), TS 6.8.1(SL IV), TS 6.5.1.6.a. (SL IV)1) Failure to take adequate corrective actions following grit intrusion during the 1995 refueling outage. Resulted in inoperability of three of the four safety-related MFRV's and one low-flow bypass MFRV in January 1997.2) Control of SG levels not in accordance with procedure and the failure to make temporary procedure changes to invoke administrative allowances for situation where deviation is necessary.

3) Failure to perform a required review of a vendor report that was used as the basis to support DG operability following the 1995 grit intrusion.

36 1996-80, Enforcement Action 96-509, SL III ($50,000 civil penalty)Appendix R (SL Ill)Fire protection features not provided to protect one train of systems -two instances.

1) Certain normal safe shut down instrumentation and the corresponding alternate safe shutdown instrumentation would be subject to fire damage.2) Potential for hot shorts exists as a result of fire damage tocables associated with both the pressurizer PORV and block valves (a high/low pressure interface).

1997-03, Enforcement Action 97-191, SL Ill ($55,000 civil penalty)Criterion XVI (SL Ill)Failure to promptly identify and take corrective actions. Maintenance worker drilled into an electrical junction box, causing fire dampers in two safety-related electrical distribution rooms to actuate. Some dampers did not drop and other became physically restrained and only partially dropped. Condition went unaddressed by plant personnel for two days until questioned by NRC.1997-08, Enforcement Action 97-367, SL Ill ($110,000 civil penalty)TS 6.8.1 (SL Ill), Criterion XVI (SL Ill), TS 3.1.A.4.a (SL Ill), TS 4.18.c (SL Ill), TS 4.2.1 .(SL IV) -5 violations

1) operation of the plant for 2.5 days outside technical specifications pressure and temperature curves with the OPS inoperable'.

Violation of TS 6.8.1.2) Failed to consider ambient temperature condition on the pressurizer code safety valve set point. Violation of TS 4.2.1 Untimely and ineffective corrective actions. Inadequate 50.59 safety evaluation for a plant mod to remove the 'Pressurizer block house roof.Inoperability of the code safety valves as prescribed by the technical specifications. Numerous opportunities existed for the staff to identify this issue.3) Ingestion of hose in 21 recirculation pump. Poor engineering resolution to degraded pump performance that preceded the identification of the hose in the 1997 refueling outage. Indications are 21 recirculation pump inoperable since 1995. Inadequate corrective actions.1997-13, Enforcement Action 97-576, SL III ($55,000 civil penalty)Criterion XVI (SL Ill)Failure to take prompt and appropriate corrective actions prior to voluntary shutdown in October 1997 to address the recurring DB-50 breaker failures to close on demand.1997-15, Enforcement Action 98-028, SL IV Criterion XVI (SL IV), TS 6.8.1 (SL IV) -2 violations

1) ConEd's failure to address degraded conditions in a timely manner on the post accident containment venting system (PACVS) and the hydrogen recombiner system.2) An inadequate procedure for operation of the PACVS.37 Lf~-2 Office of Investigations-January 22, 1998, Enforcement Action 98-056, SL III 50.9 (SL Il1) -2 Violations

1) On August 8, 1997, the emergency battery lights in the PAB were not tested per procedure.

However, records were created that indicated the lights were tested.Technicians were not in room for long enough period to adequately test lights.2) On August 8, 1997, surveillance test of EDG auxiliaries require double verification. Double verification of compressor was not performed. Records were created that indicate second verification was performed. Technician was not in the EDG building to be able to perform verification. 1998-02, Enforcement Action 98-192, SL Ill ($55,000 civil penalty)Criterion Xl (SL Ill)A significant number of technical surveillance testing discrepancies were identified through ConEd and NRC reviews. Failed to assure that all testing required to demonstrate that systems and components will perform satisfactorily in service, as specified in technical specifications, was incorporated into surveillance test procedures. 1999-014, Enforcement Action 99-319, SL 11 ($88,000 civil penalty)Criterion III (2 violations), Criterion V, Criterion XVI (SL I)1) a. Design basis not correctly translated into specifications and procedures for mod to the 480 vital bus degraded voltage relays. Therefore, relays could not perform design basis function and correctly reset. Contributing to August 31, 1999 transfer of 480V bus from offsite power supply to the RDGs.b. Requirement for auto operation of the Station Aux Transformer Load Tap Changer were not translated into procedures. As a result form September 9, 1998 to August 31, 1999, the 138kV offsite power system was unable to perform its function. Violated Technical specification 3.7. B.3.2) Procedure did not adequately ensure proper calibration of DB-75 breaker trip units for the EDGs. Result EDG was inoperable from May 27, 1999 through August 31, 1999.3) Condition adverse to quality with channel 4 of the reactor protection system (RPS)OTDT circuitry between January 1999 and August 31, 1999, resulting in a plant trip during maintenance on channel 3.2001 -010, Enforcement Action 00-179, Red Finding Criterion XVI (Red)A PWSCC defect was identified, signifying the potential for other similar cracks in low-row tubes. ConEd did not adequately evaluate the susceptibility for low-row tubes to PWSCC and the extent of degradation. ConEd did not adequately evaluate the potential for hour-glassing based on the indications of the low-row tube denting. The increased stresses caused by the hour-glassing are a prime precursor for PWSCC.1997 Steam generator inspection program was not adjusted to compensate for the 38 adverse effects of increased noise in detecting flaws, particularly when condition that increased the susceptibility to PWSCC existed.These problems contributed to at least four tubes with PWSCC flaws in their small radius U-bends, being left in service following the 1997 inspection, until one tube failed on February 15, 2000.39 Lf+LF +s-s 09/25/2007 16:07 8453713721 MILTON B SHAPIRO PAGE 02 Ertergy Nuckst NWrtwst DmW NudM W"4v-"o HI 44. Awm Ln VWhite Pls N 10601-1813 Tid 0142723=60 March 28,2005 BVY-054O NL-05-039-JPN,05-005 ENO Ltr, 2.05.023 U. S. Nuclear Regulatory Comrnislon ATTN: Document Control Desk Washington, DC 20555

SUBJECT:

Entergy Nuclear Operations, Inc.Indian Point Nuclear Generating Stations 1,2 and 8 Docket Nos. 50-S. 80-247 and 50-286 Vermont Yankee Nuclear Power Station Docket No. 50-271 Pilgrim Nuclear PoweamStation Docket No. 50-293 James A. FltzPatick Nuclear Power Plant Docket No. 50-33 Status of Decomnmissioning Funding for Plants Operated by Entergy Nuclear Operations, Inc.For Year Ending December 31, 2004_- 10 CFR 50..75=1M1)

References:

1. NUREG-1 307, *Report on Waste Burial Charges,'.

Revision 10, dated October 202.2. NRC Regulatory Issue Surmary 2001-07, '10 CFR 50.75(f)(1) Reports on the Status of Decommissioning Funds (Due March 31.2001).'Dear Sir.10 CFR 50.75(0(1) requires each power reactor rliensee to report to the NRC by March 31, 1999, and every two years thereafter, on the status of its decommissioning funding for each reactor, or share of a reactor, that It owns. On behalf of Entergy Nuclear Indian Point 2 LLC, Entergy Nuclear Indian Point 3 LLC, Entergy Nuclear Vermont Yankee LLC, Entergy Nuclear Generation Company (Pilgrim Station), and Entergy Nuclear FitzPatrick LLC, Entergy Nuclear Operations, Inc. hereby submits the Information requested for power reactors operated by Entergy Nuclear Operations, Inc. 09/25/2807 16:87 8453713721 MILTON B SHAPIRO PAGE 83 The estimated minimum decommissioning fund values were determined using the NRC's methodology In NUREG-1 307 (Relerenoe

1) and does not incWude aotivites outside of the scope of decommissioning as defined by 10 CFR 502.Entergy will continue to monitor the status of the funds and will assure that we meet all NRC regulations and Implement NRC guidance, as appropriate, to assure adequate funding for the dcoommissioning when required.The information provided in Attachment 1 Is based on NRC Regulatory issue Summary 2001-07 (Reference 2).There are no new commitments made in this letter. If you have any questions, please contact Ms. Chadene Faison at 914-272-3378.

<truly yours, Fred t. Dacimo Acting Senior Vice President and Chief Operating Officer Attachment

1. Status of Decommissioning Funding for Plants Operated by Entergy Nuclear Operations, Inc. (Indian Point 1. Indian Point 2, Indian Point 3. Vermont Yankee, Pilgrim, and FitzPatrick)

For Year Ending December 31, 2004-10 CFR 50.75(f)(1) .(7 sheets)2. NRC Minimum Funding Calculation (10 CFR 50.75(c)) for Indian Point 1, Indian Point 2, Indian Point 3, Vermont Yankee, Pilgrim, and FitzPatrick -(6 sheets)cc: Next page.2 Lý-7 09/25/2007 16:07 8453713721 MILTON B SHAPIRO PAGE 84 U=c all wtattachmerits Regional Administrator, Region I U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406 Mr. P. Milano, Senior Project Manager Project Directorate I Dision of Ucensing Project Management Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop: 0-8-C2 Washington, DC 20555-0001 Resident Inspectoes Office Indian Point 3 Nuclear Power Plant U. S. Nuclear Regulatory Commission P. O. Box337 Buchanan, NY 10511I Mr. Michael K. Webb, Project Manager Uicense Project Directorate IV Division of Licensing Project Management U. S. Nuclear Regulatory Commission Manl Stop: 7-fl-1 Washington, DC 2055500 1 Senior Resident Inspector Indian Point 2 Nuclear Power Plant U. S. Nuclear Regulatory Commission P.O. Boxas Buchanan, NY 10511 Resident Inspectors Ofce James A. FtdzPatrck Nuclear Power Plant U. S. Nuclear Regulatory Commission P.O. Box 136 Lyooming, NY 13093 Mr. John Boska, Project Manager Project Directorate I Divsion of Licensing Project Management Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mall stop 0-86-1 Washington, DC 20555-0001 Senior Resident InspectW U. S. Nuclear Regulatory Commission Pfgrtm Nuclear Power Station 600 Rocky Hill Road Mail Stop 66 PlymouthfMA 02360 Mr. Richard 8. Ennis, Projec Manager Project Directorate I Division of Lcnsing Project Management Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Ma! Stop 0-68-1 Washington, DO 20555-0001 USNRC Resident Inspector Vermont Yankee Nuclear Power Station 320 Governor Hunt Road P. 0. Box 157 Vernon, VT 05354 Mr. David O'Brien, Commissioner Department of Public Service 120 State Street -Drawer 20 Montpelier, VT 05602 Mr. Paul Eddy NYS Department of Public Service a Empire State Plaza Afbany, NY 122R3 e 3 4-& 09/25/2887 16:87 ' 8453713721 .MILTON B SWI-R0 PAGE 05 Attachment 1 to BVY-05-033, NL-05-039, JPN-05-005, ENO Ur. 2.05.023 Entergy Nuclear Operations, Inc.Status of Decommlsslonlng Funding For Year Eading- Dcember 31.,2004 -1D CFR 50.75(f)LI1 Plant Name: Indian Point Nuclear Generating Unit No. I I. Amount of decommissioning funds estimated to be required pursuant to 10 CFR 50.75 (b)and (c).Decommissioning cost estimate escalated at 3.0% per year to the midpoint of decommissioning (December 2016).2. Amount accumulated to the end of the calendar year preceding the date of the report (December 31, 2004).Fund balance with 5.0% annual growth to the midpoint of decommissioning (December 2016).3. A schedule of the annual amounts remaining to be collected.

4. Assumptions used In determining rates of escalation In decommissioning costs, rates of earnings on decommissioning funds, and rates of other factors used In funding projections.

5. Any contracts upon which the licensee Is relying pursuant to 10 CFR 50.75(e)(1)Xv).

6. Modifications occurring to a licensee's current method of providing financial assurance since the last submitted report.7. Any material changes to trust agreements.

$ 309.59 million (iP$ 441.40 million$ 227.43 million ¢$ 408,43 million None.Escalation rate: 3.0%Rate of earnings: 5.0%None.None.None.I 89/25/2887 16:87 8453713721 MILT-ON B SHAPIRO PAGE 06 Attachment 1 to BVY.05-033, NL-05-039, JPN-05-005, ENO Ltr. 2.05.023 Entergy Nuclear Operations, Inc.Status of Decommissioning Funding For Year Dacember S1. 2004 -10 CFR 50.75(N1)Plant Name: Indian Point Nuclear Generating Unit No. 2 1. Amount of decommissioning funds estimated to be required pursuant to 10 CFR 50.75 (b)and (c).Decommissloning cost estimate escalated at 3.0% per year to the midpoint of decommissioning (December 2016).2. Amount accumulated to the end of the-- calendar year preceding the date of the report (December 31, 2004).Fund balance with 5.0% annual growth to the midpoint of decommissioning (December 2016).8. A schedule of the annual amounts remaining to be colleoted.

4. Assumptions used In determining rates of escalation in decommissioning costs, rates of earnings on decommissioning funds, and rats of other factors used In funding projections.

5. Any contracts upon which the licensee Is relying pursuant to 10 CFR 50.75(eXIXv).

6. Modiictions occurring to a licensee's current method of providing finarnMd assuramne sinoe the last submitted report 7. Any material changes to trust agreements.

$ $73.79 million t 1$ 532.94 millon$ 272.04 million m$ 488.54 million None.Escalation rate: 3.0%Rate of earnings: 5.0%None.None.None.2 89/25/2887 16:087'8453713721 MILTON B SHAPIRO PAGE 87 Attachment I to BVY-05-033, NL-05-039. JPN05-005, ENO LUr. 2.05.023 Entergy Nuclear Operations, Inc.Status of Decommissioning Funding For Year Endiag December 31.20-0 -!0 CFOR 50.7,5(M Plant Name: Indian Point Nuclear Generating Unit No. $1. Amount of decommissioning funds estiarnted to be required pursuant to 10 CFR 50.75 (b)and(c).Decommissioning cost estimate escalated at 3.0% per year to the midpoint of decommissioning (December 2018).2.. Amount accumulated to the end of the calendar year preceding the date of the report (December 31, 2004).Fund balance with 5.0% annual growth to the midpoint of decommissioning (December 2018).S. A schedule of the annual amounts remaining to be collected.

4. Assumptions used in determining rates of escalation In decommissioning costs, rates of earnings on decommrissioning funds, and rates of other factors used in funding projections.

S. Any contracts upon which the licensee Is relying pumuant to 10 CFR 50.75(eX1)(v).

6. Modifications occurring to a licensee's current method of providing financial assurance since the last submitted report.7. Any material changes to trust agreements.

$ 369.06 mllion P)$ 558.24 million$ 393.00 million$ 778.11 million None.Escalation rate: 3,0%Rate of earnings: 560%**1 I.None.None.None.3 09/25/2007 1,6:07/8453713721 MILTON B SHAPIRO PAGE B8* ql Attachment 1 to BVY-05-033, NL05-039, JPN-05-005, ENO Ltr. 2.05.023 Entergy Nuclear Operations, Inc.Status of Decommisslining Funding For Year Ending December 31, 2004 -10 CFR 50.70 f)11 Plant Name: Vermont Yankee Nuclear Power Station 1. Amount of decommissioning funds estimated to be required pursuant to 10 CFR 50.75 (b)and (c).Decommissioning cost estimate escalated at 3,0% per year to the midpoint of decommissioning (December 2015).2. Amount accumulated to the end ot the-calendar year preceding the date of the report (December 31, 2004).Fund balance with 5.0% annual growth to the midpoint ol decommissioning (December 2015).3. A schedule of the annual amounts remaining to be collected.

4. Assumptions used In determining rates of escalation in decommissioning mates of earnings on decommissioning funds, and rates of other factors used in funding projections.

5. Any contracts upon which the licensee is relying pursuant to 10 CFR 50.75(e)(1)(v).

6. Modifications occurring to a Hioensee's current method of providing financial assurance since the last submitted report 7. Any material changes to trust agreements.

$ 412.60 million I$ 571.13 million$ 372.80 million$ 637.61milion None.Escalation rate: 3.0%Rate of earnings: 5.0%None.None.None.4 89/25/2807 16:0 B7 -8453713721 MILTON B SHAPIRO Attachment I to BVY-0$-033, NL-05-039, JPN-05-005, ENO Utr. 2.05.023 Entergy Nuclear Operations, Inc.Status of Decommissioning Funding For Year Endini December 31._2004 -10CFR 50.75Mf1 )PAGE 09 Plant Name: Pilgrim Nuclear Power Station 1. Amount of decommissioning funds estimated to be required pursuant to 10 CFR 50.75 (b)and (o).Decommissioning cost estimate escalated at 30% per year to the midpoint of decommissioning (December 2015).2. Amount aomumulated to the end of the o.-alendar year preceding the date-of -the report (December $1, 2004).Fund balance with 5.00%6 annual growth to the midpoint of decommissioning (December 2015).a. A schedule of the annual amounts remaining to be collected.

4. Assumptions used in determining rates of escalation In decommissioning costs, rates of earnings on decommissioning funds, and rates of other factors used in funding projections.

5. Any contracts upon which the licenmsee Is relying pursuant to 10 CFR 50.75(e)(1 Xv).S. Modifications occurring to a license's current method of providing financial assurance since the last submitted report.7. Any material changes to trust agreements.

$ 426.25 million l$ 590.0$ million$ 528.74 million$ 904.32 ffnlk None.Escalation rate: 3.0%Rate of earnings: 5.0%None.None. [see item 71 In March 2003, Mellon Bank, the trustee of the Pilgrim Provisional Decommissioning Trust was given direction to contribute all assets remaining In the Provisional Trust to the non-qualified fund of the Pilgrim Master Trust. Later that month, Mellon Bank transferred approximately $30 mnilon of assets as directed. The Pilgrim Provisional Trust was then terminated. 5 ilrf .. fIlla IranP 5-3 09/25/2-007 16:B7 ,8453713721 MILTON B SHAPIRO PAGE 10 Attachment I to BVY-05-033, NL-05-039, JPN-05-005, ENO Lr. 2.05.023 Entergy Nuclear Operations, Inc.Status of Decommissioning Funding For Year Endlng December 31, 2004 -10 CFR 50.75(fM1) Plant Name: James A. Fitzpatrick Nuclear Power Plant 1. Amount of decomrnissloning funds estimated to be required pursuant to 10 CFR 50.75 (b)and (c).Decomnmissioning cost esmrnate escalated at 3.0% per year to the midpoint of decommissioning (December 2017).2. Amount accumulated to the end of t-h calendar yor preceding the date -of thereport (December 31,2004).Fund balance with 5.0% annual growth to the midpoint of decommissioning (December 2017).8. A schedule of the annual amounts remaining to be collected.

4. Assumptions used In determining rates of escalation in decommissioning costs, rates of earnings on decommissioning funds, and rates of other factors used In funding projections.

S. Any contracts upon which the licensee Is relying pursuant to 10 CFR 50.75(e)(1)(v).

6. Modifications occurring to a ricensee's current method of providing financial assurance since the last submitted report.7. Any material changes to trust agreements.

$ 442,19 million P1$ 649.37 million$ 428.80 million$ 808.57 mlrion None.Escalation rate: 3.0%Rate of earnings: 5.0%None.None.None.6 09/25/2807 16:87 8453713721 MILTON B SHAPIRO PAGE 11 Attachment I to BVY-05-033, NL-05-039, JPN-05-005, ENO itM. 2.05.023 Entergy Nuclear Operations, Inc.Status of Decommissioning Funding For YefaEndlng! Dang ber 31, 2004- 10 CFR 50.75f(f1) [1] The calculation of the NRC minimum value Is provided In Attachment 2.[2] The current fund balances for Indian Point I and 2 do not Include an additional $25.91 million available In the provisional fund.[3] In accordance with 10 CFR 50.75(c)(i)(1) PWR reactors below 1200 MWI are to use this minimum value. Indian Point 1 had a thermal power level of 615 MWL (Refer to Attachment 3, pg. 15, of June 8, 2001 letter, M. R. Kansler to USNRC regarding*Response to June 5, 2001 Letter, Indian Point Nuclear Generating Unit Nos. I and 2.Transfer of Facility Operating License (TAC Nos. MB0743 and MB0744).1 7 09/25/2887 16:87 8453713721 MILTON B SHAPIRO PAGE 12 Attachment 2 to BVY-05-033, NL-05-039, JPN-05-005, ENO Utr. 2.05.023 Entergy Nuclear Operations, Inc.NRC Minimum Funding Calculation (10 CFR 50.76(c))For Year Ending December-t 2004 Plant Name: Indian Point Nuclear Generating Unit No. 1 Inputs: Plant Characteristics Plant Type (PWR or BWR) PWR Region NE (Norheast) Rated (in MWt) I 615 Year 2004 Waste Vendor Used (Yes/No) yes Burial Ste- Soh Caolina Atlantic Compact Member (Yes/No) No Producer Perie Index wpuO543 (Industrial electric power) 147.9 (December 2004)wpu0573 (light fuel ois) 133.4 Labor.Adlustment Factomr ecul31021 (Northeast) 174.2 (4th Quarter, 2004)Burial-Site Adjfstments ,South Carolina/non-Atlantlc Compnct Member)PWR- direct dlisposal 18.732 (NUREG-1307, Rev. 10)PWR -w/waste vendors 9.467 Adjustment Factom Energy (E) 1.434 Labor (L) 2.076 Burial (8) A.467 Minimum Amount (millions, $1986) $85.56 (size adjusted for megawatts) Escalation Factor (L, E, B) S.618 (65% L, 13% E, 22% B)NRC Minimum (millions, $2004) $309-59 w/waste vendor I1] In acO0rdance with 10 CFR 50.75(c)(1)(1) PWR maciorn below 1200 MWi are so ura Oda mlonbm vow. roman PM1rt 1 had a Iheanal power evel of 615 MWL (Refer to Afltamenf 3, pg. 15, olf uno 8, 2001 leaer, K. FL I(melar so USNRC NVOGadirg "esponae to June !, 2001 Lefr, indan Pown Nuclear Generaft Wil N9S. 1 aid 2, Trof of FScitMy Operaling I.oense (TAC No,. M00743 end I 89/25/2887 16:87 8453713721 MILTON B SHAPIRO Attachment 2 to BVY-05-043, NL-05-039, JPN-05-005, ENO Ltr. 2.05.023 Entergy Nuclear Operations, Inc.NRC Minimum Funding Calculation (10 CFR 50.75(c))For Year Endina December 31. 2004 Plant Name: Indian Point Nuclear Generating Unit No. 2 Inputs: Plant Charampteris"nc Plant Type (PWR or BWR) PWR Region NE (Northeast) Rated (in MWt) 3216 Year 2004 Waste Vendor Used (Yes/No) Yes Burial Site South Carolina Atlantic Compact Member (Yes/No) No Producer_Price Index wpU0543 (industril electric power) 147.9 (December 2004)wpuD5V3 (ight fuel oils) 133A Labor Adumtment Factors etu13102i (Northeast) 1742 (41h Quarter, 2004)Bu~ral Sit_ Adiustments (South Cerolinalno,_AtIantla Comract Memberl PWR .direct disposal 18.732 (NUREG-1307, Rev. 10)PWR -w/waste vendors 9A67 diustywent-Facm.s Energy (E) 1.434 Labor (L) 2.076 Burial (B) 9A57 Minimum Amount (millions, $1986) $103.30 (size adjusted for megawatts) Escalation Factor (, E, B) 3.618 (65% L, 13% E, 22% B)PAGE 13 NRC Minimum (millions, $2004)S$373.1 w/waste vendor 2 89/25/2887 16:07 8453713721 MILTON B SHAPIRO PAGE 14 Attachment 2 to BVY-05-033, NL-05-039. JPN-05-005, ENO Ltr. 2.05.023 Entergy Nuclear Operations, Inc.NRC Minimum Funding Calculation (10 CFR 50.75(c))ForYear Endging -December81.. 2004 Plant Name: Indian Point Nuclear Generating Unit No. 3 Inputs: P1t Characteristics Plant Type (PWR or BWR) PWR Region NE (Northeast) Rated (in MWt) 3067.4 Year 2004 Waste Vendor Used (Yes/No) Yes Burial Site South Carolina AtlantiC Compact Member (YestNo) No Producer Price Index wpuO543 (industrial electric power) 147.9 (December 2004)wpuOS7S (light fuel oft) 133A Labor Adlustmem Factor ecu13102i (Northeast) 1742 (4th Quarter, 2004)Burpls Site Adjustments_(South Carollnalhon.Atiantfi Compact Member)PWR -direct disposal 18.732 (NUREG-1307, R PWR -whwaste vendors 9.467 AdLustment Factors Energ (E) IA34 Labor (L.) 2.076 Burial (B) 9.487 Minimum Amount (millions, $1986) $101.99 (size ad'Nsted for n Escalation Factor (1, E, B) 3.618 (65% L, 13% E. 2 1ev. 10)negawatts) 2% B)NRC Minimum (milions, $2004)1 $3899.0 w/waste vendor 3 89/25/2807 16:07 6453713721 MILTON B SHAPIRO PAGE 15 Attachment 2 to BVY-05-033, NL-05-039, JPN-05-005, ENO Ltr. 2-05.023 Entergy Nuclear Operations, Inc.NRC Minimum Funding Calculation (10 CFR $0.76(c))for Year Ending December 31, 2004 Plant Name: Vermont Yankee Nuclear Power Station Inputs: PaM Charachmiti Plant Type (PWR or BWR) BWR Region NE (Northeast) Rated (in MWt) 1593 Year 2004 Waste Vendor Used (Yes/No) Yes Burial Site SoUth- Caolina Atantlic Compact Member (Yes/No) No Producer Price Index wpu0543 (industrial electric power) 147.9 (December 2004)wpu0573 (light fuel oils) 133A Labor Adiustmet Factors ecu13102i (Northeast) 174.2 (4th Quarter, 2004)uril Site Adiustmonts (South CrolinWinon-Atlantio Comp.re Member)BWR -direvt disposal 16.705 (NUREG-1307, Rev. 10)BWR- w/waste vendors 8.860 Adjusntment Factors Energy (E) 1.448 Labor (L) 2.076 Burial (a) 8.880 Minimum Amount (millions, $1986) $118.34 (size adjusted for megawatts) Escalation Factor (L.. E, B) 8.487 (65% L, 1% E, 22% B)NRC Minimum (millions, $2004)$412.60 wlwaste vendor 4 09/25/2007 16:0 7 8453713721 MILTON B SHAPIRO Attachment 2 to BVY-05-033, NL-05-039, JPN-05-005, ENO Ltr. 2.05.023 Entergy Nuclear Operations, Inc.NRC Minimum Funding Calculation (10 CFR 50.76(c))For Year Ending December 3l.2004 PAGE 16 Plant Name: Pilgrim Nuclear Power Station Inputs;Plant CharMctpenstics Plant Type (PWR or BWR) BWR Region WE (Nortast)Rated (in MWt) 2028 Year 2004 Waste Vendor Used (Yes/No) Yes Burial Sit -South-Carolina Atlantic Compact Member (Yes/No) No Pm-ducer Prce_ Index wpuO543 (industrial electric power) 147.9 (December2004) wpu0573 (light fuel oils) 133A Labor Adustment Fe,,om ecu13102. (Northeast) 174.2 (4th Quarter, 2004)Burial Se Adiustments .South Camlina/non-Atlantic Compact Member)BWR -direct disposal 16.705 (NUREG-1307, Rev. 10)BWR -w/waste vendors 88A0 Adiustmemn Factors Energy (E)Labor (L)Burial (B)Minimum Amount (millions, $1986)Escalation Factor (I., E, B)NRC Minimum (millions, $2004)1.448 2.076 8.660$12265 (size adjusted for megawatts) 3A87 (65% L, 13% E, 22% B)1 $426.U -1 w/Aeste vendor 5 ( Q'C) 89/25/2887 16:87 V.4853713721 MILTON B SHAPIRO PAGE 17 Attachment 2 to BVY-05-033, NL-05-039, JPN-05-005, ENO Ltr. 2.05.023 Entergy Nuclear Operations, Inc.NRC Minimum Funding CalculatIon (10 CFR 50-75(c))For Year December 31,JO0 Plant Name: James A. Fitzpatrick Nuclear Power Plant Inputs: Plant Characteftics Plant Type (PWR or BWR) BWR Region NE (Northeast) Rated On MWt) 2538 Year 2004 Waste Vendor Used (Yes/No) Yes Burial Site South Carolina Atla6tic Compact Member (Yes/No) No ProducerPrice In-dex wpu0543 (industrial electric power) 147.9 (December 2004)wpu0573 (lght fuel oils) 133.4 Labor Adiustment Factors ecul 31021 (Northeast) 174.2 (4th Quarter, 2004)Burial Site1 &lustments (So-uthCarolln -_Atlanftc Comoact MemberI BWR -direct disposal 16.705 (NUREG-1307, Rev. 10)BWR -w/waste vendors 8.880 Adjusrment.Factors Energy (E) 1.448 Labor (L) 2.076 Burial (B) 8.8A0 Minimum Amount (millions, $1086) $126.82 (size adjusted for megawatts) Escalation Factor (L, E, B) 3.487 (65% L, 13% E, 22% B)NRC Minimum (millions, $2004)$442-19 wlwaste vendor 6 EXHIBIT Z FR Doc E7-14864 http://a257.g.akamaitech.net/7/257/242 2/O ]jan2007l800/edocket.ac.. [Federal Register: August 1, 2007 (Volume 72, Number 147)][Notices][Page 42134-42135]

• From the Federal Register Online via GPO Access [wais.access.gpo.gov](DOCID:frOlauO7-109]

NUCLEAR REGULATORY COMMISSION [Docket Nos. 50-247 and 50-286]Entergy Nuclear Operations, Inc., Indian Point Nuclear Generating Unit Nos. 2 and 3; Notice of Acceptance for Docketing of the Application and Notice of Opportunity for Hearing Regarding Renewal of Facility Operating License Nos. DPR-26 and DPR-64 for an Additional 20-Year Period The U.S. Nuclear Regulatory Commission (NRC or the Commission) is considering an application for the renewal of Operating License Nos.DPR-26 and DPR-64, which authorize Entergy Nuclear Operations, Inc., to operate Indian Point Nuclear Generating Unit Nos. 2 and 3, respectively, at 3216 megawatts thermal (MWt) for each unit. The renewed licenses would authorize the applicant to operate Indian Point-Nuclear Generating Unit Nos. 2 and 3 for an additional 20 years beyond the period specified in the current licenses. The current operating licenses for Indian Point Nuclear Generating Unit Nos. 2 and 3 expire on September 9, 2013, and December 12, 2015, respectively. Entergy Nuclear Operations, Inc. submitted the application dated April 23, 2007, as supplemented by letters dated May 3, 2007, and June 21, 2007, pursuant to 10 CFR Part 54, to renew Operating License Nos.DPR-26 and DPR-64 for Indian Point Nuclear Generating Unit Nos. 2 and 3, respectively. A Notice of Receipt and Availability of the license renewal application (LRA), "Entergy Nuclear Operations, Inc.; Notice of Receipt and Availability of Application for Renewal of Indian Point Nuclear Generating Unit Nos. 2 and 3; Facility Operating Licenses Nos.DPR-26 and DPR-64 for an Additional 20-Year Period, was published in the Federal Register on May 11, 2007 (72 FR 26850).The Commission's staff has determined that Entergy Nuclear Operations, Inc. has submitted sufficient information in accordance ýjith 10 CFR Sections 54.19, 54.21, 54.22, 54.23, 51.45, and 51.53(c) to unable the staff to undertake a review of the application, and the application is therefore acceptable for docketing. The current Docket Nos. 50-247 and 50-286 for Operating License Nos. DPR-26 and DPR-64, respectively, will be retained. The determination to accept the license renewal application for docketing does not constitute a determination that a renewed license should be issued, and does not preclude the NRC staff from requesting additional information as the review proceeds.Before issuance of each requested renewed license, the NRC will have made the findings required by the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations. In accordance with 10 CFIk 54.29, the NRC may issue a renewed license on the basis of its review if it finds that actions have been identified and have been or will be taken with respect to: (1) Managing the effects of aging during the period of extended operation on the functionality of structures and components that have been identified as requiring aging management review, and (2) time-limited aging analyses that have been identified as requiring review, such that there is reasonable assurance that the activities authorized by the renewed license will continue to be conducted in accordance with the current licensing basis (CLE), and that any changes made to the plant's CLB comply with the Act and the Commission's regulations. Additionally, in accordance with 10 CFR 51.95(c), the NRC will prepare an environmental impact statement that is a supplement to the Commission's NUREG-1437, -Generic Environmental Impact Statement for License Renewal of Nuclear Power Plants, dated May 1996. In considering the license renewal application, the Commission must find that the applicable requirements of Subpart A of 10 CFR Part 51 have been satisfied. Pursuant to 10 CFR 51.26, and as part of the environmental scoping process, the staff intends to hold a public scoping meeting. Detailed information regarding the environmental scoping meeting will be the subject of a separate Federal Register notice.Within 60 days after the date of publication of this Federal Register Notice, any person whose interest may be affected by this proceeding and who wishes to participate as a party in the proceeding must file a written request for a hearing or a petition for leave to intervene with respect to the renewal of the license. Requests for a hearing or petitions for leave to intervene must be filed in accordance 'th the Commission's "Rules of Practice for Domestic Licensing oceedings' in 10 CFR Part 2. interested persons should consult a rrent copy of 10 CFR 2.309, which is available at the Commission's

• hu tlic Document Room (PDR), located at One White Flint North, 11555 Rockville Pike (first floor), Rockville, Maryland 20852 and is accessible from the NRC's Agencywide Documents Access and Management I of 3 10/3/2007 1:11 PM FR Doc E7-14864 bttp:H/a257.g.ak~amaitech.net!7/257/2422A/0Ijan2007]I800/edocket.ac.

System (ADAMS) Public Electronic Reading Room on the Internet at http://www.nrc.gov/reading-rm/adamrs.htmr.l. Persons who do not have access to ADAMS or who encounter problems in accessing the documents located in eADAMS should contact the NRC's PDR reference staff by telephone at 1-800-397-4209 or 301-415-4737, or by e-mail at pdr@nrc.cov. If a request for a hearing/petition for leave to intervene is filed within the 60-day period, the Commission or a presiding officer designated by the Commission or by the Chief Administrative Judge of the Atomic Safety and Licensing Board Panel will rule on the request and/or petition; and the Secretary or the Chief Administrative Judge of the Atomic Safety and Licensing Board will issue a notice of a hearing or an appropriate order. In the event that no request for a hearing or petition for leave to intervene is filed within the 60-day period, the NRC may, upon completion of its evaluations and upon making the findings required under 10 CFR Parts 51 and 54, renew the license without further notice.As required by 10 CFR 2.309, a petition for leave to intervene shall set forth with particularity the interest of the petitioner in the proceeding, and how that interest may be affected by the results of the proceeding, taking into consideration the limited scope of matters that may be considered pursuant to 10 CFR Parts 51 and 54. The petition must specifically explain the[fPage 42135]]reasons why intervention should be permitted with particular reference to the following factors: (1) The nature of the requestor's/ petitioner's right under the Act to be made a party to the proceeding; (2) the nature and extent of the requestor's/petitioner's property, financial, or other interest in the proceeding; and (3) the possible effect of any decision or order which may be entered in the proceeding on the requestor's/petitioner's interest. The petition must also set forth the specific contentions which the petitioner/requestor seeks to have litigated in the proceeding. Each contention must consist of a specific statement of the issue of law or fact to be raised or controverted. In addition, the requestor/petitioner shall provide a brief explanation of the bases of each contention and a concise statement of the alleged facts or the expert opinion that supports the contention on which the requestor/ petitioner intends to rely in proving the contention at the hearing.The requestor/petitioner must also provide references to those specific sources and documents of which the requestor/petitioner is aware and on which the requestor/petitioner intends to rely to establish those facts or expert opinion. The requestor/petitioner must provide sufficient tnformation to show that a genuine dispute exists with the applicant on material issue of law or fact.\l\ Contentions shall be limited to tters within the scope of the action under consideration. The contention must be one that, if proven, would entitleý eestor/petitioner Qrelief. estor/petiti wf 5 to sati _ e re t i Haiable because they f aeasretocontain safegurso rpietary information, eiig cest hi nomton should contact the/aplcn r plcn' cuslt iscuss the need for a A f~4e proeciv orer nume h he fo nwing groups: t l Technical (primarily aetosfycnc

(2) environmental; or (3) miscellaneous.

As specified in 10 CFR 2.309, if two or more requestors/petitioners seek to co-sponsor a contention or propose substantially the same contention, the requestors/petitioners will be required to jointly designate a representative who shall have the authority to act for the requestors/petitioners with respect to that contention. Those permitted to intervene become parties to the proceeding, subject to any limitations in the order granting leave to intervene, and have the opportunity to participate fully in the conduct of the hearing. A request for a hearing or a petition for leave to intervene must be filed by: (1) First class mail addressed to the Office of the Secretary of the Commission, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, Attention: Rulemaking and Adjudications Staff; (2) courier, express mail, and expedited delivery services to the Office of the Secretary, Sixteenth Floor, One White Flint North, 11555 Rockville Pike, Rockville, Maryland 20852, Attention: Rulemaking and Adjudications Staff; (3) E-mail addressed to the Office of the Secretary, U.S. Nuclear Regulatory Commission, HEARINGDOCKET8NRC.GOV; or (4) facsimile transmission addressed to the Office of the Secretary, S. Nuclear Regulatory Commission, Washington, DC., Attention: lemakinf and Adjudications Staff at 301-415-i101 (verification tber: 30-415-1966 h.\2\ A copy of the request for hearing or petition S for leave to intervene must also be sent to the Office of the General Counsel, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, and it is requested that copies be transmitted either by means of 2 of 3 1013/2007 1:11 PM FR Doc E7-14864 hntp://a257.g.akamaitech.net/7/ 2 5 7/2 4 2 2/.0]jan2.007J800/edocket.ac.. facsimile transmission to 301-415-3725 or by e-mail to OGCMailCenter@nrc.acv. A copy of the request for hearing or petition for leave to intervene should also be sent to the Assistant General Counsel, Entergy Nuclear Operations, Inc., 440 Hamilton Avenue, White Plains, NY 10601.-------------------

---

\2\ If the request/petition is filed by e-mail or facsimile, an original and two copies of the document must be mailed within 2 (two) business days thereafter to the Secretary, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; Attention: Rulemaking and Adjudications Staff.----------------------------------------------------- Non-timely requests and/or petitions and contentions will not be entertained absent a determination by the Commission, the presiding officer, or the Atomic Safety and Licensing Board that the petition, request and/or contentions should be granted based on a balancing of the factors specified in 10 CFR 2.309(a)(1)(i)-(viii). Detailed information about the license renewal process can be found under the Nuclear Reactors icon at http://www.nrc.uov/reactors/orerating/licensing/renewal.html on the NRC's Web site. Copies of the application to renew the operating licenses for Indian Point Nuclear Generating Unit Nos. 2 and 3, are available for public inspection at the Commission's PDR, located at One White Flint North, 11555 Rockville Pike (first floor), Rockville, Maryland 20852-2738, and at http://www.nrc.2ov/reactors/operating/Iicensi ngrenewal/applications.html the NRC's Web site while the application is under review. The application may be accessed in ADAMS through the NRC's Public Electronic Reading Room on the Internet at http://www.nrc.gov/reading-rm/adams.html under ADAMS Accession Numbers ML071210507, ML071280700, and ML071800318. As stated above, persons who do not have access to ADAMS or who encounter problems in accessing the documents located in ADAMS may contact the NRC Public Document Room (PDR) Reference staff by telephone at 1-800-397-4209 or 301-415-4737, or by e-mail to pdr@nrc.cov. The NRC staff has verified that a copy of the license renewal application is also available to local residents near Indian Point Nuclear Generating Unit Nos. 2 and 3 at the White Plains Public Library, 100 Martine Avenue, White Plains, NY 10601; the Field Library, Nelson Avenue, Peekskill, NY 10566; and the Hendrick Hudson Free ibrary, 185 Kings Ferry Road, Montrose, NY 10548.Dated at Rockville, Maryland, this 25th day of July, 2007.For The Nuclear Regulatory Commission. Pao-Tsin Kuo, Director, Division of License Renewal, Office of Nuclear Reactor Regulation.(FR Doc. E7-14864 Filed 7-31-07; 8:45 am]BILLING CODE 7590-01-P 3 of 3 10/3007 1:11 PM EXHIBIT AA GovTrack: H.R. 994: Text of Legislation http://www.govtrack.us/congress/billtext.xpd?bill=h 110-9!GovTrack.us Tracking the 11Ote United States Congress www.youtue.comftelbales tFevrbaa -Do you take transparency seriously? Consider how important to you an open and transparent government is to a healthy society. More work needs to be done to make Congress open. Make a statement to your elected officials by joining 100 others in signing a Pledge for transparency. Bills Legislators Votes Track Congress/ Log In Active Bills Recent Votes Learn More About GovTrack F Full Text Options la Download PDF View Full Text on THOMAS Bill Status Go to Bill Status Page Introduced: Feb 12, 2007 Status: Introduced Sponsor: Rep. John Hall [D-NY]hLejislation > 2007-2008 (110th Congress) > H.:R. 994 H.R. 994: To require the Nuclear Regulatory Commission to conduct an Independent Safety Assessment of the...rut HR 994 IH 110th CONGRESS I st Session H. R. 994 To require the Nuclear Regulatory Commission to conduct an Independent Safety Assessment of the Indian Point Energy Center.IN THE HOUSE OF REPRESENTATIVES February 12, 2007 Mr. HALL of New York (for himself, Mr. HINCHEY, Mr. ENGEL, Mrs. LOWEY, and Mr. SHAYS)introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To require the Nuclear Regulatory Commission to conduct an Independent Safety Assessment of the Indian Point Energy Center.Be it enacted by the Senate and House of Representalives of the United States ofAmerica in Congress assembled, SECTION 1. INDEPENDENT SAFETY ASSESSMENT. Not later than 6 months after the date of enactment of this Act, the Nuclear Regulatory Commission shall transmit to the Congress a report containing the results of--(1) a focused, in-depth Independent Safety Assessment of the design, construction, maintenance, and operational safety performance of the systems at the Indian Point Energy Center, Units 2 and 3, located in WVestchester County, New York, including the systems described in section 2; and (2) a comprehensive evaluation of the radiological emergency plan for Indian Point Energy Center, Units 2 and 3, conducted by the Nuclear Regulatory Commission and the Department of Homeland Security, which shall include--(A) a detailed explanation of the factual basis upon which the Nuclear Regulatory Commission and the Federal Emergency Management Agency relied in--(i) approving the radiological emergency plan; and 9/27/2007 5:59 PM GovTrack: H.R. 994: Text of Legislation http://www.govtrack.us/congress/billtext.xpd?bili=h 110-994 (ii) making subsequent annual findings of reasonable assurance that the plan will adequately protect the public in the event of an emergency, beginning on July 25, 2003 and continuing to the present;(B) a detailed response to each of the criticisms of the radiological emergency plan contained in the Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone, published by James Lee Witt Associates on January 10, 2003; and (C) a detailed explanation of what criteria the Nuclear Regulatory Commission and Department of Homeland Security use in determining whether or not reasonable assurance can be provided that the radiological emergency plan is adequate to protect public health and safety, including what threshold figures of injuries and fatalities these agencies consider acceptable or tolerable in the event of a nuclear accident.SEC. 2. SYSTEMS.The systems referred to in section 1(1) are the following: (1) The reactor protection system.(2) The control room ventilation system and the containment ventilation system.(3) The 4.16 kv electrical system.(4) The condensate system.(5) The spent fuel storage systems.SEC. 3. INDEPENDENT SAFETY ASSESSMENT TEAM.The Independent Safety Assessment conducted at Indian Point Nuclear Power Plant shall be conducted by an Independent Safety Assessment Team with 25 members, comprised of--(1) 16 members from the Nuclear Regulatory Commission who are unaffiliated with the Nuclear Regulatory Commission Region I office or the Nuclear Regulatory Commission Office of Nuclear Reactor Regulation; (2) 6 independent contractors with no history of having worked for or at the Indian Point Energy Center or any other nuclear power plant owned or operated by Entergy Corporation; (3) th ePresident of New York State Energy and Research Development Authority or his designee;' (4) the Director of the Bureau of Hazardous Waste and Radiation Management, in the Division of Solid and Hazardous Materials of the New York State Department of Environmental Conservation, or his designee; and (5) a New York State-appointed independent contractor with experience in system engineering and no history of affiliation with any nuclear power plant owned by Entergy Corporation. SEC. 4. INDEPENDENT SAFETY ASSESSMENT MONITORING. The Independent Safety Assessment conducted at Indian Point Nuclear Energy Center shall be monitored by--(1) an Independent Safety Assessment Observation Group comprised of 4 officials appointed by the State of New York; and (2) an Independent Safety Assessment Citizens' Review Team comprised of 5 individuals appointed by the State of New York, with one resident from each Emergency Planning Zone county (Westchester, Rockland, Putnam, and Orange) appointed in consultation with the respective County Executive. 9/27/2007 5:59 PM fjov] rack: MR. 994: Text of Legislation http://www.govtrack.us/congress/billtext.xpd?bill=hl 10-9S The Independent Safety Assessment Observation Group and Independent Safety Assessment Citizens' Review Team shall frequently provide publicly available updates on the progress and conduct of the Independent Security Assessment to the Governor of New York.SEC. 5. INDEPENDENT SAFETY ASSESSMENT MODEL.The Independent Safety Assessment conducted at Indian Point Energy Center shall be equal in scope, depth, and breadth to the Independent Safety Assessment of the Maine Yankee Nuclear Power Plant, located near Bath, Maine, conducted by the Nuclear Regulatory Commission in 1996.SEC. 6. INCORPORATION INTO RELICENSING PROCESS.The final decision by the Nuclear Regulatory Commission as to whether to renew the operating licenses for Unit 2 or Unit 3 at the Indian Point Energy Center shall not be made until--(1) the Nuclear Regulatory Commission has fully entered the complete report and findings of the Independent Safety Assessment into the administrative record of the license renewal proceeding for Unit 2 and Unit 3 at the Indian Point Energy Center, and (2) the applicant has fully accepted and implemented all findings and recommendations of the Independent Safety Assessment, including--(A) undertaking all recommended repairs;(B) replacement of safety-related equipment;(C) changes to monitoring plans; and (D) revision of the radiological emergency preparedness plans as called for in the report.The applicant shall not be allowed to operate the reactors past the expiration date of its current operating licenses for Unit 2 and Unit 3 through administrative license renewals or any other means prior to meeting the requirements in paragraph (1) and paragraph (2) of this section.SEC. 7. AUTHORIZATION OF APPROPRIATIONS. There are authorized to be appropriated to the Nuclear Regulatory Commission to carry out this Act $1 0,000,000 for. fiscal year 2008, to remain available until expended.GovTrack is not affiliated with the U.S. government or any other group. You are encouraged to reuse any material on this site. For more information, see About GovTrack. Feedback is welcome to operations@govtrack.us, but I can't do your research for you, norcan I pass on messages to Members of Congress. This website is just a pet project of a regular joe.I EXHIBIT BB-7o August 14,2007 -72 FR 45466-45467 -NUCLEAR REGULATORY COMMISSION -Notice of Availability of the Final License Renewal Interim Staff Guidance LR-ISG-2006-03: Staff Guidance for Preparing Severe Accident Mitigation Alternatives Analyses -NRC is issuing its Final License Renewal Interim Staff Guidance LR-ISG-2006-03 for preparing severe accident mitigation alternatives (SAMA) analyses. This LR-ISG recommends that applicants for license renewal use the Guidance Document Nuclear Energy Institute 05-01, Revision A, (ADAMS Accession No. ML060530203) when preparing their SAMA analyses. The NRC staff issues LR-lSGs to facilitate timely implementation of the license renewal rule and to review activities associated with a license renewal application. The NRC staff will also incorporate the approved LR-1SG into the next revision of Supplement I to Regulatory Guide 4.2, "Preparation of Supplemental Environmental Reports for Applications to Renew Nuclear Power Plant Operating Licenses.' -71 EXHIBIT CC ft L Doosan, Heavy industries & Construction Presented at the Burns & Roe 17th Annual Seminar Powering the Future March 21, 2007 9.Entergy Replacement Reactor Vessel Head* Customer : Entergy* Primary Contractor: Westinghouse

• Projects : ANO #2 (Site Delivery:

January, 2008)Waterford

1. 3 (Site Delivery:

February, 2008)Indian Point #2 (Site Delivery: October, 2011)Indian Point #3 (Site Delivery: October, 2012)* Scope Four (4) RRVHs Two (2) sets of CRDM (for Indian Point #2 & 3 only)* Manufacturer DOOSAN (EMD supplies CRDM as the subsupplier) Qinshan Phase II #3 Reactor Vessel* Customer : NPQJVC (Nuclear Power Qinshan Joint Venture Co.)* Contractors

DOOSAN (#3), CFHI (#4)* DOOSAN's Scope : One(l) Reactor Vessel & Technical Assistance

• Expected shipping : June, 2008 Doiosau He.YV Ifidustriet

& Constructton UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION WASHINGTON, DC 20555-0001 May 2, 2003 NRC REGULATORY ISSUE

SUMMARY

2003-09 ENVIRONMENTAL QUALIFICATION OF LOW-VOLTAGE INSTRUMENTATION AND CONTROL CABLES ADDRESSEES All holders of operating licenses for nuclear power reactors, except those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel.INTENT The U.S. Nuclear Regulatory Commission (NRC) is issuing this regulatory issue summary <RIS)to inform addressees of the results of the technical assessment of GSI-1 68, "Environmental Qualification of Low-Voltage Instrumentation and Control (I&C) Cables." The scope of GSI-168 is limited to safety-related, low-voltage I&C cables. This RIS requires no action or written response on the part of an addressee. BACKGROUND In support of the resolution of GSI-168, the NRC sponsored cable test research at Wyle Laboratories and the Brookhaven National Laboratory. The resulting NRC technical assessment was essentially based on reviews and analyses of the research results of six loss-of-coolant-accident (LOCA) cable tests, condition-monitoring tests on I&C cables, and information provided by the nuclear industry. Technical assessments were coordinated with the nuclear industry and the Institute of Electrical and Electronics Engineers. Following the completion of the NRC research effort, the staff concluded that typical I&C cable qualification test programs include numerous conservative practices that collectively provide a high level of confidence that the installed I&C cables will perform their intended functions during and following design basis events as required by 10 CFR 50.49, "Environmental Qualification (EQ) of Electric Equipment Important to Safety for Nuclear Power Plants." These conservative practices continue to support the current use of a single prototype during qualification testing and, therefore, a successful test provides a high level of confidence that these cables will be able to perform their safety functions during and following a design basis event. However, cable LOCA test failures that occurred during the NRC-sponsored research program indicate that in certain cases the original margin and conservatism inherent in the qualification process have been reduced. Licensees have stated in a few cases that a reduction in margin can be addressed by monitoring operating service environments (temperature, radiation, and humidity)ML031220078 a RIS 2003-09 Page 2 of 5 to ensure that operating conditions do not exceed the parameters that were assumed during qualification testing. In this regard, walkdowns to look for any visible signs of anomalies attributable to aging, with particular emphasis on localized adverse environments, coupled with the knowledge of the operating service environments, could be sufficient to ensure that qualification is maintained. DISCUSSION OF TECHNICAL ASSESSMENT The technical assessment of GSI-168 is based on reviews and analyses of the research results of six LOCA tests, condition-monitoring tests on I&C cables, and information provided by the nuclear industry. Summaries of significant research findings are presented below. Details of the NRC technical assessment of GSI-168 are available in the NRC Agencywide Documents Access and Management System (ADAMS), Accession No. ML021790551. Current EQ Process (40 Years)The current EQ process is adequate for assuring that low-voltage I&C cables will perform their intended functions for 40 years. When I&C cables are qualified in accordance with NRC regulations, the overall EQ process provides reasonable assurance that I&C cables will perform their intended safety-related functions during their qualified life. Specifically, 10 CFR 50.49(e)requires consideration of all significant types of aging degradation that can affect the component's functional capability. Compliance with 10 CFR 50.49 provides reasonable assurance that the cables will perform their intended functions during and following design basis events after exposure to the effects of service condition aging. Further, some licensees have implemented monitoring programs to ensure that service conditions will not exceed those assumed during the original qualification. Inspection, surveillance, condition monitoring, and trending of selected parameters for any installed safety-related cable system could increase the confidence in cable performance. EQ Process for License Renewal (60 Years)Licensees that have addressed license renewal recognize that knowledge of the operating service environments is essential to extending the qualified life of I&C cables. Where measured environmental service conditions are less severe than those used in the original qualification and when the cables are not degraded, the licensees assessed the difference between the operating environment and the original qualification environment to extend the qualified life of the cables to 60 years by reanalysis. This approach, based on the Arrhenius methodology, has been found acceptable by the staff during its review of license renewal applications. Results of Cable LOCA Tests Detailed information on the six cable LOCA tests conducted at Wyle Laboratories is provided in NUREG/CR-6704, "Assessment of Environmental Qualification Practices and Condition Monitoring Techniques for Low-Voltage Electric Cables." It should be noted that the LOCA conditions selected for the simulated tests were consistent with those used in the original qualification of the cables. All cable specimens in Test Sequences 1, 2, and 3 passed the LOCA test and the voltage withstand test. Samuel Moore cable specimens failed the voltage withstand test during Test Sequence 4, and Okonite bonded- jacket cable specimens failed the RIS 2003-09 Page 3 of 5 LOCA test and the voltage withstand test in Test Sequence 5. All of the Test Sequence 6 cable specimens, aged to 60 years, exhibited high leakage currents and several cable specimens failed the voltage withstand test. The summary results of the six test sequences are discussed in Attachment 1.Research Findings on Cable Condition-Monitoring Techniques NRC research results on I&C cables indicate that meaningful information can be derived from testing samples of polymeric materials under controlled laboratory conditions. With certain limitations (accessibility being the biggest limitation), some of these test results can be applied in the in situ assessment of installed cable systems. The research concluded that a combination of condition-monitoring techniques could be effective since no single technique is currently adequate to detect insulation degradation of !&C cables. Based on the test results, conclusions were drawn regarding the effectiveness of the techniques studied for monitoring cable condition and are presented in the attachment. Industry Good Practices for Condition-Monitoring During the NRC review of GSI-168, the industry stated that cable aging evaluations are ongoing throughout plant life. When unexpected localized adverse conditions are identified, the condition of the affected cables is evaluated and appropriate corrective action is taken.Monitoring or inspection of environmental conditions or component parameters was generally conducted to ensure that the component is within the bounds of its qualification basis. The combination of licensee-specific activities and industry-supported activities that were developed for condition-monitoring can support a high level of confidence that installed safety-related cables would remain qualified to perform their safety functions in the event of an accident. In addition, the nuclear industry continues to advance the state-of-the-art in cable condition-monitoring from the simplest techniques to the most sophisticated. The staff has concluded that, although a single reliable condition-monitoring technique does not currently exist, walkdowns to look for any visible signs of anomalies attributable to cable aging, coupled with monitoring of operating environments, have proven to be effective and useful.Risk Assessment The state-of-the-art for incorporating cable aging effects into probabilistic risk assessment is still evolving and current assumptions that need to be made on the failure rate and common cause effects are based on sparse data. One of the key assumptions of the risk assessment is that operating environments are less severe than or the same as those assumed during qualification testing. These assumptions can be relied upon provided licensees have ongoing knowledge of environmental operating conditions at the nuclear power plants._27 RIS 2003-09 Page 4 of 5

SUMMARY

OF ISSUE The technical assessment of GSI-168 is complete and the research findings are published in NUREG/CR-6704, Vols. 1 and 2 (Accession Nos. ML010460247 and ML010510387). The significant research findings that resulted from this effort are as follows: The current equipment qualification process for low-voltage I&C cables is adequate for the duration of the current license term of 40 years.Because of the failures of some I&C cables in the NRC LOCA tests, the original margin and conservatism inherent in the qualification process have been reduced. Adequate margin may be ensured through ongoing monitoring of plant operating environments to confirm that service conditions do not exceed those assumed during qualification testing and the cables are within the bounds of their qualification basis.* Walkdowns, with particular emphasis on the identification of localized adverse environments, to look for any visible signs of anomalies attributable to cable aging, coupled with the monitoring of operating environments, were proven to be effective and useful for ensuring qualification of cables.For license renewal, a reanalysis (based on the Arrhenius methodology) to extend the life of the cables by using the available margin based on a knowledge of the actual operating environment compared to the qualification environment, coupled with observations of the condition of the cables during walkdowns, was found -to be an acceptable approach.A combination of condition-monitoring techniques may be needed since no single technique is currently demonstrated to be adequate to detect and locate degradation of I&C cables. Monitoring I&C cable condition could provide the basis for extending cable life.BACKFIT DISCUSSION This RIS requests no action or written response. Consequently, the staff did not perform a backfit analysis.FEDERAL REGISTER NOTIFICATION A notice of opportunity for public comment was not published in the Federal Register because this RIS is informational. 78 RIS 2003-09 Page 5 of 5 PAPERWORK REDUCTION ACT STATEMENT This RIS does not request any information collection. If there are any questions concerning this RIS, please contact the person noted below.IRAI William D. Beckner, Program Director Operating Reactor Improvements Program Division of Regulatory Improvement Programs Office of Nuclear-Reactor Regulation Technical Contact: T. Koshy, NRR 301-415-1176 E-mail: txk(&nrc.qov Attachments:

1. Results of Cable LOCA Tests and Findings On Cable Condition-Monitoring Techniques

2. List of Recently Issued NRC Regulatory Issue Summaries-1 ý Attachment 1 RIS 2003-09 Page 1 of 6 RESULTS OF CABLE LOCA TESTS AND FINDINGS ON CABLE CONDITION-MONITORING TECHNIQUES CABLE LOCA TESTS Detailed information on the six cable LOCA tests conducted at Wyle Laboratories is provided in NUREG/CR-6704, "Assessment of Environmental Qualification Practices and Condition Monitoring Techniques for Low-Voltage Electric Cables." It should be noted that the LOCA conditions selected for the simulated tests were consistent with those used in the original qualification of the cables. The summary results of the six test sequences are presented below.Test Sequence 1: XLPE Insulated Cables Aged to 20 Years The samples tested in this sequence were #14 and #16 American wire gauge (AWG) XLPE-insulated cables with a Neoprene overall outer jacket manufactured by Rockbestos, with the trade name "Firewall II." The preaging parameters for the fourgroups of specimens in this test sequence were as follows: Group 1: No accelerated aging (control specimens)

Group 2: Accelerated aging to match naturally aged cable (2.86 hr,@ 248 OF + 0.63 Mrad)Group 3: Naturally aged cable (10 years old)Group 4: Accelerated aging to 20 years (648.5 hr @ 302 OF + 26.1 Mrad)The LOCA conditions simulated included exposure to 150 Mrad of accident radiation, followed by exposure to steam at high temperature and pressure (346 OF and 113 psig peak conditions, double-peak profile) and chemical spray. The test duration was 7 days. All cable specimens passed the LOCA test sequence, including the post-LOCA voltage withstand test.Test Sequence 2. EPR-Insulated Cables Aged to 20 Years The samples used in this sequence were three-conductor (3/C) and four-conductor (4/C)#16 AWG, 600v AIW cables with ethylene propylene (EPR) and unbonded chlorosulfonated polyethylene (CSPE, with the trade name Hypalon), covering the insulation of each conductor and the conductor bundle. The preaging parameters for the four groups of specimens in this test sequence were as follows: Group 1: No accelerated aging (control specimens) Group 2: Accelerated aging to match naturally aged cable (28.5 hr @ 250 OF + 3.3 Mrad)Group 3: Naturally aged cable (24 years old)Group 4: Accelerated aging to 20 years (82.2 hr @ 250 OF + 25.7 Mrad)The LOCA conditions simulated included exposure to 150 Mrad of radiation followed by exposure to steam (340 OF and 60 psig peak conditions, single-peak profile) and chemical spray. The test duration was 7 days. All cable specimens passed the LOCA test sequence, including the post-LOCA voltage withstand test. Attachment I RIS 2003-09 Page 2 of 6 Test Sequence 3. XLPE-Insulated Cables Aged to 40 Years The test specimens were cross-linked-polyethylene (XLPE)-insulated cables with a Neoprene overall outer jacket manufactured by Rockbestos, with the trade name uFirewall 1I1." The preaging parameters for the four groups of specimens in this test sequence were as follows: Group 1. No accelerated aging (control specimens) Group 2. Accelerated aging to simulate the exposure of the naturally aged specimens (9.93 hr @ 248 °F + 2.27 Mrad)Group 3. Naturally aged 10-year-old cable Group 4. Accelerated aging to simulate 40 years of qualified life (1301.16 hr @ 302 OF + 51.49 Mrad) ... ...The LOCA conditions simulated included exposure to 150 Mrad of accident radiation followed by exposure to steam (using the same LOCA profile as used in Test Sequence 1) and chemical spray.One of the Group 4 specimens did not hold the full 500 volts used for insulation resistance (IR)testing even after its splices were removed. The cause of this failure was determined to be human error in handling the test specimen. With the exception of the damaged specimen, all cable specimens passed the LOCA test sequence, including the post-LOCA voltage withstand test.Test Sequence 4. Multiconductor Cables The objective of this test sequence was to determine whether multiconductor cables have any unique failure mechanisms that are not present in single-conductor cables. The test specimens were #12 AWG, 3/C, 1,OOOV EPR-insulated cables with individual and outer CSPE jackets manufactured by Anaconda. In addition, this test sequence included #16 AWG, 2/C, 600V Samuel Moore cables with ethylene propylene diene monomer (EPDM) insulation and a CSPE bonded individual jacket with a Dekorad overall outer jacket. The preaging groups in this test sequence were as follows: Group 1. Anaconda and Samuel Moore cables with no accelerated aging (control specimens) Group 2. Samuel Moore cables with accelerated aging to simulate 20 years of qualified life (84.85 hr @ 250 OF + 25:99 Mrad)Group 3. Anaconda cables (169.20 hr @ 302 OF + 53.60 Mrad) and Samuel Moore cables (169.05 hr @ 250 'F+ 51.57 Mrad) with accelerated aging to simulate 40 years of qualified life.The LOCA conditions simulated included exposure to 150 Mrad of accident radiation followed by steam (346 OF and 113 psig peak conditions, as used in Test Sequences 1 and 3) and chemical spray. During the post-LOCA voltage withstand test, arof the Anaconda cables and Samuel Moore cables aged to simulate 20 years performed acceptably. However, two out of three Samuel Moore specimens aged to simulate 40 years could not hold the 2,400V test voltage on one conductor. Inspection of the two specimens revealed a single pinhole in the insulation of each failed conductor. It was concluded that the failures were due to localized degradation of the insulation, which caused the high-potential test to puncture the insulation on I 4 Attachment 1 RIS 2003-09 Page 3 of 6 the two failed conductors. There was no general degradation of the insulation along the length of the cable specimens and no unique failure mechanism was observed between the single-conductor and multiconductor cables. Therefore, based on these test results, the issue of a unique failure mechanism for multiconductor vs. single-conductor low-voltage I&C cables was not demonstrated. Test Sequence 5. Bonded Jacket Cables The samples used in this sequence-were Anaconda 3/C, #1 2AWG, 1,OOOV cables with EPR insulation and a CSPE jacket; Samuel Moore 2/C, #16 AWG, 600V cables with EPDM insulation and a CSPE jacket; and Okonite 1/C, #12 AWG, 600Vcables with EPR insulation and a CSPE jacket. The preaging groups in this test sequence were as follows: Group 1. Specimens with no accelerated aging (control specimens) Group 2. Specimens from A, S, and 0 with accelerated aging to simulate 20 years of qualified life (A: 84 hr @ 302 OF + 25.69 Mrad; S: 84 hr @ 250 OF + 25.99Mrad; and 0: 252 hr @ 302 OF + 25.79 Mrad)Group 3. Specimens from A, S, and 0 with accelerated aging to simulate 40 years of qualified life (A: 169 hr @ 302 OF + 51.35 Mrad; S: 169 hr,@ 250 OF + 51.57 Mrad;and 0: 504 hr @ 302 OF + 51.49 Mrad)The LOCA conditions simulated included exposures to 150 Mrad of accident radiation, followed by steam (double-peak LOCA profile, as used in Test Sequences 1 and 3 with a test duration of 10 days) and chemical spray. After post-LOCA inspections, a voltage withstand test was conducted on each of the cable specimens. All of the Samuel Moore and Anaconda cables performed acceptably, while one of the two Okonite specimens in Group 2 and all 3 Okonite specimens in Group 3 failed the 2,400V voltage withstand test. It was observed that the insulation on the Okonite cables had split open along their length during the simulated LOCA, exposing the bare conductor underneath. It was concluded that the failures in the Okonite specimens were caused by differential swelling of the bonded CSPE individual jacket and the underlying EPR insulation. The Okonite Company has subsequently requalified the 1/C, #12 AWG Okonite Okolon composite cable based on an Arrhenius activation energy of 1.24eV. Calculations using this activation energy (225 hr @ 150 0C + 200 Mrad and 300 hr @ 150 'C + 100 Mrad) extrapolate to a 40-year qualified life at 75 0 C and 77 °C, respectively. Additional details of the recent Okonite cable requalification program are contained in Regulatory Issue Summary 2002-11 (ADAMS Accession No. ML022190099), issued August 9, 2002.Test Sequence 6: EPR- and XLPE-Insulated Cables Aged to 60 Years The test specimens were Rockbestos cables (same as Test Sequences land 3), AIW cables (same as Test Ssequence 2), Samuel Moore cables (same as Test Sequences 4 and 5), and Okonite cables (same as Test Sequence 5). The preaging groups in this test sequence were as follows: Group 1: No accelerated aging (control specimens) Attachment 1 RIS 2003-09 Page 4 of 6 Group 2: Rockbestos cables (1366 hr @ 302 OF +77 Mrad), Okonite cables (756 hr@ 302 °F+ 77 Mrads), AIW cables (252 hr @ 250 OF + 38 Mrad), and Samuel Moore cables (252 hr @ 250 OF + 77 Mrad) with accelerated aging to simulate 60 years of qualified life.The LOCA conditions simulated included exposure to either 75 Mrad (AIW cables only) or 150 Mrad of accident radiation, followed by exposure to steam (double-peak LOCA profile, as used in Test Sequences 1 and 3, with peak conditions of 346 OF and 113 psig and a duration of 10 days) and chemical spray.Following the post-LOCA investigation, the test specimens were subjected 4o a voltage withstand test. In general, all of the specimens aged to 60 years exhibited a weakening of the insulation, which was- manifested inthe form of high leakage currents. Some of the specimens were unable to hold the required 2,400V of the voltage withstand test.Error in Irradiation Dose Following the completion of cable LOCA testing at Wyle Laboratories, the Georgia Institute of Technology notified Wyle Laboratories of an error in irradiation dose that affected LOCA tests 2 through 6. All specimens received irradiations from 6% to 10.5% lower than previously reported. Prior to completion of the GSI-168 technical assessment, the reported error in irradiation dose was evaluated by the Brookhaven National Laboratory and the NRC staff to determine if this error would impact the research findings. The staffs review concluded that none of the conclusions of the GSI-168 technical assessment are impacted by this error. The staff recognizes that the radiation dose of 50 Mrad used for qualification is conservative when compared to the 40-year dose seen during normal service in a nuclear power plant.RESEARCH FINDINGS ON CABLE CONDITION-MONITORING TECHNIQUES Based on the results of the testing, the following conclusions were drawn regarding the effectiveness of the techniques studied for monitoring cable -condition. Visual Inspection Visual inspection does not provide quantitative data; however, it does provide useful information on the condition of the cable that is relatively easy and inexpensive to obtain and that can be used to determine whether further investigation of the cable condition is warranted. Visual inspection is demonstrated to be a valuable source of information in any cable condition-monitoring program.Elongation at Break (EAB)EAB was found to be a reliable technique for determining the condition of the polymers studied.While EAB provides trendable data that can be readily correlated with material condition, it is a destructive test and cannot be used as an in situ means of monitoring electric cables unless sacrificial cable specimens are available. Attachment 1 RIS 2003-09 Page 5 of 6 Oxidation Induction Time Method (OITM)OITM was found to be a promising technique for monitoring the condition of electric cables.Results show that aging degradation can be trended with this technique for both XLPE and EPR insulation. However, a small sample of cable material is needed to perform this test.Oxidation Induction Temperature (OIT)OIT, which is related to OITM, was found to be less sensitive for detecting aging degradation of the polymers studied. OITM is preferred at this time.Fourier Transform Infrared (FTIR) Spectroscopy In terms of ability to trend aging degradation in the polymers studied, FTIR spectroscopy was found to provide inconclusive results. The results tend to show a consistent trend with age.However, the technical basis for the trend remains questionable. Indenter The indenter was found to be a reliable device that provides reproducible, trendable data for monitoring the degradation of cables in situ. It is limited to accessible sections of the cable, but it was found to be effective for monitoring the condition of common cable jacket and insulation materials and can be used for monitoring localized and accessible segments of low-voltage electric cables.Hardness The results of the hardness test indicate that, over a limited range, hardness-can be used to trend cable degradation. However, different probes must be used to accommodate the change in material hardness. Also, puncturing the cable insulating material is a potential concern with this technique and must be taken into consideration. Insulation Resistance Degradation of cable insulation can be trended with this technique. As cables degrade, a definite change in insulation resistance can be detected that can be correlated to cable condition. Using 1-minute and 10-minute readings to calculate the polarization index enables the effects of temperature and humidity variations to be accounted for. This technique can be used as an in situ condition-monitoring technique. Dielectric Loss This technique was found to provide useful data for trending the degradation of cable insulation. As the cables degrade, a definite change in phase angle between an applied test voltage and the circuit current can be detected at various test frequencies and correlated to cable condition. This technique can be used as an in situ condition monitoring technique. However, it is more effective when a ground plane is an integral element of a cable system. Attachment 1 RIS 2003-09 Page 6 of 6 Functional Performance This technique alone does not provide sufficient data to determine the condition of a cable. It is a "go-no go" type of test and may not be effective in detecting degraded conditions and impending failures. Further, functional performance testing is not considered an effective method for determining, in situ, the LOCA survivabiltiy for a particular cable.Voltage Withstand The capability of the insulating materials to withstand the circuit voltage is an indication of its dielectric performance. In order to detect defects in an incipient state, applied voltages may have to be elevated considerably above the rated voltages of the systems; further, the equipment at both ends of a cable system under test must be either disconnected or protected. Voltage withstand tests may result in unanticipated degradation of cables and can result in failures. Therefore, the risk of causing either catastrophic or incipient damage to cable insulation makes this an unsuitable method for assessing the LOCA survivability of low-voltage electric cables in situ. March 27, 2007 Re: NRC Proposed Rule: Power Reactor Security Requirements (RIN 3150-AG63)Annette Vietti-Cook, Secretary U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Attn: Rulemakings and Adjudications Staff Submitted via e-mail to SECY(.,nrc.gov COUNCIL ON INTELLIGENT ENERGY & CONSERVATION POLICY (CIECP)COMMENTS TO PROPOSED RULE 10 CFR PARTS 50,72 AND 73 REGARDING POWER REACTOR SECURITY REQUIREMENTS AT LICENSED NUCLEAR FACILITIES Nearly six years after September 11!,, 2001, the 103 civilian nuclear reactors in the United States are still not in a position to repel attacks by adversaries with capabilities commensurate with those of either the 9/11 terrorists or with enemies of the United States currently operative on the world stage. The present Power Reactor Security Requirements (PRSR) thus fall far short of the actual threat level faced by the U.S.today, much less the escalated level the nation will face as nations such as Russia, China and Iran improve and export nuclear engineering expertise. Indeed, as numerous security experts have pointed out, a terrorist group with access to sympathetic nuclear scientists and engineers would have sufficient sophistication to target the critical systems and weak links of nuclear reactors. The assistance that Pakistani nuclear scientists reportedly offered to Al Qaeda illustrates this threat.Recent National Intelligence Estimates and National Intelligence Council Reports describe the terrorist threat to the U.S. as real and as having no sign of abatement for many years to come. These reports further warn of a new class of "professionalized" terrorists -in part created by the Iraq war- who must be expected to have strong technical skills and English language proficiency. Such individuals should, in the future, be expected to become major players in international terrorism. Al Qaeda and other terrorist groups have shown extraordinary tactical ingenuity and a complete lack of reverence for human life. Further there is ample evidence that U.S.nuclear power plants, particularly those sited near metropolitan areas, are viewed as attractive terrorist targets. Notably, the 9/11 Commission learned that the original plan for a terrorist spectacular was for a larger strike, using more planes, and including an attack on nuclear power plants. In an AI-Jazeera broadcast in 2002, one of the planners of 9/11 said that a nuclear plant was the initial target considered. We also know from the 9/11 Commission's investigation that, even after the plot was scaled down, when Mohammed Atta was conducting his surveillance flights he spotted a nuclear power plant (unidentified by name, but obviously the Indian Point nuclear power plant) and came close to redirecting the strike. National Research Council analyses and post-9/11 intelligence has also indicated that the U.S. nuclear infrastructure is viewed as an alluring target for a future terrorist spectacular. As the Chairman of the National Intelligence Council stated in 2004, nuclear power plants "are high on Al Qaeda's ,0 P targeting list," adding that the methods of Al Qaeda and other terrorist group may be"evolving." There is, thus, every reason to believe that a sizable, well-planned and orchestrated military operation against a U.S. nuclear facility is well within both present and near-future terrorist intent and capability. In view of these realities, the current proposed PRSR is utterly inadequate. Consequently, the COUNCIL ON INTELLIGENT ENERGY & CONSERVATION POLICY (CIECP) urges the NRC to address the following realities in its PRSR: ACTIVE INSIDERS The voluminous number of security breaches which have occurred at critical infrastructure, including nuclear weapons and power facilities after 9/11 (such as the 16 foreign-born construction workers who were able to gain access to the Y-12 nuclear weapons plant with falsified documentation) demonstrates that nuclear "insiders" must be deemed potential active participants in an attack.This threat is significantly augmented by nuclear power plant operators' increasing outsourcing of on-site work in order to cut costs.Contractor oversight failures have been documented by the NRC. For example a December 22, 2003 NRC Special Inspection Report on the Indian Point Nuclear Generating Station in Buchanan, New York (Indian Point) operated by Entergy Nuclear Northeast (Entergy) notes "the common theme of a lack of direct contractor oversight and quality control measures, along with the absence of Entergy subject matter experts to independently assess contracted work activities ...." Critically, the risk of sabotage is elevated at all power plants during periods of refueling and major construction work when hundreds of outside contract workers have site access.The active participation of insiders, including contract workers, in a terrorist offensive need not take place during the time of attack. It may occur days or even many months prior to an attack. In addition to actions such as surveillance of plant schematics, security features and protocols, pre-attack participation may involve the sabotage of critical irnstrumentation, computers, piping, electronic systems or any number of other components, where such sabotage would likely not be discovered prior to an emergency event.COMPUTER SYSTEM COMPROMISE Nuclear power plant computer systems, like those of other critical infrastructure, are subject to a range of vulnerabilities, including power outages, attacks by malicious hackers, viruses and worms. Compromise of integrity may also occur at the level of software development via backdoors written into code or the implantation of logic bombs programmed to shut down a safety system at a particular time.2 Many terrorist networks have the resources and technical savvy to wreak havoc. For example, the alleged terrorist, Muhammad Naeem Noor Khan, picked up in Pakistan in 2004, and believed to have links with Al Qaeda, is a computer engineer.The fact that U.S. nuclear reactors are not impregnable was demonstrated by the penetration of the Slammer worm into the Davis-Besse nuclear facility. That intrusion disabled a safety monitoring system for nearly 5 hours. In addition, computer hackers have broken into U.S. Department of Energy computers. Some of such intrusions were root-level compromises, indicating that hackers had enough access to install viruses.Computers at nuclear power stations are also vulnerable to acts of sabotage against off-site power transmission, as was evidenced at Indian Point during the 2003 blackout which struck the Northeast. At Indian Point, various computer systems had to be removed from service, including the Critical Function Monitoring System, the Local Area Network, the Safety Assessment System/Emergency Data Display System, the Digital Radiation-Monitoring Systemrfina'rd 'the Safety Assessment System.- ..It is, accordingly, a matter of pressing importance that the NRC engage independent experts to develop a comprehensive computer vulnerability and cyber-attack threat assessment. Such an assessment must evaluate the vulnerability of the full range of nuclear power plant computer systems and the potential consequences of such vulnerabilities. The PRSR must incorporate such findings and include a protocol for quickly detecting such an attack and recovering key computer functions in the event of an attack.CHEMICAL WEAPONS The PRSR must fully address the potential consequences of the use of toxic chemicals as part of an attack scenario. There are numerous agents that can be deployed with almost instantaneous effect and can immobilize targets via paralysis, convulsions, blinding, suffocation or death. Such agents could be employed as part of the initialization strategy. For, example, a truck or even large SUV filled with chlorine, boron trifluoride, hydrofluoric acid, liquid ammonia, or any number of other agents could be crashed into a perimeter barrier, with the resulting fumes killing or disabling plant personnel guarding the outdoor area of the facility.Chemical agents could also be introduced surreptitiously into building ventilation systems. They may also be used strategically to neutralize workers endeavoring to maintain control of the situation. Many such agents are easy to make and do not require sophisticated delivery systems.Some can be carried in coffee mugs or in vials within body cavities. Phenarsazine chloride, an arsenic derivative, can be transported in minute quantities, even as a powder that can be dusted on paper. It is lethal if burned and even a spoonful can cause immediate extreme irritation of the eyes and breathing passages. A chemical like chloroform ascitone methanol can be transported on filter paper, then combined with a heat source to create an explosion. CONVENTIONAL WEAPONRY.3 Intelligence and military analysts have repeatedly warned that extremists in Iraq, the tribal areas of Pakistan and elsewhere are currently developing a high level of military skill and experience. This reality underscores the need for nuclear plants to be able to defend against attackers utilizing the full range of potential weaponry that terrorists are known to be capable of using, including heavy caliber automatic weapons; sniper rifles;shoulder-fired rockets; mortars; platter charges; anti-tank weaponry; bunker busters;shaped charges; rocket-propelled grenades; and high-power explosives. Numerous weapons systems posing a threat to even the best trained and equipped civilian guard force, as well as to on-site installations, are readily available and easy to transport. To wit:* Assault rifles and other rapid-fire battlefield weapons such as AK-47's, Uzi's and TEC-9's are freely available in the U.S. A weapon like the SKS 7.62-millimenter semiautomatic assault rifle can be purchased for under $200. In 2005 the Government Accountability Office reported that 47 individuals on a federal terrorism watch list were actually permitted to legally buy guns in 2004.* A standard .M-24 sniper rifle with day and night scope can be carried in a canvas bag and fires 7.62-millimeter ammunition targeting up to 3000 feet* A .50-caliber Barrett rifle, which can be purchased for $1000 on the internet, weighs a mere 30 lbs and can hit targets up to 6000 feet away with armor-piercing bullets that can blow a hole through a concrete bunker, bring down a helicopter or pierce an armored vehicle." A rocket propelled grenade launcher is re-loadable, can fire at the speed of 400 feet per second and can blow a vehicle into the air.* A TOW missile is an accessible form of military hardware used in over 40 countries and can be fired from a launcher on a flatbed truck. A 1998 test TOW fired into a nuclear waste transport cask (which is more robust than many on-site nuclear waste storage casks) blew out a hole the size of a grapefruit. The Kornet-E missile, developed by the Soviets and sold to Iraq, can travel over 3 miles and cut through over 3 feet of steel. The world's arms market is awash in thousands of Milan missiles. The 60-70 lb Milan missile system has an effective range of over 5000 feet and can blow a hole through more than 3 feet of armor plate.* The deployment of increasingly powerful and sophisticated explosives, including shaped charges and explosively formed penetrators (or E.F.P.s) by terrorists and insurgents in Iraq show that the explosives use capabilities of enemies of the United States should not be underestimated. Notably, the 18 men arrested in Australia in November 2005, and believed to have been planning an attack on an Australian nuclear reactor, had allegedly been stockpiling materials used to make the explosive triacetone triperoxide, or TATP. Terrorists targeting a U.S. nuclear power plant may very well be able to draw on expertise developed during the Iraq insurgency as well as military experts and rocket scientists from the former Iraq government or from hostile nations such as Iran. In addition, the strategic utility 4 of explosives is magnified when bombers are willing to blow themselves up.Suicide bombers able to gain access to the internal areas of a nuclear power plant during the course of an attack could cause untold destruction.

• Perhaps the most intractable military hardware threat is posed by shoulder-fired missiles such as Stingers, SA-7's, SA-14's and SA-18's. An estimated 500,000 such systems are scattered throughout the world and have been found in the possession of at least 27 terrorist or guerrilla groups. Some can be bought easily on the black market for as little as several thousand dollars each. Critically, shoulder-fired missiles are easy to operate (Al Qaeda training videos offer instruction) and are designed for portability, typically being 5-6 feet long and weighing 35 lbs. They can be transported by and fired from a van, S.U.V., pickup truck or recreational boat. Even a single terrorist armed with a shoulder-fired missile can cause immediate and substantial damage to a targeted structure.

Traveling at more than 1,500 miles per hour, a typical shoulder-launched missile has a range of over 12,000 feet. If the target remains intact following the initial strike, the terrorist can attach a new missile tube to the grip stock launcher and fire again.WATERBORN ATTACKS Waterborne defenses of nuclear plants adjacent to navigable waterways must be significantly enhanced. Facilities must either be-engineered to withstand damage from a waterborne attack or suited with physical barriers that prevent entry to the plant and/or critical cooling intake equipment. Continual cooling is an essential component of nuclear plant safety. A meltdown can be triggered even at a scrammed reactor if cooling is obstructed. Water intake is also essential to the proper function of spent fuel pools. Yet at certain nuclear plants, cooling systems may be highly vulnerable. At both Indian Point and Millstone Power Station, in particular, water intake pipes have been identified by engineering experts as exposed and susceptible to waterborne sabotage.One or more boats laden with high energy explosives could severely compromise cooling water intakes easily and quickly. Indian Point, for instance, is located on the* banks of the Hudson River in an area heavily trafficked by commercial and recreational vessels. The 900 foot "Exclusion Zone" -marked only by buoys- could be traversed by speed boats in 30 -40 seconds, well before any Coast Guard or other patrol boat could react. Patrol boats could also be readily taken out by suicide bomber boats crashing into them (in the manner a small explosives laden boat targeted the destroyer the USS Cole in 2000) or by weaponry like shoulder-fired missiles or rocket propelled grenades.AERIAL ASSAULT According to a terrorist "threat matrix" issued by the National Research Council and the National Academies of Sciences and Engineering following the September 2001 attack,"Nuclear power plants may present a tempting high-visibility target for terrorist attack, and the potential for a September 11-type surprise attack in the near term using U.S.assets such as airplanes appears to be high," 5 In March 2005, a joint FBI and Department of Homeland Security assessment stated that commercial airlines are "likely to remain a target and a platform for terrorists" and that "the largely unregulated" area of general aviation (which includes corporate jets, private airplanes, cargo planes, and chartered flights) remains especially vulnerable. The assessment further noted that Al Qaeda has "considered the use of helicopters as an alternative to recruiting operatives for fixed-wing operations," adding that the maneuverability and "non-threatening appearance" of helicopters, even when flying at low altitudes, makes them "attractive targets for use during suicide attacks or as a medium for the spraying of toxins on targets below." The vulnerability of nuclear power plants to malevolent airborne attack is detailed extensively in the Petition filed by the National Whistleblower Center and Randy Robarge in 2002 pursuant to 10 CFR Sec. 2.206. A number of studies of the issue are also reviewed in Appendix A to these Comments. The particular vulnerability of nuclear spent fuel pools to this kind of attack is detailed in the January 2003 report of Dr. Gordon Thompson, director of the Institute for Resource and Security Studies entitled "Robust Storage of Spent Nuclear Fuel: A Neglected Issue of Homeland Security" and in the findings of a multi-institution team study led by Frank N. Von Hippel, a physicist and co-director of the Program on Science and Global Security at Princeton University and published in the spring 2003 edition of the Princeton journal Science and Global Security under the title "Reducing the Hazards from Stored Spent Power-Reactor Fuel in the United States." It is worthy of note that, even post-9/1 1, general aviation aircraft have circled or flown closely over commercial nuclear facilities without military interception. The NRC's sole present strategy for averting a kamikaze attack upon a nuclear power plant is reliance upon aviation security upgrades implemented by the Transportation Security Administration and the Federal Aviation Administration and faith that U.S.intelligence will provide ample warning.It is this kind of governmental agency pass-the-buck mindset that brought the nation Katrina.The NRC's conjecture also betrays a reality disconnect reminiscent of the federal response to Katrina. Since 2001 there have been numerous breaches of airport security throughout the nation. Notably, in late 2005, there were three serious security breaches at Newark International Airport, one of the points of departure used by the September 11 hijackers. The most serious occurred on November 12, 2005, when a man driving a large S.U.V. barreled through the armed security checkpoint and drove in a secured area for 45 minutes before being found by NY/NJ Port Authority officers. Just this year, gaping holes in airport security were exposed when workers with access to secure areas were able to carry firearms in their carry-on bags onto a commercial jet departing from Florida.The PRSR must furthermore be upgraded to include high-speed attack by a jumbo jet of the maximum size anticipated to be in commercial use (such as the expanded version of the Boeing 747 and the Airbus A380) as well as unexpected attack by general aviation aircraft and helicopters. The PRSR must contemplate all such aircraft to be fully loaded, fueled and armed with explosives, 6 It is essential that the PRSR address not only the direct effect of impact, but the full potential aftereffects of (A) induced vibrations; (B) dislodged debris falling onto sensitive equipment; (C) a fuel fire; and (D) the combustion of aerosolized fuel (especially in combination with pre-existing on-site gases such as hydrogen). The PRSR must further take into consideration the cascading consequences of aerial assault on the full spectrum of plant installations. Inarguably, there is a wide range of on-site structures, not within hardened containment, that are critical to the safe operation of a nuclear plant. Spent fuel pools are of particular concern because the disposition of water could uncover the fuel. If plant workers are unable to effectuate replacement of the water (either because of fire or because they are otherwise incapacitated), experts warn, an exothermic reaction could cause the zirconium clad spent fuel rods to ignite a nuclear waste conflagration that would very likely spew the entire radioactive contents of the spent fuel pool into the atmosphere. Without question, hardening a nuclear power plant against aerial threat will necessitate significant upgrades in plant fortification. However even relatively modest measures such as the installation of Beamhenge and the placement of all sufficiently cooled spent fuel into Hardened On-Site Storage Systems (known as H.O.S.S.) would add measurable protection. STRATEGIC USES OF RIGS, TRUCKS AND S.U.V.'S In June 1991, the NRC denied the truck bomb petition of the Committee to Bridge the Gap and the Nuclear Information Resource Service, on the grounds that it was not realistic to believe a truck bomb would be employed in the U.S. Two years later, on February 26, 1993, terrorists drove a rented van packed with explosives into the underground garage of the World Trade Center, lighted a fuse and fled. Just a couple of weeks before that, a mentally unstable individual crashed his station wagon through the gates of the protected area of the Three Mile Island nuclear power station and evaded security for several hours before finally wrecking his vehicle by crashing into the turbine building. Thereafter, the NRC reconsidered its earlier assessment and has, on a number of occasions, upgraded reactor security standard to include some protections against land vehicles. Such upgrades, however, are insufficient in a post-9/11 world.Large Sport Utility Vehicles and pickup trucks on the road today can weigh over 8 tons, loaded, and -as do commercial vans- have considerably carrying capacity. Such vehicles could be used strategically in a number of ways.The first is as a mobile short range projectile bomb. A large, heavy vehicle packed with high explosives, even if not successful in penetrating concrete barriers, could result in the death or incapacitation of large numbers of plant workers, including security, personnel. Such casualties would be particularly likely to materialize if the vehicle bomb followed a previous diversionary event intended to draw security personnel to the plant perimeter. The second is as a transport vehicle for one team of attackers who are themselves armed or who wear explosive belts and could then themselves penetrate other areas of the facility. A terrorist wearing an explosive body belt can, in effect, be a precision guided weapon.7 q I The third and fourth scenarios are variations of the first two, with chemical agents substituted for or combined with explosives. (Indeed, insurgents in Iraq are increasingly combining explosives with chlorine gas and other chemical payloads in truck bomb detonations.) One or two such vehicles packed with the right toxins, could be expected to kill or disable a substantial number of workers, again, especially if the release followed a prior event which drew security personnel to the area, or simply to areas outside facility enclosures. Certain toxins can be lethal to anyone within miles. Using such agents, attackers wearing protective gear could then gain access to other areas of the facility.A fifth tactical use of vehicles would not even occur on site. Vehicles carrying explosives and/or chemical agents could be set off at critical regional transportation arteries such as major bridges, tunnels and highways. Notably, such incidents could be staged in a way that would not even alert authorities to the onset of terrorist activity. In-the New-York metro-politan region in which Indian Point is sited, for example, a series of major accidents occurring at or about the same time would not be an unusual occurrence. In fact, on July 25, 2003, the very day the Federal Emergency Management Agency declared that the Indian Point emergency plan provided "adequate" assurance of protection to the public, the entire New York metropolitan region was brought to a virtual traffic standstill after a tractor-trailer hit a beam on the George Washington Bridge and burst into flames, several minor accidents and a car fire took place on Interstate 95, and a truck got jammed under an overpass of the Hutchinson River Parkway. In 2006, a tanker truck carrying 8000 gallons of gasoline overturned on one of New York City's busiest highways, igniting a blaze that burned for hours and weakening the steel beams of an above bridge. Earlier this month a liquid propane explosion closed a 23 mile stretch of the New York State Thruway for hours, while firefighters had to stand by and watch the fire burn out because it was too hot to approach.The staging of a couple of incidents like those just noted, combined with an "accident" involving a tanker carrying hazardous gasses or liquids like liquefied ammonia, propane, chlorine, or vinyl chloride, prior to an assault would almost assuredly forestall the provision of outside assistance to a nuclear facility under attack.PLANTS MUST BE ABLE TO MOUNT A FULL DEFENSE WITHOUT RELIANCE ON OUTSIDE ASSISTANCE Whether or not an attack employs strategies designed to obstruct regional transportation routes, numerous studies and the actual events of 9/11, Katrina, and Rita (as well as relatively minor events such as the January 18, 2006 wind storm in NY) demonstrate beyond cavil that first responder forces and the National Guard do not have the resources, manpower, equipment or communications capabilities to swiftly and adequately respond to a major assault on a nuclear facility. Just this very month, a report of the Commission on the National Guard and Reserves detailed the ongoing problem of inadequate human, equipment, communications and financial resources plaguing the National Guard. This report calls into question the ability of the government to bring all necessary assets to bear in the immediate aftermath of a major domestic incident.8 In some regions -most notably the New York Metropolitan region, in which Indian Point is sited -roadway logistics and regular congestion alone would likely prevent assisting forces from reaching a nuclear plant under attack in time. It bears mention that SWAT team assembly takes approximately 2 hours, whereas an assault could be over in a matter of minutes.It is accordingly crucial that the NRC cedes the faulty assumption that plant personnel need only fend off attackers until law enforcement or military aid arrives. The fact that most regional first responders have little detailed knowledge of either the operational or internal layout of nuclear facilities further testifies to the folly of reliance upon the"cavalry". ELEVATED VULNERABILITY TO INFILTRATION DURING EVENT During a crisis event at a nuclear plant there also exists an elevated threat of infiltration by terrorists posing as first responders or National Guard. And in fact the imposter tactic has been used by terrorists in recent years with substantial success.Terrorists disguised as firefighters could take particularly strong advantage of this stratagem. Outside firefighters often respond to fires at nuclear power plants and many attack scenarios would be expected to involve fire. Firefighters would presumptively be seen as benign by plant personnel and would have a legitimate reason to move throughout a facility and "check" components such as electrical wiring. Moreover, bulky firefighter uniforms and equipment can hold and hide a host of articles that could be used for destructive purposes.DEFENSE AGAINST A SIZABLE MULTI-TEAM, MULTI-DIRECTIONAL FORCE In January 1991, the Nuclear Information Resource Service and the Committee to Bridge the Gap filed a joint Petition with the NRC requesting, inter alia, that the DBT be upgraded to 20 external attackers. The NRC rejected the petition in June 1991, asserting that an attack involving more than 3 assailants was unrealistic. September 11 was a demonstration of the profound limitations of governmental foresight. The September 11 plot involved 20 attackers (although only 19 were ultimately able to participate). The tragic 2004 siege at a school in Belsan, Russia involved more than 30 armed terrorists. It should be beyond question at this point that a terrorist attack could involve scores of attackers. Accordingly, the PRSR must assume at least two dozen attackers. Lessons learned from 9/11 and the many multiple coordinated terrorist actions that have transpired in Europe, Asia and the Middle East since then, also mandate the premise that attackers will act in several teams and that some of those teams may be sizable.Any carefully planned attack on a nuclear facility by knowledgeable individuals, would also involve several different modus operandi. The PRSR should therefore take into account the consequences of near-simultaneous damage to different plant installations, 9 systems and personnel (e.g., the effect of a small explosive-laden plane diving into the roof of a spent fuel pool coupled with the waterborne sabotage of the spent fuel pool intake system).A COORDINATED ATTACK ON MULTIPLE ON AND OFF-SITE TARGETS A related point is that, following 9/11, the NRC can no longer ignore the very real possibility that an attack on a nuclear power plant would occur commensurate with an attack on other regional infrastructure such as chemical plants and bridges. A coordinated attack designed to effectively eradicate a region would very likely preliminarily target communication, electrical power and/or transportation infrastructures. This would ensure that (A) the targeted region is reduced to mass confusion, (B) local and federal officials and responders would be overwhelmed, and (C)law enforcement and other first responders would be impeded from gaining access to the nuclear plant site.Certain areas of the U.S. offer a plethora of target opportunities and thus are particularly vulnerable to multiple target scenarios. Prime among them is the greater New York Metropolitan area (already in the terrorists' crosshairs) which contains numerous national landmarks, corporate headquarters, reservoirs, bridges, airports, transportation arteries and hazardous chemical plants, all in near vicinity to Indian Point, a mere 24 miles north of New York City.A CREDIBLE NUCLEAR PLANT SECURITY FORCE TESTING PROGRAM The deficiencies, failures, and chicanery that have long plagued the various manifestations of nuclear power industry security drills and force-on-force <FOF) testing have been exhaustively documented in recent years. Noteworthy investigations in this regard have been conducted by the Project on Government Oversight (augmented by testimony provided in 2002 Senate Environment and Public Works Committee hearings)and the United States General Accounting Office (which reported its findings in a September 2003 report entitled "Oversight of Security at Commercial Nuclear Power Plants Needs to Be Strengthened") as well as by the press. Problems with the FOF program are also addressed in the July 2004 Petition for Rulemaking to amend 10 CFR Part 73 to upgrade the DBT filed by the Committee to Bridge the Gap and the Comments on the DBT filed in 2006 by the Union of Concerned Scientists. CIECP fully endorses the recommendations made in previous filings by the Committee to Bridge the Gap and the Union of Concerned Scientists. CIECP urges the NRC in the strongest possible terms to upgrade drills and testing protocols to remedy the flaws that are a matter of public record and to take into account the realities noted herein. FOF tests must be sufficiently challenging to provide high confidence in the defensive capabilities of the security forces at the nation's 103 nuclear power plants. One clear failing of the FOF program to date has been the giving of excessive warning regarding upcoming tests. While some notice is necessary, one week should suffice. In addition, staff assignments should be frozen on the day of notice. This would eliminate the all too common practice of substituting a plant's most fit and accomplished security personnel in place of underachievers. 10 It is also critical that drills and the FOF program be revamped to eliminate manifest conflicts of interest. Examples of blatant conflicts of interest include: (1) The NRC allowing the nuclear industry's lobbying arm, the Nuclear Energy Institute (NEI) to award a FOF contract; and (2) The NEI, with NRC approval, then selecting Wackenhut, a corporation which contracts security guards to nuclear power plants in the U.S., to also be the contractor that supplies the mock adversary teams for the FOF tests.Such problems have reduced the value of testing to the point where the FOF program lacks public confidence. The program must be redesigned and monitored by an independent entity such as the very capable U.S. military.HIGH TARGET APPEAL REACTORS Prior terrorist attacks and plots against the U.S. have focused on major cities. It is a matter of fundamental logic that plants sited in highly populated metropolitan areas, particularly those with high symbolic value, face the greatest risk of being selected as a target.It is thus imperative that the PRSR be modified to mandate a customized approach.to high target nuclear facilities. SITE-SPECIFIC SAFETY-RELATED VULNERABILITIES It is highly unrealistic to exclude from the PRSR calculus the reality of aging structures, deteriorated conditions and compromised systems that exist at various nuclear power plants in the U.S. A facility-customized approach must be taken which adds problems which are known or reasonably suspected and which could have a' significant effect upon the ability of plant operators to maintain control during a major incident into the security equation.Prime among factors which may be site-specific are:* Corrosion and Embrittlement: For example, a risk of corrosion of the steel liner of the reactor containment at the Oyster Creek Nuclear Generating Station (Oyster Creek) was recently identified. A qualified corrosion expert has warned that the risk may be high enough to cause buckling and collapse. Manifestly, corrosion or embrittlement-weakened structures and components are more vulnerable to the effects of heat and combustion.

• Vulnerability to Fire: Fire detection and suppression equipment and fire barriers are crucial to reactor safety. Over 20 years ago a worker at the Brown's Ferry Unit 1 reactor accidentally started a fire which destroyed emergency cooling systems and severely compromised the plant's ability to monitor its condition.

In response, the NRC increased fire safety standards. In recent years, the NRC has effectively relaxed those standards. This is exceedingly unwise. During the chaos and threat level that would surely exist during a terrorist attack, human beings cannot be presumed to be able to take the actions necessary to protect critical systems from fire. The systems themselves must have integral safeguards. Yet plants such as Arkansas Nuclear One, Catawba, Ginna, H.B.11 C7 (0 Robinson, Indian Point, James A. Fitzpatrick, McGuire, Shearon Harris, Vermont Yankee and Waterford have been identified as having fire barrier wrap systems that failed fire tests. Fireproofing problems such as these jeopardize safe shutdown and must be recognized as a degradation of defense-in-depth protection. In addition, any plant fire hazard analyses must assume damage to multiple rooms and multiple structures, a circumstance that could easily result from an aircraft impact.* Integrity of Structures that Support Mobility: While the focus of NRC regulatory review is on structures and equipment directly related to safe operational function, the conditions that may prevail during an assault would likely require plant personnel to be able to move rapidly throughout the facility. The evaluation of the reliability of structural features such as stairways (which might buckle or melt during a fire) is accordingly critical." Electrical System Problems: In 2003, a cable failure knocked out power to approximately half the safety systems at Oyster Creek, including security cameras, alarms, sensors, pumps and valves. In February 2003, all 4 of the backup generators at Fermi became simultaneously inoperable. In December 2001, Indian Point reactor 2 lost power due to a malfunction of the turbine, then lost back-up power to the reactor coolant system because of a second electrical failure. During the August 2003 blackout that struck the Northeast, following the loss of off-site power, two of Indian Point's emergency backup generators (both of which had been previously flagged as having problems) failed to operate. In view of the severe consequences failures such as these could have were they to occur during a major incident, known plant electrical system vulnerabilities must be taken into consideration.

• Cooling System Problems:

Cooling system problems and design deficiencies have plagued a number of plants in recent years. In some cases the NRC has allowed plants to operate for long periods with compromised emergency cooling systems. For example, the Salem nuclear power station had experienced two years of repeated malfunctions of its high-pressure coolant-injection system prior to the time, in October 2003, when operators unsuccessfully tried to use it to stabilize water levels following a steam pipe burst. And the NRC has allowed reactors with emergency sump pumps flagged as likely to become clogged and inoperative to remain in operation for many years without repair. The Los Alamos National Laboratory, for instance, concluded that the sump pumps at Indian Point reactors 2 and 3 could become clogged in as little as 23 minutes and 14 minutes, respectively. While, upgrades are being made, the failure of the NRC to mandate immediate correction of cooling system vulnerabilities calls its oversight capabilities seriously into question. Indeed the functional declination of critical systems must be deemed a constituent element of site-specific PRSR analyses.ELIMINATE COMMERCIAL CONSIDERATIONS FROM THE PRSR CALCULUS The commercial interests of the nuclear industry are of valid concern to nuclear utilities and the NEI; they should not be of concern to the NRC. There is no justification for 12 9i7 jeopardizing national security and the health and safety of the public -even to the smallest degree -to safeguard corporate profits.The NRC has stated that its promulgated security standards are based upon the analysis of the largest threat against which a "private security force could reasonably be expected to defend" [emphasis added] 70 FR 67385.Both the NRC and the industry have acknowledged that, in their estimation, a private guard force should not be reasonably expected to defend against a 9/11 -type attack involving aircraft. Such an attack, apparently, is deemed to fall under the loophole of 10 CFR Sec. 50.13, which exempts reactor operators from defending against "an enemy of the United States, a foreign government or other person". The perimeter of this "enemy of the United States provision has never been defined, so there is no way to know how far it extends. However, it is abundantly clear from the public record that the NRC has drawn the,.line-at-point=where the-profit margins of nuclear power operators might be significantly affected. Unfortunately, the terrorists are constrained by no such boundary.Congress has.charged the NRC with the obligation to protect the public health and safety. This must not be viewed simply as a guideline; it must be viewed as an uncompromised mandate.If the NRC does not believe its licensees can afford the security upgrades necessary to protect the nation's nuclear reactors against the full potential threat, it must act with forthrightness and publicly demand that the Department of Homeland Security or the U.S. military assume responsibility for domestic nuclear power plant security.CONCLUSION The 9/11 Commission observed: "Across the government, there were failures of imagination, policy, capabilities... The most important failure was one of imagination. We do not believe leaders understood the gravity of the threat." As a public interest group we ask: What needs to happen before the gravity of the threat is not only understood, but acted upon?Respectfully submitted, COUNCIL ON INTELLIGENT ENERGY& CONSERVATION POLICY (New York)By Michel C. Lee, Esq.Chairman (914) 393-2930 13 APPENDIX A Since September 11, 2001, there has been much speculation about the vulnerability of nuclear power plants to aerial attack. Certainty, however, is in short supply.What is known is that none of the nuclear reactors presently operational in the United States were built to withstand the crash of a jumbo jet, much less the crash of super jumbo such as the A380 which will take to the air weighing 1.2 million pounds, has a wingspan almost as long as a football field, is 8 stories tall, and is 3 times as large as the 767s that brought down the Twin Towers.Nevertheless studies that have addressed the prospect of planes hitting nuclear plants include the following: 1974: To date the only published peer reviewed study on the vulnerability of U.S.nuclear power plants was conducted by General Electric, the leading builder of nuclear plants, and published in the industry journal Nuclear Safety. GE looked at accidents -not terror attacks -and concluded that were a "heavy" airliner to hit a reactor building in the right place, it would almost certainly rip it apart. Such a hit would also most likely damage the reactor core and both the cooling and emergency cooling systems. {NOTE: The GE study defined a "heavy" plane as one weighing more than 6 tons. The Boeing 757 which gouged a 100 foot gash through the reinforced concrete of the Pentagon weighed between 80 and 100 tons. A fully loaded 767 weighs over 200 tons. The Airbus 380, expected to be launched into commercial use later this year, takes to the air weighing 1.2 million pounds, hundreds of thousands of pounds heavier than the Boeing 747, the current jumbo of the sky.]1982: A technical report (previously publicly available) of a study conducted by the U.S.Army Corps of Engineers at the NRC's behest focused on plane crash analyses at the Argonne National Laboratory. The Corps concluded that planes traveling at a speed of over 466 mph would crash through the average reactor containment structure noting"account has been taken of the internal concrete wall which acts as a missie barrier... It would appear, however, that this is too optimistic since vaporized fuel, hot gaseous reaction products, and to a certain extent portions of liquid fuel streams will flow around such obstructions and overwhelm internal defenses...." [NOTE: An FBI analysis estimated that American Airlines Flight 11, which hit the north tower of the World Trade Center, was traveling at a speed of 494 mph, and that United Airlines Flight 175, which hit the south tower, was traveling at 586 mph, a speed far exceeding its design limit for the altitude.] 2000: A NRC study published less than a year before September 11 calculated that I out 2 commercial airplanes flying in the year 2000 were large enough to penetrate even a 5 foot thick reinforced concrete wall 45% of the time. Specifically, the study states,"aircraft damage can affect the structural integrity of the spent fuel pool or the availability of nearby support systems, such as power supplies, heat exchangers, or water makeup sources and may also affect recovery actions... It is estimated that half the commercial 14 aircraft now flying are large enough to penetrate the 5 foot thick reinforced concrete walls." [NOTE: The thickness of the top of certain reactor domes is 3 and-a-half feet.]2002: The German Reactor Safety Organization (GRS) a scientific-technical research group that works primarily for nuclear regulators in Germany conducted an extremely detailed study that determined that terrorists can, with a strategically targeted airplane crash, initiate a nuclear accident. (A secret Ministry document that summarized the report was leaked to the German and Austrian press and subsequently translated into English.) The GRS study used dynamic computation modeling that looked at the potential consequences of a wide range of impact possibilities on different plant equipment and installations. Different types of airplanes, velocities, angles of impact, weight loads and fuel effects were considered, as were various sequences of events.Aside from the basic finding of vulnerability, the GRS study is significant for recognizing the limitations of even its highly complex analyses. Key unknowns include the impacts of fire loads on many kind of materials and equipment as well as the behaviors of various-combustive-materials under the conditions of a plane crash.2004: In 2004 the U.K. Parliamentary Office of Science and Technology (OST) issued a secret report on the risks of terrorist attacks on nuclear facilities to the U.K. House of Commons Defense Committee. The OST report was leaked to the magazine New Scientist, which reported the OST conclusion that a large plane crash into a nuclear reactor could release as much radiation as the1986 accident at Chernobyl, while a crash into the nuclear waste tanks at the U.K.'s Sellafield facility could cause several million fatalities. From these studies it is clear that there exists a reasonable basis for concern regarding malevolent deployment of aircraft against nuclear power facilities. It should also be evident that all studies on this topic are, in substance, educated conjecture. The current state of computer modeling is not up to analyzing the full range of physical and chemical interactions that could occur under the incalculable range of different kinds of aircraft, approaching at different angles, at different speeds, hitting different structures, which all have facility-unique room and equipment layouts, and different substance, chemical, and ventilation-related conditions. A lesson in the unpredictable consequences of airplane crashes was brought home on September 11 (when even the 47 story tall 7 World Trade Center that was not struck collapsed for reasons engineers have yet to fully determine). A lesson in the limitations of advanced computer modeling can also be learned from the Columbia space shuttle disaster.[-DBT and PRSR]15[0,0 EXHIBIT FF UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION WASHINGTON, DC 20555-0001 May 2, 2003 NRC REGULATORY ISSUE

SUMMARY

2003-09 ENVIRONMENTAL QUALIFICATION OF LOW-VOLTAGE INSTRUMENTATION AND CONTROL CABLES ADDRESSEES All holders of operating licenses for nuclear power reactors, except those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel.INTENT The U.S. Nuclear Regulatory Commission (NRC) is issuing this regulatory issue summary (RIS)to inform addressees of the results of the technical assessment of GSI-168, "Environmental Qualification of Low-Voltage Instrumentation and Control (I&C) Cables." The scope of GSI-168 is limited to safety-related, low-voltage I&C cables. This RIS requires no action or written response on the part of an addressee. BACKGROUND In support of the resolution of GSI-168, the NRC sponsored cable test research at Wyte Laboratories and the Brookhaven National Laboratory. The resulting NRC technical assessment was essentially based on reviews and analyses of the research results of six loss-of-coolant-accident (LOCA) cable tests, condition-monitoring tests on I&C cables, and information provided by the nuclear industry. Technical assessments were coordinated with the nuclear industry and the Institute of Electrical and Electronics Engineers. Following the completion of the NRC research effort, the staff concluded that typical I&C cable qualification test programs include numerous conservative practices thatcollectively provide a high level of confidence that the installed I&C cables will perform their intended functions during and following design basis events as required by 10 CFR 50.49, "Environmental Qualification (EQ) of Electric Equipment Important to Safety for Nuclear Power Plants." These conservative practices continue to support the current use of a single prototype during qualification testing and, therefore, a successful test provides a high level of confidence that these cables will be able to perform their safety functions during and following a design basis event. However, cable LOCA test failures that occurred during the NRC-sponsored research program indicate that in certain cases the original margin and conservatism inherent in the qualification process have been reduced. Licensees have stated in a few cases that a reduction in margin can be addressed by monitoring operating service environments (temperature, radiation, and humidity)ML031220078 RIS 2003-09 Page 2 of 5 to ensure that operating conditions do not exceed the parameters that were assumed during qualification testing. In this regard, walkdowns to look for any visible signs of anomalies attributable to aging, With particular emphasis on localized adverse environments, coupled with the knowledge of the operating service environments, could be sufficient to ensure that qualification is maintained. DISCUSSION OF TECHNICAL ASSESSMENT The technical assessment of GSI-168 is based on reviews and analyses of the research results of six LOCA tests, condition-monitoring tests on I&C cables, and information provided by the nuclear industry. Summaries of significant research findings are presented below. Details of the NRC technical assessment of GSI-168 are available in the NRC Agencywide Documents Access and Management System (ADAMS), Accession No. ML021790551. Current EQ Process. (40 Years)The current EQ-process is adequate for assuring that low-voltage I&C cables Will perform their intended functions for 40 years. When I&C cables are qualified in accordance with NRC regulations, the overall EQ process provides reasonable assurance that I&C-cables will perform their intended safety-related functions during their qualified life. Specifically, 10 CFR 50.49(e)requires consideration of all significant types of aging degradation that can affect the component's functional capability. Compliance with 10 CFR 50.49 provides reasonable assurance that the cables Will perform their intended functions during and following design basis events after exposure to the effects of service condition aging. Further, some licensees have implemented monitoring programs to ensure that service conditions will not exceed those assumed during the original qualification. Inspection, surveillance, condition monitoring, and trending of selected parameters for any installed safety-related cable system could increase the confidence in cable performance. EQ Process for License Renewal (60 Years)Licensees that have addressed license renewal recognize that knowledge of the operating service environments is essential to extending the qualified life of I&C cables. Where measured environmental service conditions are less severe than those used in the original qualification and when the cables are not degraded, the licensees assessed the difference between the operating environment and the original qualification environment to extend the qualified life of the cables to 60 years by reanalysis. This approach, based on the Arrhenius methodology, has been found acceptable by the staff during its review of license renewal applications. Results of Cable LOCA Tests Detailed information on the six cable LOCA tests conducted at Wyle Laboratories is provided in NUREG/CR-6704, "Assessment of Environmental Qualification Practices and Condition Monitoring Techniques for Low-Voltage Electric Cables." It should be noted that the LOCA conditions selected for the simulated tests were consistent with those used in the original qualification of the cables. All cable specimens in Test Sequences 1, 2, and 3 passed the LOCA test and the voltage withstand test. Samuel Moore cable specimens failed the voltage withstand test during Test Sequence 4, and Okonite bonded- jacket-cable specimens-failed the RIS 2003-09 Page 3 -of 5 LOCA test and the voltage withstand test in Test Sequence 5. All of the Test Sequence 6 cable specimens, aged to 60 years, exhibited high leakage currents and several cable specimens failed the voltage withstand test. The summary results of the six test sequences are discussed in Attachment 1.Research Findings on Cable Condition-Monitoring Techniques NRC research results on I&C cables indicate that meaningful information can be derived from testing samples of polymeric materials under controlled laboratory conditions. With certain limitations (accessibility being the biggest limitation), some of these test results can be applied in the in situ assessment of installed cable systems. The research concluded that a combination of condition-monitoring techniques could be effective since no single technique is currently adequate to detect insulation degradation of I&C cables. Based on the test results, conclusions were drawn regarding the effectiveness of the techniques studied for monitoring cable condition and are presented in the attachment. Industry Good Practices for Condition-Monitoring During the NRC review of GSI-168, the industry stated that cable aging evaluations are ongoing throughout plant life. When unexpected localized adverse conditions are identified, the condition of the affected cables is evaluated and appropriate corrective action is taken.Monitoring or inspection of environmental conditions or component parameters was generally conducted to ensure that the component is within the bounds of its -qualification basis. The combination of licensee-specific activities and industry-supported activities that were developed for condition-monitoring can support a high level of confidence that installed safety-related cables would remain qualified to perform their safety functions in the event of an accident. In addition, the nuclear industry continues to advance the state-of-the-art in cable condition-monitoring from the simplest techniques to the most sophisticated. The staff has concluded that, although a single reliable condition-monitoring technique does not currently exist, walkdowns to look for any visible signs of anomalies attributable to cable aging, coupled with monitoring of operating environments, have proven to be effective and useful.Risk Assessment The state-of-the-art for incorporating cable aging effects into probabilistic risk assessment is still evolving and current assumptions that need to be made on the failure rate and common cause effects are based on sparse data. One of the key assumptions of the risk assessment is that operating environments are less severe than or the same as those assumed during qualification testing. These assumptions can be relied upon provided licensees have ongoing.knowledge of environmental operating conditions at the nuclear power plants. RIS 2003-09 Page 4 of 5

SUMMARY

OF ISSUE The technical assessment of GS1-168 is complete and the research findings are published in NUREG/CR-6704, Vols. 1 and 2 (Accession Nos. ML010460247 and ML010510387). The significant research findings that resulted from this effort are as follows: The current equipment qualification process for, low-voltage I&C cables is adequate for the duration of the current license term of 40 years.Because of the failures of some I&C cables in the NRC LOCA tests, the original margin and conservatism inherent in the qualification process have been reduced. Adequate margin may be ensured through ongoing monitoring of plant operating environments to confirm that service conditions do not exceed those assumed during qualification testing and the cables are within the bounds of their qualification basis.Walkdowns, with particular emphasis on the identification of localized adverse environments, to look for any visible signs of anomalies attributable to cable aging, coupled with the monitoring of operating environments, were proven to be effective and useful for ensuring qualification of cables.For license renewal, a reanalysis (based on the Arrhenius methodology) to extend the life of the cables by using the available margin based on a knowledge of the actual operating environment compared to the qualification environment, coupled with observations of the condition of the cables during walkdowns, was found to be an acceptable approach.A combination of condition-monitoring techniques may be needed since no single technique is currently demonstrated to be adequate to detect and locate degradation of I&C cables. Monitoring I&C cable condition could provide the basis for extending cable life.BACKFIT DISCUSSION This RIS requests no action or written response. Consequently, the staff did not perform a backfit analysis.FEDERAL REGISTER NOTIFICATION A notice of opportunity for public comment was not published in the Federal Register because this RIS is informational. RIS 2003-09 Page 5 of 5 PAPERWORK REDUCTION ACT STATEMENT This RIS does not request any information collection. If there are any questions concerning this RIS, please contact the person noted below.IRA/William D. Beckner, Program Director Operating Reactor Improvements Program Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation Technical Contact: T. Koshy, NRR 301-415-1176 .E-mail: txk(cnrc..qov Attachments:

1. Results of Cable LOCA Tests and Findings On Cable Condition-Monitoring Techniques

2. List of Recently Issued NRC Regulatory Issue Summaries Attachment 1 RIS 2003-09 Page 1 of 6 RESULTS OF CABLE LOCA TESTS AND FINDINGS ON CABLE CONDITION-MONITORING TECHNIQUES CABLE LOCA TESTS Detailed information on the six cable LOCA tests conducted at Wyle Laboratories is provided in NUREG/CR-6704, "Assessment of Environmental Qualification Practices and Condition.

Monitoring Techniques for Low-Voltage Electric Cables." It should be noted that the LOCA conditions selected for the simulated tests were consistent with those used in the original qualification of the cables. The summary results of the six test sequences are presented below.Test Sequence 1: XLPE Insulated Cables Aged to 20 Years The samples tested in this sequence were #14 and #16 American wire gauge 4AWG) XLPE-insulated cables with a Neoprene overall outer jacket manufactured by Rockbestos, with the trade name "Firewall IIl." The preaging parameters for the four groups of specimens in this test sequence were as follows: Group 1: No accelerated aging (control specimens) Group 2: Accelerated aging to match naturally aged cable (2.86 hr @ 248 OF + 0.63 Mrad)Group 3: Naturally aged cable (10 years old)Group 4: Accelerated aging to 20 years (648.5 hr,@ 302 OF + 26.1 Mrad)The LOCA conditions simulated included exposure to 150 Mrad of accident radiation, followed by exposure to steam at high temperature and pressure (346 OF and 113 psig peak conditions, double-peak profile) and chemical spray. The test duration was 7 days. All cable specimens passed the LOCA test sequence, including the post-LOCA voltage withstand test.Test Sequence 2. EPR-Insulated Cables Aged to 20 Years The samples used in this sequence were three-conductor .(3/C) and four-conductor (4/C)#16 AWG, 600v AIW cables with ethylene propylene (EPR) and unbonded chlorosulfonated polyethylene (CSPE, with the trade name Hypalon), covering the insulation of each conductor and the conductor bundle. The preaging parameters for the four groups of specimens in this test sequence were as follows: Group 1: No accelerated aging (control specimens) Group 2: Accelerated aging to match naturally aged cable (28.5 hr @ 250 OF + 3.3 Mrad)Group 3: Naturally aged cable (24 years old)Group 4: Accelerated aging to 20 years (82.2 hr @ 250 OF + 25.7 Mrad)The LOCA conditions simulated included exposure to 150 Mrad of radiation followed by exposure to steam (340 OF and 60 psig peak conditions, single-peak profile) and chemical spray. The test duration was 7 days. All cable specimens passed the LOCA test sequence, including the post-LOCA voltage withstand test. Attachment 1 RIS 2003-09 Page 2 of 6 Test Sequence 3. XLPE-Insulated Cables Aged to 40 Years The test specimens were cross-linked-polyethylene (XLPE)-insulated cables with a Neoprene overall outer jacket manufactured by Rockbestos, with the trade name "Firewall Ill." The preaging parameters for'the four groups of specimens in this test sequence were as follows: Group 1. No accelerated aging (control specimens) Group 2. Accelerated aging to simulate the exposure of the naturally aged specimens (9.93 hr @ 248 OF + 2.27 Mrad)Group 3. Naturally aged 10-year-old cable Group 4. Accelerated aging to simulate 40 years of qualified life (1301.16 hr @ 302 °F + 51.49 Mrad)The LOCA conditions simulated included exposure to 150 Mrad of accident radiation followed by exposure to steam (using the same LOCA profile as used in Test Sequence 1) and chemical spray.One of the Group 4 specimens did not hold the full 500 volts used for insulation resistance (IR)testing even after its splices were removed. The cause of this failure was determined to be human error in handling the test specimen. With the exception of the damaged specimen, all cable specimens passed the LOCA test sequence, including the post-LOCA voltage withstand test.Test Sequence 4. Multiconductor Cables The objective of this test sequence was to determine whether multiconductor cables have any unique failure mechanisms that are not present in single-conductor cables. The test specimens were #12 AWG, 3/C, 1,OOOV EPR-insulated cables with individual and outer CSPE jackets manufactured by Anaconda. In addition, this test sequence included #16 AWG, 2/C, 600V Samuel Moore cables with ethylene propylene diene monomer (EPDM) insulation and a CSPE bonded individual jacket with a Dekorad overall outer jacket. The preaging groups in this test sequence were as follows: Group 1. Anaconda and Samuel Moore cables with no accelerated aging (control specimens) Group 2. Samuel Moore cables with accelerated aging to simulate 20 years of qualified life (84.85 hr @ 250 OF + 25.99 Mrad)Group 3. Anaconda cables (169.20 hr @ 302 OF + 53.60 Mrad) and Samuel Moore cables (169.05 hr @ 250 OF + 51.57 Mrad) with accelerated aging to simulate 40 years of qualified life.The LOCA conditions simulated included exposure to 150 Mrad of accident radiation followed by steam (346 OF and 113 psig peak conditions, as used in Test Sequences 1 and 3) and chemical spray. During the post-LOCA voltage withstand test, all of the Anaconda cables and Samuel Moore cables aged to simulate 20 years performed acceptably. However, two out of three Samuel Moore specimens aged to simulate 40 years could not hold the 2,400V test voltage on one conductor. Inspection of the two specimens revealed a single pinhole in the insulation of each failed conductor. It was concluded that the failures were due to localized degradation of the insulation, which caused the high-potential test to puncture the insulation on Attachment 1 RIS 2003-09 Page 3 of 6 the two failed conductors. There was no general degradation of the insulation along -the length, of the cable specimens and no unique failure mechanism was observed between the single-conductor and multiconductor cables. Therefore, based on these test results, the issue of a unique failure mechanism for multiconductor vs. single-conductor low-voltage I&C cables was not demonstrated. Test Sequence 5. Bonded Jacket Cables The samples- used in this sequence were Anaconda 3/C, #12AWG, 1,000V cables with EPR insulation and a CSPE jacket; Samuel Moore 2/C, #16 AWG, 600V cables with EPDM insulation and a CSPE jacket; and Okonite 1/C, #12 AWG, 600V cables with EPR insulation and a CSPE jacket. The preaging groups in this test sequence were as follows: Group 1. Specimens with no accelerated aging (control specimens) Group 2. Specimens from A, S, and 0 with accelerated aging to simulate 20 years of qualified life (A: 84 hr@ 302 OF + 25.69 Mrad; S: 84 hr.@ 250 OF + 25.99Mrad; and 0: 252 hr @ 302 °F + 25.79 Mrad)Group 3. Specimens from A, S, and 0 with accelerated aging to simulate 40 years of qualified life (A: 169 hr @ 302 OF + 51.35 Mrad; S: 169 hr@ 250 OF + 51.57 Mrad;and 0: 504 hr @ 302 OF + 51.49 Mrad).The LOCA conditions simulated included exposures to 150 Mrad of accident radiation, followed by steam (double-peak-LOCA profile, as used in Test Sequences I and 3 with a test duration of 10 days) and chemical spray. After post-LOCA inspections, a voltage withstand test was conducted on each of the cable specimens. All of the Samuel Moore and Anaconda cables performed acceptably, while one of the two Okonite specimens in Group 2 and all 3 Okonite specimens in Group 3 failed the 2,400V voltage withstand test. It was observed that the insulation on the Okonite cables had split open along their length during the simulated LOCA, exposing the bare conductor underneath. It was concluded that the failures in the Okonite specimens were caused by differential swelling of the bonded CSPE individual jacket and the underlying EPR insulation. The Okonite Company has subsequently requalified the 1/C, #12 AWG Okonite Okolon composite cable based on an Arrhenius activation energy of 1.24eV. Calculations using this activation energy (225 hr @ 150 'C + 200 Mrad and 300 hr @ 150 'C + 100 Mrad) extrapolate to a 40-year qualified life at 75 'C and 77 °C, respectively. Additional details of the recent Okonite cable requalification program are contained in Regulatory Issue Summary 2002-11 (ADAMS Accession No. ML022190099), issued August 9, 2002.Test Sequence 6: EPR- and XLPE-Insulated Cables Aged to 60 Years The test specimens were Rockbestos cables (same as Test Sequences land 3), AIW cables (same as Test Ssequence 2), Samuel Moore cables (same as Test Sequences 4 and 5), and Okonite cables (same as Test Sequence 5). The preaging groups in this test sequence were as follows: Group 1: No accelerated aging (control specimens) Attachment 1 RIS 2003-09 Page 4 of 6 Group 2: Rockbestos cables (1366 hr @ 302 OF +77 Mrad), Okonite cables (756 hr@ 302 OF+ 77 Mrads), AIW cables (252 hr @ 250 OF + 38 Mrad), and Samuel Moore cables (252 hr @ 250 OF + 77 Mrad) with accelerated aging to simulate 60 years of qualified life.The LOCA conditions simulated included exposure to either 75 Mrad (AIW cables only) or 150 Mrad of accident radiation, followed by exposure to steam (double-peak LOCA profile, as used in Test Sequences 1 and 3, with peak conditions of 346 OF and 113 psig and a duration of 10 days) and chemical spray.Following the post-LOCA investigation, the test specimens were subjected to a voltage withstand test. In general, all of the specimens aged to 60 years exhibited a weakening of the insulation, which was manifested in the form of high leakage currents. Some of the specimens were unable to hold the required 2,400V of the voltage withstand test.Error in Irradiation Dose Following the completion of cable LOCA testing at Wyle Laboratories, the Georgia Institute of Technology notified Wyle Laboratories of an error in irradiation dose that affected LOCA tests 2 through 6. All specimens received irradiations from 6% to 10.5% lower than previously reported. Prior to completion of the GSI-168 technical assessment, the reported error in irradiation dose was evaluated by the Brookhaven National Laboratory and the NRC staff to determine if this error would impact the research findings. The staff's review concluded that none of the conclusions of the GSI-168 technical assessment are impacted by this error. The staff recognizes that the radiation dose of 50 Mrad used for qualification is conservative when compared to the 40-year dose seen during normal service in a nuclear power plant.RESEARCH FINDINGS ON CABLE CONDITION-MONITORING TECHNIQUES Based on the results of the testing, the following conclusions were drawn regarding the effectiveness of the techniques studied for monitoring cable condition. Visual Inspection Visual inspection does not provide quantitative data; however, it does provide useful information on the condition of the cable that is relatively easy and inexpensive to obtain and that can be used to determine whether further investigation of the cable condition is warranted. Visual inspection is demonstrated to be a valuable source of information in any cable condition-monitoring program.Elongation at Break (EAB)EAB was found to be a reliable technique for determining the condition of the polymers studied.While EAB provides trendable data that can be readily correlated with material condition, it is a destructive test and cannot be used as an in situ means of monitoring electric cables unless sacrificial cable specimens are available. Attachment 1 RIS 2003-09 Page 5 of 6 Oxidation Induction Time Method (OITM)OITM was found to be a promising technique for monitoring the condition of electric cables.Results show that aging degradation can be trended with this technique for both XLPE and EPR insulation. However, a small sample of cable material is needed to perform -this test.Oxidation Induction Temperature (OIT)OIT, which is related to OITM, was found to be less sensitive for detecting aging degradation of the polymers studied. OITM is preferred at this time.Fourier Transform Infrared (FTIR) Spectroscopy In terms of ability to trend aging degradation in the polymers studied, FTIR spectroscopy was found to provide inconclusive results. The results tend to show a consistent trend with age.However, the technical basis for the trend remains questionable. Indenter The indenter was found to be a reliable device that provides reproducible, trendable data for monitoring the degradation of cables in situ. It is limited to accessible sections of the cable, but it was found to be effective for monitoring the condition of common cable jacket and insulation materials and can be used for monitoring localized and accessible segments of low-voltage electric cables.Hardness The results of the hardness test indicate that, over a limited range, hardness can be used to trend cable degradation: However, different probes must be used to accommodate the change in material hardness. Also, puncturing the cable insulating material is a potential concern with this technique and must be taken into consideration. Insulation Resistance Degradation of cable insulation can be trended with this technique. As cables degrade, a definite change in insulation resistance can be detected that can be correlated to ,cable condition. Using 1-minute and 10-minute readings to calculate the polarization index enables the effects of temperature and humidity variations to be accounted for. This technique can be used as an in situ condition-monitoring technique. Dielectric Loss This technique was found to provide useful data for trending the degradation of cable insulation. As the cables degrade, a definite change in phase angle between an applied test voltage and the circuit current can be detected at various test frequencies and correlated to cable condition. This technique can be used as an in situ condition monitoring technique. However, it is more effective when a ground plane is an integral element of a cable system. Attachment 1 RIS 2003-09 Page 6 of 6 Functional Performance This technique alone does not provide sufficient data to determine the condition of a cable. It is a "go-no go" type of testand may not be effective in detecting degraded conditions and impending failures. Further, functional performance testing is not considered an effective method for determining,.in situ, the LOCA survivabiltiy for a particular cable.Voltage Withstand The capability of the insulating materials to withstand the circuit voltage is an indication of its dielectric performance. In order to detect defects in an incipient state, applied voltages may have to be elevated considerably above the rated voltages of the systems; further, the equipment at both ends of a cable system under test must be either disconnected or protected. Voltage withstand tests may result in unanticipated degradation of cables and can result in failures. Therefore; the risk of causing either catastrophic or incipient damage to cable insulation makes this an unsuitable method for assessing the LOCA survivability of low-voltage electric cables in situ. EXHIBIT FF FF Replacing the Electricity Generated at Indian Point -Westchester Citizen's Awareness Network -White Paper November 5, 2007 The Indian Point Energy Center is located on a prime piece of commercially zoned, river front property. This valuable piece of property is an asset to the community no matter what it is used for or who owns it. Property taxes, or a renegotiated payment in lieu of taxes, will regularly fall due regardless of whether the nuclear reactors are operating or not. Taxes from Indian Point contribute less than 1% to Westchester County's budget. Nonetheless county officials~have voted unanimously-for plant closure. In-the town-of Buchanan a much higher percentage of the budget is from the PILOT negotiated by Entergy. Initially a reduction in the PILOT could adversely affect the tax rates, job security and economic activity.There is time for elected officials to plan ahead and address these concerns in a business like fashion before the current operating license expires. However, this is immaterial to the re-licensing process. It is the responsibility of elected officials to come to some reasonable and just social policy in regard to these matters as has been done in the past when businesses throughout Westchester have relocated or gone bankrupt. Energy policy and the health and safety of 21 million people cannot be held hostage to 750 jobs at Entergy and resultant economic activity. After decommissioning is completed, it is unlikely that the property will sit idle. It has excellent access to the regional electric grid and gas supply lines in one of the most densely populated areas of the country. Many uses, including alternative methods for generation of electricity, are possible. This possibility was noted in the Levitan study when they reported that alternative on site generation had the potential to avoid or mitigate the costs and impacts of closure of Indian Point.There is time for elected officials to plan ahead and address these concerns in a business like fashion before the current operating license expires. Contribution of Indian Point to Westchester and New York City The percentage of electricity contributed by Indian Point to the metropolitan area has frequently been misstated. It is important to have an accurate figure for future planning. The figures below clarify the contributions from both Indian Point 2 and 3. They provide an accurate picture of how to figure the capacity of the plant as a percentage for the region.The combined output from Indian Point 2 and 3 of 2,000 MW represents-it--percent of the total generating capacity for New York City and Westchester. On a typical day when both plants are operating normally this is is approximately 16% percent of the energy delivered in the region and can range up to 23%. The percentage varies depending on total demand which generally runs between 10 and 13,000MW. It is important to note that none of the electricity produced at Indian Point is sold directly to industrial or residential consumers. It is sold to either Consolidated Edison or New York State Power Authority as part of the "basket" of electricity they use to meet the needs of customers in the region.The region consists of Westchester and NYC, the metropolitan are. However, the entire region must be considered as a whole when generating capacity or percentages of use are considered. This is because power from many different sources is used to fill the "basket"of electricity which serves the region .You cannot divide the capacity of the generators at Indian Point by the amount of electricity used to get a percentage of use for either NYC or Westchester alone. The mix of purchased electricity is subject to market conditions and long term contracts, just like any other business arrangement on the free market. The market has worked as a credible mechanism for meeting changes in the supply side of the equation should Indian Point be removed from the mix.Certainly when either of the generators at Indian Point has been down for prolonged periods, the market has adjusted at little or no extra cost to the consumer.The following figures which detail the distribution of power to the region are from 2003.102, IP2 Indian Point 2 produced 1,000 MW and sold its power to Consolidated Edison. Con Ed, like NYPA, purchases electricity from different sources. Con Ed distributes approximately 10,000MW to 13,000MW daily throughout the region which covers both Westchester and NYC. This figure includes the amount provided NYPA and transmitted by Con Ed. Like NYPA, Con Edison purchases wholesale and is responsible for providing retail electricity to its own customers which are residential and non-government businesses in Westchester County and New York City. It does not sell outside of this region. Because the power it purchases comes from-a variety of sourcesitis not possible to arrive at percentage of this figure contributed by Indian Point for use in part of the region such as NYC. All of the electricity purchased from different sources goes into the same "basket" for the region which includes NYC and Westchester. The only accurate figure is one which includes the entire region, both NYC and Westchester. An example of this is 1,000MW, the production capacity of IP2, divided by 11,000MW which is the total amount of megawatts used by Con Ed in the chart below. In this case Indian Point contributed a maximum of 9% of the electricity sold to Con Ed for use in the region. Adding the percentage of use from NYPA and Con Ed does not produce an accurate figure of regional use because Con Ed buys and distributes so much more electricity. Total capacity divided by total purchases yields the accurate percentage of use and, of course varies, depending on the amount used.Westchester County 345,000 customers 1,430MW New York City 2.8 million Customers 9,570MW Total: 11,000MW Source: Con Ed 103 IP-3 Indian Point 3 produced 986MW which it sold to the New York Power Authority. In addition NYPA used an additional 5,500MW from its own plants for a total of 6,486MW. They purchased additional electricity from Canada and New England as needed. This means that no more than 15% of the total amount of power sold by NYPA to Westchester and NYC is generated at Indian Point 3 on any given day when NYPA purchases the entire capacity of the plant.(986MW divided by 6,486MW) The percentage can frequently be less if NYPA obtains cheaper electricity from other sources. In which case, Entergy can then sell additional electricity on the daily market at a-premium. -New York-City and-Westchester are part of the same NYPA region. All of the electricity purchased by NYPA for the region goes into the same "basket." It is not possible to break down this figure in order to arrive at a percentage used for part of the same region, that is, Westchester or NYC alone. Given the way the system works, they must be considered as a whole.NYPA provided energy for the following customers: Westchester County Municipal customers 40MW Government buildings customers 75MW Westchester Airport 0.63MW Total Westchester megawatts from NYPA: 115MW Source: NYPA New York City Municipal Government 920MW NYC Housing Authority 245MW MTA (Trains) 615MW Port Authority 35MW State Buildings 60MW Javits Convention Center15MW Other 10MW JFK Airport OMW (self-generating) La Guardia 15MW Total New York City fTrlWNYA:: Source: NYPA Of the 6,468MW purchased by NYPA from in-city and out-of-city generation a total of 1915MW was used in NYC. The rest were sold elsewhere. Please note, all of this electricity used by NYPA is NOT from Indian Point. Therefore, it is wrong to divide the amount of electricity used in NYC by the production capacity of Indian Point 3 in an attempt to derive the percentage of electricity produced by Indian Point used in NYC. (986MW/1915MW) An accurate calculation would be the total capacity of the plant divided by the total megawatts of electricity purchased by NYPA which is 6,486MW. (986MW/6,486MW) This means that the maximum amount of electricity produced by this plant for municipal and-corporateclients can be up to-15%. -Independent System Operator Data January 14, 2003 NYC total local generating capacity: 8,707 Megawatts NY State total generating capacity: 36,000 Megawatts August 9, 2001 NY state maximum ever peak: 30,983 Megawatts When looking at the electricity market it is also necessary to consider generating capacity and who owns the transmission lines.According to the ISO on Jan. 14, 2003, the peak winter day that year, Con Edison transmitted 8,196MW to NYC and Westchester. This includes the amount supplied by both Con Ed and NYPA since only Con Ed transmits electricity. Indian Point could have contributed a maximum of 24% of this electricity if all of its power output were needed. But since the in-city generating capacity exceeded the demand, Entergy could have been released to sell significant amounts of its electric production on the spot market for that day. In terms of its impact on the spe,-4ndian Point contributed a maximum of 5.5% of th* state's generatingcapacity. (2,OOOMW/36,OOOMW = 5.5%) July 3, 2002, NYC peak use: 10,500 Megawatts NYC import from PJM system: 1,000 Megawatts NYC import from upstate: 4,000 Megawatts According to the ISO, on July 3, 2002, Con Ed transmitted 12,086MW to NYC and Westchester. This total includes the amount supplied by both Con Ed and NYPA since only Con Ed transmits electricity. Indian Point at 2,000MW contributed up to 16% of this electricity as peak generating capacity was exceeded. It is not possible to tell the percentage of electricity from Indian Point that-was used--to meet the-needs of either NYC or Westchester as the region must be considered as a whole.To arrive at a figure for Indian Point's contribution to the electricity used in the region, it is necessary to divide the generating capacity of the plant by the entire amount of electricity both NYPA and Con Ed purchase. This will give you the "up to a certain amount" figure which was discussed earlier. Ambiguities in this figure include in house generating capacity and the purchase of cheaper electricity from other sources. As these figures make clear, the replacement for electricity from Indian Point is a relatively small percentage of total usage and nowhere near the figure of up to 40% which is frequently cited by Entergy in its commercials and presentations. Their figure is derived by using a day and time when there is a much lower usage. This is typically early in the morning on a spring or fall day before people get up to go to work and when heating of air conditioning is not necessary. It is not a realistic reflection of usage and has been used to mislead the public and elected officials about the importance of Indian Point to the power supply.Replacement Options Replacement options for the electricity produced at Indian Point are available and more can be planned for in an orderly manner without disruptions to the supply of electricity as the plants reach the expiration date of their original licenses. This has been well documented by both the Levitan Report and The National Academy of Science study, "Alternatives to the In Poftit Energy Center for Meeting New York Electric Power Needs." within the purview of county and state governments to develop an energy portfolio that will more than compensate for the base load electricity generated at the plant by this time and for the market to respond by providing additional generation. Replacing 2,000 MW of base load generation with an equal amount of base load electricity is unnecessary for the integrity of the system if demand side options, supply side options and transmission improvements are instituted as part of reasonable and efficient energy policy. The way electricity is priced by the Independent System Operators also needs to be looked at carefully to make the cost of individual means production more responsive to the market. As it stands now, variable local sources of electricity from other plants set the price for the hour. This price is frequently far above contracted costs for the- electricity produced at Indian Point and disassociated from any costs of production. Replacement options for the electricity produced at Indian Point are available, and more can be planned for in an orderly manner without disruptions to the supply of electricity as the plants reach the expiration date of their original licenses. This has been well documented by both the Levitan Report and The National Academy of Science study, "Alternatives to the Indian Point Energy Center for Meeting New York Electric Power Needs." It is well within the purview of county and state governments to develop an energy portfolio that will more than compensate for the base load electricity generated at the plant within this time frame and for the market to respond by providing additional generation. Replacing 2,000 MW of base load generation with an equal amount of base load electricity is unnecessary for the integrity of the system if demand side options, supply side options and transmission improvements are instituted as part of reasonable and efficient energy policy. The way electricity is priced by the Independent System Operators also needs to be careful assessed.The cost of production of different means of generation is not always reflected in the hourly selling price of electricity. As it stands now, variable local sources of electricity from other plants set the price for the hour. This price is frequently far in excess of contracted costs for the electricity produced at Indian Point and is disassociated from costs of production. The current system is not an efficient or effective use of resources as it uses a base load plant to meet peak demands at a premium price.(o-7 Electricity not needed to meet contractual demands on a daily basis is made available to the Independent System Operators for dispatch elsewhere. Bids are submitted by operators on a day-ahead basis based on variable operating costs like fuel, labor, taxes, and capitol recovery costs. While the NYISO dispatches the plant with the lowest bid first, it is the lowest bid that sets the market energy price for the hour. This same price is then paid to other generators for subsequent sales, no matter the cost of the electricity they have generated. Given this day- ahead, hourly-assigned cost method of pricing electricity, and the uniform cost of producing base load electricity, The National Academy of Science Report characterizes Indian Point is a "price taker, not a price setter.-Th isrn-iean-s thh-ftKI' freq-uen itly al I oWs-th e electricity from Indian Point to be sold at a premium over and above the cost of production. While this maximizes revenue for Entergy, it does nothing to encourage conservation or to lower the cost of electricity being sold to providers. A more efficient and practical approach to pricing electricity would be to tie selling costs to the generating costs for each method of production. This kind of reform is a state responsibility and Peter Grannis, head of the Department of Conservation, reported on November 29th at the Global Warming forum held in Cortlandt Manor that the Public Service Commission is investigating ways to "break the link between production and industry profits." Utilities make their money by pushing consumption not conservation and the PSC is now looking at alternative business models that would be more responsive to today's circumstances. As the figures above make clear, the electricity produced at Indian Point is important to the reliability of the grid during peak summer usage periods, usually limited to the hottest days in August when air conditioners are operating at full force. There are other ways to compensate for this peak demand and provide for anticipated increased demand without the electricity from Indian Point as are outlined below.In addition, policy makers and consumers in our region are increasingly aware of the greenhouse gases associated with the production of electricity. These gases are produced as part of the nuclear fuel cycle. Many studies. indicate that nuclear energy produces approximately the same amount of green house gases as natural gas. This will come under increasing scrutiny in a carbon constrained world where alternative sources such as wind and solar have much smaller emissions when their fuel cycle is taken into consideration. It is to be noted that neither solar or wind energy produce highly toxic waste as a by product. Shipping and storage of high level radio active waste is another cost factor frequently overlooked with nuclear energy. In short, Indian Point is an aging generating unit which provides up to 16% of the electricity used within the region. There are large unknown costs associated with the waste it produces and the longer it operates the more waste there will be to deal with. It is a prime terrorist target. The 6etectricity-can be replaced-in~many-different-ways which are detailed below without threatening the stability of the grid. The health and safety of the 21 million people in the metropolitan area requires that the operating license for these two nuclear reactors not be renewed.Demand Side Options Demand side options represent the cleanest and cheapest form of electricity replacement. Reducing peak loads is far more economical than the cost of installing additional capacity and is already being done across the country. A well thought out energy policy incorporates a portfolio of specific numbers of saved megawatts and lists how goals will be achieved.In New York, NYSERDA has three programs already in effect: The Peak Load Reduction Program which is expected to conserve 355 to 375 MW annually;Enabling Technology for Price Sensitive Load Management which is expected to avoid the need for 308 MW Keep Cool Program which anticipates a 38 to-45 MW savings;(CAJ These programs have saved approximately 700 mega watts and illustrate how demand side options can reduce peak demand.Reducing peak demand means that generating capacity and reserve margins can both be reduced. Thus, according to the National Academy of Science study, investments in reducing peak demand through energy efficiency measures can be valued at 118 percent of the actual reduction in megawatts because it avoids the addition of new generating capacity with all its attendant costs. Consolidated Edison has established several demand management programs with the goal of reducing peak load growth by 535 MW; these programs use energy efficiency, smart equipment choices, load reductions programs and distributed generation. The New York Power Authority has committed $100 million a year for energy efficiency projects as detailed in the Contentions below which were submitted by the New York Attorney Generals Office to the Nuclear Regulatory Commission. Another way to measure the electricity saved is in negawatts. Negawatt power is a way of supplying additional electrical energy to consumers without increased generation capacity. The creation of markets for the trading of negawatts leads to increased efficiency. The concept was introduced by energy expert Amory Lovins, Director of the Rocky Mountain Institute. He first used the term in a 1989 and it has proven to be an efficient measure of saved electricity. The concept works by utilizing consumption efficiency to increase available market supply rather than by increasing plant generation capacity. For example an industrial consumer can advertise for bids for 100 MW hours. A supplier may find energy efficiencies within an unrelated business and contract to improve their heating or lighting for instance. The savings, or negawatts, can then be sold through the utility to the industrial consumer.This becomes an arbitrage transaction rather than an in house process and does not require increased generating capacity from the electric power utility. Entrepreneurial forces are focused on making money by selling negawatts, or saved units of electricity, and the entire system benefits.Energy consumers may also reduce energy consumption for a few hours to "generate" negawatts. For example, by shutting off air conditioners for a few minutes on the hour, a lot of energy can be saved over a short period of time. Con Ed has alkeaciy initiated a program for customers in Westchester which provides a programmable thermostat for air conditioners. The installation is free and the customer receives a stipend. In return they allow Con Ed to turn off their air conditioner for five minutes on the hour a limited number of times daily should electricity supplies run low during peak demand times. In this case the utility is producing and transferring the negawatts. In an expanded market many other vendors could do the same thing and the basic infrastructure remains unchanged. This is a practical and efficient way to get more work done with less electricity without building additional base load generating capacity to replace Indian Point.Better price signals to the consumer, such as off peak discounts for electricity usage, could change the load profile and allow a better pairing of demand to capacity. One example of this is using discounted off peak pricing to encourage people to shift the time for energy intensive household chores such as washing and drying laundry. On a system-wide basis the shift could be significant. It would also reduce the overall cost of electricity because peak power is more expensive than average costs. While this would not reduce use, a more vigorous educational campaign along with a wider out reach for promotion of tax credits for the installation for energy efficient measures -such as windows and appliances -would do so.Experiments have been done with meters inside the home which measure the amount of electricity used by household appliances as they are running. The results clearly indicated that when consumers become more aware of how much electricity is being used and where it is being used, they took steps to reduce usage. Electricity is invisible to most consumers. Making it more visible, that is, giving people information about how to save electricity and making it worth their while to do, can so can result in significant savings. A bill currently pending in the New York State Legislature, (Number A8739) would amend the public service law, in relation to providing real time smart metering technology to residential electricity customers. The purpose of the bill is to facilitate the use of smart metering so that households can reduce the cost of electrical services. It would Ielp consumers reduce the peak demand for electricity. The experience in California validates this point and illustrates that a 15% reduction in electricity usage can be achieved. The fact 1t4 that a state on the east coast, Vermont, has held their energy use constant while expanding their economy is proof that this can be done in our region. In many ways it is a community mind set that establishes the parameters of what is possible. In Burlington even hotel guests are expected to recycle. They are also given the option of not having their sheets changed every day in order to save the electricity used in washing and drying them. We have a lot of educating to do in New York to reach this mind set, so the potential savings are huge. Conservation as practical alternative to the electricity has been thoroughly analyzed in the report prepared by the Attorney General and the Department of Environmental Conservation for the State of New York and submitted to the Nuclear Regulatory Commission.. We reference their work below and agree with their conclusions. EXHIBIT EXHIBIT GG. *UNITED STATES NUCLEAR REGULATORY COMMISSION In the Matter Of ENTERGY NUCLEAR INDIAN POINT 2, LLC. ) Docket No. 50-286 ENTERGY NUCLEAR INDIAN POINT 3, LLC. ) Docket No. 50-247 Indian Point Energy Center Unit 2 and ) License No. DPR 26 Indian Point Energy Center Unit 3 ) License No. DRP 64 License Renewal Application )SECOND DECLARAION OF ULRICH WITTE Review of Contention

1. 14 1. My name is Ulrich Witte. Westchester Citizens Awareness Network, Rockland County Conservation Association, Public Health and Sustainable Energy, and Sierra Club-Atlantic Chapter retained me as a consultant with respect to the above-captioned proceedings.

I am a mechanical engineer with over twenty-six years of professional experience in engineering, licensing and regulatory compliance of commercial nuclear facilities. I have considerable experience and expertise in the areas of configuration management, engineering design change controls and licensing basis reconstitution. I have authored or contributed to two EPRI documents in the areas of finite element analysis, and engineering design control optimization programs. I have led industry guidelines endorsed by the American National Standards Institute regarding configuration management programs for domestic nuclear power plants. My 26 years of experience has generally focused on assisting nuclear plant owners in reestablishing fidelity of the licensing and design basis with current design configuration, and with actual plant operations. In short, my expertise is in assisting problematic plants where the regulator found reason to require the owner to reestablish competence in safely operating the facility in accordance with regulatory requirements. My curriculum vitae is attached hereto as Attachment A to my first declaration.

2. Contention 20: Leak-Before-Break analysis is unreliable for welds associated with high energy line piping containing certain alloys at Indian Point Unit 2.Certain locations of piping systems that are susceptible to stress corrosion cracking do not qualify for Leak-Before-Break (LBB) relief. Previously, butt welds associated with 82/182 alloys for example were considered to be free of SCC problems since PWRs operate in low oxygen environments.

However, more recent events with these welds have made use of Leak-Before-Break (LBB) questionable for these weld alloys. These include VC Summers, and other PWR plants.Industry guidance as well as emerging regulatory funded studies memorialized in a NUREG "Conference on Vessel Penetration Inspection, Crack Growth anid Repair" have specifically warned against traditional reliance of Leak-Before-Break (LBB) credited in Section 4.7.2 of 1P2 Section 4 LRA, partly because of the nickel-based alloy weld. [page 4.7-2 of the LRA].Indian Point 2's LRA does not address this potential safety threat, and relies wholly on previous studies such as WCAP-10977m and WCAP-10931. These studies are out of date. See for example, NUREG/CR-6936. "Probabilities of Failure and Uncertainty Estimate Information for Passive Components -A Literature Review." In addition, the NRC announced on March 13, 2007, the licensees of 40 pressurized water reactors will raise levels of vigilance concerning reactor coolant system (RCS) welds. The US Nuclear Regulatory Commission (NRC) has issued Confirmatory Action Letters (CALs) confirming, the licensees' commitment to put inI place "'more timely inspection and [weld] tlaw prevention measures, more aggressive monitoring of the RCS leakage, and more conservative leak rate thresholds a plant to shut down to investigate a possible (coolant water) leak." The measures should be put in place and welds inspected during an outage before the end of 2007. If not outage is scheduled this year, they must justify an extended schedule to the NRC.The concern are centered on the welds containing Alloy 82 and Alloy 182, used to weld together alloys like Inconel 600 and 601 as well as dissimilar metals such as carbon steel and stainless steel. The steps were taken after the discovery of certain flaws in the wells of the pressurizer at the Wolf Creek plant, which "were repaired and did not affect the safe operation of the plant." The CALs are an interim measure while the American Society of Mechanical Engineers updates its Boiler and Pressure Vessel Code, which will subsequently be reviewed and incorporated into NRC requirements. See Declaration Number of Ulrich Witte Contained in Exhibit II.I cannot therefore agree with the Applicant's LRA for Indian Point 2 and Indian Point 3 because it does not contain a reliable and adequate Aging Management Plan with regard to piping and welds, specifically Leak-before-Break (LBB), and without addressing and without remediating this issue specific to Unit 2 and Unit 3, the licensee puts at risk the public health and safety during the 20 year new superseding license. I declare under the penal-ty of perjury that the foregoing is true and correct.W Executed this J. day of December, 2007.Ulrich K. Witte State of New York ))ss.: County of Rockland )On the .day oft2) '. in the year --1 before me, the undersigned, W personally appeared.. .., ,.personally known to me or proved to me on the basis of satisfactory evidence to be the individual(s) whose name(s) is (are)subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted, executed the instrument. N a I .\ .* .: .:.-.:.Notary * ... .. ' (7 P/",.,_ -.Paae EXHIBIT Ih "2-EXHIBIT It

• A In the Matter Of ENTERGY NUCLEAR INDIAN POINT 2, LLC. ) Docket No. 50-286 ENTERGY NUCLEAR INDIAN POINT 3, LLC. ) Docket No. 50-247 Indian Point Energy. Center Unit 2 and ) License No. DPR 26 Indian Point Energy Center Unit 3 ) License No. DRP 64 License Renewal Application

)THIRD DECLARAION OF ULRICH WITTE Review of Contention

1. 35 1. My name is Ulrich Witte. Westchester Citizens Awareness Network, Rockland County Conservation Association, Public Health and Sustainable Energy, and Sierra Club- Atlantic Chapter retained me as a consultant with respect to the above-captioned proceedings.

I am a mechanical engineer with over twenty-six years of professional experience in engineering, licensing and regulatory compliance of commercial nuclear facilities. I have considerable experience and expertise in the areas of configuration management, engineering design change controls and licensing basis reconstitution. I have authored or contributed to two EPRI documents in the areas of finite element analysis, and engineering design control optimization programs. I have led industry guidelines endorsed by the American National Standards Institute regarding configuration management programs for domestic nuclear power plants. My 26 years of experience has generally focused on assisting nuclear plant owners in reestablishing fidelity of the licensing and design basis with current design configuration, and with actual plant operations. In short, my expertise is in assisting problematic plants where the regulator found reason to require the owner to reestablish competence in safely operating the facility in accordance with regulatory requirements. My curriculum vitae is attached hereto as Attachment A to my first declaration.

2. I submit the following comments in support of Contentions 17, Safety/Aging Management:

Applicant's LRA for Indian Point 2 is insufficient in managing the environmental qualification required by federal rules mandated after Three Mile Island that are required to mitigate numerous design basis accidents to avoid a reactor core melt and to protect the health and safety of the public.With the wealth of in situ data available to validate the Equipment Qualification methodology since I OCFR50.49 was first promulgated, the controversial methodology surrounding accelerated aging remains. In particular the validity of the Arrhenius aging methodology. 1 personally provided equipment qualification analysis during the early 1980s for a number of licensees. The definition of passive versus active components is ambiguous. Uncertainty and unreliability is shown by the numerous citations made in the contention. and are specific to Unit 2. Even within the ACRS this issue appears to be unresolved. Extrapolating from a few days of accelerated testing to 40 years is subject to substantial, uncertainty. Ignoring years of in situ data appears to be bypass opportunities to validate or correct what appears to the industry as tenuous at best. Cost estimates for replacement of cables to qualified cables were estimated for example by Monticello of 40 million dollars. Extrapolating to 60 years needs validation-however, insufficient analysis is being performed given that the consequences of negative outcome is high.Sufficient years of equipment qualification scope service is available. Materials and components that have been in service in operating reactors should be acquired specifically from Indian Point Unit 2, to be used for comparison with laboratory aged materials, to validate models for aging effects, and to validate nondestructive examination methods. Obtaining 60-year equivalent aging data to support plant licensing in laboratory testing requires accelerating the aging process, e.g., using artificially high temperatures or radiation dose rates and extrapolating short duration test data. These results need to be"benchmarked" against components and materials that have aged under prototypical operating conditions. In some cases, electrical cables, the components of interest may become available because they have been replaced. In others they can be obtained from plants which have been retired from service. Opportunities to obtain this information in the past have been lost due to 1) the unavailability of resources, 2) the lack of a systematic evaluation of the needs for component retrieval and assessment, and 3) the relatively short"window of opportunity" to obtain such components before theyare sent for disposal at a waste storage site or otherwise rendered inaccessible. The Environmental Qualification program is a well established program to ensure that electrical components, such as cables, that may be subject to a harsh environment are properly constructed to perform their intended function even when subject to that harsh environment. This new program called for requires periodic visual inspections of accessible, i.e. able to be approached and viewed easily, non-EQ cables which are in the scope of license renewal. The inspections will look for cable and connection jacket surface anomalies such as. embrittlement, discoloration, cracking, or surface contamination. Such jacket surface anomalies are precursors of insulation aging degradation and may indicate adverse localized, equipment environments caused by heat or radiation which can accelerate aging of electrical cables. These visual inspections are to be performed at least once every ten years. The initial inspections are to be performed following the issuance of the renewed operating licenses and prior to the end of the current operating license for Unit 2. The Applicant does not include plans or procedures for this AMP. Second, inaccessible Medium Voltage Cables Aging Management Program and testing of on, inaccessible. e.g. in conduit or direct buried. non-EQ medium voltage cables that are exposed to significant moisture simultaneously with significant voltage needs to be addressed. Significant moisture is defined as exposure to long te-nm. such as a few years. continuous standing water. Significant voltage is defined as being energized for more than twenty-five percent of the time. The cables require periodically testing to provide an indication of the condition of the conductor insulation and the ability of the cable to perform its intended function. The actual type of test has yet to be determined. The initial tests are to be performed following the issuance of the renewed operating licenses and prior to the end of the current operating license for unit 2. The tests will be repeated with a 10 year frequency. The Applicant has shown no evidence of inspection procedures for this AMP.In addition, chapter 7 of the FSAR provides: Categorv I -Instrumentation Except for sump level channels LT-938, 939. 940, and 941, the supplier completed preliminary qualification tests on pressure and differential pressure transmitters. These are reported in WCAP-7354-L,2 which has been superceded by WCAP-74 10-L.Additional instrumentation tests were performed by.Westinghouse on equipment obtained from the Indian Point Unit 2 plant equipment supplier. The results of these tests confirmed that the equipment would provide the required signals in the post-LOCA environment. The test conditions-of the Westinghouse test were as follows: steam environment, a 5-sec period rise to 286°F and 60-psig pressure and the maintenance of these conditions for 2 hr. All equipment, listed below, continued to operate throughout the test and are typical of transmitter ranges used in the containment. Static Pressure Differential Pressure Transmitters Transmitters, 0-2500 psig 0-240-in. of water 1700-2500 psik 0-300 psid Containment sump and recirculation sump level channels consist of hermetically sealed magnetic switches in a stainless steel housing. The instrumentation was designed for submerged service in borated water at 295°F at a pressure of 69 psig. Since instruments of this design have seen considerable actual service in applications more severe than the post-LOCA desigyn conditions, environmental testing for these instruments was not required.The question remains as to how these 40-60 year old instruments can be shown to still meet this acceptance criteria. No where does the applicant discuss surveillance, or planned replacement of these components. No where does the licensee provide confidence that a fifty year old instrument will survive submerged service at almost 300 deg F, and 69 psig.This is only one example of the incomplete program as described by the Applicant in the LRA.Ulrich Witte L/0 EXHIBIT JJ H-3 Enteray Nuclear Northeast Indian Poirn Energy Center~P.O. Box 249 E nte Buchanan. NY 10511-0249 James Comrloas Director, Nuclear Safety Assurance Tel 914 271 7130 July 31, 2006 Re: Indian Point Units 1, 2 and 3 Docket Nos. 50-003, 50-247 and 50-286 NL-06-079 Document Control Desk U.S. Nuclear Regulatory Commission Manl Stop O-PI-17 Washington, DC 20555-0001 Subject Ground Water Protection Baseline Inforrnaton Indian Point Eneray Center- Units-.1, 2 and 3

Dear Sir or Madam:

The nuclear industry, In conjunction with the Nuclear Energy Institute (NEI), developed a questionnaire to facilitate compilation of baseline information regarding the current status of site programs for monitoring and protecting ground water. All participating nuclear sites agreed to provide the requested information to both NEI and the Nuclear Regulatory Commission. Attachment I to this letter contains the questionnaire response for Indian Point Energy Center (IPEC). Please contact Mr. Patric W. Conroy at (914) 734-6668 if you have any questions or comments regarding this submittal. There are no new commitments contained In this submittal. Sincerely, James Comiotes t Director, Nuclear Safety Assurance Indian Point Energy Center Attachment 1 (Ground Water Protection Questionnaire Response)cc: see next page NL-06-079 Docket Nos. 50-003, 50-247 and 50-286 Page 2 of 2 cc: Mr. John P. Boska U.S. Nuclear Regulatory Commission Mr. Samuel J. Collins U.S. Nuclear Regulatory Commission Resident Inspector's Office Indian Point Unit 2 Nuclear Power Plant U.S. Nuclear Regulatory Commission Mr. Paul Eddy New York State Dept. of Public Service Mr. Ralph Anderson Nuclear Energy Institute ATTACHMENT 1 TO NL-06-079 GROUND WATER PROTECTION QUESTIONNAIRE RESPONSE INDIAN POINT UNITS 1, 2 and 3 ENTERGY NUCLEAR OPERATIONS, INC.INDIAN POINT NUCLEAR GENERATING UNIT NOS. 1, 2 AND 3 DOCKET NOS. 50-003,50-247, AND 50-286 M-0 Attachment I to NL-06-079 Docket Nos. 50-003, 50-247 and 50-286 Page 1 of 2 Ground Water Protection Questionnaire Response Indian Point Energy Center (IPEC)I. Briefly describe the program and/or methods used for detection of leakage or spills from plant systems, structures, and components that have a potential for an inadvertent release of radioactivity from plant operations into ground water.Response: IPEC has identified radioactive contamination in its on-site ground water.This contamination is currently being characterized to determine the sources of this contamination, as well as the nature and extent of the resulting ground water contamination plumes. As such, IPEC's ground water monitoring program is primarily focused on identifying the source of and characterizing after the fact release conditions. However, the program does include provisions for detecting leakage from potential future Inadvertent releases to ground water. They include* Operator plant rounds include inspection for leaks and spills, e Radiation Protection surveys include inspection for leaks and spills,* Leaks/spills documented in corrective action program,* Inspection of systems, structures and components to identify potential leak points, e Radioactive Effluent Monitoring Program (REMP) Sampling, e Storm drain periodic sampling program, and 0 Corrective action program reporting/trending.

2. Briefly describe the program and/or methods for monitoring onsite ground water for the presence of radioactivity released from plant operations.

Response: IPEC is in the process of investigating known Tritium and Sr-90 ground water contamination, resulting from leaks from the Unit I and 2 spent fuel pools (SFP).Other potential sources of leakage are also within the scope of this investigation. To accomplish this objective, a program for characterizing the nature and extent of the resulting ground water contamination and the site's hydro-geological characteristics is being conducted. As a part of this program, more than 30 monitoring wells have been installed throughout the site for the purpose of sampling ground water and obtaining hydro-geological data. These monitoring wells are sampled on a periodic basis, with the samples analyzed for Tritium, Sr-90 and gamma emitters. Upon conclusion of this investigation and any warranted remediation, these investigation monitoring wells will be transitioned Into a long-term ground water monitoring program.3. If applicable, briefly summarize any occurrences of inadvertent releases of radioactive liquids that have been documented in accordance with 10 CFR 50.75(g).Res.onse: The most significant sources for potential releases to ground water include leakage from the Unit 1 and 2 SFPs, storm drains with contaminated sediment resulting from past spills, and an impoundment containing contaminated soil from a Unit 1 septic leach field that was excavated for construction of Unit 3. Other smaller inadvertent releases and spills have also occurred.)17 EXHIBIT KK 112 2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSIGHT/ASSESS/JP2/ip2_im.html Index I Site Map I FAQ I Facility Info Reading Rm I New I Help I Glossary I Contact Us I PGOae Custom Search Search Options AotNCNuclear Nu~clear, ~>R oactive ?' Nuclear% Pt 6IcmNeetihvi 0" 1 5~ NRC e, Szcrit __Iv _r~& Reactors MAteriailWse I-; Scuiy 1,mct'Home > Nuclear Reactors > Operating Reactors > Oversight > Reactor Oversight Process Indian Point 2 2Q/2007 Plant Inspection Findings Initiating Events Significance:l Mar 31, 2007 Identified By: NRC Item Type: NCV NonCited Violation FAILURE TO INCORPORATE DESIGN BASIS INFORMATION INTO PROCEDURES TO ASSURE ADEQUATE COOLING WATER FLOW TO THE RCP THERMAL BARRIERS The inspectors identified a Green, non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion III, "Design Control," in that, Entergy did not appropriately incorporate design requirements into an operating procedure used to establish adequate component cooling water (CCW) flow to the reactor coolant pump (RCP) thermal barriers. Specifically, the flow specification in the CCW operating procedure did not incorporate the calculated design flow requirements to bound allowable CCW temperature limits. Entergy entered this issue into their corrective action program and will be evaluating the flow requirements specified in procedure 2-SOP-4.1.2, "Component Cooling Water System Operation," to ensure that they bound the allowed plant operating limits.£Bee inspectors determined that this finding was more than minor because it was associated with the Equipment Performance attribute of the Initiating Events cornerstone; and, it affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, Entergy did not incorporate design flow requirements necessary to assure adequate cooling water flow to the RCP thermal barriers into the plant operating procedures which establish the required flow. On a loss of seal injection, the procedure did not ensure that the heat removal capability was adequate to prevent a rise in seal temperature which would require the RCP to be stopped with a subsequent reactor trip. The inspectors evaluated the significance of this finding using Phase 1 of IMC 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations." This finding was determined to be of very low safety significance because it would not result in exceeding the Technical Specification limit for identified reactor coolant system leakage and would not have likely affected other mitigating systems resulting in a loss of their safety function. The inspectors found that the procedurally established nominal flow band would have assured adequate cooling of the RCP thermal barriers for the highest CCW supply temperature recorded over the previous year.The inspectors determined that this finding had a cross-cutting aspect in the area of human performance because the operating procedure used to set the flow rate of cooling water to the RCP thermal barriers was not adequate to make certain that sufficient cooling water was available to assure the components could perform their design function. (Section 1R15)Inspection Report# : 2007002 (pdf)Significance:E Mar 31, 2007 Identified By: NRC Item Type: NCV NonCited Violation FAILURE TO ESTABLISH TESTING TO ASSURE ADEQUATE COOLING WATER FLOW TO THE RCP THERMAL BARRIERS The inspectorsidentified a Green, NCV of 10 CFR 50 Appendix B, Criterion XI, "Test Control," in that, Entergy did not establish appropriate testing to assure adequate component cooling water (CCW) flow to the reactor coolant pump thermal barriers. Specifically no preventive maintenance activities or functional checks were conducted for the individual flow ters. It was determined that the rotameters on 21 and 23 RCP were not indicating correctly and that actual CCW flow to Qthermal barrier heat exchangers was less that the design requirements for CCW temperature. Entergy entered this issue r to their corrective action program (CR-1P2-2007-00783 and 00955), adjusted individual cooling water flow within the I of 10 9/27/2007 12:53 AM 2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSlGHT/ASSESS/lP2/ip2_pim.htm nominal band using ultrasonic flow meters, wrote work orders to replace the faulty flow meters, and is -conducting an evaluation to determine the appropriate test requirements for the flow indicators.inspectors determined that this finding was more than minor because it was associated with the Equipment Performance attribute of the Initiating Events cornerstone; and, it affected the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions during shutdown as well as power operations. Specifically, Entergy's test program did not assure that all testing required to demonstrate that the RCP thermal barriers will perform satisfactorily in service because no testing was performed to ensure the accuracy of the individual flow meters used to establish the required cooling water flow. Consequently, it was identified that two individual flow indicators did not read correctly and the CCW flow to two RCP's was not sufficient to assure adequate cooling in the event that seal water was lost based on the flow requirements established in design calculations. On a loss of seal injection, the cooling water flow would not ensure that the heat removal capability was adequate to prevent a rise in seal temperature which would, require the RCP to be stopped with a'subsequent reactor trip. The inspectors evaluated the significance of this finding using Phase 1 of IMC 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations." This finding was determined to be of very low safety significance because it would not result in exceeding the Technical Specification limit for identified reactor coolant system leakage and would not have likely affected other mitigating systems resulting in a loss of their safety function. (Section 1R15)Inspection Report# : 2007002 (pdf)Significance: Dec 31, 2006 Identified By: NRC Item Type: NCV NonCited Violation INADEQUATE RISK ASSESSMENT FOR 21 MBFP STEAM INLET VALVE The inspectors identified a Green non-cited violation (NCV) of Title 10 of the Code of Federal Regulations (CFR), Part 50.65(a)(4), because Entergy did not adequately assess and manage the risk of on-line maintenance activities while operating with a degraded steam inlet valve on one of Entergy's two main boiler feed pumps (MBFP). Specifically, from November 16 through 21, 2006, the degraded condition of the 21 MBFP increased the likelihood of a reactor trip, but was not assessed or included in the plant's on-line risk model. Entergy entered this issue into their corrective action program and properly assessed 21 MBFP risk on November 21, 2006.*The inspectors determined that this finding was more than minor because Entergy failed to consider risk significant tructures, systems, components, and support systems that were unavailable during the performance of on-line W aintenance. Specifically, Entergy failed to assess the increase in online risk from the increased likelihood of a reactor trip due to the 21 MBFP degraded condition. The inspectors evaluated this finding using IMC 0609, Appendix K, "Maintenance Risk Assessment and Risk Management Significance Determination Process," and determined that this finding was of very low safety significance because the finding resulted in an increase in the incremental core damage probability of less than lxtO-6 (actual increase was approximately 2x10-8).The inspectors determined that this finding had a cross-cutting aspect in the area of human performance because Entergy did not provide complete and accurate procedures, in that, the online risk assessment procedure did not require degraded equipment that impacted risk to be assessed or managed.Inspection Report# : 2006005 (pdf)Significance-E Sep 30, 2006 Identified By: Self-Revealing Item Type: FIN Finding INADEQUATE OPERATING PROCEDURES FOR LOSS OF BOTH HEATER DRAIN TANK PUMPS A Green self-revealing finding was identified because Entergy failed to develop adequate procedures for governing the response to a loss of both heater drain tank pumps and to an approaching rod insertion limit (RIL) alarm condition. Specifically, the procedure governing operator actions during a loss of heater drain tank pumps did not specify for the operators to reset the steam dumps following the rapid downpower. The alarm response procedure for the approaching rod insertion limit condition directed the operators to place the rod control system in manual to stop further automatic inward rod motion. This impacted operators ability to add negative reactivity and control the transient. Entergy entered these procedural deficiencies into their corrective action program and is evaluating the appropriate steps to correct the procedural deficiencies. The inspectors determined that this finding is greater than minor because it is associated with the Procedure Quality attribute of the Initiating Events cornerstone; and, it impacted the cornerstone objective of limiting the likelihood of those events that upset plant stability and challenge critical safety functions. Specifically, the procedural inadequacies complicated Pe rato actions to a rapid downpower, resulted in a manual reactor trip when the operators determined that they did not ve sufficient control of the transient, and could impact other accident sequences requiring negative reactivity addition.* e inspectors evaluated this finding using Phase I of IMC 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," and determined it to be of very low safety significance because it did not 2 of 10 9/27/2007 12'53 AM I *2-0 2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSIGHT/A SSESS/JP2/ip2_pim.htm] contribute to the likelihood of both a reactor trip and the likelihood that mitigation equipment or functions would be unavailable. The inspectors determined. that this finding had a cross-cutting aspect in the area of human performance Agkecause Entergy did not ensure that plant operating procedures were adequate to ensure operators could appropriately W espond to a rapid downpower transient. Wnspection Report# : 2006004 (pdf)Significance:E Sep 30, 2006 Identified By: Self-Revealing Item Type: FIN Finding INADEQUATE PROCEDURE FOR CALIBRATING THE STEAM DUMP LOSS OF LOAD CONTROLLER A Green self-revealing finding was identified because Entergy failed to develop an accurate procedure for calibration of the steam dump loss of load controller. This resulted in the steam dumps failing to operate properly during a plant transient, complicating operator response, and leading to a manual reactor trip. Following identification of the issue, Entergy entered the issue into the corrective action program, corrected the procedural deficiency, and re-calibrated the controller. The inspectors determined that this finding is greater than minor because it is associated with the Procedural Quality attribute of the Initiating events cornerstone; and, it impacted the cornerstone objective of limiting-the likelihood of those events that upset plant stability and challenge critical safety functions. Specifically, the inadequacy in Entergy's 'calibration procedure caused the steam dumps to operate improperly during a plant transient and contributed to a reactor trip. The inspectors evaluated this finding using Phase I of IMC 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," and determined it to be of very low safety significance because it did not contribute to the likelihood of both a reactor trip and the likelihood that mitigation equipment or functions would be available. The inspectors determined that this finding had a cross-cutting aspect in the area of human performance because Entergy did not ensure that the procedure for calibration of the steam dump loss of load controller was accurate, in that, it specified incorrect settings for the controller. Inspection Report# : 2006004 (pdf)Mitigating Systems f ignificance:E Feb 16, 2007*dentifled By: NRC tWtem Type: NCV NonCited Violation INADEQUATE DESIGN CONTROL ASSOCIATED WITH VORTEXING AND NET POSITIVE SUCTION HEAD CALCULATIONS The team identified a finding of very low significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion III,"Design Control," in that, Entergy did not ensure adequate suction submergence for the three safety injection (SI) pumps by not properly translating vortex and net positive suction head (NPSH) design parameters into calculations relative to reactor water storage tank (RWST) level. Specifically, Entergy used a non-conservative method to calculate the level required to prevent pump vortexing, and used a non-conservative RWST level value for determining available NPSH for the SI pumps.Entergy entered the issue into their corrective action program and revised the affected calculations. The finding is more than minor because the calculation deficiencies represented reasonable doubt on the operability of the SI pumps, even though the pumps were ultimately shown to be operable. The finding is associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding has very low safety significance, based on Phase 1 of the significance determination process (SDP), documented in.NRC Inspection Manual Chapter 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," because it was a design deficiency that did not result in a loss of SI system operability, based upon the team's verification of Entergy's revised calculations. Inspection Report# : 2007007 (pdf)Significance:E Feb 16, 2007 Identified By: NRC Item Type: NCV NonCited Violation INADEQUATE DIFFERENTIAL PRESSURE VALUE USED FOR MOV 746 AND MOV 747 TONENSURE VALVE CAPABILITY The team identified a finding of very low significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion I11,"Design Control," in that, Entergy did not accurately incorporate design parameters into valve thrust calculations for motor erated valve (MOV) 746 and MOV 747. Specifically, Entergy used an incorrect and non-conservative differential pressure*the calculations for MOV 746 and MOV 747, which were developed to verify that the valves could develop sufficient thrust*.to open under postulated design basis conditions. Additionally, an incorrect equation was used in determining the reduction 3of10 9/27/2007 12:53 AM (21 2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSIGHT/ASSESS/iP2/ip2_pim.htnt in motor torque due to degraded voltage conditions. Entergy entered the issue into their corrective action program and revised the affected calculations using the correct information.

1. rhe finding is more than minor because the calculation deficiencies represented reasonable doubt on the operability of MOV 746 and MOV 747. The finding is associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences.

The finding has very low safety significance, based on Phase 1 of the SDP, because it was a design deficiency that did not to result in a loss of MOV 746 and MOV 747 operability, based upon the team's verification of Entergy's revised calculations. Inspection Report# : 2007007 (pdf)Significance:E Feb 16, 2007 Identified By: NRC Item Type: NCV NonCited Violation INADEQUATE DESIGN CONTROL FOR ENVIRONMENTAL EFFECTS TO ENSURE THE AVAILABILITY OF THE TURBINE DRIVEN AUXILIARY FEEDWATER PUMP OPERATION The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion III, "Design Control," in that, Entergy did not establish adequate design control measures to ensure the availability of the turbine driven auxiliary feedwater pump (TDAFWP) during a postulated loss-of-offsite power (LOOP) event. Under certain LOOP situations, the team determined that the TDAFWP steam supply could be inadvertently isolated because of inadequate calculations and procedures for limiting the AFWP room temperature rise. Specifically, a calculation to determine the auxiliary feedwater pump (AFWP) room temperature rise during a LOOP did not include heat input from the TDAFWP.Further, actions that could limit the rise in AFWP room temperature and prevent the inadvertent isolation of the TDAFW pump (opening an AFWP room roll-up door or promptly restoring forced ventilation) were not included in procedures. Entergy entered this issue into their corrective action program, implemented immediate compensatory actions, and revised AFWP room temperature rise calculations. The finding is more than minor because it is associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. The finding has very low safety significance, based on Phase 1 of the SDP, because it did not represent the loss of safety function of the TDAFWP (single train) for greater than its Ae2 hour technical specification allowed outage time, based on the team's review and assessment of site ambient Wemperature data over the last year.Inspection Report# : 2007007 (pdf)Signiticance:E Feb 16, 2007 Identified By: NRC Item Type: NCV NonCited Violation FAILURE TO ADEQUATELY MONITOR GAS TURBINE SYSTEM PERFORMANCE AS REQUIRED BY THE MAINTENANCE RULE The team identified a finding of very low safety significance (Green) involving a non-cited violation of 10 CFR 50.65(a)(1), the Maintenance Rule, in that, Entergy failed to monitor the gas turbine (GT) system in a manner that provided reasonable assurance thatthe system could perform its intended safety function. Specifically, Entergy did not establish appropriate GT reliability goals, and therefore did not take corrective actions, when GT-1 had exceeded these goals for maintenance preventable functions failures (MPFF). In addition, Entergy did not properly classify repeat MPFFs, which resulted in a similar failure to take corrective actions as required. This resulted in additional GT-1 out of service time that would not have happened if appropriate actions had been taken. Entergy entered this issue into their corrective action program and lowered the allowable goal for MPFFs, and revised the GT-1 (a)(1) action plan to improve reliability. The finding is more than minor because appropriate GT reliability goals were not established commensurate with safety and appropriate corrective actions were not taken when goals were not met. This finding is associated with the equipment performance attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. The finding has very low safety significance, based on Phase 1 and Phase 2 of the SDP, which considered that the additional GT-1 out of service time due to this issue could be as much as three days. The finding has a cross-cutting aspect in the area of human performance because Entergy did not adequately ensure procedures were complete, accurate, and up-to-date. Specifically, procedure ENN-DC-171, "Maintenance Rule Monitoring," did not provide steps to discriminate between the classification of an initial design deficiency and further failures due to the same condition, resulting in-mis-classifying several GT functional failures.Inspection Report# : 2007007 (pdf)Significance: Feb 16, 2007 Identified By: NRC 4 of 10 9/27/2007 12:53 AM 122-2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSIGHT/ASSESS/IP2/ip2_pim.html Item Type: FIN Finding he team identified a finding of very low safety significance involving Entergy procedure, EN-LI-102, "Corrective Action~rocess," in that, Entergy failed to take corrective actions to address degraded GT-1 reliability. This resulted in a two and one half day time period in January 2007 when GT-1 and GT-3 were simultaneously inoperable because, after GT-3 was made inoperable for planned maintenance activities, GT-1 was subsequently found to be inoperable. Specifically, the reliability of GT-1 declined from an average of 75% for 2005 and the first 10 months of 2006, to 50% for the three months from November 2006 to January 2007; however, Entergy did not take actions to correct this degraded reliability. Entergy entered this issue into their corrective action program and developed an action plan to address GT reliability issues.The issue is more than minor because it is associated with the equipment reliability attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding has very low safety significance, based on Phase 1 and Phase 2 of the SDP, assuming that both GT-1 and GT-3 were unavailable for the two and one half days, due to this issue. The finding has a cross-cutting aspect in the area of problem identification and resolution because Entergy did not correct degraded reliability of GT-1, resulting in having GT-1 and GT-3 simultaneously inoperable. Inspection Report# : 2007007 (pdf)Significance:E Feb 16, 2007 Identified By: NRC Item Type: NCV NonCited Violation INADEQUATE STATION BATTERY CAPACITY TESTING FOR DEGRADATION MONITORING The team identified a finding of very low safety significance (Green) involving a non-cited violation of Technical Specification 3.8.6.6, in that, Entergy did not perform station battery capacity testing in accordance with IEEE Standard 450-1995 (related to battery maintenance and testing). Specifically, Entergy procedurally terminated battery capacity testing at the rated discharge time (four hours), before reaching the minimum voltage, as specified by IEEE Standard 450-1995. This prevented accurate quantitative measurement of capacity degradation and identification of the need to conduct potential accelerated battery testing, as specified by both IEEE Standard 450-1995 and the technical specifications, if battery capacity drops by more than 1 0% relative to the previous test. Entergy entered the issue into their corrective action program and performed calculations using past test data, which demonstrated that the capacities of station batteries had not degraded Sore than 10%.is issue is more than minor because it is associated with the procedure quality attribute of the Mitigating Systems cornerstone and affected the cornerstone objective to ensure the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding has very low safety significance, based on Phase I of the SDP, because it did not represent the loss of station battery safety function, based upon the team's verification of Entergy's calculations. Inspection Report#.: 2007007 (pdf)Significance:E Feb 16, 2007 Identified By: NRC Item Type: NCV NonCited Violation INEFFECTIVE CORRECTIVE ACTION FOR HIGH INTER-TIER BATTERY RESISTANCES The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," in that, Entergy did not take effective corrective actions for a condition adverse to quality concerning out-of-tolerance inter-tier resistances on the No. 21 station battery. Specifically, after repeated failures of the No. 21 station battery inter-tier resistance testing, vendor and IEEE Standard 450-1995 recommended corrective actions were not taken to correct the adverse out-of-tolerance resistance trend. Entergy enteredithe issue into their corrective action program and performed calculations, which demonstrated that the voltage drop due to the as-found resistance of the inter-tier connections was small and did not impact No. 21 battery operability. This issue is more than minor because if it was left uncorrected, it would have become a more significant safety concern.Specifically, high resistance connections in a battery that is loaded during accident conditions can cause localized heating and can cause permanent damage to the battery. The finding has very low safety significance, based on Phase 1 of the SDP, because it did not represent the loss of No. 21 station battery safety function, based upon the team's verification of Entergy's revised calculations. The finding has a cross-cutting aspect in the area of problem identification and resolution because Entergy did not take effective corrective actions to address the adverse trend of out-of-tolerance inter-tier resistances. Inspection Report# : 2007007 (pdf)O nificance: Feb 16, 2007 D Identified By: NRC Item Type: NCV NonCited Violation 5 of 10 9/2712007 12:53 AM 2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSIGHT/A SSESS/1P2/ip2_pim.html UNTIMELY CORRECTIVE ACTIONS FOR DECREASE IN BATTERY MARGIN The team identified a finding of very low safety significance involving a non-cited violation of 10 CFR 50, Appendix B,*riterion XVI, Corrective Action," in that, Entergy did not promptly identify and correct a condition adverse to quality, with espect to known errors in the No. 23 station battery design calculations. Specifically, Entergy did not recognize at the appropriate time the need to write a condition report, perform an operability determination, or place controls on the use of the No. 23 battery design calculations when errors were discovered in the No. 23 battery design calculations that significantly lowered the battery capacity margin. Entergy entered the issue into their corrective action program and performed calculations, which demonstrated No. 23 station battery operability through the next refueling outage, based on the calculated margin and conservatisms available. This issue is more than minor because it is associated with the design control attribute of the Mitigating Systems cornerstone and affected the cornerstone objective of ensuring the availability, reliability, and capability of systems that respond to initiating events to prevent undesirable consequences. The finding has very low safety significance, based on Phase I of the SDP, because it did not represent the loss of No. 23 station battery safety function, based upon the team's verification of Entergy's revised calculations. The finding has a cross-cutting aspect in the area of problem identification and resolution because Entergy failed to promptly identify the decrease in margin found in the No. 23 battery design calculations of record.Inspection Report# : 2007007 (pdf)Significance:E Dec 31, 2006 Identified By: NRC Item Type: FIN Finding FAILURE TO IMPLEMENT CORRECTIVE ACTIONS TO CORRECT A DEGRADED CONDITION WHICH IMPACTED GAS TURBINE #1 RELIABILITY AND AVAILABILITY The inspectors identified a Green finding, in that, Entergy's corrective actions were inadequate to resolve a deficiency associated with the gas turbine 1 (GT-1) starting diesel. This deficiency was identified following a failure of GT-1 to start on February 7, 2005, and resulted in three subsequent failures. A corrective action was written to correct the deficient condition following the initial failure and was closed on June 22, 2005, with no actions taken based on a senior management.decision to cancel preventive maintenance activities on the gas turbines due to pending system retirement. Entergy entered his issue into their corrective action program and installed a modification to the coolant system to prevent further trips due this condition. The inspectors determined that this finding was more than minor because it was associated with the equipment performance attribute of the Mitigating Systems cornerstone objective of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. Specifically, it impacted GT-1 reliability, in that, the deficiency resulted in multiple failures to start on demand after the condition was identified and the action to correct the condition was closed without being implemented. The inspectors evaluated the significance of this finding using Phase 1 of Inspection Manual Chapter (IMC) 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," and determined that a Phase 2 evaluation was required because the finding represented an actual loss of safety function of a non-Technical Specification required train of equipment designated as risk significant per 10 CFR 50.65 for greater than 24 hours. The inspectors used the Risk-Informed Inspection Notebook for Indian Point Nuclear Generating Unit 2, to conduct the Phase 2 evaluation. The inspectors determined that 65 hours of unavailability were caused by the additional failures of GT-1 due to the starting diesel coolant system deficiency. The inspectors conservatively equated this cumulative unavailability time to the total exposure time and used an initiating events likelihood of less than three days. The Phase 2 approximation yielded a result of very low safety significance (Green).The inspectors determined this finding had a cross-cutting aspect in the area of human performance because Entergy did not ensure that equipment and resources were available and adequate to assure reliable operation of GT-1. Specifically, Entergy did not minimize long-standing equipment issues and maintenance deferrals associated with the gas turbine system.Inspection Report# : 2006005 (pdf)Significance:E Dec 05, 2006 Identified By: NRC Item Type: NCV NonCited Violation FAILURE TO IDENTIFY A DEGRADED CONDITION OF AN AUXILIARY FEED WATER CHECK VALVE IN THE CORRECTIVE ACTION PROGRAM The inspectors identified a non-cited violation (NCV) of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," in that, ,Mntergy failed to identify a condition adverse to quality associated with improper internal clearances on BFD-68, an auxiliary dwater check valve, in the corrective action program. Specifically, upon inspection in September 2006, the .gasket wtween the valve's body to bonnet seal was found over-crushed causing the gasket to partially unwind, potentially impacting valve operation. Gasket damage was noted in work orders during internal valve inspections of BFD-68 performed in 1997 and 2002; however, the deficiencies were not identified in the corrective action program. Consequently, the jof 10 9/27/2007 12:53 AM 2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSIGHTIASSESS/lP2/ip2_pim.html problem was not evaluated and corrected prior to reassembly of the valve. Entergy entered this issue into the corrective action program, evaluated the condition, and conducted repairs to the valve to ensure the proper gasket crush was ,tained.Tche inspectors determined that this finding was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone; and, it affected the cornerstone objective of ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. The inspectors evaluated the significance of this finding using Phase 1 of IMC 0609, Appendix A, "Significance Determination of Reactor Inspection Findings for At-Power Situations," and determined that the finding was of very low safety significance because it was not a design or qualification deficiency; it did not result in the loss of a system safety function or a train safety function for greater than the Technical Specification Allowed Outage Time; and it did not screen as potentially risk significant due to external events.Inspection Report# : 2006006 (pdf)Significance:E Dec 05, 2006 Identified By: Self-Revealing Item Type: NCV NonCited Violation INADEQUATE EVALUATION OF LEAKING 22 STEAM GENERATOR LOW FLOW BYPASS VALVE FCV-427L A self-revealing, non-cited violation of 10 CFR 50, Appendix B, Criterion XVI, "Corrective Action," was identified, in that, Entergy failed to adequately evaluate leakage into the 22 steam generator. During the Indian Point Unit 2 reactor trip on August 23, 2006, main feedwater low flow bypass valve FCV-427L leaked excessively and resulted in an uncontrolled rise in 22 steam generator level; operator response to isolate feedwater to the steam generator in accordance with emergency operating procedures; and automatic actuation of the feedwater isolation system. The excessive leakage condition into the 22 steam generator was identified on April 4, 2006, prior to Indian Point Unit 2 refueling outage 2R17, but was not fully evaluated or corrected prior to the reactor trip on August 23, 2006. This issue was entered into the corrective action program, and FCV-427L was repaired and retested satisfactorily. The inspectors determined that this finding was more than minor because it was associated with the Equipment Performance attribute of the Mitigating Systems cornerstone; and, it affected the cornerstone objective of-ensuring the availability, reliability and capability of systems that respond to initiating events to prevent undesirable consequences. The spectors evaluated the significance of the finding using Phase 1 of IMC 0609, Appendix A, "Significance Determination of actor Inspection Findings for At-Power Situations," and determined that the finding was of very low safety significance Seause it was not a design or qualification deficiency; it did not result in the loss of a system safety function or a train safety function for greater than the Technical Specification Allowed Outage Time; and it did not screen as potentially risk significant due to external events.The inspectors determined that the finding had a cross-cutting aspect in the area of problem identification and resolution because Entergy did not thoroughly evaluate the cause of excessive leakage into the 22 steam generator such that the resolutions addressed the causes and extent of condition of the problem.Inspection Report# : 2006006 (pdf)Barrier Integrity Significance:E Mar 31, 2007 Identified By: NRC Item Type: NCV NonCited Violation FAILURE TO MOVE CONTAINMENT HYDROGEN ANALYZERS TO 10 CFR 50.65 (A)(1) STATUS The inspectors identified a Green, NCV of 10 CFR 50.65(a)(2) because Entergy did not demonstrate that the performance or condition of the containment hydrogen monitoring system was being effectively controlled through the performance of appropriate preventive maintenance such that the system remained capable of performing its intended function. The inspectors identified that both channels of the containment hydrogen/oxygen (H2/02) analyzers had been out of service since September 7, 2006; due to compressor seal leakage. The inspectors determined that the H2/02 analyzers are within the scope of Entergy's Maintenance Rule program since they are used in the emergency operating procedures. The inspectors noted that, based on the significant unavailability time of both trains, the system should have been in 10 CFR 50.65(a)(1) status with an action plan to improve system performance back to an (a)(2) status. Entergy entered this issue into -their corrective action program and changed the priority of the work orders to perform repairs on the H2/02 analyzers. This inspectors determined that this finding affected the Barrier Integrity cornerstone and was more than minor since it was'ar to Example 7.b in IMC 0612, Appendix E, "Examples of Minor Issues." Specifically, Entergy failed to demonstrate ctive control of the performance of the H2/02 analyzers and did not place the system in (a)(1) status. The inspectors fwaluated the significance of this finding using Phase 1 of IMC 0609, Appendix A, "Significance Determination of Reactor W nspection Findings for At-Power Situations." The finding required further evaluation through IMC 0609, Appendix H, 7 of 10 9/27/2007 12:53 AM i --) 2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSIGHT/ASSESS/1P2/ip2_pim.htmi"Containment Integrity Significance Determination Process," because it resulted in an actual reduction in the efense-in-depth for the hydrogen control function of the reactor containment. The inspectors determined that this findingýas of very low safety significance because it did not affect core damage frequency and the 112/02 analyzers are not W portant to large early release frequency. The inspectors determined this finding had a cross-cutting aspect in the area of human performance because Entergy did not ensure that equipment and resources were available to assure reliable operation of the H2/02 analyzers. Specifically, Entergy did not minimize long-standing equipment issues and maintenance deferrals associated with the containment hydrogen monitoring system. (Section 40A2)Inspection Report# : 2007002 (pdf)Significance: SL-IV Dec 31, 2006 Identified By: NRC Item Type: NCV NonCited Violation INADEQUATE CONTAINMENT CLOSURE EQUIPMENT The inspectors identified a Severity Level IV NCV of 10 CFR 50.59, "Changes, Tests and Experiments," for failure to obtain a license amendment pursuant to 10 CFR 50.90 prior implementing a change to alter the requirements of a shutdown fission product barrier. The inspectors reviewed Safety Evaluation 04-0732-MD-00-RE R1, "Installation of a Temporary Roll-up Door on the Containment Equipment Hatch," to determine if the conclusion that a licensee amendment was not required was correct. Entergy concluded that the roll-up door was equivalent to the closure plate and, therefore, adequate to close containment as required by the action statement. The inspectors found that the door was not designed to be air-tight; therefore, any radioactive release inside containment would bypass the roll-up door. The inspectors concluded that the roll-up door did not meet the design or licensing basis of the closure plate as described in the Updated Final Safety Analysis Report (UFSAR) and previously approved license amendments. Consequently, Entergy incorrectly concluded that a license amendment pursuant to 50.90 was not required prior to implementing the change. Entergy entered the issue into their corrective action program to evaluate and correct.The inspectors determined that Entergy changed the requirements for the shutdown fission product barrier (containment) prior to receiving NRC approval. As a result, traditional enforcement was used to evaluate the issue because the deficiency affected the NRC's ability to perform its regulatory function. The severity level of the violation was determined to be~~Verity Level IV. in accordance with example D.5 of Supplement 1 of the NRC Enforcement Policy. Additionally, the issue as determined to be of very low safety significance (Green) based on the low decay heat levels at the time the roll-up door~as credited in accordance with the significance determination process described in Inspection Manual Chapter (IMC) 0609 Appendix H, "Containment Integrity." Inspection Report# : 2006005 (pdf)Emergency Preparedness Significance:E Mar 31, 2007 Identified By: NRC Item Type: FIN Finding INADEQUATE CORRECTIVE ACTIONS FOR FAILURE TO APPROPRIATELY MONITOR SERVICE WATER INTAKE BAY LEVEL The inspectors identified a Green finding because Entergy failed to take adequate corrective actions for an issue associated with monitoring of service water intake bay level. This deficiency could have prevented identification of entry conditions for an emergency action level. Entergy entered this issue into the corrective action program as CR IP3-2007-00453, and initiated several corrective actions, including plans for enhanced monitoring of service water bay levels, backwashing of trash racks, procedural upgrades, correction of service water bay level instrumentation modification installation, development of modifications for enhanced service water level monitoring equipment, and enhanced inspection and cleaning of intake structure trash racks.The inspectors determined that this finding was more than minor because it was associated with the Emergency Preparedness cornerstone attribute of facilities and equipment; and, it affected the cornerstone objective of ensuring that a licensee is capable of implementing adequate measures to protect the health and safety of the public in the event of a radiological emergency. Specifically, inadequate monitoring of service water intake bay level could have resulted in failure to declare a notification of unusual event (UE). The inspectors reviewed the EAL entry criteria and determined that this.performance deficiency did not affect Entergy's ability to declare any event higher than a UE. The inspectors evaluated this finding using IMC 0609, Appendix B, "Emergency Preparedness Significance Determination Process," Sheet 1, "Failure to gomply," and determined that it was of very low safety significance because the declaration of a UE based on low service~ter bay level could have been missed or delayed, consistent with the example provided in the appendix.The inspectors determined that this finding had a cross-cutting aspect in the area of problem identification and resolution because Entergy did not implement effective corrective actions for a previously identified issue associated with inadequate 3 of 10 9/27/2007 12:53 AM 12.- (o 2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSIGHT/ASSESS/IP2/ip2_pim.html monitoring of service water intake bay level. (Section 1R17),spection Report# : 2007002 (pdf)Occupational Radiation Safety Significance:E Dec 31, 2006 Identified By: Self-Revealing Item Type: NCV NonCited Violation FAILURE TO SURVEY AND PROVIDE ACCESS TO AN UNPOSTED HIGH RADIATION AREA A Green, self-revealing NCV of 10 CFR 20.1501 with respect to 10 CFR 20.1902(b) was identified, in that, Entergy failed to survey radiological condition changes after a plant manipulation that was likely to cause a change in radiological conditions, and this led to the failure to post a plant area as a high radiation area. As a result, two workers were allowed access to an unsurveyed and unposted high radiation area.The finding is more than minor because it is associated with the Occupational Radiation Safety <cornerstone attribute of exposure control and affected the cornerstone objective, because not establishing radiological conditions and commensurate controls after changing plant radiological conditions prior to allowing access to the affected areas can cause increased personnel exposure. The inspectors evaluated this finding using IMC 0609, Appendix C, "Occupational Radiation Safety Significance Determination Process," and determined that it was of very low safety significance (Green) because it did not involve ALARA planning and controls, an overexposure, a substantial potential for overexposure, or an impaired ability to assess dose. This issue was entered into Entergy's corrective action program and training was provided to the radiation protection staff.The inspectors determined that this finding had a cross-cutting aspect in the area of human performance because Entergy did not use a conservative assumption in the decision-making process, in that, the watch radiation protection technician did not question the radiological conditions of the pipe chase area after a change of plant conditions had occurred and did not require a survey of the pipe chase area before authorizing access to personnel. Inspection Report# : 2006005 (pdf)* ignificance:E Dec 31, 2006 Identified By: Self-Revealing Item Type: FIN Finding UNIT 2 CONTAINMENT SUMP STRAINER MODIFICATION COLLECTIVE EXPOSURE OVERRUNS DUE TO INADEQUATE MOD PREPARATION A self-revealing finding was identified that involved inadequate modification planning and construction preparations relative to a Unit 2 containment sump strainer modification that resulted in significant unplanned collective exposure (93.7 person-rem compared to a work activity estimate of 10.9 person-rem). Specifically, the actual job site conditions for installation of the containment sump modification were not adequately evaluated with respect to the radiological impact of increased occupancy in high dose rate work areas. This unplanned additional in-field high radiation work resulted in significant unintended exposure that could have been avoided. This issue was entered into Entergy's corrective action program so that lessons learned could be incorporated into the Unit 3 containment sump modification. The inspectors determined that this finding was more than minor because it was similar to examples 6.a and 6.b of IMC 0612, Appendix E, "Examples of Minor Issues," in that, the issue involved actual collective exposure greater than 5 person-rem and was greater than 50 percent above the estimated or intended exposure; and the majority of the dose overrun was due to activities within Entergy's control. The inspectors evaluated this finding using IMC 0609, Appendix C,"Occupational Radiation Safety Significance Determination Process," and determined that the finding was of very low safety significance (Green) because it involved an ALARA planning issue, and the 3-year rolling average collective dose for Unit 2 was less than 135 person-rem (73 person-rem average annual exposure for 2003 through 2005).The inspectors determined that this finding had a cross-cutting aspect in the area of human performance because Entergy did not adequately incorporate job site conditions in the work control planning process.Inspection Report# : 2006005 (pdf)Public Radiation Safety.ysical Protection &Although the NRC is actively overseeing the Security cornerstone, the Commission has decided that certain findings 9 of 10 9/27/2007 12:53 AM 2.1/ 2Q/2007 Inspection Findings -Indian Point 2 http://www.nrc.gov/NRR/OVERSIGHT/ASSESS/IP2/ip2_pim.htmi pertaining to security cornerstone will not be publicly available to ensure that potentially useful information is not provided a possible adversary. Therefore, the cover letters to security inspection reports may be viewed.miscellaneous Significance: / Dec 05, 2006 Identified By: NRC Item Type: FIN Finding FAILURE TO ENTER SAFETY CULTURE ASSESSMENT RESULTS INTO CORRECTIVE ACTION PROGRAM The NRC inspectors identified a finding when Entergy failed to initiate condition reports in accordance with EN-LI-102,"Corrective Action Process," for the adverse conditions identified in the 2006 Safety Culture Assessment. Consequently, the adverse conditions were not evaluated and appropriate corrective actions were not identified in a timely manner. The contractor who performed the independent safety culture assessment presented the site specific results to Entergy management in June 2006. The, negative responses and declining trends identified in the assessment constituted adverse conditions that should have been entered into the corrective action program. At the time of the inspection, Entergy had not initiated condition reports for the assessment results. Consequently, the results had not been fully evaluated to understand-the-causes and identify appropriate actions to address-the.identified-issues.-Additionally, organizations-identified by the contractor as needing management attention had not developed departmental action plans at the time of the inspection. Entergy entered this issue into the corrective action program and initiated a learning organization condition report to track development and implementation of action plans to address the assessment results.The inspectors determined that the finding was more than minor because if left uncorrected it would become a more significant safety concern. Without appropriate action, the weaknesses in the safety culture onsite would continue, increasing the potential that safety issues would not receive the attention warranted by their significance. The finding was not suitable for SDP evaluation, but has been reviewed by NRC management and has been determined to be a finding of very low safety significance. The finding was not greater than very low safety significance because the inspectors did not identify any issues that were not raised which had an actual impact on plant safety or were of more than minor safety significance. e inspectors determined that this finding had a cross-cutting aspect in the area of problem identification and resolution cause Entergy did not identify issues with the potential to impact nuclear safety in the corrective action process for~valuation and resolution in a timely manner.Inspection Report# : 2006006 (pdf)Last modified August 24, 2007 S 10 of J0 9/27/2007 12:53 AM EXHIBIT LL UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE SECRETARY In the Matter of )Pa'ina Hawaii, LLC ) Docket No. 030-36974 Materials License Application )--= DECLARATION OF DR. GORDON R. THOMPSON -IN SUPPORT OF PETITIONER'S AREAS OF CONCERN I, Gordon R. Thompson, declare that if called as a witness in this action I could testify of my own personal knowledge as follows: 1. INTRODUCTION 1-1. I am the executive director of the Institute for Resource and Security Studies (IRSS), a nonprofit, tax-exempt corporation based in Massachusetts. Our office is located at 27 Ellsworth Avenue, Cambridge, Massachusetts 02139. IRSS was founded in 1984 to conduct technical and policy analysis and public education, with the objective of promoting peace and international security, efficient use of natural resources, and protection of the environment. In addition to holding my position at IRS S, I am also a research professor at the George Perkins Marsh Institute, Clark University, Worcester, Massachusetts. My professional qualifications are discussed in Section I1 of this declaration. 1-2. 1 have been retained by Concerned Citizens of Honolulu as an expert witness in a proceeding before the US Nuclear Regulatory Commission (NRC), regarding an application by Pa'ina Hawaii, LLC, for a license to build and operate a commercial pool-type industrial irradiator in Honolulu, Hawai'i, at the Honolulu International Airport.1-3. The purpose of this declaration is to support Concerned Citizens' contention that"special circumstances" exist, precluding the NRC's use of a categorical exclusion from the National Environmental Policy Act's mandate to prepare either an environmental assessment (EA) or environmental impact statement (EIS) in the context of the proposed license.' In this declaration, I focus on the potential for acts of malice or insanity, related to the proposed Pa'ina Hawaii irradiator, to cause harm to people and/or the enviromnent. As part of that focus, I address the potential to reduce the risk of harm by adopting alternatives to the proposed mode of construction and operation of the irradiator. Also, I address the processes whereby acts of malice or insanity could be considered in a licensing proceeding or during the preparation of an EA or EIS. My focus on the implications of potential acts of malice or insanity does not indicate that I regard other issues, relevant to licensing of the proposed irradiator, as having a lesser significance. 1-4. The remainder of this declaration has seven sections. Section II discusses my professional qualifications. Section 1I] discusses some of the characteristics of the proposed Pa'ina Hawaii irradiator. The potential for cormnercial nuclear facilities, including irradiators, to be affected by acts of malice or insanity is addressed in Section IV. That discussion is continued in Section V, with a focus on irradiators. Section VI discusses the potential to reduce the risk of harm, arising from acts of malice or insanity, by adopting alternatives to the proposed design and mode of operation of the Pa'ina Hawaii irradiator. Section VI] addresses the processes whereby acts of malice or insanity could be considered in a licensingproceeding, or during the 10 C.F.R. § 51.22(b); see also id. § 2.335(b); 40 C.F.R. § 1508.4.2 preparation of an EA or EIS, for the Pa'ina Hawaii irradiator. Major conclusions are set forth in Section VIII. Documents cited in this declaration are listed in a bibliography that is appended to the declaration.

11. MY PROFESSIONAL QUALIFICATIONS 11-1. 1 received an undergraduate education in science and mechanical engineering at the University of New South Wales, in Australia.

Subsequently, I pursued graduate studies at Oxford University and received-from-that institution a Doctorate of Philosophy in mathematics in 1973, for analyses of plasmas undergoing thermonuclear fusion. During my graduate studies I was associated with the fusion research program of the UK Atomic Energy Authority. My undergraduate and graduate work provided me with a rigorous education in the methodologies and disciplines of science, mathematics, and engineering. 11-2. Since 1977, a significant part of my work has consisted of technical analyses of safety, security and environmental issues related to nuclear facilities. These analyses have been sponsored by a variety of nongovermnental organizations and local, state and national governments, predominantly in North America and Western Europe. Drawing upon these analyses, I have provided expert testimony in legal and regulatory proceedings, and have served on committees advising US government agencies. In a number of instances, my technical findings have been accepted or adopted by relevant governmental agencies. To illustrate my expertise, I provide in the following paragraphs some details of my experience. 11-3. During the period 1978-1979, 1 served on an international review group commissioned by the government of Lower Saxony (a state in Germany) to evaluate a proposal for a nuclear fuel cycle center at Gorleben. I led the subgroup that examined safety and security risks, and identified alternative options with lower risk. One of the risk issues that ] identified 3 and analyzed was the potential for self-sustaining, exothermic oxidation reactions of fuel cladding in a high-density spent-fuel pool if water is lost from the pool. Hereafter, for simplicity, this event is referred to as a "pool fire". In examining the potential for a pool fire, I identified partial loss of water as a more severe condition than total loss of water. I identified a variety of events that could cause a loss of water from a pool, including aircraft crash, sabotage, terrorism and acts of war. Also, I identified and described alternative spent-fuel-storage options with lower risk; these lower-risk options included design features such as spatial separation, natural cooling and underground vaults. The Lower Saxony government accepted my findings about the risk of a pool fire, and ruled in May 1979 that high-density pool storage of spent fuel was not an acceptable option at Gorleben. As a direct result, policy throughout Germany has been to use dry storage in casks, rather than high-density pool storage, for away-from-reactor storage of spent fuel.11-4. My work has influenced decision making by safety officials in the US Department of Energy (DOE). During the period 1986-1991,1 was commissioned by environmental groups to assess the safety of the military production reactors at the Savannah River Site, and to identify and assess alternative options for the production of tritium for the US nuclear arsenal. Initially, much of the relevant information was classified or otherwise inaccessible to the public.Nevertheless, I addressed safety issues through analyses that were recognized as accurate by nuclear safety officials at DOE. I eventually concluded that the Savannah River reactors could not meet the safety objectives set for them by DOE. The Department subsequently reached the same conclusion, and scrapped the reactors. Current national policy for tritium production is to employ commercial reactors, an option that I had concluded was technically attractive but problematic from the perspective of nuclear weapons proliferation. 4 13-3 11-5. In 1977, and again during the period 1996-2000, 1 examined the safety and security of nuclear fuel reprocessing and liquid high-level radioactive waste management facilities at the Sellafield site in the UK. My investigation in the latter period was supported by consortia of local governments in Ireland and the UK, and I presented findings at briefings in the UK and Irish parliaments in 1998. 1 identified safety issues that were not addressed in any publicly available literature about the Sellafield site. As a direct result of my investigation, the UK Nuclear Installations Inspectorate (NII) required the operator of the Sellafield site -- British Nuclear Fuels -- to conduct extensive safety analyses. These analyses confirmed the significance of the safety issues that I had identified, and in January 2001 the Nil established a legally binding schedule for reduction of the inventory of liquid high-level radioactive waste at Sellafield. The NIl took this action in recognition of the grave offsite consequences of a release to the environment from the tanks in which liquid high-level waste is stored. I had identified a variety of events that could cause such a release, including acts of malice or insanity.11-6. In January 2002, 1 authored a submission to the .UK House of Commons Defence Committee, addressing the potential for civilian nuclear facilities to be used by an enemy as radiological weapons. The submission drew upon my own work, and the findings of other analysts, dating back as far as the mid-1970s. My primary recommendation was that the Defence Committee should call upon the Parliamentary Office of Science and Technology (POST) to conduct a thorough, independent analysis of this threat. I argued that the UK government and nuclear industry could not be trusted to provide a credible analysis. The Defence Committee subsequently adopted my recommendation, and a study was conducted by POST.5 11-7. 1 was the author or a co-author of two documents, published in 2003, that addressed the safety and security risks arising from the storage of spent fuel in high-density pools at US nuclear power plants.2 This work expanded on analysis that I had first conducted in the context of the proposed nuclear fuel cycle center at Gorleben, as discussed in paragraph 11-3, above. The two documents became controversial, and their findings and recommendations were challenged by the NRC. The US Congress recognized that our findings, if correct, would be significant for national security. Accordingly, Congress requested the National Academy of Sciences (NAS) to conduct an independent investigation of these issues. The Academy's report vindicated the work done by my co-authors and me.3 1II. CHARACTERISTICS OF THE PROPOSED IRRADIATOR Ill-1. According to the NRC, Pa'ina Hawaii has stated that the proposed irradiator would be used primarily for the irradiation of fresh fruit and vegetables bound for the US mainland.Other items to be irradiated would include cosmetics and pharmaceutical products.4 A story in the technical press has stated that the irradiator would be the Genesis model manufactured by Gray-Star, using a I million-Curie Cobalt-60 source located in a water-filled pool 22 feet deep.'Cobalt-60 is a radioactive isotope with a half-life of 5.3 years. According to an April 2004 NRC fact sheet, all US commercial irradiators regulated by the NRC currently use Cobalt-60; the amount used at each irradiator typically exceeds I million Curies and can range up to 10 million 2 Thompson, 2003; Alvarez et al, 2003.3 NAS, 2005.4 NRC, 2005.5 Nuclear News, 2005.6 Curies.' The Cobalt-60 is present in the form of sealed sources typically consisting of metallic"pencils" said to be about one inch in diameter and one foot long.7 111-2. The version of Pa'ina Hawaii's license application that has been posted at the NRC website has major redactions. That document does not allow the reaching of any conclusion about the safety and security of the proposed irradiator. IV. THE POTENTIAL FOR NUCLEAR FACILITIES TO BE AFFECTED BY ACTS OF MALICE OR INSANITY IV-1. No commercial nuclear facility in the United States was designed to resist attack.Facilities have some capability in this respect by virtue of design for other objectives (e.g., resisting tornado-driven missiles). Beginning in 1994, with the NRC's promulgation of a vehicle-bomb rule, each US nuclear power plant has implemented site-security measures (e.g., barriers, guards) that have some capability to prevent attackers from damaging vulnerable parts of the plant. The scope of this defense was increased in response to the attacks of I 1 September 2001. Nevertheless, it continues to reflect the NRC's judgment that a "light defense" of nuclear power plants, to use military terminology, is sufficient. 8 This judgment is not supported by any published strategic analysis. The NRC takes the same approach in regulating nuclear facilities other than power plants, including commercial irradiators. IV-2. A strategic analysis of needs and opportunities for security of a nuclear facility should have three parts. It should begin with an assessment of the scale of damage that could arise from an attack. A major determinant of this scale is the amount of radioactive material that is available for release to the atmosphere or a water body; other determinants are the 6 NRC, 2004b.7 Kelly, 2002.8 NRC, 2004a.7 I 3C4& vulnerability of the facility to attack, and the consequences of attack.9 The second step in the strategic analysis should be to assess the future threat environment. The third step should be to assess the adequacy of present measures to defend the facility, and to identify options for providing an enhanced defense.IV-3. The analyst should seek to understand the interests and perspectives of potential attackers. To illustrate, a sub-national group that is a committed enemy of the United States might perceive two major incentives for attacking a US commercial nuclear facility. First, release of a large amount of radioactive material could cause major, lasting damage to the United States. Second, commercial nuclear technology could symbolize US military dominance through nuclear weapons and associated technologies such as guided missiles; a successful attack on a commercial nuclear facility could challenge that symbolism. Conversely, the group might perceive three major disincentives for attack. First, nuclear facilities could be less vulnerable than other potential targets. Second, radiological damage from the attack would be indiscriminate, and could occur hundreds of km downwind in non-enemy locations (e.g., Mexico). Third, the United States could react with extreme violence.IV-4. The threat environment must be assessed over the entire period during which a nuclear facility is expected to operate. For spent-fuel storage facilities, that period could exceed a century. The risk of attack will accumulate over the period of operation. Forecasting international conditions over several decades is a notoriously difficult and uncertain enterprise. Nevenheless, an implicit or explicit forecast must underlie any decision about the level of security that is provided at a nuclear facility. Prudence dictates that a forecast in this context 9 Direct release of radioactive material is not the only potential consequence of an attack on a nuclear facility. There is also concern that radioactive or fissile material could be removed from the facility and incorporated into a radiological or nuclear weapon.13:7 should err on the side of pessimism. Decision makers should, therefore, be aware of a literature indicating that the coming decades could be turbulent, with a potential for higher levels of violence.'° One factor that might promote violence is a perception of resource scarcity. It is noteworthy that many analysts are predicting a peak in world oil production within the next few decades." Also, a recent international survey shows significant degradation in the Earth's ability to provide ecosystem services.' IV-5. The potential for attacks on nuclear facilities has been studied for decades." 3 Nevertheless, the NRC remains convinced that these facilities require only a light defense. The NRC's position fails to account for the growing strategic significance of sub-national groups as potential enemies. Various groups of this kind could possess the motive and ability to mount an attack on a US nuclear facility with a substantial probability of success. The unparalleled military capability of the United States cannot deter such a threat if the attacking group has no territory that could be counter-attacked. Moreover, use of US military capability could be counter-productive, creating enemies faster than they are killed or captured. Many analysts believe that the invasion of Iraq has produced that outcome.IV-6. The discussion in the preceding paragraphs shows that it would be prudent to consider options for providing an enhanced defense of nuclear facilities. Design studies have identified a large potential for increasing the robustness of new facilities.' 4 This finding argues for careful consideration of alternative options during the licensing of a new facility. At existing facilities, there is usually less opportunity for increasing robustness. Nevertheless, there are 10 Kugler, 1995; Raskin et al, 2002.1] Hirsch et al, 2005.12 Stokstad, 2005.'3 Ramberg, 1984.14 Hannerz, 1983.9 1ý9 many opportunities to enhance the defenses of an existing facility. I have identified such opportunities in a number of instances. For example, I have identified a set of measures that could provide an enhanced defense of the San Onofre nuclear power plant." 5 V. POTENTIAL ACTS OF MALICE OR INSANITY IN THE CONTEXT OF IRRADIATORS V-I. Section IV, above, shows that it would be prudent, in the licensing and regulation of a range of nuclear facilities, to consider the implications of potential acts of malice or insanity.Commercial irradiators, such as that proposed by Pa'ina Hawaii, are among the facilities for which this consideration would be prudent. The reason is that these irradiators contain large amounts of Cobalt-60. If that material were removed from its containment and brought into proximity to humans and other life forms or their habitats, significant harm could occur. The nature of that harm is illustrated by a case study that is discussed in paragraph V-3, below.V-2. An act of malice or insanity could remove Cobalt-60 from its containment, and bring this material into potential proximity to life forms, in two ways. First, a violent event involving mechanisms. such as blast, impact and fire could release Cobalt-60 to the atmosphere from the irradiator facility or during transport of Cobalt-60 sealed sources to or from the facility.6 This violent event could be a deliberate attack or, conceivably, a collateral event deriving from an attack directed elsewhere. Second, Cobalt-60 sealed sources could be removed intact from the irradiator facility or during, transport to or from the facility, and these sources could be used to deliberately irradiate life forms or their habitats. This irradiation could be accomplished by atmospheric dispersal of Cobalt-60 from a sealed source, with or without 15 Thompson, 2004.J6 After release to the atmosphere, the Cobalt-60 would be present in fragments or particles of various sizes, which would eventually be deposited on the ground around or downwind of the point of release.10 1.39 chemical and physical manipulation of the source prior to dispersal.' 7 An explosive charge could be used to achieve dispersal, a process that is commonly described as the use of a "dirty bomb".Atmospheric dispersal might also be achieved, after chemical and physical manipulation of the source, through mechanisms such as spraying and combustion. As an alternative to atmospheric dispersal, hostile irradiation could be accomplished by clandestinely placing sealed sources, or fragments thereof, in locations (e.g., bus or train stations) where targeted populations are likely to be present.'I V-3. Findings of a theoretical case study on atmospheric dispersal of Cobalt-60 were summarized in Congressional testimony by the Federation of American Scientists in 2002."' The case study assumed that one Cobalt-60 "pencil" from a commercial irradiator would be explosively dispersed at the lower tip of Manhattan. The results were compared with those from an assumed dispersal of radioactive cesium, in the following statement: 2 1"Again, no immediate evacuation would be necessary, but in this case [the Cobalt-60 dispersal], an area of approximately one thousand square kilometers, extending over three states, would be contaminated. Over an area of about three hundred typical city blocks, there would be a one-in-ten risk of death from cancer for residents living in the contaminated area for forty years. The entire borough of Manhattan would be so contaminated that anyone living there would have a one-in-a-hundred chance of dying from cancer caused by the residual radiation. It would be decades before the city was inhabitable again, and demolition might be necessary." V-4. Following an atmospheric dispersal of radioactive material such as Cobalt-60, the area of land that would be regarded as contaminated, and the overall economic consequences of the event, would depend on the contamination standard that would apply.2' At present, there are 17 Zimmerman and Loeb, 2004.18 NRC, 2003.'9 Kelly, 2002.20 Kelly, 2002.21 Reichmuth et al, 2005.11-ý/co-competing standards, and no clarity about which one would apply.2 Resolving this issue could be politically difficult, either before or after a dispersal event. A further complicating factor is the exclusion of radiation risk from virtually all insurance policies written in the United States.2 3 V-5. A malicious actor who seeks to expose a population to radioactive material, such as Cobalt-60, could have a range of goals including: (i) causing prompt casualties; (ii) spreading panic; (iii) recruitment to the actor's cause; (iv) asset denial; (v) economic disruption; and (vi)causing long-term casualties. 4 V-6. Many public officials in the United States and elsewhere are aware of the threat of malicious exposure to radioactive material. At times, substantial resources have been allocated to addressing this threat. For example, a major US government effort was mounted in December 2003 to detect "dirty bombs" in various US cities.2' Recently, the Australian government has located large, unsecured radioactive sources in two countries in Southeast Asia. At least one of these sources was Cobalt-60. 2 6 Acting in a manner that invites comparison with licensing of the proposed Pa'ina Hawaii irradiator, the National Nuclear Security Administration (NNSA)removed Cobalt-60 from an irradiator at the University of Hawai'i in March 2005.27 This removal occurred during the same week in which the NRC issued a Notice of Violation that responded to an NRC-observed security breach at the irradiator in March 2003.28 It is said that 22 Medalia, 2004; Zimmerman and Loeb, 2004.23 Zimmerman and Loeb, 2004.24 Medalia, 2004.25 Mintz and Schmidt, 2004.26 Eccleston and Walters, 2005.27 NNSA, 2005.28 Environment Hawai'i, 2005b.12 the irradiator contained about 1,000 Curies of Cobalt-60. 9 An NNSA official described the removal of this Cobalt-60 as follows: 3 0"The removal of these radiological sources has greatly reduced the chance that radiological materials could get into the wrong hands. The university of Hawaii, its surrounding neighbors and the international cormmunity are safer today as [a] result of this effort." V-7. There is a comparatively small technical literature on the safety and security of commercial irradiators, although it is known that safety and security incidents have occurred at these facilities. 3" Irradiators represent one application of sealed radioactive sources. Overall, the use of those sources has created grounds for concern from the perspective of security. According to NRC data, there were more than 1,300 instances of lost, stolen and abandoned sealed sources in the United States between 1998 and 2002.32 V-8. In June 2003, the NRC issued its first security order requiring enhanced security at large commercial irradiators. 3 3 The nature and scope of the required security measures have not been publicly disclosed. It is noteworthy that NRC officials have said that the NRC lacks sufficient staff to conduct inspections of all sealed-source licensees that are expected to receive security orders.34 V-9. If provided with relevant information about the design of commercial irradiators, and the security measures that are in effect at these facilities, independent analysts could assess the vulnerability of these facilities to potential acts of malice or insanity. That assessment could be performed in a manner such that sensitive information is not publicly disclosed. The 29 Environment Hawai'i, 2005a.3 0 NNSA, 2005.3' NRC, 1983.32 GAO, 2003, page 17.33 GAO, 2003, page 28.34 GAO, 2003, page 31.13 assessment could, for example, assess the vulnerability of irradiators to shaped charges.3 Also, the assessment could examine the NRC's undocumented assertion that it has "preliminarily determined that it would be extremely difficult for someone to explode a cobalt-60 source in a way that could cause widespread contamination". 3 6 As explained in paragraph V-2, above, explosive dispersal of an intact Cobalt-60 sealed source is one, but not the only, mechanism whereby Cobalt-60 could be brought into proximity to targeted populations. VI. ALTERNATIVE OPTIONS VI-l. The currently-proposed design and mode of operation of the Pa'ina Hawaii irradiator implies a risk of harm to people and/or the environment, arising from potential acts of malice or insanity. Assessment of the nature and scale of that risk must await the provision of more information about the facility than is now publicly available. It is, however, already clear that lower-risk options exist. These options could be systematically examined in an EIS.VI-2. Two options are available that could eliminate the risk. One such option would be to adopt non-irradiative methods of treating fresh fruit and vegetables. The second option would to use an irradiator that does not require radioactive material such as Cobalt-60. In this context, it is noteworthy that an existing comm-ercial irradiator in Hawai'i employs electron-beam technology. This facility, known as Hawai'i Pride, was built at Kea'au in 2000. Some observers question whether two irradiators, or even one, can be economically viable in Hawai'i.f' VI-3. If the Pa'ina Hawaii irradiator were to be built and operated, using Cobalt-60, its design, location and mode of operation could be modified to reduce the risk of harm arising from potential acts of malice or insanity. For example, site security and the robustness of the facility 35 Waiters, 2003.3 6 NRC, 2004b.37 Environment Hawai'i, 2005c.14 could be enhanced. Alternative locations could potentially reduce the risk in two ways. First, the currently-proposed location might be especially attractive to attackers because of the proximity of military and symbolic targets including Hickam Air Force Base and Pearl Harbor.Second, the currently-proposed location at Honolulu International Airport might facilitate attack from the air by, for example, an explosive-laden general aviation aircraft. Full delineation of potential modifications, and assessment of their costs and contributions to risk reduction, must await the provision of more information about the facility than is now publicly available. VII. CONSIDERATION OF ACTS OF MALICE OR INSANITY IN A LICENSE PROCEEDING, EA, OR EIS VII-1. During an open session of a license proceeding, or in the published version of an EA or EIS, it would be inappropriate to disclose information that could assist the perpetrator of an act of malice or insanity that affects a nuclear facility. It does not follow, however, that acts of malice or insanity cannot be considered in a license proceeding, an EA, or an EIS. Well-tested procedures are available whereby .this consideration could occur without publicly disclosing sensitive information. in the context of a license proceeding, some of the sessions, and the accompanying documents, could be open only to authorized persons. Similarly, an EA or EIS could contain sections or appendices that are available only to authorized persons.Interested parties, including public-interest groups, could nominate representatives, attorneys and experts who can become authorized persons on their behalf.VIII. MAJOR CONCLUSIONS VII]-I. It would be prudent, in the licensing and regulation of a range of nuclear facilities, to consider the implications of potential acts of malice or insanity. Commercial 15 irradiators, such as that proposed by Pa'ina Hawaii, are among the facilities for which this consideration would be prudent.VIII-2. The currently-proposed design and mode of operation of the Pa'ina Hawaii irradiator implies a risk of harm to people and/or the environment, arising from potential acts of malice or insanity. Assessment of the nature and scale of that risk must await the provision of more information about the facility than is now publicly available. It is, however, already clear that lower-risk options exist. These options could be systematically examined in an EIS.VIII-3. Well-tested procedures are available whereby acts of malice or insanity could be considered in a license proceeding, an EA, or an EIS related to the proposed Pa'ina Hawaii irradiator. I declare under penalty of perjury that I have read the foregoing declaration and know the contents thereof to be true of my own knowledge. Dated at Cambridge, Massachusetts, 3 October 2005.GORDON R. THOMPSON 16 APPENDIX: BIBLIOGRAPHY (Alvarez et al, 2003)Robert Alvarez, Jan Beyea, Klaus Janberg, Jungmin Kang, Ed Lyman, Allison Macfarlane, Gordon Thompson and Frank N. von Hippel, "Reducing the Hazards from Stored Spent Power-Reactor Fuel in the United States", Science and Global Security, Volume 11, 2003, pp 1-51.(Eccleston and Walters, 2005)Roy Eccleston and Patrick Walters, "Fears for 'dirty bomb' in region", The Australian, 29 August 2005.(Environment Hawai'i, 2005a)"Honolulu Airport Is Proposed as Site For Cobalt-60 Food Irradiation Facility" Environment Hawai'i, Volume 16, Number 3, September 2005, pp 1, 4-6.(Environment Hawai'i, 2005b)"NRC Sanctions University of Hawai'i For Lax Irradiator Management" Environment Hawai'i, Volume 16, Number 3, September 2005, pp 3-4.(Environment Hawai'i, 2005c)"Can Hawai'i Support Two Irradiators?" Environment Hawai'i, Volume 16, Number 3, September 2005, page 7.(GAO, 2003)US General Accounting Office, Nuclear Securitv" Federal and State Action Needed to Improve Security of Sealed Radioactive Sources, GA 0-03-804 (Washington, DC: General Accounting Office, August 2003).(Hannerz, 1983)K. Hannerz, Towards Intrinsically Safe Light Water Reactors (Oak Ridge, Tennessee: Institute for Energy Analysis, February 1983).(Hirsch et al, 2005)Robert L. Hirsch, Roger H. Bezdek and Robert M. Wendling, "Peaking Oil Production: Sooner Rather Than Later?" Issues in Science and Technology, Volume XXI, Number 3, Spring 2005, pp 25-30. (This paper was adapted from a report prepared for the US Department of Energy's National Energy Technology Laboratory.)(Kelly, 2002)Henry Kelly, President, Federation of American Scientists, testimony before the US Senate Committee on Foreign Relations, 6 March 2002.17 (Kugler, 1995)Richard L. Kugler, Toward a Dangerous World: US National Security Strategy for the Coming Turbulence (Santa Monica, California: RAND, 1995).(Medalia, 2004)Jonathan Medalia, Terrorist "Dirty Bombs": A Brief Primer (Washington, DC: Congressional Research Service, Library of Congress, 1 April 2004).(Mintz and Schmidt, 2004)John Mintz and Susan Schmidt, "'Dirty Bomb' Was Major New Year's Worry", Washington Post, 7 January 2004, page A01.(NAS, 2005)Committee on the Safety and Security of Commercial Spent Nuclear Fuel Storage, Board on Radioactive Waste Management, National Research Council, Safeoy and Security of Commercial Spent Nuclear Fuel Storage: Public Report (Washington, DC: National Academies Press, 2005).(NNSA, 2005)National Nuclear Security Administration, "NNSA Removes Radioactive Sources From University Facility", Press Release NA-05-07, 13 April 2005.(NRC, 2005)US Nuclear Regulatory Commission, "NRC Announces Opportunity for Hearing on License Application for Commercial Irradiator in Honolulu, Hawaii", NRC News, No. IV-05-029, 26 July 2005.(NRC, 2004a)US Nuclear Regulatory Commission, Protecting Our Nation Since 9-11-01, NUREG/BR-0314 (Washington, DC: Nuclear Regulatory Commission, September 2004).(NRC, 2004b)US Nuclear Regulatory Commission, "Commercial Irradiators". Fact Sheet, April 2004.(NRC, 2003)US Nuclear Regulatory Commission, "Dirty Bombs", Fact Sheet, March 2003.(NRC, 1983)US Nuclear Regulatory Commission, "Safety and Security of Irradiators", Infornation Notice No. 83-09, 9 March 1983.(Nuclear News, 2005)"Food Irradiation: License Sought for Hawaii Irradiator", Nuclear News, September 2005, pp 61-62.18 (Ramberg, 1984)Bennett Ramberg, Nuclear Power Plants as Weapons for the Enemy: An Unrecognized Military Peril (Berkeley, California: University of California Press, 1984).(Raskin et al, 2002)Paul Raskin et al, Great Transition: The Promise and Lure of the Times Ahead (Boston, Massachusetts: Stockholm Environment Institute, 2002).(Reichmuth et al, 2005)Barbara Reichmuth, Steve Short and Tom Wood, "Economic Consequences of a Rad/Nuc Attack: Cleanup Standards Significantly Affect Cost", a paper presented at, and recorded in a CD-ROM archive of, a conference sponsored by the US Department of Homeland Security, titled: "Working Together: R&D Partnerships in Homeland Security", 27-28 April 2005, Boston, Massachusetts.(Stokstad, 2005)Erik Stokstad, "Taking the Pulse of Earth's Life-Support Systems", Science, Volume 308, 1 April 2005, pp 41-43. (News story about the Millennium Ecosystem Assessment.)(Thompson, 2004)Gordon Thompson, testimony before the Public Utilities Commission of the State of California regarding Application No. 04-02-026, 13 December 2004. (This testimony, prepared for California Earth Corps, addressed the provision of an enhanced defense of Units 2 and 3 of the San Onofre Nuclear Generating Station.)(Thompson, 2003)Gordon Thompson, Robust Storage of Spent Nuclear Fuel: A Neglected Issue oQf Homeland Security (Cambridge, Massachusetts: Institute for Resource and Security Studies, January 2003).(Walters, 2003)William Walters, "An Overview of the Shaped Charge Concept", paper presented at the I Ith Annual ARL/USMA Technical Symposium, 5 and 7 November 2003. (This symposium was sponsored by the Mathematical Sciences Center of Excellence at the US Military Academy (USMA) and hosted by the US Army Research Laboratory (ARL) and USMA.)(Zimmerman and Loeb, 2004)Peter D. Zimmerman and Cheryl Loeb, "Dirty Bombs: The Threat Revisited", Defense Horizons (a publication of the Center for Technology and National Security Policy, National Defense University), Number 38, January 2004, pp 1-1 1.19[.0~ INSTITUTE FOR RESOURCE AND SECURITY STUDIES 27 Ellsworth Avenue, Cambridge, Massachusetts 02139, USA Phone: 617-491-5177 Fax: 617-491-6904 Email: irss@igc.org ROBUST STORAGE OF SPENT NUCLEAR FUEL: A Neglected Issue of Homeland Security by Gordon Thompson January 2003 A report commissioned by Citizens Awareness Network i 4 ý Robust Storage of Spent Nuclear Fuel January 2003 Page 2 About IRSS The Institute for Resource and Security Studies (QRSS) is an independent, non-profit corporation. It was founded in 1984 to conduct technical and policy analysis and public education, with the objective of promoting international security and sustainable use of natural resources. IRSS projects always reflect a concern for practical solutions to resource, environment and security problems. Projects include detailed technical studies, participation in public education and debate, and field programs that promote the constructive management of conflict.About the author Dr. Gordon Thompson is the executive director of IRSS and a research professor at Clark University. He received an undergraduate education in science and mechanical engineering in Australia and a doctorate in applied mathematics from Oxford University. Thompson has extensive experience in assessing the safety and security hazards associated with nuclear facilities, and in identifying alternative designs and modes of operation that can reduce a facility's hazard potential. Acknowledgements This report was commissioned by Citizens Awareness Network (CAN). The author thanks Deb Katz of CAN for her courtesy and assistance during this project. During preparation of the report, important insights and perspectives were contributed by Robert Alvarez, Diane Curran, Robert Goble, Paula Gutlove and Jim Warren. The author, Gordon Thompson, is solely responsible for the content of this report. Robust Storage of Spent Nuclear Fuel January 2003 Page 3 Abstract The prevailing practice of storing most US spent nuclear fuel in high-density pools poses a very high risk. Knowledgeable attackers could induce a loss of water from a pool, causing a fire that would release to the atmosphere a huge amount of radioactive material. Nuclear reactors are also vulnerable to attack. Dry-storage modules used in independent spent fuel storage installations (ISFSIs) have safety advantages in comparison to pools and reactors, but are not designed to resist a determined attack. Thus, nuclear power plants and their spent fuel can be regarded as pre-deployed radiological weapons that await activation by an enemy. The US government and the Nuclear Regulatory Commission seem unaware of this threat.This report sets forth a strategy for robust storage of US spent fuel. Such a strategy will be needed whether or not a repository is opened at Yucca Mountain. This strategy should be implemented as a major element of a defense-in-depth strategy for US civilian nuclear facilities. In turn, that defense-in-depth strategy should be a component of a homeland-security strategy that provides solid protection of our critical infrastructure. The highest priority in a robust-storage strategy for spent fuel would be to re-equip spent-fuel pools with low-density, open-frame racks. As a further measure of risk reduction, ISFSIs would be re-designed to incorporate hardening and dispersal. Preliminary analysis suggests that a hardened, dispersed ISFSI could be designed to meet a two-tiered design-basis threat.The first tier would require high confidence that no more than a small release of radioactive material would occur in the event of a direct attack on the ISFSI by various non-nuclear instruments. The second tier would require reasonable confidence that no more than a specified release of radioactive material would occur in the event of attack using a 10-kilotonne nuclear weapon. Robust Storage of Spent Nuclear Fuel January 2003 Page 4 Table of Contents 1. Introduction

2. Nuclear Power Plants and Spent Fuel in the USA 2.1 Status and Trends of Nuclear Power Plants and Spent Fuel 2.2 Present Practice for Storing Spent Fuel 2.3 Present Security Arrangements

3. The Potential for Attacks on NOclear Facilities 3.1 A Brief History 3.2 The Strategic Context 3.3 The US Government's Response to this Threat 3.4 A Balanced Response to the Threat 4. Defending Nuclear Power Plants and Spent Fuel 4.1 Potential Modes and Instruments of Attack 4.2 Vulnerability to Attack 4.3 Consequences of Attack 4.4 Defense in Depth 4.5 A Strategy for Robust Storage of Spent Fuel 5. Considerations in Planning Hardened, Dispersed, Dry Storage 5.1 Balancing Short- and Long-Term Risks 5.2 Cost and Timeframe for Implementation 5.3 Design-Basis Threat 5.4 Site Constraints

6. A Proposed Design Approach for Hardened, Dispersed, Dry Storage 7. Requirements for Nationwide Implementation of Robust Storage 7.1 Experiments on Vulnerability of Dry-Storage Options 7.2 Performance-Based Specifications for Robust Storage 7.3 A Homeland-Security Strategy for Robust Storage 8. Conclusions

9. Bibliography Robust Storage of Spent Nuclear Fuel January 2003 Page 5 1. Introduction"One fact dominates all homeland security threat assessments:

terrorists are strategic actors. They choose their targets deliberately based on the weaknesses they observe in our defenses and our preparations. They can balance the difficulty in successfully executing a particular attack against the magnitude of loss it might cause." National Strategy for Homeland Security 1 It is well known that nuclear power plants and their spent fuel contain massive quantities of radioactive material. (Note: Irradiated fuel discharged from a nuclear reactor is described as "spent" because it is no longer suitable for generating fission power.) Consequently, thoughout the history of the nuclear power industry, informed citizens have expressed concern that a substantial amount of this material could be released to the environment. One focus of concern has been the possibility of an accidental release caused by human error, equipment failure or natural forces (e.g., an earthquake). In response to citizens' demands and events such as the Three Mile Island reactor accident of 1979, the US Nuclear Regulatory Commission (NRC) has taken some actions that address this threat.To date, citizens have been much less successful in forcing the NRC to address a related threat -- the possibility that a release of radioactive material will be caused by an act of malice or insanity. The citizens' failure is not for lack of effort. For many years, citizen groups have petitioned the NRC and engaged in licensing interventions, seeking to persuade the NRC to address this threat. Yet, the agency has responded slowly, reluctantly and in limited ways, even after the terrorist attacks of 11 September 2001. This limited response is not unique to the NRC. The US government in general seems unwilling to address the possibility that an enemy, domestic or foreign, will exploit a civilian nuclear facility as a radiological weapon.The terrorist attacks of September 2001 demonstrated the vulnerability of our industrial society to determined acts of malice, and cruelly validated long-neglected warnings by many analysts and concerned citizens. In response, the United States employed its military capabilities in Afghanistan and has signaled its willingness to use those capabilities in Iraq and elsewhere. Yet, nothing significant has been done to defend US nuclear power plants and their spent fuel against attack. There is much discussion in the media about"dirty bombs" that disperse radioactive material, but decision makers seem I Office of Homeland Security, 2002, page 7. Robust Storage of Spent Nuclear Fuel January 2003 Page 6 largely unaware that civilian nuclear facilities contain massive quantities of radioactive material and are vulnerable to attack.What is Robust Storage?This report addresses robust storage of spent fuel from nuclear power plants.Here, the term "robust" means that a facility for storing spent fuel is made resistant to attack. The provision of robust storage would substantially reduce the potential for a maliciously-induced release of radioactive material from spent fuel, and would thereby enhance US homeland security. Robust storage of spent fuel should be viewed as a component of a national strategy for reducing the vulnerability of all civilian nuclear facilities, within the context of homeland security. This report takes such a view.A spent-fuel-storage facility can be made resistant to attack in three ways.First, the facility can be made passively safe, so that spent fuel remains in a safe state without needing electrical power, cooling water or the presence of an operating crew. Second, the facility can be "hardened", so that the spent fuel and its containment structure are protected from damage by an instrument of attack (e.g., an anti-tank missile). For a facility at ground level, hardening involves the provision of layers of concrete, steel, gravel or other materials above and around the spent fuel. Third, the facility can be"dispersed", so that spent fuel is not concentrated at one location, but is spread more uniformly across the site. Dispersal can reduce the magnitude of the radioactive release that would arise from a given attack.At present, all but a tiny fraction of US spent fuel is stored at the nation's nuclear power plants. Most of this fuel is stored at high density in water-filled pools that are adjacent to, but outside, the containments of the reactors.This mode of storage does not meet any of the above-stated three conditions for robustness. High-density spent-fuel pools are not passively safe. Indeed, if water is lost from such a pool, which could occur in various ways, the fuel will heat up, self-ignite and burn, releasing a large amount of radioactive material to the environment. Spent-fuel pools are not hardened against attack, and a pool concentrates a large amount of spent fuel in a small space, which is the antithesis of dispersal. A growing fraction of US spent fuel, now about 6 percent of the total inventory, is stored in dry-storage facilities at nuclear power plants. The storage is "dry" in the sense that the spent fuel is surrounded by a gas such as helium, rather than by water. The NRC describes a spent-fuel-storage facility, other than a spent-fuel pool at a nuclear power plant, as an independent Robust Storage of Spent Nuclear Fuel January 2003 Page 7 spent fuel storage installation (ISFSI).2 All but two of the existing ISFSls are at the sites of nuclear power plants, either operational plants or plants undergoing decommissioning. 3 Future ISFSIs could be built at nuclear-.power-plant sites or at away-from-reactor sites. An application to build an ISFSI at an away-from-reactor site -- Skull Valley, Utah -- is awaiting decision by the NRC. It should be noted that the nuclear industry is building dry-storage ISFSIs not as an alternative to high-density pools, but to accommodate the growing inventory of spent fuel as pools become full.Dry-storage ISFSIs meet one of the above-stated three conditions for robust storage of spent fuel. They are passively safe, because their cooling depends on the natural circulation of ambient air. However, none of the existing or proposed ISFSIs is hardened, and none of them is dispersed across its site.A Broader Context This report describes the need for robust storage of all US spent fuel, whether in pools or dry-storage ISFSIs, and sets forth a strategy for meeting this need.As discussed above, a productive discussion of these issues must occur within a broader context, which is is addressed in this report. The provision of robust storage of spent fuel must be viewed as a component of a national strategy for defending the nation's civilian nuclear industry, including all of the nuclear power plants and all of their spent fuel. That strategy must in turn be viewed as a component of homeland security in general. Finally, homeland security must be viewed as a key component of US strategy for national defense and international security.The various levels of security, ranging from the security of nuclear facilities to the security of the nation and the international community, are linked in surprising ways. If our nuclear facilities and other parts of our infrastructure --such as the airlines -- are poorly defended, we may feel compelled to use military force aggressively around the world, to punish or pre-empt attackers. Such action poses the risk of arousing hostility and promoting anarchy, leading to new attacks on our homeland. The potential exists for an escalating spiral of violence. If, however, our nuclear facilities and other critical items of infrastructure are strongly defended, we can gain a double benefit. First, the communities around each facility will. receive direct protection. Second, we can take a more measured approach to national defense, with a greater prospect of detecting, deterring and apprehending potential attackers without undermining civil liberties or international 2 One wet-storage ISFSI exists in the USA, at Morris, Illinois. All other existing ISFSIs, and all planned ISFSIs, employ dry storage.3 The existing ISFSIs that are not at nuclear-power-plant sites are the small wet-storage facility at Morris and a facility in Idaho that stores fuel debris from Three Mile Island Unit 2. Robust Storage of Spent Nuclear Fuel January 2003 Page 8 security. Thus, a decision about the level of protection to be provided at a nuclear facility has wide-ranging implications. The Need for Further Investigation The investigation leading to this report has identified a number of technical issues that could not be resolved within the scope of the investigation. Issues of this kind are flagged in relevant parts of the report. Also, this report has a broad focus. It sets forth a strategy for providing robust storage of US spent fuel, and outlines a design approach for hardened, dispersed, dry storage.Additional analysis, supported by experiments, would be needed to test and refine this design approach and to determine the feasibility of implementing hardened, dispersed, dry storage at particular sites. That work would, in turn, set the stage for detailed, engineering-design studies that could lead to site-specific implementation. Moreover, a variety of governmental actions would be needed to support nationwide implementation of robust storage. For example, the NRC would need to develop new regulations and guidance.Also, the implementation program would require new financing arrangements, which would probably require new legislation. Sensitive Information An attack on a nuclear facility could be assisted by detailed information about the facility's vulnerability and the measures taken to defend the facility.Thus, certain categories of information related to a facility are not appropriate for general distribution. However, experience shows that secrecy breeds incompetence, complacency and conflicts of interest within the organizations that are shielded from public view.4 Thus, in the context of defending nuclear facilities, protection of the public interest requires that secrecy be limited in two respects. Firstly, the only information that should be withheld from the public is detailed technical information that would directly assist an attacker. Second, stakeholder groups should be fully engaged in the development and implementation of measures for defending nuclear facilities, through processes that allow debate but protect sensitive information. 5 It should be noted that this report does not contain sensitive information and is suitable for general distribution. Thompson, 2002a, Section X.5 Thompson, 2002a, Sections ]X and X./I§ (Q Robust Storage of Spent Nuclear Fuel January 2003 Page 9 Robust Storage and Related Concepts Issues addressed in this report have been the subject of public debate around the United States, and this debate has been framed in a number of ways. One approach has been to speak of "risk reduction", whereby robust storage of spent fuel and related measures are used to reduce the risk of a maliciously-induced release of radioactive material from nuclear facilities. This approach explicitly recognizes that the risk can be reduced but, given the continued existence of radioactive material, cannot be eliminated. Another approach has been to speak of "hardened on-site storage" as a strategy for managing US spent fuel. This approach advocates the robust storage of all spent fuel, but only at the sites of nuclear power plants. A related but distinct approach is"nuclear guardianship", whose supporters argue that radioactive materials should be contained in accessible, monitored storage facilities for the foreseeable future. The robust-storage strategy that is outlined in this report is compatible with all three approaches, and with a prudent assessment of the likelihood and timeframe for development of a radioactive-waste repository at Yucca Mountain.Structure of this Report The remainder of this report begins, in Section 2, with the provision of some basic information about US nuclear power plants and their spent fuel. Then, Section 3 discusses the potential for attacks on nuclear facilities, describes the US government's response to this threat, and outlines a balanced response.Section 4 addresses the vulnerability of nuclear facilities to attack, describes the potential consequences of an attack, outlines a defense-in-depth strategy for a nuclear facility, and sets forth a national strategy for robust storage of spent fuel. Elaborating upon this proposed strategy for robust storage, Section 5 discusses the various factors that must be considered in planning hardened, dispersed, dry storage of spent fuel. Section 6 offers a design approach that accounts for these factors. A set of requirements for nationwide implementation of robust storage is described in Section 7. Conclusions are set forth in Section 8, and a bibliography is provided in Section 9. Documents cited in this report are, unless indicated otherwise, drawn from this bibliography. j5~~) Robust Storage of Spent Nuclear Fuel January 2003 Page 10 2. Nuclear Power Plants and Spent Fuel in the USA 2.1 Status and Trends of Nuclear Power Plants and Spent Fuel There are 103 commercial nuclear reactors operating in the USA at 65 sites in 31 states.6 Of these 103 reactors, 69 are pressurized-water reactors (PWRs), 9 with ice-condenser containments and 60 with dry containments. The remaining 34 reactors are boiling-water reactors (BWRs), 22 with Mark I containments, 8 with Mark II containments and 4 with Mark III containments. In addition there are 27 previously-operating commercial reactors in various stages of storage or decommissioning. As of December 2000, all but 2 of the 103 operating reactors had been in service for at least 9 years, and 55 reactors had been in service for at least 19 years.7 Thus, the reactor fleet is aging. The nominal duration of a reactor operating license is 40 years.Four of the 103 operating reactors have design features intended to resist aircraft impact. The Limerick Unit 1, Limerick Unit 2 and Seabrook reactors were designed to withstand the impact of an aircraft weighing 6 tonnes, while the Three Mile Island Unit I reactor was designed to withstand the impact of an aircraft weighing 90 tonnes. No other US reactor was designed to withstand aircraft impact.8 Wet and Dry Storage of Spent Fuel The core of a commercial nuclear reactor consists of several hundred fuel assemblies. 9 Each fuel assembly contains thousands of cylindrical, uranium-oxide pellets stacked inside long, thin-walled tubes made of zirconium alloy.These tubes are often described as the "cladding" of the fuel. After several years of use inside an operating reactor, a fuel assembly becomes "spent" in the sense that it is no longer suitable for generating fission power. Then, the fuel is discharged from the reactor and placed in a water-filled pool adjacent to the reactor but outside the reactor containment. This fuel, although spent, contains numerous radioactive isotopes whose decay generates ionizing radiation and heat.6 ]n addition, Browns Ferry Unit 1, a BWR with a Mark I containment, is nominally operational. However, it is defueled and not in service.7 Data from the NRC website (www.nrc.gov), 24 April 2002.8 Markey, 2002, page 73.9 The number of fuel assemblies in a reactor core ranges from 121 (in some PWRs) to 764 (in some BWRs). Robust Storage of Spent Nuclear Fuel January 2003 Page ))After a period of storage in a pool, the thermal power produced by a fuel assembly declines to a level such that the assembly can be transferred to a dry-storage ISFSI. Current practice is to allow a minimum cooling period of 5 years before transfer to dry storage. However, this cooling period reflects an economic and safety tradeoff rather than a fundamental physical limit. Fuel cooled for a shorter period than 5 years could be transferred to dry storage, but in that case fewer assemblies could be placed in each dry-storage container. Alternatively, older and younger spent fuel (counting age from the date of discharge from the reactor) could be co-located in a dry-storage container. The major physical limit to placement of spent fuel in dry storage is the maximum temperature of the cladding, which the NRC now sets at 400 degrees C. This temperature limit constrains the allowable heat output of the fuel, which in turn constrains the cooling period.Development of ISFSIs At present, there are 20 ISFSIs in the USA, of which 15 are at sites where commercial reactors are in operation. 1 0 More ISFSls will be needed, because the spent-fuel pools at operating reactors are filling up. Analysis by Allison Macfarlane of MIT shows that, by 2005, almost two-thirds of reactor licensees will face the need to acquire onsite dry-storage capacity, even if shipment of spent fuel away from the reactor sites begins in 2005.11 NAC International, a consulting firm and vendor of dry-storage technology, reaches similar conclusions. NAC estimates that, at the end of 2000, about 6 percent of the US inventory of commercial spent fuel was stored in ISFSIs at reactor sites, whereas about 30 percent of the inventory will be stored in ISFSls by 2010.12 New ISFSls entering operation by 2010 will generally be at reactor sites, although some might be at new sites. At present, only one proposed ISFSI at a new site -- Skull Valley, Utah -- seems to be a plausible candidate for operation by 2010.Shipment of Spent Fuel from Reactor Sites If spent fuel is shipped away from a reactor site, the fuel could have three possible destinations. First, fuel could be shipped to another reactor site, which Carolina Power and Light Co. is now doing, shipping fuel from its 10 Data from the NRC website (www.nrc.gov), 24 April 2002.11 Macfarlane, 2001a.12 NAC, 2001. NAC estimates that the end-2000 US inventory of spent fuel was 42,900 lonnes, of which 2,430 tonnes was in ISFSls. Also, NAC estimates that the 2010 US inventory will be 64,300 tonnes, of Which 19,450 tonnes will be in ISFSls.fsc' Robust Storage of Spent Nuclear Fuel January 2003 Page 12 Brunswick and Robinson reactors to its Harris site.1 3 Second, fuel could be shipped to an ISFSI at an away-from-reactor site, such as Skull Valley. Third, fuel could be shipped to a repository at Yucca Mountain, Nevada. At Yucca Mountain, the fuel would be emplaced in underground tunnels. Under some scenarios for the operation of Yucca Mountain, emplacement would be preceded by a period of interim storage at the surface.There seems to be no current planning for shipment of spent fuel to any reactor site other than Harris. Also, there are factors that argue against shipping fuel to an away-from-reactor ISFSI. First, such shipment would increase the overall transport risk, because fuel would be shipped twice, first from the reactor site to the ISFSI, and then from the ISFSI to the ultimate repository. Second, an away-from-reactor ISFSI would hold a comparatively large inventory of spent fuel, creating a potentially attractive target for an enemy.1 4 Third, shipment to an away-from-reactor ISFSI would not free most reactor licensees from the obligation to build some ISFSI capacity at each reactor site.1 5 Fourth, there is a risk that a large, away-from-reactor ISFSI would become, by default, a permanent repository, despite having no long-term containment capability. Finally, storage of spent -fuel in reactor-site ISFSIs could be cheaper than shipping fuel to away-from-reactor ISFSls.1 6 Time will reveal the extent to which these factors affect the development of away-from-reactor ISFSIs at Skull Valley or elsewhere. Yucca Mountain The Yucca Mountain repository project will not free reactor licensees from the obligation to develop ISFSI capacity, for three reasons. First, the Yucca Mountain repository may never open. This project is politically driven, does not have a sound scientific basis, and is going forward only because previously-specified technical criteria for a repository have been abandoned. 1 7 These deficiencies add weight to the determined opposition to this project by the state of Nevada and other entities. That opposition will also be fueled by concern about the risk of transporting fuel to Yucca Mountain. Second, decades will pass before fuel can be emplaced in a repository at Yucca Mountain. The US Department of Energy (DOE) claims that it can open the repository in 2010, but the US General Accounting Office has determined that 13 The Harris site features one reactor and four spent-fuel pools, and thus has more pool-storage capacity than other reactor sites. Spent fuel that is shipped to Harris is placed in a pool, and there is no current plan to build an ISFSI at Harris.14 The proposed Skull Valley ISFSI could hold 40,000 tonnes of spent fuel, according to the Private Fuel Storage website (www.privatefuelstorage.com), 4 October 2002.15 Macfarlane, 2001a.16 Macfarlane, 2001b.17 Ewing and Macfarlane, 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 13 several factors, including budget limitations, could extend this date to 2015 or later.1 8 DOE envisions that, after the repository is opened, emplacement of fuel will occur over a period of at least 24 years and potentially 50 years.1 9 This vision may prove to be optimistic. Third, under present federal law the Yucca Mountain repository will hold no more than 63,000 tonnes of commercial spent fuel.2 0 Yet, the cumulative amount of commercial spent fuel to be generated during the lifetimes of the 103 currently-licensed reactors is likely to exceed 80,000 tonnes.2 1 Reactor licensees have shown strong interest in obtaining license extensions which, if granted, would lead to the production of a substantial additional amount of spent fuel.Summary To summarize the preceding paragraphs, it is clear that thousands of tonnes of spent fuel will be stored at reactor sites for several decades to come, in pools and/or ISFSIs. Similar amounts of fuel might be stored at away-from-reactor ISFSIs. Moreover, it is entirely possible that the Yucca Mountain repository will not open, with the result that the entire national inventory of spent fuel will be stored for decades, perhaps for 100 years or more, at reactor sites (in pools and/or ISFSIs) and/or at away-from-reactor ISFSIs. It is therefore imperative that each ISFSI is planned to allow for its possible extended use.The NRC has begun to recognize this need, by performing research to determine if dry storage of spent fuel can safely continue for a period of up to 100 years.2 2 2.2 Present Practice for Storing Spent Fuel The technology that is currently used for storing spent fuel was developed without consideration of the possibility of an attack. Nor was there any consideration of the possibility that spent fuel would be stored for many decades. Instead, the technology has developed incrementally, in response to 18 Jones, 2002b.19 DOE, 2002. DOE contemplates the construction of a surface facility for interim storage of spent fuel at Yucca Mountain, especially if emplacement of fuel occurs over a period of 50 years.However, given the cost of this surface facility, a more likely alternative is that fuel would remain in ISFSIs until it could be emplaced in the repository. 20 DOE, 2002. The Nuclear Waste Policy Act limits the total amount of waste that can be placed in a first repository to 70,000 tonnes until a second repository is in operation. DOE plans to use 63,000 tonnes of this capacity for commercial spent fuel. DOE has studied the possible expansion of Yucca Mountain's capacity to include 105,000 tonnes of commercial spent fuel together with other wastes.21 Macfarlane, 2001a.22 "Radioactive Waste Safety Research", from NRC website (www.nrc.gov), 23 September 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 14 changing circumstances. Throughout this process, cost minimization has been a top priority.When the present generation of nuclear power plants was designed, the nuclear industry and the US government both assumed that spent nuclear fuel would be reprocessed. Thus, spent-fuel pools were designed to hold only the amount of spent fuel that a reactor Would discharge over a period of a few years. This was accomplished by equipping the pools with low-density, open-frame racks. However, in the mid-1970s the US government banned reprocessing, and the industry faced the prospect of an accumulating inventory of spent fuel.High-Density Spent-Fuel Pools Industry's response to growing spent-fuel inventories has been to re-rack spent-fuel pools at progressively higher densities, so that more fuel can be stored in a given pool. Now, pools across the nation are equipped with high-density, closed-frame racks that, in many instances, fill the floor area .of the pool from wall to wall. The NRC has allowed this transition to occur despite the fact that a loss of water from a pool equipped with high-density racks can cause the zirconium cladding of the spent fuel to heat up, spontaneously ignite and burn, releasing a large amount of radioactive material to the atmosphere. This hazard is discussed further in Section 4.2.Dry Storage as a Supplement to High-Density Pools Consistent with the focus on cost minimization, the nuclear industry has turned to alternative methods of fuel storage only when pools have begun to fill up. Preventing a pool fire has not been a consideration. Thus, dry-storage ISFSls have not been introduced as an alternative to high-density pool storage. Instead, standard industry practice is to fill a pool to nearly its maximum capacity, then to transfer older spent fuel from the pool to an ISFSI at a rate just sufficient to open up space in the pool for fuel that is discharged from the reactor.2 3 As a part of this strategy, each ISFSI has a modular design. One or more concrete pads are laid in the open air. Each pad supports an array of identical fuel-storage modules that are purchased and installed as needed, so that the ISFSI grows incrementally. Additional pads can be laid as needed.23 In standard practice, the maximum storage capacity of a spent-fuel pool is less than the number of fuel-assembly slots in the pool, to allow for the possibility of offloading a full reactor core. However, preserving the capacity for a full-core offload is not a licensing requirement. Robust Storage of Spent Nuclear Fuel January 2003 Page 15 This modular approach to the development of ISFSIs has functional and cost advantages. However, the present implementation of the approach is not driven by security considerations, and is therefore proceeding slowly. Pools remain packed with fuel at high density, and can therefore be readily exploited as radiological weapons. Moreover, the ISFSls themselves are not designed to resist attack.Types of Dry-Storage Module The NRC has approved 14 different designs of dry-storage module for general use in ISFSIs.2 4 In each of these designs, the central component of the module is a cylindrical, metal container whose interior is equipped with a metal basket structure into which spent fuel assemblies can be inserted. This container is filled with spent fuel while immersed in a spent-fuel pool. Then, the container's lid is attached, the container is removed from the pool and sealed, its interior is dried and filled with an inert gas (typically helium), and it is transferred to the ISFSI.Available designs of dry-storage modules for ISFSIs fall into two basic categories. In the first category, the metal container has a thick wall, and no enclosing structure is provided. This type of module is commonly described as a "monolithic cask". In the second category, the metal container has a thin wall and is surrounded by an overpack.' Different overpacks are used during the three phases of spent-fuel management. First, during the initial transfer of fuel from a spent-fuel pool to an onsite ISFSI, the metal container is surrounded by a transfer overpack. Second, during storage in an ISFSI, the metal container is surrounded by a storage overpack. Third, if fuel is eventually shipped away from the site, the metal container would be placed inside a transport overpack. The second category of module is described here as an "overpack system".A Typical Monolithic Cask One example of a monolithic cask is the CASTOR V/21, which was approved by the NRC in 1990 for general use and is employed at the Surry ISFSI. This cask is about 4.9 meters long and 2.4 meters in diameter, and can hold 21 PWR fuel assemblies. In the storage position the cask axis is vertical. The cask body is made of ductile cast iron with a wall thickness of about 38 cm.Circumferential fins on the outside of the cask body facilitate cooling by natural circulation of ambient air. Fully loaded, this cask weighs about 98 tonnes.2 5 The NRC has approved this cask for storage but not for transport, 24 "Dry Spent Fuel Storage Designs: NRC Approved for General Use", from NRC website (www.nrc.gov), 20 September 2002.25 Raddatz and Waters, 1996. Robust Storage of Spent Nuclear Fuel January 2003 Page 16 although CASTOR casks are widely used in Europe for both purposes.CASTOR casks have not been popular in the US market.Examples of Overpack Systems One example of an overpack system is the NUHOMS design, which the NRC approved for general use in 1995. In this design, the metal container that holds the spent fuel is about 4.7 meters long and 1.7 meters in diameter, and has a wall thickness of 1.6 cm. This container, which is placed horizontally inside its storage overpack, is made of stainless steel and can hold 24 PWR fuel assemblies or 52 BWR fuel assemblies. The storage overpack is a reinforced-concrete box about 6.1 meters long, 4.6 meters high and 2.7 meters wide, with walls and roof 91 cm thick.2 6 Ambient air passes into and out of this structure through vents, and cools the metal container by natural convection. NUHOMS modules are in use at the Davis-Besse site and some other reactor sites.A second example of an overpack system is the NAC-UMS, which the NRC approved for general use in 2000. In this instance, the metal container is about 4.7 meters long and 1.7 meters in diameter, and has a wall thickness of 1.6 cm. This container, which is made of stainless steel, can hold 24 PWR fuel assemblies or 56 BWR fuel assemblies. The storage overpack is a vertical-axis reinforced-concrete cylinder about 5.5 meters high and 3.5 meters in diameter.The wall of this overpack consists of a steel liner 6.4 cm thick and a layer of concrete 72 cm thick. Ambient air passes into and out of the overpack through vents, and cools the metal container by natural convection. At the Maine Yankee nuclear power plant, which is being decommissioned, sixty NAC-UMS modules are being installed. Most of the modules will be used to store spent fuel discharged from the plant. Some modules will store pieces of the reactor core shroud, which is classified as greater-than-Class C (GTCC)waste.2 7 Monolithic Casks versus Overpack Systems The two categories of dry-storage module employ distinct design approaches. In a monolithic cask such as the CASTOR, spent fuel is contained within a thick-walled metal cylinder that is comparatively robust.2 8 In an overpack system the fuel is contained within a thin-walled metal container that has a 26 Ibid.27 Stone and Webster, 1999.28 The vendor of the CASTOR cask has developed a cheaper type of monolithic cask that is made as a steel-concrete-steel sandwich. This cask, known as CONSTOR, was developed for storage and transport of spent fuel from Russian reactors. The vendor states that the CONSTOR cask could be used in the USA. See: Peters et a], 1999. Robust Storage of Spent Nuclear Fuel January 2003 Page 17 limited capability to withstand impact, fire or corrosion. The storage overpack employs concrete -- a cheap material -- as its primary constituent. The transfer and transport overpacks can be used multiple times. Thus, an overpack system can be substantially cheaper -- about half as expensive per fuel assembly, according to some reports -- than a monolithic cask.JSFSI Configuration At ISFSIs in the USA, dry-storage modules are placed on concrete pads in the open air. This approach contrasts with German practice, where dry-storage modules -- usually CASTOR casks -- are placed inside buildings. These buildings are designed to have some resistance to attack from outside using anti-tank weapons. This aspect of their design has been informed by tests conducted in the period 1979-1980. At one German reactor site --Neckarwestheim -- the ISFSI is inside a tunnel built into the side of a hill.2 9 Another feature of the US approach to ISFSI design, consistent with the high priority assigned to cost minimization, is that dry-storage modules are packed closely together in large numbers. In illustration, consider the ISFSI that is proposed for the Diablo Canyon site in California. This facility would hold up to 140 of Holtec's HI-STORM 100 dry-storage modules, whose design is similar to the NAC-UMS system described above. These modules would sit on concrete pads, 20 casks per pad in a 4 by 5 array. Initially, two pads would be built. Ultimately, as the ISFSI expanded, seven pads would be positioned side by side, covering an area about 150 meters by 32 meters. Each module would be a vertical-axis cylinder about 3.7 meters in diameter and 5.9 meters high. The center-to-center spacing of modules would be about 5.5 meters, leaving a gap of 1.8 meters between modules. A security fence would surround the area needed for this array, at a distance of about 15 meters from the outermost modules. That fence would in turn be surrounded by a second fence, at a distance of about 30 meters from the outermost modules.3 0 2.3 Present Security Arrangements One could reasonably expect that the defense strategy for a nuclear-facility site would be a component of a strategy for homeland security, which would itself be a component of an overall strategy for national security. Moreover, one could expect that the site-level strategy would provide a defense in depth.(See Section 4.4 of this report for an explanation of defense in depth.) Logical planning of this kind may eventually occur. However, at present, the security 29 Janberg, 2002.30 PG&E, 2001a. Robust Storage of Spent Nuclear Fuel January 2003 Page 18 arrangements for US nuclear facilities are not informed by any strategic vision.Differing Positions on the Threat of Attack For several decades it has been clear to many people that nuclear power plants and other commercial nuclear facilities are potential targets of acts of malice or insanity, including highly destructive acts. The NRC has repeatedly rebuffed citizens' requests that this threat be given the depth of analysis that would be expected, for example, in an environmental impact statement (E1S).3 1 This history is illustrated by a September 1982 ruling by the Atomic Safety and Licensing Board (ASLB) in the operating-license proceeding for the Harris plant. The intervenor, Wells Eddleman, had proffered a contention alleging, in part, that the plant's safety analysis was deficient because it did not consider the "consequences of terrorists commandeering a very large airplane ..... and diving it into the containment." In rejecting this contention the ASLB stated: 3 2"This part of the contention is barred by 10 CFR 50.13. This rule must be read in pari materia with 10 CFR 73.1(a)(1), which describes the"design basis threat" against which commercial power reactors are required to be protected. Under that provision, a plant's security plan must be designed to cope with a violent external assault by "several persons," equipped with light, portable weapons, such as hand-held automatic weapons, explosives, incapacitating agents, and the like.Read in the light of section 73.1, the principal thrust of section 50.13 is that military style attacks with heavier weapons are not a part of the design basis threat for commercial reactors. Reactors could not be effectively protected against such attacks without turning them into virtually impregnable fortresses at much higher cost. Thus Applicants are not required to design against such things as artillery bombardments, missiles with nuclear warheads, or kamikaze dives by large airplanes, despite the fact that such attacks would damage and may well destroy. a commercial reactor." In this statement, the ASLB correctly described the design basis for US nuclear power plants. However, other design bases are possible. In the early 1980s the 31 In illustration of this continuing policy, on 18 December 2002 the NRC Commissioners dismissed four licensing interventions calling for EISs that consider the potential for malicious acts at nuclear facilities. One intervention, by the state of Utah, addressed the proposed ISFSI at Skull Valley. The other three interventions, by citizen groups, addressed: a proposed spent-fuel-pool expansion at Millstone Unit 3; a proposed MOX-fuel-fabrication facility; and proposed license renewals for the McGuire and Catawba nuclear power plants.32 ASLB, 1982.('Y Robust Storage of Spent Nuclear Fuel January 2003 Page 19 reactor vendor ASEA-Atom developed a preliminary design for a commercial reactor known as the PIUS reactor. The design basis for the PIUS reactor included events such as equipment failures, operator errors and earthquakes, but also included: (i) takeover of the plant for one operating shift by knowledgeable saboteurs equipped with large amounts of explosives; (ii)aerial bombardment with 1,000-pound bombs; and (iii) abandonment of the plant by the operators for one week.3 3 It seems likely that this design basis would also provide protection against a range of other assaults, including the impact of a large, fuel-laden aircraft. Clearly, ASEA-Atom foresaw a world in which acts of malice could pose a significant threat to nuclear facilities. The NRC has never exercised an equivalent degree of foresight. A Brief History Some US nuclear facilities have been specifically designed to resist attack. For example, in the early 1950s five heavy-water reactors were built at the Savannah River site in South Carolina, to produce plutonium and tritium for use in US nuclear weapons. In order to resist an attack by the USSR using nuclear weapons, the reactors were dispersed across a large site and hardened against blast. The reactor buildings were designed to withstand an external blast of 7 psi, the overpressure that could be experienced at about 2 miles from a 1-megatonne surface burst. However, the purpose was to preserve the reactors' ability to produce weapons material after an attack, rather than to protect the public from a release of radioactive material. Indeed, these reactors had minimal safety systems when they first entered service. Safety systems were added over the years, but the reactors' safety standards never approached the level that is expected for commercial reactors.3 4 In 1950, the Reactor Safeguards Committee of the US Atomic Energy Commission (AEC) produced a report -- designated WASH-3 -- that considered the potential for reactor accidents and estimated the offsite effects of an accident. This report gave special attention to sabotage as a potentially important cause of reactor accidents. About 16 years later, during the construction license proceedings for Turkey Point Units 3 and 4 in Florida, an intervenor raised the question of an attack on these nuclear power plants from a hostile country (i.e., Cuba). The AEC held that it was not responsible for providing protection against such an attack.3 5 This position remains enshrined in the NRC's regulation 10 CFR 50.13, which states: 3 6 33 Hannerz, 1983.34 Thompson and Sholly, 1991.35 Okrent, 1981, pp 18-19.36 NRC Staff, 2002. Robust--Storage of Spent Nuclear Fuel January 2003 Page 20"An applicant for a license to construct and operate a production or utilization facility, or for an amendment to such license, is not required to provide for design features or other measures for the specific purpose of protection against the effects of (a) attacks and destructive acts, including sabotage, directed against the facility by an enemy of the United States, whether a foreign government or other person, or (b)use or deployment of weapons incident to US defense activities." Pursuant to this regulation, the NRC's licensees are not required to design or operate nuclear facilities to resist enemy attack. However, events have forced the NRC to progressively modify this position, so as to require greater protection against acts of malice or insanity. A series of incidents, including the 1993 bombing of the World Trade Center in New York, eventually forced the NRC to introduce, in 1994, regulations requiring licensees to defend nuclear power plants against vehicle bombs. The terrorist events of 1I September 2001 forced the NRC to require additional, interim measures by licensees to protect nuclear facilities, and are also forcing the NRC to consider strengthening its regulations in this area. Nevertheless, present NRC regulations require only a light defense of nuclear facilities. NRC Regulations for Defending Nuclear Facilities Present NRC regulations for the defense of nuclear facilities are focused on site security. As described in Section 4.4, below, site security is one of four types of measure that, taken together, could provide a defense in depth against acts of malice or insanity. The other three types of measure are, with some limited exceptions, ignored in present NRC regulations and requirements. 3 7 At a nuclear power plant or an ISFSI, the NRC requires the licensee to implement a set of physical protection measures. According to the NRC, these measures provide defense in depth by taking effect within defined areas with increasing levels of security. In fact, these measures provide only a fraction of the protection that could be provided by a comprehensive defense-in-depth strategy. Within the outermost physical protection area, known as the Exclusion Area, the licensee is expected to control the area but is not required to employ fences and guard posts for this purpose. Within the Exclusion area is a Protected Area encompassed by physical barriers including one or more fences, together with gates and barriers at points of entry.Authorization for unescorted access within the Protected Area is based on background and behavioral checks. Within the Protected Area are Vital 37 For information about the NRC's present regulations and requirements for nuclear-facility defense, see: the NRC website (www.nrc.gov) under the heading "Nuclear Security and Safeguards", 2 September 2002: Markey, 2002; Meserve, 2002; and NRC, 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 21 Areas and Material Access Areas that are protected by additional barriers and alarms; unescorted access to these locations requires additional authorization. Associated with the physical protection areas are measures for detection and assessment of an intrusion, and for armed response to an intrusion. Measures for intrusion detection include guards and instruments whose role is to detect a potential intrusion and notify the site security force. Then, security personnel seek additional information through means such as direct observation and closed-circuit TV cameras, to assess the nature of the intrusion. If judged appropriate, an armed response to the intrusion is then mounted by the site security force, potentially backed up by local law enforcement agencies and the FBI.The Design Basis Threat The design of physical protection areas and their associated barriers, together with the design of measures for intrusion detection, intrusion assessment and armed response, is required to accommodate a "design basis threat" (DBT)that is specified by the NRC in 10 CFR 73.1. The DBT for an ISFSI is less demanding than that for a nuclear power plant. At a nuclear power plant, the dominant sources of hazard are the reactor and the spent-fuel pool(s). In theory, both of these items receive the same level of protection, but in practice the reactor has been the main focus of attention. At present, the DBT for a nuclear power plant has the following features: 3 8"(i) A determined violent external assault, attack by stealth, or deceptive actions, of several persons with the following attributes, assistance and equipment: (A) Well-trained (including military training and skills) and dedicated individuals, (B) inside assistance which may include a knowledgeable individual who attempts to participate in a passive role (e.g., provide information), an active role (e.g., facilitate entrance and exit, disable alarms and communications, participate in violent attack), or both, (C) suitable weapons, up to and including hand-held automatic weapons, equipped with silencers and having effective long range accuracy, (D) hand-carried equipment, including incapacitating agents and explosives for use as tools of entry or for otherwise destroying reactor, facility, transporter, or container integrity or features of the safeguards system, and (E) a four-wheel drive land vehicle used for transporting personnel and their hand-carried equipment to the proximity of vital areas, and 38 10 CFR 73.1, Purpose and Scope, from the NRC web site (www.nrc.gov), 2 September 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 22 (ii) An internal threat of an insider, including an employee (in any position), and (iii) A four-wheel drive land vehicle bomb." For an ISFSI, the DBT is the same as for a nuclear power plant except that it does not include the use of a four-wheel-drive land vehicle, either for transport of personnel and equipment or for use as a vehicle bomb. This is true whether the ISFSI is at a new site or a reactor site. Thus, an ISFSI at a reactor site will be less protected than the reactor(s) and spent-fuel pool(s) at that site. At a reactor site or a new site, an ISFSI will be vulnerable to attack by a vehicle bomb. (Note: An NRC .order of October 2002 to reactor-site ISFSI licensees, as discussed below, might require vehicle-bomb protection at reactor-site ISFSIs. Measures required by this order have not been disclosed.) Interim, Additional Requirements by the NRC After the events of II September 2001, the NRC concluded that its requirements for nuclear power plant security were inadequate. Accordingly, the NRC issued an order to licensees of operating plants in February 2002, and similar orders to licensees of decommissioning plants in May 2002 and reactor-site ISFSI licensees in October 2002, requiring "certain compensatory measures", also described as "prudent, interim measures", whose purpose is to "provide the Commission with reasonable assurance that the public health and safety and common defense and security continue to be adequately protected in the current generalized high-level threat environment". 3 9 The additional measures required by these orders have not been publicly disclosed, but the NRC Chairman has stated that they include: 4 0 (i) increased patrols;(ii) augmented security forces and capabilities;(iii) additional security posts;(iv) vehicle checks at greater stand-off distances;(v) enhanced coordination with law enforcement and military authorities;(vi) additional restrictions on unescorted access authorizations;(vii) plans to respond to plant damage from explosions or fires; and (viii) assured presence of Emergency Plan staff and resources. 39 The quoted language is from page 2 of the NRC's order of 25 February 2002 to all operating power reactor licensees. Almost-identical language appears in the NRC's orders of 23 May 2002 to all decommissioning power reactor licensees and 16 October 2002 to all ISFSI licensees who also hold 10 CFR 50 licenses.40 Meserve, 2002.[ 0 Robust Storage of Spent Nuclear Fuel January 2003 Page 23 In addition to requiring these additional security measures, the NRC has established a Threat Advisory System that warns of a possible attack on a nuclear facility. This system uses five color-coded threat conditions ranging from green (low risk of attack) to red (severe risk of attack). These threat conditions conform with those used by the Office of Homeland Security.Also, the NRC is undertaking what it describes as a "top-to-bottom review" of its security requirements. The NRC has stated that it expects that this review will lead to revision of the present DBT. The review is not proceeding on any specific schedule.Limitations of the Design Basis Threat A cursory examination of the present DBT reveals significant limitations. For example, this threat does not include aircraft bombs (e.g., fuel-laden commercial aircraft, light aircraft packed with high explosive) or boat bombs.4 1 This threat does not include lethal chemical weapons as instruments for disabling security personnel. This threat allows for one vehicle bomb, but not for a subsequent vehicle bomb that gains access to a vital area after the first bomb has breached a security barrier. Also, this threat envisions a small attacking force equipped with light weapons, rather than a larger force (e.g., 20 persons) equipped with heavier weapons such as anti-tank missiles. In sum, the present DBT is inadequate in light of the present threat environment. The compensatory measures required by the NRC's recent orders do not correct this deficiency. 4 2 3. The Potential for Attacks on Nuclear Facilities 3.1 A Brief History There is a rich history of events which show that acts of malice or insanity pose a significant threat to nuclear facilities around the world.4 3 Consider some examples. Nuclear power plants under construction in Iran were repeatedly bombed from the air by Iraq in the period 1984-1987. Yugoslav Air Force fighters made a threatening overpass of the Krsko nuclear plant in Slovenia -- which was operating at the time -- a few days after Slovenia declared independence in 1991. So-called research reactors in Iraq were destroyed by aerial bombing by Israel in 1981 and by the United States in 1991.In 1987, Iranian radio threatened an attack by unspecified means on US nuclear plants if the United States attacked launch sites for Iran's Silkworm anti-ship missiles. Bombs damaged reactors under construction in Spain in 41 An NRC Fact Sheet (NRC, 2002) mentions new measures "against water-borne attacks", but it does not appear that these measures provide significant protection against boat bombs.42 POGO, 2002.43 Thompson, 1996. Robust Storage of Spent Nuclear Fuel January 2003 Page 24 1977 and in South Africa in 1982. Anti-tank missiles struck a nuclear plant under construction in France in 1982. North Korean commandos were killed while attempting to come ashore near a South Korean plant in 1985. These and other events illustrate the "external" threat to nuclear plants. Numerous crimes and acts of sabotage by plant personnel illustrate the "internal" threat.Vehicle Bombs The threat posed to nuclear facilities by vehicle bombs became clearly apparent from an October 1983 attack on a US Marine barracks in Beirut. In a suicide mission, a truck was driven at high speed past a guard post and into the barracks. A gas-boosted bomb on the truck was detonated with a yield equivalent to about 5 tonnes of TNT, destroying the building and killing 241 Marines. In April 1984 a study by Sandia National Laboratories titled"Analysis of Truck Bomb Threats at Nuclear Facilities" was presented to the NRC. According to an NRC summary: 4 4 "The results show that unacceptable damage to vital reactor systems could occur from a relatively small charge at close distances and also from larger but still reasonable size charges at large setback distances (greater than the protected area for most plants)." Eventually, in 1994, the NRC introduced regulations that require reactor licensees to install defenses (gates, barriers, etc.) against vehicle bombs.The NRC was spurred into taking this action by two incidents in February 1993. In one incident, a vehicle bomb was detonated in a parking garage under the World Trade Center in New York. In the other incident, a man recently released from a mental hospital crashed his station wagon through the security gate of the Three Mile Island nuclear plant and rammed the vehicle under a partly-opened door in the turbine building.Suicidal Aircraft Attack The threat of suicidal aircraft attack on symbolic or high-value targets became clearly apparent from three incidents in 1994.45 In April 1994-a Federal Express flight engineer who was facing a disciplinary hearing was travelling as a passenger on a company DC-10. He stormed the cockpit, severely wounded all three members of the crew with a hammer, and tried to gain control of the aircraft. The crew regained control with great difficulty. Federal Express employees said that the flight engineer was planning to crash into a company building. In September 1994 a lone pilot crashed a stolen single-engine Cessna into the grounds of the White House, just short of the President's living quarters. In December 1994 four Algerians hijacked an Air France Airbus 300, carrying 20 sticks of dynamite. The aircraft landed in 44 Rehm, 1984.45 Wald, 2001. Robust Storage of Spent Nuclear Fuel January 2003 Page 25 Marseille, where the hijackers demanded that it be given a large fuel load --three times more than necessary for the journey -- before flying to Paris.Troops killed the hijackers before this plan could be implemented. French authorities determined that the hijackers planned to explode the aircraft over Paris or crash it into the Eiffel Tower.The Insider Threat The incident involving the Federal Express flight engineer illustrates the vulnerability of industrial systems, including nuclear plants, to "internal" threats. That vulnerability is further illustrated by a number of incidents. In December 2000, Michael McDermott killed seven co-workers in a shooting rampage at an office building in Massachusetts. He had worked at the Maine Yankee nuclear plant from 1982 to 1988 as an auxiliary operator and operator before being terminated for exhibiting unstable behavior.4 6 In 1997, Carl Drega of New Hampshire stockpiled weapons and killed four people --including two state troopers and a judge -- on a suicide mission. He had passed security clearances at three nuclear plants in the 1990s.4 7 In October 2000 a former US Army sergeant pleaded guilty to assisting Osama bin Laden in planning the bombing of the US embassy in Nairobi, which occurred in 1998.48 In June 1999, a security guard at the Bradwell nuclear plant in Britain hacked into the plant's computer system and wiped out records. It emerged that he had never been vetted and had two undisclosed criminal convictions. 4 9 These and other incidents demonstrate clearly that it is foolish to ignore or downplay the "internal" threat of acts of malice or insanity at nuclear plants.The General Threat of Terrorism The events mentioned in the preceding paragraphs occurred against a background of numerous acts of terrorism around the world. Many of these acts have been highly destructive. US facilities have been targets on many occasions, as illustrated by the bombing of the US embassy in Beirut in 1983, the embassies in Nairobi and Dar es Salaam in 1998, and the USS Cole in 2000.There have been repeated warnings that the threat of terrorism is growing and could involve the US homeland. For example, in 1998 three authors with high-level government experience wrote: 5 0 46 Barnard and Kerber, 2001.47 Ibid.48 Goldman, 2000.49 Maguire, 2001.50 Carter et a], 1998. Robust Storage of Spent Nuclear Fuel January 2003 Page 26"Long part of the Hollywood and Tom Clancy repertory of nightmarish scenarios, catastrophic terrorism has moved from far-fetched horror to a contingency that could happen next month. Although the United States still takes conventional terrorism seriously, as demonstrated by the response to the attacks on its embassies in Kenya and Tanzania in August, it is not yet prepared for the new threat of catastrophic terrorism." Some years ago the US Department of Defense established an advisory commission on national security in the 21st century. This commission --often known as the Hart-Rudman commission because it was co-chaired by former Senators Gary Hart and Warren Rudman -- issued reports in September 1999, April 2000 and March 2001. The findings in the September 1999 report included the following: 5 1"America will become increasingly vulnerable to hostile attack on our homeland, and our military superiority will not entirely protect us .............. States, terrorists and other disaffected groups will acquire weapons of mass destruction and mass disruption, and some will use them. Americans will likely die on American soil, possibly in large numbers." It is clear that the potential for acts of malice or insanity at nuclear facilities --including highly destructive acts -- has been foreseeable for many years, and has been foreseen. However, the terrorist attacks on the World Trade Center and the Pentagon on 11 September 2001 provided significant new information. These attacks conclusively demonstrated that the threat of highly-destructive acts of malice or insanity is a clear and present danger, and that no reasonable person can regard this threat as remote or speculative. According to press reports, US authorities have obtained information suggesting that the hijackers of United Airlines flight 93, which crashed in Pennsylvania on 11 September 2001, were planning to hit a nuclear plant.5 2 This may be true or false, or the truth may never be known. Whatever the truth is, it would be foolish to regard nuclear plants as immune from attack.Estimating the Probability of an Attack on a Nuclear Facility The NRC has a longstanding policy of dismissing citizens' concerns about nuclear-facility accidents if the probability of such accidents is, in the agency's judgement, low. A body of analytic techniques known as probabilistic risk 51 Commission on National Security, 1999.52 Rufford et a], 2001. Robust Storage of Spent Nuclear Fuel January 2003 Page 27 assessment (PRA) has been developed to support such judgements. 5 3 However, the NRC Staff has conceded that it cannot provide a quantitative assessment of the probability of an act of malice at a nuclear facility. In a memo to the NRC Commissioners, the Staff has stated: 5 4"The staff, as a result of its ongoing work with the Federal national security agencies, has determined that the ability to quantify the likelihood of sabotage events at nuclear power plants is not currently supported by the state-of-the-art in PRA methods and data. The staff also believes that both the NRC and the other government stakeholders would need to conduct additional research and expend significant time and resources before it could even attempt to quantify the likelihood of sabotage events. In addition, the national security agencies, Intelligence Community, and Law Enforcement Agencies do not currently quantitatively assess the likelihood of terrorist, criminal, or other malevolent acts." To date, there has been no determined attack on a US civilian nuclear facility.At present, we cannot quantitatively estimate the probability of such an attack in the future. However, from a qualitative perspective, it is clear that the probability is significant. 3.2 The Strategic Context In considering the need to defend civilian nuclear facilities, one is obliged to take a broad view of the security environment. An ISFSI, for example, may remain in service for 100 years or more. During that period the level of risk will vary but the cumulative risk will continue to grow. Thus, the ISFSI's designer should take a conservative position in specifying a DBT. That position should be informed by a sober assessment of the range of threats that may be manifested over coming decades.A Turbulent World?A number of strategic analysts have warned that world affairs may become more turbulent over the coming decades. Analysts have pointed to destabilizing factors that include economic inequality, poverty, political grievances, nationalism, environmental degradation and the weakening of international institutions. For example, a 1995 RAND study for the US Department of Defense contains the statement: 5 5 53 The state of the art of PRA can be illustrated by: NRC, 1990. For a critique of PRA, see: Hirsch et al, 1989.54 Travers, 2001.55 Kugler, 1995, page xv. Robust Storage of Spent Nuclear Fuel January 2003 Page 28"If the worst does transpire, the world could combine the negative features of nineteenth-century geopolitics, twentieth-century political passions, and twenty-first century technology: a chronically turbulent world of unstable multi-polarity, atavistic nationalism, and modern armaments." As another example, the Stockholm Environment Institute (SEI) has identified a range of scenarios for the future of the world over the coming decades, and has studied the policies and actions that will tend to make each scenario come true. In summarizing this work, SEI states: 5 6"In the critical years ahead, if destabilizing social, political and environmental stresses are addressed, the dream of a culturally rich, inclusive and sustainable world civilization becomes plausible. If they are not, the nightmare of an impoverished, mean and destructive future looms. The rapidity of the planetary transition increases the urgency for vision and action lest we cross thresholds that irreversibly reduce options -- a climate discontinuity, locking-in to unsustainable technological choices, and the loss of cultural and biological diversity." SEI has specifically considered the implications of the September 2001 terrorist attacks, concluding: 5 7"Certainly the world will not be the same after 9/11, but the ultimate implications are indeterminate. One possibility is hopeful: new strategic alliances could be a platform for new multinational engagement on a wide range of political, social and environmental problems. Heightened awareness of global inequities and dangers could support a push for a more equitable form of global development as both a moral and a security imperative. Popular values could eventually shift toward a strong desire for participation, cooperation and global understanding. Another possibility is ominous: an escalating spiral of violence and reaction could amplify cultural and political schisms; the new military and security priorities could weaken democratic institutions, civil liberties and economic opportunity; and people could grow more fearful, intolerant and xenophobic as elites withdraw to their fortresses." 56 Raskin et al, 2002, page 11.57 Ibid. Robust Storage of Spent Nuclear Fuel January 2003 Page 29 Nuclear Facilities as Symbolic Targets In view of the range of possibilities for world order or turbulence over the coming decades, it would be prudent to assume that any US civilian nuclear facility could be the subject of a determined attack. Moreover, civilian nuclear facilities may be especially prime targets because of their symbolic connection with nuclear weapons.- The US government flaunts its superiority in nuclear weapons and rejects any constraint on these weapons through international law.5 8 At the same time, the government has signaled its willingness to attack Iraq because that country might acquire a nuclear weapon. It would be prudent to assume that this situation will motivate terrorist groups to search for ways to attack US nuclear facilities. For example, a terrorist group possessing a crude nuclear weapon might choose to use that weapon on a US civilian nuclear facility for two reasons. First, because the target would be highly symbolic. Second, because the radioactive fallout from the weapon would be greatly amplified. The Domestic Threat There is a natural tendency to look outside the country for sources of threat.However, an attack on a nuclear facility could also originate within the United States. The national strategy for homeland security contains the statement: 5 9"Terrorist groups also include domestic organizations. The 1995 bombing of the Murrah Federal Building in Oklahoma City highlights the threat of domestic terrorist acts designed to achieve mass casualties. The US government averted seven planned terrorist acts in 1999 -- two were potentially large-scale, high-casualty attacks being organized by domestic extremist groups." 3.3 The US Government's Response to this Threat The preceding discussion shows that there is a significant potential for a determined attack on a US civilian nuclear facility. Such an attack could employ a level of sophistication and violence that is characteristic of military operations. However, in most attack scenarios the attacking group would have a negligible capability for direct confrontation with US military forces.Thus, it is appropriate to think of an attack of this kind as a form of asymmetric warfare. The attacking group, be it domestic or foreign, will have 58 Deller, 2002; Scarry, 2002.59 Office of Homeland Security, 2002, page 10.V)7 Robust Storage of Spent Nuclear Fuel January 2003 Page 30 a set of political objectives. For symbolic and practical reasons, the attackers will prefer to obtain their weapons and logistical resources inside the USA.US Strategy for National Security and Homeland Security The White House has recently articulated a national security strategy for the United States.6 0 This strategy rests primarily on the use of military force outside the country, to deter, disrupt or punish potential attackers. In support of this concept, the strategy asserts the right to conduct unilateral, pre-emptive attacks around the world, and repudiates the International Criminal Court. Homeland security is regarded as a secondary form of defense, as illustrated by the statement: 6 1"While we recognize that our best defense is a good offense, we are also strengthening America's homeland security to protect against and deter attack." A strategy for homeland security has been articulated by the White House.6 2 This document contains a section titled "Defending against Catastrophic Threats", and that section begins with an aerial photograph of a nuclear power plant. Yet, the section does not mention civilian nuclear facilities or the NRC. Thus, at the highest levels of strategic planning, the US government has nothing to say about the potential for an attack on a nuclear facility, or about the measures that could be taken to defend against such attacks. In fact, the US government seems largely unaware of this threat, and has delegated its responsibility to the NRC. As described in Section 2.3 of this report, the NRC's response to the threat has been limited and ineffectual. Imbalance in National Security and Defense Planning Inattention to the vulnerability of nuclear facilities is symptomatic of a larger imbalance in national security and defense planning. As another example of imbalance, consider the threat of attack on the United States by inter-continental ballistic missiles (ICBMs). Large expenditures are devoted to the development of technologies that might, ultimately, allow missile warheads to be intercepted. Yet, in considering the respective risks of attack by missiles or other means, the US National Intelligence Council has stated: 6 3 60 White House, 2002.61 lbid, page 6.62 Office of Homeland Security, 2002.63 National Intelligence Council, 2001, page 18.1. )? Robust Storage of Spent Nuclear Fuel January 2003 Page 31"Nonmissile means of delivering weapons of mass destruction [WMD]do not provide the same prestige or degree of deterrence and coercive diplomacy associated with ICBMs. Nevertheless, concern remains about options for delivering WMD to the United States without missiles by state and nonstate actors. Ships, trucks, airplanes, and other means may be used. In fact, the Intelligence Community judges that US territority is more likely to be attacked with WMD using nonmissile means, primarily because such means: " Are less expensive than developing and producing ICBMs." Can be covertly developed and employed; the source of the weapon could be masked in an attempt to evade retaliation. -Probably would be more reliable than ICBMs that have not completed rigorous testing and validation programs.-Probably would be much more accurate than emerging ICBMs over the next 15 years.-Probably would be more effective for disseminating biological warfare agent than a ballistic missile.* Would avoid missile defenses." The defense analyst John Newhouse has contrasted the high level of attention given to the ICBM threat with the lack of effort in other areas of defense. He notes that the State Department advised US embassies in early 2001 that the principal threat to US security is the use of long-range missiles by rogue states, and comments: 6 4"This dubious proposition -- an article of faith within parts of the defense establishment -- obscured existing and far more credible threats from truly frightful weapons, some of which are within the reach of terrorists. They include Russia's shaky control of its nuclear weapons and weapons-usable material; the vulnerability of US coastal cities and military forces stationed abroad to medium-range missile systems, ballistic and cruise; the vulnerabilities of all cities to chemical and biological weapons, along with so-called suitcase weapons and other low-tech delivery expedients. Vehicles that contain potentially destructive amounts of stored energy are a major source of concern, as is one of their most attractive potential targets, a nuclear spent-fuel storage facility." 64 Newhouse, 2002, page 43. Robust Storage of Spent Nuclear Fuel-January 2003 Page 32 Nuclear Facilities as Targets It is clear that US civilian nuclear facilities are candidates for attack under conditions of asymmetric warfare. They are large, fixed targets that are, at present, lightly defended. In the eyes of an enemy, they can be regarded as pre-deployed radiological weapons. They can be attacked using comparatively low levels of technology. Given the United States' overt reliance on nuclear weapons as offensive instruments, civilian nuclear facilities offer highly symbolic targets. In light of these considerations, it is remarkable that the US government has largely ignored this threat.The Danger of an Offense-Dominated Strategy At present, US policy for national security assigns a higher priority to offensive actions worldwide than to defensive actions within the homeland.This is a tradition of many years' standing. However, in the contemporary era of asymmetric warfare, this policy can be dangerous. 6 5 If our vulnerable infrastructure -- including nuclear facilities, the airlines, etc.. -- is poorly defended, we may feel compelled to use military force aggressively around the world, in order to pre-empt or punish attackers. Such action poses the risk of arousing hostility and promoting anarchy, leading to new attacks on our homeland. The potential exists for an escalating spiral of violence.Strategic analysts have warned of this danger, both before and after the terrorist events of September 2001.66 3.4 A Balanced Response to the Threat The United States needs a balanced, mature strategy for national defense and international security. Within that strategy, it needs a balanced strategy for homeland security. Finally, as a part of homeland security, the nation needs a defense-in-depth strategy to protect its civilian nuclear facilities.. At present, all three levels of strategy are deficient. The Role of Protection in a Balanced Response Articulation of a balanced strategy at all three levels is a task beyond the scope of this report. However, this report does articulate, in Sections 4.4 and 4.5 65 A recent essay (Betts, 2003) argues that US decision makers have neglected the risk that Iraq's leaders will strike back at the US homeland if we attack lraq. Betts' essay focusses on the potential for Iraq to use chemical or biological weapons on US territory, but the same general arguments apply to the potential for an attack on a US civilian nuclear facility.66 See, for example: Sloan, 1995; Martin, 2002 (see especially the chapter by Conrad Crane in this volume); Mathews, 2002; Conetta; 2002; Crawford, 2003; and Newhouse, 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 33 respectively, a defense-in-depth strategy for nuclear facilities and a national strategy for robust storage of spent fuel. As an illustration of how these protective measures could fit within a higher-level strategy, consider Carl Conetta's suggestion of a four-pronged campaign against the terrorist group al-Qaeda. The four prongs would be: 6 7"(i) squeeze the blood flow of the organization -- its financial support system;(ii) throw more light on the organization's members and components through intelligence gathering activities;(iii) impede the movement of the organization by increasing the sensitivity of screening procedures at critical gateways -- borders, financial exchanges, arms markets, and transportation portals; and (iv) improve the protection of high-value targets." The importance of protecting high-value targets is emphasized in the recent report of a high-level task force convened by the Council on Foreign Relations and chaired by former Senators Gary Hart and Warren Rudman.One of the report's major findings is: 6 8"Homeland security measures have deterrence value: US counterterrorism initiatives abroad can be reinforced by making the US homeland a less tempting target. We can transform the calculations of would-be terrorists by elevating the risk that (1) an attack on the United States will fail, and (2) the disruptive consequences of a successful attack will be minimal. It is especially critical that we bolster this deterrent now since an inevitable consequence of the US government's stepped-up military and diplomatic exertions will be to elevate the incentive to strike back before these efforts have their desired effect." The Need for Proactive Planning Other findings by the Council on Foreign Relations' task force also deserve attention. For example, their report points out that proactive planning will yield better protection at lower cost than reacting after each new attack.6 9 This point is especially important in an era of asymmetric warfare, when opponents will employ unfamiliar tactics. Planning techniques such as"competitive strategies" and "net assessment" have been developed to accommodate such situations. In discussing net assessment, one author has stated:70 67 Conetta, 2002, page 3.68 Hart et al, 2002, pp 14-15.69 Ibid, page 16.70 Hoffman, 2002, pp 3-4. Robust Storage of Spent Nuclear Fuel January 2003 Page 34"One of the advantages of such an approach is that it credits the opponent with having a brain and a will, which Clausewitz suggested is also fundamental to war. Rarely do US strategists credit adversaries with being as cunning or adaptive as they usually turn out to be. It is well to be reminded on occasion that any opponent has strategies and options at his disposal too. The essence of the homeland security challenge is based on this consideration." 4. Defending Nuclear Power Plants and Spent Fuel 4.1 Potential Modes and Instruments of Attack It is not appropriate to publish a detailed discussion of scenarios whereby a nuclear power plant or a spent-fuel-storage facility might be successfully attacked. However, it must be assumed that attackers are technically sophisticated and possess considerable knowledge about individual nuclear facilities. For decades, engineering drawings, photographs and technical analyses have been openly available for every civilian nuclear facility in the USA. This material is archived at many locations around the world. Thus, a public discussion, in general terms, of potential modes and instruments of attack will not assist attackers. Indeed, such a discussion is needed to ensure that appropriate defensive actions are taken.Safety Systems and their Vulnerability The safe operation of a US commercial reactor or a spent-fuel pooldepends upon the fuel in the reactor or the pool being immersed in water. Moreover, that water must be continually cooled to remove fission heat or radioactive decay heat generated in the fuel. A variety of systems are used to ensure that water is available and is cooled, and that other safety-related functions -- such as shutdown of the fission reaction when needed -- are performed. Some of the relevant systems -- such as the switchyard -- are highly vulnerable to attack. Other systems are located inside reinforced-concrete structures -- such as the reactor auxiliary building -- that provide some degree of protection against attack. The reactor itself is inside a containment structure. At some plants, but not all, the reactor containment is a concrete structure that is highly reinforced and comparatively robust. Spent-fuel pools have thick concrete walls but are typically covered by lightweight structures. Attack through Brute Force or Indirectly? A group of attackers equipped with highly-destructive instruments could take a brute-force approach to attacking a reactor or a spent-fuel pool. Such an Robust Storage of Spent Nuclear Fuel January 2003 Page 35 approach would aim to directly breach the reactor containment and primary cooling circuit, or to breach the wall or floor of a spent-fuel pool.Alternatively, the attacking group could take an indirect approach, and many such approaches will readily suggest themselves to technically-informed attackers. Insiders, or outsiders who have taken over the plant, could obtain a release of radioactive material without necessarily employing destructive instruments. Some attack scenarios will involve the disabling of plant personnel, which could be accomplished by armed attack, use of lethal chemical weapons, or radioactive contamination of the site by an initial release of radioactive material.Vulnerability of ISFSIs Dry-storage ISFSIs differ from reactors and spent-fuel pools in that their operation is entirely passive. Thus, each dry-storage module in an ISFSI must be attacked directly. To obtain a release of radioactive material, the wall of the fuel container must be penetrated from the outside, or the container must be heated by an external fire to such an extent that the containment envelope fails. The attack could also exploit stored chemical energy in the zirconium cladding of spent fuel inside the module. Combustion of this cladding iii air, if initiated, would generate heat that could liberate radioactive material from the fuel to the outside environment. A knowledgeable attacker could combine penetration of the fuel container with the initiation of combustion. Relevance of Site-Security Barriers In some attack scenarios that involve the use of destructive instruments, the attackers may need to carry these instruments, by hand or in a vehicle, to the point of application. Such an action would require the overcoming of site-security barriers. In other scenarios, the instruments could be launched from a position outside some or all of these barriers.Commercial Aircraft as Instruments of Attack One instrument that an attacking group will consider is a fuel-laden commercial aircraft. As indicators of the forces that could accompany the impact of such an aircraft, consider the weights and fuel capacities of some typical jetliners. 7 1 The Boeing 737-300 has a maximum takeoff weight of 56-63 tonnes and a fuel capacity of 20-24 thousand liters. The Boeing 747-400 has a maximum takeoff weight of 363-395 tonnes and a fuel capacity of 204-217 thousand liters. The Boeing 757 has a maximum takeoff weight of 104-116 tonnes and a fuel capacity of 43 thousand liters. The Boeing 767 has a 71 Jackson, 1996. Robust Storage of Spent Nuclear Fuel January 2003 Page 36 maximum takeoff weight of 136-181 tonnes and a fuel capacity of 63-91 thousand liters.Commercial jet fuel typically has a heat of combustion of about 38 MJ per liter. For comparison, 1 kilogram of TNT will yield 4.2 MJ of energy. Thus, complete combustion of 1 liter of jet fuel will yield energy equivalent to that from 9 kilograms of TNT. Complete combustion of 100 thousand liters of jet fuel -- about half the fuel capacity of a Boeing 747-400 -- will yield energy equivalent to that from 900 tonnes of TNT. Thus, the impact of a fuel-laden aircraft could lead to a violent fuel-air explosion. Fuel-air munitions have been developed that yield more than 5 times the energy of their equivalent weight in TNT, and create a blast overpressure exceeding 1,000 pounds per square inch.7 2 A fuel-air explosion arising from an aircraft impact will be less efficient than a munition in converting combustion energy into blast, but could generate a highly-destructive blast if fuel vapor accumulates in a confined space before igniting.Explosive-Laden, General-Aviation Aircraft The attacking group might choose to use an explosive-laden, general-aviation aircraft as an instrument of attack. Such an aircraft could be much easier to obtain than a large commercial aircraft. In 1999, about 219,000 general-aviation aircraft were in use in the USA.7 3 Of these, about 172,000 had piston engines, 5,700 were turboprops, 7,100 were turbojets and 7,400 were helicopters. 7 4 In the piston-engine category, about 21,000 aircraft had two engines, the remainder having one engine. The general-aviation fleet in 2002 must be similar to that in 1999.It is clear that terrorist groups can readily obtain and use explosive materials. Such use is a tragic accompaniment to political disputes around the world.Moreover, explosives are easily obtainable within the USA. In 2001, about 2.4 million tonnes of explosives were sold in the USA. Most of this material consisted of blasting agents and oxidizers used for mining, quarrying and construction. Much of the blasting material consisted of mixtures of ammonium nitrate and fuel oil, which are readily-available materials. It is also noteworthy that current law in many US states allows high explosives to be purchased without a permit or a background check.7 5 72 Gervasi, 1977.73 Data from the website of the General Aviation Manufacturers Association (www.generalaviation.org), 30 September 2002.74 The remainder of the fleet consisted of gliders, balloons/blimps and experimental aircraft.75 Information from the website of the Institute of Makers of Explosives (www.ime.org), 30 September 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 37 Anti-Tank Missiles Another instrument of attack that could be used is an anti-tank missile. Large numbers of these missiles exist around the world, and they can be obtained by many terrorist groups. As an example, consider the tube-launched, optically-tracked, wire-guided (TOW) anti-tank missile system, which is now marketed by Raytheon.7 6 This system is said to be the most successful anti-tank missile system in the world. It first entered service with the US Army in 1970 and is currently in use by more than 40 military forces. As of 1991, more than 46,0,000 TOW missiles had been produced, and the cumulative production up to 2002 must be substantially higher. The TOW missile has a maintenance-free storage life of 20 years, and all versions of the missile can be fired from any TOW launcher. TOW systems have been sold to countries such as Colombia, Iran, Lebanon, Pakistan, Somalia, Yugoslavia and South Yemen, so it must be presumed that they can be obtained by terrorist groups. There is no indication from available literature that the TOW missile or launcher is self-disabling if it passes into inappropriate hands. In connection with the availability of systems of this kind, it is interesting to note that, in August 2002, federal agents seized more than 2,300 unregistered armor-piercing missiles from a private, counter-terrorism training school in New Mexico.7 7 Modern anti-tank missiles are reliable, accurate and easy to use. They are capable of penetrating considerable thicknesses of armor plate using a shaped-charge warhead that is designed for this purpose. Some types of missile can also be equipped with a general-purpose warhead that would be used for attacking targets such as fortified bunkers and gun emplacements. All types can be set up and reloaded comparatively quickly. Consider the TOW missile system as an example. The launcher can be mounted on a light vehicle or carried a short distance and mounted on the ground on a tripod. A late-model TOW launcher weighs about 93 kilograms, the guidance set about 24 kilograms and each missile about 22 kilograms. A rate of fire of about two rounds per minute can be sustained, and the missile has a range in excess of 3,000 meters. It is reported that an early-model TOW missile can blow a hole as much as two feet in diameter in the armor of a Soviet T-62 tank, or cut through three feet of concrete. Later-model TOW missiles are more capable.7 8 76 Information from: Hogg, 1991; Gervasi, 1977; Raytheon website (www.raytheon.com), 26 September 2002; US Marine Corps website (www.hqmc.usmc.mil), 26 September 2002; and Canadian Army website (www.army.forces.gc.ca), 27 September 2002.77 Reuters, 2002.78 Information from: Hogg, 1991; Gervasi, 1977; Raytheon website (www.raytheon.com), 26 September 2002; US Marine Corps website (www.hqmc.usmc.mil), 26 September 2002; and Canadian Army website (www.army.forces.gc.ca), 27 September 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 38 Nuclear Weapons A nuclear weapon could be used to attack a civilian nuclear facility. This possibility was a source of concern during the Cold War, and there is a body of technical and policy literature on this subject.7 9 Russia retains the capability to attack US nuclear facilities using ICBMs with thermonuclear warheads, and might be motivated at some future date to threaten or implement such an attack. A greater concern in the current period is that a sub-national group, with or without the assistance of a government, might use a comparatively low-yield fission weapon -- perhaps one with an explosive yield in the vicinity of 10 kilotonnes of TNT equivalent -- to attack a US nuclear facility. The means of delivery might be a land vehicle or a general-aviation aircraft. Such a weapon would be difficult to obtain, but many knowledgeable experts have warned that the fissionable material for a simple nuclear weapon could be diverted from poorly-secured stocks in Russia and elsewhere. 8 0 There is even the possibility that a complete nuclear weapon will be diverted. A high-level group advising the US government has examined the security of nuclear weapons and fissile material in Russia, concluding: 8 1"The most urgent unmet national security threat to the United States today is the danger that weapons of mass destruction or weapons-usable material in Russia could be stolen and sold to terrorists or hostile nation states and used against American troops abroad or citizens at home. This threat is a clear and present danger to the international community as well as to American lives and liberties." Summary Table 1, on the following page, briefly summarizes the characteristics of some potential modes of attack on civilian nuclear facilities, and.the present defense against each mode. Other modes of attack can be identified, and an attacking group might use several modes simultaneously or in sequence. The characteristics of each mode are, of course, more complex and varied than is shown in Table 1. Nevertheless, this table shows that determined, knowledgeable attackers have a range of options available to them.79 See, for example: Fetter, 1982; Fetter and Tsipis, 1980; Ramberg, 1984; and SIPRI, 1981.80 See, for example: Baker, Cutler et al, 2001; Bunn et al, 2002; and Sokolski and Riisager, 2002.81 Baker, Cutler et al, 2001, first page of Executive Summary.1181, Robust Storage of January 2003 Spent Nuclear Fuel Page 39 MODE OF ATTACK CHARACTERISTICS PRESENT DEFENSE Commando-style attack .Could involve heavy Alarms, fences and weapons and lightly-armed guards, sophisticated tactics with offsite backup* Successful attack would require substantial planning and resources Land-vehicle bomb

• Readily obtainable Vehicle barriers at entry* Highly destructive if points to Protected Area detonated at target Anti-tank missile
• Readily obtainable None if missile* Highly destructive at launched from offsite point of impact Commercial aircraft
• More difficult to None obtain than pre-9/ 11* Can destroy larger, softer targets Explosive-laden smaller 9 Readily obtainable None aircraft Can destroy smaller, harder targets 10-kilotonne nuclear 0 Difficult to obtain None weapon
• Assured destruction if detonated at target TABLE 1 SOME POTENTIAL MODES OF ATTACK ON CIVILIAN NUCLEAR FACILITIES Robust Storage of Spent Nuclear Fuel January 2003 Page 40 4.2 Vulnerability to Attack The preceding section of this report describes, in deliberately general terms, the potential modes and instruments of attack on a nuclear power plant or an ISFSI. No sensitive information is disclosed.

In discussing the vulnerability of nuclear facilities to such attacks, one must be similarly careful to avoid disclosing sensitive information. In this context, the word "vulnerability" refers to the potential for an act of malice or insanity to cause a release of radioactive material to the environment. At the site of a nuclear power plant or an ISFSI, most of the radioactive material at the site is in the reactor(s), the spent-fuel pool(s) and the ISFSI modules.Requirements for a Vulnerability Study Every US commercial reactor has been subjected to a PRA-type study by the licensee. This study addressed the reactor's potential to experience accidents, but did not consider acts of malice or insanity. No spent-fuel pool or ISFSI has been subjected to a PRA-type study or a study of its vulnerability to acts of malice or insanity. Indeed, there has never been a comprehensive, published study of the vulnerability of any US nuclear facility to acts of malice or insanity. Spurred by the terrorist events of September 2001, the NRC has sponsored secret, ongoing studies on the vulnerability of nuclear facilities to impact by a large commercial aircraft. Available information suggests that these studies are narrow in scope and will provide limited guidance regarding the overall vulnerability of nuclear facilities. A comprehensive study of a facility's vulnerability would begin by identifying a range of potential attacks on the facility. The probability of each potential attack would be qualitatively estimated, with consideration of the factors (e.g., international events, changing availability of instruments of attack) that could alter the probability over time. Site-specific factors affecting the feasibility and probability of attack scenarios include local terrain and the proximity of coastlines, airports, population centers and national symbols. A variety of modes and instruments of attack would be considered, of the kind discussed in Section 4.1.After identifying a range of potential attacks, a comprehensive study would examine the vulnerability of the subject facility to those attacks. This could be done by adapting and extending known techniques of PRA, with an emphasis on the logical structure of PRA rather than the numerical probabilities of events. The analysis would consider the potential for interactions among facilities at a site. For example, a potentially important interaction could be the prevention of personnel access at one facility (e.g., a spent-fuel pool) due Robust Storage of Spent Nuclear Fuel January 2003 Page 41 to a release of radioactive material at another facility (e.g., a reactor).Attention would be given to the potential for "cascading" scenarios in which attacks at some parts of a nuclear-power-plant site (e.g., control room, switchyard, diesel generators) lead to releases from reactors and/or spent fuel pools that were not directly attacked.Working with Partial or Misleading Information In the absence of any comprehensive study of vulnerability, one is obliged to rely upon partial information. Also, one must contend with misleading information disseminated by the nuclear industry. An egregious example is a recent paper in Science, a journal that is usually sound.8 2 Two points illustrate the low scientific quality of this paper. First, the paper cites an experiment performed at Sandia National Laboratories as proof that an aircraft cannot penetrate the concrete wall of a reactor containment. In response, Sandia officials have stated that the test has no relevance to the structural behavior of a containment wall, a fact that is readily evident from the nature of the test.8 3 Second, the paper states, in connection with the vulnerability of spent-fuel shipping casks, that "there is virtually nothing one could do to these shipping casks that would cause a significant public hazard".8 4 A report prepared by Sandia for the NRC is cited in support of this statement. 8 5 Yet, examination of the Sandia report reveals that it considers only the effects on a shipping cask of impact and fire pursuant to a truck or train accident. The Sandia report does not address the effects of, for example, attack by a TOW missile, a vehicle bomb, or a manually-placed charge.Aircraft Impact A rough, preliminary indication of the vulnerability of a nuclear power plant to aircraft impact can be obtained from the PRA for the Seabrook reactor. This reactor is a 4-loop Westinghouse PWR with a large, dry containment, and is one of only four US reactors that were specifically designed to resist impact by an aircraft, a 6-tonne aircraft in the case of Seabrook.8 6 The Seabrook PRA finds that any direct impact on the containment by an aircraft weighing more than 37 tonnes will lead to penetration of the containment and a breach in the reactor coolant circuit. Also, the Seabrook PRA finds that a similar impact on the control building or auxiliary building will inevitably lead to a core melt.8 7 All of the typical, commercial aircraft mentioned in Section 4.1 of this 82 Chapin et a], 2002.83 Jones, 2002a.84 Chapin et a], 2002, page 1997.85 Sprung et al, 2000.86 Markey, 2002, page 73.87 PLG, 1983, pp 9.3-10 to 9.3-11. Robust Storage of Spent Nuclear Fuel January 2003 Page 42 report weigh considerably more than 37 tonnes. Moreover, the Seabrook PRA does not consider the effects of a fuel-air explosion and/or fire as an accompaniment to an aircraft impact. Finally, this PRA, like other PRAs, does not consider malicious acts. Thus, it does not consider, for example, an attack on the Seabrook reactor by an explosive-laden, general-aviation aircraft.Analytic techniques are available for estimating the effects that aircraft impact will have on the structures and equipment of a nuclear facility. Two recent studies illustrate the use of such techniques. First, the Nuclear Energy Institute (NEI), an industry lobbying organization, has released some preliminary findings from an analysis of aircraft impact on reactor containments and spent-fuel facilities. 8 8 The analysis itself will not be published, so the findings cannot be verified. Second, a group at Purdue University has released the results of its simulation of the aircraft impact on the Pentagon that occurred on 11 September 2001.89 A simulation of this kind could be performed for aircraft impact on a nuclear facility. The.Purdue group employs commercially-available software and, in contrast to NEI, seems willing to publish its analysis.The analytic techniques discussed in the preceding paragraph focus on the kinetic energy of the impacting aircraft and its contents. Effects of an accompanying fuel-air explosion and/or fire are given, at best, a crude analysis. A 1982 review by Argonne National Laboratory of the state of the art for aircraft-impact analysis stated:90"Based on the review of past licensing experience, it appears that fire and explosion hazards have been treated with much less care than the direct aircraft impact and the resulting structural response. Therefore, the claim that these fire/explosion effects do not represent a threat to nuclear power plants has not been clearly demonstrated." Examination of PRAs and related studies for nuclear facilities shows that the Argonne statement remains valid today. Indeed, in view of the large amount of energy that can be liberated in a fuel-air fire or explosion, previous analyses of aircraft impacts may have substantially underestimated the vulnerability of nuclear facilities to such impacts.88 NEI, 2002.89 Purdue, 2002; Sozen et ai, 2002.90 Kot et al, 1982, page 78.(qO Robust Storage of Spent Nuclear Fuel January 2003 Page 43 Vulnerability of Spent-Fuel Pools The vulnerability of spent-fuel pools deserves special attention because these pools contain large amounts of long-lived radioactive material that could be liberally released to the atmosphere during a fire.9 1 The potential for such a fire exists because the pools have been equipped with high-density racks. In the 1970s, the spent-fuel pools of US nuclear power plants were typically equipped with low-density, open-frame racks. If water were partially or totally lost from such a pool, air or steam could circulate freely throughout the racks, providing convective cooling to the spent fuel. By contrast, the high-density racks that are used today have a closed structure. To suppress criticality, each fuel assembly is surrounded by solid, neutron-absorbing panels, and there is little or no gap between the panels of adjacent cells. In the absence of water, this configuration allows only one mode of circulation of air and steam around a fuel assembly -- vertically upward within the confines of the neutron-absorbing panels.If water is totally lost from a high-density pool, air will pass downward through available gaps such as the gap between the pool wall and the outer faces of the racks, will travel horizontally across the base of the pool, will enter each rack cell through a hole in its base, and will rise upward within the cell, providing cooling to the spent fuel assembly in that cell. If the fuel has been discharged from the reactor comparatively recently, the flow of air may be insufficient to remove all of the fuel's decay heat. In that case, the temperature of the fuel cladding may rise to the point where a self-sustaining, exothermic oxidation reaction with air will begin. In simple terms, the fuel cladding -- which is made of zirconium alloy -- will begin to burn. The zirconium-alloy cladding can also enter into a self-sustaining, exothermic oxidation reaction with steam. Other exothermic oxidation reactions can also occur. For simplicity, the occurrence of one or more of the possible reactions can be referred to as a pool fire.In many scenarios for loss of water from a pool, the flow of air that is described in the preceding paragraph will be blocked. For example, a falling object (e.g., a fuel-transfer cask) might distort rack structures, thereby blocking air flow. As another example, an attack might cause debris (e.g., from the roof of the fuel handling building) to fall into the pool and block air flow. The presence of residual water in the bottom of the pool would also block air flow.In most scenarios for loss of water, residual water will be present for significant periods of time. Blockage of air flow, for whatever reason, will lead to ignition of fuel that has been discharged from a reactor for long 91 The NRC has published a variety of technical documents that address spent-fuel-pool fires.The most recent of these documents is: Collins et al, 2000.H I Robust Storage of Spent Nuclear Fuel January 2003 Page 44 periods -- potentially 10 years or longer.9 2 The NRC Staff failed to understand this point for more than two decades.9 3 Loss of Water from a Pool Partial or total loss of water from a spent-fuel pool could occur through leakage, evaporation, siphoning, pumping, displacement by objects falling into the pool, or overturning of the pool. These modes of loss of water could arise, directly or indirectly, through a variety of attack scenarios. As a simple example, consider leakage as a direct result of aircraft impact on the wall of a pool. This example represents a brute-force attack on the model of 11-September 2001. Other attack options will suggest themselves to knowledgeable attackers. An NRC Staff study includes a crude, generic analysis of the conditional probability that aircraft impact will cause a loss of water from a spent fuel pool.9 4 The pool is assumed to have a 5-ft-thick reinforced-concrete wall.Impacting aircraft are divided into the categories "large" (weight more than 5.4 tonnes) and "small" (weight less than 5.4 tonnes). The Staff estimates that the conditional probability of penetration of the pool wall by a large aircraft is 0.45, and that 50 percent of penetration incidents involve a loss of water which exposes fuel to air. Thus, the Staff estimates that, for impact of a large aircraft, the conditional probability of a loss of water sufficient to initiate a pool fire is 0.23 (23 percent).Facility Interactions and Cascading Scenarios An earlier paragraph in Section 4.2 of this report mentions the potential for interactions among facilities on a site, and points out that a potentially important interaction could be the prevention of personnel access at one facility (e.g., a spent-fuel pool) due to a release of radioactive material at another facility (e.g., a reactor). This type of interaction was partially addressed during a licensing proceeding for the Harris nuclear power plant.In that proceeding, the NRC Staff conceded that a fire in one spent-fuel pool would preclude the provision of cooling and makeup to nearby pools, thereby leading to evaporation of water from the nearby pools followed by fires in those pools.9 5 This situation would arise mostly because the initial fire would contaminate the site with radioactive material, generating high radiation fields that preclude personnel access. An analogous situation could 92 The role of residual water in promoting ignition of old fuel is discussed in: Thompson, 1999, Appendix D.93 Thompson, 2002a, Section II.94 Collins et al, 2000, page 3-23 and Appendix 2D.95 Parry et al, 2000, paragraph

29.

Robust Storage of Spent Nuclear Fuel January 2003 Page 45 arise in which the release of radioactive material from a damaged reactor precludes the provision of cooling and makeup to nearby pools. For example, an attack on a reactor could lead to a rapid-onset core melt with an open containment, accompanied by a raging fire. That event would create high radiation fields across the site, potentially precluding any access to the site by personnel. One can envision a variety of "cascading" scenarios, in which there might eventually be fires in all of the pools at a site, accompanied by core-melt events at all of the reactors.Progression of a Pool Fire A pool fire could begin comparatively soon after water is lost from a pool.For example, suppose that most of the length of the fuel assemblies is exposed to air, but the flow of air to the base of the racks is precluded by residual water or a collapsed structure. In that event, fuel heatup would be approximately adiabatic. Fuel discharged for 1 month would ignite in less than 2 hours, and fuel discharged for 3 months would ignite in about 3 hours. The fire would then spread to older fuel. Once a fire has begun, it could be impossible to extinguish. Spraying water on the fire could feed an exothermic zirconium-steam reaction that would generate flammable hydrogen. High radiation fields could preclude the approach of firefighters. Vulnerability of Dry-Storage Modules The dry-storage modules used at ISFSIs are passively safe, as discussed in Section 4.1 of this report. Thus, an attacking group that seeks to obtain a radioactive release from an ISFSI must attack each module directly. To obtain a release of radioactive material, the wall of the fuel container must be penetrated from the outside, or the container must be heated by an external fire to such an extent that the containment envelope fails. In addition, a technically-informed and appropriately-equipped attacker could exploit stored chemical energy in the zirconium cladding of the stored spent fuel. Such an attacker would arrange for penetration of the container to be accompanied by the initiation of combustion of the cladding in air. Combustion would generate heat that could liberate radioactive material from the fuel to the outside environment. Initiation of combustion could be facilitated by the presence of zirconium hydride in the fuel cladding, which is a characteristic of high-burnup fuel. The NRC Staff has noted that zirconium hydride can experience auto-ignition in air.9 6 This point had been brought to the Staffs attention by the NRC's Advisory Committee on Reactor Safeguards. 9 7 96 Collins et al, 2000, page A1B-3.97 Powers, 2000, page 3. Robust Storage of Spent Nuclear Fuel January 2003 Page 46 There is a body of literature that addresses aspects of the vulnerability of dry-storage modules for ISFSIs. Consider some examples. First, NAG International has analyzed the impact of a Boeing 747-400 aircraft on a NAC-UMS storage module of the type discussed in Section 2.2 of this report.9 8 According to NAC, this analysis shows that failure of the fuel container would not occur, either from impact or fire. Second, analyses of aircraft impact have been done in Germany in connection with the licensing of ISFSIs that employ CASTOR casks. In Germany, ISFSIs are typically located inside buildings to provide someprotection against anti-tank missiles, a practice which creates the potential for pooling of jet fuel following an aircraft impact. As a result, the intensity and duration of fire has become a key issue in technical debates about the release of radioactive material following an aircraft impact.9 9 Third, in a test done in Germany in 1992, a shortened CASTOR cask containing simulated fuel assemblies made from depleted uranium was penetrated by a static, shaped charge, in order to simulate attack by an anti-tank missile.1 0 0 The metal jet created by the shaped charge caused a small amount of finely-divided uranium to be released from the cask, but this test did not account for several important factors that are discussed in the following paragraph. Fourth, analyses of aircraft, cruise-missile and dummy-bomb impact on a dry-storage module have been done in connection with the licensing of the proposed Skull Valley ISFSI. The accompanying technical debate suggests that the magnitude of the radioactive release following penetration of a fuel container would be sensitive to the fraction of a fuel assembly's inventory of radionuclides, such as cesium-137, that would be present in the pellet-cladding gap region.'0'Requirements for a Comprehensive Study of Dry-Storage Vulnerability The literature that is exemplified in the preceding paragraph addresses only some of the attack scenarios and physical-chemical phenomena that would be addressed in a comprehensive assessment of the vulnerability of dry-storage modules. Such an assessment would consider a range of instruments of attack, including anti-tank missiles, manually-placed charges, a vehicle bomb or an aircraft bomb. Modes of attack that promote zirconium ignition would be considered. Factors that would be accounted for include: (i) the presence of zirconium hydride in fuel cladding; (ii) radioactive-decay heat in fuel pellets;(iii) a pre-attack temperature characteristic of an actual, operating module;and (iv) source-term phenomena (such as the gap inventory of radionuclides) that are characteristic of high-burnup fuel. There is no evidence from 98 McCough and Pennington, 2002.99 Hirsch, 2002.100 Lange et a], 2002.101 Resnikoff, 2001. Robust Storage of Spent Nuclear Fuel January 2003 Page 47 published literature that a comprehensive vulnerability assessment of this kind has been made. Some components of a comprehensive assessment may have been performed secretly. For example, there are rumors of NRC-sponsored tests that have combined penetration of a fuel container with incendiary effects. Given the information that is available, it is prudent to assume that a variety of modes and non-nuclear instruments of attack could release to the atmosphere a substantial fraction of the radioactive inventory of a dry-storage module.Attack Using a Nuclear Weapon As indicated in Section 4.1 of this report, it is prudent to assume that a low-yield nuclear weapon (with a yield of perhaps 10 kilotonnes of TNT equivalent) might be used as an instrument of attack at a nuclear power plant or an ISFSI. A thorough assessment of the vulnerability to such an attack of the reactor(s), spent-fuel pool(s) and ISFSI modules at a site would require detailed analysis. Absent such an analysis, rough judgements can be made.Consider, for example, a 10-kilotonne ground burst at an unhardened, surface-level ISFSI of the usual US type. It seems reasonable to assume that any module within the crater area would, as a result of blast effects and heating by the fireball, become divided into fragments, many of them small enough to travel downwind for many kilometers before falling to earth. A 10-kilotonne ground burst over sandstone, which is perhaps representative of an ISFSI, would yield a crater about 68 meters in diameter and 16 meters deep.1 0 2 As an indication of the potential release of radioactive material following a nuclear detonation at an ISFSI, consider a 10-kilotonne groundburst at an ISFSI that employs vertical-axis fuel-storage modules with a center-to-center distance of 5.5 meters, as would be the case for the proposed Diablo Canyon facility. Given a large, square array of such modules, about 120 modules would fall within the 68-meter diameter of the anticipated crater. Thus, it is plausible to assume that 100 percent of the volatile radionuclides (such as cesium-137) in 120 modules, together with a lesser fraction of the non-volatile radionuclides, would be carried downwind in a radioactive plume. This quantity could be an over-estimate, because the ISFSI has finite dimensions and is not an infinite array, or it could be an under-estimate, because damage to modules outside the crater is not considered. Note that a NAC-UMS module, as used at Maine Yankee, can hold 24 PWR fuel assemblies or 56 102 Glasstone, 1962, Chapter Vl. Robust Storage of Spent Nuclear Fuel January 2003 Page 48 BWR fuel assemblies.1 0 3 The HI-STORM 100 modules that would be used at the proposed Diablo Canyon ISFSI can each hold 32 PWR fuel assemblies. 1 0 4 Comparative Risks of Attack Options Section 4.1 of this report shows that a determined, knowledgeable group has available to it a range of options for attacking reactors, spent-fuel pools and ISFSIs. The preceding paragraphs of Section 4.2 provide a brief discussion of the vulnerability of reactors, pools and ISFSI modules to such options. These topics could be discussed more comprehensively, but that task was beyond the scope of this report. A comprehensive assessment -- whose underlying technical analysis should not, for obvious reasons, be openly published --would identify a wide range of attack scenarios and would estimate their outcomes. Such an assessment could provide a perspective on the comparative risks of attack options.As an illustration of comparative risk, consider three potential options for obtaining a release of radioactive material. Option I would be an attack on an ISFSI using a 10-kilotonne nuclear weapon delivered by a general-aviation aircraft. Delivery of the weapon could be straightforward, given the lack of air defense at ISFSIs, but the weapon would be difficult to obtain. Thus, this attack option seems to have a comparatively low probability. However, it would yield a large release of radioactive material. Option I1 would be a commando-style attack in which the attackers seize control of a nuclear power plant, initiate a reactor-core melt, breach the reactor containment, and initiate the removal of water from the spent-fuel pool(s) by siphoning and/or breaching the pool(s). Such an attack is feasible but would require substantial planning and resources and might be repulsed. Thus, this attack option may have a comparatively low probability. It would, however, yield a large release of radioactive material. Option III would be an attack on one or more ISFSI modules using anti-tank missiles fired from one or more offsite locations. In a plausible time window the attackers might, for example, be able to obtain 10 hits. The probability of this option is presumably substantially greater than the probability of Options I and II, but the release of radioactive material would be considerably smaller.4.3 Consequences of Attack The offsite radiological consequences of a potential attack on a nuclear facility can be estimated with widely-used, computer-based models. In order to apply such a model, one must have an estimate of the accident "source term". The 103 Stone and Webster, 1999.104 PG&E, 2001a. Robust Storage of Spent Nuclear Fuel January 2003 Page 49 source term is a set of characteristics -- magnitude, timing, etc. -- that describe a potential release of radioactive material to the atmosphere. Using this source term, together with weather data for the release site, the model can estimate the magnitude of each of a range of radiological impacts at specified locations downwind.Cesium-137 as an Indicator A full analysis of this type is beyond the scope of this report. Instead, some scoping calculations are presented here, focussing on one radioactive isotope --cesium-137. This isotope is a useful indicator of the potential, long-term consequences of a release of radioactive material. Cesium-137 has a half-life of 30 years, and accounts for most of the offsite radiation exposure that is attributable to the 1986 Chernobyl reactor accident, and for about half of the radiation exposure that is attributable to fallout from nuclear weapons tests in the atmosphere.' 0 5 Cesium is a volatile element that would be liberally released during nuclear-facility accidents or attacks. For example, an NRC study has concluded that a generic estimate of the release fraction of cesium isotopes during a spent-fuel-pool fire -- that is, the fraction of the pool's inventory of cesium isotopes that would reach the atmosphere -- is 100 percent.1 0 6 It is reasonable to assume such a high release fraction because cesium is volatile, because a fire in a high-density pool, once initiated, would eventually involve. all of the fuel in the pool, and because pool buildings are not designed as containment structures..Inventories of Cesium-137 at Indian Point The Indian Point site provides an illustration of the inventories of cesium-137 at nuclear facilities. Three nuclear power plants have been built at this site. Unit 1 had a rated power of 590 MW (thermal) and operated from 1962 to 1974.107 Unit 2 has a rated power of 2,760 MW (thermal), commenced operating in 1974, and remains operational. Unit 3 has a rated power of 2,760 MW (thermal), commenced operating in 1976, and remains operational. Unit 2 and Unit 3 each employ a four-loop Westinghouse PWR with a large, dry containment. The reactor cores of Unit 2 and Unit 3 each contain 193 fuel assemblies.' 0 8 Unit 2 and Unit 3 are each equipped with one spent-fuel pool. The capacity of the Unit 2 pool is 1,374 fuel assemblies, while the capacity of the Unit 3 pool is 105 DOE, 1987.106 Sailor et a], 1987.107 Thompson and Beckerley, 1973, Table 4-1.108 Larson, 1985, Table A-2. Robust Storage of Spent Nuclear Fuel January 2003 Page 50 1,345 fuel assemblies. 1 0 9 Both pools employ high-density racks. As of November 1998, the Unit 2 pool contained 917 fuel assemblies, while the Unit 3 pool contained 672 fuel assemblies. 1 10 It can be assumed that the number of fuel assemblies in each pool has increased since November 1998.The inventory of cesium-137 in the Indian Point pools can be readily estimated. Three parameters govern this estimate -- the number of spent fuel assemblies, their respective burnups, and their respective ages after discharge. Assuming a representative, uniform burnup of 46 GW-days per tonne, one finds that the 917 fuel assemblies that were in the Unit 2 pool in November 1998 now contain about 42 million Curies (460 kilograms) of cesium-137. The 672 fuel assemblies that were in the Unit 3 pool in November 1998 now contain about 31 million Curies (350 kilograms) of cesium-137. Additional amounts of cesium-137 would be present in any fuel assemblies that have been added to these pools since November 1998.For comparison, the cores of the Indian Point Unit 2 and Unit 3 reactors each contain about 6 million Curies (67 kilograms) of cesium-137. Also, it should be noted that the Chernobyl reactor accident of 1986 released about 2.4 million Curies (27 kilograms) of cesium-137 to the atmosphere. That release represented 40 percent of the Chernobyl reactor core's inventory of 6 million Curies (67 kg) of cesium-137.111 Also, atmospheric testing of nuclear weapons led to the deposition of about 20 million Curies (220 kilograms) of cesium-137 across the land and water surfaces of the Northern Hemisphere. 12 As another comparison, consider a HI-STORM 100 dry-storage module that contains 32 PWR fuel assemblies. Assuming that these fuel assemblies have an average post-discharge age of 20 years, this module would contain about 1.3 million Curies (14 kilograms) of cesium-137. Inventories of Cesium-137 at Vermont Yankee The Vermont Yankee site provides a second illustration of the inventories of cesium-137 at nuclear facilities. At this site there is a single BWR with a rated power of 1,590 MW (thermal) and a Mark I containment. This plant commenced operating in 1972 and remains operational. The reactor core contains 368 fuel assemblies.1 13 One spent-fuel pool is provided at this plant.109 "Reactor Spent Fuel Storage", from NRC website (www.nrc.gov), 30 May 2001.110 Ibid.I Krass, 1991.112 DOE, 1987.113 Larson, 1985, Table A-I.tqg Robust Storage of Spent Nuclear Fuel January 2003 Page 51 The pool is equipped with high-density racks and has a capacity of 2,870 fuel assemblies, with a possible recent increase in this capacity.] 14 In 2000, the Vermont Yankee pool contained 2,439 fuel assemblies.] 1 5 Licensee projections done in 1999 showed the pool inventory increasing to a maximum of 2,687 assemblies in 2004, after which the inventory would decrease until the pool would be empty in 2017. These projections assumed continuing operation of the plant until 2012, transfer of spent fuel from the pool to an on-site ISFSI beginning in 2004, and shipment of fuel to Yucca Mountain beginning in 2010.116 To date, there has been no license application for an ISFSI at Vermont Yankee. Thus, transfer of fuel to an on-site ISFSI in 2004 is unlikely. As discussed in Section 2.1 of this report, shipment of fuel to Yucca Mountain in 2010 is unlikely.The inventories of cesium-137 in the Vermont Yankee pool and reactor can be estimated as described above for Indian Point. One can assume that the Vermont Yankee pool now (in January 2003) contains 2,639 fuel assemblies, which have been discharged from the reactor during refuelling outages since 1972.117 Thus, the pool now contains about 35 million Curies (390 kilograms) of cesium-137. The Vermont Yankee reactor contains about 2.3 million Curies (26 kilograms) of cesium-137. Land Contamination by Cesium-137 After a Pool Fire Now consider the potential for a spent-fuel-pool fire at Indian Point or Vermont Yankee. As explained above, it is reasonable to assume that 100 percent of the cesium-137 in a pool would be released to the atmosphere in the event of a fire. The cesium-137 would be released to the atmosphere in small particles that would travel downwind and be deposited on the ground and other surfaces. The deposited particles would emit intense gamma radiation, leading to external, whole-body radiation doses to exposed persons.Cesium-137 would also contaminate water and foodstuffs, leading to internal radiation doses.114 According to information compiled by licensee staff in February 1999 (Weyman, 1999), the licensed storage limit for the Vermont Yankee pool was 2,870 fuel assemblies in 1999, and was projected to increase to 3,355 fuel assemblies in 2001. According to information compiled by the NRC, the capacity of the Vermont Yankee pool in November 1998 was 2.863 assemblies; see"Reactor Spent Fuel Storage", from NRC website (www.nrc.gov), 30 May 2001.115 Vermont Yankee, 2000.116 Weyman, 1999.117 Ibid. Robust Storage of Spent Nuclear Fuel January 2003 Page 52 One measure of the scope of radiation exposure attributable to deposition of cesium-137 is the area of land that would become uninhabitable. For illustration, one can assume that the threshold of uninhabitability is an external, whole-body dose of 10 rem over 30 years. This level of radiation exposure, which would represent about a three-fold increase above the typical level of background (natural) radiation, was used in the NRC's 1975 Reactor Safety Study as a criterion for relocating populations from rural areas.A radiation dose of 10 rem over 30 years corresponds to an average dose rate of 0.33 rem per year.' 18 The health effects of radiation exposure at this dose level have been estimated by the National Research Council's Committee on the Biological Effects of Ionizing Radiations. 1 1 9 This committee has estimated that a continuous lifetime exposure of 0.1 rem per year would increase the incidence of fatal cancers in an exposed population by 2.5 percent for males and 3.4 percent for females.]2 0 Incidence would scale linearly with dose, in this low-dose region.1 2 1 Thus, an average lifetime exposure of 0.33 rem per year would increase the incidence of fatal cancers by about 8 percent for males and 11 percent for females. About 21 percent of males and 18 percent of females normally die of cancer.1 2 2 In other words, in populations residing continuously at the threshold of uninhabitability (an external dose rate of 0.33 rem per year), about 2 percent of people would suffer a fatal cancer that would not otherwise occur.1 2 3 Internal doses from contaminated food and water could cause additional cancer fatalities. The increased cancer incidence described in the preceding paragraph would apply at the boundary of the uninhabitable area. Within that area, the external dose rate from cesium-137 would exceed the threshold of 10 rem over 30 years. At some locations, the dose rate would exceed this threshold by orders of magnitude. Therefore, persons choosing to live within the uninhabitable area would experience an incidence of fatal cancers at a level higher than is set forth above.118 At a given location contaminated by cesium-137, the resulting external, whole-body dose received by a person at that location would decline over time, due to radioactive decay and weathering of the cesium-137. Thus, a person receiving 10 rem over an initial 30-year period would receive a lower dose over the subsequent 30 -year period.119 National Research Council, 1990.120 Ibid, Table 4-2.121 The BEIR V committee assumed a linear dose-response model for cancers other than leukemia, and a model for leukemia that is effectively linear in the low-dose range. See National Research Council, 1990, pp 171-176.122 National Research Council, 1990, Table 4-2.123 For males, 0.08 x 0.21 = 0.017. For females, 0.11 x 0.18 = 0.020.2-0 0 Robust Storage of Spent Nuclear Fuel January 2003 Page 53 Area of Uninhabitable Land After a Pool Fire at Indian Point or Vermont Yankee For a postulated release of cesium-137 to the atmosphere, the area of uninhabitable land can be estimated from calculations done by Dr Jan Beyea.1 2 4 Four releases of cesium-137 are postulated here. The first postulated release is 42 million Curies, representing the fuel that was present in the Indian Point Unit 2 pool in November 1998. The second postulated release is 31 million Curies, representing the fuel that was present in the Indian Point Unit 3 pool in November 1998. (Actual, present inventories of cesium-137 in the Unit 2 and Unit 3 pools are higher than these numbers, assuming that fuel has been added since November 1998.) The third postulated release is 35 million Curies, representing the present (January 2003) inventory of fuel in the Vermont Yankee pool. The fourth postulated release is 1 million Curies, representing the cesium-137 inventory in a dry-storage ISFSI module that contains 32 PWR fuel assemblies. This fourth release does not represent a pool fire or a predicted release from an ISFSI.Instead, it is a notional release that provides a scale comparison. For typical weather conditions, assuming that the radioactive plume travels over land rather than out to sea, a release of 42 million Curies of cesium-137 would render about 95,000 square kilometers of land uninhabitable. Under the same conditions, a release of 31 million Curies would render about 75,000 square kilometers uninhabitable, and a release of 35 million Curies would render about 80,000 square kilometers uninhabitable. A release of 1 million Curies would render uninhabitable about 2,000 square kilometers. For comparison, note that the area of New York state is 127,000 square kilometers, while the combined area of Vermont, New Hampshire and Massachusetts is 70,000 square kilometers. The use of a little imagination shows that a spent-fuel-pool fire at Indian Point or Vermont Yankee would be a regional and national disaster of historic proportions, with health, environmental, economic, social and political dimensions. Cesium-137 Fallout From a Nuclear Detonation For attack scenarios involving the use of a nuclear weapon on a spent-fuel-storage facility, it is instructive to compare the long-term radiological significance of the nuclear detonation itself with the significance of the release that the detonation could induce. For example, detonation of a 10-kilotonne fission weapon would directly generate about 2 thousand Curies (21 124 Beyea et al, 1979. Robust Storage of Spent Nuclear Fuel January 2003 Page 54 grams) of cesium-137. 1 2 5 Yet, this weapon could release to the atmosphere tens of millions of Curies of cesium-137 from a spent-fuel pool or an unhardened, undispersed ISFSI.4.4 Defense in Depth Four types of measure, taken together, could provide a comprehensive, defense-in-depth strategy against acts of malice or insanity at a nuclear facility.The four types of measure, which are described in the following paragraphs, are in the categories: (i) site security; (ii) facility robustness; (iii) damage control; and (iv) emergency response planning. The degree of protection provided by these measures would be greatest if they were integrated into the design of a facility before its construction. However, a comprehensive set of measures could provide significant protection at existing facilities. Site Security Site-security measures are those that reduce the potential for implementation of destructive acts of malice or insanity at a nuclear site. Two types of measure fall into this category. Measures of the first type would be implemented at offsite locations, and the implementing agencies might have no direct connection with the site. Airline or airport security measures are examples of measures in this category. Measures of the second type would be implemented at or near the site. Implementing agencies would include the licensee, the NRC and, potentially, other entities (e.g., National Guard, Coast Guard). The physical protection measures now required by the NRC, as discussed in Section 2.3 of this report, are examples of site-security measures of the second type. More stringent measures could be introduced, such as: (i) establishment of a mandatory aircraft exclusion boundary around the site;(ii) deployment of an approaching-aircraft detection system that triggers a high-alert status at facilities on the site;(iii) expansion of the DBT, beyond that now applicable to a nuclear power plant, to include additional intruders, heavy weapons, lethal chemical weapons and more than one vehicle bomb; and (iv) any ISFSI on the site to receive protection equivalent to that provided for a nuclear power plant.125 SIPRI, 1981, page 76. Robust Storage of Spent Nuclear Fuel January 2003 Page 55 Facility Robustness Facility-robustness measures are those that improve the ability of a. nuclear facility to experience destructive acts of malice or insanity without a significant release of radioactive material to the environment. In illustration, the PIUS reactor design, as discussed in Section 2.3, was intended to withstand aerial bombardment by 1,000-pound bombs without suffering core damage or releasing a significant amount of radioactive material to the environment. An ISFSI could be constructed with a similar degree of robustness. At existing facilities, a variety of opportunities are available for enhancing robustness. As a high-priority example, the spent fuel pool(s) at a nuclear power plant could be re-equipped with low-density racks, so that spent fuel would not ignite if water were lost from a pool. As a second example, the reactor of a nuclear power plant could be permanently shut down, or the reactor could operate at reduced power, either permanently or at times of alert. Other robustness-enhancing opportunities could be identified. For a nuclear power plant whose reactor is not permanently shut down, robustness could be enhanced by an integrated set of measures such as: (i) automated shutdown of the reactor upon initiation of a high-alert status at the plant, with provision for completion of the automated shutdown sequence if the control room is disabled;(ii) permanent deployment of diesel-driven pumps and pre-engineered piping to be available to provide emergency water supply to the reactor, the steam generators (at a PWR) and the spent fuel pool(s);(iii) re-equipment of the spent fuel pool(s) with low-density racks, excess fuel being stored in an onsite ISFSI; and (iv) construction of the ISFSI to employ hardened, dispersed, dry storage.Damage Control Damage-control measures are those that reduce the potential for a release of radioactive material from a facility following damage to that facility due to destructive acts of malice or insanity. Measures of this kind could be ad hoc or pre-engineered. One illustration of a damage control measure would be a set of arrangements for patching and restoring water to a spent fuel pool that has been breached. Many other illustrations can be provided. It appears, from the list of additional measures set forth in Section 2.3 of this report, that the NRC's recent orders have required licensees to undertake some planning for damage control following explosions or fires. Additional measures would be appropriate. For example, at a site housing one or more nuclear power plants and an ISFSI, the following damage-control measures could be implemented: Robust Storage of Spent Nuclear Fuel January 2003 Page 56 (i) establishment of a damage control capability at the site, using onsite personnel and equipment for first response and offsite resources for backup;(ii) periodic exercises of damage-control capability;(iii) establishment of a set of damage-control objectives -- to include patching and restoring water to a breached spent fuel pool, fire suppression in the ISFSJ, and provision of cooling to a reactor whose support systems and control room are disabled -- with accompanying plans; and (iv) provision of equipment and training to allow damage control to proceed on a radioactively-contaminated site.Offsite Emergency Response Emergency-response measures are those that reduce the potential for exposure of offsite populations to radiation, following a malice- or insanity-induced release of radioactive material from a nuclear facility. Measures in this category would in many respects be similar to emergency planning measures that are designed to accommodate "accidental" releases of radioactive material arising from human error, equipment failure or natural forces (e.g., earthquake). However, there are two major ways in which malice- or insanity-induced releases might differ from accidental releases.First, a malice- or insanity-induced release might be larger and begin earlier than an accidental release.1 2 6 Second, a malice- or insanity-induced release might be accompanied by deliberate degradation of emergency response capabilities (e.g., the attacking group might block an evacuation route).Accommodating these differences could require additional measures of emergency response. Overall, an appropriate way to improve emergency-response capability at a nuclear-power-plant site could be to implement a model emergency response plan that was developed by a team based at Clark University in Massachusetts. 1 2 7 This model plan was specificallydesigned to accommodate radioactive releases from spent-fuel-storage facilities, as well as from reactors. That provision, and other features of the plan, would provide a capability to accommodate both accidental releases and malice- or insanity-induced releases. Major features of the model plan include: 1 2 8 126 Present plans for emergency response do not account for the potential for a large release of radioactive material from spent fuel, as would occur during a pool fire. The underlying assumption is that a release of this kind is very unlikely. That assumption cannot be sustained in the present threat environment. 127 Golding et al, 1992.128 Ibid, pp 8-13.'2~0 Robust Storage of Spent Nuclear Fuel January 2003 Page 57 (i) structured objectives;(ii) improved flexibility and resilience, with a richer flow of information;(iii) precautionary initiation of response, with State authorities having an independent capability to identify conditions calling for a precautionary response' 29;(iv) criteria for long-term protective actions;(v) three planning zones, with the outer zone extending to any distance necessary130;(vi) improved structure for accident classification;(vii) increased State capabilities and power;(viii) enhanced role for local governments;(ix) improved capabilities for radiation monitoring, plume tracking and dose projection;(x) improved medical response;(xi) enhanced capability for information exchange;(xii) more emphasis on drills, exercises and training;(xiii) improved public education and involvement; and (xiv) requirement that emergency preparedness be regarded as a safety system equivalent to in-plant systems.4.5 A Strategy for Robust Storage of Spent Fuel The preceding section of this report sets forth a defense-in-depth strategy for nuclear facilities. This strategy could be implemented at every civilian nuclear facility in the United States. Within the context of that .strategy, it would be necessary to establish a nationwide strategy for the robust storage of spent fuel. The strategy must protect all spent fuel that has been discharged from a reactor but has not been emplaced in a repository. Available options for storing this fuel are wet storage in pools and dry storage in ISFSls.Timeframe for a Robust-Storage Strategy As pointed out in Section 2.1 of this report, thousands of tonnes of US spent fuel will remain in interim storage for decades, even if a repository opens at Yucca Mountain. If a repository does not open, the entire national inventory of spent fuel will remain in interim storage for many decades. Thus, the robust-storage strategy for spent fuel must minimize the overall risk of interim storage throughout a period that may extend for 100 years or longer.129 A security alert could be a condition calling for a precautionary response.130 The inner and intermediate zones would have radii of 5 and 25 miles, respectively. As an example of the planning measures in each zone, potassium iodide would be predistributed within the 25-mile zone and made generally accessible nationwide. 2 0o C Robust Storage of Spent Nuclear Fuel January 2003 Page 58 Moreover, this interim storage strategy must be compatible with the eventual emplacement of the spent fuel in a repository in a manner that minimizes long-term risk.Reactor Risk and Spent-Fuel Risk This report focusses on the risk of a radioactive release from spent fuel. It also, by necessity, discusses the risk of a similar release from a reactor. These risks are closely intertwined in two practical ways. First, many scenarios for a spent-fuel-pool fire involve interactions between the affected pool(s) and the reactor(s) on the site. Second, the security of an at-reactor ISFSI is an adjunct to the security of a nuclear-power-plant site.A robust-storage strategy for spent fuel could substantially reduce the risk of a radioactive release from spent fuel, at a comparatively low cost. Given the design of US nuclear power plants, there is no obvious strategy for achieving a comparable reduction in reactor risk. Thus, even if a defense-in-depth strategy is implemented for every reactor, a substantial fraction of the present reactor risk will continue to exist as long as the reactors continue to operate.What should be the risk target for a robust-storage strategy? There are three major considerations that argue for seeking a spent-fuel risk that is substantially lower than the reactor risk. First, measures are available for substantially reducing the spent-fuel risk at a comparatively low cost. Second, storing spent fuel creates no benefit to offset its risk, whereas reactors generate electricity. Third, spent fuel may be in interim storage for 100 years or longer, whereas the present reactors will operate for at most a few more decades.Elements of a Robust-Storage Strategy From Sections 4.2 and 4.3 of this report, it is evident that storing spent fuel in high-density pools poses a very high risk. Dry storage of spent fuel, even employing the present practice that is described in Section 2.3, poses a lower risk. Thus, a robust-storage strategy must assign its highest priority to re-equipping each spent fuel pool with low-density racks, in order to reduce the pool's inventory of fuel and to prevent self-ignition and burning of fuel if water is lost from the pool.1 3 1 The excess fuel, for which space would no longer be available in pools, would be transferred to ISFSls. When a nuclear power plant is shut down, the fuel remaining in its pool(s) would be transferred to an ISFSI after an appropriate period of cooling. These steps would dramatically reduce the overall risk of spent-fuel storage. A further, 131 Further protection of the spent fuel that remains in pools could be provided by a variety of site-security, facility-robustness and damage-control measures of the kind that are described in Section 4.4 of this report.2-o7 Robust Storage of Spent Nuclear Fuel January 2003 Page 59 substantial reduction of the overall risk would be obtained by employing hardened, dispersed, dry storage at every ISFSI.Figure 1, on the following page, shows how a robust-storage strategy for spent fuel would operate in a larger context. The robust-storage strategy would have the three elements represented by the three boxes at the base of the figure: low-density pools; hardened dry-storage modules; and dispersed dry-storage modules. In turn, the robust-storage strategy would be one of the elements of facility robustness, which itself would be one of four components of a defense in depth for US civilian nuclear facilities. This defense would contribute to homeland security and national security.A way-from-Reactor ISFSIs In a robust-storage strategy, any ISFSI would employ hardened, dispersed dry storage. The essential principles would be the same whether the ISFSI is at a nuclear-power-plant site or at another site such as Skull Valley.Section 2.1 of this report discusses factors that argue against shipping spent fuel to an away-from-reactor ISFSI. Some of these factors are economic in nature. However, three factors affect the overall risk of interim storage. First, shipment to an away-from-reactor ISFSI would increase the overall transport risk, because fuel would be shipped twice, first from the reactor site to the ISFSI, and then from the ISFSI to the ultimate repository. Second, an away-from-reactor ISFSI would hold a comparatively large inventory of spent fuel, creating a potentially attractive target for an enemy. Third, there is a risk that a large, away-from-reactor ISFSI would become, by default, a permanent repository, despite having no long-term containment capability. These three factors must be considered in minimizing the overall risk of interim storage.208 ý Robust Storage of Spent Nuclear Fuel January 2003 Page 60 FIGURE 1 ROBUST STORAGE OF SPENT FUEL IN THE CONTEXT OF NATIONAL SECURITY S.oq Robust Storage of Spent Nuclear Fuel January 2003 Page 61 5. Considerations in Planning Hardened, Dispersed, Dry Storage 5.1 Balancing Short- and Long-Term Risks Interim storage of spent fuel could lead to eventual emplacement of the fuel in a repository at Yucca Mountain. In this case, fuel would remain in interim storage for several decades. That period is long enough to require action to reduce the very high risk that is posed by pool storage, and the smaller but still significant risk that is posed by unhardened, undispersed ISFSIs.However, in this case the long-term risk posed by spent-fuel management would not be relevant to interim storage. The long-term risk, which will be significant for many thousands of years, would be associated with the Yucca Mountain repository. Avoiding a Repository by Default If a repository does not open, a different problem will arise. That problem is the possibility that society will extend the life of interim-storage facilities until they become, by default, repositories for spent fuel. These facilities would function poorly as repositories, and the environment around each facility would become contaminated by radioactive material leaking from the facility.This outcome would pose a substantial long-term risk. The prospect of society acting in this improvident manner may seem far-fetched, but becomes more credible when one examines the history of the Yucca Mountain project.That project is politically driven, and is going forward only because previously-specified technical criteria for a repository have been abandoned. 1 3 2 Any current planning for the implementation of interim storage must account for the possibility that a repository will not open at Yucca Mountain.Thus, the design approach that is adopted for a hardened, dispersed, dry-storage ISFSI must balance two objectives. The first objective is that the facility should be comparatively robust against attack. The second objective is that the facility should not have features that encourage society to allow the facility to become, by default, a repository. Consideration of the second objective dictates that the ISFSI should not, unless absolutely necessary, be located underground. Therefore, the first objective should be pursued through a design in which the ISFSI modules are stored at grade level (i.e., at the general level of the site). Hardening would then be achieved by placing steel, concrete, gravel or other materials above 132 Ewing and Macfarlane, 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 62 and around each module. The remaining protection would be provided by dispersal of the storage modules.5.2 Cost and Timeframe for Implementation As discussed in Section 2.1 of this report, forecasts show a rapid expansion in dry-storage capacity across the USA over the coming years. NAC International predicts that about 30 percent of US commercial spent fuel will be in dry-storage ISFSIs by 2010, as compared with 6 percent at the end of 2000.Vendors have developed a comparatively cheap technology for these ISFSIs, in response to to industry preferences. This technology -- the overpack system -- involves the placement of spent fuel into thin-walled metal containers that are stored inside overpacks made primarily from concrete.The resulting modules are placed close together in large numbers on concrete pads in the open air. A preference for vertical-axis modules seems to be emerging.Required Properties of Dry-Storage Modules Re-equipping US spent fuel pools with low-density racks would create a large additional demand for dry-storage modules. This demand should be met as quickly as possible, in view of the very high risk that is posed by high-density pool storage. Also, the cost of the additional storage capacity should be minimized, consistent with the achievement of performance objectives. Thus, it is desirable that module designs already approved by the NRC be used. However, any module that is used for a hardened, dispersed ISFSI must be capable, when hardened, of resisting a specified attack. This requirement did not exist when module designs were approved by the NRC. Also, it is desirable that modules be capable of retaining their integrity for 100 years or more, which was not a requirement when module designs were approved by the NRC. A module that does not have a long-life capability may need to be replaced at some point if it is used in an ISFSI that serves for an extended period. Finally, the design of a module should allow for the eventual transport of spent fuel from an ISFSI to a repository. Meeting the Requirements: Monolithic Casks versus Overpack Systems Of the module designs already approved by the NRC, monolithic casks such as the CASTOR are probably more capable of meeting attack-resistance and long-life requirements than are modules that employ a thin-walled metal container inside a concrete overpack. However, monolithic casks are more expensive. Thus, it would be convenient if some of the cheaper and more widely-used module designs proved to be capable of meeting attack-resistance Robust Storage of Spent Nuclear Fuel January 2003 Page 63 and long-life requirements. This outcome would minimize the cost of offloading fuel from pools to hardened, dispersed dry storage, and would expedite this transition. The development of detailed requirements for attack resistance and long life is a task beyond the scope of this report. Section 7 of the report sets forth a process for developing attack-resistance requirements, drawing upon experiments. When that process is completed, it will be possible to determine which of the already-approved module designs can be used for hardened, dispersed, dry storage.5.3 Design-Basis Threat The specification of a DBT for a nuclear facility inevitably reflects a set of tradeoffs. In the case of a hardened, dispersed, dry-storage ISFSI, five major considerations must be balanced. First, the ISFSI must protect spent fuel against a range of possible attacks. Second, the cost of the ISFSI should not be dramatically higher than the cost of an ISFS1 built according to present practice. Third, the timeframe for building of the ISFSI should be similar to the timeframe for building an ISFSI according to present practice. Fourth, the ISFSI should not, unless absolutely necessary, be built underground. Fifth, it should be possible to construct an ISFSI of this kind at every US nuclear-power-plant site.These considerations suggest a two-tier DBT for a hardened, dispersed, dry-storage ISFSI. This DBT might have the following structure: Tier I There should be high confidence that the release of radioactive material from the ISFSI to the environment would not exceed a small, specified amount in the event of a direct attack on any part of the ISFSI by: (i) a TOW missile;(ii) a specified manually-placed charge;(iii) a specified vehicle bomb;(iv) a specified explosive-laden general-aviation aircraft; or (v) a fuel-laden commercial aircraft.Tier II There should be reasonable confidence that the release of radioactive material from the ISFSI to the environment would not exceed a specified amount in Robust Storage of Spent Nuclear Fuel January 2003 Page 64 the event of a ground burst, at any part of the ISFSI, of a 10-kilotonne nuclear weapon.5.4 Site Constraints At each ISFSI site there will be a site-specific set of constraints on the development of a hardened, dispersed ISFSI. Some constraints will be political, financial or in some other non-physical category. Other constraints will be physical, reflecting the geography of the site. Of the physical constraints, the most significant will be the land area required for dispersal of dry-storage modules.At many nuclear-power-plant sites, ample land area will be available for dispersal. At some, smaller sites, it may not be possible to achieve the desired degree of dispersal, but this deficiency might be compensated by increased hardening. At the smallest sites, it might be necessary to relax the requirement that the ISFSI should not be built underground. This step would allow a substantial increase in hardening, to offset the limited degree of dispersal that could be achieved. At especially-constricted sites, it might be necessary to ship some spent fuel from the site to an ISFSI elsewhere.

6. A Proposed Design Approach for Hardened, Dispersed, Dry Storage An ISFSI design approach that offers a prospect of meeting the above-specified DBT involves an array of vertical-axis dry-storage modules at a center-to-center spacing of perhaps 25 meters. Each module would be on a concrete pad slightly above ground level, and would be surrounded by a concentric tube surmounted by a cap, both being made of steel and concrete.

This tube would be backed up by a conical mound made of earth, gravel and rocks. Further structural support would be provided by triangular panels within the mound, buttressing the tube. The various structural components would be tied together with steel rods. Air channels would be provided, to allow cooling of the dry-storage module. These channels would be inclined, to prevent pooling of jet fuel, and would be configured to preclude line-of-sight access to the dry-storage module. Figure 2, on the following page, provides a schematic view of the proposed design.2-Vs Robust Storage of Spent Nuclear Fuel January 2003 Page 65 Steel/coilcrete. Tiibe:&:Cap ........... ........... ....................... ......................................... ........... .. ........... .......... -.... ................. ... ............Un Storage Module'...........Nj:L C"oncrete,ýPad%Groun11-d Channel, for FIGURE 2 SCHEMATIC VIEW OF PROPOSED DESIGN FOR HARDENED, DRY STORAGE Notes 1. Cooling channels would be inclined, to prevent pooling of jet fuel, and would be configured to preclude line-of-sight access to the dry-storage module.2. The tube, cap and pad surrounding the dry-storage module would be tied together with steel rods, and spacer blocks would prevent the module from moving inside the tube.3. The steel/concrete tube could be buttressed by several triangular panels connecting the tube and the base pad. Robust Storage of Spent Nuclear Fuel January 2003 Page 66 Further analysis and full-scale experiments would be needed to determine whether this design approach, or something like it, could meet the DBT and other requirements that are set forth in Section 5, above. Ideally, these requirements could be met while using dry-storage modules that are approved by the NRC and are in common use. Another objective would be that the hardening elements (concentric tube, cap, tie rods, mound, etc.) could be built and assembled comparatively quickly and cheaply. These elements would not be high-technology items.The Benefits of Dispersal As an illustration of the benefits of dispersal, consider an attack on an ISFSI involving a ground burst of a 10-kilotonne nuclear weapon. In Section 4.2 of this report, it was noted that this attack could excavate a crater about 68 meters in diameter and 16 meters deep. If dry-storage modules had a center-to-center spacing of 5.5 meters, as is typical of present practice, about. 120 modules could fall within the crater area and suffer destruction. However, if the center-to-center spacing were 25 meters, as is proposed here, only 6 modules could fall within the crater area and suffer destruction. Site-Specific Tradeoffs Within this design approach it would be possible to trade off, to some extent, hardening and dispersal. As suggested in Section 5.4, above,' dispersal could be reduced and hardening could be increased at smaller sites. Detailed, site-specific analysis is needed to determine how such tradeoffs might work.An alternative design approach might be used at a few sites where space is insufficient to allow wide dispersal. In this approach, a number of dry-storage modules would be co-located in an underground, reinforced-concrete bunker.Similar bunkers would be dispersed across the site to the extent allowed by the site's geography. At an especially-constricted site, it might be necessary to reduce the overall inventory of spent fuel in order to meet design objectives. Thus, some spent fuel from the site would be shipped t6 an ISFSI elsewhere.

7. Requirements for Nationwide Implementation of Robust Storage 7.1 Experiments on Vulnerability of Dry-Storage Options Section 5.3 of this report outlines a DBT for hardened, dispersed, dry storage of spent fuel. Section 6 describes a design approach that offers a prospect of meeting a DBT of this kind, together with other requirements that are set forth in Section 5. Further investigation is needed to determine the extent to Robust Storage of Spent Nuclear Fuel January 2003 Page 67 which the various requirements can be met. This determination would be made at two levels. First, the investigation would determine if the DBT and other requirements set forth in Section 5 are broadly compatible with the proposed design approach or something like it. Second, assuming an affirmative determination at the first level, the investigation would go into more detail, exploring the various tradeoffs that could be made.An essential part of this investigation would be a series of full-scale, open-air experiments.

These experiments would be sponsored by the US government, and would be conducted at US government laboratories and testing centers.The experiments would involve a range of non-nuclear instruments of attack, including anti-tank missiles, manually-placed charges, vehicle bombs and aircraft bombs. Each instrument of attack would be tested against several test specimens that would simulate alternative design approaches for a hardened, dispersed ISFSI.A separate set of experiments would be conducted in contained situations. These experiments would study the potential for release of radioactive material following penetration or prolonged heating of a fuel container. 1 3 3 Factors discussed in Section 4.2 of this report, such as the presence of zirconium hydride in fuel cladding, would be accounted for. The potential for auto-ignition of hydrided cladding when exposed to air deserves special attention in the experimental program, because this potential is relevant not only to the vulnerability of dry-storage modules, but also to the initiation of a fire in a spent-fuel pool.1 3 4 7.2 Performance-Based Specifications for Robust Storage The investigation called for in Section 7.1 would establish the technical basis for a set of performance-based specifications for hardened, dispersed, dry storage of spent fuel. These specifications would include a detailed, precise formulation of the DBT. Also included would be design guidelines for meeting the DBT, and an allowable range of design parameters within which tradeoffs could be made. The specifications would apply not only to the design of external, hardening elements, but also to dry-storage modules.Thus, some modification of the licensing basis for currently-licensed dry-storage modules may be required.133 The proposed experiments would simulate, among other events, an attack in which penetration of a fuel container is accompanied by incendiary effects.134 At the higher fuel burnups now commonly achieved, zirconium hydride forms in the fuel.cladding. A potential for auto-ignition of zirconium hydride in air has been identified. See: Powers, 2000, page 3; Collins et al. 2000, page AIB-3. Robust Storage of Spent Nuclear Fuel January 2003 Page 68 Specifications for Low-Density Pool Storage Performance specifications would also be required for the nationwide reversion to low-density pool storage. A primary objective would be to prevent the initiation of a pool fire in the event of a loss of water from a pool.This would be accomplished by reverting to low-density, open-frame racks that allow convective cooling of fuel by air or steam in the event of water loss, as discussed in Section 4.2. (Note: Low-density, open-frame racks would not necessarily preclude a pool fire after water loss if auto-ignition of zirconium hydride, as discussed in Section 7.1, could occur. Thus, it is important to empirically resolve the auto-ignition issue.)At nuclear power plants with larger pools, reverting to low-density, open-frame racks will not conflict with other objectives. At plants with smaller pools, the pursuit of low density may conflict with other objectives, including: (i) preserving open spaces in the racks to allow offloading of the reactor core; (ii) allowing fuel to age for at least 5 years before transferring it to an ISFSI; and (iii) suppressing criticality of fresh or low-burnup fuel without relying on soluble boron in the pool water. Tradeoffs and technical fixes could resolve many of these conflicts. 1 3 5 New analysis, perhaps supplemented by some experiments, would establish the technical basis for performance specifications that include the necessary tradeoffs. Establishing the Specifications Establishing a comprehensive set of specifications for robust storage would call for the exercise of judgement. There is no purely objective basis for deciding upon one level of required performance as opposed to another.However, judgement must be exercised with full awareness of the wide-ranging implications of a particular choice. As discussed in Section 3 of this report, the defense of US nuclear facilities should be seen as a key component of homeland security and international security.In view of the national importance of the needed set of specifications, these should be developed with the full engagement of stakeholders. Relevant stakeholders include citizen groups, local governments and state 135 Examples of possible tradeoffs and technical fixes include: (i) relaxing the requirement to offload a full core; (ii) providing some high-density rack spaces for fresh fuel and core offload;(iii) relying on soluble boron in normal operation, with limited addition of unborated water if borated water is lost; (iv) adding some solid boron to rack structures while preserving an open-frame configuration; (v) relaxing the 5-year cooling period by partially filling some dry-storage modules or mixing younger fuel with older fuel in dry-storage modules; and (vi)-shipping some fuel to plants with larger pools. Robust Storage of Spent Nuclear Fuel January 2003 Page 69 governments. Processes are available that could allow full engagement of stakeholders while protecting sensitive information. 1 3 6 7.3 A Homeland-Security Strategy for Robust Storage A robust-storage strategy for'US spent fuel would involve two major initiatives. The first initiative would be to re-equip the nation's spent-fuel pools with low-density racks and to provide other defense-in-depth measures to protect the pools. The second initiative would be to place all spent fuel, other than the residual amount that would then be stored in low-density pools, into hardened, dispersed, dry-storage ISFSIs.Fast, effective implementation of this strategy would require decisive action by the US government. It would require expenditures that are comparatively small by national-security standards but are nonetheless significant. At present, there is no sign that the needed action will be taken. The US government in general seems largely unaware of the threat posed by the present practice of storing spent fuel. The NRC appears to be paralyzed, perhaps through fear of being criticized for its previous inattention to the threat of attack on nuclear facilities. A new paradigm is needed, in which spent-fuel-storage facilities are seen as pre-deployed radiological weapons that await activation by an enemy.Correcting this situation is an imperative of national defense. If the NRC continues to undermine national defense, it should be bypassed. Citizens should insist that Congress and the executive branch promptly initiate a strategy for robust storage of spent fuel, as a key clement of homeland security.8. Conclusions The prevailing practice of storing most US spent fuel in high-density pools poses a very high risk because knowledgeable attackers could induce a loss of water from a pool, causing a spent-fuel fire that would release a huge amount of radioactive material to the atmosphere. Nuclear reactors are also vulnerable to attack. Dry-storage modules used in ISFSIs have safety advantages in comparison to pools and reactors, but are not designed to resist a determined attack.Thus, nuclear power plants and their spent fuel can be regarded as pre-deployed radiological weapons that await activation by an enemy. The US government in general and the NRC in particular seem unaware of this 136 Thompson, 2002a, Sections IX and X. Robust Storage of Spent Nuclear Fuel January 2003 Page 70 threat. US nuclear facilities are lightly defended and are not designed to resist attack. This situation is symptomatic of an unbalanced US strategy for national security, which is a potentially destabilizing factor internationally. A strategy for robust storage of US spent fuel is needed, whether or not a repository is opened at Yucca Mountain. This strategy should be implemented as a major element of a defense-in-depth strategy for US civilian nuclear facilities. In turn, that defense-in-depth strategy should be a component of a homeland-security strategy that provides solid protection of our critical infrastructure. The highest priority in a robust-storage strategy for spent fuel would be to re-equip spent-fuel pools with low-density, open-frame racks. As a further measure of risk reduction, ISFSIs should be re-designed to incorporate hardening and dispersal. These measures should not be implemented in a manner such that an ISFSI may become, by default, a repository. Therefore, a hardened ISFSI should not, unless absolutely necessary, be built underground. Also, the cost and timeframe for implementing hardening and dispersal should be minimized. These considerations argue for the use, if possible, of dry-storage modules thatare already approved by the NRC and are in common use.Preliminary analysis suggests that a hardened, dispersed ISFSI meeting these criteria could be designed to meet a two-tiered DBT. The first tier would require high confidence that no more than a small release of radioactive material would occur in the event of a direct attack on the ISFSI by various non-nuclear instruments. The second tier would require reasonable confidence that no more than a specified release of radioactive material would occur in the event of attack using a 10-kilotonne nuclear weapon.Three major requirements must be met if a robust-storage strategy for spent fuel is to be implemented nationwide. First, appropriate experiments are needed. Second, performance-based specifications for robust storage must be developed with stakeholder involvement. Third, robust storage for spent fuel must be seen as a vital component of homeland security. Robust Storage of Spent Nuclear Fuel January 2003 Page 71 9. Bibliography (Alpert et al, 1986)Daniel]. Alpert et al, Relative Importance of Individual Elements to Reactor Accident Consequences Assuming Equal Release Fractions, NUREG/CR-4467 (Washington, DC: NRC, March 1986).(ASLB, 1982)Atomic Safety and Licensing Board, "Carolina Power and Light Co." (Shearon Harris Nuclear Power Plant, Units I and 2), LBP-82-119A, 16 NRC 2069 (1982).(Baker, Cutler et al, 2001)Howard Baker and Lloyd Cutler (co-chairs, Russia Task Force) et al, A Report Card on the Department of Energy's Nonproliferation Programs with Russia (Washington, DC: Secretary of Energy Advisory Board, US Department of Energy, 10 January 2001).(Barnard and Kerber, 2001)Anne Barnard and Ross Kerber, "Web posting tells of suspect's firing from Maine plant", The Boston Globe, 5 January 2001, page A12.(Betts, 2003)Richard K. Betts, "Suicide From Fear of Death", Foreign Affairs, January/February 2003, pp 34-43.(Beyea et al, 1979)Jan Beyea, Yves Lenoir, Gene Rochlin and Gordon Thompson (subgroup chair), Report of the Gorleben International Review, Chapter 3: Potential Accidents and their Effects, submitted (in German) to the Government of Lower Saxony, March 1979.(Bunn et al, 2002)Matthew Bunn, John P. Holdren and Anthony Wier, Securing Nuclear Weapons and Materials: Seven Steps. for Immediate Action (Cambridge, Massachusetts: John F. Kennedy School of Government, Harvard University, May 2002).(Burns, 2002)Jimmy Burns, "Al-Qaeda planning attack on US interests", Financial Times, 5 September 2002.-29-2 Robust Storage of Spent Nuclear Fuel January 2003 Page 72 (Carter et al, 1998)A. Carter, J. Deutch and P. Zelikow, "Catastrophic Terrorism", Foreign Affairs, November/December 1998.(Chapin et al, 2002)Douglas M. Chapin et al, "Nuclear Power Plants and Their Fuel as Terrorist Targets", Science, Volume 297, 20 September 2002, pp 1997-1999.(Collins et al, 2000)Timothy Collins et al, Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants (Washington, DC: US Nuclear Regulatory Commission, October 2000).(Commission on National Security, 1999)US Commission on National Security/21st Century, New World Coming: American Security in the 21st Century, Phase I report, 15 September 1999.(Commons Defence Committee, 2002)House of Commons Defence Committee, Defence and Security in the UK: Sixth Report of Session 2001-02 (London: The Stationery Office Limited, 24 July 2002).(Conetta, 2002)Carl Conetta, Dislocating Alcyoneus: How to combat al-Oaeda and the new terrorism (Cambridge, Massachusetts: Project on Defense Alternatives, 25 June 2002).(Crawford, 2003)Alan Crawford, "Terrorism 'not as bad as war': Leading academic warns'disproportionate response' by Britain and US forces could escalate conflict", Sunday Herald, 12 January 2003.(Decker, 2001)Raymond J. Decker, Director, Defense Capabilities and Management, US General Accounting Office, "Homeland Security: A Risk Management Approach Can Guide Preparedness Efforts", testimony before the Senate Committee on Governmental Affairs, 31 October 2001.(Deller, 2002)Nicole Deller, "Rule of Power or Rule of Law?", Science for Democratic Action, Volume 10, Number 4, August 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 73 (DOE, 2002)US Department of Energy, Final Environmental Impact Statement for a Geologic Repository for the Disposal of Spent Nuclear Fuel and High-Level Radioactive Waste at Yucca Mountain. Nve County, Nevada, DOE/EIS-0250F (Washington, DC: DOE, February 2002).(DOE, 1987)US Department of Energy, Health and Environmental Consequences of the Chernobyl Nuclear Power Plant Accident. DOE/ER-0332 (Washington, DC: DOE, June 1987).(ERIN, 2000)ERIN Engineering and Research Inc, "Technical Input for Use in the Matter of Shearon Harris Spent Fuel Pool Before the Atomic Safety and Licensing Board (Docket No. 50-400-LA)", November 2000.(Ewing and Macfarlane, 2002)Rodney C. Ewing and Allison Macfarlane, "Yucca Mountain", Science, Volume 296, 26 April 2002, pp 659-660.(Farah, 2002)Douglas Farah, "Al Qaeda, Taliban said to stash gold in Sudan", The Boston Globe, 3 September 2002, page A11.(Fetter, 1982)Steve Fetter, The Vulnerability of Nuclear Reactors to Attack by Nuclear Weapons (Cambridge, Massachusetts: Physics Department, Massachusetts Institute of Technology, August 1982).(Fetter and Tsipis, 1980)Steve Fetter and Kosta Tsipis, Catastrophic Nuclear Radiation Releases (Cambridge, Massachusetts: Physics Department, Massachusetts Institute of Technology, September 1980).(Flowers et al, 1976)Brian Flowers (chair) et al, Nuclear Power and the Environment: Sixth Report of the Royal Commission on Environmental Pollution, Cmnd. 6618 (London: HMSO, September 1976).(Garwin, 2001)Richard Garwin, "The Many Threats of Terror", The New York Review, I November 2001. Robust Storage of Spent Nuclear Fuel January 2003 Page 74 (Gervasi, 1977)Tom Gervasi, Arsenal of Democracy (New York: Grove Press, 1977).(Glasstone, 1962)Samuel Glasstone (editor), The Effects of Nuclear Weapons (Washington, DC: US Atomic Energy Commission, April 1962).(Golding et al, 1995)Dominic Golding et al, Preparing for Nuclear Power Plant Accidents (Boulder, Colorado: Westview Press, 1995).(Golding et al, 1992)Dominic Golding et al, Managing Nuclear Accidents: A Model Emergency Response Plan for Power Plants and Communities (Boulder, Colorado: Westview Press, 1992).(Goldman, 2000)John J. Goldman, "Former sergeant admits role in bombings of US embassies", The Boston Globe, 21 October 2000, page A2.(Hannerz, 1983)K. Hannerz, Towards Intrinsically Safe Light Water Reactors JOak Ridge, Tennessee: Institute for Energy Analysis, February 1983).(Hart et al, 2002)Gary Hart and Warren B. Rudman (co-chairs), Stephen E. Flynn (project director) and Task Force members, America Still Unprepared -- America Still in Danger: Report of an Independent Task Force Sponsored by the Council on Foreign Relations (New York, NY: Council on Foreign Relations, 25 October 2002).(von Hippel, 2001)Frank von Hippel, "Recommendations for Preventing Nuclear Terrorism", FAS Public Interest Report: Journal of the Federation of American Scientists, Volume 54, Number 6, November/December 2001, pp 1-10.(Hirsch, 2002).Helmut Hirsch, unpublished note on the safety and security of German dry-storage facilities that use CASTOR casks, summarizing the findings of German-language reports that have been prepared by Hirsch and others for the Austrian Federal Government and Austrian State Governments, September 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 75 (Hirsch et al, 1989)H. Hirsch et al, IAEA Safety Targets and Probabilistic Risk Assessment (Hannover, Germany: Gesellschaft fur Okologische Forschung und Beratung mbH, August 1989).(Hoffman, 2002)F. G. Hoffman, Homeland Security: A Competitive Strategies Approach (Washington, DC: Center for Defense Information, March 2002).(Hogg, 1991)Ian V. Hogg (editor), lane's Infantry Weapons, 1991-92 (Alexandia, Virginia: Jane's Information Group, 1991)(ackson, 1996)Paul Jackson (editor), lane's All the World's Aircraft, 1996-97 (Alexandria, Virginia: Jane's Information Group, 1996).(Janberg, 2002)Klaus Janberg, oral presentation at the MIT seminar, "Radiological Hazard Posed by Nuclear Power Plants and Spent Fuel", 2 July 2002.(Jones, 2002a)David Jones, "Sandia says its study not proof of nuke plant durability" Inside Enter, 30 September 2002, page 14.(Jones, 2002b)Gary Jones, Director, Natural Resources and Environment, US General Accounting Office, "Nuclear Waste: Uncertainties about the Yucca Mountain Repository Project", testimony before the Subcommittee on Energy and Air Quality, House Committee on Energy and Commerce, 21 March 2002.(Keeny et al, 1977)Spurgeon M. Keeny et al, Nuclear Power Issues and Choices (Cambridge, Massachusetts: Ballinger Publishing Company, 1977).(Kot et al, 1982)C. A. Kot et al, Evaluation of Aircraft Crash Hazards Analyses for Nuclear Power Plants, NUREG/CR-2859 (Washington, DC: NRC, June 1982).(Krass, 1991)Allan S. Krass, Consequences of the Chernobyl Accident (Cambridge, Massachusetts: Institute for Resource and Security Studies, December 1991).2 ~ Robust Storage of Spent Nuclear Fuel January 2003 Page 76 (Kugler, 1995)Richard L. Kugler, Toward a Dangerous World: US National Security Strategy for the Coming Turbulence (Santa Monica, California: RAND, 1995).(Lange et al, 2002)F. Lange et al, "Experiments to Quantify Potential Releases and Consequences from Sabotage Attack on Spent Fuel Casks", in Proceedings of the 13th International Symposium on the Packaging and Transportation of Radioactive Material (PATRAM) (Northbrook, Illinois: Institute of Nuclear Materials Management, 2002).(Larson, 1985)Jay R. Larson, Systems Analysis Handbook, NUREG/CR-4041 (Washington, DC: US Nuclear Regulatory Commission, November 1985).(Lempert et al, 2000)J. P. Lempert et al, "Status of HLW and Spent Fuel Management in the Federal Republic of Germany", paper presented at the WM'00 Conference, Tucson, Arizona, 27 February to 2 March 2000.(Leventhal and Alexander, 1987)Paul Leventhal and Yonah Alexander (editors), Preventing Nuclear Terrorism (Lexington, Massachusetts: Lexington Books, 1987).(Macfarlane, 2001a)Allison Macfarlane, "Interim Storage of Spent Fuel in the United States", Annual Review of Energy & Environment, Volume 26 (2001), pp 2,01-235.(Macfarlane, 2001b)Allison Macfarlane, "The problem of used nuclear fuel: lessons for interim solutions from a comparative cost analysis", Energy Policy, Volume 29 (2001), pp 1379-1389.(Maguire, 2001)Kevin Maguire, "Security checks tightened after high-level alert", The Guardian, 9 January 2001.(Margulies and Martin, 1984)T. S. Margulies and J. A. Martin, Dose Calculations for Severe LWR Accident Scenarios, NUREG-1062 (Washington, DC: NRC, May 1984).-2-1,5-Robust Storage of Spent Nuclear Fuel January 2003 Page 77 (Markey, 2002)Staff of US Representative Edward Markey, "Security Gap: A Hard Look At the Soft Spots in Our Civilian Nuclear Reactor Security", 25 March 2002.(Martin, 2002)John R. Martin (editor), Defeating Terrorism: Strategic Issue Analyses (Carlisle, Pennsylvania: Strategic Studies Institute, US Army War College, January 2002).(Mathews, 2002)Jessica T. Mathews, September

11. One Year Later: A World of Change (Washington, DC: Carnegie Endowment for International Peace, September 2002).(McCough and Pennington, 2002)Michael S. McCough and Charles W. Pennington, "Plane tough storage", Nuclear Engineering International, May 2002, pp 24-26.(Meserve, 2002)NRC Chairman Richard Meserve, "Statement Submitted by the United States Nuclear Regulatory Commission to the Committee on Environment and Public Works, United States Senate, Concerning Nuclear Power Plant Security", 5 June 2002.(NAC, 2001)NAC Worldwide Consulting, US Spent Fuel Update: Year 2000 in Review (Atlanta, Georgia: NAC Worldwide Consulting, 2001).(National Intelligence Council, 2001)National Intelligence Council, Foreign Missile Developments and the Ballistic Missile Threat Through 2015: Unclassified Summary of a National Intelligence Estimate (Washington, DC: Central Intelligence Agency, December 2001).(National Research Council, 2002)National Research Council, Making the Nation Safer: The Role of Science and Technology in Countering Terrorism (Washington, DC: National Academy Press, 2002).(National Research Council, 1990)National Research Council, Health Effects of Exposure to Low Levels of Ionizing Radiation:

BEIR V (Washington, DC: National Academy Press, 1990).-) (3/4 Robust Storage of Spent Nuclear Fuel January 2003 Page 78 (NEI, 2002)Nuclear Energy Institute, "Deterring Terrorism: Aircraft Crash Impact Analyses Demonstrate Nuclear Power Plant's Structural Strength", December 2002.(Newhouse, 2002)John Newhouse, "Assessing the Threats", in John Newhouse (editor), Assessing the Threats (Washington, DC: Center for Defense Information, July 2002).(NRC, 2002)US Nuclear Regulatory Commission, Fact Sheet: Nuclear Security Enhancements Since Sept. 11, 2001 (Washington, DC: US Nuclear Regulatory Commission, undated, apparently September 2002).(NRC Staff, 2002)"NRC Staffs Response to Contentions Submitted by San Luis Obispo Mothers for Peace et al", 19 August 2002, before the Atomic Safety and Licensing Board in the Matter of Pacific Gas & Electric Company, Diablo Canyon ISFSI, Docket No. 72-26-ISFSI, ASLBP No. 02-801-01-ISFSI.(NRC, 1997)US Nuclear Regulatory Commission, Standard Review Plan for Dry. Cask Storage Systems. NUREG-1536 (Washington, DC: US Nuclear Regulatory Commission, January 1997).(NRC, 1990)US Nuclear Regulatory Commission, Severe Accident Risks: An Assessment for Five US Nuclear Power Plants. NUREG-1150 (Washington, DC: US Nuclear Regulatory Commission, December 1990).(Office of Homeland Security, 2002)Office of Homeland Security, National Strategy for Homeland Security (Washington, DC: The White House, July 2002).(Okrent, 1981)David Okrent, Nuclear Reactor Safety: On the History of the Regulatory Process (Madison, Wisconsin: University of Wisconsin Press, 1981).(Parry et al, 2000)ASLBP No. 99-762-02-LA, "Affidavit of Gareth W. Parry, Stephen F. LaVie, Robert L. Palla and Christopher Gratton in Support of NRC Staff Brief and Summary of Relevant Facts, Data and Arguments upon which the Staff 12-7 Robust Storage of Spent Nuclear Fuel January 2003 Page 79 Proposes to Rely at Oral Argument on Environmental Contention EC-6", 210 November 2000.(Pennington, 2002)Charles W. Pennington, "The Continuing Safety of NAC's Multipurpose Dry Storage Systems in the Face of Militant Acts of Destructiveness (MADness)", viewgraphs accompanying a presentation at the Institute of Nuclear Materials Management-sponsored Spent Fuel Management Seminar XIX, Washington, DC, 10 January 2002.(Peters et al, 1999)Ralf Peters et al, "CONSTOR -Spent Nuclear Fuel Storage and Transport Cask System", paper presented at WM'99 Conference, 28 February to 4 March 1999.(PG&E, 2001a)Pacific Gas and Electric Company, Diablo Canyon Independent Spent Fuel Storage Installation: Environmental Report (Avila Beach, California: PG&E, 21 December 2001).(PG&E, 2001b)Pacific Gas and Electric Company, Diablo Canyon Independent Spent Fuel Storage Installation: Safety Analysis Report (Avila Beach, California: PG&E, 21 December 2001).(PLG, 1983)Pickard, Lowe and Garrick Inc, Seabrook Station Probabilistic Safety Assessment, Main Report (Irvine, California: PLG, December 1983).(POGO, 2002)Project on Government Oversight, Nuclear Power Plant Security: Voices from Inside the Fences (Washington, DC: Project on Government Oversight, 12 September 2002).(Powers, 2000)Dana A. Powers, Chairman, Advisory Committee on Reactor Safeguards, letter of 13 April 2000 to NRC Chairman Richard A. Meserve, subject: "Draft Final Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants".(Purdue, 2002)Purdue University, "Purdue News: New simulation shows 9/11 plane crash with scientific detail", 10 September 2002. Robust Storage of Spent Nuclear Fuel January 2003 Page 80 (Raddatz and Waters, 1996)M. G. Raddatz and M. D. Waters, Information Handbook on Independent Spent Fuel Storage Installations, NUREG-1571 (Washington, DC: US Nuclear Regulatory Commission, December 1996).(Ramberg, 1984)Bennett Ramberg, Nuclear Power Plants as Weapons for the Enemy: An Unrecognized Military Peril (Los Angeles: University of California Press, 1984).(Raskin et al, 2002)Paul Raskin et al, Great Transition: The Promise and Lure of the Times Ahead (Boston, Massachusetts: Stockholm Environment Institute, 2002).(Rehm, 1984)T. A. Rehm, memo to the NRC Commissioners, "Weekly Information Report -- Week Ending April 20, 1984".(Resnikoff, 2001)Marvin Resnikoff, Declaration of 30 January 2001 before the Atomic Safety and Licensing Board, US Nuclear Regulatory Commission, regarding the proposed Private Fuel Storage independent spent fuel storage installation (ASLBP No. 97-732-02-ISFSI).(Reuters, 2002)Reuters, "School says its missiles were licensed", The Boston Globe, 20 August 2002, page A 11.(Rufford et al, 2001)Nicholas Rufford, David Leppard and Paul Eddy, "Nuclear Mystery: Crashed plane's target may have been reactor", The Sunday Times, London, 20 October 2001.(Sailor et al, 1987)V. L. Sailor et al, Severe Accidents in Spent Fuel Pools in Support of Generic Safety Issue 82, NUREG/CR-4982 (Washington, DC: NRC, July 1987).(Scarry, 2002)Elaine Scarry, "A nuclear double standard", Boston Sunday Globe, 3 November 2002, page D11.1221 Robust Storage of Spent Nuclear Fuel January 2003 Page 81 (Shleien, 1983)Bernard Shleien, Preparedness and Response in Radiation Accidents (Washington, DC: US Department of Health and Human Services, August 1983).(SIPRI, 1981)Stockholm International Peace Research Institute, Nuclear Radiation in Warfare (London: Taylor and Francis, 1981).(Sloan, 1995)Stephen Sloan, "Terrorism: How Vulnerable is the United States?", in Stephen Pelletiere (editor), Terrorism: National Security Policy and the Home Front (Carlisle, Pennsylvania: Strategic Studies Institute, US Army War College, May 1995).(Sokolski and Riisager, 2002)Henry D. Sokolski and Thomas Riisager, Beyond Nunn-Lugar: Curbing -the Next Wave of Weapons Proliferation Threats from Russia (Carlisle, Pennsylvania: Strategic Studies Institute, US Army War College, April 2002).(Sozen et al, 2002)Mete A. Sozen et al, "September 11 Pentagon Attack Simulations Using LS-Dyna: Phase I, Completed September 11, 2002"<http://www.cs.purdue.edu/homes/cmh/simulation/>(Sprung et al, 2000)J. L. Sprung et al, Reexamination of Spent Fuel Shipment Risk Estimates. NUREG/CR-6672 (Washington, DC: US Nuclear Regulatory Commission, March 2000).(Stone and Webster, 1999)Stone and Webster, Maine Yankee Independent Spent Fuel "Storage Installation (ISFSI): Site Location of Development Permit #L-17973.Application for Amendment to Maine Department of Environmental Protection (Boston, Massachusetts: Stone and Webster, April 1999).(Thompson and Beckerly, 1973)T. J. Thompson and J. G. Beckerley (editors), The Technology of Nuclear Reactor Safety, Volume 2 (Cambridge, Massachusetts: MIT Press, 1973). Robust Storage of Spent Nuclear Fuel January 2003 Page 82 (Thompson, 2002a)Gordon Thompson, Declaration of 7 September 2002 in support of a petition to the US Nuclear Regulatory Commission by Avila Valley Advisory Council et al, regarding nuclear-facility operations at the Diablo Canyon site.(Thompson, 2002b)Gordon Thompson, Civilian Nuclear Facilities as Weapons for an Enemy: A submission to the House of Commons Defence Committee (Cambridge, Massachusetts: Institute for Resource and Security Studies, 3 January 2002).(Thompson, 2001)Gordon Thompson, Declaration of 31 October 2001 in support of a motion by CCAM/CAM before the Atomic Safety and Licensing Board, US Nuclear Regulatory Commission, regarding the Millstone nuclear power station (ASLBP No. 00-771-01-LA).(Thompson, 1999)Gordon Thompson, Risks and Alternative Options Associated with Spent Fuel Storage at the Shearon Harris Nuclear Power Plant (Cambridge, Massachusetts: Institute for Resource and Security Studies, February 1999).(Thompson, 1998a)Gordon Thompson, "Science, democracy and safety: why public accountability matters", in F. Barker (editor), Management of Radioactive Wastes: Issues for local authorities (London: Thomas Telford, 1998).(Thompson, 1998b)Gordon Thompson, High Level Radioactive Liquid Waste at Sellafield: Risks, Alternative Options and Lessons for Policy (Cambridge, Massachusetts: Institute for Resource and Security Studies, June 1998).(Thompson, 1996)Gordon Thompson, War, Terrorism and Nuclear Power Plants (Canberra: Peace Research Centre, Australian National University, October 1996).(Thompson and Sholly, 1991)Gordon Thompson and Steven C. Sholly, No Restart for K Reactor (Cambridge, Massachusetts: Institute for Resource and Security Studies, October 1991). Robust Storage of Spent Nuclear Fuel January 2003 Page 83 (Throm, 1989)E. D. Throm, Regulatory Analysis for the Resolution of Generic Issue 82."Beyond Design Basis Accidents in Spent Fuel Pools". NUREG-1353 (Washington, DC: US Nuclear Regulatory Commission, April 1989).(Travers, 2002)William D. Travers, memo to the NRC Commissioners, "Withholding Sensitive Homeland Security Information From the Public, COMSECY 0015", 4 April 2002.(Travers, 2001)William D. Travers, memo to the NRC Commissioners, "Policy Issues Related to Safeguards, Insurance, and Emergency Preparedness Regulations at Decommissioning Nuclear Power Plants Storing Fuel in Spent Fuel Pools (WITS 200000126), SECY-01-0100", 4 June 2001.(Vermont Yankee, 2000)Vermont Yankee Nuclear Power Corporation, Responses to CAN's 2nd Set of Interrogatories and Requests to Produce, 28 February 2000, Docket No. ,6300, Response VY:CAN:2-21.(Wald, 2001)Matthew L. Wald, "US Failed to Learn From Earlier Hijackings", International Herald Tribune, 4 October 2001, page 6.(Walker, 2002)David M. Walker, Comptroller General of the United States, "Homeland Security: Responsibility and Accountability For Achieving National Goals", testimony before the Senate Committee on Governmental Affairs, 11 April 2002.(Weyman, 1999)Dean Weyman (Engineering Department, Vermont Yankee Nuclear Power Corporation), memo to Bob Jordan, 12 February 1999.(White House, 2002)The White House, The National Security Strategy of the United States of America (Washington, DC: The White House, September 2002). The EPA Radiation Standard for Spent-Fuel Storage in a Geological Repository Background Information November 2006 BACKGROUND In 2002, the U.S. Congress upheld the President's designation of the Yucca Mountain, Nevada, site for a national repository for used commercial nuclear fuel and high-level radioactive waste.This designation enabled the U.S. Department of Energy (DOE) to proceed with federal licensing activities required before beginning construction of a specially designed repository. In accordance with the Nuclear Waste Policy Act of 1982, as amended, the DOE is developing a license application for Yucca Mountain that it will submit to the U.S. Nuclear Regulatory Commission (NRC). The NRC will independently evaluate DOE's repository design and safety analysis to determine if the planned facility meets regulatory requirements. The "Energy Policy Act of 1992" (Ref. 1) required the U.S. Environmental Protection Agency (EPA) to issue public health and safety standards for the Yucca Mountain site "based upon and consistent with the findings and recommendations of the National Academy of Sciences" (NAS).The NAS study (Ref. 2) was issued in 1995 and found "no scientific basis for limiting the time period of the individual standard to 10,000 years or any other value." However, it recommended that the standard be applied whenever the peak risk, or highest exposure, is anticipated to occur.Some calculations project that the peak risk-might occur tens of thousands of years into the future.Following the NAS report, the EPA issued a proposed rule in 1999 (Ref. 3) and following consideration of many public comments issued a final rule in 2001 (Ref. 4) limiting the compliance period to 10,000 years. The EPA acknowledged the NAS recommendation but concluded "there is still considerable uncertainty as to whether current modeling capability allows development of computer models that will provide sufficiently meaningful and reliable projections over a time frame up to tens-of-thousands to hundreds-of-thousands of years. Simply because such models can provide projections for those time periods does not mean those projections are meaningful and reliable enough to establish a rational basis for regulatory decision-making." The NRC incorporated the EPA standards into its own regulations (Ref. 5) and agreed with the"fact that it is feasible to calculate performance of the engineered and geologic barriers ... for periods much longer than 10,000 years does not mean that it is possible to make realistic or meaningful projections of human exposure and risk ...." The DOE also supported the 10,000-The EPA Radiation Standard for Spent-Fuel Storage in a Geological Repository Background for Position Statement 81 November 2006 AMERICAN NUCLEAR SOCIETY

• Outreach Program 708-352-6611
• Federal Affairs 708-352-6611 9 www.ans.org 1 of 3 year compliance period on the basis that a "significantly longer time period for assessing compliance would be unprecedented, unworkable, and probably unimplementable" (Ref. 6). In response to several legal challenges, the U.S. Court of Appeals vacated in July 2004 (Ref. 7) the 10,000-year time frame used by the EPA on the basis that it did not comply with the Congressional mandate that it be based on the NAS recommendations.

The Court ruled that the EPA could reissue the standard providing a better basis for its decision, issue a rule with standards extending to one million years, or seek legislative endorsement of the 10,000-year applicability period.The Court ruled that the 10,000-year EPA standard and NRC regulations limiting radiation levels, analytical methods, and other programs to protect public health and safety from the repository were determined appropriately through scientific assessments. However, the Court agreed with Nevada that the EPA's 10,000-year radiation standard was not "based upon and consistent with" a 1995 NAS recommendation as required by the Energy Policy Act of 1992.The science behind radiation and its health effects is based on more than a half-century of study.In the United States, naturally occurring radiation exposes residents to an average of 300 millirems per year (Ref. 8).a The existing EPA standard states that for the next 10,000 years, the critical population group closest to the boundary of the Yucca Mountain repository can receive an annual dose of no more than 15 millirems-an amount equal to taking three round-trip transcontinental airline flights.The 15-millirem limit is about twice the amount of radiation that workers in the U.S. Capitol building receive per year from the naturally occurring radioactivity in the structure's granite blocks. According to DOE studies, the expected annual radiation dose near Yucca Mountain would be 0.1 millirem, less than 1 percent of the EPA limit. Subsequent to the court decision invalidating the 1 0,000-year regulatory period, the EPA developed an additional post- 10,000-year standard of 350 millirems per year by surveying background radiation in parts of the Rocky Mountain west and Southwest that had similar geography and geology to those of the Yucca Mountain site.The court decision offered two alternatives for implementing its mandate: The EPA could revise regulations to extend the compliance period (and the NRC would then make its regulatory review consistent), or Congress could enact legislation to define a compliance period. The Court also suggested a third alternative whereby the EPA could reinstate the 10,000-year period by providing a better explanation of the rationale for it.In August 2005, the EPA proposed a revised radiation standard for Yucca Mountain. This standard holds the annual dose limit at 15 millirems for 10,000 years. The standard also imposes a NUREG 1501 indicates a background dose of 300 millirems per year (3.0 millisieverts per year) for the United States in Table 2.9, Sec. 2.4.1, and includes a value of 2.4 for the World mean. Table 2.10 in Sec. 2.4.2 provides a rounded total of 3.6 to 3.7 millisieverts per year (360 to 370 millirems per year) including contributions from other sources such as occupational, and nuclear medical.The EPA Radiation Standard for Spent-Fuel Storage in a Geological Repository Background for Position Statement 81 Novemii 2006 AMERICAN NUCLEAR SOCIETY

• Outreach Program 708-352-6611 a Federal Affairs 708-352-6611
• www.ans.org 2 of 3 a 350-millirem limit for the period between 10,000 and 1 million years into the future.References

1. "Energy Policy Act of 1992," Public Law 102-486 (Oct. 24, 1992).2. "Technical Bases for Yucca Mountain Standards," National Academy of Sciences (1995).3. "Public Health and Environmental Radiation Protection Standards for Yucca Mountain, NV;Proposed Rule," Title 40, Part 197, Code of Federal Regulations (Aug. 27, 1999); 64 FR 46991, Federal Register.4. "Public Health and Environmental Radiation Protection Standards for Yucca Mountain, NV;Final Rule," Title 40, Part 197, Code of Federal Regulations (June 13, 2001); FRL-6995-7, pp.32074-32135, Federal Register.5. "Disposal of High-Level Radioactive Wastes in a Proposed Geologic Repository at Yucca Mountain, NV; Final Rule," Title 10, Parts 2, 19, 20, 21, etc., Code of Federal Regulations (Nov.2, 2001); Vol 66, No. 213, pp. 55732-55816.

6. Lake H. Barrett, Acting Director, Office of Civilian Radioactive Waste Management, Letter to U.S. Environmental Protection Agency (Nov. 2, 1999).7. U.S. Court of Appeals for the District of Columbia Circuit, No. 01-1258 (July 9,2004).8. "Background as a Residual Radioactivity Criterion for Decommissioning," NUREG 1501, U.S. Nuclear Regulatory Commission.

The American Nuclear Society, founded in 1954, is a not-for-profit scientific and educational society of over 10,000 scientists, engineers, and educators from universities, government and private laboratories, and industry.Position Statements are the considered opinions and judgments of the Society in matters related to nuclear science and technology. They are intended to provide an objective basis for weighing the facts in reaching decisions on important national issues.The EPA Radiation Standard for Spent-Fuel Storage in a Geological Repository Background for Position Statement 81 November 2006 AMERICAN NUCLEAR SOCIETY

• Outreach Program 708-352-6611
• Federal Affairs 708-352-6611
• www.ans.org 3 of 3 EXHIBIT NN 90 Ll Exhibit NN UNITED STATES CENSUS BUREAU POPULATION STATISTICS ROCKLAND 136803 229,908 286753 294,965 116%WESTCHESTER 808891 894104 923459 949,355 17%ORANGE 183734 208505 341367 376,392 51%PUTNAM 31722 58471 95745 100,603 217%TOTAL for 4 1161150 1721315 49%COUNTIES*Estimated.

All other statistics are based on census data+http://www.census.gov/population/cencounts/ny 1 90090.txt'C-EXHIBIT 00 EXHIBIT 00 SA M E S L E E ASSOCIATES, L L C S-34j Prepared By James Lee Witt Associates, LLC 1201 F Street, NW, Suite 850 Washington, DC 20004 Prepared For Power Authority of the State of New York Prepared Under Contract for New York State Nuclear Plan Review, 4500058472 This report documents work by author, JL WA and contracted with and/or requested by: an agency of the State of New York The author's opinions findings, conclusions, and/or recommendations are provided solely for the use and benefit of the requesting party. Any warranties (expressed and/or implied), unless explicitly set forth herein, are specifically waived Any statements, allegations, and/or recommendations in this report should not be construed as a New York State position, policy, or decision, unless so designated by other documentation. The report was based on the most accurate data available to author at the time of publication, and therefore is subject to change without notice. The use of trade names in this report does not constitute an official endorsement or approval of the use of such commercial products. Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone Table of Contents EXECUTIVE

SUMMARY

Vi CHAPTER 1 INTRODUCTION I 1.1 Organization of this Document 1 CHAPTER 2 BACKGROUND 4 2.1 Location and Description of Indian Point 4 2.2 Descriptions and Demographics of Counties Surrounding Indian Point 7 2.2.1 Orange County Description 7 2.2.2 Putnam County Description 8 2.2.3 Rockland County Description 8 2.2.4 Westchester County Description 9 2.3 Location and Description of Millstone Nuclear Power Station 10 2.4 Description and Demographics of County Surrounding Millstone 13 2.4.1 Suffolk County, Description 13 2.5 The Emergency Management System 14 2.5.1 Planning, Training, Exercising: The Process for Developing and Maintaining an Effective Emergency Management System 15 CHAPTER 3 DESCRIPTION OF THE HAZARD 18 3.1 Nature and Likelihood of a Release 18 3.2 Plume Behavior 21 3.3 Effects on Health 23 3.4 Guidelines on Absorbed Doses and Protective Actions .24 3.5 Off-site Accident Impact Analysis Review 28 3.5.1 Review of Off-site Accident Impact Procedures, Indian Point 29 3.5.2 Review of Off-site Accident Impact Procedures, Millstone 35 3.5.3 Review of Off-site Accident Impact Procedures, State of New York 38 3.5.4 Findings from the Off-site Accident Impact Analysis Review 39 James Lee Witt Associates, 2003 Page-3~ Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone CHAPTER 4 REVIEW OF EMERGENCY PLANS: COMPLIANCE WITH REGULATIONS 43 4.1 Review of Indian Point Plans 46 4.1.1 Indian Point Energy Center Plan Review 46 4.1.2 New York State Plan Review 47 4.1.3 Putnam County Plan Review 47 4.1.4 Rockland County Plan Review 47 4.1.5 Orange County Plan Review 48 4.1.6 Westchester County Plan Review 48 4.2 Review of Millstone Plans 49 4.2.1 Millstone Plant Plan Review 49 4.2.2 State of Connecticut Plan Review 53 4.2.3 Fishers Island Plan Review 53 4.2.4 Plum Island Plan Review 57 4.2.5 Suffolk County Plan Review 58 4.3 Conclusions from Individual Plan Reviews 59 4.4 Performance Analysis of Radiological Emergency Plans 60 4.5 Related Planning and Preparedness Reviews 66 4.5.1 Medical Preparedness 67 4.5.2 Law Enforcement 70 4.5.3 Fire Services 73 4.5.4 United States Military Academy at West Point 74 4.5.5 Public Works 74 4.5.6 Transportation 74 4.5.7 Schools 75 CHAPTER 5 EMERGENCY PLANNING BASES AND SYSTEMS 77 5.1 Population Basis Review 78 5.1.1 Determining Accurate and Up-to-Date Population Data for Indian Point 78 5.1.2 Residential Population Outside the Indian Point Emergency Planning Zone 82 5.1.3 Transient Population in Area Surrounding Indian Point -82 James Lee Witt Associates, 2003 Page ii Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone 5.1.4 Special Facility Populations in the Area Surrounding Indian Point 84 5.1.5 Additional Observations Concerning Indian Point Emergency Planning Zone Population 84 5.1.6 Population Analysis for Millstone: New York Population In the 10-mile and 50-mile Emergency Planning Zone 86 5.2 Evacuation Time Estimate Review 90 5.2.1 Review of Available Indian Point Evacuation Time Estimates 91 5.2.2 Review and Analysis of Indian Point Evacuation Time Estimate Methodology 92 5.2.3 Mobilization Times and Shadow Evacuations around Indian Point 95 5.2.4 Observations Concerning Evacuation Time Estimates for Indian Point 97 5.2.5 Review of Available Evacuation Time Estimates for Millstone 98 5.3 Alert and Notification System Review 109 5.3.1 Review of Indian Point Alert and Notification System 109 5.3.2 Alert and Notification Review Findings for Indian Point 111 5.3.3 Review of Millstone Alert and Notification System 120 5.3.4 Alert and Notification Review Findings 121 5.4 Communications System Review 122 5.4.1 Components of Effective Emergency Communications Systems 124 5.4.2 Current Communications Technology Inventory 126 5.4.3 Analysis of Communications Technology Effectiveness and Related Recommendations 134 5.4.4 Evaluation of Millstone Radiological Emergency Preparedness Communications 141 CHAPTER 6 REVIEW OF INIAN POINT AND MILLSTONE TRAINING PROGRAMS 145 CHAPTER 7 REVIEW OF PUBLIC INFORMATION AND EDUCATION PROGRAMS 151 7.1 Review of Public Education 152 7.2 Review of Public Information-Indian Point 152 7.2.1 Printed Materials-Indian Point 153 7.2.2 Internet Resources-Indian Point 158 James Lee Witt Associates, 2003 Page iii Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone 7.3 Review of Public Information Materials-Millstone 161 7.3.1 Printed Materials-Millstone 161 7.3.2 Internet Resources-Millstone 164 CHAPTER 8 REVIEW OF PREVIOUS INSPECTION AND EXERCISE REPORTS 166 8.1 Analysis of Previous Indian Point and Millstone Inspection and Exercise Reports 167 8.1.1 Nuclear Regulatory Commission Inspection and Exercise Reports for Indian Point and Millstone 167 8.1.2 Self-Reported Performance Indicators for Emergency Preparedness 167 8.1.3 Analysis of Inspection and Exercise Reports and Performance Indicators 169 8.1.4 Review of Off-site Exercise Reports 172 CHAPTER 9 ARCHITECTURE FOR ANALYSING COORDINATED AND INTEGRATED RESPONSE 194 CHAPTER 10 EXERCISE ANALYSIS USING THE PUBLIC PROTECTION PERFORMANCE ARCHITECTURE (P3A) 203 CHAPTER 11 CONCLUSIONS AND RECOMMENDATIONS REGARDING PUBLIC SAFETY 211 11.1 Conclusions 211 11.1.1 Issues with Meeting Emergency Needs 212 11.2 Recommendations 227 11.2.1 Improve Planning for Nuclear Power Plant Emergencies 228 11.2.2 Expand the "Circle of Emergency Management" 233 11.2.3 Develop and Implement a Comprehensive Public Outreach Strategy 235 11.2.4 Develop and Vigorously Implement a Nuclear Emergency Response Force and Training Program 239 11.2.5 Implement a Performance Outcome-Based Exercise Program 239 11.2.6 Upgrade Communications Capability 241 11.2.7 Upgrade Level of Response Management Technology 242 11.2.8 Summary 245 11.3 Two Additional Points 246 11.4 Limitations and Omissions 247 James Lee Witt Associates, 2003 Page ivý3 3c1 Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone Contributors Appendix A: Appendix B: Appendix C: Appendix D: Appendix E: Appendix F: Appendix G: Appendix H: Appendix 1: Appendix J: Appendix K: Appendix L: Approach to the Statement of Work Detail on Off-site Accident Impact Analysis Review Individual Plan Review Compliance Matrices Detail on Population Basis Review KLD's Evacuation Network from Field Survey Details on Alert and Notification System Review FEMA Exercise Report Findings Nuclear Regulatory Commission Inspection Report Findings 2002 Indian Point Practice and Full-Scale Exercise Observations Advocacy Issues Results of the Comment Period Response to FEMA Report (estimated date of publication-week of March 10, 2003)251 A-1 B-1 C-1 D-1 E-1 F-1 G-1 H-1 I-1 J-1 K-1 L-1 James Lee Witt Associates, 2003 Page v-2)4-0 Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone EXECUTIVE

SUMMARY

On August 1, 2002, Governor George E. Pataki announced a comprehensive and independent review of emergency preparedness to be performed by James Lee Witt Associates (JLWA) for the area around the Indian Point Energy Center ("Indian Point"), and for that portion of New York in proximity to the Millstone nuclear plant ("Millstone") in Connecticut. James Lee Witt Associates subcontracted with Innovative Emergency Management ("IEM") for portions of the review. The review encompassed many related activities that were designed, when taken together, to determine whether the existing plans and capabilities of the jurisdictions involved are sufficient to ensure the safety of the people of New York in the event of an incident at one of these plants, and how those existing plans and capabilities might be improved. In addition to an outreach effort into the surrounding communities, the review included recent exercise results and public information efforts, current radiological emergency response plans, and the data underlying the response plans, such as population data, the methodology of evacuation time estimates, alert and notification system specifications, Off-site accident impact analysis methodologies, and communication capabilities. It should be noted that we were not asked to look at the safety of the plants themselves, the availability of alternate energy sources, the economic and environmental costs and benefits of the plants, or other factors relevant to an overall picture of the plants within their respective communities. Consequently, nowhere have we taken a position on the future status of the plants.During our review we were frequently asked whether we were under constraints. We were guided by our experience and were unconstrained in our recommendations. Major Findings Plans and Exercises 1. The plans are built on compliance with regulations, rather than a strategy that leads to structures and systems to protect from radiation exposure.2. The plans appear based on the premise that people will comply with official government directions rather than acting in accordance with what they perceive to be their best interests.

3. The plans do not consider the possible additional ramifications of a terrorist caused event.4. The plans do not consider the reality and impacts of spontaneous evacuation.

5. Response exercises designed to test the plans are of limited use in identifying inadequacies and improving subsequent responses.

These planning problems are more serious because of the large population concentrations near the Indian Point plant, and when the effectiveness of the plan requires a degree of public and responder confidence that is largely absent. Thus the consequences of the five general fmdion James Lee Witt Associates, 2003 PageA Review of Emergency Preparedness of Areas Adjacent to Indian Point and Millstone above are more serious for the communities around Indian Point than for New York jurisdictions closest to Millstone. Regulations The Nuclear Regulatory Commission ("NRC") has stated as recently as Noveniber 18, 2002, that a preliminary assessment of the capabilities of, and compliance by, the State and its jurisdictions by the Federal Emergency Management Agency ("FEMA"), based on the September 24, 2002 exercise, indicates the Off-site emergency plans are adequate to protect public health and safety.While under the current regulations that may be technically true, we are concerned that when plans and exercises, which omit such things as a realistic consideration of spontaneous evacuation and the unique consequences of a terrorist attack, still meet NRC and FEMA regulations, then those regulations need to be revised and updated on a national basis. We believe any plant adjacent to high population areas should have different requirements than plants otherwise situated, because protective actions are more difficult and the consequences of failure or delay are higher. The standard, to minimize the radiological dose to the public, would remain the same; its accomplishment necessitates higher requirements in some communities than others.Some may look at our findings, conclusions, and recommendations and read them, incorrectly, as an indictment of FEMA or the State and its jurisdictions, and their staff and leadership. FEMA has recognized the need to change in the direction of a more performance-based approach in its exercise program. Although the change does not go far enough, it began with a multi-year strategic review of the Radiological Emergency Preparedness Program, and resulted in a new exercise methodology developed prior to 9/11 and published in the Federal Register on September 12, 2001. This beginning of a change in exercise theory to focus on performance outcomes was not found in the planning and exercising practices of the State of New York and its jurisdictions however. We hope our recommendations will accelerate both regulatory and cultural changes.Also, while we do have many recommendations for further change that impact on the systems and practices of FEMA and others, we recognize that these systems and practices were developed in a different environment. Simply stated, the world has recently changed. What was once considered sufficient may now be in need of further revision. We hope that those at all levels of government with emergency management responsibilities will consider our suggestions in a manner that is consistent with their high standards and professional experience. James Lee Witt Associates, 2003 Page vii EXHIBIT PP 6f-Wtj 91T 34 Nuclear Security Act testimony below regarding nuclear plant security. Testimony was given by the Project on Government Oversight. web address: http:-//jW_ pogo.org Mr. Chairman and Members of the Committee, POGO first began investigating security at nuclear facilities over sixteen months ago. We are an investigative organization that works with insiders in order to improve public policy. We have neither a pro- nor an anti-nuclear agenda. We began investigating the Department of Energy's (DOE) nuclear weapons facilities because more than a dozen insiders -current and former DOE and contractor security officials, contractors with military experience who test and evaluate the security at these facilities, and members of various guard forces -came to us with grave concerns regarding inadequate security pre-September 11.LJust prior to September 11, we completed our report U.S. Nuclear Weapons Complex: Security at Risk, concluding that our nation's ten nuclear weapons facilities, which house nearly one thousand tons of weapons-grade plutonium and highly-enriched uranium, .regularly fail to protect this material from mock terrorist attacks.Once security became a national priority, we briefed these alarming findings with the National Security Council, the Office of Homeland Security, the Pentagon Nuclear Command and Control staff, the staff of the Scowcroft End-to-End Review, the Office of Management and Budget, numerous Congressional Committees and Members, and at Rep. Chris Shays' request, the General Accounting Office..Because of this work, guards from commercial nuclear power plants across the country began contacting POGO with similar concerns about inadequate security at the plants where they work. In April, POGO accompanied a group of nuclear power plant security guards to brief a dozen Congressional offices and Committee staff about O threir first hand concerns. We then began working with current and former Nuclear Regulatory Commission (NRC)security officials and contractors with military capabilities who test and evaluate security at commercial reactors.These people echo the same concerns about ongoing inadequate security at commercial nuclear power plants..My testimony is based on the information and documents gathered from these insiders. Again, I believe it is important to emphasize that our sources of information are not "anti-nuclear." In fact, most of them have worked in the nuclear energy field for most of their adult lives. We applaud the sponsors of Senate Bills 1586 and 1746, the "Nuclear Security Act," for several important provisions contained in these bills.The Design Basis Threat Nuclear facilities are required to protect against a specified level of threat (known as the Design Basis Threat or DBT) from outside attackers and inside conspirators using a specific set of weapons. NRC's current DBT is wholly inadequate and must be made more realistic. According to published sources including U.S. News and World Report, the NRC's DBT requires protection against only three outside attackers with the help of one passive insider. This is absurd given the 19 terrorists involved in the highly coordinated, technolog ically advanced September 11 attack..Rumors are that DOE will increase its DBT to approximately ten outside attackers and significantly upgrade the weaponry and tools that adversaries can be expected to use in an attack. However, although some in NRC have also recommended an increase to its DBT, there seems to be resistance within the senior ranks of the NRC to committing to making these improvements. There appears tobe no justification for the NRC to have a less robust DBT for nuclear power plants than DOE has for nuclear weapons facilities. A successful.attack on either a nuclear power plant or weapons facility would cause unfathomable damage to surrounding populations. We believe that the provisions in the "Nuclear Security Act" for a new and significantly upgraded DBT are absolutely essential..In addition to the inadequate number of attackers to be protected against, the current DBT does not require protection against some of the most dangerous weapons that are available on the open market today, such as 50 0 liber API sniper rounds that can penetrate hardened guard posts and vehicles, nor do they use simulated emical or biological agents that would require the guard force to be trained with gas masks. Furthermore, performance tests do not employ diversionary tactics that are likely to be used during an attack, such as remote controlled explosives. POGO agrees with the Nuclear Security Act's provisions that the new DBT include 10/8/03 'I "& .Q1j -t enhanced requirements for more realistic weapons, explosives, tools, and tactics, as well as more outside attackers and active inside collaborators. D Poor Performance Though the DBT is severely inadequate compared to what we now recognize as the threat, half the nuclear power plants cannot even protect against this current standard of three outside attackers. David Orrik, the head of the Operational Safeguards Response Evaluation (OSRE) program, testified before the House Commerce Committee on April 11, that in 46 percent of the force-on-force security tests: "the expert NRC team identified a significant weakness -significant being defined as the adversary team simulating sabotaging a target set, which would lead to core damage and in many cases, to a probable radioactive release. It is important to note that, even with adequate time for the plants to prepare and make themselves ready for the OSRE, that 46% still had a weakness in armed response.".Let me caution the Committee -these tests are seriously dumbed down to favor the guard forces. The utilities are informed of an upcoming test six to ten months in advance giving them plenty of time to prepare, the guards are usually aware of the attack scenarios, the mock terrorists are allowed to be made up of the utilities' own management staff, and the weapons used in the tests are not nearly as dangerous as those that can easily be found on the open market..Despite their clear artificiality and imperfections that favor the guard forces, force-on-force performance tests are still the best test of the performance of a guard force in protecting key targets at a nuclear facility. This is the key issue that cannot be forgotten -can the guard force protect the integrity of the reactor and the spent fuel pools from a suicidal terrorist attack? The statistics say no. How much worse would those statistics be if the DBT accurately represented the very real and sophisticated threat we know we are now facing?.The mindset of both the utilities and the NRC is far too compliance-oriented -rather than performance tested.Our security guards are regularly told that security upgrades are unnecessary because the utility is already in"compliance" with NRC regulations. In other words, if a checklist of requirements for detection, delay, and D response is met -to include such items as a double-fence, alarms, a certain number of guards -the facility is deemed secure. However, performance tests repeatedly reveal that despite this "compliance" with requirements, physical security and the guard forces cannot stop terrorists from causing catastrophic damage to the reactor.This institutionalized bureaucratic complacency may be the biggest impediment to adequate security.A post-September 11 example of this phenomenon is that armed guards are now required to accompany all visiting trucks coming onto the site. We are told, there is often no extra guard available, and therefore, a guard is required to leave his post uncovered to accompany the truck. In these cases, the facility may be in compliance with this new requirement, yet guards are concerned that there is a hole in their defensive posture.Spent Fuel Pools are Security"s Poor Stepchild The NRC has never tested a power plant guard force"s ability to protect spent fuel pools -possibly the prime target of a terrorist attack. In October of 2000 the NRC started to recognize the problem of spent fuel fires in a study of the effects of accidents. However, in 100 pages of analysis, they never considered sabotage by terrorists. The NRC needs to create a targetlassets list prioritized by importance. EZ=Several spent fuel pools at nuclear power plants across the country are only 50 yards from the double fence line. In a terrorist attack, the initial strike would likely be extraordinarily violent, fast, and with a significant level of human carnage. According to Sandia National Lab's "Barrier Technology Handbook," it is estimated that a terrorist could penetrate the fence line and breach a door or side of a secured building in less than 60 seconds.We encourage the NRC to immediately recognize spent fuel, pools as a primary terrorist target.E=_Ne have been advised by military Special Forces sources of specific and obvious vulnerabilities at most nuclear power plants that I would be happy to discuss with Senators or staff. I am uncomfortable, however, outlining them in public testimony. .1To explain in general terms, a certain type of explosive, which a terrorist could carry on his back, would allow him to blow a sizeable hole in the reinforced concrete bottom or wall of the spent fuel pool. At nuclear plants that have boiling water reactors (BWR) -about one-third of the existing?reactors are BWRs -things could be even worse. These reactors have the spent fuel pools above ground. In these cases, a certain kind of explosive could vyen be launched from outside the fence lineinto the side of the pool. According to an unclassified study by Brookhaven National Lab, under certain conditions, the pool would start draining immediately, which could result in the immediate release of high-levels of radiation, quickly turning into an uncontrolled radioactive fire, and the 10/8/03 Page 3 of 4 plant could do nothing effective about it.ZI he Nuclear Security Act does require a plan to increase security of these spent fuel pools. In the meantime, e we would encourage the addition of barriers and delay mechanisms to supplement security until the spent fuel is placed in dry casks underground. Inadequate Training and Weaponry Guards from several of the power plants have registered complaints with POGO about inadequate training as well. For example, one facility hired a new class of guards after September

11. The vast majority of the new recruits had never fired a gun before. During their training, they were limited to firing 96 rounds with their handgun, and far fewer with their shotguns.

Two guards quit after two months on the job believing they couldn't protect the plant in the case of a terrorist attack. They told POGO, and other guards have admitted to NRC inspectors, that their training is so inadequate, in the face of a real terrorist attack, many guards would use their guns simply to protect themselves while they escaped from the plant. Other guards with decades of experience protecting nuclear power plants bemoaned the lack of training outside the classroom, as well as the lack of modern tactical training. For example, their firearms training requires only that they be capable of standing and hitting a stationary target 25 yards away -they have no training shooting on the run at a moving target.Eýl dditionally, the guard forces at nuclear power plants are severely out-gunned. Even the NRC's DBT assumes that attackers will be armed with automatic weapons and explosives, yet many guard forces around the country are equipped only with shotguns and revolvers. We understand that the NRC is working with the Committee on legislative language to address this discrepancy. Security Tests: More Often and More Robust NRC's virtually defunct Operational Safeguards Response Evaluation (OSRE) program conducts force-on-force tests using mock attackers only once every eight years at each plant. According to the nuclear power plant security guards and NRC inspectors we have interviewed, this eight-year hiatus creates a woeful lack of focus on security between tests. According to the guards with whom we have been working, because the tests are announced so far in advance, the utility management has time to quickly invest in security training consultants to improve their posture and chances of success. The guards advise us that after OSRE force-on-force tests, th security posture regularly returns to a bare minimum.F----POGO agrees with the Nuclear Security Act's provision to require that such tests occur no less than every two years to ensure that heightened standards remain in effect. POGO additionally recommends that the utility only be given 24- to 36-hour notice and that the utility be required to freeze in place the guard force to be tested at the moment of notification, rather than being allowed to call in the youngest or most capable guards.EZ=3Currently, the mock terrorists and the attack scenarios to be tested are chosen by the utilities. The mock terrorists can be county or state police, the utility's own training staff, or even their own utility management staff-the very people who have a stake in ensuring success. With all due respect to these people, and as genuine as they may be in trying to test the physical security of the facility, none of them are trained to have the mindset or skills of highly trained terrorists. POGO recommends the use of military Special Forces units that are already trained to act as the adversarial team in force-on-force tests.E=Z=According to the guards, they know within an hour or two when a test will take place and what part of the plant the mock terrorists will attack. They tell us that contrary to the full-page ads in the Washington Post and other newspapers, they do not normally wear flack jackets or their communications gear, nor do they carry their semi-automatic weapons. Sometimes, the guards are more than a football field's distance away from their weapons and flack jackets. However, when the mock attack is about to take place, the guards are magically wearing their flack jackets and communications gear and have their weapons in hand. Even more troubling is the fact that, at one-third of nuclear power plants, the guards only have access to shotguns, and they are locked up at a central location. In case of a real attack, the guards would have to go to that location, unlock the cabinet, get their shotguns and protective gear, and return to their post. By that time, the terrorists would have achieved their goals and caused catastrophic damage. Ongoing, limited-scope performance tests should regularly be testing the timelines for terrorist access to critical components. !E7Jf the facility fails a performance test, the Nuclear Security Act requires re-testing every six months until it passes. We would recommend, immediately calling in a well-armed and trained National Guard unit as ,de compensatory action to supplement security until the facility passes a new OSRE test.=* hWe have learned from anti-terrorism experts that the worst enemy of any guard force is the daily grind of nothing happening. Guards are only human. A simple way to combat this problem is to add unannounced checks by the NRC to security testing. Fast food chains and the Postal Service frequently use a "mystery shopper" to use a false ID or exploit some other weakness. Because the guards know a "mystery shopper" may be in their midst 10/8/03 rdv+ La -t at any time, they remain more alert. This would be a very low cost tool that would significantly supplement security.e Federalization We recognize that federalizing the security force is a contentious issue. POGO believes that the same goals can be accomplished through far more vigorous federal oversight, along with upgraded training, compensation, and authority granted to security forces.EZ=Currently, security guards who are risking their lives are among the lowest compensated employees at many plants. Pay scales and first responder benefits for security forces, including life and disability insurance, should be commensurate with those accorded to local police and fire departments. We cannot expect our security guards to give their all when we do not fairly provide for them in the event that they are injured while performing this dangerous and important job. Also, people working at nuclear power plants, including NRC and utility employees as well as contractor and subcontractor employees, should be given whistleblower protections. In the current climate of fear and whistleblower retaliation, it has been our experience that people have been deterred from coming forward with important information that could help fix security problems. The Paul Revere Act, introduced in the House, and soon to be introduced in the Senate, would strengthen whistleblower rights and extend them to federal contractor employees. [=iWe applaud the introduction of Senate Bill 1586 that recognizes that security forces do not have enough authority to carry out their mission. Currently, guards are prohibited from using deadly force unless an intruder wields a gun, or they feel their life or the life of someone else is in danger, in accordance with state law. In other words, if an attacker jumps over the fence with a backpack and runs towards the reactor building or spent fuel pool, the guard can only attempt to chase down the attacker. We have been told of an instance when an NRC inspector observed a guard follow a mock terrorist during a force-on-force drill as he destroyed critical target sets in the reactor complex. When asked why he wasn't doing anything to stop him, the guard explained that he didn't have the authority to shoot an intruder who was only destroying property. The NRC has been trying to resolve this conflict for years. This legislation must remedy this obvious failure.,rILocal law enforcement and first responders should also be given clearance to receive safeguard information so they can better coordinate emergency response plans. Currently, local law enforcement and first responders, in many cases, do not have adequate familiarity with the layout of critical areas of the plant that is necessary to respond to an emergency. --i If there is any expanded role for the federal government, it should be providing independent oversight, rather than management of security. Robust and credible federal oversight is absolutely key to adequate security at both the nuclear power plants and nuclear weapons facilities. POGO has already recommended taking the security oversight function out of DOE, and we strongly recommend the same for NRC. NRC has historically been altogether too compliant with industry's wishes. For example, recently agreeing to industry's demands to replace OSRE with industry self-assessments of security was totally irresponsible. History has shown that the critical job of security oversight cannot be adequately performed from within these agencies. Therefore we suggest that a small independent Office of Nuclear Security be created, perhaps housed in the Office of Homeland Security, or perhaps as an independent agency reporting to the Congress and President. Its purpose would be to provide oversight over and test the security of both government and commercial nuclear facilities. 7__We would be happy to assist you and your staff as you work to refine these pieces of legislation, as well as making some of our inside sources available to you so that you can learn from their first-hand experiences. 10/8/03 "3S_0 EXHIBIT RR EXHIBIT QQ LLvitan Report Executive Summary http://www.ipsecinfo.org/Levitan-executive-summary.htm Executive Summary.Introduction In June 2004, Levitan & Associates, Inc. (LAI), a Boston-based management consulting firm specializing in the energy industry, was retained by the County of Westchester (Westchester or the County) and the County of Westchester Public Utility Service Agency (COWPUSA) to evaluate economic, technical, and certain legal issues surrounding the operation and retirement of the Indian Point Energy Center (IP). Since 9/11, IP has been a lightning rod for safety and security concerns. In response to these concerns, the County has expressed an interest in assessing the feasibility of alternative options to facilitate IP's retirement. In conducting this analysis, LAI has been assisted by WPI, a nuclear advisory firm specializing in plant decommissioning, safety, and spent nuclear fuel (SNF) advisory services.LAI has identified and evaluated two options for the County to facilitate IP's retirement: acquire the plant by condemnation or reach a consensual agreement to voluntarily retire the plant with IP's owner, Entergy Corporation (Entergy). LAI assessed IP's current and expected performance, estimated the economic impacts of retirement, identified the likely sources of replacement generation and impact on customer rates, calculated the compensation due Entergy, and described the requisite decommissioning and SNF activities. LAI's scope of work did not include the breadth of safety and homeland security issues associated with ongoing operation of IP, or the potential for alternative energy technologies to replace it.S Background When the New York power market was deregulated in the late 1990s, utilities divested their power plant assets. Some power plants have power purchase agreements (PPAs) with utilities and other load-serving entities that establish power quantities and prices. The majority of power plants in New York State are merchant plants that do not hold PPAs and compete to sell their output at market prices administered by the New York Independent System Operator (NYISO). Since wholesale power markets became competitive, Entergy has acquired various nuclear power plants in New York and New England, including IP.There are three nuclear units at the IP site. Indian Point I (IPI) and Indian Point 2 (IP2) were sold by Consolidated Edison Company of New York, Inc. (Con Edison) to Entergy in September 2001. IP I was deactivated in 1974, and will be decommissioned at a later date in conjunction with the decommissioning of IP2 and Indian Point 3 (I1P3). Entergy purchased IP3 along with the FitzPatrick station from the New York Power Authority (NYPA) in November 2000. The nominal generation capacity of each IP unit is about 1,000 megawatts (MW). IP therefore represents about 5% of the total installed generation capacity throughout New York State. In terms of energy output, IP2&3 collectively account for about 10% of New York's electricity requirements. I P2&3's Nuclear Regulatory Commission (NRC) operating licenses are scheduled to expire in 2013 and 2015, respectively. In accord with industry trends, Entergy could apply for license extensions for up to an additional twenty years, mh, provided certain operating, environmental, and safety conditions are met.I of 16 12/11/07 11:49 AM Levitan Report hxecutive Summary http://www.ipsecinfo.org/Levitan_executive-summary.htm Entergy is a Louisiana-based integrated energy holding company with both utility and non-utility business segments. Entergy owns and operates five utility-owned and five non-utility nuclear power plants; the non-utility plants are located in New York and New England. Since Entergy acquired IP from Con Edison and NYPA, the units have operated at relatively high capacity factors. After Entergy completed the acquisitions, skyrocketing natural gas and oil prices have materially increased the market value of IP's output. Average market energy prices in Westchester increased 26% from 2001 to 2004.Moreover, the outlook on premium fossil fuel prices, coupled with regulatory changes in New York promulgated by NYISO, portend continued pressure on market energy and, capacity prices for the foreseeable future.Thus the value of IP has improved since Entergy's acquisition. Against this backdrop, the County and COWPUSA have a limited number of strategic options to shut down IP.Findings* There are two principal options to retire IP early -acquisition through condemnation or a consensual agreement with Entergy for a voluntary shutdown. Either option will require compensating Entergy for lost profits net of avoided costs and capital expenditures (CapEx).Condemnation would also involve the assumption of decommissioning and SNF responsibilities, as well as financial risks. Entergy would retain those responsibilities and risks under a consensual agreement." A condemnation process is likely to take several years, depending on how quickly the condemnation was sought and whether Entergy contests the original compensation offer. If the condemnation was successful, Entergy would be entitled to just and reasonable compensation. For example, if the process started now and was completed by January 1, 2008, we estimate that Entergy would have to be paid $1.4 -$1.8 billion in compensation for lost profits through the current license terms, plus $0.3 -$1.0 billion for the twenty year license extension period. While the decommissioning funds should be sufficient to cover decommissioning activities, the condemnor would become responsible for SNF costs that we estimate at approximately $241 million over the following six years.* Under a consensual agreement in which Entergy would voluntarily retire IP, Entergy would retain the responsibilities and risks of nuclear plant ownership. Entergy may be receptive, given the high cost (estimated at $1 billion), uncertain financial return, and likely political quagmire associated with operating beyond the current NRC license terms. Assuming a January 1, 2010 agreement /payment date and a 2013/15 retirement date, i.e. at the end of the existing license terms, we estimate the value of Entergy's lost profits to be $0.5 -$1.4 billion for the twenty year license extension period. These values do not account for any risk that the NRC could deny Entergy's request for license extension, which would lower our compensation estimates. LAI estimated the ranges of compensation values under each option by forecasting IP revenues, expenses, and cash flow, then applying high and low discount rates that reflect the risks of a merchant nuclear plant. The wide range in compensation values is due to the high and low discount rates as well as the effect of compounding over time. Any change in the payment dates 2 of 16 12/I 1/07 11:43 AM Levitan Report ExCCL[tiVe SUrninary Levian RportF~xculiv Sumary tip://%vwv.i pseci nl'o.org,/Lcvilani execLltivc ..sumniary.htm assumed in the retirement options identified above would change our compensation estimates." Condemnation of IP by the County is legally difficult and financially risky. On the other hand, a consensual agreement should be achievable and could involve other stakeholders such as the State of New York, NYPA, New York City, and other utility and government stakeholders. The challenge for a consensual agreement would be to convince Entergy to retire IP voluntarily and, ideally, develop replacement generation on the IP site." Retirement of IP presents economic and rate impacts beyond compensation costs. These impacts will inevitably occur whenever IP ceases operation, so the question is not whether there will be impacts from IP retirement; the question is when these impacts will occur. Many of these impacts could be avoided or mitigated by development of on-site replacement generation. Local impacts would include loss of payments in lieu of tax (PILOT), the bulk of which go to the Hendrick Hudson School District. Local employment and spending benefits would disappear about ten years after retirement, once the site is decommissioned and SNF is in dry storage. Local community support activities would cease, and power plant emissions would increase." The largest quantifiable positive impact of retiring IP would be the improved health of the Hudson River fisheries, which would benefit residents beyond the local communities. These fisheries would also benefit if IP is converted to closed-cycle cooling, although Hudson River water may still be required for emergency cooling. While retiring IP would result in public safety and security benefits, we have not tried to quantify those benefits. A minor benefit of retiring IP would be that the County could avoid emergency service costs." The greatest negative impact of retiring IP before its license expires in 2013/15 would be a rise in market energy prices, even with the timely addition of replacement generation. We estimate that a minimum of three-to-four years is required, from the time IP's retirement is announced to develop and construct new power plants. Retirement through a consensual agreement with Entergy, or if Entergy was unable to extend the NRC licenses, should provide sufficient lead time to develop replacement generation on the IP site or elsewhere in the downstate region. In practice, lenders and investors are unlikely to rely on uncertain market prices to justify new merchant projects.Therefore downstate utilities might decide to offer PPAs to assure their customers of sufficient resources. It is not known how the New York Public Service Commission (NYPSC) would react to a new PPA commitment. If necessary, the NYISO or NYPA could make short-term arrangements to assure bulk power security." Since Entergy has not yet filed an application with the NRC to renew IP's licenses, our working assumption has been that IP will be retired at the end of the existing license terms. Therefore a voluntary retirement on the same dates would impose virtually identical economic and electric rate impacts on County and New York residents -retirement in 2013/15 would not impose any additional economic or rate impacts.Extending the NRC licenses will likely cost Entergy over $1 billion, principally to convert from a once-through cooling system using the Hudson River to a closed-cycle system using cooling towers. Constructing the towers will require a local zoning variance, each IP unit would have to 3 of' 16 12/11/07 11:43 AM Levitan Report Executive Summary http://wvww.ipsecinfo.org/Levitan executivesummary.htm be shut down for roughly nine months for the conversion, and future plant performance would suffer. In spite of these hurdles, the economics of license extension appear favorable from Entergy's perspective, unless gas prices decline materially (thus lowering the value of IP output)or conversion costs are higher than expected. However, the significant costs and risks provide the County, State, NYPA, and other interested stakeholders a window of negotiating opportunity through about 2010, after which cooling tower construction would probably need to commence.We believe that the cooling towers would require considerable space on the IP site and preclude any chance for on-site replacement generation. Converting the IP units to gas-fired generation is not feasible. However, the existing site is well-suited for new replacement gas-fired generation, particularly with the existing high-voltage transmission infrastructure and the Algonquin Gas Transmission (Algonquin) interstate natural gas pipeline adjacent to the site, provided that cooling towers for the nuclear units are not installed. It is not the County's legal responsibility to replace the generation capacity to maintain adequate reserve margins if IP were to retire. Nevertheless, on-site replacement generation has the potential to avoid or mitigate the costs and impacts of a voluntary retirement.

• The development of on-site replacement generation could be facilitated through a variety of mechanisms.

For example, surplus property on the site could be leased to a generation developer if Entergy itself did not want to develop a replacement plant. Alternatively, the market risks of on-site replacement generation could be avoided through a PPA with a credit-worthy purchaser such as NYPA or others who can re-sell the power to retail customers. While COWPUSA has the authority to enter into a long-term PPA and provide retail service to Westchester residents, it does not have a large customer base and may not be able to effectively compete with Con Edison.A third mechanism, providing tax-exempt financing for an on-site replacement plant, may not be possible under current federal tax provisions, although Congress could adopt legislation that would make such an option possible.* SNF will be stored in specially-designed dry casks on-site starting next year. It is anticipated that the SNF will eventually be shipped to Yucca Mountain, the nation's planned SNF repository in Nevada. Entergy will have to bear the on-site SNF storage costs until then, and remove any non-radioactive materials. We estimate that it will take ten years after retirement until all SNF and radioactive materials could be removed, provided Yucca Mountain is opened in 2010 as planned.This date may slip due to recent licensing delays, which will require additional quantities of SNF to be stored on-site over a longer period of time." Other radioactive materials will be stored on-site until a disposal site is licensed. The IP decommissioning funds should be adequate to cover decommissioning costs, assuming that the three IP units will be decommissioned in an integrated program.Recommendation Acquiring IP through condemnation is not recommended because it would require assuming nuclear decommissioning and SNF management responsibilities, and is fraught with financial costs and risks that have the potential to impose material economic hardships. A consensual agreement is the better 4 of 16 12/11/07 11:43 AM Lcvitan Report Executive Summary h'iil://wwvw.ipseciiil'o.org/Levi tan __executive summary.htm option, in which the County, together with other stakeholders such as the State, NYPA, and New York City, can muster political pressure to discourage re-licensing and can negotiate and fund a financial* compensation and replacement generation package. The high CapEx associated with license extension, coupled with the potential uncertainties surrounding the NRC approval and local zoning process, offers a window of opportunity to negotiate a retirement date, perhaps at the end of the current NRC license terms. Reaching a consensual agreement no later than year-end 2010, with the support of the State and its Congressional delegation, would allow sufficient time for replacement generation to be developed, including on the IP site, by 2013/15. Other strategies to induce Entergy to retire IP early through State or federal action appear unprecedented, but are possible with State and Congressional support.A consensual agreement to voluntarily retire IP would provide sufficient time to structure the best possible solution for Westchester residents. We recommend that a consensual agreement include on-site replacement generation to avoid or mitigate the costs and impacts of IP retirement. An on-site gas-fired combined cycle replacement plant, for example, would provide benefits to Entergy and the State as well.Entergy would have an attractive investment opportunity in New York, and State residents (outside of Westchester) would enjoy the bulk of the benefits from improving the health of the Hudson River fisheries. The State should participate in a consensual agreement and be part of the IP solution.Acquisition by Condemnation The ability to acquire IP through a condemnation proceeding is based on principles of eminent domain.Our evaluation of applicable regulations indicates that this option is feasible but risky. In brief, the condemnor would have to conduct a public hearing, make a public determination to condemn and acquire the plant, offer a price based on a property appraisal, and then file a petition that is accepted by the Westchester Supreme Court. This option has some significant drawbacks and entails difficult ownership responsibilities: If IP were immediately deactivated upon acquisition, the condemnor would have to obtain management expertise that satisfies stringent NRC standards to decommission the units and handle radioactive materials. SNF would remain on the site at least a decade, obligating the condemnor to provide appropriate security measures. The availability and cost of obtaining this nuclear expertise are highly uncertain. The existing decommissioning funds, designed to cover the costs to decommission the radioactive materials, should be adequate. However, there is no guarantee, and any shortfall would impose Significant decommissioning costs on the condemnor. The funds do not cover the cost to store the SNF, or to remove non-radioactive materials. Under New York law, Entergy would be entitled to just and reasonable compensation for the condemnation of IP. The compensation amount would be set by a court-ordered appraisal and reflect then-prevailing market, operating, and regulatory conditions, and therefore could be higher than our estimate.The County or New York State could be the condemning authority, thereby assuming all attendant responsibilities and risks. Since retiring IP benefits State residents beyond Westchester 5 of' 16 12/I 1/07 11:43 AM Levitaii Report Executive Suimmary http://wvww.i pseci iil'o.org/Levitan cxecutive_summary.htm County, it may make sense for NYPA to be responsible for decommissioning and SNF activities.

• Present Value Summary -Acquisition in 2008 versus Retirement in 2013/15 (2008 $ millions; excludes indirect impacts; assumes no replacement generation)

Costs Shared by Stakeholders Entergy Compensation Original License Term $1,465 -$1,831 Renewal Option $ 289 -$ 913 Sub-Total $1,754 -$2,744 Spent Nuclear Fuel $ 241 Total $1,995 -$2,985 Rate / Economic Impacts County New York State Electric Market Impact $ 216 $ 1,742 O Economic Impacts (benefits in parenthesis) Property Taxes $ 143 $ 143 Employment $ 123 $ 820 Local Spending $ 89 $ 341 Community Support $ 6 $ 6 County Emergency Planning ($ 35) ($ 35)Corporate Income Tax $ 8 $ 167 Hludson River Fisheries ($ 220) ($ 2,198)Air Emissions $ 2 $ 41 Sub-Total $116 ($ 715)Total $ 332 $ 1,027 For purposes of this analysis, we have assumed that condemnation proceedings would commence Ah immediately, and IP would be acquired and shut down on January 1, 2008. Two types of costs arise 6 of 16 12/11/07 11:43 AM Levitan Report Executive Summary http://www.ipsecint'o.org/Levitaniexccutivcesummary.htm under the acquisition option: (i) compensation due Entergy and taking on tile SNF responsibilities, and (ii) electric rate and economic impacts. We estimate compensation due Entergy at $1.75 -$2.74 billion, plus the condemnor would become responsible for $241 millibn of SNF costs. We estimate the State-wide rate and economic impacts at $1.03 billion, of which the County would shoulder 21%. All of these costs and impacts are expressed in present value terms as of January 1, 2008, as itemized in the summary tables above, and are relative to our base case assumption of IP retirement in 2013/15 at the end of the existing license terms.The largest cost component is compensation due Entergy. LAI provided a low and high range of compensation values due to uncertainty about a key valuation assumption, the appropriate discount rate for Entergy's future revenues from IP2&3.The low end of the compensation range, $1.75 billion, is associated with a high discount rate of 20%, the high end of our estimate of Entergy's cost of funds (combined debt and equity) for a merchant nuclear power facility. The high end of the compensation range, $2.74 billion, is associated with a low discount rate of 14%, the low end of our estimate of Entergy's cost of funds. We assumed that Entergy would receive full credit for lost earnings over the license extension period. Any risk that the NRC would not approve license extension would lower the estimated value for the license extension period.Ideally, the County could participate jointly with the State, NYPA, New York City, and other stakeholders, in the acquisition and compensation arrangement." The condemnor would incur SNF costs, estimated at $241 million. The existing decommissioning funds should be adequate to cover all decommissioning costs." The present value of the electric market impact on the County is estimated at $216 million, and$1.74 billion for the entire State. Estimated rate impacts reflect our assumption that long-term utility PPAs provide a 50% hedge against higher market energy prices. Typical residential bills in Westchester would increase $1.55/month if IP retires before 2013/15, and by about $0.73/month in New York City.Total direct economic impacts (excluding electricity prices) are estimated to have a negative present value of $116 million for the County and a positive present value of $715 million for the entire State as follows:-Lost PILOT revenues from 2008 through 2015 would total $143 million for the County; the rest of the State would not be directly affected.-Significant manpower would be required at the site for decommissioning and SNF activities, so that reduced employment and local spending would not affect the County for five-to-ten years. The present value of lost wages would total $123 million in the County and $820 million in the entire State.-Reduced local spending on goods and services would total $89 million in the County and $341 million in the entire State.A, -Reduced local community support, e.g. monetary contributions and employee volunteer efforts, would 7 o1' 16 12/11/07 11:43 AM Levitim Report Executive Summary http://vwww.i psecinl'o.org/LcvitanlexCcutivCestLmmary.htm total $6 million in the County and would not afl'ect the rest of the State.* -Reduced County emergency planning expenses would save the County $35 million and would not affect the rest of the State.-Lost corporate income taxes would total $167 million in the State, and $8 million to the County, assuming a 5% allocation (consistent with County / State population ratio).-The health of Hudson River fisheries would improve and provide significant benefits estimated at $2.2 billion for the State. Lacking a good basis for assigning this benefit, we assumed that a nominal 10%would accrue to County residents. -Emissions of air pollutants from power plants across New York State would increase. We estimate the impact to be $41 million for the State, of which $2 million would be allocable to the County based simply on population. Voluntary Retirement Westchester, in conjunction with the State, NYPA, New York City, and other stakeholders could negotiate a consensual agreement for Entergy to retire IP. A voluntary retirement would avoid the costs and risks of an acquisition, keep in place Entergy's operation and management resources, and provide significant flexibility to arrange a compensation package and develop replacement generation on site: " A voluntary retirement could be agreed upon with an actual shutdown date at some date in the future to allow sufficient time for market participants to replace IP's capacity in an orderly fashion. In our view, the announced retirement of IP would encourage market participants to replace substantially all of the generation capacity in the downstate region, possibly supported by long-term PPAs offered by downstate utilities. A minimum of three-to-four years would be adequate to develop replacement generation to assure system reliability. While there are many power plant sites that could be developed, on-site replacement generation is preferred as it could avoid or mitigate the local economic impacts of retiring I P." Entergy would request substantial compensation in exchange for agreeing to retire IP and to not pursue license extension. However, retiring IP at the end of the current license terms would allow Entergy to avoid the costs and risks associated with the license extension process, including NRC approval and the requisite zoning variance. LAI's estimate of the CapEx for license extension is over $1 billion for cooling towers and other plant repairs / improvements. The NRC has not rejected any license extension applications to date, but approval of Entergy's application is not certain given IP's unique siting and cooling system challenges. If Entergy retires IP by 2013/15 and does not construct the cooling towers, there would be sufficient acreage for a gas-fired power plant. Three years ago, Entergy proposed the addition of an on-site gas-fired plant, but subsequently withdrew its application. COWPUSA has the authority to purchase power from an on-site replacement plant through a PPA, but currently sells power only for economic development purposes. Providing retail service would be a major step 8 of' 16 12/11/07 11:43 AM Levilan Report fi.xecufive Summary http://www.ipsecitil'o.org/Levitanexecutivesum mary.htm for COWPUSA and would impose associated administrative and operational costs. LAI considered a strategy for COWPUSA to buy power directly from the on-site generator to avoid transmission charges, but that strategy was not effective. In addition, the Monthly Adjustment Charge (MAC) component levied by Con Edison for Westchester residents will be equalized, removing a potential cost advantage for COWPUSA.Ignoring PSC directives to encourage retail choice and competition among generators, it would be preferable for a utility with a large retail customer base, such as NYPA or Con Edison, to enter into a long-term PPA for on-site replacement generation, perhaps in conjunction with COWPUSA. A PPA with credit-worthy counterparty such as NYPA or Con Edison would also assure project financeability.

• There would be no electric market and economic impacts because IP would be retired on the same date as in our base case assumption, 2013/15.Present Value Summary -Voluntary Retirement in 2013/15 (2011 $ millions; excludes indirect impacts; assumes no replacement generation)

Costs Shared by Stakeholders Entergy Compensation Original License Term n/a Renewal Option $ 495 -$1,376 Sub-Total $495 -$1,376 Spent Nuclear Fuel n/a Total $495 -$1,376 We have assumed that a consensual agreement with Entergy would be reached by January 1, 2011, to retire IP at the end of the existing license terms. In this case, the only cost that would be incurred is the compensation cost due Entergy. Entergy would remain responsible for SNF and decommissioning. In effect, Entergy's option to extend IP's licenses would be bought out. We estimate compensation due Entergy at $0.5 -$1.4 billion in present value terms as of January 1, 2011, the assumed payment date.As before, the compensation range is due to the uncertainty of the discount rate that would be developed in the negotiations. Entergy would continue to be responsible for SNF costs, and the rate and economic impacts would be no different than if IP were shut down on its "natural" retirement dates at the end of the existing license terms.As with the acquisition option, the compensation amounts that we estimated represent an upper limit, because we ascribed full value to the cash flows Entergy would earn during the twenty year license extension period. We effectively assumed that Entergy faces no risk of the NRC rejecting the application 9 of* 16 12/11/07 11:49 AM ILevitan Report ExecutivC Summary http://www.ipseci nfo.org/l.,evit an-cxecutive-summary.htm for license extension. While there is some uncertainty suriounding the relicensing effort, we have not tried to calculate either the likelihood of NRC rejection of Entergy's application for IP license extension P or the resulting change in the compensation value.State and Federal Action Any action by the state or federal government to require Entergy to retire IP prior to the expiration of the current operating licenses would be unprecedented. In such an event, the State or federal government would likely provide the compensation due Entergy. The State would be bound by similar eminent domain regulations as the County, but the regulatory basis and condemnation process for federal action was not part of LAI's scope of work. However, State and congressional support for County actions could greatly improve the chances of a successful negotiating outcome and reduce the County's compensation burden.Congressional action would likely be needed to obtain tax law changes that would make tax-exempt financing possible for replacement generation on the IP site.License Extension The NRC licenses for IP2&3 expire on September 28, 2013 and December 12, 2015, respectively. In light of the high value of energy and capacity in downstate New York and pressures on oil and gas producers throughout North America, we believe that the forward economics would support Entergy's decision to apply for a twenty year license extension. In order to receive NRC approval, Entergy will have to demonstrate that all of the systems, structures, and components that are critical to IP's safe operation can continue to function for the term of the license extension. IP's proximity to New York City and the efficacy of its Emergency Evacuation Plan would not be considered in a typical license extension process under existing NRC regulations. Given the strong public and political attitudes about IP, the NRC may not view an application from Entergy for license extension as typical.In order to continue operating beyond the term of the initial licenses, the New York Department of Environmental Conservation (DEC) has required Entergy to convert from the existing once-through cooling system that utilizes Hudson River water to a closed system with cooling towers. We estimate that the future cost of converting to cooling towers plus other repairs and improvements that would likely be undertaken will be $1 billion. Conversion would require that each unit be shut down for roughly nine months, plant output would be reduced by roughly 4% due to pumping requirements and other internal loads, and plant operation and maintenance costs would increase due to age-related problems. The closed-cycle cooling design will likely be scrutinized by the NRC in any application for license extension, and cooling towers will require a zoning variance from the Village of Buchanan.The NRC has approved extension requests for 30 nuclear plants at 17 sites to date, and has not denied any requests. However, Entergy does face some risk that IP's application for license extension will not be approved, particularly verifying that the plant design, including conversion to the closed cooling cycle, meets current safety standards. The effectiveness of opposition from New York State interveners before the NRC is unknown. If the NRC denied Entergy's application for license extension, the County AN& and other stakeholders would not have to fund compensation costs. However, we do not recommend 10 of 16 12/11/07 11:43 AM Lcvitan Report Becutivc Summary http://vwww.ipsecinfo.org/Levi tan_executivcsummary.htm relying on such a strategy.From an economic perspective, we calculate that license extension would be cost-effective in relation to the value of capacity and energy from the units over the anticipated twenty years of extended plant life.However, if the CapEx requirement is higher than our $1 billion estimate, if the NRC approval is for less than twenty years, or if power prices are lower than our forecast, Entergy may be less inclined to pursue license extension, and our compensation estimates would be lower.Replacement Generation We believe that announcing IP's retirement at least three-to-four years in advance will allow sufficient time to develop replacement generation. One scenario we examined contemplates the postulated immediate retirement of IP, an unrealistic assumption that would by definition preclude sufficient time for replacement generation, thereby threatening the reliability of the state's bulk power system. The immediate retirement of JP would cause energy and capacity prices to soar. To ensure resource adequacy, we would expect NYISO to implement a number of expensive short-term fixes to ensure grid security prior to the commercialization of new generation resources. If IP were to be retired, LAI believes that the resulting market price signals would be attractive for replacement generators. It may nevertheless be necessary for downstate utilities to backstop the development of replacement capacity through PPAs. While the current financial markets are wary of lending to projects that have merchant risk, projects with PPAs provide credit support that facilitate debt and equity financing. Whether those downstate utilities could be reasonably assured of recovering all PPA costs is outside the scope of this inquiry.We examined the range of possible replacement generation options and concluded that they would likely be gas-fired and located in the downstate region. This conclusion is consistent with possible replacement generation at the IP site and with proposed combined cycle plants in Orange and Rockland counties over the last few years. Generation additions in upstate New York would not be economic without expensive transmission upgrades. Assuming utility support through PPAs, the requisite generation capacity would likely be permitted and developed on a timely basis. Other infrastructure improvements, in particular, increasing gas pipeline deliverability, would also be required. Major electric transmission improvements would not be necessary in light of the existing transmission infrastructure from IP southward. Replacing IP's capacity may be facilitated, in part, by New York's Renewable Portfolio Standard that requires utilities to increase their purchases of renewable energy over the next decade. How much new capacity and energy could be derived from renewable technologies in the downstate New York region was outside our scope of work.It is not feasible to convert any of the existing IP units to gas-fired operation. However, the site is well-situated for new gas-fired combined cycle replacement generation so long as cooling towers are not installed, which would utilize valuable remaining space. Entergy proposed developing 330 MW of new gas-fired simple cycle generation at the IP site three years ago, but later withdrew the application. We I I of' 16 12/11/07 11:49 AM lecvitan Report Executive Summrrary hittp://www.i pseci nfo.org/Levitan executive summary.htm believe the remaining on-site acreage is sufficient for more than 330 MW of new generation. Algonquin traverses the site and IP's retirement would free tip electric transmission capacity. Although Algonquin is fully subscribed with virtually no surplus capacity throughout the winter season, planned pipeline projects and expansions should make the IP site attractive for new gas-fired generation. Expensive pipeline upgrades on Algonquin would be required to provide firm year-round deliveries. The quality of non-firm transportation during the winter is uncertain, particularly in light of complex market dynamics associated with new gas supplies entering the system..To the extent a new combined cycle plant received an air emissions permit that allowed burning distillate oil up to 30 days per year, non-firm service might still entail interruptions during the heating season.While it is not Westchester's legal responsibility to replace IP capacity, facilitating the development of replacement generation at the IP site is one way that the costs and economic impacts of IP's retirement could be avoided or mitigated. In this regard, COWPUSA may be able to support NYPA's efforts to execute a PPA and purchase power from the replacement plant. While both utilities have large customer bases, neither party would be obligated to do so. In fact, Con Edison has taken a number of steps to lessen its reliance on PPAs in response to state regulatory initiatives to promote competition. Alternatively, part of the IP site could be purchased and leased to a developer, which would maintain PILOT and local spending as well as provide construction opportunities. We do not recommend that COWPUSA consider plant ownership given the competitive market pressures and operational challenges. The National Academy of Sciences has recently been asked to conduct a study for the U.S.Department of Energy (DOE) to identify and evaluate conventional and alternative energy options to replace IP. For its part, the County may also want to pursue cost-effective conservation, load management, distributed generation, and renewable energy sources in Westchester. Valuation LAI estimated the value of IP using standard appraisal techniques. The preferred technique for an income-producing property, referred to as the Earnings Approach, requires forecasting revenues and expenses, and discounting the resulting cash flows back to a specified date using an appropriate discount rate. LAI forecasted IP revenues using a system dispatch simulation model that reflects the hourly power market operation under existing regulations and expected levels of plant performance. Expenses were forecasted based on a detailed economic study of IP prepared by the Nuclear Energy Institute (NEI), a nuclear industry policy organization, as well as on publicly available data. Other local economic impacts, including property taxes, employment, and local spending, were considered separately. The derivation of the appropriate discount rate applicable to IP's cash flows is challenging. In addition to market risk attributable to all merchant generation owners who merchandise output without the benefit of a compensatory PPA, nuclear plant owners face a broad spectrum of discernible risks, such as safety compliance, decommissioning, SNF, mishap repairs, latent technical defects, extended outages, and changes in government regulation. In order to bound the range of reasonable plant values applicable to IP, LAI estimated a high discount rate of 20% and a low of 14%. The higher discount rate provides a lower plant value / compensation payment, and vice versa. We did not include a risk premium for 12 of' 16 12/11/07 1 1:43 AM LevilLin Report Fxectifive SLIMrnary Levian Rport[xcutiv Sumaryhttp://wwvw.i pseci iio(.org/l..evi tan-executive-summary.htm possible NRC rejection on Entergy's application for life extension, which would depress plant values and compensation estimates. In our valuation estimates, we have assumed that once IP ceases operating,* the decommissioning funds can be utilized to recover all costs of removing and storing radioactive materials. Non-decommissioning costs, such as SNF management and disposal of non-radioactive structures, cannot be recovered from the funds and would have to be borne by the owner.LAI utilized a different discount rate to calculate the present value of rate and economic impacts.Evaluating these impacts from the County's point of view, we estimate that the County's financing cost is approximately 4.0% based on the cost of issuing tax-exempt debt.Tax-Exempt Financing If IP were acquired through condemnation or if Entergy agreed to a voluntary shutdown, we believe that compensation could be funded by issuing tax-exempt general obligation (GO) bonds. If the County were the acquiring entity, it would have to acquire an ownership interest, or else develop a business structure with the assistance of legal counsel that satisfies the State's municipal finance regulations without being exposing to nuclear plant ownership-type risks. However, acquisition by the County would be problematic as a large GO issuance would stretch the County's debt capacity and probably lower the County's AAA credit rating.A lower rating would increase the cost of debt to compensate Entergy as well as the cost of any future County debt issuances. For these reasons, it might be better to have the State or NYPA, which has the experience to manage the IP asset, issue the bonds. It may be possible for Entergy to remain responsible O for decommissioning and SNF management through an easement or sale and lease-back transaction, provided the NRC accepted this arrangement. We do not believe COWPUSA or the Westchester County Industrial Development Agency (WIDA)could have a role in funding Entergy's compensation. COWPUSA does not have statutory authority to either issue bonds or to own power generating facilities. WIDA issues Revenue bonds that must be supported by a pledge of revenues from the ultimate borrower.However, WIDA or another issuing authority might be able to facilitate on-site replacement generation by issuing tax-exempt debt if Congress supported changes to federal tax law.Decommissioning and Spent Fuel Management Decommissioning, i.e. the removal of all radioactive materials that are controlled under the NRC licenses, does not include SNF and non-radioactive material. The removal and long-term storage of SNF is the responsibility of the DOE. It is expected that SNF will be stored on-site and eventually shipped to Yucca Mountain starting no earlier than 2010, although that date is uncertain. Non-radioactive material, such as cooling towers, water inlet structures, and buildings, would be removed by Entergy or successor site owners using conventional methods. The IP site will be decommissioned by placing highly radioactive materials, including the reactor vessel and other structural materials, in special containers that will likely have to be stored on site for the foreseeable future. Currently, no licensed A disposal site exists for IP's highly radioactive materials, although Yucca Mountain may be able to accept 13 of' 16 12/11/07 11:43 AM Levitan Report Executive Summary http://vlww.ipsecinfto.org/Levitan-executive-summary.htm such waste if its license is amended.* After removal from the reactor vessels, SNF is stored in on-site storage pools for five years to allow the fuel to cool down. Since Yucca Mountain will not open until at least 2010 and IP is running out of storage pool space, Entergy has received approval for, and is constructing an Independent Spent Fuel Storage Installation (ISFSI) on-site. SNF that has cooled sufficiently will be removed from the storage pools, placed in dry storage casks, and stored at the ISFSI until they can be shipped to Yucca Mountain.Upon retirement, we estimate that it will take ten years to remove all of the SNF from the IP site.There are separate decommissioning funds for each of the three IP units. The IPI &2 funds and liabilities were transferred to Entergy. NYPA retained the fund and liability for IP3 but has the right to require Entergy to assume the liability provided that it is assigned the decommissioning fund. A report by the U.S. Government Accountability Office (GAO) indicates that IPI was under-funded, and funding for IP2&3 was adequate. However, it is reasonable to assume that Entergy will be able to conduct an integrated decommissioning effort for all three units that will reduce costs, in which case we believe that the combined decommissioning funds will be sufficient. Economic Impacts Retiring IP, without simultaneous development of on-site replacement generation, would result in the loss of PILOT, jobs, and local spending, higher emissions of certain air pollutants, and higher electricity bills. On the other hand, the County's emergency planning costs would decline and the health of the Hudson River fisheries would improve. These impacts will result whenever IP is retired, but could be Savoided or mitigated if replacement generation is developed at the site. Consistent with standard socio-economic analysis, we used economic multipliers to estimate the secondary, or indirect, economic impacts in Westchester and throughout the State.Entergy executed agreements that established a PILOT schedule of$18.8 million in 2005, escalating to $26.8 million by 2014. The Hendrick Hudson School District receives over 80% of these payments and would be most affected by the loss of PILOT, which accounts for one-third of its revenues. Remaining PILOT is shared among the town of Cortlandt, the Verplanck Fire District, and the County. A PILOT schedule for on-site replacement generation would have to be negotiated among Entergy and these parties. We believe thatthe ISFSI currently being installed on-site will not alter the existing PILOT schedule." If IP is retired PILOT would cease unless replacement generation is developed on-site. IP2&3 would be subject to much lower property taxes at then-current rates. While IP's retirement may increase property values for nearby homeowners, property tax rates may be higher to make up for lost PILOT.Entergy has announced plans to reduce IP personnel in the next two years, at which point the direct and indirect contribution to Westchester is expected to be $26 million/year. Whenever IP is retired overall staffing levels will be reduced gradually because decommissioning personnel will be required for approximately ten years. Once that work is completed and the SNF is removed for disposal, the site can be reused. Development of on-sitp replacement generation could provide 14 of' 16 12/11/07 11:43 AM ILcvitan Report Executive Summary 'http://wwww.ipsecinfo.org/Lcvitan-executive-summary.htm another source of employment. The number of jobs would actually increase while decommissioning, SNF storage, and construction activities for on-site replacement generation

• were taking place.IP spends approximately

$12 million/year on goods and services in Westchester, and $55 million on a state-wide basis. These payments will also gradually disappear as decommissioning and SNF work are completed, but development of on-site replacement generation could avoid or mitigate these impacts.We estimate, on an indicative basis, New York power plant emissions of nitrogen oxides (NOx)will increase by 4.0% and sulfur dioxide (S02) by 2.6% if IP is retired, as other plants, new and existing, will have to operate additional hours every year. According to statistics from the U.S.Environmental Protection Agency (EPA), power plants are responsible for approximately one-eighth of New York NOx emission and one-half of S02 emissions. Therefore the overall state-wide increase from retiring [P would be about 0.5% and 1.4%, respectively. Monetary contributions and IP employee volunteer efforts to the local community, which totaled$0.3 million in 2002 and $1.2 million in 2003, may continue at a lower level once IP retires, until decommissioning was completed and SNF was removed from the site. We estimated 2005 contributions of $0.8 million, escalating with inflation as long the plant continues to operate.However, if Entergy were to develop replacement generation on the IP site it may be expected to continue monetary and volunteer contributions to the local community.

• The County would have to continue providing emergency services as long as SNF remains on site. These services cost Westchester

$4.2 million in 2002, net of contributions from the State, and could be substantially reduced after IP is retired.* We estimate the value of fish mortality due to using Hudson River water for cooling to be $309 million based on mortality statistics developed by the DEC and standard industry fish values.Retiring IP would eliminate this impact significantly except for a small amount of cooling water that may be required for the SNF storage pools. Since residents throughout the State would benefit from improving the health of fish stocks in the Hudson River, we recommend that the State play a role in fostering a consensual agreement and in compensating Entergy.Electric Rate Impacts* There are three types of wholesale electricity products: energy that is metered and paid for based on usage, capacity to ensure sufficient energy supplies and paid for regardless of usage, and ancillary services products required to maintain a stable and efficient bulk power system. All customer bills include charges for these wholesale products as well as for local delivery. Energy is the largest component and comprises roughly one-third of a residential bill for a customer consuming 500 kilowatt-hours per month (kWh/month). Utilities purchase energy and capacity for their customers in two ways: from the market at prices that reflect daily and hourly conditions, and through long-term PPAs with generators. PPAs provide retail customers with some insulation from short-term changes in market prices.15 of 16 12/11/07 11:43 AM Levitan Report Executive Surnmary n http://vwww.ipseci nfo.org/Levitan_executivesummary.htm" IP has a low operating cost and is normally dispatched whenever it is available. If IP retired prior to 2013/15, market energy prices in Westchester and the Hudson River Valley would increase by an average of 8.4%, even with the timely addition of replacement generation. Market energy prices in New York City would likely increase by an average of 3.8%, and slightly less on Long Island. Elsewhere in New York, we expect less than a 1% impact. If IP voluntarily retired in 2013/15, there would not be any market price impact compared to the base case assumption of retirement at the end of the existing license terms. Our expectation of sufficient and timely replacement generation would leave market capacity prices unchanged." If IP retired in 2008, typical residential bills in Westchester would increase by an average of about$1.55/month though 2015 and about one-half of that amount in New York City. In the unrealistic scenario in which IP was retired immediately without replacement generation, market energy and capacity prices would soar and service reliability would be impaired until short-term generation measures were implemented. Action Plan The County's goals of retiring IP, minimizing economic and rate impacts on County and State residents, and maintaining system reliability are not inherently incompatible. While an immediate shutdown would have serious consequences, the County could pursue its goals through an orderly retirement strategy.We recommend that the County spearhead an agreement with New York State, Entergy, NYPA, and other stakeholders that focuses on twokey initiatives -voluntary retirement in 2013/15 at the end of the current NRC license terms and encouraging on-site gas-fired replacement generation. This would allow Entergy to continue earning profits for the term of the current NRC licenses as originally envisioned, avoid the high cost of license extension, and pursue an on-site investment opportunity that takes advantage of existing infrastructure. Local communities and school districts could preserve some level of PILOT, employment, and local spending on goods and services.Lastly, an agreement reached by year-end 2010 would allow sufficient time for Entergy and other developers to install sufficient replacement generation. 16 of' 16 12/11/07 11:43 AM EXHIBIT RR p://books.nap.edu/caialog/1 1'666.html ALTERNATIVES TO THE Indian Point Energy Center FOR MEETING NEW YORK ELECTRIC POWER NEEDS , ...Committee on Alternatives to Indian Point for Meeting Energy Needs Board on Energy and' Environmental Systems Division on Engineering and Physical Sciences NATIONAL RESEARCH COUNCIL OF THE NATIONAL ACADEMIES THE NATIONAL ACADEMIES PRESS Washington, D.C.www.nap.edu Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu li Ia LIVU6 IU I It M I UlW il I jIU It r I I Iy .U1 IW l IUI IVI -LII ly I'JUW I UI K I-I LiIt; r-UWuI IIUt)://books.nap.edu/catalog/l 1666.html THE NATIONAL ACADEMIES PRESS

• 500 Fifth Street, N.W.
• Washington, DC 20001 I .NOTICE: The project that is the subject of this report was approved by the Governing Board of the National Research Council, whose members are drawn from the councils of the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine.

The members of the committee responsible for the report were chosen for their special competences and with regardlfor appropriate balance.This report and the study on which it is based were supported by Contract No. DE-ATOI -04TD45037 (Task Order No. 6) from the U.S. Department of Energy. Any opinions, findings, conclusions, or recommendations expressed in this publication are those of the author(s) and do not necessarily reflect the view of the organizations or agencies that provided support for the project.International Standard Book Number: 0-309-10172-7 Cover: The transmission network links generating plants, including Indian Point, with demand centers in all parts of New York State. Map courtesy of the New York State Independent System Operator. Indian Point Energy Center image courtesy of Entergy Corporation. Available in limited supply from: Board on Energy and Environmental Systems National Research Council 500 Fifth Street, N.W.Keck W934 Washington, DC 20001 202-334-3344 Additional copies, available for sale from: The National Academies Press 500 Fifth Street, N.W.Lockbox 285 Washington, DC .20055 800-624-6242 or 202-334-3313 (in the Washington metropolitan area)http://www.nap.edu Copyright 2006 by the National Academy of Sciences. All rights reserved.Printed in the United States of America.Copyright-© 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu nIIdUMVC LU Lift: IllUldi I rUVIlI ~Itultiyy uCImtIluiVICIi 'd iuivienm iew umrwuumu ruwui i'jv;uuu)://books.nap.edu/catalog/1 1666.html THE NATIONAL ACADEMIES Advisers to the Nation on Science, Engineering, and Medicine The National Academy of Sciences is a private, nonprofit, self-perpetuating society of distinguished scholars engaged in scientific and engineering research, dedicated to the furtherance of science and technology and to their use for the general welfare. Upon the authority of the charter granted to it by the Congress in 1863, the Academy has a mandate that requires it to advise the federal government on scientific and technical matters.Dr. Ralph J. Cicerone is president of the National Academy of Sciences.The National Academy of Engineering was established in 1964,under the charter of the National Academy of Sciences, as a parallel organization of outstanding engineers. It is autonomous in its administration and in the selection of its members, sharing with the National Academy of Sciences the responsibility for advising the federal government. The.National Academy of Engineering also sponsors engineering programs aimed at meeting national needs, encourages education and research, and recognizes the superior achieve-ments of engineers. Dr. Wm. A. Wuif is president of the National Academy of Engineering. The Institute of Medicine was established in 1970 by the National Academy of Sciences to secure the services of eminent members of appropriate professions in the examination of policy matters pertaining to the health of the public. The Institute acts under the re-sponsibility given to the National Academy of Sciences by its congressional charter to be an adviser to the federal government and, upon its own initiative, to identify issues of medical care, research, and education. Dr. Harvey V. Fineberg is president of the Insti-tute of Medicine.The National Research Council was organized by the National Academy of Sciences in 1916 to associate the broad community of science and technology with the Academy's purposes of furthering knowledge and advising the federal government. Functioning in accordance with general policies determined by the Academy, the Council has become the principal operating agency of both the National Academy of Sciences and the National Academy of Engineering in providing services to the government, the public, and the scientific and engineering communities. The Council is administered jointly by both Acad-emies and the Institute of Medicine. Dr. Ralph J. Cicerone and Dr. Wm. A. Wulf are chair and vice chair, respectively, of the National Research Council.www.national-academies.org Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu

//books.nap.edulcatalogll 1,666html COMMITTEE ON ALTERNATIVES TO INDIAN POINT FOR MEETING ENERGY NEEDS LAWRENCE T. PAPAY, NAE,' Consultant, Chair DAN E. ARVIZU, National Renewable Energy Laboratory JAN BEYEA, Consulting in the Public Interest PETER BRADFORD, Bradford Brook Associates, Ltd.MARILYN A. BROWN, Oak Ridge National Laboratory ALEXANDER E. FARRELL, University of California, Berkeley SAMUEL M. FLEMING, Consultant GEORGE M. HIDY, Envair/Aerochem JAMES R. KATZER, NAE, Consultant PARKER D. MATIHUSA, New York State Energy Research and Development Authority TIMOTHY MOUNT, Cornell University FRANCIS J. MURRAY, JR., Consultant D. LOUIS PEOPLES, Nyack Management Company, Ltd.WILLIAM F. QUINN, Argos Utilities LLC DAN W. REICHER, New Energy Capital Corporation JAMES S. THORP, NAE, Virginia Polytechnic Institute and State University JOHN A. TILLINGHAST, NAE, Tillinghast Technology Interests, Inc.Project Staff Board on Energy and Environmental Systems (BEES)ALAN CRANE, Study Director DUNCAN BROWN, Senior Program Officer (part time)JAMES J. ZUCCHETTO, Director, BEES PANOLA GOLSON, Program Associate Consultants General Electric International, Inc.Optimal Energy, Inc.'NAE. National Academy of Engineering.

V Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu IIdI LU LIIt llUldIll 1-i011 r-lIJI k.yt:I1tl il IUI IVI4 LII V l dIl V l l% FI ul-II; ruoI .'ldOUb)://books.nap.edu/catalog/1 1666.html BOARD ON ENERGY AND ENVIRONMENTAL SYSTEMS DOUGLAS M. CHAPIN, NAE,1 MPR Associates, Inc., Chair ROBERT W. FRI, Resources for the Future (senior fellow emeritus), Vice Chair RAKESH AGRAWAL, NAE, Purdue University ALLEN J. BARD, NAS, 2 University of Texas, Austin DAVID L. BODDE, Clemson University PHILIP R. CLARK, NAE, GPU Nuclear Corporation. (retired)MICHAEL L. CORRADINI, NAE, University of Wisconsin, Madison E. LINN DRAPER, JR., NAE, American Electric Power, Inc. (emeritus). CHARLES GOODMAN, Southern Company DAVID G. HAWKINS, Natural Resources Defense Council MARTHA A. KREBS, California Energy Commission DAVID K. OWENS, Edison Electric Institute WILLIAM F. POWERS, NAE, Ford Motor Company (retired)TONY PROPHET, Carrier Corporation MICHAEL P. RAMAGE, NAE, ExxonMobil Research and Engineering Company (retired), MAXINE SAVITZ, NAE, Honeywell, Inc. (retired)PHILIP R. SHARP, Harvard University SCOTT W. TINKER, University of Texas, Austin Staff JAMES J. ZUCCHETTO, Director DUNCAN BROWN, Senior Program Officer (part time)ALAN CRANE, Senior Program Officer MARTIN OFFUTT, Senior Program Officer DANA CAINES, Financial Associate PANOLA GOLSON, Program Associate JENNIFER BUTLER, Financial Assistant S'NAE, National Academy of Engineering. 2 NAS, National Academy of Sciences.Vi-Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu -1IIdLIVU5 LU IIC It:11lUldi I r-lJIIL rI II Iyy UVI IR;uI IUi IVIVtULIII ly 1-4W I UllK MUDI iCL ruwui l'dluuu)://books.nap.edu/cataiog/l 1666.html Preface The Indian Point Energy Center, with two operational nuclear reactors, is in a densely populated region about 40 miles north of midtown Manhattan. On September 11, 2001, one of the hijacked planes flew past the plant on the Way to the World Trade Center. This incident heightened concerns that a terrorist, attack on the reactors or the spent fuel pools might cause a catastrophic release of radioactivity. and led to calls for the plant to be closed. .The Indian Point Energy Center is a vital part of the sys-tem supplying electricity to the New York City region. Any significant interruption of power to New York City also could have serious consequences, as shown by the relatively brief blackout that occurred in August 2003. The system de-livering power to New York City consumers must be highly reliable, and that depends on having adequate generating ca-pacity available. This dichotomy led the U:S. Congress to request a study from the National Academies on potential options for re-placing the energy services provided by Indian Point. The request, initiated by Representative Nita M. Lowey of New York's 18th District, was directed to the U.S. Department of Energy, which in turn arranged for the study with the Na-tional Research Council (NRC) of the National Academies. The NRC established the Committee on Alternatives to Indian Point for Meeting Energy Needs to conduct the study.Committee members were selected from industry, academia, national laboratories, and other organizations for their ex-pertise on electric power technology and systems and on is-sues specific to New York. Biographical sketches of the com-mittee members are presented in Appendix A.The committee was charged with fulfilling the following statement of task: The National Academies' National Research Council will form a committee to review options for replacing current electric power generation from the Indian Point Energy Cen-ter (New York) nuclear facilities with alternative means for meeting electric power demand and associated energy ser-vices. The study may include consideration of fossil-fuel-based options (e.g., coal-fired or natural-gas-fired power generation), renewable-energy-based options (e.g., wind,-solar, biomass), imports of required electrical energy, and energy efficiency measures, or some combination thereof.The study should include an assessment of the pros and cons of the alternatives to the continued operation of the Indian Point nuclear power plants. The study will not result in the choice of an option but will compare options based on the criteria adopted by the committee. In 2005, the committee met twice in Washington, D.C., and once in White Plains, New York, to gather information from public sources. The committee was particularly inter-ested in the feasibility of implementing the various options on a scale sufficient to replace the 2,000 megawatts of elec-tric power now produced by Indian Point and to address the resulting economic, environmental, and societal impacts. It procured the services of General Electric International, Inc., to model the New York electric system and how the options would affect reliability. It also contracted with Optimal En-ergy, Inc., to detail the efficiency improvements that could be made in the New York City area, based on its statewide assessment for the New York State Energy Research and Development Authority. The committee also, met twice in closed session to discuss results and progress on this report and held numerous conference calls. Details of the meetings are provided in Appendix B.The report focuses exclusively on options for replacing current electric power generation and ancillary services from Indian Point. In accordance with the original request, it does not examine the potential for terrorist attacks on Indian Point, nor their probability of success or possible consequences. It makes no recommendations as to whether Indian Point should be closed or how that decision could be implemented. The overriding goal of the study was to evaluate the options that are available to meet electric power demand and to pro-vii Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu II;IdtVt:ý LU UftIý HIW141iI r'UII It C I ieyy %,AiIi lul: w ivitn~iiiiy I'Jew UiK um muLII ruwui va'dtuz:/Ibooks. nap.edu/catalog/l 1 666.html ViiiPRFC PREFACE vide the other services required to maintain the reliability of the electric system should a decision be made to close the Indian Point plant.This report presents the committee's findings. It is the result of a great deal of effort on. the part of many highly qualified experts. I greatly appreciate the efforts by the com-mittee members and their enthusiasm, dedication, and in-sights in conducting this study and preparing the report. The committee operated under the auspices of the NRC Board on Energy and Environmental Systems and is grateful for the able assistance of James Zucchetto, Alan Crane, Panola Golson, and Duncan Brown of the NRC staff.Lawrence T. Papay, Chair Committee on Alternatives to Indian Point for Meeting Energy Needs'Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu 1111dLIV U5 LII tilel1Uldil roUlit r-IIl;IYY tLtiitlI lUi IVIe~tilIY lmuvy IUlIK riluuLl ruwui iNmeuu)://tbooks.nap.edu/catalog/1 666.html Acknowledgments The Committee on Alternatives to Indian Point for Meet-ing Energy Needs is grateful to the many individuals who contributed their time and effort to the National Academies' National Research Council (NRC) study. The presentations at committee meetings provided valuable information and insight on energy options and constraints in the New York area. The committee thanks the following_ individuals who provided briefings: Beth Tritter, Office of Congresswoman Nita M. Lowey, Philip Overholt, U.S. Department of Energy, John Kucek, Oak Ridge National Laboratory, Lawrence Pakenas, New York State Energy Research and Development Authority, John Plunkett, Optimal Energy, Inc., Randall Swisher, American Wind Energy Association, Harry Vidas, Energy and Environmental Analysis, Inc., Philip Fedora, Northeast Power Coordinating Council, Bill Quinn; Argos Utilities, LLC, Juanita Haydel, ICF Consulting, Michael R. Kansler, Entergy Nuclear Northeast, Steve Mitnick, Conjunction, LLC, Howard Tarler, New York State Department of Public Service, The Honorable Andrew J. Spano, Westchester County Executive, The Honorable Michael Kaplowitz, Westchester County Board of Legislators, Bruce Biewald, Synapse Energy Economics, Inc., Alex Matthiessen, Riverkeeper, Fred Zalcman, Pace Law School Energy Project, Garry Brown, New York Independent System Operator, Michael Forte, Consolidated Edison, Carl Seligson, Economic and Strategic Consultant, N.Z, Shilling, GE, and Paul A. DeCotis, New York State Energy Research and Development Authority. This report has been reviewed in draft form by individu-als chosen for their diverse perspectives and technical exper-tise, in accordance with procedures approved by the NRC's Report Review Committee. The purpose of the independent review is to provide candid and critical comments that will assist the institution in making its published report as sound as possible and to ensure that the report meets institutional standards for objectivity, evidence, and responsiveness to the study charge. The review comments and draft manuscript remain confidential to protect the integrity of the delibera-tive process. We wish to thank the following individuals for their review of this report: David Bodde, Clemson University, William L. Chameides (NAS), Environmental Defense, Douglas M. Chapin (NAE), MPR Associates, Inc., Michehl R. Gent, Summit Power, Leonard S. Hyman, RJ Rudden Associates, Paul Komor, University of Colorado, Gerald L. Kulcinski, University of Wisconsin, Harold N. Scherer, Jr. (NAE), Board of Directors, New York Independent System Operator,- Robert J. Thomas, Cornell University, Harry Vidas, Energy and Environmental Analysis, Inc., Carl Weinberg, Weinberg Associates, and Irvin L. (Jack) White, formerly with Pacific Northwest National Laboratory and New York State Energy Research and Development Authority. Although the reviewers listed above have provided many constructive comments and suggestions, they were not asked, to endorse the conclusions or recommendations, nor did they see the final draft of the report before its release. The review of this report was overseen by George Homberger (NAE), University of Virginia. Appointed by the National Research Council, he was responsible for making certain that an inde-pendent examination of this report was carried out in accor-ix Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu )://books.nap.edulcatalog/l 1666.html x ACKNOWLEDGMENTS dance with institutional procedures and that all review com-ments were carefully considered. Responsibility for the final content of this report rests entirely with the authoring com-mittee and the institution. The committee offers special thanks to Mark Sanford, Gene Hinkle, and Gary Jordan at GE Energy and to John Adams and William Lamanna at the New York Independent System Operator for their efforts on the committee's sce-nario analysis. The committee also benefited from an analy-sis of energy efficiency opportunities by John Plunkett and Optimal Energy, Inc.The committee is also very appreciative of the contribu-tions of Erin Hogan, Paul DeCotis, and John Spath of the New York State Energy Research and Development Author-ity; Benjamin Sovacool of Oak Ridge National Laboratory; and Lynn Billman, Robert Margolis, Brian Parsons, Ralph Overend, Rich Bain, Phil Shepherd, and Walter Short of the National Renewable Energy Laboratory. u;oprgh~q20 s1?qna AcadggloU t, }1 sp lpns S0A11W01}U V IikjLIWýZ t Ll U L WI I~ illld It r -lI EIUI Yy ',:I IMI IUI IVIetLllly I'JUW T UI K CMU~LIIt; rUWUI I'dtIVUZ p://books.nap.edu/catalog/l 1666.html Contents ABSTRACT

SUMMARY

AND FINDINGS 3 1 INTRODUCTION 8 Background, 8 Electricity Supply and Demand, 8 The Indian Point Energy Center: Description and Role, 14 Community Concerns, 14 Criteria for Evaluating Replacement Options, 15 Conduct of the Study, 16 Organization of the Report, 17 References, 17 2 DEMAND-SIDE OPTIONS 18 Demand Growth in the Indian Point Service Area, 18 Potential of Demand-Side Options, 20 Definition of Demand-Side Options and Measures of Potential, 21 Current Programs Operating in the Indian Point Territory, 23 The Potential for Additional.Energy-Efficiency Improvements, 26 The Potential for Future Demand Response, 27 The Potential for Expanded Combined Heat and Power, 29 The Potential for Expanded Distributed Photovoltaics, 29 Summary, 30 Impediments to Demand-Side Programs, 31 References, 33 3 GENERATION AND TRANSMISSION OPTIONS 35 Existing Generating Capacity, 35 Potential New Generating Capacity, 36 Technologies Considered, 36 Overall Considerations, 40 Electrical Transmission, 40 Existing Transmission, 40 New Transmission, 41 Reliability and Reactive Power, 42 Reliability, 42 Reactive Power, 43 References, 43 xi Copyright ©2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu

1666.html xii CONTENTS 4 INSTITUTIONAL CONSIDERATIONS AND CHANGING IMPACTS 44 Regulation, Finance, and Reliability, 44 The New York State Electricity Market, 44 The Permitting Process with Article X, 50 Social Concerns, 51 fEnvironmental Regulation, 51 Energy Security, 56 Socioeconomic Factors Including Indirect Costs to the Public, 56 References, 57 5 ANALYSIS OF OPTIONS FOR MEETING ELECTRICAL DEMAND 59 The NYISO Starting Point, 59 The Committee's Reference Case, 60 Replacement Scenarios, 62 Results of Reliability Analyses, 63 Operational and Economic Impacts, 66 Analytical Considerations, 67 fpel Diversity: Impact on NYCA Reliance on Natural Gas for Generating Electricity, 68 Projected Impact on the Wholesale Price of Electricity, 69 Impact on the Annual Variable Cost of Producing Electricity, 71 Sensitivity to Higher Fuel Prices, 72 Comparing the Results with Criteria, 73 References, 74 APPENDIXES' A Committee Biographical Information 77 B Presentations and Committee Meetings 82 C Acronyms 84 D Supply Technologies 86 D-1 Cost Estimates for Electric Generation Technologies, 87 D-2 Zonal Energy and Seasonal Capacity in New York State, 2004 and 2005, 94 D-3 Energy Generated in 2003 from Natural Gas Units in Zones H Through K, 104 D-4 Proposed Pipeline Projects in the Northeast of the United States, 105 D-5 Coal Technologies, 106 D-6 Generation Technologies-Wind and Biomass, 110 D-7 Distributed Photovoltaics to Offset Demand for Electricity, 118 E Paying for Reliability in Deregulated Markets 124 F Background for the System Reliability and Cost Analysis .144 F-1 The NYISOApproach, 145 F-2 Notes on the MARS-MAPS Simulations, 148 G Demand-Side Measures 169 G-1 Demand Reduction, 170 G-2 Estimating the Potential for Energy-Efficiency Improvements, 171 G-3 Estimating Demand-Response Potential, 175 G-4 Estimating Photovoltaics for Demand Reduction, 176'Appendixes D through G are reproduced on the CD-ROM that contains the full report but are not included in the printed report owing to space limitations. Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu .:1I IdIiVS LU tIIt IIIUli I rUIIIL Ir-IIyy Y ,I IUIUiuI WM IUhy l'w I UIK r',uCLUU rUWti I'dUUUb p://books.nap.edu/catalog/l 1666.html Tables, Figures, and Boxes TABLES 2-1 Weather-Normalized Annual Electricity Use, Past and Forecast, in Giga-watt-Hours per Year, for Three New York Regions and Statewide, Selected Years from 1993 Through 2015, 19 2-2 Weather-Normalized Summer Peak Power, Past and Forecast, in Mega-watts, for Three New York Regions and Statewide, Selected Years from 1993 Through 2015, 19 2-3 Current Photovoltaic (PV)-Related Policies in New York State, 24 2-4 Committee Estimation of the Potential of Energy-Efficiency Programs in New York Control Area Zones 1, J, and K, Selected Years Between 2007 and 2015 (MW), 27 2-5 Committee Estimation of Potential Peak Reduction from Demand-Response Programs in New York Control Area Zones I, J, and K, Selected Years Between 2007 and 2015 (MW), 29 2-6 Committee Estimation of Potential Peak Reduction from Combined Heat and Power in New York Control Area Zones I, J, and K, Selected Years Between 2007 and 2015 (MW), 29 2-7 Committee Estimation of Potential Peak Reduction from Photovoltaics in New York Control Area Zones I, J, and K, Selected Years Between 2007 and 2015, 30 3-1 Approximate (Noncoincident) Summer Peak Load and Capacity in New York State, by Region, 35 3-2 Potential Generating Technologies Considered by the Committee for Re-placing Indian Point, 37 3-3 Nominal Transfer Capability Between New York Regions, 41 4-1 Estimated Future Emission Allowance Prices, 54 4-2 Annual Costs for Allowances to Replace Indian Point Generation, Without CO 2 Control (Regional Greenhouse Gas Initiative Baseline Scenario, No CO 2 Control), 55 4-3 Annual Costs for Allowances to Replace Indian Point Generation with CO 2 Control (Regional Greenhouse Gas Initiative Reference Scenario), 55 5-1 NYISO Base Case Peak Load and Known New York ControlArea (NYCA)Resources, 60 O5-2 Additional Generating Capacity Assumed in Reference Case, 61 X111 Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu l I IIdklIVt LU tIlt lUldl I rUII II I-- C It:I1gy ýUI MN IUI IVItlIII I'JteW 7UItK Cl.U tK; ruwul Nt:t'UU p://books.nap.edu/catalog/1 1666.html xiv TABLES, FIGURES, AND BOXES 5-3 Capacity Additions Assumed for Cases b2 and c2, 64 5-4 Summary of Illustrative Resources Assumed to Maintain NYCA Reliability, 64 5-5 Results of Reliability Analyses, 65 5-6 Benchmark of the Consumption of Natural Gas, Coal, and Oil for 2005 and 2008: Annual Fuel Consumption in Trillion Btu, 69 5-7 Projected Impact on Electrical Generation Based on Natural Gas for 2008 to 2015, with Sensitivity to Fuel Price, 69 5-8 MAPS-Projected Impact on Electricity Wholesale Price, 70 5-9* Projected Impact on Annual Variable Operating Cost, 72 D-1-1 Summary Cost Estimates: Total Cost of Electricity (in 2003 U.S.dollars per kilowatt-hour) for Generating Technologies Examined by the Committee, 87 D-1-2 Cost Components for Electricity Generation Technologies, 88 D-1-3a Energy Information Administration National Average Cost Estimates D J(2003 dollars), 89 D-1-3b Energy Information Administration National Average Cost Estimates (2003 dollars), 90 D- I -4a Energy Information Administration Regional Cost Estimates (2003 dollars), 91 D- I -4b Energy Information Administration Regional Cost Estimates (2003 dollars), 92 D-1-5 University of Chicago National Average Cost Estimates (2003 dollars), 92 D- 1-6 University of Chicago Regional Cost Estimates for the New York Control Area (2003 dollars), 93 D-1-7 New York City Fuel Prices ($/MMBtu), 93 D-2-1 Summary of Summer and Winter Capacity, Energy Production, and Energy Requirements in the New York Control Area, by Zone, 94 D-2-2 Summer Zonal Capacity, by Fuel, 2004 and 2005, 95 D-2-3 Winter Zonal Capacity, by Fuel, 2004 and 2005, 96 D-2-4 Annual Energy Production, by Fuel, 2004 and 2005, 97 D-2-5 Summary of New York Control Area Generation Facilities' Energy Production by Fuel Type as of January 1, 2005, 98 D-2-6 Summary of New York Control Area Generation Facilities' Winter Capacity, by Fuel Type, as of January 1, 2005, 99 D-2-7 Summary of New York Control Area Generation Facilities' Summer Capacity, by Fuel Type, as of January 1, 2005, 100 D-2-8 Summary of New York Control Area Generation Facilities' Energy, by Fuel Type, as of January 1,2004, 101 D-2-9 Summary of New York Control Area Generation Facilities' Winter Capacity, by Fuel Type, as of January 1, 2004, 102 D-2-10 Summary of New York Control Area Generation Facilities' Summer Capacity, by Fuel Type, as of January 1, 2004, 103 D-3-1 Natural Gas Consumption for Electricity in Zones H Through K, 2003, 104 D-3-2 Natural Gas Consumption for Electricity in Zones H Through K, 2004, 104 D-3-3 Estimated Natural Gas (NG) Consumption of a 2,000 MW Combined-Cycle Unit with a 95 Percent Capacity Facior, 104 D-5-1 Electricity Cost from Coal with Emissions Controls, 108 D-6-1 Estimate of Potential Impact of Renewable Generation Technologies on Indian Point Service Area, 1 I 1 D-6-2 Quantitative Estimates of Wind Potential in Indian Point Zones, 113 ,Copyright © 2004 National Academy of Sciences. All rights reserved.This.executive summary-plus thousands more available at http:/twww.nap.edu

LVU thle mIUiWi rUiI.t CElIlyy t alILet IUI IVI yLIIIy IJUW UTUI CI-VtUiLt; rUWtI Il UUU5:://books.nap.edu/catalog/l 1666.html TABLES, FIGURES, AND BOXES xv DL6-3 Biomass Potential Applicable to Indian Point, 115 D-7-.1 Estimated Distributed Photovoltaics in the Indian Point Service Area in the Accelerated Deployment Scenario, 118 D-7-2 Current and Projected Distributed PV Cost (2005 dollars), 120 D-7-3 Current PV Related Policies in New York State, 121 D-7-4 Accelerated PV Deployment Scenario for New York (2005 dollars), 123 E-1 Locational ICAP Requirements and Installed Capacity for NYCA in 2005-2006, 130 E-2 The Capacity Factors in 2003 of Major Generating Units in New York City and Long Island, 135 E-3 New Generating Units Proposed for the NYCA in 2004, 141 E-4 New Generating Units Proposed for the NYCA in 2005, 142 F-2-1 NYISO Initial Base Case Capacity Details Adopted for the MARS Analysis, 150 F-2-2 Electricity Generation Load and Capacity Representing NYISO Initial Base Case, 151 F-2-3 NYISO Initial Base Case-Qualifying Additions to Capacity (MW), 153 F-2-4 Committee's Screening Study-Early Shutdown with Assumed Compensation from Planned NYCA Projects and Added Energy-Efficiency and Demand-Side-Management Measures (MW), 154 F-2-5 Committee's Screening Study-End-of-License Shutdown with Assumed Compensation from Planned NYCA Projects and Added Energy-Efficiency and Demand-Side-Management Measures (MW), 155 F-2-6 NYISO Initial Base Casewith Alternate New England Transmission Constraints-Projected NYCA Reliability Loss-of-Load Expectation (LOLE) and Reserve Margin, 155 F-2-7 Committee's Screening Study: Impact on Reliability and Reserve Margins of Shutting Down Indian Point Without Adding Compensatory Resources: Comparison of the NYISO Initial Base Case with Early-Shutdown and End-of-Current-License Shutdown Cases, 156 F-2-8 Committee's Screening Study: Impact on Reliability and Reserve Margins of Shutting Down Indian Point and Adding Compensatory Resources from Announced Projects, Beyond NYISO Initial Base Case (Table F-2-3): Comparison of Early Shutdown and End-of-Current-License Shutdown, 157 F-2-9 Reference Case: Illustrative Additional Resources Beyond the.NYISO Initial Base Case to Meet Load Growth and Scheduled Retirements and Ensure Reliability Criteria Are Met, and Including Reliability Results If Indian Point Is Closed Without Further Compensation, 158 F-2-10 Early Shutdown of Indian Point with Compensatory Resources, Case b2, 159 F-2-1 1 End-of-Current-License Shutdown of Indian Point with Compensatory Resources, Case c2, 160 F-2-12 Early Shutdown of Indian Point with High-Voltage Direct Current (HVDC) Cable, Case b3, 161 F-2-13 End-of-Current-License Shutdown of Indian Point with Compensatory Resources Including 1,000 MW HVDC Transmission Lines, Case c3, 162 F-2-14 Early Shutdown of Indian Point with Higher Efficiency and Demand-Side B Management, Case b4, 163 Copyright© 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu 1;,-IdLIVUv LU t1I Iudn l r I IL r iunt n yy u IvInUtiLIy INUW TVuIr 17nt:CLI ruwui :/books. nap.edu/catalog/l 1666:html xvi TABLES, FIGURES, AND BOXES F-2-15 End-of-Current-License Shutdown of Indian Point with Higher Efficiency and Demand-Side Management, Case c4, 164 F-2-16 Early Shutdown Without Compensatory Resources Beyond the Reference Case-Impact on NYCA Reliability (Loss-of-Load

• Expectation) and Reserve Margin, Case b 1, 165 F-2-17 End-of-Current-License Shutdown Without Compensatory Resources Beyond the Reference Case-Impact on NYCA Reliability (Loss-of-Load Expectation) and Reserve Margin, Case cl, 165 F-2-18 Committee's Reference Case-Impact on NYCA Reliability (Loss-of-Load) Expectation and Reserve Margin, 165 F-2-19 Early Shutdown with Additional Compensatory Resources-Impact on NYCA Reliability and Reserve Margin, Case b2, 165 F-2-20 End-of-Current-License Shutdown with Additional Compensating Resources-Impact on NYCA Reliability and Reserve Margin, Case c2, 166 F-2-21 Additional Compensatory Resources, Including 1,000 MW North-South HVDC Transmission Line-Impact on NYCA Reliability and Reserve Margin, Cases b3 and c3, 166 F-2-22 Additional Compensatory Resources, Including Higher Energy.Efficiency and Demand-Side-Management Penetration-Impact on NYCA Reliability and Reserve Margin, Cases b4 and c4, 166 F-2-23 Projected Impact on the Annual Variable Cost of Operation for the Northeast Region, NYCA, and Zones H Through K: All Scenarios, 2008-2015, Including Percentage Change from Benchmark of 2008 NYISO Initial Base Case, 167 G-1-1 Economic Potential:

Annual Savings (in megawatt-hours) for Top Eight Residential Energy-Efficiency Measures-Zones J and K, 2007, 2012, and 2022, 170 G-1-2 Economic Potential: Annual.Savings (in megawatt-hours) for Top Ten Commercial Energy-Efficiency Measures-Existing Construction End Use in Zones J and K, 2007-2022, 170 G-4-1 Current and Projected Distributed PV Cost, 177 G-4-2 Accelerated PV Deployment Scenario for the New York City Area, 177 FIGURES S-I New York Control Area load zones, 4 1-1 The New York Control Area high-voltage transmission network, 10 1-2 Average daily load and peak hour load in New York City, 11 1-3 New York Control Area load zones, 12 1-4 Generating capacity in the NYCA, by fuel type, 2005, 13 1-5 Capability of generating plants by NYCA zone and generator type, 13 2-1 Past and projected trends in real residential electricity price in New York state relative to 1980, 20 2-2 Effects of demand-reduction programs on daily power demand, 21 2-3 Global photovoltaic market evolution, by market segment, 1985 to 2004, 23 2-4 Phased-in programmable potential for expanded demand-side options in the Indian Point service territory (in megawatts of peak reduction), 30 Copyright © 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu sItILIVt: &U Lt:I IIIUIn I rUIIIL E kItI: UI 1UllV t'lW TUIK.r-IeULAII ruWm i 'cll Ub://books.nap.edu/catalog/l 1666.html TABLES, FIGURES, AND BOXES xvii 4-1 Projections made by NYISO in 2004 and 2005: summer reserve margin for generating capacity in the New York Control Area, 49 5-1 NYISO reliability projections, 61 5-2 Approximate additional resources needed, 63 5-3 Impact on NYCA reliability loss of load (LOLE) of shutting down Indian Point without additional resources beyond the reference case, 63 5-4 Capacity assumed to meet load growth and compensate for retiring Indian Point, 66 5-5 Loss-of-load expectation after compensation, 66 5-6 Projected reserve margin for End-of-License (EOL) Shutdown of Indian Point with Compensation (Case c2),,67 D-4-1 Proposed Northeast pipeline projects, 105 D-5-1 Emissions control options for coal-fired generation, 106 D-5ý2 Past and projected U.S. emissions from fossil power generation, 1965 to 2030, 107 D-5-3 Types of power plants, 108 D-7-1 'Global PV market evolution by market segment, 1985 to 2004, 119 D-7-2 An accelerated PV market development path for New York (all estimates are 2005 dollars), 122 E-1 North American additions in historical perspective; 126 E-2 Locational installed capacity requirements for Long Island and New York City for 2005-2006, 130 E-3 Average total cost of production (in dollars per megawatt-hour generated) for a representative peaking unit, 132 E-4 Daily zonal spot prices ($/MWh), January 2000 to July 2005, for New YorkCity in the balancing (real-time) market at 2:00 p.m. on the first day of each month shown, 133 E-5 Average price-duration curves in the balancing market for May-April in New York City (in dollars per megawatt-hour) for 2000-2001, 2002-2003, and 2004-2005, 134 E-6 Projections made in 2004 and 2005 of the summer reserve margin for generating capacity in the New York Control Area, 140 G-4-1 Accelerated PV market development path for the New York City area, 178 BOXES 1-1 Keeping Competitive Markets Operating, 9 4-1 The Cost of Replacing Indian Point: In Theory, 45 4-2 The Cost of Replacing Indian Point: In Practice, 46 5-1 Reliability Criteria, 60 5-2 Multi-Area Reliability Simulation (MARS) Model, 62 5-3 Multi-Area Production Simulation (MAPS) Software Model, 68 0 Copyright @ 2004 National Academy of Sciences. All rights reserved.This executive summary plus thousands more available at http://www.nap.edu EXHIBIT SS EXHIBIT SS 2-Y [ S;S NOTES TO THE FILE -Susan Shapiro- August 30, 2007 Conference call Discussion regarding Dry Cask Storage at Indian Point Richard Barkely and Joe Sebrosky -Project Manager Division of Spent Fuel Storage, Transport, Nuclear Material Safety and Safe Guards Part 72 Storage Cask Capacity to Store Spent Fuel on IP Site Independent Spent Fuel Storage Installation (ISFSI)Estimates capacity 75 Holtec 100 High Storm Casks 18ft high x 14 ft in diameter Multipurpose Canister /2 inch diameter holder 32 PDR fuel assemblies Tech spacing for heat dispersal told us approximately 4 feet and then sent correct memo of 2.5 feet between casks.Each Reactor has 193 fuel assemblies -nominally 1/3 of the core is replace at each refueling once every 2 years.Per plant approximately 64 assemblies move every two years, assuming don't have to change fuel assemblies b/c of power uprate or other problem The pad can store a total of 75 casks.It is estimated that one cask per year, per plant.Capacity amount of spent fuel in pools Unit 2 1374 currently almost full Unit 3 1345 currently almost full IP 1 approximately 5 MPC (casks)Looking into the future -fuel cladding problem was early generations. Casks are 3 ft thick made of carbon steel inside concrete Each PWR fuel assembly and dry cask weighs approx 1,400 lbs.100 meter buffer of controlled land Barnwell closing -so low level waste will be stored on site. They will get back to us regarding capacity for low level waste storage Not sure about commingling at Unit 1 Plan to move Unit 3 waste to Unit 2 to package and move to Pad. Temporarily commingling waste.Design Control program details certification -Amendment to support off loading fuel from Unit One -special transfer cask needed to remove fuel from #1 because shorter rods. Amend # 4 to high storm systems.Part 72 Process -Site Specific-Certificate of Compliance HOLTE John Bosca -Project manager -Part 50 Follow up letter from Richard Barkley Sept 6 2007 We have specialist technical staff on site this week doing an inspection of the Independent Spent Fuel Storage Installation lifting and transfer equipment. I asked one of them to review the blueprint for the thick reinforced concrete ISFSI pad; it is rectangular in shape and encompasses an area of 12 (0.5) acres, slightly smaller than my original estimate. Thus even if the pad had to be doubled in size in the future, it would still represent just 1,2 of 1% of the Indian Point site area.I was sure my calculations were correct -I taught math at Holy Family University on Tuesday evenings this Spring, so I still remember how to multiply.Talk to you soon!Richard S. Barkley, P.E.Technical Communications Assistant, NRC Region I (610) 337-5065 Cell (610) 608-1517 3(e3 EXHIBIT TT PUBLIC HEALTH RISKS OF EXTENDING LICENSES OF THE INDIAN POINT 2 AND 3 NUCLEAR REACTORS Joseph J. Mangano, MPH MBA Executive Director Radiation and Public Health Project October 6, 2007 Advisors: Rosalie Bertell PhD, founder of the International Institute of Concern for Public Health Marci Culley PhD, associate professor of psychology, Georgia State University Samuel Epstein MD, professor emeritus of public health, Univ. of Illinois-Chicago Sam Galewsky PhD, associate professor of biology, Millikin (IL) University Donald Louria MD, professor of preventive medicine, New Jersey Medical School Kay Kilburn MD, retired professor of medicine, University of Southern California Janette Sherman MD, adjunct professor, Environmental Institute, Western Michigan Univ I TABLE OF CONTENTS Executive Summary ............................................. 3 I. Introduction A. Brief History of Nuclear Power and Indian Point ............... 4 B. Radioactivity Produced in Reactors ........................... 5 II. Health Hazards Posed by Reactor Meltdowns A .D escription .............................................. 5 B. Estimates of Casualties ...................................... 6 III. Radioactivity from Indian Point A. Environmental Releases from Indian Point ...................... 7 B. Environmental Radioactivity Levels Near Indian Point ............. 10 C. Radioactivity Levels in Bodies Near Indian Point ................ 12 IV. Potential Health Risks from Indian Point A .Prior Studies .............................................. 14 B. Defining Local Population .................................... 15 C. Cancer Incidence ........................................... 16 D. Cancer M ortality ........................................... 22 V. Studies of Improved Health After Reactor Shutdown A. Precedent -Atomic Bomb Testing Halt ......................... 25 B. Precedent -Nuclear Reactor Closing ........................... 25 C. Potential Cancer Reductions After Indian Point Closing ............. 27 VI. Summary and Policy Implications .................. ................. 28 2 EXECUTIVE

SUMMARY

The Indian Point nuclear plant, 35 miles north of midtown Manhattan, has three reactors, two of which remain in operation. Entergy Nuclear, which operates the plant, has requested that the federal government extend the operating licenses of the two reactors for 20 additional years beyond their 2013 and 2015 expiration dates. To date, federal officials have not acknowledged any public health risks of license extension at Indian Point. This report explores risks from extending the Indian Point licenses.Continued operation of Indian Point raises the risk of radioactivity exposure in two ways.First, the reactor cores would produce high-level waste to be added to the 1,500 tons already at the site, worsening the consequences of a large-scale release. Second, because reactors routinely release radioactivity, keeping Indian Point in service would mean greater releases and risks to local residents. The principal findings of this report are: 1. A large-scale release of radioactivity in a meltdown, from mechanical failure or act of sabotage, would harm thousands through acute radiation poisoning or cancer.2. Indian Point has released the 5th greatest amount of airborne radioactivity out of 72 U.S. nuclear plants. In some periods, releases are up to 100 times greater than normal.3. Radioactivity levels in the Hudson River near Indian Point are over 10 times greater than those in Albany. Large variations exist in local radioactivity levels; for example, 2006 airborne radioactivity was three times as high in late fall, than in late spring.4. Levels of Strontium-90 in local baby teeth are the highest of any area near seven U.S.nuclear plants. Local children born in the late 1990s have an average Sr-90 level 38%greater than those born a decade earlier.5. In the four counties closest to Indian Point, the incidence of cancer exceeds the state and national rates. In 2000-2004, excess cancer cases range from 2090 to 363 1.6. Local incidence rates of childhood cancer and thyroid cancer, both known to be sensitive to radiation exposure, are among the highest in New York State. Local thyroid cancer incidence is about 70% above the U.S. rate.7. Cancer incidence in the towns within five miles of Indian Point is 20% greater than the rest of Rockland and Westchester Counties.8. There is a statistical link between average levels of Strontium-90 in local baby teeth and local childhood cancer rates.9. If closing Indian Point is associated with decreases in cancer mortality as it did near the Rancho Seco CA plant, 5000 fewer cancer deaths would occur in the next 20 years.While many factors contribute to cancer risk, evidence suggests that more detailed study on Indian Point is warranted, and that the public be informed of any health risks.3 I. Introduction A. Brief History of Nuclear Power and Indian Point. The discovery of nuclear fission, or creation of high energy by splitting uranium atoms, was first used for military purposes, i.e. the atomic bombs in Japan during World War II. Soon after, other uses of the fission process were introduced. One of these was the creation of electric power from the heat generated by fission. The "Atoms for Peace" speech given at the United Nations by President Dwight Eisenhower in 1953 opened the door for the development of reactors that would produce electricity. Hundreds of reactors were proposed by electric utilities, who were interested based on the potential to produce clean and cheap energy. In the New York City area, many reactors were discussed, and federal applications were formally submitted for a total of 16 within 100 miles of midtown Manhattan (Table 1). Of these, only five eventually operated and only three still remain in operation (Indian Point 2, Indian Point 3, and Oyster Creek).Table 1 Nuclear Power Reactors Within 100 Miles of Midtown Manhattan With Formal Applications to the U.S. Atomic Energy Commission Reactor 1. Indian Point 1 2. Indian Point 2 3. Indian Point 3 4. Haddam Neck 5. Oyster Creek 6. Ravenswood

7. Shoreham 8. Burlington 1 9. Burlington 2 10. Verplanck 1 11. Verplanck 2 12. Forked River 13. Atlantic 1 14. Atlantic 2 15. Jamesport 1 16. Jamesport 2 State NY NY 14Y-CT NJ NY NY NJ NJ NY NY NJ NJ NJ NY NY Miles/Dir.

From NYC 35 mi.N 35 mi. N 35 mi. N 90 mi. NE 65 mi. SW 3mi. E 55 mi. NE 80 mi. SW 80 mi. SW 35 mi. N 35 mi. N 65 mi. SW 100 mi. S 100 mi. S 75 mi. E 75 mi. E Ordered 1955 1965 1967 1962 1963 1962 1968 1966 1966 1968 1968 1973 1974 1974 1974 1974 1962 1973 1976 1967 1969 Closed 1974 1995 Source: U.S. Nuclear Regulatory Commission, www.nrc.gov The Indian Pointplant is the former site of an amusement park in the town of Buchanan, in northwestern Westchester County. It is located on the Hudson River, the source of power needed to operate the plant. Five reactors were once proposed for the site;however, the Verplanck 1 and 2 reactors were cancelled in the 1970s, and the Indian Point unit 1 reactor closed permanently in 1974.4 The Indian Point units 2 and 3 reactors have the capacity to generate 951 and 965 megawatts of electricity, respectively, much more than the unit I capacity of 257. The reactors went critical (began producing radioactivity) on May 22, 1973 and April 6, 1976, respectively. To date, no U.S. reactor has operated longer than 38 years, making the 34 and 31 year-old Indian Point reactors among the oldest.B. Radioactivity Produced in Reactors. To produce electricity, nuclear power reactors split uranium-235 atoms, generating high energy that is transformed into electrical power.This splitting process, known as fission, also produces over 100 chemicals not found in nature. These chemicals are the same as those found in the large clouds of fallout after above-ground atomic bomb tests.Fission products, which take the form of gases and particles, include Cesium-137, Iodine-131, and Strontium-90. They are highly unstable atoms which emit alpha particles, beta particles, or gamma rays. When they enter the body, they affect various organs. Cesium seeks out the muscles (including the heart and reproductive organs), iodine attacks the thyroid gland, and strontium attaches to bone. Each causes cancer after damaging DNA in cells and creating mutations, and is especially harmful to the fetus, infant, and child.Some decay quickly (Iodine-131 has a half life of 8 days), while others remain for long periods (Strontium-90 has a half life of 29 years).Most of the radioactivity produced in reactors is contained within the reactor building and stored as high-level waste in deep pools of water that must be constantly cooled. At Indian Point and at other aging plants, the pools are becoming full. Some of the waste has been transferred to above-ground outdoor casks, and this process is expected to begin at Indian Point in late 2007. Indian Point currently maintains over 1,500 tons of waste on site, and additional radioactivity in the reactor cores. The amount of radioactivity at the plant is equivalent to several times as much as present at the Chernobyl site, and hundreds of times as much as was released at Hiroshima in 1945.The federal government has designated Yucca Mountain in Nevada as a permanent waste site. Yucca has encountered much opposition, and will not open until at least 2018 (according to the U.S. Energy Department). Some experts believe that Yucca Mountain or any permanent repository will never open, leaving existing nuclear plants to maintain the waste indefinitely. II. Health Hazards Posed by Reactor Meltdowns A. Description. Much of the health concern posed by nuclear reactors is on the effects of a major meltdown. The radioactivity in a reactor core and waste pools must be constantly cooled by water, or the fuel will heat uncontrollably, causing a huge release of radioactivity. This release can be caused by mechanical failure (such as what happened at Chernobyl in 1986, when safeguard redundancy was deliberately shut off for testing purposes) or by a deliberate act of sabotage.The experience at Hiroshima and Nagasaki demonstrated how exposure to high levels of radioactivity can harm humans. Those closest to the bombs were vaporized, literally 5 melting from the intense heat. But many other victims who survived the initial blast developed acute radiation poisoning, marked by symptoms such as nausea, vomiting, diarrhea, skin bums, weakness, dehydration, bleeding, hair loss, ulcerations, bloody stool, and skin sloughing (falling off), according to the Medical Encyclopedia of the National Library of Medicine. In addition, a large number of bomb survivors in the two cities developed cancers over the next several decades; thyroid cancer had the greatest excess, according to a 1994 report. (Source: Thompson DE et al. Cancer Incidence in Atomic Bomb Survivors. Part II: Solid Tumore, 1958-1987. Radiation Effects Research Foundation, Hiroshima Japan, 1994).B. Estimates of Casualties. If a meltdown that caused large scale releases of radioactivity from the reactor core or the waste pools occurred at Indian Point, there would be no vaporizing of humans. However, many would suffer from acute radiation poisoning (in the short term) and cancer (in the long term). Several estimates have been made to calculate just how many would be harmed. In 1982, the Sandia National Laboratories submitted estimates to Congress for each U.S. nuclear plant in the case of core meltdown.Those estimates for Indian Point are given in Table 2.Table 2 Estimated Deaths/Cases of Acute Radiation Poisoning and Cancer Deaths Near Indian Point, Following a Core Meltdown Type of Effect Indian Point 2 Indian Point 3 Deaths, Acute Radiation Poisoning 46,000 50,000 Cases, Acute Radiation Poisoning 141,000 167,000 Cancer Deaths 13,000 14,000 Note: Acute radiation poisoning cases and deaths calculated for a radius of 17.5 miles from the plant, cancer deaths calculated for radius 50 miles from the plant.Source: Sandia National Laboratories, Calculation of Reactor Accident Consequences (CRAC-2) for U.S.Nuclear Power Plants. Prepared for U.S. Congress, Subcommittee on Oversight and Investigations, Committee on Interior and Insular Affairs. November 1, 1982. Published in New York Times and Washington Post the following day.The Sandia figures are known as CRAC-2 (for Calculation of Reactor Accident Consequences). CRAC-2 estimated casualties for Indian Point are one of the highest of any U.S. nuclear plant. Many believe the figures should be much larger, since the local population has grown since 1982 when the calculations were made, and people beyond a 17.5 mile radius from the plant will also suffer adverse health consequences. More recently, the Union of Concerned Scientists prepared an estimate of casualties after a core meltdown from a terrorist attack. The 2004 report entitled "Chernobyl on the Hudson" estimated much higher casualties than did the 1982 Sandia effort. The Unio.' s Dr. Edwin Lyman calculated that as many as 44,000 near term deaths from aetA6 radiation syndrome within 50 miles and 518,000 long term deaths from cancer within 60 miles could occur, depending on weather conditions. (Source: Lyman ES, Chernobyl on-A'h'e Hudson?: The Health and Economic Impacts of a Terrorist Attack on the Indian Point Nuclear PIV."'Washington DC: Union of Concerned Scientists, 2004. www.ucsusa.org). 6 3Qc Indian Point is more vulnerable to a meltdown from mechanical failure than most reactors because of its age, and more vulnerable to a terrorist attack because of its proximity to New York City. Since the terrorist attack on the World Trade Center of September 11, 2001, much attention has been paid to the possibility of Indian Point as a potential target for attack.The reactors are also more vulnerable to a meltdown due to its parts corroding as the plant ages and as the reactors operate much more of the time in recent years; the operating factor from 2001-2004 was 95%, compared to the national rate of 90% (Table 3). Until 1994, the operating factors for Indian Point 2 and 3 were 64.7% and 50.4%, respectively. Source: U.S. Nuclear Regulatory Commission, in The New York Times, October 2, 1995.Table 3 -..Hours Indian Point Reactors Were Critical, 2001-2004 Year Indian Point 2 Indian Point 3 2001 8513.98 8156.38 2002 8000.87 8731.05 2003 8664.86 7866.83 2004 7994.62 8784.00 Total 33,174.33 33,538.26% Capacity 94.6% 95.6%Source: U.S. Nuclear Regulatory Commission, www.nrc.gov. The potential for a meltdown, while not highly likely, is a reality. A recent report by Greenpeace entitled "An American Chernobyl" identified 200 near-miss accidents at American reactors in the past two decades. Four of these were at Indian Point, all occurring since 2000 (Table 4).Table 4 Near Miss Accidents At Indian Point Since 1986 Date Reactor " Description February 15, 2000 Indian Point 2 Steam generator tube rupture July 19, 2002 Indian Point 2 Degraded control room fire barrier August 14, 2003 Indian Point 2 Loss of offsite power due to NE blackout August 14, 2003 Indian Point 3 Loss of offsite power due to NE blackout Source: An American Chernobyl: Nuclear "Near Misses" at U.S. Reactors Since 1986. Washington DC: Greenpeace, 2006. www.greenpeace.org. III. Radioactivity from Indian Point A. Environmental Releases from Indian Point. All nuclear reactors must routinely emit radioactivity into the environment in order to operate. There are several forms of these emissions. One is accidental releases due to leaking equipment, which can include the 7 3~7o cladding and welds of fuel rods in the reactor core, cracks and breaks in fuel that damages cladding, corroding pipes, and cracked steam generator tubes. These scenarios result in radioactivity released into the air and water. Radioactivity is also deliberately released into local water about every 18 months when reactors refuel.Each utility is required by federal law to measure and report radioactive environmental emissions from nuclear reactors annually. From 1970-1993, the federal government produced a comparative listing of annual emissions for each U.S. reactor (it has since been discontinued). One measure of environmental emissions is known as airborne"Iodine-131 and Effluents" or chemicals with a half life of at least eight days (and thus, are more likely to enter the body through breathing and the food chain). The list of the U.S. nuclear plants with the highest releases is given in Table 5: Table 5 U.S. Nuclear Plants with Highest Emissions Of Airborne Radioactivity, 1970-1993 Plant Location Reactors Emissions*

1. Dresden Morris IL 3 97.22 2. Oyster Creek Forked River NJ 1 77.05 3. Millstone Waterford CT 2 32.80 4. Quad Cities Cordova IL 2 26.95 5. Indian Point Buchanan NY 3 17.50 6. Nine Mile Point Scriba NY 2 14.67 7. Brunswick Southport NC 2 14.50 8. Three Mile Island Londonderry PA 2 14.43 9. Monticello Monticello MN 1 12.48 10. Pilgrim Plymouth MA 1 6.71* Emissions expressed as curies of Iodine-131 and effluents Source: Tichler J et al. Radioactive Materials Released from Nuclear Power Plants, annual reports. Upton NY: Brookhaven National Laboratory, NUREG/CR-2907.

The Indian Point total of 17.50 curies is the 5 d' highest of 72 U.S. plants. The total is greater than the 14.43 curies from the Three Mile Island plant in Pennsylvania, most of which was reported after the 1979 accident. Most of the Indian Point total occurred in 1985 and 1986, with a total of 14.03 curies from Indian Point 2. Several years later, the totals were changed to 1.90 curies; an inquiry to the U.S. Nuclear Regulatory Commission attributed the change to a "clerical error." While the original figures are used here, using revised figures would still rank Indian Point as the 12'h highest in the nation.More recent data on emissions is now posted on the Internet by the federal government. Data for all U.S. reactors are listed from 2001-2004, by quarter, and by type of emission.Unfortunately, no information for Indian Point 2 is given, and data for Indian Point 3 is missing for various quarters.8 But examination of types of airborne and liquid radioactive emissions with data reported for each quarter from 2001-2004 from Indian Point 3 is helpful in understanding the large variations over time (Tables 6 and 7). For example:-Releases of fission gases from Indian Point 3 rose about six-fold from the fourth quarter 2001 to the first quarter 2002 (about 15-fold for Xenon-133, a type of fission gas), and about 100 times higher than a year earlier.-Second quarter 2004 releases of airborne fission gases were much higher than typical quarterly 2003 releases-The quarters with the highest liquid releases of fission and activation products were not necessarily those with the highest liquid releases of tritium More analysis is needed to understand reason(s) for these releases. But it is clear that there are very large swings in emissions levels over time. Large increases often remain high for extended periods of time.Table 6 Airborne Radioactivity Released from Indian Point 3, in Millicuries Selected Measures of Radioactivity, by Quarter, 2001-2004 Quarter is t Q 01 2nd Q 0 1 3 rd Q 0 1 4t Q 01 1st Q 02 2 nd Q 02 3' Q 02 4 th Q 02 15tQ 03 2 nd Q 03 3 rd Q 03 4 th Q 03 1st Q 04 2 nd Q 04 3 rd Q 0 4 4 th Q 04 Xenon- 133 59 218 321 378 5580 1820 166 33 141 190 371 523 144 1290 29 36 Total Fission Gases 91 251 1040 1400 8180 3790 202 55 181 229 525 1590 204 1450 58 121 Tritium 360 457 1120 1430 1310 1670 1540 679 495 828 951 830 1420 1340 1140 1570 One millicurie is 1/1 0 0 0 tI of a curie. The physical half lives of Xenon-133 and Tritium are 5.24 days and 12.3 years, respectively. Source: U.S. Nuclear Regulatory Commission. www.reirs.com/effluent/EDB 9 37ý2_ Table 7 Liquid Radioactivity Released from Indian Point 3, in Millicuries Selected Measures of Radioactivity, by Quarter, 2001-2004 Fission and Quarter Activation Products Tritium 1s t Q 01 27.0 251,000 2 nd Q 0 1 51.4 170,000 3 rd Q 01 36.4 22,900 40 Q 01 12.0 482,000 Ss t Q 02 4.5 31,900 2 nd Q 02 2.5 19,600 3 rd Q 0 2 7.6 51,400 4th Q 02 14.0 692,000 1st Q 03 3.9 667,000 2 nd Q 0 3 27.3 61,800 3 rd Q 03 7.5 187,000 4th Q 03 6.3 38,500 1st Q 04 3.1 28,800 2 nd Q 04 3.0 71,800 3 rd Q 04 4.7 44,900 4 t Q 04 4.8 530,000 One millicurie is 1/1000t of a curie. The physical half life of Tritium is 12.3 years.Source: U.S. Nuclear Regulatory Commission. www.reirs.com/effluent/EDB B. Environmental Radioactivity Levels near Indian Point. All utilities are also required by federal law to make periodic measurements of radioactivity levels in the local area near reactors, and report them to the U.S. Nuclear Regulatory Commission annually. In addition, the New York State Department of Health makes measurements in air, water, soil, fish, and vegetation, and makes results available to the public.Some of the measurements are for levels of specific chemicals, such as Strontium-90 and Iodine-131. But others cover entire categories of radioactive chemicals (which emit alpha particles, beta particles, or gamma rays). These categories are most meaningful when trying to estimate total radiation burden to the environment. The state Health Department maintains a water monitoring site on the Hudson River at Verplanck, which is just one mile south of the Indian Point plant. It also measures radioactivity levels in water in Albany, on the roof of the Health Department building, as a "control", meaning the site is far from any nuclear plant. Average weekly levels of all alpha and beta emitters have traditionally been about 10 to 11 times higher in Verplanck than in Albany (Table 8). It is virtually certain that this difference is due to the operations of Indian Point, as many of these alpha- and beta-emitting chemicals can only be produced in nuclear reactors.10 3-23 Table 8 Average Gross Alpha and Gross Beta Levels in Water From Weekly Measurements, 1982-2003 Hudson River (Verplanck) vs. Albany (Health Department) Area Period Verplanck 1982-1994 Albany 1982-1994 Times Verplanck is above Albany Verplanck 1995-2003 Albany 1995-2003 Times Verplanck is above Albany Annual Avg. (measurements) Gross Alpha Gross Beta 21.74 (573) 24.41 (574)1.85 (706) 1.99 (706)11.8 10.9 23.41 (416)2.20 (228)10.6 25.36 (416)2.39 (228)10.6 All measurements are in picocuries of gross alpha/gross beta per liter of water.Source: New York State Department of Health, Bureau of Radiation Protection. Environmental Radiation in New York State, annual volumes.The Annual Radiological Environmental Operating Report for the Indian Point plant is now available on the NRC web site from 1999 to 2006. While each report lists a variety of radioactivity measurements near the plant, there are problems. There is no simple way to summarize radioactivity patterns near the plant. Measurements of some forms of radioactivity are taken infrequently (e.g. annually or quarterly). Levels of radioactivity may not always be detectable by Entergy, given the reliable detection limits of the methodologies employed. At these levels, measurement uncertainty is characteristically high, making it difficult to obtain reliable assessments. One type of radioactivity that may be helpful in understanding local radioactivity burden is "gross beta in air", or the total amount of radioactive chemicals that emit beta particles. Measurements are taken weekly; error margins are small; there are nine stations near Indian Point; and all measurements are detectable. Table 9 displays fimdings for 2006: Table 9 Average Gross Beta in Air From Weekly Measurements, 2006 Nine Stations Near the Indian Point Plant Indicator Average, all stations Range of averages, nine stations Lowest/highest weekly averages (6/13, 12/12)First 23 weeks/Last 29 weeks Lowest/highest period (4/25-6/13, 11/7-12/19) Result 13.02 12.59- 13.43 3.67 -25.00 10.67 -14.89 (+40%)8.07 -23.76 All measurements are in picocuries of gross beta per cubic meter of air, multiplied by 1000. The error margin for each measurement is +/- .0001. A total of 466 measurements were taken in 2006.Source: Annual Environmental Radiological Operating Report, available at www.nrc.gov The average of gross beta for all nine stations in 2006, covering 466 individual measurements is 13.02 picocuries per cubic meter of air (actually .001302 x 1000).Average readings are relatively consistent from station to station; the lowest is 12.59 and the highest is 13.43.Perhaps the most noteworthy pattern observed in these data is the wide variation over time. The average for the last 29 weeks of the year was 40% greater than the first 23 weeks. The average during the late autumn (23.76 for the seven weeks November 7 to December 19) was nearly triple that of the late spring (8.07 for the eight weeks April 25 to June 13). These patterns are consistent among the nine stations, and cover hundreds of readings, suggesting they are due to changes in man-made radioactivity from Indian Point.C. Radioactivity Levels in Bodies near Indian Point. The question of how much man-made radioactivity enters human bodies was first considered in the 1950s, when the U.S.government sponsored studies that measured bone and teeth samples for Strontium-90, one of the 100-plus chemicals found in nuclear weapon explosions and nuclear reactor operations. A landmark study of baby teeth in St. Louis found that the average Sr-90 level for children born in 1964 (just as atomic bomb testing was stopped) was about 50 times greater than for children born in 1950. Furthermore, Sr-90 studies found that average concentrations in bodies plunged by about half from 1964 to 1969, after large-scale weapons testing in the atmosphere was banned. Similar studies of Sr-90 in bone and teeth in Europe found similar patterns. (Sources: Rosenthal HR. Accumulation of environmental strontium-90 in teeth of children. In: Proceedings of the Ninth Annual Hanford Biology Symposium, Richland WA, May 5-8, 1969. Washington DC: U.S. Atomic Energy Commission, 1969.Health and Safety Laboratory, U.S.Atomic Energy Commission. Strontium-90 in Human Vertebrae. In: Radiation Data and Reports, monthly volumes, 1964-1969). Government officials dropped their in-body radiation monitoring programs in 1970, 1971, and 1982. No studies measuring in-body levels near U.S. nuclear plants existed until 1996, when the independent research group Radiation and Public Health Project initiated an effort measuring Sr-90 in baby teeth, as did the earlier project in St. Louis.RPHP used a machine designed to measure low-dose radioactivity levels and selected the REMS radiochemistry lab of Canada to establish protocols and test teeth.The lab calculated the ratio of Sr-90 to calcium, and RPHP converted it to a ratio at birth, using the Sr-90 half life of 28.7 years. Most Sr-90 in a baby tooth is taken up during the last six months of pregnancy and the first few months of life. A tooth from a person age 28.7 years with a current ratio of 4.30 would have an at-birth ratio of 8.60. Teeth were classified according to where the mother lived during pregnancy and the first year of life, not the current residence. RPHP has tested nearly 5,000 baby teeth, and published five medical journal articles on results. A comprehensive analysis of the study found that average Sr-90 in baby teeth were 30-50% higher in counties closest to six U.S. nuclear plants, and that average levels rose about 50% from the late 1980s to the late 1990s (reversing a prior decline), as reactors aged and were in operation more frequently. Results were statistically 12 3 7 5-significant, suggesting strongly that emissions from nuclear reactors were entering bodies of local humans. (Source: Mangano JJ et al. An unexpected rise in Strontium-90 in US deciduous teeth in the 1990s. The Science of the Total Environment 2003;317:37-51). Over 500 teeth were collected and tested from the New York metropolitan area partly supported by a $25,000 grant from the Westchester County legislature. Over half were from the four counties closest to Indian Point -Westchester, Rockland, Orange, and Putnam. The average local Sr-90 level was the highest in the area, and the highest of near six U.S. nuclear plants. Average Sr-90 decreased with distance from the plant, i.e., New York City was lower than the local area, and Long Island was lower than New York City (Table 10).Table 10 Average Concentration of Strontium-90 in Baby Teeth, At Birth New York City Metropolitan Area Region Teeth Average Sr-90 4 Cos. Near Indian Point 279 3.78 New York City 161 3.10 Long Island 94 2.75 Average = picocuries of Sr-90 per gram of calcium at birth. Only births after 1979 included.Source:-Radiation and Public Health Project Increases in average Sr-90 in baby teeth over the past decade were also highest near Indian Point. Children born in the late 1990s in the four-county area had a 38% greater average Sr-90 level than those born in the late 1980s, while the changes in New York City and Long Island were +36% and -11%, respectively (Table 11).Table 11 Change in Average Concentration of Strontium-90 in Baby Teeth, At Birth New York City Metropolitan Area, 1986-89 to 1994-97 Average Sr-90 (no. teeth)Area b. 1986-89 b. 1994-97 % Change 4 Cos. Near Indian Point 3.31 (55) 4.55 (77) +38%New York City 2.67 (51) 3.62 (32) +36%Long Island 3.33 (20) 2.98 (20) -11%Average = picocuries of Sr-90 per gram of calcium at birth.Source: Radiation and Public Health Project While the tooth study provided some unique and important data, it is difficult to demonstrate exactly how the Sr-90 entered children's bodies. (Some is taken from the mother's bone stores, some is through the mother's diet during pregnancy, and some through the baby's diet during infancy). Sr-90 enters bodies through milk, water, vegetation, and breathing. The study limits do not, however, negate the importance of 13 3 7tC consistent and significant findings Of high and rising levels of radioactivity closest to Indian Point.The preceding data documenting high emissions from Indian Point, high levels in the local environment, and high/rising levels in local bodies raise questions about whether the health of local residents have been hanmed.IV. Potential Health Risks from Indian Point A. Prior Studies. Health risks from Indian Point have been virtually unstudied. The only national study of cancer rates near U.S. nuclear plants was conducted in the late 1980s by the National Cancer Institute. The study examined changes in cancer death rates before and after the startup of 62 plants, including Indian Point.Because Indian Point 1 began operating in 1962, the NCI study compared death rates in Westchester and Rockland Counties with the U.S. rate for the periods 1950-1962 and 1963-1984. Aggregate results were published in the New England Journal of Medicine in March 199 1. Table I11 provides results for the two counties.Table 11 Change in Cancer Mortality Rates, By Type of Cancer Westchester/Rockland Counties vs. U.S., 1950-1962 to 1963-1984 increases (6) No Change (2)i Decreases (6)Bone and Joint Brain Bladder Childhood (age 0-19) Breast Colon and Rectum Hodgkin's Disease Leukemia.Other Lymphomna Liver Stomach Lung, Bronchus, Trachea Thyroid Multiple Myeloma Source: Jablon S. et al. Cancer Mortality in Populations Living Near U.S. Nuclear Facilities. National Cancer Institute, U.S. Department of Health and Human Services, N[H Pub. No. 90-874. Washington DC: U.S. Government Printing Office, 1990.Results of the NCI study are mixed, as rates of six types of cancer increased and six types decreased in Westchester and Rockland Counties. However, no data are examined after 1984, which makes the study outdated. In addition, the fact that only cancer deaths, not cancer cases, were examined suggests it did not comprehensively address cancer risk.In 2003, a medical journal articles examined childhood cancer incidence (cases) near 14 nuclear power plants in the eastern U.S., covering the period 1988-1997, during which nearly 4000 cases were diagnosed. The article found that cancer rates in children age 0-9 exceeded the national rate in all 14 areas near nuclear plants. One of the 14 areas was Indian Point (Westchester and Rockland Counties), which exceeded the U.S. by 17.4%.The excess was of borderline statistical significance (p<.0 8 , when p<z.05 is considered significant). The article also examined mortality for children age 0-9 during this period.The Westchester/Rockland death rate was 1.4% above the U.S., not a significant excess.14 3 2 Table 12 Childhood Cancer Incidence and Mortality Rates Westchester/Rockland Counties vs. U.S., 1988-1997 Rate/i 00,000 Coil=Cases/Deaths % +1- U.S.Incidence Westchester 18.39 (190) +18.6 Rockland 17.63( 63) +13.7 TOTAL 18.20 (253) +17.4 Mortality Westchester 3.-38 (39) -3.2 Rockland 4.01 (16) +14.8 TOTAL 3.55 (55) + 1.4 Sources: Mangano JJ et al. Elevated childhood cancer incidence proximate to U.S. nuclear power plants.Archives of Environmental Health 2003 ;58(2)-.74-83. These studies, while providing helpful data, fall far short of addressing any potential connection between Indian Point emissions and local risk of cancer. Much more detailed and updated analyses are needed, especially as federal regulators examine the application to extend the licenses of the Indian Point 2 and 3 reactors for an additional 20 years.B. Defining Local Population. While there is no uniform definition of what is meant by the "local" area around Indian Point, any study should include some or all of the four counties that flank the plant. Westchester County, the site of the site, lies to the east and southeast, while Rockland County lies to the west and southwest. These two counties were recognized by the National Cancer Institute as the "local" counties near Indian Point. In addition, Putnam County (just to the northeast) and Orange County. (just to the northwest) can be considered, although area totals will largely reflect Westchester and Rockland counties, which are much more populated. Most residents of these counties live within 20 miles of Indian Point.Several demographic characteristics that can affect health risk in counties closest to Indian Point are given in Table 13.15 Table 13 Selected Demographic Characteristics Counties Closest to Indian Point vs. the U.S. and NY State Characteristic 2006 population 1950 population U.S.299.4m 150.4m NYS 19.3m 14.9m 4 Cos 1721315 887654 West. Rock.949355 294965 625816 89276 Put.100603 20307 Orange 376392 152255 2005 % black 2005 % Hispanic/Latino 2000 % Foreign born 2000 % English not spoken*2000 % >25 HS grad 2000 % >25 College grad 2004 % below poverty 2000 % Homeownership 12.8 17.4 12.6 14.4 16.1 15.8 11.1 20.4 17.9 17.9 28.0 25.5 80.4 79.1 83.9 24.4 27.4 35.9 12.7 14.5 9.0 66.2 53.0 64.9 14.9 11.9 2.6 10.2 18.0 12.2 9.2 14.9 22.2 19.1 8.8 8.4 28.4 29.9 13.2 18.2 83.6 85.3 90.2 81.8 40.9 37.5 33.9 22.5 8.9 9.5 4.5 10.2 60.1 71.7 82.2 67.0* Language other than English spoken at home, age 5+Source: U.S. Bureau of the Census, www.census.gov, your gateway to the 2000 census, state and county quick facts.The current population of the four-county area is over 1.7 million, which has nearly doubled in the past half century. Compared to the U.S. and New York State, the local educational level is higher, while the percentage of minorities and persons living in poverty are lower. Thus, there are no apparent characteristics in the area suggesting elevated disease risk. The presence of world-class medical care in New York City is another factor suggesting local disease rates should not exceed state and national levels.C. Cancer Incidence.

1. All Cancers Combined.

The New York State Department of Health has made cancer incidence data available on the Internet for small areas, including counties and zip codes.The most recent data covers the period 2000-2004. Table 14 displays cancer incidence rates for the four counties, compared to the U.S. and New York State rates, diagnosed during.2000-2004, for all cancers combined.16_329 Table 14 Incidence, All Cancers Combined Four Counties Near Indian Point vs. U.S. and NY State, 2000-2004% Local +/-US NYS Significance* vs. US vs. NYS Excess Cases vs. US vs. NYS County Males Westchester Rockland Putnam Orange 4 COS.Females Westchester Rockland Putnam Orange 4 COS.TOTAL ALL Rate/100,000 577.6 (12608)613.8 3991)619.0 1244)590.1 ( 4067)21910 442.4 (12822)459.7 (3750)501.5 1255)474.4 4166)21993 43903+ 3.9+10.4+11.4+ 6.2++++1.1 7.5 8.4 3.3<.003*<.001*<..01"<. .01"< .37<.002*< .05*< .15 492 415 142 252 1301 975 443 275 637 2330 3631 139 299 105 134 677+ 7.6+11.8+21.9+15.3+ 3.5+ 7.6+17.3+11.1<.001*<.001*<.001*<.001*<.006*<.002*<.001*<.001 449 285 217 462 1413 2090 Excess cases derived by multiplying percent over US/NYS by number of cases.* Excess significant if p <.05. Rates Adjusted to 2000 U.S. standard population. NYS rates for males/females = 571.1,427.4. U.S. rates (17 states and cities) = 555.8,411.3. Sources: New York State Department of Health. www.nyhealth.gov/statistics/cancer/reu istry. Surveillance Epidemiology and End Results, www.seer.cancer.gov. The cancer incidence rate in each county exceeds the U.S. and state rates, for both genders (greater for females). In nearly all cases, the excess was statistically significant. If the rate for each county had been equal to the national and state rates, 3631 and 2090 fewer cancer cases, respectively, would have been diagnosed during 2000-2004.

2. Childhood Cancers. Children are especially vulnerable to the toxic properties of radiation exposure.

Thus, childhood cancer is likely the most-studied disease near nuclear plants.The New York State Cancer Registry also makes available county-specific cancer incidence data for children, defined as those diagnosed before age 20. Table 15 lists childhood cancer incidence for each of the 22 most populated counties in New York State, which accounts for 86% of the state's population, for 2000-2004. Each county has at least 140,000 residents. 17 Table 15 Cancer Incidence, Children Age 0-19 Largest Counties in New York State, 2000-2004 County Rate/100.000 Pon (No. cases)1. Rockland 2. Niagara 3. Westchester

3. Nassau 5. Suffolk 6. Manhattan 7. Schenectady

8. Orange 9. Rensselaer

10. Oneida 11. Staten Island 12. Brooklyn 13. Erie 14. Ulster 15. Queens 16. Dutchess 17. Monroe 18. Broome 19. Saratoga 20. Bronx 21. Albany 22. Onandaga 21.6 (94)21.1 ( 60)20.3 (254)20.3 (357)20.0 (401)19.8 (300)18.5( 36)18.0 (98)17.9( 36)17.8 ( 53)17.7( 88)17.2 (620)17.0 (209)16.9( 38)16.5 (456)16.5( 63)16.4(168)15.0( 40)14.8 ( 40)14.7 (322)14.2( 54)13.0( 83)4 Local Counties 20.0 (471)Putnam 19.4 (25)NY State 17.8 U.S. 16.4 (Each of the 22 counties has over 140,000 residents

= 86% of 2000 NY State population) Source: NY State Department of Health, www.nyhealth .gov/statistics/cancer/registry The table reveals that childhood cancer incidence in each of the four counties near Indian Point exceeds state and national rates. Rockland, Westchester, and Orange Counties have the , 3 rd, and 8th highest rates, respectively, of the 22 largest counties in the state (the number of cases in each of the other counties are likely to be too small to be significant). If Putnam County were large enough, it would have the 7h highest rate.A total of 471 children in the four counties were diagnosed with cancer from 2000-2004. The rate of 20.0 cases per 100,000 children exceeds the state and nation by 12% and 22%, respectively. The excesses is of borderline significance (p<.08) compared to the state, and significantly above the U.S. (p<.003).3. Thyroid Cancer. The specific type of cancer most strongly linked with radiation exposure is cancer of the thyroid gland. Radioactive iodine found only in atomic bomb fallout and nuclear reactor emissions seeks out the thyroid when it enters the body, and destroys and injures healthy cells.18 Aside from exposure to ionizing radiation, experts have yet to conclusively identify risk factors for thyroid cancer. Thyroid cancer is the fastest-rising type of malignancy in the U.S.; the incidence rate has more than doubled since 1980, for young, middle age, and elderly adults (the disease is very rare in children). This trend, plus the sensitivity of the thyroid gland to radiation, makes it logical to examine thyroid cancer incidence near the Indian Point plant. Tables 16 and 17 show 2000-2004 thyroid cancer incidence rates for the most populated counties in New York State, for males and females.Table 16 Thyroid Cancer Incidence, Males, All Ages Largest Counties in New York State, 2000-2004 County 1. Rockland 2. Suffolk 3. Orange 4. Staten Island 5. Westchester

6. Nassau 7. Dutchess 8. Manhattan 9. Onandaga 10. Oneida 10. Saratoga 12. Niagara 13. Monroe 14. Erie 15. Broome 15. Queens 15. Brooklyn 15. Schenectady

19. Albany 20. Bronx 21. Ulster 22. Rensselaer Rate/100,000 Pop (no. cases)10.0 (70)7.1 (254) Putnam 8.6 (20)6.7 (56) 4 Local Counties 7.4 6.4( 71)6.1 (141)6.0 (204)5.9 ( 44)5.8 (224)5.5 ( 60)5.4 ( 33)5.4( 28)5.0( 28) NYS 5.0 4.6( 81)4.3 (102) U.S. 4.3 4.1 ( 21)4.1 (215)4.1 (217)4.1 (15)3.9( 28)3.7( 94)3.6(17)2.6( 10)(Each of 22 counties has over 140,000 residents

= 86% of 2000 NY State population) Rates adjusted to 2000 U.S. standard population Source: NY State Department of Health, www.nyhealth.zov/statistics/cancer/registry 19 Table 17 Thyroid Cancer Incidence, Females, All Ages Largest Counties in New York State, 2000-2004 CouLnty 1. Orange 2. Rockland 3. Oneida 4. Saratoga 5. Westchester

6. Schenectady

7. Suffolk 8. Nassau 9. Niagara 10. Dutchess 11. Broome 12. Onandaga 13. Staten Island 14. Erie 15. Albany 16. Manhattan 17. Queens 18. Rensselaer

19. Monroe 20. Ulster 21. Brooklyn 22. Bronx Rate/100,000 Pop (No. cases)25.9 (229)25.3 (192) 4 Local Counties 21.3 19.4 (116) Putnam 20.6 (54)18.4(102)17.2 (440)17.1 ( 66)16.9 (657)16.8 (516)16.7( 96)15.8 (116)15.6( 81)15.1(181)15.0 (186)14.5 (368)13.9 (109) NYS 13.8 12.8 (590)12.7 (778)12.0 ( 49) U.S. 12.5 11.8 (228)11.3( 54)11.1 (737)9.7 (338)(Each of 22 counties has over 140,000 residents

= 86% of 2000 NY State population) Rates adjusted to 2000 U.S. standard population Source: NY State Department of Health, www.nyhealth.2ov/statistics/cancer/registry The data show dramatically elevated rates of thyroid cancer incidence in the counties closest to Indian Point. The 4 county rate is 72% and 70% higher than the U.S. for males and females (7.4 vs. 4.3 and 21.3 vs. 12.5). While the Health Department web site does not combine rates for both genders, it appears that Rockland and Orange Counties have the highest rates of any large county in the state, followed closely by Westchester and Putnam Counties. The rate in Rockland County is approximately double that of the U.S.While thyroid cancer is not among the most common types of cancer, the total of 1202 cases diagnosed in the region from 2000-2004 makes the excess statistically significant, and worthy of further analysis.4. Breast Cancer. Another type of cancer known to sensitive to radiation exposure is breast cancer. In 1994, a report on over 200,000 survivors of the atomic bombs used on Hiroshima and Nagasaki documented elevated rates of many types of cancer in those who received highest doses. Breast cancer in females had the highest excess (20%) of any 20 type of cancer, except for thyroid cancer (34%). (Source: Thompson DE et al. Cancer Incidence in Atomic Bomb Survivors. Part II: Solid Tumore, 1958-1987. Radiation Effects Research Foundation, Hiroshima Japan, 1994).The incidence of breast cancer in the Indian Point area during the most recent five years, as posted on the state Health Department web site, is given in Table 18: Table 18 Cancer Incidence, Female Breast Four Counties Nearest Indian Point vs. U.S. and NY State Coqntl 2000-2004 Westchester Rockland Putnam Orange TOTAL Period 1976-1979 1980-1984 1985-1989 1990-1994 1995-1999 2000-2004 Rate/100,000 (Cases)136:3 (3870)133.7 (1094)141.5( 373)132.5 (1165)135.3 (6502)Rate/100,000 (Cases)102.9 (3144)108.3 (4264)120.0 (4955)128.2 (5490)139.4 (6238)135.3 (6502)% Local is +/-U.S. NYS+ 6.7 + 7.8+ 4.6 + 5.8+10.7 +11.9+ 3.7 + 4.8+ 5.9 + 7.0% Local is +/-NY State+1.9+2.6+2.5+2.7+3.9+7.0 Excess Cases vs US vs NYS 259 50 38 43 390 302 63 44 56 465 Excess Cases vs NY State 59 109 123 150 242 465 Excess cases derived by multiplying percent over US/NYS by number of cases.Rates Adjusted to 2000 U.S. standard population. NYS rate = 126.4. U.S. rate (17 states and cities) = 127.8 Sources: New York State Department of Health. www.nyhealth.gov/statistics/cancer/registry. Surveillance Epidemiology and End Results, www.seer.cancer.gov. Breast cancer incidence was greater than the state and nation for each county. The four-county excess was 7.0% and 5.9%, respectively. Of the total of 6502 breast cancer cases diagnosed during the period, 390 to 465 are in excess of the national and state rates, respectively. The only excesses that are statistically significant are those for Westchester and the four-county total.In addition, the gap between the four-county and state rates of breast cancer incidence has grown in the past three decades. The excess of 1.9% in the late 1970s has increased to 7.0% in the early 2000s. The number of breast cancer cases diagnosed annually has risen from about 800 to 1300 during this time.5. Most Common Cancers, by Zip Code. The state Health Department has also made available cancer incidence data by each zip code in New York State, for the five year 21 period 1999-2003. The data only cover the four most common types of cancer: (female)breast, colorectal, lung and bronchus, and (male) prostate. These account for about 55%of all newly-diagnosed cancer cases in the U.S. Actual cases are compared with the number expected if the rate in the zip code equaled the state rate for each age group.Table 19 displays the number of cancer cases for the six zip code areas closest to Indian Point, all within about five miles of the plant. Three of these are in Rockland County and three are in Westchester County.Table 19 Cancer Incidence, Breast/Colorectal/Lung/Prostate Cancers Six Zip Code Areas Closest to Indian Point vs. Other Westchester/Rockland 1999-2003 Cancer Cases % Actual Town/Zip Code Actual Expected +/-Expected Westchester Buchanan (10511) 34 31.3 + 8.6%Peekskill (10566, 10517) 333 283.5 +17.5%Montrose (10548,10596) 73 67.4 + 8.3%3 Westchester Towns 440 382.2 +15.1% p<.06 Rockland Stony Point (10980, 10986) 254 202.8 +25.2%Haverstraw (10927) 133 112.5 +18.2%W. Haverstraw (10993) 92 66.1 +39.2%3 Rockland Towns 479 381.4 +25.6% p<.002 Total 6 Towns 919 763.6 +20.4% p<.0002 Oth Westchester/Rockland 17520 17298.2 + 1.3%Colorectal 199 163.7 +21.6% p<.06 Female Breast 214 205.0 + 4.4%Lung/Bronchus 245 187.4 +30.7% p<.004 Male Prostate 261 207.5 +25.8% p<.01 Source: New York State Department of Health. www.nyhealth.gov/statistics/cancer/registry. There were 919 cases of the four cancer types diagnosed in the towns closest to Indian Point from 1999-2003. Cancer incidence in the six towns exceeded the state rate by 20.4%, while the excess for the rest of the two counties was just 1.3%. The excess in the six towns is highly significant at p<.0 0 0 2.Local rates were significantly higher than expected for each of the four types of cancer except for breast cancer.D. Cancer Mortality.

1. All Cancers Combined.

Data for all U.S. deaths is available for the years 1979 to 2004 on the web site of the U.S. Centers for Disease Control and Prevention. The site permits 22 V5_5 analysis by age, race, sex, and cause of death, and identifies state and county of residence. It also allows death rates for clusters of counties or states to be analyzed.Table 20 displays the death rate for all cancers combined for the four-county area near Indian Point, compared to the state and nation, for the 26 year period in the data base.Table 20 Mortality, All Cancers Combined Four Counties Nearest Indian Point vs. U.S. and NY State, 1979-2004 Rate/100,000 % Local is +/- Excess Deaths Count (Deaths) U.S. NYS vs US vs NYS Westchester 205.5 (51696) -1.9 -2.4 -982 -1241 Rockland 209.1 (12970) -0.2 -0.7 91 Putnam 227.6 ( 4101) + 8.6 + 8.1 353 332 Orange 231.3 (15640) +10.4 + 9.9 1626 1548 TOTAL 211.3 (84407) + 0.9 + 0.4 971 548 Excess cases derived by multiplying percent over US/NYS by number of cases.Rates Adjusted to 2000 U.S. standard population. NYS rate = 210.5. U.S. rate = 209.5 Source: U.S. Centers for Disease Control and Prevention, http://wonder.cdc.gov, underlying cause of death.Uses ICD-9 codes 140.0-239.9 (1979-1998) and ICD-10 codes COO-D48.9 (1999-2004). The four-county area has virtually the same cancer death rate as the state and nation (+0.4% and +0.9%, respectively). The total excess deaths (548 and 971) are a small proportion of the total number of 84,407 cancer deaths in this period. Putnam and Orange Counties have higher rates, while Westchester and Rockland Counties have lower rates. The differences are all statistically significant, except for Rockland County.2. Cancer vs. Non-Cancer Mortality. While the local cancer mortality rate near Indian Point is only slightly higher than the state and national rates, this pattern takes on different meaning after analyzing local death rates for other causes. Table 21 shows the local mortality rates for cancers and all other causes combined, for each age group.For all but the elderly, the local rate of all non-cancer deaths was 21% to 26% below the U.S. standard, a large variation from the slight elevation in cancer deaths. If the local cancer mortality rate had been below the U.S. like it was for other causes, a total of 8,799 fewer cancer deaths would have occurred from 1979-2004 in the four counties.23 Table 21 Mortality, Cancer vs. All Other Causes Four Counties Nearest Indian Point vs. U.S. by Age, 1979-2004 Deaths % +/- U.S. Excess Age Cancer Other Cancer Other Ca. Deaths 0-24 614 9157 + 2.6-26.2 177 25-44 3343 13708 + 2.4-21.3 826 45-64 22804 34714 -4.8-22.3 3991 65+ 57644 192922 + 3.6- 3.0 3805 TOTAL 8799 Excess cancer deaths derived by multiplying percent over US by number of deaths.Rates Adjusted to 2000 U.S. standard population. Source: U.S. Centers for Disease Control and Prevention, http://wonder.cdc.gov, underlying cause of death.Uses ICD-9 codes 140.0-239.9 (1979-1998) and ICD-10 codes COO-D48.9 (1999-2004).

3. Thyroid Cancer. Thyroid cancer is one of the most successfully treated types of cancer, and thus the mortality rate for this disease is very low. In the period 1979-2004, a total of 241 residents of the four local counties died of thyroid cancer. The death rate of 0.607 per 100,000 was 32.6% and 13.9% greater than the U.S. and New York State, respectively.

The difference with the U.S. is statistically significant at p<.01, while the difference with New York State is not significant.

4. Correlation of Radioactivity from Indian Point with Cancer. To start examining a any correlation between radioactive emissions from Indian Point and cancer risk, RPHP compared trends in Strontium-90 in local baby teeth with trends in childhood cancer incidence age 0-9. Figure 1 includes two line graphs over a 14 year period, one each for the local trend in Putnam, Rockland, and Westchester Counties.

The childhood cancer line represents periods four years after the Sr-90 line, to test the principle that childhood cancer occurs several years after exposure to the fetus. Dr. Alice Stewart first observed this phenomenon in the late 1950s when she demonstrated pelvic X-rays to the fetus resulted in nearly a doubling in the cancer death rate before the child reached age ten.When the Sr-90 level rises, cancer incidence in children under age ten also rises.Conversely, declines in Sr-90 are followed by declines in cancer incidence. The correlation falls short of statistical significance; but similar and significant findings near the Oyster Creek and Brookhaven nuclear plants give the results credibility, and suggest that more detailed examination is merited. Source: Mangano JJ. A Short Latency between Radiation Exposure from Nuclear Plants and Cancer in Young Children. International Journal of Health Services 2006;36(1):113-35. V. Studies of improved local health after reactor shutdown A. Precedent -Atomic Bomb Test Halt. If Indian Point closes by the end of its current license in 2015, no additional radioactivity will be produced or released from the reactor core (the slow-decaying forms of radioactive waste will remain). Closing the reactor will reduce levels of these products in the environment and body.24 337 There is a precedent for such reductions. When above ground atomic bomb tests ceased after the Partial Test Ban Treaty of 1963, chemicals that decay quickly (such as Iodine-131, with a half life of eight days) virtually disappeared. Chemicals with a slower decay rate also dropped; Strontium-90 fell 75% in milk and 50% in bones from 1964-1970, according to studies conducted by the U.S. Public Health Service. (Source: Health and Safety Laboratory, U.S. Atomic Energy Commission. Strontium-90 in Human Vertebrae. In: Radiation Data and Reports, monthly volumes, 1964-1969). Reduced environmental radioactivity raises the question of whether disease rates would also decline, especially among the more, susceptible infant and children. Again, there may be precedent for such a change. The incidence of cancer age 0-4 in Connecticut, the only state which maintained a cancer registry in the 1960s, rose as large-scale bomb testing continued; from 1959 to 1962, new cases increased steadily from 41 to 60. But after testing ended, the number of cases plunged, from 60 to 30 between 1962 and 1968 (Table 22). Cancer incidence to young children can be seen as one of the most sensitive indicators of harm from radiation exposure, as these cancers often represent insults to the highly radiosensitive fetus.Table 22 Cancer Cases Diagnosed in Children Age 0-4 Connecticut, Each Year from 1959-1968 Year Cases Year Cases During Bomb Testing After Bomb Testing 1959 41 1964 53 1960 47 1965 38 1961 46 1966 43 1962 60 1967 43 1963 58 1968 30 Source: National Cancer Institute, Forty-five Years of Cancer Incidence in Connecticut: 1935-79. NIH Publication No. 86-2652. Bethesda MID: U.S. Department of Health and Human Services, 1986.B. Precedent -Nuclear Reactor Closing. Much of the radioactivity in the core of a nuclear reactor consists of chemicals that decay relatively quickly. Thus, reactor shutdown would mean a substantial decrease in routine emissions and in emissions from a core meltdown, just days after closing. A recent report calculated that a core meltdown just 20 days after shutdown of a fully operational reactor would reduce cancer deaths within 50 miles by 50% and reduce acute fatalities by 81%. Using the me-thodology from the Sandia National Laboratories 1982 study, the report estimated that a meltdown at Indian Point 20 days after the reactor closed would reduce cancer deaths 'within 50 miles from 53,960 to 26,870 and acute fatalities within 10 miles from 867 to 166. Source: Lyman ES. The Impact of Nuclear Plant Shutdown on Severe Accident Consequences. Washington DC: Nuclear Control Institute, February 12,2002.Like atomic bomb test cessation, there may be a precedent for cancer reductions after nuclear reactors close and radioactive releases end. A 2002 journal article by the 25 Radiation and Public Health Project examines reactors that closed from 1987-1998 that were at least 70 miles from any other nuclear plant. The article compared cancer incidence in children under age five in the periods prior to and after closing. For downwind areas near six closed reactors, the rate fell each time (total of -24.8%), even though there was a slight increase in the U.S. childhood cancer during this period (Table 23).Table 23 Change in Cancer Incidence Rates, Age 0-4 Counties Downwind and <40 Miles of Closed Reactors Before and After Reactor Closing Reactor LaCrosse Rancho Seco Fort St. Vrain Big Rock Point Maine Yankee Zion Year Closed 1987 1989 1989 1997 1997 1998 Counties Downwind and <40 Miles LaCrosse, Vernon WI Amador, El Dorado, Placer, Sacramento CA Larimer, Weld CO Antrim, Charlevoix, Cheboygan, Emmet, Otsego MI Kennebec, Knox, Lincoln ME Lake IL; Kenosha, Racine WI Reactor LaCrosse Rancho Seco Fort St. Vrain Big Rock Pt.Me. Yankee Zion Before Close'86-87'88-89'88-89'96-97'96-97'97-98 After Close'88-94'90-96'90-96'98-00*'98-01'99-00 Cases/100,000 (No.)Before 40.0( 7)24.0 (50)20.3 (10)45.0( 7)38.1 ( 8)21.2 (32)After 24.6( 15)17.6(153)18.0( 32)21.1 ( 5)27.2 (11)19.7 (30)% Change-38.5%-26.9%-11.7%-53.1%-28.5%-7.0%TOTAL 24.7 (114) 18.5 (246)-24.8%+0.3%U.S. ANNUAL AVERAGE CHANGE, 1986-1998 Sources: State cancer registries, in Mangano JJ et al. Infant Death and Childhood Cancer Reductions after Nuclear Plant Closings in the United States. Archives of Environmental Health 2002;57(10):23-32. Cancer reductions for people of all ages have also occurred near closed nuclear reactors.One of the largest U.S. reactors that has closed permanently is Rancho Seco, in Sacramento County CA, which closed on June 6, 1989. The four California counties within 40 miles downwind (east) of Rancho Seco have a population of 1.9 million, roughly equal to the four counties surrounding Indian Point. This part of California also has approximately the same percentage of minorities, foreign born residents, educational levels, and poverty levels as does the U.S.In the 1980s, while Rancho Seco was operating, the local cancer death rate was higher than the U.S. But in the 1990s and 2000s, after shutdown, levels abruptly moved below the U.S. The difference between the actual (lower) cancer death rates and an expected 26 3~c~ continuation of previous rates equals 3225 fewer local cancer deaths from 1990-2003 (Table 24).Table 24 Reduction in Cancer Deaths, All Ages Counties East and Under 40 Miles of Rancho Seco (Amador, El Dorado, Placer, Sacramento) Before and After Reactor Closing, June 1989 Cancer Local U.S.Deaths Rate Rate% Local +/- US Actual Expected Expected Deaths Reduced Deaths Period Before Shutdown 1979-83 1984-89 After Shutdown 1990-98 1999-03 9212 215.6 210.3 +2.52% ----13609 222.7 215.0 +3.56%24138 204.9 213.1 -3.86% +4.60%15968 197.1 200.6 -1.77% +5.64%26180 17151 43331 2042 1183 3225 POST-SHUTDOWN TOTAL 40106 Note: If the increase of local cancer death rate excess from 2.52% (1979-83)continued, it would have reached 4.60% in 1990-98, 5.64% in 1999-03.Expected deaths for 1990-98 = 24138 * (1 +(.046 + .0386)) = 26180 Expected deaths for 1999-03 = 15968 * (1 +(.0564 + .0177)) = 17151 Reduced deaths for 1990-98 = 26180 -24138 = 2042 Reduced deaths for 1999-03 = 17151 -15968 = 1183 to 3.56% (1984-89) had Source: U.S. Centers for Disease Control and Prevention, http://wonder.cdc.gov. underlying cause of death. Uses lCD-9 cancer codes 140.0-239.9 (1979-1998) and ICD-10 cancer codes COO-D48.9 (1999-2003). All rates adjusted to 2000 U.S. standard population. California counties include Amador, El Dorado, Placer, and Sacramento. Reductions in cancer after reactor closing may reflect various contributing factors other than reduced radioactivity. However, no other factors in the Rancho Seco area accounting for this significant trend are apparent.C. Potential Cancer Reduction After Indian Point Closing. To the extent, if any, that elevated local rates of cancer are caused by Indian Point's radioactive releases, closing the reactors could result in a decrease in cancer incidence and mortality. If cancer death rates in the four counties within 20 miles of Indian Point declined at a similar rate as in the four counties near the closed Rancho Seco reactor, the reduction in cancer deaths from 2016 to 2035 would be 5,203 (Table 25).27 Table 25 Reduction in Cancer Deaths, All Ages Orange, Putnam, Rockland, and Westchester Counties If Similar Patterns Near Rancho Seco Were Duplicated Estimate for 20 Year Period 2016-2035 Assumptions:

1. Change in local and U.S. cancer death rates is -1%/year 2. Change in local population is +1%/year 3. Decline in local rate vs. U.S. is -8.02%, based on-Rancho Seco went from an expected +4.60% to an actual -3.86% in 1990-98 (-8.46%)-Rancho Seco went from an expected +5.64% to an actual -1.77% in 1999-03 (-7.41%)-Weighted average difference in actual vs. expected cancer death rates = 8.02%Calculations:

Actual cancer deaths in 10 year period 1995-04 32,438 Expected cancer deaths in 20 year period 2016-35 (32,110 x 2) 64,876 Reduction in deaths (expected deaths x reduction (64,220 x .0802) 5,203 Source: U.S. Centers for Disease Control and Prevention, http://wonder.cdc.gov, underlying cause of death. Uses ICD-9 cancer codes 140.0-239.9 (1995-1998) and ICD-10 cancer codes COO-D48.9 (1999-2004). VI. Summary anad Policy Implications The preceding report covers two subjects: (potential and actual) radioactive contamination from the Indian Point reactors in the local environment, and potential health risks to local residents. Several analyses estimate that a large-scale release of radioactivity, either from mechanical failure or act of sabotage, would harm thousands, either through acute radiation poisoning or cancer.In addition, environmental contamination from Indian Point may have already caused harm. Evidence of contamination includes reported environmental emissions from the reactors; reported levels of radioactivity in the environment; and Strontium-90 detected in local baby teeth. Official data from state and federal regulators of nuclear plants were used for emissions and environmental levels, while a novel study by the Radiation and Public Health Project was used for data on baby teeth. RPHP published five medical journal articles on the study.The Indian Point reactors historically have emitted greater amounts of radioactivity into the environment than most U.S. plants. These emissions appear to be unpredictable, as wide variations in environmental radioactivity levels near Indian Point over time suggest.The baby tooth study, while it cannot exactly track all pathways of Sr-90 into local bodies, does document relatively high (compared to other areas) and rising levels of the isotope in counties closest to Indian Point.Cancer data were obtained from the New York State Cancer Registry (for cancer incidence from 2000-2004) and from the U.S. Centers for Disease Control (for cancer mortality from 1979-2004). The local area near Indian Point was defined as the counties within 20 miles (Orange, Putnam, Rockland, and Westchester). The results show that: 28-39i -The elevated local incidence rate, compared to the state and nation, suggests between 2090 and 3631 "excess" cancer cases occurred locally from 2000-2004-Childhood cancer incidence in the four local counties is among the highest in New York State, and well above the national rate-Thyroid cancer incidence in the four local counties is among the highest in New York State. The level in Rockland County is approximately double the U.S. rate The local breast cancer incidence rate exceeds the state and nation, and the excess is growing over time-Incidence of the four most common types of cancer in the six towns within five miles of Indian Point is 20% greater than the rest of Rockland and Westchester Counties.-The local mortality rate is well below the U.S. for all causes (for each age group)except for cancer, which is slightly higher.-There is a statistical link between average levels of Strontium-90 in local baby teeth and local childhood cancer rates.It is important to understand that this report presents data that suggest -but not yet prove-that Indian Point emissions are causing cancer. Many factors contribute to cancer risk, and radiation exposure is just one. However, the data raise questions about a potential link, on a topic has been virtually ignored in the 45 years that Indian Point has operated.The costs to society of high cancer rates are enormous, including direct medical costs and lost productivity from otherwise healthy members of society.Given that federal regulators are about to review an application by Entergy Nuclear for permission to extend the operating licenses of the two Indian Point reactors for another 20 years, a prudent policy would be to conduct further study and not to grant any extension until the public better understands to what extent, if any, the threat that Indian Point presents to local public health.29;cI2.- EXHIBIT UU .UNITED STATES NUCLEAR REGULATORY COMMISSION In the miatter of ENTERGY NUCLEAR INDIAN POINT 2, L.L.C., and ) License No. DPR-26 ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. ) License No. DPR-64 Indian Point Energy Center Unit 2 and ) Docket No. 50-247 Indian Point Energy Center Unit 3 ) Docket No. 50-286 License Renewal Application )DECLARATION OF Joseph J. Mangano My name is Joseph J. Mangano; I live in Ocean City NJ., 150 miles from Indian Poin~t.Westchester Citizen's Awareness Network represents my interests in a Petition for Leave to Intervene, Request for Hearing and Contentions; and the Notice of Appearance, in the matter of Entergy Nuclear Indian Point 2, LLC, Entergy Nuclear Indian Point 3, LLC and Entergy Nuclear Operations, Inc., License Renewal Application. I declare uinder penalty of perjury that the following statement is true and correct.Executed this 27"' day of November, 2007, at Ocean City, NJ.Joseph J. Mangano State of New Jersey County of Cape May On the 27" day of November, in the year 2007 before me, the undersigned, personally appeared -ri .. V4\, ,, , , personally known to me or proved to me on the basis of satisfactory evidence to be the individual(s) whose name(s) is (are)subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted, executed the instrument. Joseph,,.. Mangano N~otar)ý Public 401ARY PUK-i~dI ~NE'F 03ERS, I UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 2, L.L.C., and ) License No. DPR-26 ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. ) License No. DPR-64 Indian Point Energy Center Unit 2 and ) Docket No. 50-247 Indian Point Energy Center Unit 3 ) Docket No. 50-286 License Renewal Application )DECLARATION OF Joseph J. Mangano My name is Joseph J. Mangano; I live in Ocean City NJ., 150 miles from Indian Point.Rockland CouLnty Conservation Association represents my interests in a Petition for Leave to Intervene, Request for Hearing and Contentions; and the Notice of Appearance, in the matter of Entergy Nuclear Indian Point 2, LLC, Entergy Nuclear Indian Point 3, LLC and Entergy Nuclear Operations, Inc., License Renewal Application. I declare under penalty of perjury that the following statement is true and correct.Executed this 2 7"' day of November, 2007, at Ocean City, NJ.Joseph J. Mangano State of New Jersey County of Cape May On the 27"' day of November, in the year 2007 before me, the. undersigned, personally appeared Lc , .IV\ ,.i'M \. \; , personally known to me or proved to me on the basis of satisfactory evidence tb be the individual(s) whose name(s) is (are)subscribed to the within instrument and acknowledged to me that he/shedthey executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted, executed the instrument. Notary Public JI *t J, Mangi a no iiJoseph-J. Mangano:i .-E F NFX JIMEY-X?!RES MIA1C 19, 2010 I UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 2,' L.L.C., and ) License No. DPR-26 ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. ) License No. DPR-64 Indian Point Energy Center Unit 2 and ) Docket No. 50-247 Indian Point Energy Center Unit 3 ) Docket No. 50-286 License Renewal Application )DECLARATION OF Joseph J. Mangano My name is Joseph J. Mangano; I live in Ocean City N.J., 150 miles from Indian Point.Public Health and Sustainable Energy represents my interests in a Petition for Leave to Intervene, Request for Hearing and Contentions; and the Notice of Appearance, in the matter of Entergy Nuclear Indian Point 2, LLC, Entergy Nuclear Indian Point 3. LLC and Entergy Nuclear Operations, Inc., License Renewal. Application. I declare under penalty of perjury that the following statement is true and correct.Executed this 2 7"' day of November, 2007, at Ocean City, NJ.Joseph i. Mangano State of New Jersey County of Cape May On the 2 7 t day of November, in the year 2007 before me, the undersigned, personally appeared7 t 1 j. ý v:i L ., personally known to me or proved to me on the basis of satisfactory evidence to be the individual(s) whose name(s) is.(are)subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted.executed the instrument. ., --;.,, .,*".. .--- .Notary Public t *Joseph J. Mangano JOSU14 IRE MMA NOTARY PUSUC STATE Of NEW JERSEY My Co. ,,InS,., MARCH 19,2010 I UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 2, L.L.C., and ) License No. DPR-26 ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. ) License No. DPR-64 Indian Point Energy Center Unit 2 and ) Docket No. 50-247 Indian Point Energy Center Unit 3 ) Docket No. 50-286 License Renewal Application )DECLARATION OF Joseph J. Mangano My name is Joseph J. Mangano; I live in Ocean City NJ., 150 miles from Indian Point.Sierra Club -Atlantic Chapter represents my interests in a Petition for Leave to Intervene, Request for Hearing and Contentions; and the Notice of Appearance, in the matter of Entergy Nuclear Indian Point 2, LLC, Entergy Nuclear Indian Point 3. LLC and Entergy Nuclear Operations, Inc., License Renewal Application. [ declare under penalty of perjury that the following statement is true and correct.Executed this 27"1' day of November, 2007, at Ocean City, NJ.Joseph .. Mangano State of New Jersey County of Cape May On the 27". day of November, in the year 2007 before me, the undersigned, personally appeared -.& -v t,---\ ,, , personally known to me or proved to me on the basis of satisfactory evidence td be the individual(s) whose name(s) is (are)subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of.which the.individual(s) acted, executed the instrument. Joseph J; Mangano Notary Public SM~ DECLARATION OF JOSEPH MANGANO 1. My name is Joseph Mangano. The Westchester Citizens Awareness Network (WESCAN), Rockland County Conservation Association (RCCA), Public Health and Sustainable Energy (PHASE) and the Sierra Club-Atlantic Chapter, have retained me as a consultant with respect to the above-captioned proceeding. I am a health researcher, and have worked with the Radiation and Public Health Project (RPHP) since 1989. [ currently serve RPHP as Executive Director.My work with RPHP has involved the conducting research on the risk of cancer and other disease from fission products emitted from nuclear reactors. To that end, I am the author or co-author of 23 medical journal articles that have been peer-reveiewed by experts (unknown to me) and deemed appropriate for publication. I am also the author of Low Level Radiation and Immune Damage: An Atomic Era Legacy (Lewis 1998), and co-author of The Enemy Within: The High Cost of Living Near Nuclear Reactors (Four Walls Eight Windows, 1996).For over a decade, our group has studied levels of radioactive Strontium-90 in baby teeth based on prior studies in the 1960s in the U.S. and abroad. We have tested nearly 5,000 teeth in a laboratory, and five of the journal articles I mentioned address results of the tooth study. The effort is the only attempt to examine radioactivity levels in bodies of Americans living near nuclear reactors. My curriculum vitae is attached hereto as Attachment A.2. [ submit the following comments in support of WESCAN, RCCA, PHASE, and SIERRA CLUB'S declaration.

3. Like all nuclear power reactors, Indian Point units 2 and 3 produce over 100 radioactive chemicals, or fission products, to generate electricity.

Very few of these chemicals are found in nature, but are only produced in atomic bomb explosions and nuclear reactor operations. These chemicals, which are radioactive and known to cause cancer, include Cesium- 137, Iodine- 131, and Strontium-90.

4. Like all nuclear power reactors, Indian Point 2 and 3 emit radioactivity, in the form of gases and particles, into the air and water on a routine basis. Documentation of historical levels of these emissions is found in annual reports prepared for the Nuclear Regulatory Commission.

The amount of airborne releases from Indian Point exceeds that of most other U.S. reactor, and can vary over time by a factor of 100 or more. (1) (2)5. Indian Point has also experienced unplanned releases of radioactive chemicals into the environment, documented in the official reports of radioactive emissions and environmental levels. (1) (2).6. State and federal regulatory agencies report environmental radioactivity levels near Indian Point, along the areas far from any nuclear reactor. The reports document that radioactivity levels are higher near Indian Point, and that there are large temporal variations, both indicating that emissions from Indian Point are entering the air, water and food in measurable quantities (3) (4)

7. RPHP has measured levels of radioactive Strontium-90 (Sr-90) in a laboratory for nearly 5,000 baby teeth, over 500 of who are from children in the New York mefropolitan area. Results. which are published in five medical journal articles, show that average Sr-90 levels near Indian Point are higher than any of the six nuclear plants with over 100 iteeth studied. and that average levels near Indian Point have risen sharply since the late 1980s. (5)8. Hypotheses that low dose exposures to radioactivity are harmless to humans have been documented to be incorrect by scientific research.

Nearly half a century ago, studies showing that pelvic X-rays to pregnant women raise the risk that the child will die of cancer by age ten, in both the United Kingdom and the United States, were the first to demonstrate carcinogenic effects of low dose exposures. (6) (7)9. Other official reports that counter the prevailing assumption that low dose exposures are harmless include a 1997 report by the National Cancer Institute, which estimated that up to 212,000 Americans developed thyroid cancer from lodine-131 in Nevada above-ground atomic tests, and a 2000 U.S. Department of Energy report concluding that many studies demonstrate elevated cancer risk for workers in nuclear weapons plants. (8) (9)Several recent reports from a blue ribbon panel of experts on radiation health effects, the most recent in 2005, reviewed many scholarly reports on the topic, and determined that there is no safe threshold of radiation exposure, i.e., there are health risks from even the lowest doses. (10)10. The youngest humans (fetus, infant, and young child) are more susceptible to the harmful properties of exposure to radioactive chemicals than are adults. (11)11. Official public health statistics document elevated levels of cancer incidence in the counties closest to Indian Point. (The great majority of the 1.7 million residents of Orange, Putnam, Rockland, and Westchester Counties live within 20 miles of Indian Point). From 2000-2004, the local rate was 10% greater than the U.S. average.Childhood cancer (age 0-19) was 22% higher, and thyroid cancer was 70% higher.Childhood and thyroid cancer are acknowledged to be among the cancers most susceptible to the toxic properties of ionizing radiation.

12. RPHP has documented a statistical link between trends in average Sr-90 in baby teeth and trends in cancer incidence in children age 0-9 in Westchester, Rockland, and Putnam counties.

Trends in Sr-90 were followed by similar trends in child cancer incidence four years later. Similar correlations were found in Ocean/Monmouth Counties in New Jersey (near the Oyster Creek nuclear reactor) and Suffolk County in New York (site of the Brookhaven reactors). (12)13. A forthcoming medical journal article shows that of 14 U.S. nuclear plants started since 1982, the infant and fetal death rates rose most rapidly near the Grand GulI f plant in southwest Mississippi. The area near Grand Gulf has high (relative to the U.S.)proportions of African-American residents, and its poverty level is also high. The results suggest that poor minorities are more susceptible to the toxic properties of pollutants such as ionizing radiation. (13)REFERENCES

1. Tichler J., Doty K, Lucadamo K. Radioactive Materials Released from Nuclear Power Plants, annual reports. NUREG/CR-2907.

Upton NY: Brookhaven National Laboratory. Latest volume covers annual airborne emiissions of Iodine-131 and effluents, or isotopes with a half life over 8 days, for each U.S. reactor for each year from 1970-1993.

2. U.S. Nuclear Regulatory Commission, REIRS (spell out what REIRS stands for)vwww.reirs.con/el'luent.

Presents amounts of environmental radioactive releases,. covering a variety of isotopes, for all U.S. nuclear reactors for each year from 2001-2004.

3. New York State Department of Health, Bureau of Radiation Protection.

Environmental Radiation in New York State, annual volumes.4. Annual Environmental Radiological Operating Report, Indian Point nuclear power plant, as reported to the U.S. Nuclear Regulatory Commission. www.nrc.gov.

5. Mangano .IJ et al. An unexpected rise in strontium-90 in US deciduous teeth in the 1990s. The Science of the Total Environment 2003;317:37-5

1.6. Stewart

A et al. A survey of childhood malignancies. British Medical Journal 1958;i: 1495-1508.

7. MacMahon B. Prenatal x-ray exposure and childhood cancer. Journal of the National Cancer Institute 1962;28:1 173-92.8. National Academy of Sciences.

Exposure of the American People to lodine-I 31 from Nevada Atomic Bomb Tests: Review of the National Cancer Institute Report and Public Health Implications. Washington DC: National Academies Press, 1998.9. Alvarez R. The Risks of Making Nuclear Weapons: A Review of the Health and Mortality of U.S. Department of Energy Workers. Washington DC: The Government Accountability Project and Takoma Park MD: The Health and Energy Institute, 2000.10. Committee on the Biological Effects of Ionizing Radiation (BEIR). Health Effects of.Exposure to Low Levels of Ionizing Radiation. Washington DC: National Academy Press, 2005 (latest report).11. Guidelines for Carcinogen Risk Assessment. Washington DC: U.S. Environmental Protection Agency. Risk Assessment Forum, 2005. The document estimates that early-life exposure can be about 10-fold higher than the risk of-an exposure of similar duration later in life.4

12. Mangano J.1. A short latency between radiation exposure frorn nuclear plants and cancer in young children.

International Journal of Health Services 2006;36(1):1 13-35.13. Mangano J.l. Excess Mortality After Startup of a Nuclear Power Plant in Mississippi," International Journal of Health Services (accepted, publication expected early 2008).ATTACHMENT A Joseph Mangano MPH MBA is a health researcher and Executive Director of the Radiation and Public Health Project (RPHP), which conducts research and education on health risks of nuclear reactors. Mr. Mangano has served RPFIP since 1989. He has published 23 articles in medicalz journals that have been reviewed and approved for publication by experts. He is author of the book "Low Level Radiation and Immune System Damage: An Atomic Era Legacy" (Lewis 1998). and co-author of "The Enemy Within: The High Cost of Living Near Nuclear Reactors" (Four Walls Eight Windows 1996). His work has found a consistent pattern of increased cancer rates after nuclear reactors begun operating, and decreased rates after they shut dowrn.Mr. Mangano played a major role in the RPHP study of Strontium-90 in baby. teeth, the only study ever to examine radioactivity levels in bodies of Americans living near nuclear plants.The study found the highest Sr-90 levels closest to plants, rising levels since the late 1980s, and high levels in children with cancer.Mr. Mangano has participated in 20 press conferences and presented testimony to 17 government panels. He has also written 25 editorials in U.S. newspapers in 2006-2007, most of them discussing the health risks of building new nuclear reactors. Because of his efforts, RPHP work has been extensively covered by media including The New York Times, USA Today, CNN, NPR and BBC. He received master's degrees in public health from the University of North Carolina and in business administration from Fordhamn University. EDITORIALS [N NEWSPAPERS (30): (* denotes letter, others are editorials)"Radiation Too Easily Dismissed in Cancer Study" Asbury Park (N.i) Press, 1/18/02."French Fries Don't Give You Cancer" Pottstown (PA) Mercury, 2/14/05"New Nukes Threaten Health in Illinois" Champaign (IL) News-Gazette, 1/15/06"New Nuclear Reactors are a Threat to our Children's Health" Durham (NC) Herald-Sun, 2/I 3/06"Nuclear Energy Produces Health, Safety Risks" Richmond (VA) Times-Dispatch, 4/16/06"Study Health of Neighbors of Millstone" New Haven (CT) Register, 5/23/06"New South Texas Reactors: Build Them and Risks Will Come" Houston Chronicle, 7/22/06"New Nuke Plants Hazardous to Amarillo's Health" Amarillo (TX) Globe-News, 8/18/06"Grand Gulf Raises Health Questions" Monroe (LA) News-Star, 8/20/06"A New Nuclear Facility Would Pose Health Concerns" Spartanburg (SC) Herald-J, 8/20/06"Would a New Grand Gulf Nuclear Plant Be Safe?" Jackson (MS) Clarion-Ledger, 11/12/06"Ask Your Commission to Consider Health Before Endorsing Plant" Idaho Statesman, 12/10/06"The Danger of Storing Nuclear Waste" Pottstown (PA) Mercury, 12/16/06"A New Plant on the Horizon? Weighing Risks" Orlando (FL) Sentinel, 12/22/06"Pilgrim Nuclear Plant's Cancer Menace" Providence (RI) Journal, 3/27/07"New Reactor Would Pose Health Risk" Toledo (OH) Blade, 3/28/07*"It is Time to Study All Nuclear Risks" Tuscaloosa (AL) News, 5/3 1/07*5 "Nuclear Health Risks" Fhe Huntsville (AL) Times, 6/5/07*"Study Health Risks Before Proposing New Reactors" The Palm Beach (FL) Post, 6/18/07*"Oyster Creek Regulators Can't Ignore Health Risks" Asbury Park (NJ) Press, 7/18/07"For Safety's Sake, Shut Down Oyster Creek" Newark (NJ) Star-Ledger, 8/8/07"Nuke Plants in Utah Would Pose Public Health Risk" Salt Lake City (UT)Tribune, 8/26/07'VY: Clear and Present Danger?" Brattleboro (VT) Reformer, 9/14/07"Nuclear Reactor an Unclean, Dangerous Source for Energy" Spfld. (MO) News-Leader. 9/22/07"Oyster Creek: Safety First" Trenton (NJ) Times, 9/28/07"Don't Keep Old Nuclear Plant Open in Ocean" Parsippany (NJ) Daily Record, 10/6/07"Demand Answers on Cancer Causes" Ocean County (NIJ) Observer, 10/24/07"State Should Look to Truly Clean Energy Sources" Milwaukee (WI) Journal Sentinel. 10/30/07 4& " Westchester (NY) Journal News, 11/19/07*"Demand Answers on Cancer Causes" Chattanooga (TN) Times Free Press, 11/25/07 MEDICAL JOURNAL ARTICLES, author or co-author (14): "Excess Mortality After Startup of a Nuclear Power Plant in Mississippi," hiternational .Journal of Health Services (accepted, publication expected early 2008)."A Short Latency Between Radiation Exposure From Nuclear Plants and Cancer In Young Children," International Journal of Health Services, winter 2006."Three Mile Island: Health Study Meltdown," Bulletin of the Atomic Scientists, sumnmer 2004."An Unexpected Rise in Strontium-90 in U.S. Deciduous Teeth in the 1990s," The Science of the Total Environment, Winter 2004."Elevated Childhood Cancer Incidence Proximate to U.S. Nuclear Power Plants," Archives of Environmental Health, Spring 2003."Infant Death and Childhood Cancer Reductions After Nuclear Plant Closing in the U.S.," Archives qf Environmental Health, Spring 2002."Strontium-90 in Baby Teeth as a Factor in Early Childhood Cancer," International Journal of Health Services, Fall 2000."Strontiurn-90 in Newborns and Childhood Disease," Archives. of Environmental Health, Fall 2000."Improvements in Local Infant Health After Nuclear Power Reactor Closing," Journal of Environmental Epidemiology and Toxicology, Spring 2000."The Strontium-90 Baby Teeth Study and Childhood Cancer," European .Iournal of Oncology, Fall 2000."A Rise in the Incidence of Childhood Cancer in the U.S.," ntternational .Journal of Health Services, Spring 1999."A Post-Chernobyl Rise in Thyroid Cancer in Connecticut," European Journal of Cancer Prevention, February 1996."Cancer Mortality Near Oak Ridge, Tennessee," International Journal of Health Services, Sunumer 1994.6 "Cancer in Baseball Players: A New Outbreak?" Pesticides, People. and alture, Summer 2000.LETTERS TO MEDICAL JOURNALS (6): "Childhood Leukemia Near U.S. Nuclear Plants," European JIournal of Cancer Care. accepted (publication expected early 2008)."Answering the Challenge," (response to Sen. Pete Domenici), Bulletin of the Atomic Scientists., 7/98."Low-Level Radiation Harmed Humans Near Three Mile Island," Environmental Health Per-spectives. 8/97."Childhood Leukaemia in U.S. May Have Risen Due to Fallout From Chernobyl," BMJ, 4/19/97."Chernobyl and Hypothyroidism," Lancet, 5/25/96 and 8/17/96 (response to comment)."Thyroid Cancer in the United States Since Accident at Chernobyl," BR/, 8/19/95 CONFERENCE PROCEEDINGS (3): "Chernobyl Emissions Linked to a Variety of Adverse Health Effects in the U.S." In Kohnlein W and Nussbaum R (eds.): Effects of Low Dose Ionizing Radiation. Muenster, Germany: German Society for Radiation Protection, 1998."Health Effects of Low Dose Exposure to Fission Products from Chernobyl and the Fermi Nuclear Reactor in the Population of the Detroit Metropolitan Area." In Kohnlein W and Nussbaum R (eds.): Effects of Low Dose Ionizing Radiation. Muenster, Germany: German Society for Radiation Protection, 1998."Low Level Radiation and Carcinoma of the Thyroid." In Schmitz-Feuerhake I and Lengfelder E (eds.): 100 Jahre Roentgen: Berlin, Germany: German Society for Radiation Protection, 1995.PRESS CONFERENCES (20):-Washington DC, 4/00-White Plains NY, 11/00 and 10/02-Valhalla NY, 8/03-Pottstown PA. 1/0 1, 11/03, 4/05, 5/06-Toms River NJ, 5/00 and 4/01-Mineola NY, 6/01-New York City, 7/99, 4/02, and 11/07-Trenton NJ, 5/03, 3/06, 6/07-Hackensack NJ, 11/03-Harrisburg PA. 8/04, 11/05 TESTIMONY TO GOVERNMENT OFFICIALS (17):-New York State energy advisory group .(NYSERDA), 4/02-New York City Council (Indian Point NY plant), 5/02 and 2/03-U.S. Nuclear Regulatory Commission (Harris NC plant), 7/07-U.S. Nuclear Regulatory Commission (Oyster Creek NJ plant), 7/06, 5/07-U.S. Nuclear Regulatory Commission (Peach Bottom PA plant). 7/02-U.S. Nuclear Regulatory Commission (Turkey Point FL plant), 7/01 7 Connecticut State utility commission, (Millstone CT plant) 1.1/00 U.S. Senate Environment Committee (Sen. Hillary R. Clinton), 6/01-Suffolk County (NY) legislature, Sr-90 in baby teeth, 8/00-Suffolk County (NY) Rhabdomyosarcoma task force, 2001-3-Westchester County (NY) legislature, Sr-90 in baby teeth 11/00, 10/02-New Jersey Commission on Radiation Protection, 2/05, 6/07-Ocean County (NJ) Board of Freeholders,9/07 8 EXHIBIT WW GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://w,,Aw;cao.gov/htext/dO .4654.htmi This is the accessible text file for GAO report number GAO-04-654 ntitled 'Nuclear Regulation: NRC's Liability Insurance Requirements or Nuclear Power Plants'Owned by Limited Liability Companies' which as released on June 08, 2004.This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the.end of the file, and the text of agency comment letters, are .provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Requesters: May 2004: Nuclear Regulation: DRC's Liability Insurance Requirements for Nuclear Power Plants Owned y Limited Liability Companies: [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-04-654]: GAO Highlights: Highlights of GAO-04-654, a report to congressional requesters. Why GAO Did This Study: An accident at one the nation's commercial nuclear power plants could result in.human health and environmental damages. To ensure that funds would be available to settle liability claims in such cases, the Price-Anderson Act requires licensees for these plants to have primary insurance-currently $300 million per site. The act also requires-secondary coverage in the form of retrospective premiums to be contributed by all licensees to cover claims that exceed primary insurance. If these premiums are needed, each licensee's payments are limited to $10 million per year and $95.8 million in total for each of its plants. In recent years, limited liability companies have increasingly become licensees of nuclear power plants, raising concerns about whether these companies-by shielding their parent corporations' assets-will have the financial resources to pay their retrospective premiums.GAO was asked to determine (1) the extent to which limited liability companies are the licensees for U.S. commercial nuclear power plants, (2) the Nuclear Regulatory Commission's (NRC) requirements and-rocedures for ensuring that licensees of nuclear power plants comply th the Price-Anderson Act's liability requirements, and (3) .whether nd how these procedures differ for licensees that are limited liability companies. I Af?74 1 Ald A'PIlP)7 11.nO DN.A GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://Iwww_,gaO.gov/htext/dO4654.html What GAO Found:* f the 103 operating nuclear power plants, 31 are owned by 11 limited* iability companies. Three energy corporations-Exelon, Entergy, and the Constellation Energy Group-are the parent companies for eight of these limited liability companies. These 8 subsidiaries are the licensees or co-licensees for 27 of-the 31 plants.NRC requires all licensees for nuclear power plants to show proof that they have the primary and secondary insurance coverage mandated by the Price-Anderson Act. Licensees obtain their primary insurance through American Nuclear Insurers. Licensees also sign an agreement with NRC to keep the insurance in effect. American Nuclear Insurers alsb has a contractual agreement with each of the licensees to collect the retrospective premiums if these payments become necessary. A certified copy of this agreement, which is called a bond for payment of retrospective premiums, is provided to NRC as proof of secondary insurance. It obligates the licensee to pay the retrospective premiums to American Nuclear Insurers.NRC. does not treat limited liability companies differently than other licensees with respect to the Price-Anderson Act's insurance requirements. Like. other licensees, limited liability companies must show proof of both primary and secondary insurance coverage. American Nuclear Insurers also requires limited liability companies to provide a letter of guarantee from their parent or other affiliated companies with sufficient assets to pay the retrospective premiums. These letters state that the parent or affiliated companies are responsible for paying the retrospective premiums if the limited liability company does not. American Nuclear Insurers informs NRC it has received-these letters. In light of the increasing number of plants owned by limited iability companies, NRC is studying its existing regulations and hxpects to report on its findings by the end of summer 2004.0 1n commenting on a draft of this report, NRC stated that it accurately reflects the present insurance system for nuclear power plants.www.gao.gov/cgi-bin/getrptGAO-04-654. To view the full product, including the scope and methodology, click on the link above. For more information, contact Jim Wells at 202-512-3841. [End of section]Contents: Letter: Results in Brief:

Background:

Limited Liability Companies Are Licensees for 31 of the 203 Operating Commercial Nuclear Power Plants in the United States: NRC Has Specific Requirements and Procedures to Ensure That All Licensees Comply with the Price-Anderson Act's Liability Provisions:-NRC Treats Limited Liability Companies the Same as Other Licensees, but the Insurance Industry Has Added Important Requirements for These ompanies: W-ency Comments: Scope and Methodology: GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://www.gao.gov/htext/d04654.btm] ZýAppendixes: ppendix I: Nuclear Power Plant Ownership:

• Appendix II: Comments from the Nuclear Regulatory Commission:

Table: Table 1: Limited Liability Companies Licensed to Operate Nuclear Power Plants and Their Parent Companies: Letter May 28, 2004: Congressional Requesters: An accident at one of the nation's 103[Footnote 1] operating commercial nuclear power plants could result in human health and environmental damages. The Price-Anderson Act was enacted in 1957 to ensure that funds would be available for at least a portion of.the damages suffered-by the public in the event of an incident at a U.S. nuclear power plant. The act requires each licensee of a nuclear plant to have primary insurance coverage equal to the maximum amount of liability insurance available from private sources--currently $300 million--to settle any such claims against it. In the event of an accident at any plant where liability claims exceed the $300 million primary insurance coverage, the act also requires licensees for all plants to pay retrospective premiums (also referred to as secondary insurance). Under current U.S. Nuclear Regulatory Commission (NRC) regulations, these payments could amount to a maximum of $95.8 million for each of a licensee's plants per incident. If claims for an incident exceed this approximately $10 billion currently available in primary insurance and etrospective premiums, NRC may request additional funds from the ongress. To operate a nuclear power plant, the owner must obtain a icense from NRC and meet its regulatory requirements, including those ,for liability insurance established under the Price-Anderson Act.A major aspect of the deregulation or restructuring of the U.S.electricity industry in the 1990s was the separation of electricity generation from transmission and distribution.. Utilities could create separate entities or subsidiaries to operate their generation facilities, including nuclear power plants, or could sell them off to..other companies. Energy holding companies bought some of the generation facilities, sometimes placing them under subsidiaries. The limited liability company also emerged in the 1990s as a new type of company ,structure in the United States. These companies have characteristics of both a partnership and a corporation. Like a partnership, the profits are passed through and taxable to the owners, known as members; like a corporation, it is a separate and distinct legal entity and its owners are insulated from personal liability for its debts and liabilities. You asked us to determine (1) the extent to which limited liability companies are.the licensees for U.S. commercial nuclear power plants, (2) NRC's requirements and procedures for ensurino that licensees of nuclear power plants comply with the Price-Anderson Act's liability requirements, and (3) whether and how these procedures differ for licensees that are limited liability companies. To respond to your request, we reviewed applicable sections of the Price-Anderson Act and NRC's implementing regulations and written procedures. We also held discussions with and obtained information from responsible NRC officials and representatives of American Nuclear Insurers, which is a joint underwriting association of 50 insurance companies that pr.ovides 0nsurance coverage to the nuclear power plants. These are property/sualty insurance companies licensed'to do business in at least one of he states or territories of the United States. We performed our work* between April 2003 and April 2004 in accordance with generally accepted government auditing standards. ' nf d GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...bttp://,.vww.-ao.gov/htext/d04654.htmi Results in Brief: irty-one of the 103 operating commercial nuclear power plants ationwide'are licensed to limited liability companies. Four of the 31 p ants are licensed jointly to two limited liability companies. A total o11 limited liability companies are licensed to own nuclear power plants. One--the Exelon Generation Company, LLC--is the licensee for 12 plants and co-licensee for 4 plants. The 10 other limited liability companies are the licensees or co-licensees for one to five. plants.Three energy corporations--Exelon, Entergy, and the Constellation Energy Group--are the parent companies for eight of the limited liability companies. These eight subsidiaries are the licensees or co-licensees for 27 of the 31 plants.NRC's procedures for ensuring that licensees comply with Price-Anderson Act liability insurance provisions include requirements that licensees provide proof of primary and secondary insurance coverage. NRC requires'each licensee to show proof that it has liability insurance that includes the $300 million of primary insurance coverage per site required by the Price-Anderson Act. NRC and the licensee also sign an indemnity agreement that requires the licensee to maintain an insurance policy in this amount. This agreement is in effect as long as the owner is licensed to operate the plant. NRC relies on American Nuclear Insurers--the joint underwriting association that provides insurance for U.S. nuclear power plants--to send NRC the annual endorsements documenting proof of insurance after the licensees have paid their annual premiums. In addition to the primary insurance coverage, licensees must also show proof of secondary insurance to NRC. This secondary insurance is in the form of retrospective premiums that, in the event of a nuclear incident causing damages exceeding $300 million, would be collected from each nuclear power plant licensee at a rate of to $10 million per year and up to a maximum of $95.8 million per cident for each nuclear power plant. Typically, each licensee signs a*nd for payment of retrospective premiums as proof of the secondary surance and furnishes NRC with a certified copy. This bond is a contractual agreement between the licensee and American Nuclear Insurers that obligates the licensee to pay American Nuclear Insurers the retrospective premiums. In the event that claims exhaust primary coverage, American Nuclear Insurers would collect the retrospective premiums. If a licensee did not pay its share of these retrospective premiums, American Nuclear Insurers would, under its agreement with the licensees, pay up to $30 million of the premiums in I year-and attempt to collect this amount later from the licensees. NRC does not treat limited liability companies differently than other licensees of nuclear power plants with respect to Price-Anderson Act liability requirements. All licensees follow the same regulations and procedures regardless of whether they are limited liability companies. Like other licensees, limited liability companies are required to show that they are maintaining $300 million in primary insurance coverage, and they provide NRC a.copy of the bond for payment of retrospective premiums. While NRC does not conduct in-depth financial reviews specifically to determine licensees' ability.to pay retrospective premiums, when a licensee applies for a license or when the license is transferred, NRC reviews the licensee's financial ability to safely operate the plant and to contribute decommissioning funds for the future retirement of the plant. According to NRC officials, if-licensees have the financial resources to cover these two expenses, they are likely to be capable of paying their retrospective premiums.American Nuclear Insurers goes further than NRC and requires limited liability companies to provide a letter of guarantee from their parent other affiliated companies with sufficient assets to cover the rospective premiums. These letters state that the parent or an filiated company is responsible for paying the retrospective premiums f the limited liability company does not. American Nuclear Insurers nforms NRC that it has received these letters of guarantee. Recognizing that limited liability companies are becoming more I of24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://ww",ýgao.gov/htext/d04654.htm] prevalent as owners of nuclear power plants, NRC is examining whether it needs to revise any of its regulations and procedures for these ompanies. NRC estimates the study will be completed by the end of ummer 2004.in commenting on a draft of this report, NRC stated that it accurately reflects the present insurance system for nuclear power plants.

Background:

The Atomic Energy Act of 1954 authorized a comprehensive regu'latory program to permit private industry to develop and apply atomic energy for peaceful uses, such as generating electricity from privately owned nuclear power plants. Soon thereafter, government and industry experts identified a major impediment to accomplishing the act's objective: the potential for payment of damages resulting from a nuclear accident and the lack of adequate available insurance. Unwilling to risk huge financial liability, private companies viewed even the remote specter of a serious accident as a roadblock to their participating in the development and use of nuclear power.[Footnote 2] In additibn,-congressional concern developed over ensuring adequate financial protection to the public because the public had no assurance that it would receive compensation for personal injury or property. damages from the liable party in event of a serious accident. Faced with these concerns, the Congress enacted the Price-Anderson Act in September 1957. The Price-Anderson Act has two underlying objectives: (1) to-establish a mechanism for compensating the public f-or personal injury or property damage in the event of a nuclear accident and (2) to encourage the development of nuclear power.To provide financial protection, the-Price-Anderson Act requires& mmercial nuclear reactors to be insured to the maximum level of rimary insurance available from private insurers; To implement this ovision, NRC periodically revises its regulations to require censees of nuclear reactors to increase their coverage level as the private insurance market increases the maximum level of primary insurance that it is willing to offer. For example, in January 2003, NRC increased the required coverage from $200 million to the current$300 million, when American Nuclear Insurers informed NRC that $300 million per site in coverage was now available in its insurance pool.In 1975, the Price-Anderson Act was amended to require licensees to pay a pro-rated share of the damages in excess of the primary insurance amount. Under this amendment, each licensee would pay up to $5 million in retrospective premiums per facility it owned per incident if a nuclear accident resulted in damages exceeding the amount bf primary insurance coverage. In 1988, the act was further amended to increase the maximum retrospective premium to $63 million per reactor per incident to be adjusted by NRC for inflation. The amendment also limited the maximum annual retrospective premium per reactor t-o $10 million. Under the act, NRC is to adjust the maximum amount of retrospective premiums every 5 years using the aggregate change in the Consumer Price Index for urban consumers. In August 2003, NRC set the current maximum retrospective payment at $95.8 million per reactor per incident. With 103 operating nuclear power plants, this secondary insurance pool would total about.$10.billion.[Footnote 3]The Price-Anderson Act also provides a process to deal with incidents in which the damages exceed the primary and secondary insurance coverage. Under the act, NRC shall survey the causes and extent of the damage and submit a report on the results to, among others, the)ngress and the courts. The courts must determine whether public ability exceeds the liability limits available in the primary nsurance and secondary retrospective premiums. Then the President would submit to the Congress an estimate of the financial extent of damages, recommendations for additional sources of funds, and one or more compensation plans for full and prompt compensation for all valid; nf?7 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...bttp://www.gao.-ov/htext/d04654.btmi claims. In addition, NRC can request the Congress to appropriate funds.The most serious incident at a U.S. nuclear power plant took place in 979 at the Three Mile Island Nuclear Station in Pennsylvania. That ncident has resulted in $70 million in liability claims.NRC's regulatory activities include licensing nuclear reactors and overseeing their safe operation. Licensees must meet NRC regulations to obtain and retain their license to operate a nuclear facility. NRC carries out reviews of financial qualifications of reactor licensees when they apply for a license or if the license is transferred, including requiring applicants to demonstrate that they possess or have reasonable assurance of obtaining funds necessary to cover estimated operating costs for the period of the license. NRC does not systematically review its licensees' financial qualifications once it has issued the license unless it has reason to believe this is necessary. In addition, NRC performs inspections to verify that a licensee's activities are properly conducted to ensure safe operations in accordance with NRC's regulations. NRC can issue sanctions to licensees who violate its regulations. These sanctions include notices of violation; civil penalties of up to $100,000 per violation per day;and orders that may modify, suspend, or revoke a license.Limited Liability Companies Are Licensees for 31 of the 103 Operating Commercial Nuclear Power Plants in the United States: Thirty-one commercial nuclear power plants nationwide are licensed to limited liability companies. In total, 11 limited liability companies are licensed to own nuclear power plants. Three energy corporations-- Exelon, Entergy, and the Constellation Energy Group--are the parent companies for 8 of these limited liability companies. These eight subsidiaries are licensed or co-licensed to operate 27 of the 31 plants. The two subsidiaries of the Exelon Corporation are the icensees for 15 plants and the co-licensees for 4 others.~onstellation Energy Group, Inc., and Entergy Corporation are the&parent companies of limited liability companies that are licensees for four nuclear power plants each. (See table I.): Table 1: Limited Liability Companies Licensed to Operate Nuclear Power Plants and Their Parent Companies: Limited liability company: Exelon Generation Company, LLC;Parent company: Exelon Corporation; Number of plants owned or co-owned: 12.Limited liability company: AmerGen Energy Company, LLC;Parent company: Exelon Corporation; Number of plants owned or co-owned: 3.Limited liability company: Exelon Generation Company, LLC; PSEG Nuclear, LLC;Parent company: Exelon Corporation; Public Service Enterprise Group, Incorporated; -Number of plants owned or co-owned: 4.Limited liability company: PSEG Nuclear, LLC;Parent company: Public Service Enterprise Group, Incorporated; Number of plants owned or co-owned: 1.Limited liability company: Calvert Cliffs Nuclear Power Plant, LLC;Parent company: Constellation Energy Group, Inc.;Number of plants owned or co-owned: 2.imited liability company: Nine Mile Point Nuclear Station, LLC;1Warent company: Constellation Energy Group, _Inc.;* Number of plants owned or co-owned: 2.Limited liability company: Entergy 'Nuclear Indian Point 2, LLC;Af n24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://www.gao.gov/,.htext/d04654.btm] Parent company: Entergy Corporation; Number of plants owned or co-owned: 1.Limited liability company: Entergy Nuclear Indian Point 3, LLC;Parent company: Entergy Corporation; Number of plants owned or co-owned: 1.Limited liability company: Entergy Nuclear FitzPatrick, LLC;Parent company: Entergy Corporation; Number of plants owned. or co-owned: 1.Limited liability company: Entergy Nuclear Vermont Yankee, LLC;Parent company: Entergy Corporation; Number of plants owned or co-owned: 1.Limited liability company: FPL Energy Seabrook, LLC;.Parent company: FPL Group, Inc.;Number of plants owned or co-owned: 1.Limited liability company: PPL Susquehanna, LLC;Parent company: Pennsylvania Power and Light Company;Number of plants owned or co-owned: 2.Source: GAO survey of NRC project managers.[End of table]Of all the limited liability companies, Exelon Generation Company, LLC, has the largest number of plants.. It is the licensee for 12 plants and co-licensee with PSEG Nuclear, LLC, for 4 other plants. For these 4 plants, Exelon Generation owns 43 percent of Salem Nuclear Generating tations 1 and 2 and 50 percent of Peach Bottom Atomic Power Stations 2 d 3. (App. I lists all the licensees and their nuclear power l ants.): NRC Has Specific Requirements and Procedures to Ensure That All Licensees Comply with the Price-Anderson Act's Liability Provisions: NRC requires licensees of nuclear power plants to comply with the Price-Anderson Act's liability insurance provisions by maintaining the necessary primary and secondary insurance coverage. First, NRC ensures that licensees comply with the primary insurance coverage requirement by requiring them to submit proof of coverage in the amount of $300 million. Second, NRC ensures compliance with the requirement for secondary coverage by accepting the certified copy of the licensee's bond for payment of retrospective premiums.All the nuclear power plant licensees purchase their primary insurance from American Nuclear Insurers. American Nuclear Insurers sends-NRC annual endorsements documenting proof of primary insurance after the licensees have paid their annual premiums. NRC and each licensee also sign an indemnity agreement, stating that the licensee will maintain an insurance policy in the required amount. This agreement, which is in effect as long as the owner *is licensed to-operate the plant-guarantees reimbursement of liability claims against the licensee in the event of a nuclear incident through the liability insurance. The agency can suspend or revoke the license if a lilcensee does'not maintain the insurance, but according to an NRC official, no licensee has ever failed to pay its annual primary insurance premium and American Nuclear Insurers would notify NRC. if a licensee failed to pay.[Footnote 41 proof of their secondary insurance coverage,-licensees must provide"vidence that they are maintaining a guarantee of payment of*retrospective premiums. Under NRC regulations, the licensee must provide NRC with evidence that it maintains one of the following six types of guarantees: (I) surety bond, (2) letter of credit, (3)7 nf 94 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...bttp://www.gao.gov/htext/d04654.html revolving credit/term loan arrangement, (4) maintenance of escrow deposits of government securities, (5) annual certified financial statement showing either that a cash flow can be generated and would be~vailable for payment of retrospective premiums within 3 months after ubmission of the statement or a cash reserve or combination of these, or (6) such other type of guarantee as may be approved by the Commission. Before the late 1990s, the licensees provided financial statements to NRC as evidence of their ability to pay retrospective-premiums.[Footnote 5] According to NRC officials, in the late 1990s, Entergy asked NRC to accept the bond for payment of retrospective premiums that it had with American Nuclear Insurers as complying with the sixth option under NRC's regulations: such other type of guarantee as may be approved by the Commission. After reviewing and agreeing to Entergy's request, NRC decided to accept the bond from all the licensees as meeting NRC's requirements. NRC officials told us that they did not document this decision with Commission papers or.incorporate it into the regulations because they did not view this as necessary under the regulations. The bond for payment of retrospective premiums is a contractual agreement between the licensee and American Nuclear Insurers that obligates the licensee to pay American Nuclear Insurers the retrospective premiums. Each licensee signs this bond and furnishes NRC with a certified copy. In the event that claims exhaust primary.coverage, American Nuclear Insurers would collect the retrospective premiums. If a licensee were not to pay its share of these retrospective premiums, American Nuclear Insurers would, under its agreement with the licensees, pay for up to three defaults or up to $30 million in I year of the premiums and attempt to collect this amount ter from the defaulting licensees. According to an American Nuclear surers official, any additional defaults would reduce the amount ailable for retrospective payments. An American Nuclear Insurers fficial told us that his organization believes that the bond for payment of retrospective premiums is legally binding and obligates the licensee to pay the premium. Under NRC regulations, if a licensee fails to pay the assessed deferred premium, NRC reserves the right to pay those premiums on behalf of the licensee and recover the amount of such premiums from the licensee.NRC Treats Limited Liability Companies the Same as Other Licensees, but the Insurance Industry Has Added Important Requirements for These Companies: NRC applies the same rules to limited liability companies that it does to other licensees of nuclear power- plants with respect to liability requirements under the Price-Anderson Act.All licensees must meet the same requirements regardless of whether they are limited liability companies. American Nuclear Insurers applies an additional requirement for limited liability companies with respect to secondary insurance coverage in order to ensure that they have sufficient assets to pay retrospective premiums.. Given the growing number of nuclear power plants licensed to limited liability companies, NRC is examining the need to revise its procedures and regulations for such companies. NRC requires all licensees of nuclear power plants to follow the same regulations and procedures. Limited liability companies, like other licensees, are required to show that they are maintaining the $300 llion in primary insurance coverage and provide NRC a copy of the..nd for payment of retrospective premiums or other approved evidence , guarantee of retrospective premium payments. According to NRC officials, all its licensees, including those that are limited liability companies, have sufficient assets to cover the retrospective premiums. While NRC does not conduct in-depth financial reviews of"24 GAO-04-654, Nuclear Regulation: NRCs Liability Insurance Requi...htip://v,,,Aw.,I-ao.go,.,/htext/dO4654.htm] specifically to determine licensees' ability to pay retrospective premiums, it reviews the licensees' financial ability to safely operate heir plants and to contribute decommissioning funds for the future retirement of the plants. According to NRC officials, if licensees have the financial resources to cover these two larger expenses, they are likely to be capable of paying their retrospective premiums.American Nuclear Insurers goes further than NRC and requires licensees that are limited liability companies to provide a letter of guarantee from their parent or other affiliated companies with sufficient assets to cover the retrospective premiums. An American Nuclear Insurers official stated that American Nuclear Insurers obtains these letters as a matter of good business practice. These letters state that the parent or an affiliated company is responsible for paying. the retrospective premiums if the limited liability company does not. If the parent company or other affiliated company of a limited liability company does not provide a letter of guarantee, American Nuclear Insurers could refuse to issue the bond for payment of retrospective premiums and the ,company would have to have another means to show NRC. proof of secondary insurance. American Nuclear Insurers informs NRC that it has received these letters of guarantee. The official also told us that American'Nuclear Insurers believes that the letters from the parent companies or other affiliated companies of the limited liability company licensed by NRC are valid and legally enforceable contracts. NRC officials told us that they were not aware of any-problems caused by limited liability companies owning nuclear power plants and that NRC currently does not regard limited liability companies' ownership of.nuclear power plants as a concern. However, because these companies are becoming more prevalent~as owners of nuclear power plants, NRC is examining whether it needs to revise any of its regulations or rocedures for these licensees. NRC estimates that it will'complete its tudy by the end of summer 2004.ency Comments: We provided a draft of this report to NRC for review and comment. In its written comments (see app. II), NRC stated that it believes the report accurately reflects the present insurance system for nuclear power plants. NRC said that we correctly conclude that the agency does not treat limited liability companies differently than :other licensees with respect to Price-Anderson's insurance requirements. NRC also stated that we are correct in noting that it is not aware of any problems caused by limited liability companies owning nuclear power plants and that NRC currently does not regard limited liability companies' ownership of nuclear power plants as a concern.-In addition, NRC commented that we agree with the agency's conclusion that all its reactor licensees have sufficient assets that they are likely to be able to pay the retrospective premiums. With respect to this last comment, the report does not take a position on the licensees' ability to pay the retrospective premiums. We did not evaluate the sufficiency of the individual licensees' assets to make these payments. Instead, we, reviewed NRC's and the American Nuclear Insurers' requirements and procedures for retrospective premiums.Scope and Methodology: We performed our review at NRC headquarters in Washington, D.C. We reviewed statutes, regulations, and appropriate guidance as well as interviewed agency officials to determine the relevant statutory framework of the Price-Anderson Act. To determine the number of nuclear.ower plant licensees that are limited liability companies, we irveyed, through electronic mail, all the NRC project managers"esponsible for maintaining nuclear power plant licenses. We asked them to provide data on the licensees, including the licensee's name and whether it was a limited liability company. if it was a limited , liability company, we asked when the license was transferred to theý of 94 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http:HwA-A,.gao.gov/btext/d04654.htmi limited, liability company and who is the parent company of the limited liability company. We received responses for all 103 nuclear power lants currently licensed to operate. We analyzed the results of the urvey responses. We verified the reliability of the data from a random ample of project managers by requesting copies of the power plant t licenses and then comparing the power plant licenses to the data provided by the project managers. The data agreed in all cases. We concluded that the data were reliable enough for the purposes of this report.To determine NRC's requirements for ensuring that licensees of nuclear power plants comply with the Price-Anderson Act's, liability requirements, we'reviewed relevant statutes and NRC regulations and interviewed NRC officials responsible for ensuring that licensees have primary and secondary insurance coverage. We also spoke with American Nuclear Insurers officials responsible for issuing the insurance coverage to nuclear power plant licensees, and we reviewed relevant documents associated with the insurance. To determine whether and how these procedures differ for licensees that. are limited liability companies, we reviewed relevant documents, including NRC regulations, and interviewed NRC officials responsible for ensuring licensee compliance with Price-Anderson Act requirements. As agreed with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 7 days from the date of this letter. We will then send copies to interested congressional committees; the Commissioners, Nuclear Regulatory Commission; the Director, Office of Management and Budget; and other interested parties. We will make copies avalilable to others on request.In addition, the report will be available at no charge on GAO's Web site at [Hyperlink, http://www.gao.gov]. IRf you or your staff have any questions about this report, I can be eached at (202) 512-3841. Major contributors to this report include Ray Smith, Ilene Pollack, and Amy Webbink. John Delicath and Judy Pagano also contributed to this report.Signed by: Jim Wells, Director, Natural Resources and Environment: List of Congressional Requesters: The Honorable Hillary Rodham Clinton: The Honorable James M. Jeffords: The Honorable Harry Reid: United States Senate:[End of section]Appendixes: Appendix 1: Nuclear Power Plant Ownership: 1;Plant: Arkansas Nuclear One 1;Licensed to own: Entergy Arkansas, Inc.;.LLC: No.2;Plant: Arkansas Nuclear One 2;~censed tc own- Entergy Arkansas, Inc.;WC: No.Plant: Arnold (Duane). Energy Center;1,0 of 24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://,A-ww.._P-ao.gov/htext/dO4-654.btmi CýLicensed to own: Interstate Power and Light;LLC: No;* icensed to own: Central Iowa Power Cooperative;

• C No;Licensed to own: Corn Belt Power Cooperative; LLC: No.4; ....Plant: Beaver Valley Power Station 1;Licensed to own: Pennsylvania Power Company;LLC: No.Licensed to own: Ohio Edison Company;LLC: No, Licensed to own: FirstEnergy Nuclear Operating Company;LLC: No.5;Plant: Beaver Valley Power Station 2;Licensed to own: Pennsylvania Power Company;LLC: No;Licensed to own: Ohio Edison Company;LLC: No;Licensed to own: Cleveland Electric Illuminating Company;LLC: No;Licensed to own: Toledo Edison Company;LLC: No;Licensed to own: FirstEnergy Nuclear Operating Company;LLC: No.6;Plant: Braidwood Station 1;Licensed to own: Exelon Generation Company, LLC;ILC: Yes;icense transfer date: 1/12/2001;

1. LC parent company: Exelon Corporation.

7;Plant: Braidwood Station 2;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/12/2001; LLC parent company: Exelon Corporation. 8;Plant: Browns Ferry Nuclear Power Station 1;Licensed to own: Tennessee Valley Authority; LLC: No.9;Plant: Browns Ferry Nuclear Power Station 2;Licensed to own: Tennessee Valley Authority; LLC: No.10;Plant: Browns Ferry Nuclear Power Station 3;Licensed to own: Tennessee Valley Authority,; LLC: No.11;Plant: Brunswick Steam Electric Plant 1;Licensed to own: Carolina Power & Light Co.;T LC: No;I censed to own: North Carolina Eastern Municipal Power Agency;No.12;Plant: Brunswick Steam Electric Plant 2;I I of 24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://%Nww.gao.obv/htext/d04654.htmi Z-Li~censed to own: Carolina Power & Light Co.;LLC: No;i-censed to own: North Carolina Eastern Municipal Power Agency;1 un ciae nowrse dcy LC: No.13;Plant: Byron Station 1;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/12/2001; LLC parent company: Exelon Corporation. 14;Plant: Byron Station 2;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/12/2001; LLC parent company: Exelon Corporation. 15;Plant: Callaway Plant;Licensed to own: Union Electric Company;LLC: No.16;Plant: Calvert Cliffs Nuclear Power Plant 1;Licensed to own: Calvert Cliffs Nuclear Power Plant, LLC;LLC: Yes;Li-cense transfer date: 6/19/2001;-LLC parent company: Constellation Energy Group, Inc..lant: Calvert Cliffs Nuclear Power Plant 2;icensed to own: Calvert Cliffs Nuclear Power Plant, LLC;WLC: Yes;License transfer date: 6/19/2001; LLC parent company: Constellation Energy Group, Inc..18;Plant: Catawba Nuclear Station 1;Licensed to own: North Carolina Electric Membership Corp.;LLC: No;Licensed to own: Saluda River Electric Cooperative, Inc.;LLC: No;Licensed to own: Duke Energy Corporation; LLC: No.19;Plant: Catawba Nuclear Station 2;Licensed to own: North Carolina Municipal Power Agency No. 1;LLC: No;Licensed to own: Piedmont Municipal Power Agency;LLC: No.20;Plant: Clinton Power Station;Licensed to own: AmerGen Energy Company, LLC;LLC: Yes;-License transfer date: 11/24/1999; LLC parent company: Exelon Corporation. 21;o ant: Columbia Generation Station;.censed to-own: Energy Northwest; SLLC: No.22;12 of 24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://,,vAmA,.gao.gov/,hlext/d04654.htmi C, Plant: Comanche Peak Licensed to own: TXU SLC: No.23 P lant: Comanche Peak Licensed to own: TXU.LLC: No.Steam Electric Station 1;Generation Company LP;Steam Electric Station 2;Generation Company LP;24;Plant: Cook Licensed to LLC: No.25;Plant: Cook Licensed to LLC: No.(Donald C.) Nuclear Power Plant 1;own: Indiana Michigan Power Company;(Donald C.) Nuclear Power Plant 2;own: Indiana Michigan Power Company;2,6;Plant: Cooper Nuclear Station;Li-censed to own: Nebraska Public Power District;LLC: No.27;Plant: Crystal River Nuclear Plant 3;Licensed LLC: No;Licensed LLC: No;Licensed LLC: No;haLcensed LC: No;#Licensed LLC: No;Licensed LLC: No;Licensed LLC: No;Licensed LLC: No;Licensed LLC: No;Licensed LLC: No.to own: Florida Power Corporation; to own: City of Alachua;to own: City of Bushnell;to own: City of Gainesville; to own: City of Kissimmee; to own:. City of Leesburg;to own: City of New Smyrna Beach and Utilities Commission; to own: City of Ocala;to own.: Orlando Utilities Commission and City of Orlando;to own: Seminole Electric Cooperative, Inc.;28;Plant: Davis-Besse Nuclear Power Station;Licensed to own: Cleveland Electric Illumination Company;LLC: No;Licensed to own: Toledo Edison Company;LLC: No.29;Plant: Diablo Canyon Nuclear Power Plant 1;Licensed to own: Pacific Gas and Electric Company;LLC: No.30;Plant: Diablo Canyon Nuclear Power Plant 2;censed to own: Pacific Gas and Electric Company;: No...Plant: Dresden Nuclear Power Station 2;Li censed to own: Exelon Generation Company, LLC;13 of 24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http:/,Iwývw.gao.gov/htext/dO4654.htmi LLC: Yes;License transfer date: 8/3/2000;1;C parent company: Exelon Corporation. S32;Plant: Dresden Nuclear Power Station 3;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date:.8/3/2000; LLC parent company: Exelon Corporation. 33;Plant: Farley (Joseph M.) Nuclear Plant 1;Licensed to own: Alabama Power Company;LLC: No.34; ..Plant: Farley (Joseph M.) Nuclear Plant 2;Licensed to own: Alabama Power Company;LLC: No.35;Plant: Fermi (Enrico) Atomic Power Plant 2;Licensed to own: Detroit Edison Company;LLC: No.36;Plant: FitzPatrick (James A.) Nuclear Power Plant;Licensed to own: Entergy Nuclear FitzPatrick, LLC;LLC: Yes;License transfer date: 11/ 21/2000;LLC parent company: Entergy Corporation. lant: Fort Calhoun Station;Licensed to own: Omaha Public Power District;LLC: No.38;Plant: Ginna (Robert E.) Nuclear Station;Licensed to own: Rochester Gas and Electric Corporation; LLC: No.39;Plant: Grand Gulf Nuclear Station;Licensed to own: System Energy Resources, Inc.;LLC: No;Licensed to own: South Mississippi Electric Power Assoc.;LLC: No.40;Plant: Harris (Shearon) Nuclear Power Plant;Licensed to own: Carolina Power & Light Co.;LLC: No;Licensed to own: North Carolina Eastern Municipal Power Agency;LLC: No.41;Plant: Hatch (Edwin I.) Nuclear Plant 1;Licensed to own: Georgia Power Company;LLC: No;Licensed to own: Municipal Electric Authority of Georgia;LC: No;icensed to own: Oglethorpe Power Corporation;

• LC: No;Licensed to own: City of Dalton, Georgia;LLC: No.14 of 24 14 of24 an,-, ~'%nn~ 1-~~ ~ -

GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi..m http://,,v-",w.gao.govlhtext/d04654.btmi 42;Plant: Hatch (Edwin I.) Nuclear Plant 2;icensed to own: Georgia Power Company;ILC: No;icensed to own: Municipal Electric Authority of Georgia;LLC: No;Licensed to own: Oglethorpe Power Corporation; LLC: No;Licensed to own: City of Dalton, Georgia;LLC: No.'43;Plant: Hope Creek Nuclear Power Station;Licensed to own: PSEG Nuclear, LLC;LLC: Yes;License transfer date: 8/21/2000; 10/18/2001; LLC parent company: Public Service Enterprise Group, Incorporated. 44;Plant: Indian Point 2;Licensed to own: Entergy Nuclear Indian Point 2, LLC;LLC: Yes;License transfer date: 9/6/2001;LLC parent company: Entergy Corporation. 45;Plant: Indian Point 3;Licensed to own: Entergy Nuclear Indian Point 3, LLC;LLC: Yes;License transfer date: 11/21/2000; I LC parent company: Entergy Corporation. Plant: Kewaunee Nuclear Power Plant;Licensed to own: Wisconsin Public Service Corp.;LLC: No;Licensed to own: Wisconsin Power & Light Company;LLC: No.47;Plant: LaSalle County Station 2;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/12/2001; LLC parent company: Exelon Corporation. 4!B;Plant: LaSalle County Station 2;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/22/2001; LLC' parent company: Exelon Corporation. 49;Plant: Limerick Generating Station 1;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/22/2001; LLC parent company: Exelon Corporation. Sant: Limerick Generating Station 2;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/22/2001; 15 of24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...LLC parent company: Exelon Corporation.

lant: McGuire (William B.) Nuclear Station 1;Licensed to own: Duke Energy Corporation; LLC: No.52;Plant: McGuire (William B.) Nuclear Station 2;Licensed to own: Duke Energy Corporation; LLC: No.http://www.gao.gOv/htext/dO4654.html 53;Plant: Millstone Licensed to own: LLC: No.54;Plant: Millstone Licensed to own: LLC: No;Licensed to own: LLC: No;Licensed to own: LLC: No.Nuclear Power Station 2;Dominion Nuclear Connecticut, Inc.;Nuclear Power Station 3;Dominion Nuclear Connecticut, Inc.;Central Vermont Public Service Corporation; Massachusetts Municipal Wholesale Electric Co.;55;Plant: Monticello Nuclear Generating Plant;Licensed to own: Northern-States Power Company;LLC: No.56;lant: Nine Mile Point Nuclear Station 1;icensed to own: Nine Mile Point Nuclear Station, LLC;LC: Yes;License transfer date: 11/7/ 2001;LLC parent company: Constellation Energy Group.57;Plant: Nine Mile Point Nuclear Station 2;Licensed to own: Nine Mile Point Nuclear Station, LLC;LLC: Yes;License transfer date: 11/7/ 2001;LLC parent company: Constellation Energy Group;Licensed to own: Long Island Lighting Company;LLC: No.58;Plant: North Anna Power Station 1;Licensed to own: Virginia Electric and Power Company;LLC: No;Licensed to own: Old Dominion Electric Cooperative; LLC: No.59;Plant: North-Anna Power Station 2;Licensed to own: Virginia Electric and Power Company;LLC: No;Licensed to own: Old Dominion Electric Cooperative; LLC: No.want: Oconee Nuclear Station 1;1icensed to own: Duke Energy Corporation;

• LLC: No.61;16 of 24 GA.O-04-654, Nuclear Regulation:

NRC's Liability Insurance Requi...http://%%,ww.,-,ao.2oN,/Iitext/dO4654.btm] Plant: Oconee Nuclear Station 2;Licensed to own: Duke Energy Corporation; LC: No..62;Plant: Oconee Nuclear Station 3;Licensed to own: Duke Energy Corporation; LLC: No.63;Plant: Oyster Creek Nuclear Power Plant;Li~censed to own: AmerGen Energy Company, LLC;LLC: Yes;License transfer date: 8/8/2000;LLC parent company: Exelon. Corporation. 64;Plant: Palisades.Nuclear Plant;Licensed to own: Consumers Energy Company;LLC: No.65;Plant: Palo Verde Nuclear Generating Station 1;Licensed to own: Arizona Public Service Company;LLC: No;*Licensed to own: Salt River Project Agricultural Improvement and Power District;LLC: No;Licensed to own: El Paso Electric Company;LLC: No;Licensed to own: Southern California Edison Company;LLC: No;icensed to own: Public Service Company of New Mexico;LC: No;W Licensed to own: Los Angeles Dept. of Water and Power;LLC:,No;Licensed to own: Southern California Public Power Authority; LLC: No.66;Plant: Palo Verde Nuclear Generating Station 2;Licensed to own: Arizona Public Service Company;LLC: No;Licensed to own: Salt River Project Agricultural Improvement and Power District;LLC: No;Licensed to own: El Paso Electric Company;LLC: No;Licensed to own: Southern California Edison Company;LLC: No;" Licensed to own: Public Service Company of New Mexico;LLC: No;Licensed to own: Los Angeles Dept. of Water and Power;LLC: No;Licensed to own: Southern California Public Power Authority; LLC: No.67;Plant: Palo Verde Nuclear Generating Station 3;Licensed to own: Arizona Public Service Company;LLC: No;Licensed to own: Salt River Project Agricultural Improvement and Power strict;*C: No;Licensed to own: El Paso Electric Company;LLC: No;Licensed to own: Southern California Edison Company;17 of 24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://,A,-vm.gao.gov/htext/d04654.btml LLC: No;Licensed to own: Public Service Company of New Mexico;LC: No;icensed to own: Los Angeles Dept. of Water and Power;LC: No;9 Licensed to own: Southern California Public Power Authority'; LLC: No.68;Plant: Peach Bottom Atomic Power Station 2;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/12/2001; LLC parent company: Exelon Corporation; Licensed to own: PSEG Nuclear, LLC;LLC: Yes.LLC parent company: Public Service Enterprise Group, Incorporated. 69;Plant: Peach Bottom Atomic Power Station 3;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/12/2001; LLC parent company: Exelon Corporation; Licensed to own: PSEG Nuclear, LLC;LLC: Yes.LLC parent company: Public Service Enterprise Group, Incorporated. 70;P!ant: Perry Nuclear Power Plant;icensed to own: Ohio Edison Company;W LC: No; -*Licensed to own: Cleveland Electric Company;LLC: No;Licensed to own: Toledo Edison Company;:LLC: No.71;Plant: Pilgrim Station;Licensed to own: Entergy Nuclear Generation Co.;LLC: No.72;Plant: Point Beach Nuclear Plant 1;Licensed to own: Wisconsin Electric Power Company;LLC: No.73;Plant: Point Beach Nuclear Plant 2;Licensed to own: Wisconsin Electric Power Company;LLC: No.74;Plant: Praire Island Nuclear Plant 2;Licensed to own: Northern States Power Company;LLC: No.75;Plant: Praire Island Nuclear Plant 2;~censed to own: Northern States Power Company;IC: NO.76;Plant: Quad Cities Station 1;Licensed to own: Exelon ,Generation Company, LLC;18 of 24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi....http://www.gao'gov/htext/d04654.htmi LLC: Yes;License transfer date: 8/3/2000;icensed-to own: 77: MidAmerican Energy. Company;LC: 77: No;W License transfer date: 77: [Empty];LLC parent company: 77: [Empty].77;Plant: Quad Cities Station 2;Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 8/3/2000;LLC parent company: Exelon Corporation; Licensed to own: MidAmerican Energy Company;LLC: No.78;Plant.: River Bend Station;Licensed to own: Entergy Gulf States, Inc.;LLC: No.79;Plant: Robinson (H. B.) Plant 2;Licensed to own* Carolina Power & Light Co.;LLC: No.80;Plant: Salem Nuclear Generating Station 1;Licensed to own: PSEG Nuclear, LLC;LLC: Yes;icense transfer date: 8/21/2000; LC parent company: Public Service Enterprise Group, Incorporated; Umicensed to own: Exelon Generation Company, LLC;40L-LC: Yes;License transfer date: 1/12/2001; LLC parent company: Exelon Corporation. 81;Plant: Salem Nuclear Generating Station 2;Licensed to own: PSEG Nuclear, LLC;LLC: Yes;License transfer date: 8/21/2000; LLC parent company: Public Service Enterprise Group, Incorporated; Licensed to own: Exelon Generation Company, LLC;LLC: Yes;License transfer date: 1/12/2001; LLC parent company: Exelon Corporation. 82;Plant: San Onofre Nuclear Generating Station 2;Licensed to own: Southern California Edison Company;LLC: No.83;Plant: San Onofre Nuclear Generating Station 3;Licensed to own: Southern California Edison Company;LLC: No.84;Plant:_Seabrook Nuclear Power Station;.icensed to own: FPL Energy Seabrook, LLC;C: Yes; .icense transfer date: 11/1/2002; LLC parent company: FPL Group, Inc.;Licensed to own: Massachusetts Municipal Wholesal.e Electric Co.;LLC: No;I() nfg9d GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...Licensed to own: Tauton Municipal Lighting Plant;LLC: No;Li4ce to own: Hudson Light & Power Department; LLC: No.(SJ hffp://www'._Ogao.,Oov/hlext/dO4654.htnr. Plant: Sequoya Nuclear Plant 1;Licensed to own: Tennessee Valley LLC: No.86;Plant: Sequoya Nuclear Plant 2;Licensed to own: Tennessee Valley LLC: No.Authority; Authority; 87;Plant: South Texas Project 1;Licensed to own: Texas Genco, LP;LLC: No;Licensed to own: City Public Service Board of San Antonio;LLC: No;Licensed to own: Central Power & Light Company;LLC: No;Licensed to own: City of Austin, Texas;LLC: No.P8;Plant: South Texas Project 2;Licensed to own: LLC: No;Licensed to own: LLC: No;icensed to own: W LC: No;Licensed to own: LLC: No.89;Plant: St. Lucie Licensed to own: LLC: No.90;Plant: St. Lucie Licensed to own: LLC: No;Licensed to own: LLC: No;Licensed.to own: LLC: No.Texas Genco, LP;City Public Service Board of San Antonio;Central Power & Light Company;City of Austin, Texas;Plant 1;Florida Power and Plant 2;Florida Power and Light Company;.Light Company;Florida Municipal Power Agency;Orlando Utilities Commission; Plant: Summer (Virgil C.) Nuclear Station;Licensed to own: South Carolina Electric & Gas company;LLC: No;Licensed to own: South Carolina Public Service Authority; LLC: No.92;Plant: Surry Power Station 1;Licensed to own: Virginia Electric and Power Company;'LC: No.403;P lant: Surry Power Station 2;Licensed to own: Virginia Electric and Power Company;LLC: No.20 of 24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...bttp://w%-w.2ao.gov/htext/d04654.htm]Susquehanna Steam Electric Station 1;jLicensed to own:,.PPL Susquehanna, L LC;LLC: Yes;License transfer date.: 6/1/2000;LLC parent company: Pennsylvania Power and Light Company.95;Plant: Susquehanna Steam Electric Station 2;Licensed to own: PPL Susquehanna, LLC;LLC: Yes;License transfer date: 6/l/2000;LLC parent company: Pennsylvania Power and Light Company.96;Plant: Three Mile Island Nuclear Station 1;Licensed to own: AmerGen Energy Company, LLC;LLC: Yes;License transfer date: 12/20/ 1999;LLC parent company: Exelon Corporation. 97;Plant: Turkey Point Station 3;Licensed to own: Florida Power and Light Company;LLC: No.98;Plant:--Turkey Point Station 4;Licensed to own: Florida Power and Light. Company;LLC: No.-9;Dlant: Vermont Yankee Nuclear Power Station;01Licensed to own: Entergy Nuclear Vermont Yankee, LLC;LLC: Yes;License transfer date: 7/1/2002;LLC parent company: Entergy Corporation; Licensed to own: Entergy Nuclear Operations, Inc.;LLC: No.100;-Plant: Vogtle (Alvin W.) Nuclear Plant 1;Licensed to own: Georgia Power Company;LLC: No;Licensed to own: Municipal Electric Authority of Georgia;LLC: No;Licensed to own: Oglethorpe Power Corporation; LLC: No;Licensed to own: City of Dalton, Georgia;LLC: No.101;Plant: Vogtle (Alvin W.) Nuclear Plant 2;Licensed to own: Georgia Power Company;LLC: No;Licensed to own: Municipal Electric Authority of Georgia;LLC: No;Licensed to own: Oglethorpe Power Corporation; LLC: No;Licensed to own: City of Dalton, Georgia;LLC: No.*02,-Plant: Waterford Generating Station 3;* Licensed to own: Entergy Operations, Inc.;.LLC: No.21 of 24 GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http://ww.w.-ao.eov/btextý/d04654.htm] 103;Watts Bar Nuclear Plant 1; to own: Tennessee Valley Authority; 104;, Plant: Wolf Creek Generating Station;Licensed to own: Kansas Gas & Electric Company;LLC: No;Licensed to own: Kansas City Power & Light Company;LLC: No;Licensed to own: Kansas Electric Power Cooperative, Inc.;LLC: No.Source: GAO survey of NRC Project Managers.[End of table)[End of section]Appendix II: Comments from the Nuclear Regulatory Commission: UNITED STATES NUCLEAR REGULATORY COMMISSION: WASHINGTON, D.C. 20555-0001: April 29, 2004: Mr. James E. Wells: Director, Natural Resources and Environment:.nited States General Accounting Office: 41G Street, N.W.ashinton, DC 20548:

Dear Mr. Wells:

I would like to thank you for the opportunity to review and submit comments on the May 2004 draft of the General Accounting Office's (GAO)report entitled "Nuclear Regulation7NBC's Liability Insurance Requirements for Nuclear Power Plants Owned by Limited Liability. Companies." The U.S. Nuclear Regulatory Commission (NRC) appreciates the time and effort that you and your staff have taken to review this topic.GAO correctly concludes that NRC does not treat limited liability companies differently than other licensees with respect to the Price-Anderson's insurance requirements. Like other licensees, limited liability companies must show proof of both primary and secondary financial protection. GAO also is correct in noting that NRC is not aware of any problems caused by limited liability companies owning nuclear power plants and that NRC currently does not regard limited liability companies' ownership of nuclear power plants as a concern.Finally, GAO agrees with NBC's conclusion that all its reactor licensees have sufficient assets that they are likely to be able to pay the retrospective premiums. These assets are assured by a number of different methods that are approved by NRC as GAO discusses in its report.The NRC believes that the GAO report accurately reflects the present 4nsurance system for nuclear power plants. Therefore, we do not have 0 y comments to provide regarding the draft report.Signcerely, 0 Signed by: 11 ~)A GAO-04-654, Nuclear Regulation: NRC's Liabilityinsurance Requi...bnp://www.gao.gov/'htext/d04654.htm] William D. Travers: Executive Director for Operations: 8c: Ilene Pollack, GAO: S(360330): FOOTNOTES[1] Although 104 commercial nuclear power plants are licensed to operate in the United States, I plant, Browns Ferry Unit 1, was shut down in 1985 and remains idle.[2] NRC's regulations define a nuclear incident as any occurrence that causes bodily injury, sickness, disease, or death or loss of or damage to property or for loss. of the use of property arising out of or resulting from the radioactive, toxic, explosive, or other hazardous properties of the source, special nuclear or byproduct material.[3] NRC regulations also require licensees to maintain $1 billion in on-site property damage insurance to provide funds -to deal with cleanup of the reactor site after an accident.[4] The average annual premium for a single nuclear power plant at a site is about $400,000. The premium for a second or third plant at the same site is discounted because the maximum amount of primaryinsurance for a multi-plant site is $300 million.[5] Fifteen licensees continue to provide financial statements to NRC.-GAO's Mission: fe General Accounting Office, the investigative arm of Congress,_x ists to support Congress in meeting its constitutional esponsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to.good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics.Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this, list to you every afternoon, go to www.gao.gov and select "Subscribe to e-mail alerts" under the "Order ,GAO Products" heading.Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 ch. A check or money order should be made out to the Superintendent W Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent.rders should be sent to:?1 nfD? GAO-04-654, Nuclear Regulation: NRC's Liability Insurance Requi...http:/,Iwww.gao.gov/htext/dO4654.htm] U.S. General Accounting Office 41 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To. Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.-gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S.General Accounting Office, 441 G Street NW, Room 7149 Washington, D.C.ý20548: I')A -Ir) A EXHIBIT AAA UNITED STATES NUCLEAR REGULATORY COMMISSION in the matter of ENTERGY NUCLEAR INDIAN POINT 2, L.L.C.Indian Point Energy Center Unit 3 License Renewal Application LicenseNo. DPR-64 Docket No. 50-286 DECLARATION OF.CONNIE L. COKER My name is Connie L. Coker. I live at 87 Depot P1., S. Nyack, NY 10960 which is a village along the Hudson River where my husband and [ raised our daughters now 24 and 21 years old. i , My professional life included working as the Lead nurse or a prenatal clinic in Westchester and for the past 12 years I have worked as a certified nurse-midwife at St.-Agnes Hospital, a birth center and then started a practice attending births in the mother's home.The risks of the Indian Point nuclear power point were certainly vivid to me when I attended the birth of a baby in Buchanan, NY and knew that during fetal development he could have been exposed to radiation from ongoing leaks of strontium 90 and tritium from the plant into the groundwater and by way of steam. The disastrous effects of an industrial accident or a terrorist attack are also vivid to those of us who live near the plant. The inability to evacuate residents in our densely populated area is obvious.Due to my commitment to the health and well being of families I became a Rockland County Legislator a few years ago. In my role as policy maker and nurse-midwife, I am opposed to the re-licensing of Indian Point.I respectfully ask the NRC to deny Indian Point a license to operate. I also ask that Indian Point be decommissioned because it presents a threat to the entire population of this area.I declare under penalty of perjury that the foregoing is true and correct.Executed this 5th day of December, 2007, at Connie L. Coker, RN MSN CNM Rockland County Legislator 5q Nhvaek MIY 7*S Nvack NY Ll/<# UNINTED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 2, L.L.C.Indian Point Energy Center Unit 2/AZkJ A7&AC./License Renewal Application DECLARATION OF CONNIE L. COKER LicenseNo. DPR-26 Docket No. 50-247 My name is Connie L. Coker. I live at 87 Depot P1., S. Nyack, NY 10960 which is a village along the Hudson River where my husband and [ raised our daughters now 24 and 21. years old. '7 , 7 .u l r '(/ -My professional life included working as the head nurse for a prenatal clinic in Westchester and for the past 12 years I have worked as a certified nurse-midwife at St.Agnes Hospital, a birth center and then started a practice attending births in the mother's home.The risks of the Indian Point nuclear power point were certainly vivid to me when I attended the birth of a baby in Buchanan, NY and knew that during fetal development he could have been exposed to radiation from ongoing leaks of strontium 90 and tritium from the plant into the groundwater and by way of steam. The disastrous effects of an industrial accident or a terrorist attack are also vivid to those of us who live near the plant. The inability to evacuate residents in our densely populated area is obvious.Due to my commitment to- the health and well being of families I became a Rockland County Legislator a few years ago. In my role as policy maker and nurse-midwife, I am opposed to the re-licensing of Indian Point.I respectfully ask the NRC to deny Indian Point a license to operate. I also ask that Indian Point be decommissioned because it presents a threat to the entire population of this area.I declare under penalty of perjury that the foregoing is true and correct.Executed this 5th day of December, 2007, at S. Nyack, NY.Connie L. Coker, RN MSN CNM -Rockland County Legislator ... ./ EXHIBIT BBB UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 3, L.L.C.Indian Point Energy Center Unit 3 License Renewal Application) LicenseNo. DPR-64) Docket No. 50-286)AND In the matter of ENTERGY NUCLEAR INDIAN POINT 2, L.L.C.Indian Point Energy Center Unit 2 License Renewal Application DECLARATION OF JANET LEE BURNET) LicenseNo. DPR-26) Docket No. 50-247)My name is Janet Lee Burnet. [ live at 20 Spook Rock Road, Suffern, NY 1090t, with my two children. t am a member of the Rockland County Conservation Association (RCCA), Executive Director of the Ramapo Parks Foundation and Executive Director of the Ramapo River Watershed Intermunicipal Council. RCCA represents my interests in a Petition for Leave to Intervene, Request for Hearing and Contentions; and the Notice of Appearance, in the matter of Entergy Nuclear Indian Point 2, LLC, and Entergy Nuclear Indian Point 3, LLC, and Entergy Nuclear Operations, Inc. License Renewal Application. I have lived- in proximity to Indian Point for--Rokla:fd-County for 28 years -as a 9-year resident of Manhattan, NY and for the last 19 years as a resident of Rockland County, New York.My experiences as. a resident of Manhattan, as a commuter to Manhattan from Rockland county, as- a mother of two children in the Rockland County School systems, and as an active member of the environmental advocacy community for the region are roles that make me keenly aware of the challenges our region would face in the event of an emergency at Indian Point -and of ongoing environmental threats to human health and a healthy regional ecosystem regardless of a full scale nuclear emergency. As.a long term resident of the region, I am aware of the many years of news reports aboutt failed emergency sirens and emergency notification systems at Indian Point, multiple shut-downs, security breaches (including a sleeping guard), radioactive leaks, and environmental threats including release of Stronium-90 and it's hazardous effect on humans; and the deleterious effects of Indian, Point Facilrity operations on local groundwater quality and on the fish and aquatic life of the Hudson River. As a long term resident, I am also aware of the importance of the.health and safety of New York City and the Tri-State area -- and how this health and safety is critically linked to national security and. the national/global economy.My concerns focus therefore on several, issues that in my belief cannot be mitigated or remedied, and which therefore dictate the shut down and decommissioning of Indian- Point Nuclear Energy Facility: (t) Impossibility of an emergency evacuation, (2) risk to school children, (3) risk to human health, (4) risk to the environment, (5) massive risk to national security and the nation's economy.

1. Impossibility for Emergency Evacuation

-- Regional population density and inadequate roadway and transportation systems make the emergency evacuation of millions of people an utter impossibility. A minor emergency evacuation at a local Mall (Palisades Mall in West Nyack, directly adjacent to 1-287) a few years ago took over four hours, and rendered the adjacent Thru-way impassable. Ordinary traffic on normal summer weekend frequently brings the thruway to a stand-still. The Tappan-Zee Bridge is often'impassable due to min6ir fender-benders or simple traffic volume, and the notorious stretch of 1-87 between exit 15-A (Hillburn) and exit 16 (Woodbury) is fraught with accidents that all too frequently stop traffic for hours -on ordinary days. Empirical evidence shows that these critical traffic arteries are frequently impassable, yet this is a main westbound transportation route for the Emergency Evacuation Plan. Future plans to bring even more traffic into this transportation artery: expansion of Stewart Airport, and replacement & expansion of the Tappan Zee Bridge crossing, combined with numerous planned large-scale developments and a projected increase in population make it clear that this main evacuation route will become even more problematical in the future.-2. Risk to school children -- Children of school age are particularly at risk in an. emergency evacuation scenario, since their lives and safe and timely evacuation depends upon their care and transportation by school bus drivers, and local teachers -,an action that requires school bus drivers and teachers to unreasonably abandon their own families and their own safety for the purpose of transporting and caring for thousands of other people's school-aged children. Although our bus drivers and teachers'are very dependable people under most ordinary circumstances, (and I have no doubt that among them there would be some heroes) I cannot reasonably expect or depend on their heroism and training in the event of a nuclear disaster.3. Risk to human health -- Obviously, in the event of a nuclear disaster, the NYC region would be rendered uninhabitable. But on a realistic, day-to-day scenario, the effects of this particular facility, with its failure to contain all radioactive materials over the years, and with its inability even to get its emergency sirens to operate correctly, the risk and actual deleterious effects on human health are already unacceptable. Stronium-90 is already a proven factor -but the level of stress on adults and school age children in the area is also a negative health effect that is present -but hard to measure. It should be taken into account.4. Risk to the environment

- While fish kills and groundwater pollution have been documented in the area of the Facility, I believe the long-term effects of these factors on the Hudson River and its environs are not fully understood and must be addressed.

Additionally, the cost-benefit to the environment, in the event of a nuclear disaster must be taken into account on behalf of affected ecosystems, fish, bird and other wildlife of the region. For instance, in the event of a nuclear disaster, prevailing winds would carry radioactive fallout directly into one of the world's major bird migratory pathways -the Atlantic Flyway. Additionally, the location of Indian, Point Nuclear Facility on the shore of one of the world's largest estuaries shouldý raise environmental concerns to a high level, since this major estuary is the spawning ground and incubator site for a huge population of marine species which would also be affected.5. Massive risk to regional, national security and national/global economy -With. NYC a& the regional, national and global center for trade, communications, publishing, the arts, the United Nations and the repository of much of the world's most valuable art and cultural artifacts, the potential risk of a nuclear catastrophe and subsequent destruction of these critical and essential assets is unacceptable. The risk for such a catastrophe cannot be measured against normal risks -but should be measured against the unthinkable obliteration of these essential assets -- and must be taken into consideration when weighing the risklbenefit of allowing Indian Point and its long record of failures to -continue to cast its grim security shadow over the vital infrastructure, irreplaceable cultural resources, essential global businesses and communications hubs contained within the 10-20 mile radius of this faulty facility. Whether the threat comes from the risk of cataclysmic weather events, climate change and its accompanying rise in river levels, seismic activity, negligence, sabotage, terrorist acts, acts of war, or "mere" human accidental error is irrelevant--- the risk to our nation and the world's security is simply too high to tolerate.I declare under penalty of perjury that the foregoing is a true and correct statement of my understanding and concerns.Executed this 6 th day of December, 2007, at Airmont, New York Janet Lee gurnet.State ofNew York )*)ss.: County of Rockland )On the 6 th Day of December, in the year 2007 before me, the undersigned, personally appeared r- , personally known to me or proved to me on the bd-sis of satisfactory evidence to be the individuals(s) whose name(s) is (are) subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her/their signature(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted, executed-the-instrument. N, (Notary Pu biltc" l//. EXHIBIT CCC UNITED STATES NUCLEAR REGULATORY COMMISSION P In the matter of ENTERGY NUCLEAR [NIAN POINT 2, L.L.C. LicenseNo. ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. &DPR-26&DPR.64 Indian Point Energy Center Unit 2 & ) Docket Indian Point Energy Center 3 No. 50-247 &~ ~_/Ct No. 50-286 License Renewal Application )DECLARATION OF ANDREW Y. STEWART, PhD My name is Andrew Y. Stewart, I live at 19 Mill Street, Nyack, NY 10960.I am a member of Rockland County Conservation Association (RCCA) and the Executive Director of Keep Rockland Beautiful, Inc.RCCA represents my interests in a Petition for Leave to Intervene, Request for Hearing, and Contentions; and the Notice of Appearance, in the matter of Entergy Nuclear Indian Point 2, LLC, and Entergy Nuclear Operations, Inc, License Renewal Application. I have lived in the Hudson Valley for 17 years, and am very connected to the Hudson River. About 12 years ago I built my own kayak and use it in the Hudson. Also I have built my own small sail boat.I teach environmental science at Rockland Community College. For the past 6 years I have organized volunteer clean-up of the banks of the Hudson.For the past 3 years I have helped Hudson River Basin Watch put together educational workshops for high school students on the Haverstraw water front, regarding land use and water quality.Rockland County is currently considering using the river for tap water, due the limited water resources in the county.The Hudson River is a unique and vital resource to our community and the entire New York region. Today, Indian Point could not be cited where it is currently located, due the enormous surrounding population and lack of a workable evacuation plan. It is. unacceptable for the NRC to allow Indian Point to continue to contaminate the groundwater and Hudson.If the NRC permits Entergy to continue operation of this aging plant that is polluting the River, it will directly affect my lifestyle by preventing me from enjoying the river for exercise and will stop me from being able to bring students and community members to its banks. In addition it may directly affect the health and safety of my family.The public's health and safety.cannot be compromised, for the sole benefit of a privately owned corporation. I declare under penalty of perjury that the foregoing is true and correct.Executed this ,_ day of /t,; 2007, at Nyack, NY.Andrew Y, Stewart State of New York ))ss.: County of Rockland)On the 5 day of\: ., in the yeari % r before me, the undersigned, personally appeared -a. , -/- " .personally known to me or proved to me on the basis of satisfactory evidence to be the individual(s) whose name(s) is (are) subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted, executed the instrument./ Notary"Pu.btic ....,'. .(. / EXHIBIT DDD UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 2, L.L.C. LicenseNo. ENTERGY NUCLEAR INDIAN POINT 3, LLC ) DPR-26 &ENTERGY NUCLEAR OPERATIONS, LCC DPR 64 Indian Point Energy Center Unit 2 & Indian Point ) Docket Entergy Center Unit 3 No. 50-247& No. 50-286 License Renewal. Application DECLARATION OF MICHEL LEE My name is Michel Lee. [ live at 265 Madison Road, Scarsdale, NY 10583, with my husband and two children, ages II and 13. My home is located approximately 20 miles from Indian Point, my principal places of business are my home and 21 Perlman Drive, Spring-Valley, NY 10977, which is located approximately 11 miles from Indian Point. I am Senior Policy Analyst to Public Health and-Sustainable Energy (PHASE), and on the Board of the Nuclear Information and Resource Service (NIRS).PHASE represents my interests in a Petition for Leave to Intervene and Request for Hearing in the License Renewal Proceeding for the Indian Point Nuclear Power Plants.[ am an avid. hiker, and walk daily at various locations in Westchester, including by the Hudson River. I also bicycle in these areas with my family.[ am also extremely fond of breathing in air, and would be doing so, even should a maj~or radiation release form Indian Point occur.I am not a long-term opponent of nuclear power. Prior to 9/11 [ gave nuclear power little thought. On 9/11 , my children where in school. At one point, I heard the thundering roar of an airplane. I froze in place, looked up to the sky, and thought, "What the H_ can they be attacking in Westchester? Happily, I was wrong about the jet, it turned out to be a U.S. fighter, one of the many that were sent out to patrol the skies; but unfortunately too late to prevent terrorists from unleashing death and destruction on our soil.Unhappily, [was wrong about there being no good terrorist target in Westchester County, NY. As I soon thereafter learned, there is an excellent target in Westchester: the Indian Point nuclear reactors. In fact, they are arguably the premier terrorist target in the nation..Later, of course, I also found out that American Airlines Flight 11 flew almost directly over Indian Point some 6 minutes before crashing into the North Tower of the World Trade Center. I also learned, from the report of the 9/I1 Commission investigation, that Mohamed Atta, had "considered targeting a nuclear facility [i.e., Indian Point] he had seen during familiarization flights near New York." I also later learned that nuclear facilities in the U.S. were envisioned as targets in al Qaeda's original plan for a terrorist strike on America.But, most alarmingly, I discovered from thousands of hours of my own research and countless hours in NRC meetings, that the NRC does not act,* even remotely, as a true watchdog. It acts the way an in-house counsel's office functions in a large corporation: endeavoring to make sure things don't totally blow up (as that would be bad for the corporation), but ul-timately serving the near-term financial interest of the company. When that modus operandi fails, as it did with Enron, folks lose money. When it fails, early in the lifetime of a nuclear plant, as it did with Three Mile Island, a lot of people get paid huge amounts of money to drop iheir injury suits and keep, their mouths shut and the corporation enters a deal whereby it pleads guilty to criminal violations and pays a fine. When it happens to an old'degradingcnuclear power plant like Indian Point, the consequences could be of a magnitude I am quite certain I do not wish to find out.(Notably, at a joint NRC-FEMA public "Exit Meeting" following a drill several years ago, [ specifically posed the following two questions to NRC and FEMA officials: (1) What number of people do the NRC and FEMA calculate may die as a result of a worst case accident at Indian Point? And (2) What is the number of deaths which the NRC and FEMA deem to be acceptable as part of their "reasonable assurance" standard? Both agencies refused point-blank to answer my questions) 2 I have some two decades of expertise in how in-house counsel and large Corporations make decisions and operate. [ was a litigator and -after obtaining a post-doctoral degree -developed a sub-specialty of conducting internal investigations for companies and other organizations. My professional experience, long ago, disabused me of the notion that for-profit corporations purposefully act for reasons other than profit. In fact, by law, corporations must act to maximize shareholder profit. So I would never expect the Entergy Corporation in any of its multifarious corporate forms to do anything other than try to squeeze the last penny of profit, for as long as possib.le, from Indian Point.However, until 2001, I truly did believe that there was a regulator carefully serving as. a watchdog, I no longer hold such an illusion.Still, I do.still believe that there are individuals within the NRC who are not captive to the industry. And it is they to whom I direct this simple appeal, from a mother: Please put the health and welfare of my family and the millions of other families whose lives can be destroyed by one very bad day at Indian Point ahead of the financial interest of the Entergy Corporation. Please remember that the mission of your agency is to protect the public and the environment, not the profit margins of the nuclear industry.I declare under penalty of perjury that the foregoing is true and correct.Executed this 27th day of November, 2007.: 7 I'Michel Lee, Esq.4/.........,,..... ;. ..J. / /,'";. .'.3 EXHIBIT EEE UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 3, L.L.C.Indian Point Energy Center Unit 3 ENTERGY NUCLEAR INDIAN POINT 2, L.L.C.Indian Point Energy Center Unit 2 License Renewal Application LicenseNo. DPR-64 Docket No. 50-286 LicenseNo. DPR-26) Docket No. 50-247 DECLARATION OF SUSAN H. SHAPIRO, Esq.My name is Susan H. Shapiro I live at 36 Home Tooke Road, Palisades NY 10964, with my husband and two children, ages 8 and 10. My home is located approximately 17 miles from Indian Point, my principal place of business is 21 Perlman Drive, Spring Valley, NY 10977 located approximately I1 miles from Indian Point. I am member of Public Health and Sustainable Energy (PHASE), a steering committee member of the Indian Point Safe Energy Coalition, and a board member of Hudson River Sloop Clearwater. PHASE represents my interests in the Petition for Leave to Intervene, Request for Hearing, and Contentions; and the Notice of Appearance, in the above matter.I am a life long resident of Rockland County. I enjoyed walking, hiking and cycling along the banks of the Hudson with my family. On 9/1 I1 became concerned about the threat of terrorism to Indian Point, as my daughter was in pre-school only 4 miles from Indian Point, and the 9/11 hijackers flew directly over the plant. It was, later learned, that in fact the, terrorists had- planned to, attack Indian Point, before they decided, instead, to attack the World Trade Center.As I learned more about the operations of Indian Point, my concern about a terrorist attack became dwarfed by the seemingly endless operating problems and leaks at the aging, facility, which the current owner, Entergy bought on or about 9/1 I. Nearly every day I read in the paper about some new problem.I attended in. Buchanan, NY I and was shocked to hear about numerous amount of repairs needed. When I expressed my concern an Entergy employee said "what's the big deal, wouldn't you drive an old car, it might be a little rusty, but it's still running". This was my introduction into the lack adequate aging management at Indian Point.Since that time, there have been chronic problems with the plant. In 2005 leaks-of tritium where discovered accidently near spent fuel pool #2, further investigation uncovered large amounts of Strontium 90 apparently leaking from spent fuel #1. However, to date, the exact location, size, and duration of the leaks, and identifying how to stop and remediate said leaks remains unknown.Since then other leaks also have been discovered by accident, such as the April 7t' steam leak. It is disturbing that the leaks are not being found through proper and thorough investigation, but rather by accident.I cannot understand how the NRC can possibly justify issuing Entergy a new superceding license to an additional 20 years, when the plant has clearly outlived its ability to be run without jeopardizing public health and safety,-and the integrity of the environment. During Katrina, I was at meeting with the NRC in Washington, D.C. where the NEI, the nuclear industry's powerful lobby group, I introduced a white paper' that recommended reducing the evacuation area guidance from the 10 mile radius, to a 2 mile wedge. NRC quickly rubberstamped favoring protection of the financial profits of the nuclear industry to those of public health and safety, as required by it's organizing mandate. Indian Point is unique, as it is the only plant located in the middle of 21 million residents, 24 miles from New York City, 3 miles from West Point Military Academy, is leaking Strontium 90, tritium and cesium'into the groundwater and Hudson River, and does not have an adequate, workable or fixable evacuation plan.Our elected officials (Federal, State and Local), and thousands of Hudson Valley residents have called for Indian Point's closure and for an Independent Safety Assessment prior to consideration for relicensing. Even though the NRC refused to require backup power for an emergency siren system, a Federal law was passed that did require such a system be installed and operable months ago. To date Entergy has been unable to properly install the required siren system.Upon decommissioning, I understand the law requires the site to cleaned up to the condition it was in prior to the plant being built. It appears that the law is being broken. For example in the case of Unit 1, which was shut down over 30 years ago, its spent fuel pool is currently leaking Strontium 90, tritium and cesium into the river. The river is continuing to be polluted as a result of the inaction of the owners and regulators. Rockland County is considering building a desalination plant, to use Hudson River water, as part of its public water supply, if the radioactive contamination from Indian Point is not stopped and fully remediated, it could adversely affect my health and the health of my children and family.If this was any other kind of business, such as a gas station, the government authorities would shut it down and make the owners remediate the underground leaks immediately. S Today, Indian Point could not be sited where it is located in the most densely populated region of the country, on a earthquake fault, and along with the inadequate aging management of the plant, the NRC cannot issue a new superceding license to the operator for another 20 years. [n fact the plant should be closed immediately and the cite decommissioned. [ declare under penalty of perjury that the foregoing is true and correct.Executed this _Iqday of December, 2007, at Spring Valley, NY.-n--2'State of New York))SS.: ..County of Rockland )On the -S day of DecvlVc" , in the year Z407before me, the undersigned, personally appeared S.cAsn 9.: , Sah r---ld , personally known to me or proved to me on the basis of satisfactory evidence to be the individual(s) whose name(s) is (are) subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted, executed the instrument. N/tary Public PATRICIA E. FRENCH Notary Public, 8wt't 01 New York No. oi FM5041488 Qualified in Rockland County Commission Expires 04/03W 0( EXHIBIT FFF UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of LicenseN o.ENTERGY NUCLEAR INDIAN POINT 2, L.L.C. ) DPR-26 Indian Point Energy Center Unit 2 Docket License Renewal Application No. 50-247 DECLARATION OF ROBERT A. JONES My name is Robert A. Jones, I live at 124 Trails End, New City 10956, with my wife and my three young children. [ am a member of Public Health and Sustainable Energy (PHASE).PHASE represents my interests in a Petition for Leave to Intervene, Request for Hearing and Contentions; and the Notice of Appearance, in the matter of Entergy Nuclear Indian Point 2, LLC, and Entergy Nuclear Operations, Inc, License Renewal Application. [ have lived in Rockland for 38 years. Until a few years ago [ used the river for swimmingand water skiing, off my boat. I stopped due to the condition of the water and all the leaks you hear about from Indian Point.When I was swimming and waterskiing, my friends and I would park our boats just north of the Haverstraw Bay, and we noticed the dramatic different in water temperature. It was always much warmer there. When we learned that is was warmed because Indian Point was dumping heated water.into the river we immediately using it, and it turned me off from swimming any where in the river. Indian Point has changed my quality of life.Now that I know that strontium and tritium in to the river I am even more concerned. I heard that they are considering using the Hudson River for Rockland County tap water, I think its crazy. Certainly if I won't swim it I wont'drink it or bathe in it. Or permit my young children to do so. This will certainly affect my quality of life.I love the Hudson River because it is beautiful area, it is close to home, convenient, unfortunately because of Indian Point there are many things I used to do on the water, that I now cannot do. The Hudson River is a unique and vital resource to-our community and the entire New York region., Today, Indian Point could not be cited where it is currently located, due the enormous surrounding population and lack of a workable evacuation plan.I work for a company that owns a gas station, where a spill was reported, the DEC and Health Department immediately shut down the station, until it was totally dug up and, remediated, even though it turned out not to be the gas stations fault. [ cannot understand how our government allows Indian Point to remain open and be considered for relicensing for another 20 years, with all, the leaks and problems that keeps arising..Indian Point is currently leaking radioactive waste into the groundwater and River, yet the NRC is considering to permit it to continue operating and leaking for another 20 years, to me this totally insane.I declare under penalty of perjury that the foregoing is true and correct.-x)Executed this -day of November, 2007, at Spring Valley, NY.Robert A. Jones-State of New York )" )ss.: County of Rockland )Onthe-,' day of 4'/ ':$> ,in the vear1i. before me, the undersigned, personally appeared ,A ,personally known to me or proved to me on the basis.of satisfactory evidenice to be the individual(s) whose name(s) is-(are) subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individyff(.) acted, executed the instrument. -.1, -JNot ry .P '- UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. ) LicenseNo. o .v- ,. DPR-64 Indian Point Energy Center Unit 3 ) Docket License Renewal Application No. 50-286 DECLARATION OF ROBERT A. JONES My name is Robert A; Jones, [ live at 124 Trails End, New City 10956, with my wife and my three young children. I am a member of Public Health and Sustainable Energy (PHASE).PHASE represents my interests in a Petition for Leave to Intervene, Request for Hearing and Contentions; and the Notice of Appearance, in the matter of Entergy Nuclear Indian Point 2, LLC, and Entergy Nuclear Operations, Inc, License Renewal Application. I have lived in, Rockland for 38 years. Until a few years ago I used the river for swimming and water skiing, off my boat. I stopped due to the condition of the water and all the leaks you hear about from Indian Point.When I was swimming and watersikiing, my friends and I would park our boats just north of the Haverstraw Bay, and we noticed the dramatic different in water temperature. It was always much warmer there. When we learned that is was warmed because Indian Point was dumping heated water into the river we immediately using it, and it turned me off from swimming any where in the river. Indian Point has changed my quality of life.Now that I know that strontium and tritium in to the river I am even more concerned. I heard that they are considering using the Hudson River for Rockland County tap water, I think its crazy. Certainly if I won't swim it I wont'drink it or bathe in it. Or permit my young children to do so. This will certainly affect my quality of life. The Hudson River is a unique and vital resource to our community and the entire New York region. Today, Indian Point could not be cited where it is currently located, due the enormous surrounding population and lack-of a workahle evacuation plan.I work for a company that owns a gas station, where a.spill was reported, the DEC and Health Department immediately shut down the station, until it was totally dug up and remediated, even though it turned out not to be the gas stations fault. I cannot understand how our government allows Indian Point-to remain open and be considered for relicensing for another 20 years, with all the leaks and problems that keeps arising.Indian Point is currently leaking radioactive waste into the groundwater and River, yet the NRC is considering to permit it to continue operating and leaking for another 20 years, to me this totally insane.I declare under penalty of perjury that the foregoing is true and correct.Executed, this -' day of November, 2007, at Spring Valley, NY.Robert A. JonleS State of New York )County of Rockland )On the dav of .- ',>.:. , in the yearJ22-before me, the undersigned, personally appeareqd. -L-., U.-1 -, -, personally known to me or proved to me on the basis of satisfactory evidence to be the individual(s) whose name(s) is (are) subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the indimvdua-s)acted 4 executed the instrument. --"3w ofPtaryubli, '* I " ,t " l '"44 t .......; , , l t EXHIBIT GGG UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 2, L.L.C. LicenseNo. ENTERGY NUCLEAR INDIAN POINT 3, LLC DPR-26 &ENTERGY NUCLEAR OPERATIONS, LCC DPR 64 Indian Point Energy Center Unit 2 & Indian Point Docket Entergy Center Unit 3 No. 50-247& No. 50-286 License Renewal Application DECLARATION OF MAUREEN G. RITTER My name is Maureen Ritter. I live at 46 Campbell Ave in Suffem NY with my husband and 2 school age children. We are located approximately 14 miles from the Indian Point Nuclear Reactors, which is considered to be the peak injury zone under NRC standards As a life long resident of Rockland County, mother and school teacher, I feel that Indian Point represents the singular largest threat to public health and safety to our region and most importantly the future of our children.Public Health and Sustainable Energy (PHASE) represents my interests in a Petition for Leave to Intervene, , Request for a Hearing; and notice of Appearance in the above matter.On September 11;, 2001 the planes that hit the world trade center traveled down the Hudson past IP toward their targets. Upon the news of the Towers' destruction, I ran to. my children's school to pick them up as did the majority of parents. It was a chaotic scene with the potential for full scale panic. That horrible day showed me several things:* The improbable can happen.* You can never be fully prepared for a catastrophic event or even a slow moving serious event.* Parents will do anything and ignore anyone to get to their children.In 2003, James Lee Witt, former director for FEMA, concluded that the evacuation was inadequate and unfixable. This study has been ignored by the NRC and seems to violate its own standards for protecting public health and safety.There is a litany of problems at Indian Point which fall under the heading of on-going issues. As the NRC considers a 20 year extension to the operation of these plants, it is counter intuitive for these issues to fall outside the criteria for "relicensing' (which is actually a new license).The Hudson River is the jewel of our region and has had to endure environmental assaults of every kind. Indian Point has greatly contributed to that struggle. The very operation of this plant has contributed strontium 90, tritium, and cesium. Plant #1's pool has been leaking for years. Then several years ago there were leaks that were "accidentally "discovered at plant #2.Beneath the campus of the reactors is now a pool of irradiated water, which is leaking into the Hudson. There is no firm plan or agreement'on how this is to be remedied. Decisions on blasting, drilling, pumping, draining do not seem to ensure that more contaminated water will not wind up in our drinking, water or wells. At a time when Rockland County is considering drawing, drinking, water fromý the Hudson and the construction of desalinization plant, the NRC must consider the river as a drinking source.The possibil-ity of the unforeseen always exists. In 2005 at IP #3 there was an accidental slip of a control rod into the reactor core. It was thought to be a result of a malfunction of an electrical switch. The rods are used to slow the reactor which could have had disastrous consequences if an immediate shut down was necessary... As these plants continue to age, problems like this will continue to arise.The public has had to withstand a sub-standard siren system (for which the NRC has yet to levy appropriate monetary fines); leaks;transformer explosions, radioactive isotopes being released into the air and water; postponed inspections; the absence of best available cooling technology; leaking fuel pools; the specter of seismic activity of the Ramapo fault; the use of the facility as a irradiated waste repository and the potential target of the Indian Point facility by terrorists. All of these realities lie outside the purview of the NRC in its consideration of a 20 year extension to the operation of these facilities. All of the realities impact the lives of my children and the 20 million who live within the 50 mile radius of these plants.I was raised to believe that our country put the protection of its people and their health and well being, as the highest priority. At its inception, the job of the NRC established guidelines to for citing power plants. Yet during this Current relicensing process the NRC will not hold Indian Point to those standards. Indian Point should not be given leeway just because it is operating. It is my understanding. that Indian Point would actually be granted a new superseding, license during this process. In that case, the NRC is in violation of its own standards. The focus of the NRC is on the maintenance, integrity and safety of the plant operations and the protection of all. It is not p the function of the NRC to debate the source or supply of electricity to our region. The power of Indian Point can be replaced but our environment and population can not. It is the duty of this agency to -make sure that sure that public health and safety is not something that is "grandfathered" in an effort to keep the plant operating. There is enough compelling evidence to close Indian Point now. The NRC should not undercut its function further by granting another license to the reactors at Indian Point.I declare under penalty of perjury that the foregoing is true and correct.Executed this. day of December 2007, Spring Valley, NY.,,-,-- Ji. _Maureen Ritter State of New York).)ss.: County of Rockland)On the > day of" , in the year r before me, the undersigned,T personally appeared." 'r,!.?,t\i..x l .,-Cy , personally known to me or proved to me.on the basis of satisfactory evidence to be the individual(s) whose name(s) is (are) subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted, executed-th

• n e 0. ...*b2--

EXHIBIT HHH ~..f 4-I UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of LicenseNo. ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. ) DPR-64 Indian Point Energy Center Unit 3 ) Docket£#ff~C6~' ,d/(l d ,L,6?d..tA/".No. 50-286 License Renewal Application DECLARATION OF NYC COUNCIL MEMBER JAMES VACCA'My name is James Vacca. I reside at 2 Cedar Place, Bronx New York 10465. 1 am currently the New York City Council Member for the 1 3 th Council District, located in the North East Bronx. Previously, I served as District Manager of Community Board #10 in-Bronx serving the communities of Throgs Neck, Pelham Bay, Country Club, Zerega, and Co-op City.I am writing this declaration on behalf of the constituents of the 1 3 th Council District.We are very concerned by the continuing operation of the Indian Point Nuclear power facility in Buchanan, New York 24 miles way. We oppose the re-licensing of this facility.The vulnerabilities associated with the facility are a persistent threat to the residents and the environment. For example, the New York City water supply is threatened by any accident or terrorist threat to the plant. Additionally, New York City does not rely on Indian Point for electricity. There have been numerous incidents which have caused the shut down. Our office is. in support of the announcement made by the New York Attorney General Andrew Cuomo yesterday, which calls for the NRC to deny re-licensing to Indian Point.Indian Point is unique, as it is. the only plant located in the middle of 21 million residents, 24 miles from New York City, 3 miles from West Point Military Academy, is leaking Strontium 90, tritium and cesium into the groundwater and Hudson River, and does not have an adequate, workable evacuation plan.There have been chronic problems with the plant. In 2005, leaks of tritium where discovered accidentally near spent fuel pool #2, further investigation uncovered large amounts of Strontium 90 apparently leaking from spent fuel #1. However, to date, the exact location, size, and duration of the leaks, and identifying how to stop and remediate said leaks remains unknown.Since then other leaks also have been discovered by accident, such as the April 7, 2007, steam leak. It is disturbing that the leaks are not being found through proper and thorough investigation, but rather by accident. I cannot understand how the NRC can possibly justify issuing Entergy a new superceding license to an additional, 20 years, when the plant has clearly outlived its ability to be run without jeopardizing, public health and safety, and the integrity of the environment. Many of my colleagues in Federal, State and Local government, as well as thousands of Hudson Valley and Bronx residents have called for Indian Point closure and for an Independent Safety Assessment prior to consideration for re-licensing. In fact, even though the NRC refused to require backup power for an emergency siren system, a Federal law was passed that did require such a system be installed and operable months ago. To date Entergy has been unable to properly install the required siren system.Today, Indian Point could not be sited where it is located. It is in the most densely populated region of the country and on an earthquake fault. The inadequate management of the plant with regard to safety issues strongly makes the case for denying a new superceding license to the operator that would be another 20 years in duration. In fact the plant should be closed immediately and the site decommissioned. I declare under penalty of perjury that the foregoing is true and correct.Executed this ____ day of December, 2007, at Bronx, NY.Xames. Vacca JAMIN R. SEWELL Notary Public, State of New York No. 02SE6139679 Qualified in Bronx County Term Expires Januar17 2010I UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of LicenseNo. ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. DPR-64 Indian Point Energy Center Unit 3 ) Docket No. 50-247 License Renewal Application DECLARATION OF NYC COUNCIL MEMBER JAMES VACCA My name is James Vacca. I reside at 2 Cedar Place, Bronx New York 10465. 1 am currently the New York City Council Member for the 1 3 th Council District, located in the North East Bronx. Previously, I served as District Manager of Community Board #10 in the Bronx serving the communities of Throgs Neck, Pelham Bay, Country Club, Zerega, and Co-op City.I am writing, this declaration on behalf of the constituents of the 1 3 th Council District.We are very concerned by the continuing operation of the Indian Point Nuclear power facility in Buchanan, New York 24 miles way. We oppose the re-licensing of this facility.The vulnerabilities associated with the facility are a persistent threat to the residents and the environment. For example, the New York City water supply is threatened by any accident or terrorist threat to the plant. Additionally, New York City does not rely on Indian Point for electricity. There have been numerous incidents which have caused the shut down. Our office is in support of the announcement made by the New York Attorney General Andrew Cuomo yesterday, which calls for the NRC to deny re-licensing to Indian Point.Indian Point is unique, as it is the only plant located in the middle of 21 million residents, 24 miles from New York City, 3 miles from West Point Military Academy, is leaking Strontium. 90, tritium and cesium into the groundwater and Hudson River, and does not have an adequate, workable evacuation plan.There have been chronic problems with the plant. In 2005, leaks of tritium where discovered accidentally near spent fuel pool #2, further investigation uncovered large amounts of Strontium 90 apparently leaking from spent fuel #1. However, to date, the exact location, size, and duration of the leaks, and identifying how to stop and remediate said leaks remains unknown.Since then other leaks also have been discovered by accident, such as the April 7, 2007, steam leak. It is disturbing that the leaks are not being found through proper and thorough investigation, but rather by accident. I cannot understand how the NRC can possibly justify issuing Entergy a new superceding license to. an additional 20 years, when the plant has clearly outlived its ability to be run without jeopardizing public health and safety, and the integrity of the environment. Many of my colleagues in Federal, State and Local government, as well as thousands of Hudson Valley and Bronx residents have called for Indian Point closure and for an Independent Safety Assessment prior to consideration for re-licensing. In fact, even though the NRC refused to require backup power for an emergency siren system, a Federal law was passed that did require such a system be installed and operable months ago. To date Entergy has been unable to properly install the required siren system.Today, Indian Point could not be sited where it is located. It is in the most densely populated region of the country and on an earthquake fault. The inadequate management of the plant with regard to safety issues strongly makes the case for denying a new superceding license to the operator that would be another 20 years in duration. In fact the plant should be closed immediately and the site decommissioned. I declare under penalty of perjury that the foregoing is true and correct.Executed this 676 day of December, 2007, at Bronx, NY./4ames Vacca JAMIN R. SEWELL Notary Public, State of New York No. 02SE6139679 Qualified in Bronx County EXHIBIT III "J; f UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of LicenseNo. ENTERGY NUCLEAR INDIAN POINT 2, L.L.C. ) DPR-26 Indian Point Energy Center Unit 2 ) Docket No. 50-247 License Renewal Application DECLARATION OF DORICE MADRONERO[, Dorice Madronero reside at 4 Regis Court, Suffern, NY 10901. As a resident of Rockland County since 1962 1 have a particular sense of the growth in this community. Currently, I serve as president of the Rockland County Conservation Association, Inc.Having lived in Stony Point and attended North Rockland schools I have a lifetime connection to the Hudson River. My family looked out over the river everyday and saw firsthand the natural beauty that poignantly reflects the ebb and flow of life. The potential for the devastation to this area that might result from a mishap at Indian Point is beyond reason.To consider the growth in population and congestion in the area and the potential for successful evacuation is troubling for anyone who calls this area home. This region is fertile with history of this nation and to consider the possibilities of it being uninhabitable because of a mishap at Indian Point is beyond reason.The stark reality of unintended leaking of strontium 90 from Indian Point is troubling in itself, but the potential that the Hudson River will be a drinking water source for Rockland County is beyond reason.For the NRC to issue a new super ceding license to the operator for another 20 years is beyond reason.I declare under penalty of perjury that the foregoing is true and correct.Executed this 8th day of December, 2007, at Suffern, NY"Drr'6dce Maonero IjN.L-ILLAa'YS-ý A ... 1)0u t1 ri C in ockI~ h r z" UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of LicenseNo. ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. ) DPR-64 Indian Point Energy Center Unit 3 ) Docket"6w2/q AkC L IA/C. No. 50-286 License Renewal Application DECLARATION OF DORICE MADRONERO 1, Dorice Madionero reside at 4 Regis Court, Suffern, NY 10901. As a resident of Rockland County since 1962 1 have a particular sense of the growth in this community. Currently, I serve as president of the Rockland County Conservation Association, Inc.Having lived in Stony Point and attended North Rockland schools I have a lifetime connection to the Hudson River. My family looked out over the river everyday and saw firsthand the natural beauty that poignantly reflects the ebb and flow of life. The potential for the devastation to this area that might result from a mishap at Indian Point is beyond reason.To consider the growth in population and congestion in the area and the potential for successful evacuation is troubling for anyone who calls this area home. This region is fertile with history of this nation and to consider the possibilities of it being uninhabitable because of a mishap at Indian Point is beyond reason.The stark reality of unintended leaking of strontium 90 from Indian Point is troubling in itself, but the potential that the Hudson River will be a drinking water source for Rockland County is beyond reason.For the NRC to issue a new super ceding license to the operator for another 20 years is beyond reason.I declare under penalty of perjury that the foregoing is true and correct.Executed this 8th day of December, 2007, at Suffern, NY Dorice Ma ronero S , .--T EXHIBIT JJJ January 7, 2007 Ms. Lisa Rainwater Riverkeeper, Inc.828 South Broadway Tarrytown, NY 10591

Dear Ms. Rainwater:

As a person who appears to embrace the need of truly independent oversight of the India, Point Energy Center, I thought the enclosed information would be of great interest to you.I have enclosed several documents that I believe you will find at first glance unbelievable; and then when the'potential consequences sink in, I hope you find them even more disturbing than a few malfunctioning sirens or underground radioactive water, that has not flowed beyond the plant boundaries.ments outline a plan that Entergy Nuclear Northeast has implemented at their Northeast plants that TOTALLY ELIMINATES the quality control departments (day to day oversight), and severely cut the staffing of their quality assurance departments (general oversight). You are probably asking, "How can they do that". We have asked the same question, as "independent inspections" are codified in I 0CFRS0 Appendix B.We have been told that I 0CFR50 does not mandate a QC department; it mandates"independent inspections". What Entergy has done over the past several years is write QC out of their Quality Assurance Program Document, and put in general phrases about"independent inspections". They have included a shor't phrase stating that personnel performing inspections work for the QA Manager, while they are performing inspections. That would hilarious, except for the fact that many of those craftsmen wouldn't even know the QA Manager if they were on the elevator with him._what exactly have they done? EEntergy Nuclear Northeast's upper management has dissolved the QC Departments at each of their plants, and is now having each department perform their own inspections!!!!! For example, Bill, Joe and Sam are maintenance mechanics. On one job Bill and Joe perform the work, while Sam inspects the work. On the next job, Bill and Sando the job, ,hile Joe performs the inspection Entergy has stated time and time again they are not violating any requirement, as someone other than those doing the work is performing each inspection. I am writing to you as a former member of the QC Department. I am not writing due to"sour grapes", as each of the former QC Department staff members still has a job at IPEC, and none of us have received a pay cut. I am writing to you because we (former QC staff) truly believe the dismantling of the QC Department has very serious safety implications at IPEC. When this plan was first announce several years ago by the Northeast Director of Corporate Oversight, Mike Columb, "we" expressed our serious reservations to the plan. With more than 25 years of quality control experience each, we had many examples from nuclear plants around the world that this was a poor idea. Of tle many stories we shared with Mr. Columb, the recurring one was mechanics arguing\at an unacceptable condition was "close enough"; that by spending the TIME to rework She part won't make it that much better. Now that the mechanics inspect the work of their ,eers, we now say amongst ourselves that "close enough", has now become "good ough".Another reason given for implementing this plan was to make workers accountable for their own work. Let me put that argument into perspective.tSuch logic would be like the State saying that since NYS citizens are inherently honest, and to save a substantial amount of money on police patrols, the State was going to make drivers and passengers accountable for the driver's driving. When a passenger identified a driver violating a traffic law, they would report the violation. That logic would be simply laughable, except that is what Entergy Nuclear Northeast has done to quality oversight at its Northeast Plants.Please review the enclosed documents, and I trust that you too will agree that the immediate risk of not having quality control oversight has far greater immediate and long term consequences than the current discussions of sirens, evacuation plans and ground water contamination.. Since the NRC is fully aware of this policy and has not taken any action, we are taking the time to write our Senators, Congressmen, and local government officials, hoping that your collective resources can make a change to a potentially disastrous policy.Signed: A sincerely concerned Entergy Nuclear Northeast employee, and the former QC Staff. June 3, 2005 IP-QAS-05-007 MESSAGE FROM JOE PERROTTA, QA MANAGER As part of a fleet alignment initiative, as of June 5, 2005, the Quality Assurance Department Quality Services/Inspection function will complete its transition to Maintenance and Programs &Components Engineering (P&CE) Departments. Maintenance inspection (ANSI type verifications) will be performed within the Maintenance Department and all Nondestructive Examinations (UT, RT, PT, MT, VT) will now be performed by P&CE. Previously only NDE UT and RT were performed by P&CE. In addition, the responsibility for Civil and Coatings Inspections will be transferred to Design Engineering. QA personnel are being transferred to the respective organizations to support this initiative. Implementing procedures have been revised to reflect this change. As with any new process there will be a period of adjustment. ENN-MA-102,."Maintenance Inspection", has been generated and issued for the inspection process,.clearly defining roles and responsibilities to ensure compliance when implementing the program within Maintenance. ENN-MA-102 identifies a Maintenance Inspection Coordinator (MWC). For IPEC our designated MIC is Mark Gettleman. Mark's primary responsibility will be the designation of required inspection points, within Maintenance activities in accordance with ENN-MA-102, adding and deleting inspection points as applicable. See the attached memo for details of the transitions. If youlhave questions, contact Mark Gettleman X8523 (Maintenance Inspection Coordinator), Norm Nilsen X8686 (Maintenance), or Nelson Azevado X6048 (P&CE).Attachments: Chris Schwarz, VP Operations, Transition of QC Inspection to Maintenance and, Engineering Entergy Date: June 3, 2005 To: IPEC Personnel From: Mike Co]omb, Acting VP Operations

Subject:

Transition of ANSI Inspections to Maintenance, All NDE Examinations to Site Engineering and the Use and Understanding of Maintenance and Other Site Documentation As the Quality Assurance Department will no longer have a Quality Control Section within the department, all ANSI mechanical, electrical and instrument & control inspect:ions will be the responsibility of individuals qualified and certified to ANSI N45.2.6 within the Maintenance Department. All nondestructive examinations (NDE), which includes volumetric, surface, visual, welding and ANSI inspections for civil and concrete activities, will be conducted by site Engineering. At this point in time not all of the Mainteriunce Procedures, Technical Mechanical Specifications and other site documents have been revised to reflect this change in line ownership of the inspection and.examination process reflected in station procedures. Based on this transition, the following guidelines have been assembled to assist station personnel in understanding the organization that should be contacted or reflected in work instructions such as work orders, modifications and procedures.

1) If the term "Notify Quality Assurance or Quality Control for a Start of Work" appears in a Maintenance Procedure, sign, initial and date the step as recognition that a QC organization no longer exits at IPEC. This step was used as notification to QC as a possible activity for process monitoring.

The Quality Assurance Department will no longer have a Quality Control organization within the department to respond to the notification.

2) All pre-existing "Quality Control Inspection Hold Points", except for code required and non-routine inspections, as defined in ENN-MA- 102, are no longer valid or in effect. All inspections will be selected and indicated in appropriate work documents in accordance with ENN-MA-102.

Such documents will be identified as requiring inspection points by a qualified inspector. Any specific hold points in work documents will be individually' stamped as a qualified inspection point. Transition of ANSI Inspections to Maintenance, Page 2 of 2 All NDE Examinations to Site Engineering and the use and UnderstaMding of Maintenance and Other Site Documentation

3) If a Maintenance Procedure, Technical Mechanical Specification or other site document has a step or references one of the following examinations such as, radiography (RT), ultrasonic examination (UT), magnetic particle (MT), liquid penetrant (PT), visual examination (VT-I, VT-2, & VT-3), weld examination, coatings, and civil inspections contact Programs, Component

& Engineering (PC&E) for the required support.4) If a modification is being developed and nondestructive examinations as well as civil or coating examinations/inspections are required, Engineering will be responsible for providing the required support.5) If a modification is being developed the original construction criteria shall apply requiring the applicable "Inspection" for the ANSI activities involving "Mechanical, Electrical, and Instrument & Control" tasks. The required support shall be provided by the Maintenance Department.

6) The Maintenance Department will have a Maintenance Inspection Coordinator (MIC), who will be responsible for reviewing the 12-week schedule and selecting safety related activities whether routine or non-routine maintenance for ANSI inspections.

The MIC shall-be ANSI N45.2.6 qualified and certified.

7) Planners shall be required to reference this memorandum when planning work orders involving Maintenance Procedures, Technical Mechanical Specifications and other site documents to determine which organization should be contacted when inspections or examinations are required.

The ENN-WM-105 procedure, entitled, "Planning", states in Section 4.0, "Responsibilities", specifically 4.2.6, "Tlhat the Planner is responsible for specifying Hold Points, Verifications, and Witness Points per site requirements." Based on this statement, the Planner will rely on the MIC to determine the ANSI inspections for routine and non-routine maintenance by T-8. (As required in EN-MA-102.). The planner will use site documentation such as, specifications, drawings and procedures to determine when NDE examinations are required or request assistance from Engineering A new Maintenance procedure, EN-MA-102, entitled, "Inspection Program", has been issued to cover how ANSI required inspections would be selected and conducted. The required NDE examinations are covered in the Nondestructive Examination Procedures. These procedures can be found in the Nuclear Management Manual, These instructions are to be followed until the site-specific procedures are revised to reflect the line ownership of inspections and examinations. RP/RMP cc: Michael Colomb Richard Patch Richard Petrone Mel Garofalo Joe Perrotta Enlý,ergy Interoffice Correspondence April 17, 2006 IP-QAS-06-003MC TO: IPEC Personnel FROM: J. Perrotta, QA Manager T. Carson, Maintenance Manager

Subject:

TRANSITION OF ANSI INSPECTIONS TO MAINTENANCE, ALL NDE EXAMINATIONS TO SITE ENGINEERING, AND THE USE AND UNDERSTANDING OF MAINTENANCE AND OTHER SITE DOCUMENTATION As the Quality Assurance Department no longer has a Quality Control section within the department, all ANSI Mechanical, Electrical, and Instrumentation & Control inspections are now the responsibility of individuals qualified and certified to ANSI N45.2.6 within the Maintenance Department, in accordance with EN-MA-i102 Inspection Program.Based on this transition, not all of the Maintenance procedures, technical maintenance specifications, and other site documents have currently been revised to reflect this change.The following guidance, as originally identified by memorandum issued on June 3, 2005 by Mr. Michael Colomb, Acting VP Operations, is being reissued. Additional guidance is being added for clarification. 1.) All pre-existing "Quality Control Inspection Hold Points", except for code required and non-routine inspections, as defined in EN-MA-102, are no longer valid or in effect. -All inspections will be amd are selected and indicated in appropriate work documents in accordance with EN-MA-102. Such documents will be identified as "Requiring Inspection Points by a Qualified Inspector". Any specific hold points in work documents will be electronically entered, or hold points individually stamped as a qualified inspection point. F-PAS-O6-O03MC Page 2 of 2 Transition of ANSI Inspections to Maintenance, All NDE Examinations to Site Engineering and the Use and Understanding of Maintenance and Other Site Documentation 2.) For further clarification and in accordance with EN and site procedures, all "Pre-existing Quality Control Inspection Hold Points", except for code required and for non-routine inspections as identified in EN-MA-102, shall be:-N/A'd as Not Applicable -Initialed and dated (preferably by a Supervisor) or Designee-Clarification with an explanation stating that "QC No Longer Valid or In Effect" These instructions are to be followed until the site-specific procedures are revised to reflect the line ownership of inspections and examinations, and the hold points are formerly deleted.MG/cc Cc: T. Carson M. Colornb M. Gettleman P. Morris R. Patch J. Perrotta File 2.2 Records Overall Nuclear Safety Culture Trends NSC Tren 0 U-dS Nuclear-Safety Culture Trends 1999-2006 4M0 3,76 ft-YYv.41- VOA"CC, ATII?wor Year The overall trend in Nuclear Safety Culture has been declining since the 2002 survey. Indian Point has shown a sharper decline than other Entergy fleet plants Cultural Dimension Details IM del /*Ours..1. .0 ]PEC Molor Functional.Orgs. N I)( 'LLAR SAFETY CULTURE aNs VALV rS, B .11AV1011-S & PRA("I'lCLS S Ff TY CONSOOLIN, NVORK ENVIROMMENT 01111.0YEE CONCERNS,' PROGRAM F.FFj-'.C'I'tV EN E.SS GFNERAL CULTURE 4K NY 0 It K E NV I I(ONNI E, NT OP A-IT ..EN I NA I Issl-* > 10 .int'g. Itjip ss.;: > I% nreg, rrqlunr.w

21) e yl.. -,rtjslull or 0 ." NogaIblh' Po~ilive *' "['csij (Meisim 5-10% IfigihFr " lowe.)t t or a .- S.i arfieo (a 'I -/ Nr.n lv r "re 1 (Ne,, T lraf > 10% higher ,' lower)Indian Point has maintained a very good to excellent (blue boxes) Safety Conscious Work Environment but shows notable declines among somne worker groups in area such as Employee Concerns Program and, general work culture (morale issues). Note: green= good, yellow=nominally adequate UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of LicenseNo.

ENTERGY NUCLEAR INDIAN POINT 2, L.L.C.ENTERGY NUCLEAR INDIAN POINT 3, L.L.C. &DPR-26-&DPR 64 Indian Point Energy Center Unit 2 & ) Docket Indian Point Energy Center 3 No. 50-247 &Entergy Nuclear Operations, Inc. No. 50-286 ASLBP No.License Renewal Application 70-858 LR-BDOI DECLARATION OF RICHARD L. BRODSKY Richard L. Brodsky represents the 92nd Assembly District, which includes the Towns of Greenburgh and Mount Pleasant, the Villages of Ardsley, Dobbs Ferry, Elmsford, Hastings-on-Hudson, Irvington, Pleasantville, Sleepy Hollow, Tarrytown, a portion of the Village of Briarcliff Manor, and part of the City of Yonkers.Assemblyman Brodsky has led efforts to investigate the Indian Point nuclear power plants, undertook the first independent analysis of the Evacuation Plans for Indian Point, and in February 2002, he released the Interim Report on the Evacuation Plans for the Indian Point Nuclear Generating Facility, which detailed the serious and systematic deficiencies which make it unable to "adequately protect the public health and safety," as required by law.These findings were confirmed by the James Lee Witt Report released eleven months later. On June 13, 2002, Chairman Brodsky, along with numerous local, State, and federal elected officials, submitted a formal Petition to the Federal Emergency Management Agency requesting that they withdraw their approval of the Indian Point Evacuation Plans, marking the first formal challenge to a nuclear plant's evacuation plans.He is also the lead Petitioner and Counsel, along with the Hudson River Sloop Clearwater, Pete and Toshi Seeger and others, in successful litigation seeking to compel the State Department of Environmental Conservation to effectively regulate the ongoing pollution of the Hudson River caused by Indian Point's intake of over two billion gallons of water daily.He serves as Chairman of the Standing Committee on Corporations, Authorities, and Commissions, which oversees the state's public and private corporations. This includes jurisdiction over business corporation law and telecommunications, as well as all public authorities, such as the MTA, the Thruway Authority, the Public Service Commission, the Port Authority, and the Lower Manhattan Development Corporation. From 1993 to 2002, Assemblyman Brodsky served as Chairman of the Committee on Environmental Conservation, where he structured the most dramatic legislative advances in environmental conservation in over two decades. His accomplishments include authoring the legislation that created the Environmental Protection Fund, the first dedicated fund for environmental protection in the history of New York State, and the Clean Air/Clean Water Bond Act, a $1.75 billion bond act passed by voters across New York to provide a funding mechanism for unfunded clean air and clean water projects throughout the State.He lives within 15 miles of the plant in Elmsford, New York with his wife and two daughters. I declare under penalty of perjury that the foregoing is true and correct.I y407,Emsod Ex cut d thiA ay of -'-p4 2007, at Elmsford, NY.L1T~clL. Brodsky* State of New York ))SS.: County of Westchester) On the ic day of j( i7"C/ , in the yearZZ6.+before me, the undersigned, personally appeared'Ric -I ' , personally known to me. or proved to me on the basis of satisfactory evidence to be the individual(s) whose name(s) is (are) subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted, executed the instrument. 4i , .... ... N o tary Pihbllc -7* c- S~t'" of ..w cl " d Oil Exhibit FP No. 1. The Associated Press March 3, 1993, Wednesday, AM cycle Problems With Fire-Retarding Material Went Uncorrected, Panel Told BYLINE: By H. JOSEF HEBERT, Associated Press Writer SECTION: Washington Dateline LENGTH: 511 words DATELINE: WASHINGTON Federal regulators for years did nothing to correct problems with a fire-retarding material at nuclear power plants because they relied on industry assurances, a congressional panel was told Wednesday. A report by the Nuclear Regulatoryv Commnission'sinrspector general said NR IC staff members who approved the fire-protective material "op'erated under the mpremise that the informl Oa tion was accrate be cause, it w~as submiitted under oath." The Juistice Deatin a eu a criminal invies .tigation inito whether the NRC ad utitlities were misled abo~ut the fire-retarding catpabilities of Therino-Lag, a gyps~ump-]ke material use~d to protlect critical electrical wires at nuclear power Plants i case of fire.The mlaterial issused in 79 nuclear mooWtrg O plants nationwide. The NRC elast year directed that operators of the plants StepLIP physicaI monitoring of the plants to detect' problems early'juntil a deci~sibon is made xy1iat to do with the material. ThrIwe NRC s swed Itedd thetre were probis withthe mateii]manufactured h by Thermal ScienceInc.ofSt.Louis,oandtt the agency had argely ignored conacrns raised by and othcrs.about the material.In a fOllOW-Upar ranr SemlinltteVesuaornttedothaeHouse Ene'rgy andCommverce i subcommittee, tlesNRC said agency staff members over more than a decade madeo effort ito i reiew test resuleros defindcienssubrnfitedbtheNilia1factswller ofnTheno-La tiendtclaimes thatithele m erial met NRC requirem~ents. s The management philosoh wa by qne staff smember asa 'You have l somebody sormetirne," said the inspector general's report. It said there also was ressure t approve the material and ,"not delay (:nuclearp pat) operation." NRCo Chairnan Ivan Selin toldathe Subcommittee that theninter n g uncovered "numerous missed opprtunities" toidentifyand correct the robilems with the material."There were Serious deficiencies on ther oNC' part, as wel as on the pr of t1 ndl utilities involved,m Selin said. Heaidthe NC would determine afterit itc pleted its X investigation w to take disciplinmary action againpus ayfthe agency officials involvesd 4'The NR required fire-protective materials a rsouran c tricaldcablesJohnuclear plants afterran 1 ire at.te Browvns Ferry reactor in Alabama damnaLdmor than 1 ,600 electrical cables.Thermo-Lag was aproved by as a protective barrier in the early I1980s. The NRIC. howVever, never conducted indepen~dent tcýtt determinle if the material met fderal standards, reyn ntadoeot Over 10 years there al so were a number of reports -som from utilities -indicating that themialeria1 failed o meet NRC requirements, inclu~ding one that it produce toxic gases wheniburned. But each~ timne the NRC failed 'to pursue them, agency inivestigators said."'The N1RC blindly ac~cepted the utilities' assurances," said' Rep. John Dingell, D-Mich- chairmhan of the, subcomimttee and of the full Energyand Commerce Codimittee. "This is hardly a regulatory success." LANGUAGE: ENGLISH Copyright 1993 Associated Press All Rights Reserved States News Service March 3, 1993, Wednesday CONGRESSIONAL PANEL SAYS AREA NUCLEAR POWER PLANTS MAY EMPLOY DEFECTIVE FIRE RETARDANTS: Protectant Supposed To Aid In Emergency Shutdowns BYLINE: By Jennifer Babson, States News Service LENGTH: 713 words DATELINE: WASHINGTON 0 A fire retardant used at Limerick and the Peach Bottom atomic power station to protect electrical cables needed to shut down these facilities during emergencies, may be faulty, a U.S. House panel heard Wednesday. Witnesses appearing before a House Energy and Commerce subcommittee, said the Nuclear Regulatory Commission (NRC) turned a blind eye to contradictory and sometimes sketchy test results conducted on THERMO-LAG, a fire retardant manufactured by Thermal Science Inc. (TSJ), of St. Louis.Under NRC regulations, the retardant material must be able to withstand very high fire temperatures --for one hour if the plant has a sprinkler system, three hours if it doesn't.But accordingto Leo Norton, the NRC's Assistant Inspector General of Investigations, in one test, THERMO-LAG collapsed within 22 minutes. He also said the NRC never bothered to personally test the product, preferring to take the word of vendors and utility company officials who swore under oath test results showed the product worked."The NRC, to a considerable extent, relied on people swearing to particular information," -Norton said. "If information was submitted under oath, they would accept it, whether it was the vendor or the licensee." At Wednesday's hearing, Energy and Commerce Committee Chairman John Dingell, D-Michigan, charged that THERMO-LAG has resulted in "substandard fire protection" for nuclear plants that employ the material.In response to these allegations, nuclear power plant officials said they're taking added safety precautions, some of which have been ordered recently by the NRC.Bill Jones, a spokesman for the Philadelphia Electric Company, which operates both the Limerick and Peach Bottom plants, said the company has implemented additional fire safety precautions, while it waits for the agency to take further action."Whatever needs to be done, we'll do it, in the meantime, I really don't think the public needs to be concerned," Jones said."Our concern is to prevent a fire from happening in the first place," he added. "We feel as long as we can safely prevent fires, you won't need fire protection barriers to protect you." David Williams, Inspector General for the U.S. Nuclear Regulatory Commission, also told lawmakers the NRC "did not conduct an adequate review" of the so-called 'tests' that many utility companies cited when they requested NRC permission to use THERMO-LAG. A report Williams released in August of last year found that, "Between 1981 and 1991, the NRC staff did not observe any tests of THERMO-LAG. Further, the NRC staff did not investigate the qualifications of or visit the laboratory which purportedly supervised most of the THERMO-LAG tests." The NRC also didn't conduct any inspections of TSI.And although NRC regulations stipulated that fire retardant perfonrnance tests be conducted by a'nationally recognized fire testing laboratory,' the commission accepted the results of tests conducted by some companies that didn't, fall into that category, and others with "no fire testing expertise." Some tests also weren't conducted in accordance with NRC fire testing standards, and others were conducted by TSI, which had a financial stake in their outcome.The NRC is currently investigating the effectiveness of THERMO-LAG. Shortly before Williams released his report in August of last year, the commission surveyed the nation's nuclear utilities to find out how many used THERMO-LAG. They also ordered plants to implement a series of additional fire safety precautions until the matter is resolved.In aprepared statemnent, Ivan ScIn, Chairman of the U.S. Nuclear Reou Iatory Conim issi~On.conceded the agency's lack of regulatpry oyersight may have cotrbud to aqetoalccepaco the THERMO-LAG miaterial in the first'place." Bfit S~elin placed the blamec equally on the shoulders Of utilities that chose to use the pr~oduict.. "Th ere were serious deficiencies on the NRZC's part, as well as on thepart of the utilities involved," hie said.A~lthough NRC "Inquiries to date indicate that repairs of upgrading may be needed," Seliii said he agenc y Is holding off on further action ntiln it has "adequately identified what criteria are appropriate to decide whatlstandards-have been imet." LOAD-DATE: March 5, 1993 LANGUAGE: ENGLISH Copyright 1993 States News Service Exhibit FP No. 2 Nov 27 2007 1:29PM Beyond Nuclear 301 -920-1037 p. 1 ERROR: typecheck OFFENDING COMMAND: restore STACK:--@exec--{256 --array-- trEnc /Encoding --exch-- def 1-savelevel-Nov 27 2,GO? 1:32PM Be!lond.Nuclear r~o~ 7 0.0 13RM B~od uc er-301-92'0-1'037 -P.3....::::" ? : " ...... .......... I I I I I I I I I III III ] I I I I I I I I I I ..... ... .... .. .ADEQUACY OF NRC STAFF'S ACCEPTANCE AND REVIEW OF THERMO-LAG 330-1 FIRE BARRIER MATERIAL INSPg 4OR fqp4 )ý-klalE INSPECTOR CATE GAENERATL O 14SPECTOR DATE GENERAL FOR INVESTIGATIONS Nov 27 2007 1:32PM Bejond Nuclear 301-920-1037 p.4 TABLE OF CONTENTS PAGE EXECUTIVE

SUMMARY

.........................................

3 BASIS AND SCOPE ........................................... 9 BACKGROUND.. .............................. .............. 10 FIRE BARRIER QUALIFICATION ............................ 12 AMPACITY DERATING REQUIREMENTS ............................... 13 DETAILS ... .............................................. 14 FIRE ENDURANCE..... ........ ......................... 14 AMPACITY DERATING ................................... 17 INDICATIONS OF INADEQUATE PERFORMANCE ...................... 19 CURRENT STATUS...... ................................ 22 FINDINGS................................................ 25 Nov 27 2007 1:32PM Bejon'd. Nuclear 301-920-1037 p.5 3 EXECUTIVE

SUMMARY

This Office of the Inspector General (01G) inspection was initiated in the spring of 1991, based on receipt of allegations that questioned the adequacy of Thermo-Lag 330-1.Thermo-Lag 330-1 is a fire barrier material manufactured by Thermal Science, Inc.(TSI), St. Louis, Missouri. The Nuclear Regulatory Commission (NRC) staff estimates that Thermo-Lag 330-1 is utilized in approximately 80-100 nuclear power plants to protect redundant safe shutdown electrical circuits from fire as required by NRC regulations. It has been alleged however, that the material does not provide the required level of fire protection and also, that the ampacity derating figures for Thermo-Lag 330-1 are actually much higher than the figures reported by TSI. Our inspection addressed the adequacy of the NRC staffs acceptance and review of Thermo-Lag 330-1, and the staff's response to reports of problems with Thermo-Lag 330-1 that were reported over a period of about 10 years.On March 22, 1975, a fire occurred at the Browns Ferry nuclear power plant in Alabama. A Special Review Group (SRG) was established by the NRC shortly after the Browns Ferry fire to identify lessons learned and to make recommendations. The SRG concluded that improvements, in fire prevention and fire control were needed and proposed a number of recommendations. One recommendation involved the need to protect redundant electrical systems required to achieve and maintain safe shutdown in the event of a fire. The NRC provided immediate guidance on this issue to the nuclear power industry. In 1981, Appendix R was issued and Section nM.G. specifically addressed the requirements involving the protection of safe shutdown systems. These requirements have been made applicable to all nuclear power plants.One method of satisfying this safe shutdown requirement is to enclose the redundant electrical circuits with fire-rated barriers. Before licensees could use a fire barrier material to satisfy the requirements of Appendix R, the NRC required that the products have a fire resistance rating of either one or three hours. If a one hour barrier was chosen, an automatic sprinkler system was required. The NRC and industry required that this rating be achieved by having a nationally recognized, fire testing laboratory subject the fire barrier material to a standard fire exposure test.In 1981, the NRC began receiving requests from licensees for acceptance of Thermo-Lag 330-1 to satisfy the safe shutdown requirements in Appendix-R. Since its initial acceptance in 1981, Thermo-Lag 330-1 has been the fire barrier material most extensively accepted by the NRC and installed by licensees. When electric cables are placed in trays and conduits and enclosed by fire barrier material, the temperature of the cable insulation increases because the heat generated by electricity passing through the cables is retained within the barrier. Since electrical cable insulation is vulnerable to premature degradation when operating at higher than Nov 27 2007 1:33PM Besdond Nuclear 301-920-1037 p.6 4 normal temperatures, the ampacity of the enclosed cables must be derated (lowered) to adjust for the insulating effect of the fire barrier material Therefore, a low ampacity derating requirement would be an important consideration relative to the fire barrier material selected for installation in nuclear power plants.The NRC requires that cable derating due to the use of fire retardant coatings be considered by utilities during. plant design or when design changes are made to existing electrical system configurations. The NRC electrical staff is responsible for reviewing cable derating to ensure compliance with accepted industry practice.Beginning in 1981, the NRC received reports documenting fire tests of Thermo-Lag 330-1 that were conducted by TSI. Fire tests conducted by TSI were witnessed by Industrial Testing Laboratories, Inc. (IM), St. Louis, Missouri. A review of a number of ITL reports of fire tests conducted by TSI and witnessed by lTL disclosed that the TSI tests had not been performed in accordance with the required standards. For example, the test furnace and temperature measuring devices used by TSI during the -tests did not meet the standards. Although the NRC requires a full scale fire endurance test, the tests conducted at TS1 were "small scale" tests. NRC requirements state that a fire endurance test on barrier materials must be conducted-by a nationally recognized, fire testing laboratory. The NRC staff accepted ITL test reports, and ITL test reports were used throughout the industry to qualify Thermo-Lag 330-1 for use in power plants., It has been recently determined that ITL had no fire testing expertise. TSI fire endurance tests were reportedly validated by the presence of a representative from ITM, utility officials, and inspectors from the American Nuclear Insurers (ANI).OIG found that utility officials and ANI inspectors merely witnessed the conduct of fire tests. They did not inspect the test articles as they were being constructed by TSI employees, and they were often absent during significant portions of the fire tests.Although the lTLtest reports state the fire tests were supervised and controlled entirely by MTJ, the ITL representative was present only as a witness to verify that a test was conducted. The test reports were actually written by TSI and then signed by the President of ITL with no substantive verification that the data in the reports reflected the actual tests. In some instances, the IML President simply signed test report cover sheets for TSI without seeing the test report.The NRC managers of the fire protection staff advised OIG that the NRC conducted reviews by auditing paperwork. The NRC staff considered it the responsibility of the utilities to provide accurate information concerning the conduct of the qualification tests.Consequently, the NRC did not find it necessary to observe qualification tests of Thermo-Lag 330-1.In 1982 the NRC received from Susquehanna nuclear power plant two reports of TSI, tests of one hour Thermo-Lag 330-1. In June 1982, the NRC fire protection staff 44ov 27 -2007 1: 33PM Be!jond Nuclear 301-920-1037 p.7 5 rejected both TSI reports because the tests were simulated and differed from the..required fire testing standards. The NRC recommended that Susquehanna have a test conducted at an approved laboratory. The OIG inspection found that within months of rejecting the TSI tests submitted by Susquehanna, the NRC staff accepted a fire test from Washington Nuclear Project-2 (WNP-2) which was conducted using the same substandard procedures. During the fall of 1982, TSI conducted two additional tests of Thermo-Lag 330-1 that passed and that had applicability to many power plants. These test reports were used throughout the nuclear power industry to qualify Thermo-Lag 330-1 with the NRC.Specific power plants that used these generic tests included Comanche Peak, Palo Verde, River Bend, Prairie Island, Callaway, and Susquehanna. ITL was witness to these tests which were conducted under the same inadequate conditions as previous TSI tests.Ampacity -terating Originally, TSI reported to Comanche Peak that Therno-Lag 330-I would require a 10 percent ampacity derating. In 1982, TSI conducted an ampacity derating test with ITL as the witness and produced a derating figure of about 17 percent. During this same time period, manufacturers of other fire barrier materials conducted ampacity derating tests and reported ampacity derating figures far higher than those reported by TSI, some as high as 40 percent.In 1986, an ampacity derating test on Thermo-Lag 330-M was conducted at a nationally recognized laboratory-Underwriters Laboratories (UL). The UL test produced ampacity derating figures of about 31 percent for the three hour and about 28 percent for the one hour Thermo-Lag 330-1. These figures were significantly higher than those previously reported by TSL In the above test, UL officials told OIG that TSI refused to follow the UL ampacity derating testing procedure. After the TSI representatives left the UL facility, an additional ampacity derating test on Thermo-Lag 330-1 was conducted by ULT which followed the UtL ampacity derating test procedure. The second UL test produced ampacity derating figures for Thermo-Lag 330-1 of nearly 40 percent for the three hour barrier and 36 percent for the one hour barrier. These figures were not reported to the NRC.Indications of inadeuate performance of Thernio-Lag 330-1 not addressed by the NRC During its inquiry, OIG learned of instances over the past ten years which were reported to the NRC and which questioned the ability of Thermo-Lag 330-1 to perform as claimed by the manufacturer. However, our review of much of this information disclosed that the NRC staff did not effectively respond to these indicators. Several of these instances are discussed below: Nov*27 20-07 1:33PM Bebond Nuclear 301-920-1.037 p.8 6 Inadequate TSI test reports submitted by Susquehanna In June 1982, the NRC fire protection staff rejected two TS3 test reports submitted by Susquehanna and recommended that a test be conducted at an approved testing laboratory. One reason for rejecting the tests was because the tests were not performed in accordance with adequate quality assurance procedures. In October 1982, however, the NRC staff accepted a test report from WNP-2 that was conducted at TSI in the same manner. The nuclear industry continued to use TSI tests that were documented in JTL test reports to qualify the installation of Thermo-Lag 330-1. OIG found no action by the NRC staff to address the fact that utilities were using TSI tests that were documented in itL test reports to qualify their installation of Tbermo-Lag 330-1. Nor was any effort made to resolve the fact that tests using the same T`SI procedures were rejected and then accepted by the NRC.10 CFR Part 21 Report on ampacity derating On October 2,1986, TSI notified the NRC by mailgram of ampacity derating figures that were significantly higher than those reported earlier by TSI. The earlier TSI figures were used by utilities to design electric power systems utilizing Thermo-Lag 330-1. The TSI mailgram was administratively recorded as a Part 21 Report by the NRC. In December 1990, the Part 21 Report was closed by the NRC without taking any action.Comanche Peak report on new ampacity derating figures In 1987, Comanche Peak provided a written report to the NRC detailing new ampacity derating figures provided by TSL The new figures were 31 percent and 20 percent, substantially higher than the 10 percent originally reported by TSI and used in the initial cable sizing calculations at Comanche Peak. In its report to the NRC, Comanche Peak stated that failure to consider the additional derating of power cables due to Thermo-Lag 330-1 installation could cause the power cables to exceed the design temperature rating of the cables. OIG found no NRC follow-up with MS! in order to obtain an explanation for the significant increase over the ampacity derating figures initially provided by TSI to Comanche Peak.Allegations regarding the performance of Thermo-Lag 330-1 In March 1989,- the NRC received an allegation that, when burned, Tbermo-Lag 330-1 gave off lethal gases. In support of this concern, the alleger provided the staff with information from a test of Thermo-Lag 330-1 documented in a May 1986 SwRI report.During an Allegation Review Board meeting it was decided to close the allegation without further action.The alleger also informed the NRC about a fire endurance test that involved Thermo-Lag 330-1 as a fire barrier used in conjunction with a fire penetration seal. The alleger Kov 27 2007 1:34PM Beydond Nuclear 301-820-1037 p.9 7 pointed out that the Thermo-Lag 330-1 had disintegrated during the test. OIG did not find any indication that the NRC staff conducted an inquiry into the information that Thermo-Lag 330-1 had been consumed in a fire test.Problems with Tbermo-Lag 330-1 at Comanche Peak In 1989, NRC Region IV was informed that panels of one hour Thermo-Lag 330-1 were arriving at Comanche Peak from TSI, that measured less than the required thickness. Subsequently, Comanche Peak management discussed the situation with TSL. In a July 13, 1990, letter to the NRC, Comanche Peak explained that the behavior of Thermo-Lag 330-1 under fire conditions is dependent on the density-of the product and not on the thickness. After reviewing the Comanche Peak July 13, 1990, letter and without further inquiry of TSI or Comanche Peak, Region IV accepted the resolution of the matter and closed this issue.OIG learned from the NRC and National Institute of Standards and Technology staff that the Comanche Peak quality control practice of checking weights was not an accurate indication of the performance of Thermo-Lag 330-1 panels. The identification of this problem provided another opportunity for the NRC to inquire into the performance of., TSI and Thermo-Lag 330-1 that was not pursued.Concerns about the performance of Thermo-Lag 330-1 at River Bend In December 1989, the River Bend nuclear power plant submitted an Informational Report to the NRC regarding an October 1989 test of Thermo-Lag 330-1 that failed. As a result, River Bend conducted an investigation and identified several generic issues with Thermo-Lag 330-1 that were outlined in the Informational Report. The OIG inspection did not identify any immediate action by the NRC to address the generic concerns with Thermo-Lag 330-1. It was not until May 1991, after additional allegations regarding the performance of Thermo-Lag 330-1 were received by the NRC, that NRC inspectors made a fact finding visit to River Bend to review problems with the performance of Thermo-Lag 330-1.In June 1991, in response to both the allegations and the problems identified at River Bend, the NRC established-a Special Review Team to review Thermo-Lag 330-1 issues and make recommendations for their resolution. In August and December 1991, the NRC issued Information Notices (IN 91-47 and IN 91-79) which discussed the test failure of Thermo-Lag 330-1 at River Bend.In December 1991, the NRC Vendor Inspection Branch (VIB) conducted its first inspection at TSI. This inspection disclosed problems with the TSI quality. assurance Nov 27 2007 1:34PM Bebond Nuclear 301-920-1037 p.10 8 program and that ITL did not act as an independent testing laboratory when it witnessed TSI qualification tests of Thermo-Lag 330-1.In January 1992, the Special Review Team completed its activities and in April 1992, issued a final report documenting its review of the performance of Thermo-Lag 330-1.One conclusion in the report was the fire resistance ratings and ampacity derating factors for the Thermo-La& 330-1 fire barrier system are indeterminate. The NRC is continuing to monitor the Thermo-Lag 330-1 testing being conducted by Comanche Peak Further, the NRC is currently sponsoring testing of Thermo-Lag'330.1 at the National Institute of Standards and Technology. This testing was still ongoing at the time this report was prepared.FINDINGS Based on the information developed during this inspection, the OIG found that the NRC staff did not conduct an adequate review of fire endurance and ampacity derating information concerning the ability of the fire barrier material, Thermo-Lag 330-1. Had the staff conducted a thorough review of the test reports submitted by industry or verified the test procedures and test results reported by TSI, a number of problems with the test program and Thermo-Lag 330-1 would have been discovered. An NRC vendor inspection at TSI at an earlier date would have determined there were problems with the TSI testing program. Further, it would have been discovered that the test reports were actually written by the vendor with no substantive verification that the data in the reports reflected the data recorded during the tests. Because these reviews and inspections were not conducted, it was not until 1992 that the NRC staff determined that the performance of Thermo-Lag 330-1 with respect to fire resistance ratings and ampacity derating was indeterminate. In addition to the inadequate initial review process discussed above, the staff did not take any significant action between 1982 and 1991 when reports of problems with Thermo-Lag 330-1 were received. Our inspection disclosed seven instances in which NRC did not pursue reports of problems with Thermo-Lag 330-1. Nov 27 20A07 1: 34P3M Bebon-d Nuclear 301-920-1037 p.il 9 BASIS AND SCOPE This Office of the Inspector General (OIG) inspection was initiated in the spring of 1991, when the U.S. Nuclear Regulatory Commission (NRC), received allegations that questioned the adequacy of Thermo-Lag 330-1. Thermo-Lag 330-1 is a fire barrier material manufactured by Thermal Science, Inc. (TSI), St. Louis, Missouri. The NRC staff estimates that Thermo-Lag 330-1 is utilized in approximately 80-100 nuclear power plants. Thermo-Lag 330-1 was accepted by the NRC to protect redundant safe shutdown electrical circuits from fire. However, it has been alleged that the material does not provide the required level of protection with respect to fire endurance. Further, information was received that indicated that the ampacity derating figures for Thermo-Lag 330-1 are much higher than the reported figures. Ampacity derating figures are used in assuring the useful life of cables is achieved.This OIG inspection addressed the adequacy of the NRC staff's acceptance and review of Thermo-Lag 330-1 as a fire barrier material for use in nuclear power plants. In addition, the inspection included a review of the staff's response to reports of problems with Thermo-Lag 330-1 that were received over a period of about 10 years. Our efforts involved interviews with utility officials at Comanche Peak, Susquehanna, Salem, Washington Nuclear Project, and Palo Verde. At each of these plants, we reviewed the documentation involving the decision to use Thermo-Lag 330-1. Interviews were also conducted with current and former NRC employees involved in the process of reviewing and accepting Thermo-Lag 330-1 for installation in nuclear power plants. We reviewed 12 years of correspondence among the utilities, vendors and the NRC involving the acceptance and installation of Tbermo-Lag 330-1. We interviewed personnel from three fire testing laboratories, the Industrial Testing Laboratories, Inc. (ITL), and the manufacturer of a competing fire barrier material, Minnesota Mining and Manufacturing Company (3M). We reviewed reports of tests conducted at each of the laboratories. These tests also involved fire barrier materials other than Thermo-Lag 330-1.In addition to this inspection effort, OIG, in conjunction with the Office of Investigations,. is conducting an investigation involving the manufacturer of Thermo-Lag 330-1. OIG is also examining several allegations of NRC employee misconduct. ,Nov 27 2007 1:34PM Betiond Nuclear 301-920-1037 p.12 10 BACKGROUND On March 22, 1975, a fire occurred at the Browns Ferry nuclear plant in Alabama. At that time, the nuclear reactors in Units I and 2 at Browns Ferry were operating, and a third unit was under construction. The fire began in the cable spreading room where technicians were testing for air leaks in the penetration seals between the cable spreading room and the reactor building. The fire caused minima] damage in the cable spreading room; however, it quickly spread through a seal into the Unit 1 reactor building located adjacent to the cable spreading room. The fire continued for about seven hours inside cable trays and conduits in the reactor building. Approximately 1600 electrical cables were damaged. Electrical shorts and grounding occurred as the insulation burned off the cables. Tbis resulted in the loss of control power for much of the equipment, such as valves, pumps, and blowers. Although all of the emergency core cooling systems for Unit 1 were rendered inoperable, and portions of Unit 2 cooling systems were also affected, sufficient equipment remained operational to shut down the reactors and maintain the reactor cores in a cooled and safe condition. The damage to electric power and control systems also jeopardized the ability of the operators to monitor the status of the plant, including the reactor.A Special Review Group (SRG) was established by the NRC shortly after the Browns Ferry fire to identify lessons learned and to make recommendations for the future. The SRG concluded that improvements, especially in the areas of fire prevention and fire control, should be made in most existing nuclear facilities. In its report,"Recommendations Related to Browns Ferry Fire" (NLUREG-0050, February 1976), the SRG pointed out a lack of definitive criteria, codes, or standards related to fire prevention and fire protection in power plants. The review group also noted that the existing criteria covering separation of redundant electrical control circuits and power -cables needed revision. The NRC developed technical guidance from the recommendations in the SRG report. In May 1976, the NRC issued guidance in Branch Technical Position (BTP) 9.5-1. This guidance, however, did not apply to nuclear facilities alieady in operation at that time. Guidance to operating plants was provided in July 1976 in Appendix A to the BTP.By early 1980, most operating plants had implemented the guidelines in Appendix A, one of which was to protect redundant electrical systems required to achieve and maintain safe shutdown in the event of a fire. However, the fire protection program had some significant problems. Some licensees had expressed continuing disagreement with and refused to adopt recommendations relating to a number of issues. To resolve these contested issues, the Commission issued a fire protection rule for operating nuclear power plants. The new rule, contained in Title 10, Code of Federal RegLUlations Part 50.48 (10 CFR 50.48) and 10 CFR 50, Appendix R, set out minimum fire protection requirements. These guidelines became effective on February 19, 1981, and applied to all plants licensed to operate before January 1, 1979. Nov 27 2007 1:35PM Bedond Nuclear 3.01-920-1037 p.13 11 As originally proposed to the public, all of the requirements in Appendix R would have applied to plants licensed to operate prior to January 1, 1979. Based on a review of public comments, the Commission determined that only three items in Appendix R were of such safety significance that they should apply to all plants. Accordingly, 10 CFR 50.48 requires that each nuclear power plant licensed to operate before January 1, 1979, meet the requirements of Appendix 11, Sections lII.G, EILJ, and 111.O. These sections deal with protection of safe shutdown capability, emergency lighting, and the reactor coolant pump lubrication system. Due to the safety significance of these items, the Commission approved the staff's recommendation that plants receiving operating licenses after December 31, 1978, must also satisfy the requirements of these sections.The requirements of Section I.0, pertain to. the protection of redundant safe shutdown electrical systems. The objective of this section is to ensure that at least one electrical circuit capable of achieving and maintaining the safe shutdown of the plant will remain free of damage and be available during and after a fire in the plant Licensees can satisfy Section T1I.G by separating one train of electricail systems from its redundant train by:. 1) a horizontal distance of 20 feet with no intervening combustibles, or 2) with fire-rated barriers. The fire resistance rating required of the barriers is either one hour or three hours depending on the other fire protection features provided in the fire area.The feature distinguishing the one hour from the three hour requirement is that an automatic sprinkler system must be installed when the one hour barrier is utilized.For power plants unable to achieve a horizontal separation of 20 feet for the redundant safe shutdown systems, the installation of an acceptable fire barrier material was critical.However, in 1981 when Appendix R became effective, fire barrier materials that could be used to protect electrical circuits were still in the developmental stage. Before licensees could use a fire barrier material to satisfy the requirements of Appendix R, the NRC required that the products have a fire resistance rating of either one or three hours. The NRC and industry required that this rating be achieved by having a nationally recognized, fire testing laboratory subject the fire barrier material to a standard fire exposure test.In 1981, the NRC began receiving requests from licensees for acceptance of Thermo-Lag 330-1 to satisfy the fire protection requirements in Appendix R. Since its initial acceptance in 1981, Thermo-Lag 330-1 has been the fire barrier material most extensively accepted by the NRC. It has been installed by many licensees to comply with the fire protection requirements of Section II1.G of Appendix R. Thermo-Lag 330-1 has been installed in about 80-100 nuclear power plants to protect redundant safe shutdown electrical systems for both the one hour and three hour requirements of Section I11.G of Appendix R. Nov 27 2007 1:35PM Beyjond Nuclear 301-920-1037 p.14 12 Fire barrier qualificaton When the NRC proposed 10 CFR 50.48 and Appendix R, the NRC stated that although nuclear power plants have few combustible materials and the chances of a fire are low, the potential consequences of fire are serious. For this reason, three hours was selected as the minimum fire resistance rating for fire barriers used to separate redundant safe shutdown electrical systems. The NRC considered a one hour barrier with an automatic fire detection and suppression system to be equivalent to a three hour fire barrier.Therefore, fire barriers relied upon to protect redundant safe shutdown systems need to have a fire resistance rating of either one hour or three hours.The NRC adopted the standard fire test defined by the American Society for Testing and Materials (ASTM) in ASTM E-119, "Standards for Fire Resistance of Building Materials." The fire resistance rating is defined as "the time that materials or assemblies have withstood a fire exposure as established in accordance with the test procedure of Standard Methods of Fire Tests of Building Construction and Materials." ASTM E-119 also requires that a "hose stream" test be conducted. This consists of directing a stream of water onto the fire barrier immediately following the fire endurance test. The success criteria for the hose stream test would be that no opening in the barrier developed which permitted a projection of water to penetrate the fire barrier. Further, the NRC also required that the fire endurance qualification tests be conducted by nationally recognized, fire testing laboratories. An NRC guidance document, Generic Letter (GL) 86-10, provided additional information on existing NRC fire barrier acceptance criteria. One criteria discussed was the requirement that the transmission of heat through the fire barrier during a fire endurance test shall not have been such as to raise the temperature to more than 325 degrees Fahrenheit inside the fire barrier. The 325 degree temperature criterion is used by the NRC because it functions to preserve the integrity of the cables and keep them free of fire damage.Additional NRC criteria discussed in GL 86-10 required that the fire barrite specimen being exposed to the standard fire test duplicate what would be installed in the power plant. This is significant because construction variations between the test article and the installed assembly could substantially change the performance of the fire barrier.Consequently, this requirement applies to materials, methods of construction, the dimensions, and the configuration of the test barrier. GL 86-10 stated that licensees should either install barriers that replicate the configurations that were tested, or justify to the NRC that installed fire barriers that deviate from the tested configurations provide an equivalent level of protection. Nov 27 2007 1:36PM Bebond Nuclear 301-920-1037 p.15 13=raig Reouirements As electric current passes through a cable, heat is generated which raises the temperature of the cable. Ampacity is the electrical current-carrying capacity of a cable specified by the manufacturer. To avoid damage to cable insulation, the manufacturer's recommended temperature should not be exceeded during normal operations. When cables are placed in trays and conduits and enclosed in fire barrier material, the temperature of the cable insulation increases because the heat is retained by the barrier.Because electrical cable insulation is vulnerable to premature degradation when operating at abnormally high temperatures, the ampacity of the enclosed cables must be derated (lowered) to adjust for the insulating effect of the fire barrier material. To ensure that the expected life of electrical cables was not shortened, cable ampacity derating became an important consideration relative to the fire barrier material selected for installation in the nuclear power plants.The "Protection Systems" section of 10 CFR 50.55a(h), requires that protection systems meet certain requirements for the ampacity derating of components. These requirements are set forth in the Institute of Electrical and Electronics Engineers Standard "Criteria For Protection Systems For Nuclear Power Generating Stations." Additionally, in accordance with NRC requirements, cable derating due to the use of fire retardant coatings must be considered by utilities during plant design or when design changes are made to existing electrical system configurations. The NRC electrical staff is responsible for reviewing cable derating to ensure compliance with accepted industry pracuce. Nov 27 2007 1:36PM Besjond Nuclear 301-S20-1037 p.16 14 DETAILS This OIG inspection was initiated upon receipt of allegations and other information indicating that Thermo-Lag 330-1 did not perform adequately with respect to fire endurance and ampacity derating. Because Thermo-Lag 330-1 is installed in about 80-100 nuclear power plants, the OIG inspection addressed the adequacy of the NRC staffs acceptance and review of Thermo-Lag 330-1 as a fire barrier material. Our inspection also involved a review of how the NRC staff has responded over the years to incidents that indicated problems with Thermo-Lag 330-1. 0IG efforts included interviews with officials of utilities, vendors, fire testing laboratories, current and former NRC employees, and a review of documents extending over a period of nearly 12 years. The results of our inspection are presented in this section.Fire endurace To comply with the NRC fire protection requirements, utilities could separate redundant, safe shutdown circuits by at least 20 feet or protect the circuits with a fire barrier. The fire barrier material could have a one hour fire endurance rating if fire detection and automatic sprinkler systems were installed. If no sprinkler system were used, the barrier material must have a three hour fire endurance rating. In 1981, the practice of enclosing cable trays and conduits in nuclear power plants with fire barrier material was new;therefore, the availability of products for this purpose was limited. At this time, TSI began its efforts to adapt and qualify Thermo-Lag 330-1 for use in nuclear power plants.Because Thermo-Lag 330-1 had no history of use in nuclear power plants to protect safe shutdown circuits, utilities proposing to install this fire barrier material sought NRC staff acceptance. Along with their proposals to use Thermo-Lag 330-1, the utilities submitted test reports and other documentation to qualify Thermo-Lag 330-1 as a fire barrier that met NRC fire protection requirements. Beginning in 1981, the NRC received reports documenting fire tests of Thermo-Lag 330-1 that were conducted by TSI. These test reports were submitted to the NRC by utilities during the licensing process and by TSL One example of this occurred in early 1982, when Washington Nuclear Project 2 (WNP-2) officials informed the NRC fire protection staff of a plan to have both one hour and three hour fire endurance tests conducted on cable trays enclosed with Thermo-Lag 330-1. In May and June 1982, the two tests were conducted by TSI in its St. Louis, Missouri facility. The tests were witnessed by ITL, also located in St. Louis, Missouri. WNP-2 provided the test reports to the NRC in August and October of that year. The test results indicated both one hour and three hour materials passed the fire endurance tests. NRC requirements state that a fire endurance test on barrier materials must be conducted by a nationally recognized, fire testing laboratory. As discussed in this OIG report, it has been recently determined that 1TL was not a nationally recognized, fire testing laboratory. Nevertheless, the NRC staff Nov 27 2007 1:3GPM Beyjond Nuclear 301-920-1037 p.17 15 accepted ITL test reports. ITL test reports were used throughout the industry to qualify Thermo-Lag 330-1 for use in nuclear power plants.Subsequent to initiation of this inspection, NRC technical staff reviewed a number. of the reports of fire tests conducted by TSI and witnessed by ITL These reviews disclosed that the TSI tests had not been performed in accordance with ASTM Standard E-119 as required by the NRC. The test furnace and temperature measuring devices used by TSI during the tests did not meet the requirements of ASTM E-119. In fact, although the NRC requires a full scale fire endurance test, the tests conducted at TSI are considered to be "small scale" tests. Additionally, the reports prepared to document the TSI tests did not contain sufficient detail to verify that some basic requirements of the ASTM E-119 test procedure, such as equipment calibration, were performed. Further, although the NRC required that the tested configurations duplicate the field installation, it was later determined that many of the configurations tested by TSI were not typical of field installations. TSI fire endurance tests were reportedly validated by the presence of a representative from ITL, utility officials, and inspectors from American Nuclear Insurers (ANI). ANI is a property insurance organization which witnessed several of the TSI tests of Thermo-Lag 330-1 for utilities that planned to install Thermo-Lag 330-1. ANT witnessed the TS1 tests to determine if Thermo-Lag 330-1 could provide acceptable protection of property for insurance purposes. OIG found that utility officials and ANY inspectors merely witnessed the conduct of fire tests. They did not inspect the test articles as they were being constructed by TSI employees to ensure all quality control and technical specifications were followed. They also could not verify that the tested articles were constructed the same as the ones described in the test reports. In fact, OIG was told that utility and ANT representatives were often absent during significant portions of the fire tests.Although the 1TL test reports state the fire tests were supervised and controlled entirely by IT7L, it was determined that TM3 controlled the tests and the ITL representative was present only as a witness to verify that a test was conducted. Quality control and construction of the test assemblies were completed by TSI with no independent verification by IML Further, even though the fire test reports were published with an ITL cover sheet, they were actually written by TSI and then signed by the President of ITL with no substantive verification that the data in the reports reflected the actual tests.Further, the ITL President related that in several instances he signed cover sheets for test reports without seeing the test reports.Upon receipt of proposals to use Thermo-Lag 330-1, the NRC fire protection staff reviewed the written material to determine the acceptability of Thermo-Lag 330-1.When interviewed by the 01G, the NRC staff responsible for reviewing and accepting the proposals indicated that their managers told them that their review should consist of an examination of the documents submitted by the utilities. For example, when a utility Nov 27 2007 1:36PM Bebond Nuclear 301-920-1037 p.18 16 submitted a test report on a fire barrier material, the staff reviewed the test report to see that the report stated that the test was conducted in accordance with the NRC and industry fire endurance test standards and that the results were acceptable based on NRC criteria. The NRC managers of the fire protection staff advised OIG that the NRC review consisted of an audit of thepaperwork submitted by the utilities. The NRC staff considered it the responsibility of the utilities to provide accurate information concerning the conduct of the qualification tests. The managers explained that utilities formally submitted information under oath. Consequently, the NRC did not find it necessary to observe any qualification tests of Thermo-Lag 330-1.In 1981, Comanche Peak submitted a proposal to install Thermo-Lag 330-1 in Unit 1.The proposal was supported by a one hour fire endurance test conducted at Southwest Research Institute (SwRI). SwRI is a nationally recognized, fire testing laboratory. This is the only fire endurance test involving Thermo-Lag 330-1 conducted by a nationally recognized, fire testing laboratory that passed the NRC fire protection requirements. The Thermo-Lag 330-1 material that was tested at SwRI included an embedded layer of fiberglass. However, Comanche Peak decided not to install Thermo-Lag 330-1 with the fiberglass, and no other utility installed Thermo-Lag 330-1 with embedded fiberglass. In May 1982, the NRC received from Susquehanna two TSI one hour test reports documenting TSI tests conducted in 1981 at the TSI facility. These reports were provided to the NRC by Susquehanna in an effort to support the installation of Thermo-Lag 330-1 and eliminate the need to conduct an additional test. However, in June 1982, the NRC fire protection staff rejected both TSI reports because they found the tests were not performed in accordance with adequate quality assurance procedures. Further, the tests conducted by TSI were "simulated" ASTM E-119 tests which differed from the required ASTM E-119 standard test. Although the NRC staff reviewers identified significant problems with these TSI reports, the OIG inspection found that within months, the NRC staff accepted a fire test which was conducted in the same furnace and under the same inadequate quality assu-ance procedures. The test was submitted by Washington Nuclear Project 2 as a basis for installing Thermo-Lag 330-1 in that plant.In August 1982, the NRC fire protection reviewers also received fire endurance test results on one hour Thermo-Lag 330-1 conducted at SwRI for Susquehanna Unit 1.Unlike the one hour fire test conducted for WNP-2 at TSJ and witnessed by ITL, the fire test conducted at SwRI did not pass the one hour Thermo-Lag 330-1 fire test. The test that failed was conducted at a nationally recognized, fire testing laboratory, while the test that passed was conducted by TSI and witnessed by an employee of ITL, a laboratory with no fire testing expertise. Therefore, during the same time period, the NRC fire protection staff received conflicting results of fire tests of one hour Thermo-Lag 330-1 conducted at different laboratories. The OIG inspection determined that the NRC reviewers did not pursue why one test passed and the other failed. NL-06-078 Docket No. 50-286 Attachment 1 Page 7 of 14 6.2 The requested exemption does not present an undue risk to the public health and safety.The Hemyc ERFBS configurations installed in IP3 Fire Areas ETN-4 and PAB-2 will provide a fire resistance capability of at least 30 minutes, as discussed in Section 5.0. The minimal fire hazards and ignition sources, combined with the nature of the fire hazards in the areas, the active and passive fire protection features, and the controls on transient combustibles and ignition sources, as discussed in Section 3.0, provide assurance that the credible fire challenge to the IP3 Hemyc ERFBS will be substantially less than that of an equivalent ASTM E 119 30-minute fire exposure. Therefore, as discussed in Section 4.0, the installed ERFBS can be expected to provide adequate protection for the affected safe-shutdown raceways and enclosed cables.Therefore, given the existing level of fire protection defense in depth, combined with the minimal fire challenge presented by the credible fire scenarios in these areas, and the favorable FP equipment operating history, the change in credited ERFBS fire resistance rating from one hour to 30minutes will not degrade the effectiveness of the IP3 fire protection program, nor will it challenge the credited post-fire safe-shutdown capability. Based on the determination that safe shutdown in the event of a-fire can be achieved and maintained with less than a one-hour fire resistance rating, the requested revision to the existing exemptions does not present an undue risk to the public health and safety.6.3 The requested exemption is consistent with the common defense and security The requested revision to the existing exemptions is not directly related to and should not adversely impact the common defense and security.6.4 Special circumstances are present -underlying purpose of the rule 10 CFR 50.12(a) requires that special circumstance be present in order for the Commission to consider granting an exemption. Per 10 CFR 50.12(a)(2)(ii), one special circumstance is that application of the regulation in the particular circumstances would not serve the underlying purpose of the rule or is not necessary to achieve the underlying purpose of the rule.The underlying purpose of 10 CFR 50, Appendix R, Section IIL.G is to provide reasonable assurance that at least one means of achieving and maintaining safe shutdown conditions will remain available during and after any postulated fire. For the areas containing the Hemyc ERFBS installations, the credible fire challenge to the IP3 Hemyc ERFBS due to any postulated fire will be substantially less than that of an equivalent ASTM E 119 30-minute fire exposure. Therefore, a fire NL-06-078 Docket No. 50-286 Attachment 1 Page 8 of 14 resistance capability of at least 30 minutes provides protection of the components required for achieving and maintaining safe shutdown. Therefore, the underlying purpose of the rule is satisfied and the application of the regulation in these particular circumstances is not necessary to achieve the underlying purpose of the rule.

7.0 CONCLUSION

The defense-in-depth objectives of the Fire Protection Program are to 1) Prevent fires from occurring;

2) Detect, control, and extinguish promptly those fires that do occur; and, 3) Provide protection from the effects of a fire for structures, systems, and components needed to achieve and maintain safe shutdown.The fire hazards analysis of the fire zones containing the Hemyc ERFBS installations and the existing protection (after completion of modifications discussed in Section 5.0) of the electrical raceways show that these objectives are met. The first objective is supported by the fact that there are few significant ignition sources' in the areas, and transient combustibles are controlled.

Supporting the second objective are the active fire detection and suppression features in each area. The third objective is supported by the Hemyc ERFBS configurations which provide protection from credible fire exposures, which have an expected duration less than that of the proposed 30 minute rating.This request for revision of existing exemptions is warranted under the provisions of 10 CFR 50.12, in that it is authorized by law, does not present an undue risk to the public health and safety, and is consistent with the common defense and security. Further, it meets the requirement for a special circumstance in that it satisfies the underlying purpose of 10 CFR 50 Appendix R by providing an ERFBS that will provide protection for the duration of any postulated fire such that safe shutdown can be achieved and maintained. Ignition sources in the affected fire zones consist of limited transient combustibles (all zones), several equipment cabinets and (3kVA) 480/120V instrument power transformer BH8 (Fire Zone 73A), and a CCW pump motor (Fire Zone 1) NL-06-078 Docket No. 50-286 Attachment I Page 9 of 14

8.0 REFERENCES

8.1 NRC Letter and SER, S. A. Varga to J. C. Brons (NYPA); Indian Point 3 Nuclear Power Plant -Exemption From Certain Requirements of Section III.G and IIl.J of Appendix R to 10 CFR Part 50, January 7, 1987 8.2 NYPA Letter, J. C. Brons to S. A. Varga (NRC); Information to Support the Evaluation of IP3 to 10 CFR 50.48 and Appendix R to 10 CFR 50, September 19, 1985 8.3 NYPA Letter, J. C. Brons to S. A. Varga (NRC); Appendix R Fire Protection Program, August 16, 1984 8.4 NRC Letter and SER, S. A. Varga to J. C. Brons (NYPA); Exemptions From the Requirements of 10 CFR 50, Appendix R, for the Indian Point Nuclear Generating Plant, Unit No. 3 (IP-3), February 2, 1984 8.5 Hemyc (One-Hour) Electrical Raceway Fire Barrier Systems Performance Testing;Conduit and Junction Box Raceways (Omega Point Laboratories Fire Test Report, Project 14790-123263, dated April 11, 2005)8.6 Hemyc (One-Hour) Electrical Raceway Fire Barrier Systems Performance Testing;Cable Tray, Cable Air Drop and Junction Box Raceways (Omega Point Laboratories Fire Test Report, Project 14790-123264, dated April 18, 2005)8.7 IP3-ANAL-FP-02143, Indian Point 3 Fire Hazards Analysis, Revision 4 8.8 EN-DC-127, Control of Hot Work and Ignition Sources, Revision 2 8.9 ENN-DC-161, Transient Combustible Program, Revision 1 8.10 NUREG-1 805, "Fire Dynamics Tools (FDTs) Quantitative Fire Hazard Analysis Methods for the U.S. NRC Fire Protection Inspection Program," December 2004.8.11 Entergy Engineering Report IP-RPT-06-00062, Revision 0; "Comparison of IP3 Hemyc Electrical Raceway Fire Barrier System to NRC Hemyc Fire Test Results." Nov 27 2007 1:37PM Betiond Nuclear 301-920-1037 p.19 17 During the fall of 1982, TSI conducted two additional tests of Thermo-Lag 330-1. These were one and three hour fire endurance tests on cable trays containing a cable configuration that had applicability to many power plants. The tests were conducted in September and October 1982, at TSI with ITL witnessing the tests. As noted earlier, ITL did not possess any fire testing expertise. In both of these tests (rrL Reports 82.11-80 and 82-11-81), ITL represented that Thermo-Lag 330-1 passed the NRC requirements. Due to the generic nature of the test articles, these test reports were used throughout the nuclear power industry to qualify Thermo-Lag 330-1 with the NRC. Specific power plants that used these generic tests included Comanche Peak,. Palo Verde, River Bend, Prairie Island, Callaway, and Susquehanna. Once the NRC staff accepted Thermo-Lag 330-1 as a fire barrier that met NRC requirements, numerous proposals to use Thermo-Lag 330-1 were submitted by other utilities. For example, in the case of Palo Verde in early 1983, utility personnel verbally informed the NRC of their proposal to install Thermo-Lag 330-1 because it had been previously tested and the NRC had already accepted it. Palo Verde personnel told OIG that the NRC staff reviewer expressed no concerns with the use of Thermo-Lag 330-1;therefore, Palo Verde had no reason to conduct their own tests. Rather, Palo Verde used one of the generic tests conducted by TSI and witnessed by ITL as the basis for installing Thermo-Lag 330-1.During this inspection, OIG became aware of about 25 tests of Thermio-Lag 330-1 that were conducted by TSI with ITL acting as a witness. JTL test reports prepared to document these tests indicated that with few exceptions, Thermo-Lag 330-1 met NRC fire protection requirements. Many of these tests conducted by TSI were used to qualify the installation of Thermo-Lag 330-1 at nuclear power plants.Amacity derating As electric current passes through cables, heat is generated which raises the temperature of the cables. When cables are placed in cable trays and conduits, and enclosed in fire barrier material, the temperatures of the cables increase because heat is retained by the barrier. Electrical cables that operate in temperatures that are too high will deteriorate prematurely. Because of the negative effect of abnormally high temperatures, the electrical current-carrying capacity (ampacity) of the enclosed cables must be derated (lowered) to adjust for the insulating effect of the fire barrier material. Therefore, those fire barrier materials requiring the least derating would be most attractive to the user.As a result, cable ampacity derating became an important consideration relative to the fire barrier material selected for installation in nuclear power plants.TSI conducted ampacity derating tests of Thermo-Lag 330-1. Originally, TSI reported to Comanche Peak that Thermo-Lag 330-1 would require a 10 percent ampacity derating.In 1982, TSI conducted a test with ITL as the witness and produced an ampacity derating figure of about 17 percent. As with the fire endurance test reports written by TSI and N- :nnl'7 * -'DI" i n I V L L- ~, , * .or ,, oe:rio iNuclear 30l -920U-1037 p.20* 18 signed by IrL, the TSI ampacity derating test reports stated that the tests were conducted under the supervision and total control of ITL However, as noted earlier the ITL representatives told us they only witnessed the conduct of the tests, they did not control the tests, and they did not write the reports.During this same time period, manufacturers of other fire barrier materials conducted ampacity derating tests and reported ampacity derating figures far higher than those reported by TSI. For example, Underwriters Laboratories (UL) conducted ampacity derating tests on the fire barrier material manufactured by Minnesota Mining and Manufacturing (3M) and reported ampacity derating figures of about 40 percent.Because TSI reported significantly lower derating figures compared to other manufacturers, Thermo-Lag 330-1 was an attractive choice for use by the utilities in reducing the negative effects of heat in the barriers.In 1986, an engineering firm associated with the construction of the South Texas nuclear plant requested an ampacity derating test on Thermo-Lag 330-1. TSI arranged with UL to use its facility to conduct an ampacity derating test. The September 1986 tests at UL produced ampacity derating figures of about 31 percent for the three hour and about 28 percent for the one hour Thermo-Lag 330-1. These figures were significantly higher than the 10 per cent first reported by TSI.The officials at UL told OIG that TSI refused to follow the UL ampacity derating testing procedure. After the TSI representatives left the UL facility, an additional ampacity derating test on Thermo-Lag 330-1 was conducted. This test followed the UL testing procedure and was conducted at UL's own expense. This additional test was conducted because UL believed the earlier tests and results were not valid. When the second UL test was conducted, the ampacity derating figures for Thermo-Lag 330-1 increased to nearly 40 percent for the three hour barrier and 36 percent for the one hour barrier.This information was not submitted to the NRC.The NRC electrical staff was responsible for ensuring that utilities considered cable ampacity derating when designing and modifying their electrical systems. However, OIG found no evidence indicating the staff reviewed the ampacity derating tests on the Thermo-Lag 330-1 material even though it was being installed in the majority of nuclear power plants. The NRC staff explained it was the responsibility of the utilities to ensure that ampacity derating was considered when designing their electrical systems. Further, according to staff, if the utilities based their cable installation configurations on specific ampacity derating tests of fire barrier materials, it was the utilities responsibility to ensure the tests and the results were valid. The staff told OIG they had not reviewed ampacity derating test reports for fire barrier materials. ,Nov 27 2007 1:37PM Besjond Nuclear 3101-920-1037 19 Indigtions of inadequate performance of Thermo-Lag 330-1 not addressed by the NRC The- NRC Vendor Inspection Branch (VIB) develops and conducts inspections of 1)vendors and licensee contractors who supply safety-related products and services to the nuclear industry, and 2) licensee procurement programs and interfaces with vendors. .These inspections are often performed in response to allegations and reports of defective and substandard components and equipment in nuclear service or being offered for nuclear service. The VIE also determines the safety significance and generic implications of substandard vendor products. During its inquiry, OIG learned of instances over the past ten years which were reported to the NRC and which questioned the ability of Thermo-Lag 330-1 to perform as claimed by the manufacturer. However, our review of this information disclosed that the NRC staff did not effectively respond to these indicators. Several of these instances are discussed below:-inadequate TSI test reports submitted by Susquehanna In May 1982, during the NRC staff review of the Susquehanna fire protection program, Susquehanna submitted two TSI test reports involving one hour Thermo-Lag 330-1. The reason for this submittal was to assure the NRC that Thermo-Lag 330-1 was an acceptable fire barrier that performed in accordance with NRC requirements. In June 1982, after reviewing the two TSI test reports, the NRC fire protection staff rejected both and recommended that Susquehanna conduct a test at an approved testing laboratory. Among the reasons for the rejection, was the NRC reviewers findings that 1) TSI tests were not performed in accordance with adequate quality assurance procedures, and 2)the TMY tests were "simulated" ASTM E-119 tests, not-the standard ASTM E-119 test as required by the NRC. However, in October 1982, the NRC staff accepted a test report from Washington Nuclear Project 2 that was conducted at TSI in the same manner and in the same fiurnace.TSI tests documented in ITL test reports continue to be used to support the installation of Thermo-Lag 330-1 in nuclear power plants. These tests were witnessed by ITL, not a nationally recognized fire testing laboratory. OIG found no action by the NRC staff to address the fact that utilities were using TSI tests that were documented in ITL test reports to qualify their installation of Thermo-Lag 330-1. Nor was any effort made to resolve the fact that tests using the same TSI procedures were rejected and then accepted by the NRC.Problems with ampacity derating identified during an NRC inspection In 1985, an NRC inspection at Fort Calhoun nuclear power plant identified an apparent deficiency concerning the failure to verify the ampacity derating figures provided by the fire barrier material manufacturer, Minnesota Mining and Manufacturing Company (3M). A VIB inspection at 3M disclosed that the 3M ampacity figures were computer generated. The VIB inspector questioned the lack of documented 3M procedures to Nov 27.2007 1:38PM BetIond Nuclear 301-920-1037 p.22 20 ensure the computer generated derating figures were accurate. Because TSI also supplied ampacity derating information for Thermo-Lag 330-1 to a large segment of the nuclear industry,' the NRC inspector asked TSl to provide the NRC with ampacity derating information. In April 1987, T31 forwarded to the VIB the UL report on the ampacity derating tests which had been conducted in September 1986. In addition, TSI provided two test reports and a TSI technical note on ampacity derating of Thermo-Lag 330-1. However, due to other priorities, the ampacity derating information provided by TSI was not reviewed by the NRC staff to determine if the TSI ampacity derating figures were adequately validated. 10 CFR Part 21 Report on ampacity derating On October Z 1986, TSI notified the NRC by mailgram that ampacity derating tests on Thermo-Lag 330-1 conducted at UL in September 1986 indicated ampacity derating figures that were significantly higher than those reported earlier by TSI. The earlier TSI figures were used by utilities to design electric power systems utilizing Thermo-Lag 330-1. The TSI mailgram was administratively recorded as a 10 CFR Part 21 Report by the NRC. Part 21 pertains to the reporting of defects to the NRC by the nuclear industry.At the time the report was received, NRC follow-up of 10 CFR Part 21 Reports was the responsoibility of the Office for Analysis and Evaluation of Operational Data. This responsibility was later transferred to the VIB. In December 1990, the VIE closed the October 2, 1986, Part 21 Report without taking any action.Comanche Peak report on new ampacity derating figures In 1987, Comanche Peak responded to new information from TSI which established ampacity derating figures for Thermo-Lag 330-1 that were higher than the 10 percent originally reported by TSI and used in the initial cable sizing calculations at Comanche Peak. The new figures were 31 percent for single cable trays and 20 percent for single conduits enclosed in Thermo-Lag 330-1. On June 17, 1987, this information was verbally provided by Comanche Peak to the NRC resident inspector. On December 23, 1987, Comanche Peak provided a written report on this issue to the NRC. In its report to the NRC, Comanche Peak stated that failure to consider the additional derating of power cables due to Thermo-Lag 330-1 installation could cause the power cables to exceed the design temperature rating of the cables: Comanche Peak further noted that if left uncorrected, the higher ampacity derating could adversely affect the safety of plant operation& OIG found no NRC follow-up with TSI in order to obtain an explanation for the significant increase over the initial ampacity derating figures provided by TSI to Comanche Peak. Also, the NRC did not take any steps to ensure that other utilities were notified of the increased ampacity derating figures for Thermo-Lag 330-1. Nov 27 20'07 1:38PM Besdond Nuclear 301-920-1037 p.23 21 Allegations regarding the performance of Tbermo-Lag 330-1 On March 28, 1989, the NRC received an allegation that Thermo-Lag 330-1 gave off lethal gases when it burned. In support of this concern, the alleger provided the staff with information from a test of Thermo-Lag 330-1 documented in a May 1986 SwRI report. One month later, this issue became the subject of an Allegation Review Board meetin& During this meeting, it was decided to close the allegation without further action. In June 1989, the alleger was notified by letter of this decision.OIG noted during its review of the staff's handling of the above allegation that in addition to concerns about toxicity, the alleger also informed the NRC in April 1989 about a fire endurance test of fire penetration seals for the River Bend nuclear power plant. This test had been conducted on June 18, 1985, at SwRI. The test involved Thermo-Lag 330-1 as a fire barrier used in conjunction with a fire penetration seal. The alleger provided the summary of the test which stated that the installation of Thermo;Lag 330-1 had no apparent effect on the outcome of the test because most of the Thermo-Lag 330-1 was totally gone when the assembly was removed from the furnace.In the letter, the alleger pointed out that the Thermo-Lag 330-1 had disintegrated during the test. The alleger also stated that he had heard the 3M company had experienced the same result when testing Thermo-Lag 330-1.The ateger further related that River Bend was scheduled to conduct a full scale test of Thermo-Lag 330-1 at SwRL OIG did not find any indication that the NRC staff conducted any inquiry into the information that Thermo-Lag 330-1 had been consumed in a fire test or that the staff attempted to obtain the results of the scheduled full scale test.Problems with Thermo-Lag 330-1 at Comanche Peak In 1989, NTRC Region IV was informed that panels of one hour Thermo-Lag 330-1 were arriving at Comanche Peak, from TSI, that measured less than the required thickness. To provide one hour protection for cable trays in the event of a fire, Thermo-Lag 330-1 was required to be one half inch thick. Subsequently, Comanche Peak management discussed the situation with TSL In a July 13, 1990, letter to the NRC, Comanche Peak explained that the behavior of Thermo-Lag 330-1 under fire conditions is dependent on the density of the product and not on the thickness. Therefore, in conjunction with a TSI recommendation, Comanche Peak developed new receipt inspection criteria based on panel weight instead of thickness. Comanche Peak also informed the NRC that Tsrs quality assurance program required that Thermo-Lag 330-1 prefabricated panels be subjected to detailed thickness measurements prior to shipment to the plant. Comanche Peak assured the NRC that the TSi panel fabrication and quality control inspection methodology had remained essentially unchanged since TSI began production of prefabricated panels in the early 1980Ys. After reviewing the Comanche Peak July 13, Nov 27 2007 1:38PM Beyond Nuclear 301-920-1037 p.24 22 1990, letter and without further inquiy of TSI or Comanche Peak, Region IV accepted the resolution of the matter provided by Comanche Peak and TSI and closed this issue.During this inspection, OIG learned from the NRC and National Institute of Standards and Technology staff that the Comanche Peak quality control practice of checking weights was not an effective inspection method for Thermo-Lag 330-1 panels.Additionally, in December 1991, during the only NRC VIB inspection of TSI, the NRC found that the TSI quality assurance program did not specify a requirement for measuring minimum thickness of Thermo-Lag 330-1 panels fabricated at TSI. This finding was not consistent with the explanation given to NRC Region IV by Comanche Peak personnel and was relied on by Region IV to close the issue at that time. The problems at Comanche Peak provided another opportunity for the NRC to inquire into the performance of TSI and Thermo-Lag 330-1 that was not pursued.Concerns about the performance of Thermo-Lag 330-1 at River Bend In December 1989, the River Bend nuclear power plant submitted an Informational Report to the NRC regarding an October 1989 test of Thermo-Lag 330-1. The fire test was conducted at SwRI, a nationally recognized, fire testing laboratory, to verify Thermo-Lag 330-1 performance and to compare the three hour rated Tbermo-Lag 330-1 with the product from a competing company. Both fire barriers were applied to 30 inch wide aluminum cable trays. The Informational Report documented that at approximately 41 minutes into the three hour test, the Thermo-Lag 330-1 covering the bottom of the cable tray fell off. As the test continued, temperatures inside the cable tray enclosure increased with a loss of circuit integrity at 47 minutes.As a result, River Bend conducted an investigation and identified several generic issues with Thermo-Lag 330-1 that were outlined in the Informational Report. The Informational Report noted that prior to the River Bend test of a 30 inch cable tray, the maximum size previously tested was 12 inches. However, cable trays of a larger size than 12 inches are used in power plants. The OIG inspection did not identify any immediate action by the NRC to address the generic concerns with Thermo-Lag 330-1.It was not until May 1991, after additional allegations regarding the performance of Thermo-Lag 330-1 were received by the NRC, that NRC inspectors made a fact finding visit to River Bend to review problems with the performance of Thermo-Lag 330-1.In February 1991, the NRC received allegations from a confidential alleger that Thermo-Lag 330-1 did not provide the protection for electrical cables required by NRC and as claimed by the vendor.In May 1991, the NRC staff visited River Bend to review with utility officials installation discrepancies and failed fire endurance tests. These problems were first reported to the Nov 27 20107 1:39PM Beý:ond Nuclear 301-920-1037 p.25 23 NRC by the utility in April 1989. As a result of this visit, the staff concluded that a generic concern existed with respect to the abilities of Thermo-Lag 330-1 to protect 30 inch cable trays. In June 1991, in response to both the allegations and the problems'identified at River Bend, the NRC established a Special Review Team to review Thermo-Lag 330-1 issues and make recommendations for their resolution. In August and December 1991, the NRC issued Information Notices (IN 91-47 and IN 91-79) which discussed the test failure of Thermo-Lag 330-1 at River Bend and problems that could result from improperly installing Thermo-Lag 330-1.In December 1991, the VIEB conducted its first inspection at TSL This inspection disclosed problems with the TSI quality assurance program and that ITL did not act as an independent testing laboratory when it witnessed TSI qualification tests of Thermo-Lag 330-1.In January 1992, the Special Review Team completed its activities and in April 1992, issued a final report documenting its review of the performance of Thermo-Lag 330-1.One conclusion in the report was that the fire resistance ratings and ampacity derating factors for the Thermo-Lag 330-1 fire barrier system are "indeterminate." Additionally, as a result of concerns developed during the review by the Special Review Team, the NRC prepared a draft Generic Letter in Februay 1992. This Generic Letter would require licensees to provide information to verify that their Thermo-Lag 330-1 fire barrier installations comply with NRC requirements. As of July 31, 1992, the NRC had not finalized the Generic Letter.On June 24, 1992, NRC Bulletin 92-01 was issued as a result of further fire endurance tests of Thermo-Lag 330-1 at Omega Point Laboratories. These tests were conducted by Comanche Peak to qualify their Thermo-Lag 330-1 fire barrier system. The testing resulted in failures of several Thermo-Lag 330-1 fire barrier systems that were designed to duplicate actual plant configurations. The bulletin stated that the NRC considered these tests to be failures of the Thermo-Lag 330-1 fire barrier system. In this bulletin, the NRC concluded that the one hour and three hour Thermo-Lag 330-1 preformed assemblies installed on small conduits and on cable trays wider than 14 inches did not provide the level of safety required by the NRC. The bulletin required that where applicable, utilities implement appropriate compensatory measures. On June 23, 1992, in conjunction with the bulletin, the NRC issued Information Notice 9246 which informed the industry of the findings of the Special Review Team and the results of the fire endurance tests conducted at Omega Point.During the week of July 13-17, 1992, pursuant to a contract between NRC and the National Institute of Standards and Technology, tests of Thermo-Lag 330-1 one and three hour fire barriers were conducted. Both tests failed the NRC fire protection requirements. On July 27, 1992, the NRC issued Information Notice 92-55 addressing the results of these tests. Additionally, as a result of these efforts, the NRC staff has become concerned that Thermo-Lag 330-1 is a combustible material. The staff is Nov 27 2007 1:39PM Bebond Nuclear 301-920-1-037 p.2G 24 reviewing this matter of combustibility in light of the fact that Thermo-Lag 330-1 has beenused in areas of nuclear power plants that were required to be free of combustibles. NRC efforts are also underway to assure that accurate ampacity derating figures for Thermo-Lag 330-1 are being used by the nuclear industry. The life of cables enclosed in Thermo-Lag 330-1 may have been shortened, and the utilities may not be aware of the extent of this problem since they assumed the ampacity figures initially provided by TSI.were accurate. Nov 27 2007 1:39PM Betlond Nuclei-r 301-920-1037 _.p.27 25 FINDINGS Based. on the information developed during this inspection, we found that the NRC staff did not conduct an adequate review of fire endurance and ampacity derating information concerning the ability of the fire barrier material, Thermo-Lag 330-1. Had the staff conducted a thorough review of the test reports submitted by industry or verified the test procedures and test results reported by TSI, a number of problems with the test program and Thermo-Lag 330-1 would have been discovered. For example, the staff would have found that the test furnace at TSI was, not adequate to conduct the required standard fire endurance test; however, it has continued to be used since 1981. Also, the staff would have discovered that the quality assurance procedures at the TSI test facility were not adequate.Identification of such problems could have resulted in an NRC vendor inspection-at TSI.The vendor inspection would have determined there were problems with the TSI testing program and that the fire endurance and ampacity derating tests were not conducted, as required, by a nationally recognized testing laboratory. Further, it would have been.discovered that the test 'rports were actually written by the vendor with no substantive verification that the data in the reports reflected the data recorded during the tests.Because these reviews and inspections were not conducted, it was not until 1992 during the conduct of reviews by the NRC Special Review Team and the OIG/OI investigative taskforce, that the staff determined that the performance of Thermo-Lag 330-1 with respect to fire resistance ratings and ampacity derating was indeterminate. In addition to the inadequate initial review process discussed above, the staff did not take any significant action between 1982 and 1991 when reports of problems with Thermo-Lag 330-1 were received. Our inspection disclosed seven instances in which the NRC did not-pursue reports of problems with Thermo-Lag 330-1. Exhibit FP No. 3 Page I Environment and Energy Daily October 4. 2001 NUCLEAR SECURITY LANGUAGE FOR ANTI-TERRORISM BILL APPROVED BYLINE: Suzanne Struglinski SECTION: NUCLEAR POLICY; Vol. 10, No. 9 LENGTH: 1011 words The House Energy and Commerce Committee on Wednesday approved language concerning Nuclear Regulatory Commission-security and bioterrorism that could be part of a future, larger anti-terrorism bill. However, negotiations are expected to continue prior to floor action on several possible amendments submitted by Rep. Ed Markey (D-Mass.). Rep. Joe Barton (R-Texas), Energy and Air Quality Subcommittee chairman, submitted the NRC language, which was approved by voice vote. The language authorizes guards at NRC licensed facilities to carry and use weapons to protect the facilities or prevent theft of special nuclear maierials. If passed into law, guards would be able to carry firearms and make arrests without a warrant under specific circumstances. Barton said that currently, only Energy Department security forces now have that ability even though NRC facilities handle nuclear material. Also, NRC would be allowed to regulate dangerous weapon use on any facility licensed or certified by it, meaning public or private property."This change ensures that the full range of facilities regulated by the commission are subject to the statutory provisions prohibiting the introduciion of weapons or other dangerous instruments, providing an additional measure of.security for materials which could be subject to theft or sabotage," Barton said.The language -- which is intended to be incorporated into a larger anti-terrorism bill -- also extends laws prohibiting sabotage or attempted sabotage of nuclear facilities to include nuclear waste treatment-and disposal facilities-and nuclear*fabrication facilities. Barton pointed out that this language was included in the NRC reauthorization-language that passed last Congress but did not-become law.Rep. Cliff Stearns (R-Fla.) offered an amendment raising penalties for attempted nuclear plant sabotage or threats that cause damage to public health or safety to S$ million and a prison term of up to life in prison without parole..The Page 2 NUCLEAR SECURITY LANGUAGE FOR ANTI-TERRORISM BILL APPROVED Environment and Energy Daily October 4, 2001 amendment also passed by voice vote.Rep. Heather Wilson (R-N.M.) offered an amendment to conduct a study to asses the vulnerabilities of nuclear power plants to potential terrorist attacks. She wants the study-to " include an assessment of the plant's design. to identify long-term and short-term protection measures, assess physical, cyber, biochemical and other terrorist threats, and recommend additional studies as needed. The study would be due to Congress 90 days after enactment. The amendment was approved by voice vote.Markey submitted a similar amendment, however his asks for an NRC rulemaking within a year of enactment revising the design basis threat and-associated regulations. He wants regulations issued specifically taking into account a list of nine items, including the Sept. 11. attack, potential for attacks, potential suicide attacks and fire threats. NRC is to meet with the secretary of Defense, director of.Central Intelligence, director of the Federal Bureau Of Investigation, national security-adviser, director of Homeland Security and other appropriate officials before completing the rulemaking.."The threat is real, it's serious and it requires study and action," Markey, said.Committee ranking member John Dingell (D-Mich.) supported Markey's amendment saying the rulemaking has more clout than just a review and that it sets forth what they need to look at."You can't count iot;n [NRC Chairman Richard] Mesrve and hdis bunch of sleep'heads to complete [a review]' DiglIl said.Tauzin also read a letter from NRC alluding to plans to review security and vulnerabilities anyway.Markey also proposed an amendment that would allow the president to deploy armed forces to the national guard to defend NRC licenses facilities should another attack occur. Barton objected to the amendment saying the president already has that ability and that the bill was not necessary. However, he later withdrew his objection."What the hay? Congress does a lot of things that are unnecessary," Barton said.Markey later withdrew the amendment after Tauzin said he would confer with the House Armed Services Committee to hammer out potential jurisdictional problems with the bill.Markey's third amendment was designed to allow NRC to establish a system looking at the transportation of nuclear-waste. Wilson objected to the amendment expressing concern. over a possible limitation on Energy Department, National Nuclear Security Administration or Defense Department responsibilities. Barton said the language may also affect medical radioactive waste, such as that associated with cancer treatments. Markey also withdrew this amendment after Tauzin said the committee would examine the language to see how the bill could be limited only to NRC.

• Page 3 NUCLEAR SECURITY LANGUAGE FOR ANTI-TERRORISM BILL APPROVED Environment and Energy Daily October 4, 2001 Tauzin and several othei members, also acknowledged that a closed meeting with Meserve and other officials taking'place later Wednesdav'afiernoon could clear up some questions surrounding the provisions.

Markey eventually withdrew the amendment. Tauzin said language similarto the amendment could be introduced when the bill goes to the floor.The bioterrorism provisions, also approved Wednesday,"close loopholesand stiffen penalties for the possession of substances such as anthrax and other deadly biological agents and toxins that could be used for a bioterrorist attack," Tauzin said.'Provisions for the bioterrorism and NRC language were derived from Attorney General John Ashcroft's anti-terrorism proposal to Congress.Tauzin said the committee will continue a broader investigation into ways to secure the country's energy, telecomnmunicaitions, health and other critical infrastructures. THURSDAY'S AGENDA The. Subcommittee on Energy and Air Quality plans to hold a markup at 9:30 a.m.. Thursday, in 2123 Rayburn looking at H.R.2983, the Price-Anderson Reauthorization Act of 2001, and H.Res.250, a resolution urging the secretary of Energy to fill the Strategic Petroleum Reserve.LOAD-DATE: October 3, 2001 LANGUAGE: ENGLISH Copyright 2001 Environment and Energy Publishing, LLC Exhibit FP No. 5 ~Ener~y Entergy Nuclear Northeast Indian Point.Energy Center 450 Broadway.GSB P.O. -Box 249 Buchanan, NY 10511-0249 Tel 914 734 6700 Fred Dacimo Site Vice President Administration July 24, 2006 Re: Indian Point Unit No. 3 Docket No. 50-286 NL-06-078 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

SUBJECT:

Request for Revision of Existing Exemptions from 10-CFR50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 1) NRC Information Notice .2005-07, "Results of HEMYC Electrical Raceway Fire Barrier System Full Scale Fire Testing," April 1, 2005

References:

2) NYPA Letter, J. C. Brons to S. A. Varga (NRC), "Appendix R Fire Protection Program," August 1.6, 1984 3) NYPA Letter, J. C. Brons to S. A. Varga (NRC), "Information to Support the Evaluation of IP3 to 10 CFR 50.48 and Appendix R to 10 CFR 50," September 19, 1985 4) NRC Letter and SER, S. A. Varga to J. C. Brons (NYPA), "Indian Point 3 Nuclear Power Plant -Exemption From Certain Requirements of Section III.G and III.J of Appendix R -to 10 CFR Part 50," January 7, 1987 5) IPEC Letter NL-06-060, F. Dacimo to Document Control Desk,"Response to Generic Letter 2006-03 (Potentially Nonconforming Hemyc and MT Fire Barrier Configurations)," June 8, 2006

Dear Sir or Madam:

NRC Information Notice (IN) 2005-07 (Reference

1) notified licensees of potential performance concerns associated with the one-hour rated Hemyc electrical raceway fire barrier system (ERFBS), indicating that the system may be incapable of fulfilling the stated one-hour fire resistance rating when tested in accordance with Generic Letter 86-10, Supplement 1 criteria.

Indian Point Unit No. 3 (IP3) utilizes the one-hour rated Hemyc NL-06-078 Docket No. 50-286 Page 2 of 3 ERFBS that is the subject of IN 2005-07 in two areas of the plant. In a Safety Evaluation Report (SER) dated January 7, 1987 (Reference 4), the Staff granted a number of exemptions from specific requirements of 10 CFR 50, Appendix R, which included these two plant areas. Entergy has reviewed the Hemyc fire test results provided by'the NRC in IN 2005-07 and has determined that it is-necessary to revise the fire resistance rating of the Hemyc ERFBS configurations credited in two of the exemptions. The two affected exemptions are those applicable to Fire Area PAB-2 in the Primary Auxiliary Building, and Fire Area ETN-4 in the Electrical Tunnels and Electrical Penetration Areas.In accordance with 10 CFR 50.12, the purpose of this letter is to request revision of the January 7, .1987 SER to reflect that the installed Hemyc'ERFBS configurations provide a 30-minute fire resistance rating, in lieu of the previously stated one-hour fire resistance rating. The requests for the exemptions granted by the January 7, 1987 SER were docketed in NYPA Letters dated August 16, 1984 (Reference

2) and September 19, 1985 (Reference 3). Based on a review of these letters and of the NRC test results, it is Entergy's position that a Hemyc ERFBS fire resistance rating of 30 minutes will provide sufficient protection for the affected raceways, with adequate margin, to continue to meet the intent of the original requests for exemption and the conclusions presented-in the January 7, 1987 SER. This evaluation is summarized in Attachment 1.As documented in Attachment 1, it is Entergy's conclusion that the revised fire resistance rating of the Hemyc ERFBS does not reflect a reduction in overall fire safety, and presents no added challenge to the credited post-fire safe-shutdown capability.

The remainder of the credited fire protection features, the fire hazards and ignition sources, fire brigade-and operator response to fire events, and the credited post-fire safe-shutdown capability remain materially unchanged from the configuration as originally described in the NYPA letters and as credited in the January 7, 1987 SER.Entergy has reviewed the as-built configurations of the Hemyc ERFBS installed at IP3 against the results of the NRC Hemyc fire test program as referenced by IN 2005-07.This review has determined that the installed ERFBS can be expected to afford a thermal protection rating of at least 30 minutes, contingent upon the installation of a modification to augment raceway support protection and to install over-banding of certain enclosures. A commitment to install these modifications is contained in our response to Generic Letter 2006-03 (Reference 5). The conclusions from the engineering evaluation are also summarized in Attachment 1.There are no new commitments contained in this letter.. If you have any questions or require additional information, please contact Mr. Patric W. Conroy at 914-734-6668. NL-06-078 Docket No. 50-286 Page 3 of 3 a~nereIl"e R. Dacim-40Y -. Site Vice President Indian Point EnergyCenter Attachment 1: Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 cc: Mr. Samuel J. Collins, Regional Administrator, NRC Region I Mr. John P. Boska, Senior Project Manager, NRC NRR DORL NRC Resident Inspectors Office, Indian Point Energy Center Mr. Paul Eddy, New York State Department of Public Service Mr. Peter R. Smith, NYSERDA ATTACHMENT 1 to NL-06-078 Request for Revision of Existing Exemitions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 Entergy Nuclear Operations, Inc.Indian Point Nuclear Generating Unit No. 3 Docket No. 50-286 NL-06-078 Docket No. 50-286 Attachment 1 Page 1 of 14 Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2

1.0 INTRODUCTION

The Indian Point Unit No. 3 (IP3) electrical raceways provided with Hemyc ERFBS protection consist of several conduits, cable trays, and a box-type enclosure. The locations of the Hemyc ERFBS installations are illustrated by Figures 1 through 4.To support the request for revision to the two exemptions applicable to Fire Areas ETN-4 (Electrical Tunnels and Electrical Penetration Areas) and PAB-2 (Component Cooling Pump Area) contained in the January 7, 1987 SER (Reference 8.1), this attachment:

• Discusses the licensing basis for the one-hour Hemyc electrical raceway fire barrier system (ERFBS) fSection 2.0);* Discusses the fire hazards, combustible controls, and fire protection features of the areas (Section 3.0);* Evaluates the acceptability of a 30-minute rating considering the current fire hazards and fire protection features in the areas (Section 4.0);* Presents a summary description of the installed one-hour Hemyc ERFBS configurations, and of the evaluation of the results of the NRC Hemyc fire test program (Reference 8.11) (Section 5.0).As documented in Reference 8.11, the NRC Hemyc test specimens provided acceptable thermal performance for a period of at least 30 minutes, or the results provided insight into the observed failure mechanisms.

Further, each of the , installed IP3 Hemyc configurations is bounded by one or more of the NRC test specimens, or is subject to a planned modification based on the insights learned from the NRC test program. As determined in Reference 8.11, the Hemyc ERFBS at IP3 can be expected to provide a fire resistance rating of a minimum of 30 ,minutes, consistent with ASTM E 119 temperature rise acceptance criteria. A fire resistance rating of 30 minutes will provide adequate protection for the affected IP3 safe-shutdown raceways, in consideration of the additional mitigating factors of low fire loading and active and passive fire protection features installed in each of the two affected plant areas. NL-06-078 Docket No. 50-286 Attachment I Page 2 of 14.2.0 EXISTING LICENSING BASIS FOR ONE-HOUR ERFBS IN AFFECTED PLANT AREAS 2.1 Electrical Tunnels and Penetration Areas: Fire Area ETN-4: Upper and Lower Electrical Tunnels (Fire Zones 7A and 60A, respectively) and Upper Penetration Area (Fire Zone 73A)By SER dated February 2, 1984 (Reference 8.4), the Staff approved an exemption from the Appendix R Section III.G separation requirements, to-the extent-that redundant safe-shutdown systems are not separated by more. than 20 feet free of intervening combustibles or fire hazards, and that redundant safe-shutdown systems are not separated by a one-hour rated fire barrier in an area which is protected by.automatic fire detection and suppression systems. The bases forthis exemption included the existing separation between redundant safe-shutdown trains, minimal fire hazards, flame-retardant characteristics of cable insulation, and the installed active and passive fire protection features.Following a comprehensive reassessment of the IP3 Appendix R compliance basis, by letters dated August 16, 1984 and September 19, 1985 (References 8.3 and 8.2, respectively), NYPA informed the NRC of the need for additional separation measures to be installed in Fire Area ETN-4. These measures included the installation of one-hour rated fire wrap on several safe-shutdown raceways. By SER dated January 7, 1987 (Reference 8.1), the Staff acknowledged this clarification and the addition of one-hour rated fire wrap, and confirmed the continued validity of the exemption granted by the February 2, 1984 SER (Reference 8.4).2.2 Primary Auxiliary Building, Fire Area PAB-2: Fire Zone 1, 41' Elevation CCW Pump Area In the SER dated January 7, 1987 (Reference 8.1), the Staff approved an exemption from the Section IlI.G separation requirements for this fire zone, to the extent that an automatic suppression system has not been provided, and redundant safe-shutdown systems are not separated by more than 20 -feet free of intervening combustibles. The bases for this exemption included the existing separation between redundant safe-shutdown trains, low fire loading, a fire-detection system, manual hose stations and portable extinguishers, a partial height noncombustible barrier designed to protect the CCW pump against radiant heat from a fire, and a one-hour fire rated cable wrap around the normal power feed conduit to the 33 CCW pump. NL-06-078 Docket No. 50-286 Attachment I Page 3 of 14 3.0 FIRE HAZARDS, COMBUSTIBLE CONTROLS, AND FIRE PROTECTION. FEATURES IN FIRE AREAS ETN-4 AND PAB-2 3.1 Evaluation of Hazards/Iqnition Sources and Combustible Controls The fire hazards and ignition sources in Fire Areas ETN-4 and PAB-2 remain materially unchanged from the characteristics of these areas as described in the SERs dated February 2, 1984 (Reference 8.4) and January 7, 1987 {Reference. 8.1), and the NYPA correspondence referenced therein, as applicable to the specific fire zone.Transient combustible and hot work controls have been enhanced since the transition from'NYPA to Entergy operation of IP3, with the issuance of procedures EN-DC-127, "Control of Hot Work and Ignition Sources" (Reference 8.8) and ENN-DC-161, "Transient Combustible Program" (Reference 8.9). Notably, per Transient Combustible Program procedure ENN-DC-161, Fire Areas ETN-4 and PAB-2 are designated as "Level 2" combustible control areas, which constrains transient combustibles to moderate quantities. Any planned introduction of more than the allowable quantities of combustibles into these areas requires a prior review by Fire Protection Engineering, which will include the definition of additional protective/compensatory measures as determined to be applicable. In addition, per procedure EN-DC-127, any planned hot work in IP3 Fire Areas ETN-4 or PAB-2 requires the prior review and approval of Fire Protection Engineering. This constraint provides assurance that hazards and potential effects consistently receive proper prior evaluation, and that compensatory measures, as applicable, are adequately defined in advance of the hot work activity.The administrative controls imposed by ENN-DC-161 and the structured Fire Protection Engineering review of planned hot work activities per EN-DC-127 provide additional assurance that the potential for, and potential effects of, significant floor-based transient combustible fires is sharply limited.3.2 Active Protection: Fire Detection and Suppression Features The installed fire detection systems and automatic and manual fire suppression features in the affected zones of Fire Areas ETN-4 and PAB-2 remain functionally unchanged from those described in SERs dated February 2, 1984 (Reference 8.4)and January 7, 1987 (Reference 8.1), and the NYPA correspondence referenced therein, as applicable. Preaction automatic water spray suppression is provided in ETN-4 for protection of cable trays; manual suppression capabilities are provided in both Fire Areas ETN-4 and PAB-2, in the form of accessible fire hose stations and portable fire extinguishers. NL-06-078 Docket No. 50-286 Attachment 1 Page 4 of 14 3.3 Passive Fire Protection Features The installed passive fire protection features (fire barriers and penetration seal systems) in Fire Areas ETN-4 and PAB-2 remain functionally unchanged from those described in SERs dated February 2, 1984 (Reference

84) and January 7, 1987 (Reference 8.1), and the NYPA correspondence referenced therein, as applicable.

3.4 Transient

Combustible Control and FP Equipment Operating History A review of IP3 condition reports for the period beginning with Entergy ownership through the.present indicated that no significant fire protection related deficiencies applicable to Fire Zones 1, 7A, 60A, or 73A were identified during this time period.Topics searched included fire barriers, ERFBS,ifire suppression, fire detection, and housekeeping/combustible loading. Hence, there is reasonable assurance that the design and operational controls (as described above) in place since the'transition to Entergy operation of IP3 have maintained the fire protection defense-in-depth measures consistent with the IP3 fire protection licensing basis.4.0 ADEQUACY OF A 30-MINUTE ERFBS TO PROTECT SAFE-SHUTDOWN CABLES 4.1 Fire Area ETN-4, Fire Zones 7A, 60A, and 73A As described in the SER dated February 21 1984- (Reference 8.4), the fire hazards in the affected zones of this area are small. As given by Reference 8.7, the calculated fire severity in Fire Area ETN-4 is less than 60 minutes, of which less than one minute of fire severity is attributable to the expected transient fire loading.The balance of the combustible inventory is predominantly asbestos-jacketed, flame-retardant electrical cable insulation. The flame-retardant characteristics of the principal combustible ensure that fire will not propagate along the cables to any significant degree, thereby limiting the rate of development and damage incurred by credible fires. As the credible fire scenarios involve floor-based transient combustibles, the. impact of such a fire, at any location within the area, is expected to be slight, and insufficient to involve substantial quantities of the predominant' fixed combustibles (the flame-retardant cables in trays). In addition, the fire detection, automatic cable tray fire suppression system, and manual fire suppression features provide further assurance that fire damage will be limited in scope and severity. Therefore, based on the current Fire Hazards Analysis, an ERFBS with a 30-minute fire resistance rating is adequate to protect the safe-shutdown cables in this area. NL-06-078 Docket No. 50-286 Attachment 1 Page 5 of 14 Based on a review of the fire zones in this area using the guidance and tools of N UREG-1 805 (Reference 8.10), it was found that the credible fire challenge would be less severe than that imposed by an ASTM E 119 fire exposure. Further, with the installed smoke detection system and the preaction water spray system for the cable trays in the area, the credible fire challenge in the affected zones. of Fire Area ETN-4 can be expected to result in a temperature profile that is substantially. less severe than that of the ASTM E 119 time-temperature curve. Therefore, based on the insights using NUREG-1 805 guidance and tools, the expected fire effects in this Fire Area will not challenge a Hemyc ERFBS installation that has a fire resistance rating of 30 minutes.4.2 Fire Area PAB-2, Fire Zone 1 As described in the SER dated January 7, 1987 (Reference 8.1), the fire load in this area is low. As given by Reference 8.7, the calculated fire severity in Fire Area PAB-2, Fire Zone 1 is less than 10 minutes. The small quantity of combustible materials (e.g., CCW pump lubricating oil or transient materials) would be expected to result in a credible fire which is localized, with a low aggregate heat release, and no challenge to redundant safe-shutdown cables or components caused by radiant or convective energy. The installed fire detection system would'ensure timely detection, enable prompt manual suppression of the fire, and.provide assurance that any fire damage will be limited in scope and severity.Therefore, the credible fire challenge can be expected to result in a temperature profile less severe than that of the ASTM E 119 time-temperature curve.Hence, an ERFBS capable of providing at least 30 minutes of protection for the enclosed cables when tested in accordance with ASTM E 119 will provide adequate protection for the safe-shutdown cables in this area, given the hazards in the area and the active fire protection features.5.0 EVALUATION OF 1P3-SPECIFIC HEMYC ERFBS VERSUS NRC-TESTED CONFIGURATIONS The installed IP3 Hemyc ERFBS is summarized as follows:* Two 4" rigid steel conduits, each with a cable percent fill of approximately 30%.The two 4" rigid steel conduits are protected with direct-attached 2" thick Hemyc blanket wrap.* Seven 18" cable tray sections, with a cable percent fill in these trays ranging from approximately 10% to 25%. Also wrapped are two 24" cable tray sections, each with a cable percent fill of approximately 50%. All cable -trays NL-06-078 Docket No. 50-286 Attachment 1 Page 6 of 14 are wrapped using 1-1/2" thick Hemyc blanket with a 2" air gap between the blanket and the protected raceway.* Box-type enclosure at containment electrical penetrations H191H20, consisting of 2" thick Hemyc blanket directly attached to the enclosure.. The IP3 Hemyc ERFBS configurations have been compared to the size, orientation, materials, methods of construction, and thermal performance of the test specimens of References 8.5 and 8.6 in an engineering evaluation (Reference 8.11). The detailed thermal performance results of the NRC Hemyc fire tests indicated that several of the tested configurations provided at least 30 minutes of protection for the enclosed safe-shutdown cables, or provided insights into the failure mechanisms that occurred during testing. The engineering evaluation compares the details of these tested configurations with the details of the IP3 Hemyc ERFBS configurations. This evaluation establishes that the IP3 Hemyc ERFBS configurations are sufficiently comparable to the NRC-tested configurations, with minor enhancements to several IP3 configurations, which include the need to augment the ERFBS on raceway supports and to install additional over-banding on certain enclosures. Pending implementation of those modifications to the affected configurations, all of the IP3 Hemyc ERFBS configurations can be expected to provide a fire resistance capability of at least 30 minutes for the enclosed safe-shutdown cables.6.0 REGULATORY ANALYSIS 10 CFR 50.12(a) states that the Commission may grant exemptions from the requirements of the regulations contained in 10 CFR 50 which are: (1) Authorized by law, will not present an undue risk to the public health and safety, and are consistent with the common defense and security; and, (2) If special circumstances are present.This request for revision of existing exemptions meets the criteria set forth in 10 CFR 50.12, as discussed. herein.6.1 The requested exemption is authorized by law 10 CFR 50.12(a) authorizes the NRC to grant exemptions from its regulations, and no law is known that precludes the NRC from granting the requested revision to the existing exemptions. NL-06-078 Docket No. 50-286 Attachment 1 Page 7 of 14 6.2 The requested exemption does not present an undue risk to the public health and safety v The Hemyc ERFBS configurations installed in IP3 Fire Areas ETN-4 and PAB-2 will provide a fire resistance capability of at least 30 minutes, as discussed in Section 5.0. The minimal fire hazards and ignition sources, combined with -the nature of the fire hazards in the areas, the active and passive fire protection features, and the controls on transient combustibles and ignition sources, as discussed in Section 3.0, provide assurance that the credible fire challenge to the-IP3 Hemyc ERFBS will be substantially less than that of an equivalent ASTM'E 119 30-minute fire exposure. Therefore, as discussed in Section 4.0, the installed ERFBS can be expected to provide adequate protection for the affected safe-shutdown raceways and enclosed cables.Therefore, given the existing level of fire protection defense in depth, combined with the minimal fire challenge presented by the credible fire scenarios in these.areas, and the favorable FP equipment operating history, the change in credited ERFBS fire resistance rating from one hour to 30minutes will not degrade the effectiveness of the IP3 fire protection program, nor will it challenge the credited post-fire safe-shutdown capability. Based on the determination that safe shutdown in the event of a-fire can be achieved and maintained with less than a one-hour fire resistance rating, the requested revision to the existing exemptions does not present an undue risk to the public health and safety.6.3 The requested exemption is consistent with the common defense and security The requested revision to the existing'exemptions is not directly related to and should not adversely impact the common defense and security.6.4 Special circumstances are present -underlying purpose of the rule 10 CFR 50.12(a) requires that special circumstance be present in order for the Commission to consider granting an exemption. Per 10 CFR 50.12(a)(2)(ii), one special circumstance is that application of the regulation in the particular circumstances would not serve the underlying purpose of the rule or is not necessary to achieve the underlying purpose of the rule.The underlying purpose of 10 CFR 50, Appendix R,--Section IIL.G is to provide reasonable assurance that at least one means of achieving and maintaining safe shutdown conditions will remain available during and after any postulated fire. For the areas containing the Hemyc ERFBS installations, the credible fire challenge to the IP3 Hemyc ERFBS due to any postulated fire will be substantially less than that of an equivalent ASTM E 119 30-minute fire exposure. Therefore, a fire NL-06-078 Docket No. 50-286 Attachment 1 Page 7 of 14 6.2 The'requested exemption does not present an undue risk to the public health and The Hemyc ERFBS configurations installed in iP3 Fire Areas ETN-4 and PAB-2 will provide a fire resistance capability of at least 30 minutes, as discussed in Section 5.0. The minimal fire hazards and ignition sources, combined with the nature of the fire hazards in the areas, the active and passive fire protection features, and the controls on transient combustibles and ignition sources, as discussed in Section 3.0, provide assurance that the credible fire challenge to the IP3 Hemyc ERFBS will be substantially less than that of an equivalent ASTM E 119 30-minute fire exposure. Therefore, as discussed in Section 4.0, the installed ERFBS can be expected to provide adequate protection for the affected safe-shutdown raceways and enclosed cables.Therefore, given the existing level of fire protection defense in depth, combined with the minimal fire challenge presented by the credible fire scenarios in these areas, and the favorable FP equipment operating history, the change in credited ERFBS fire resistance rating from one hour to 30"minutes will not degrade the effectiveness of the IP3 fire protection program, nor will it challenge the credited post-fire safe-shutdown capability. Based on the determination that safe shutdown in the event of a fire can be achieved and maintained with less than a one-hour fire resistance rating, the requested revision to the existing exemptions does not present an undue risk to the public health and safety.6.3 The requested exemption is consistent with the common defense and security The requested revision to the existing exemptions is not directly related to and should not adversely impact the common defense and security.6.4 Special circumstances are present -underlyinq purpose of the rule 10 CFR 50.12(a) requires that special circumstance be present in order for the Commission to consider granting an exemption. Per 10.CFR 50.12(a)(2)(ii), one special circumstance is that application of the regulation in the particular circumstances would not serve the underlying purpose of the rule or is not necessary to achieve the underlying purpose of the rule.The underlying purpose of 10 CFR 50, Appendix R, Section IIL.G is to provide reasonable assurance that at least one means of achieving and maintaining safe shutdown conditions will remain available during and after any postulated fire. For the areas containing the Hemyc ERFBS installations, the credible fire challenge to the IP3 Hemyc ERFBS due to any postulated fire will be substantially less than that of an equivalent ASTM E 119 30-minute fire exposure. Therefore, a fire NL-06-078 Docket No. 50-286 Attachment 1 Page-8 of 14 resistance capability of at least 30 minutes provides protection of the components required for achieving and maintaining safe shutdown. Therefore, the underlying purpose of the rule is satisfied and the application of the regulation in these particular circumstances is not necessary to achieve the underlying purpose of the rule.

7.0 CONCLUSION

The defense-in-depth objectives of the Fire Protection Program are to 1) Prevent fires from occurring;

2) Detect, control, and extinguish promptly those fires that do occur; and, 3) Provide protection from the effects of. a fire for structures, systems, and components needed to achieve and maintain safe shutdown.The fire hazards analysis of the fire zones containing the Hemyc ERFBS installations and the existing protection (after completion of modifications discussed in Section 5.0) of the electrical raceways show that these objectives are met. The first objective is supported by the fact that there are few significant ignition sources' in the areas, and transient combustibles are controlled.

Supporting the second objective are the active fire detection and suppression features in each area. The third objective is supported by the Hemyc ERFBS configurations which provide protection from credible fire exposures, which have an expected duration less than that of the proposed 30 minute rating.This request for revision of existing exemptions is warranted under the provisions of 10 CFR 50.12, in that it is authorized by law, does not present an undue risk to the public health and safety, and is consistent with the common defense and security. Further, it meets the requirement for a special circumstance in that it satisfies the underlying purpose of 10 CFR 50 Appendix R by providing an ERFBS that will provide protection for the duration of any postulated fire such that safe shutdown can be achieved and maintained. Ignition sources in the affected fire zones consist of limited transient combustibles (all zones), several equipment cabinets and (3kVA) 480/120V instrument power transformer .BH8 (Fire Zone 73A), and a CCW pump motor (Fire Zone 1) NL-06-078 Docket No, 50-286 Attachment 1 Page 9 of 14

8.0 REFERENCES

8.1 NRC Letter and SER, S. A. Varga to J. C. Brons (NYPA); Indian Point 3 Nuclear Power Plant -Exemption From Certain Requirements of Section III.G and ill.J of Appendix R to 10 CFR Part 50, January 7, 1987 8.2 NYPA Letter, J. C. Brons to S. A. Varga (NRC); Information to Support the Evaluation of IP3 to 10 CFR 50.48 and Appendix R to 10 CFR 50, September 19, 1985 8.3 NYPA Letter, J. C. Brons to S. A. Varga (NRC); Appendix R Fire Protection Program, August 16, 1984 8.4 NRC Letter and SER, S. A. Varga to J. C. Brons (NYPA); Exemptions From the Requirements of 10 CFR 50, Appendix R, for the Indian Point Nuclear Generating Plant, Unit No. 3 (IP-3), February 2, 1984 8.5 Hemyc (One-Hour) Electrical Raceway Fire Barrier Systems Performance Testing;Conduit and Junction Box Raceways (Omega Point Laboratories Fire Test Report, Project 14790-123263, dated April 11, 2005)8.6 Hemyc (One-Hour) Electrical Raceway Fire Barrier Systems Performance Testing;Cable Tray, Cable Air Drop and Junction Box Raceways (Omega Point Laboratories Fire Test Report, Project 14790-123264, dated April 18, 2005)8.7 IP3-ANAL-FP-02143, Indian Point 3 Fire Hazards Analysis, Revision 4 8.8 EN-DC-127, Control of Hot Work and Ignition Sources, Revision 2 8.9 ENN-DC-161, Transient Combustible Program, Revision 1 8.10 NUREG-1 805, "Fire Dynamics Tools (FDTs) Quantitative Fire Hazard Analysis... Methods for the U.S. NRC Fire Protection Inspection Program," December 2004.8.11 Entergy Engineering Report IP-RPT-06-00062, Revision 0; "Comparison of IP3 Hemyc Electrical Raceway Fire Barrier System to NRC Hemyc Fire Test Results." NL-06-078 Docket No. 50-286 Attachment I Page 10 of 14 9.0 FIGURES 9.1 Hemyc ERFBS in Fire Zone 1 9.2 Hemyc ERFBS in Fire Zone 7A 9.3 Hemyc ERFBS in Fire Zone 60A 9.4 Hemyc ERFBS in Fire Zone 73A NL-06-078 Docket No. 50-286 Attachment 1 Page 11 of. 14 Figure 9.1: Hemyc ERFBS In Fire Zone 1 0 NL-06-078 Docket No. 50-286 Attachment I Page 12 of 14 Figure 9.2: Hemyc ERFBS in Fire Zone 7A NL-06-078 Docket No. 50-286 Attachment I Page 13 of 14 Figure 9.3: Hemyc ERFBS In Fire Zone 60A NL-06-078 Docket No. 50-286 Attachment 1 Page 14 of 14 Figure 9.4: Hemyc ERFBS In Fire Zone 73A Exhibit FP No. 6 Enteray Nuclear Northeast Indian Point Energy Center 450 Broadway, GSB P.O. Box 249" 'EntTl91e3460 Buchanan, NY 10511-0249

• " Tel 914 734 6700 Fred Dacimo Site Vice President Administration August 16, 2007 Re: Indian Point Unit No. 3 Docket No. 50-286 NL-07-084 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

SUBJECT:

Supplement to the Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 for Indian Point Nuclear Generating Unit No. 3 (TAC No. MD2671)

REFERENCES:

1. Entergy letter dated July 24, 2006, F.R. Dacimo to Document Control Desk,"Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2" 2. NRC Letter and SER dated January 7, 1987, S.A. Varga to J.C. Brons (NYPA), "Indian Point 3 Nuclear Power Plant -Exemption from Certain Requirements of Section III.G and III.J of Appendix R to 10 CFR Part 50" 3. NRC letter dated March 15, 2007, J.P. Boska to M.R. Kansler, "Indian Point Nuclear Generating Unit No. 3 -Request for Additional Information Regarding the Revision of Existing Exemptions from Title 10 of the Code of Federal Regulations Part 50, Appendix R Requirements (TAC No. MD2671)" 4. Entergy letter dated April 30, 2007, F.R. Dacimo to Document Control Desk,"Response to Request for Additional Information Regarding the Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 for Indian Point Nuclear Generating Unit No. 3" 5.- Entergy letter dated May 23, 2007, F.R. Dacimo to Document Control Desk,"Supplemental Response to Request for Additional Information Regarding the Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 for Indian Point Nuclear Generating Unit No. 3 (TAC No. MD2671)"

NL-074084 Docket No. 50-286 Page 2 of 3

Dear Sir or Madam:

By letter dated July 24, 2006 (Reference 1), Entergy Nuclear Operations, Inc. submitted a"Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2." The letter requested revision of the January 7, 1987 NRC SER (Reference

2) to reflect that the installed Hemyc Electrical Raceway Fire Barrier System (ERFBS) configurations provide a 30-minute fire resistance rating, in lieu of the previously stated one-hour fire resistance rating. This applies to Hemyc ERFBS that is installed on conduit, cable tray, and a box-type enclosure in Fire Areas ETN-4 and PAB-2. The NRC staff requested additional information by letter.dated March 15, 2007. (Reference

3) in order to complete its review of the request. Responses to questions 2 through 6 were provided by letter dated April 30, 2007 (Reference 4), and the response 4o question 1 was provided in a letter dated May 23, 2007 (Reference 5): The purpose of this letter is to revise the request made in Reference 1 relative to the cable tray Hemyc ERFBS configurations, in light of new information obtained since the letter was, submitted.

Entergy herein requests revision of the January 7, 1987 SER to reflect that the installed Hemyc ERFBS configurations in Fire Area ETN-4 on the cable tray provide a 24-minute fire resistance rating, in lieu of the previously stated one-hour fire resistance rating in the January 7, 1987 NRC SER. The revised request for a 24-minute fire resistance rating for the cable tray Hemyc ERFBS configurations is in lieu of the 30-minute fire resistance rating requested in our July 24, 2006 letter. Attachment 1 contains supporting information for-this revised request. We consider this conservatively interpreted fire resistance rating for the cable tray Hemyc ERFBS configurations to provide an adequate level of protection for the enclosed safe-shutdown cables in Fire Area ETN-4, given the limited amounts and types of hazards in the area and the active and passive fire protection features that are provided.Commitments made in this letter are identified in Attachment

2. If you have any questions or require additional information, please contact Mr. R.W. Walpole, Manager, Licensing at (914)734-6710.I declare under penalty of perjury that the foregoing is true and correct. Executed on Sincerely,-Fed R. Dacimo Site Vice President Indian Point Energy Center Attachments:

NL-07-084-Docket No. 50-286 Page 3 of 3 1: Supplement to the Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 2: Commitments made in Supplement to the Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 cc: Mr. John P. Boska, Senior Project Manager, NRC NRR DORL Mr. Samuel J. Collins, Regional Administrator, NRC Region 1 NRC Resident Inspector, IPEC Mr*. Peter R. Smith, President, NYSERDA Mr. Paul Eddy, New York State Dept, of Public Service ATTACHMENT 1 to NL-07-084 Supplement to the Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 ENTERGY NUCLEAR OPERATIONS, INC.INDIAN POINT NUCLEAR GENERATING UNIT NO. 3 DOCKET NO. 50-286 NL-07-084 Docket No. 50-286 Attachment 1 Page 1 of 5 Supplement to the Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 By letter dated July 24, 2006 (Reference 1), Entergy requested revision of the January 7, 1987 NRC SER (Reference

2) to reflect that the installed Hemyc Electrical Raceway Fire Barrier System (ERFBS) configurations in Fire Areas ETN-4 and PAB-2 provide a 30-minute fire resistance rating, in lieu of the previously stated one-hour fire resistance rating. This applies to Hemyc ERFBS that is installed on conduit, cable tray, and a box-type.enclosure.

Responses to a request for additional information (Reference

3) were provided by letters dated April 30, 2007 (Reference

4) and May 23, 2007 (Reference 5). In the referenced Entergy correspondence, information was provided to support a revision of the 1-hourfire resistance rating,. establishing that a 30-minute fire resistance rating would provide. adequate protection for the safe-shutdown cables, in light of the hazards and fire protection features of the areas. The information herein supplements and revises the request for revision of the January 7, 1987 SER for the installed cable tray Hemyc ERFBS configurations in Fire Area ETN-4 from a one-hour fire resistance rating to a 24-minute fire resistance rating.Cable Tray Sections As stated in Reference 1, the installed cable tray Hemyc ERFBS configurations consist of the following:

Seven 18" cable tray sections, with a cable percent fill in these trays ranging from approximately 10% to 25%. Also wrapped are two 24" cable tray sections, each with a cable percent fill of approximately 50%. All cable trays are wrapped using 1-1/2" thick Hemyc blanket with a 2" air gap between the blanket and the protected raceway.In preparing Reference 1 and as documented in Reference 6, the results from several test configurations from the NRC Hemyc fire test program conducted in 2005 were applied to those of comparable Indian Point 3 (IP3) installed Hemyc ERFBS configurations in the affected fire areas. For the cable tray configurations, Entergy referenced the fire test results (Reference

7) of cable tray Configurations 2B and 2D, noting that Configuration 21 provided thermal protection for the enclosed cables of at least 30 minutes, and Configuration 2D provided thermal protection for approximately 27 minutes before exceeding the temperature rise acceptance criteria.

Recognizing that Configuration 2D failed to provide 30 minutes of thermal protection, and interpreting Hemyc joint separation as a contributing factor, it was proposed to install additional stainless steel over-banding on the installed cable-tray Hemyc ERFBS configurations in the affected fire zones of Fire Area ETN-4 to minimize the potential for mechanical failure of the ERFBS under fire exposure conditions in the belief that this would enable the installed configurations to better resist a 30-minute exposure fire. N L-07-084 Docket No. 50-286 Attachment 1 Page 2 of 5 As of the date of the Entergy submittal (Reference 1), additional Hemyc fire testing by the industry had not yet been completed, and thus further meaningful comparative data was not available for consideration. By NRC letter dated March 15, 2007 (Reference 3), Entergy was requested to consider the results of other industry Hemyc fire testing to assess whether the results of this testing impacted any of the conclusions reached in Entergy's July 24, 2006 request.In the response to Reference 3 provided by letter dated May 23, 2007 (Reference 5), the results for tested cable tray Hemyc ERFBS Configurations A-I, A-2, and A-3 from industry fire testing (documented in Reference 8), all constructed with zero percent fill and a 2" air gap, were used to evaluate comparable IP3 installed cable tray Hemyc configurations. Configuration A-2 consisted of multiple 24" cable trays, while Configurations' A-1 and A-3 each consisted of a single 24" cable tray. Configurations A-2 and A-3 provided thermal protection for at least 30 minutes before exceeding the temperature rise acceptance criteria, but Configuration A-1 exceeded the temperature rise acceptance criteria at approximately 24 minutes into the exposure period. To compensate for the failure of Configuration A-i, which Entergy attributed to the apparent infiltration of hot gases due to joint separation, it was reiterated in Reference 5 that Entergy intended to install over-banding on the installed cable tray configurations to minimize the potential for joint separation in an effort to achieve a 30-minute fire resistance rating.Subsequent to Entergy letter dated May 23, 2007 (Reference 5), discussions with the Staff were held and further review of the industry Hemyc fire -test data in Reference 8 was performed. Despite the successful minimum 30-minute performance of Configurations A-2 and A-3, the postulated success of a third comparable Configuration (A-1) to perform for a minimum of 30 minutes via the use of over-banding cannot be definitively demonstrated. Moreover, the affected IP3 cable trays contain at least 10% cable fill versus thezero percent fill in the tested configurations, and although not qualifiable the heat sink afforded by the copper conductors can be expected to moderate the temperature inside the IP3 installed cable tray Hemyc ERFBS configurations. As a result, it has been determined that the more limiting performance of Configuration A-1 should be used as the basis for the installed -cable tray Hemyc ERFBS configurations fire resistance rating. Therefore, for purposes of this request, Entergy considers the fire resistance capability of the,installed cable tray Hemyc ERFBS configurations in Fire Area ETN-4 to be 24 minutes without the use of over-banding. A comparison of the 24-minute fire resistance rating to the fire hazards in Fire Area ETN-4 demonstrates the adequacy of this rating. The subject cable trays provided with Hemyc ERFBS configurations are located in Fire Zones 7A, 60A, and 73A. These fire zones have computed combustible loading values as shown below, with electrical cable insulation in the cable trays being the dominant contributor in each zone. NL-07-084 Docket No. 50-286 Attachment 1 Page 3 of 5 Ft Combustible Incidental Equivalent Fire TotalLoad ContributedE Combustible Severity, Fire Combustible Fire Severity by Cables Loading Combustibles Zone Load (BTU/ft 2) (Minutes) by Cables Loading, Other Than__________ ____ I_ _ _Cables -Minutes)7A 78,716 59 78,316 400 < 1 60A 90,991 68 90,591 400 < 1 73A 127,239 95 126,839 400 < 1 The electrical cables installed in cable trays in Fire Area ETN-4, inclusive of the fire zones listed above, are of flame-retardant construction, and will not constitute a significant component of the fuel source for credible fire scenarios in this area. In an SER dated February 2, 1984 (Reference 9), the NRC Staff stated that -(given the flame-retardant-cable construction and the results of testing as described in a NYPA letter dated November 22, 1982 (Reference 10)), "... a postulated fire commensurate with the transient fire hazard -[in Fire Area ETN-4] would not cause propagation along the cables to a significant degree." This was the basis for the granting of an exemption in that SER from the requirement to consider electrical cable in the Electrical Tunnels as an intervening combustible. Therefore, the electrical cables in the fully-suppressed cable trays in Fire Area ETN-4 are considered to be a negligible contributor to any credible fire scenario in that area.The fuel loading contribution from the credible fire hazards in the area, exclusive of the cable insulation and inclusive of transient and incidental combustibles, represents an insignificant fire challenge to systems, structures, and components in Fire Area ETN-4. For the range of credible fire scenarios, a 24-minute fire resistance rating provided by the installed cable tray Hemyc ERFBS configurations will provide adequate protection, with margin, of the credited safe-shutdown capability. Conclusions In light of the limited amounts and types of hazards in Fire Area ETN-4, the full-area coverage fire detection system, the fixed automatic cable tray fire suppression system, and available manual suppression features, the conservative fire resistance rating of 24 minutes of the IP3 installed cable tray Hemyc ERFBS configurations is considered to provide adequate protection, with margin, for the enclosed safe-shutdown cables in Fire Area ETN-4.Therefore, by this letter, Entergy Nuclear Operations, Inc.: 1. Requests revision of the January 7, 1987 SER to reflect that the installed Hemyc ERFBS configurations in Fire Area ETN-4 on the cable tray provide a 24-minute fire resistance rating, in lieu of the previously stated one-hour fire resistance rating in the January 7, 1987 NRC SER. The revised request for a 24-minute fire resistance NL-07-084 Docket No. 50-286 Attachment 1 Page 4 of 5 rating for the cable tray Hemyc ERFBS configurations is in lieu of the 30-minute fire resistance rating requested in our July 24, 2006 letter.2. Modifies the Commitment (Number 3) originally presented in Attachment 2 to Reference 11 and subsequently modified as presented in Attachment 2 to Reference 5, to clarify the commitment on installation of stainless steel over-banding. .Given that a definitive solution for the failure of test Configuration A-1 to meet temperature rise criteria has not been demonstrated, the value of installing over-banding on the installed cable tray Hemyc ERFBS configurations is indeterminate. As such, Entergy will not install such over-banding on IP3 installed cable tray Hemyc ERFBS configurations as discussed in References 1 and 5. This revised commitment is contained in Attachment 2 to this letter.-References

1. Entergy letter dated July 24, 2006, F.R. Dacimo to Document Control Desk, "Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2" 2. NRC Letter and SER dated January 7, 1987, S.A. Varga to J.C. Brons (NYPA),"Indian Point 3 Nuclear Power Plant -Exemption from Certain Requirements of Section III.G and IIl.J of Appendix R to 10 CFR Part 50" 3. NRC letter dated March 15, 2007, J.P. Boska to M.R. Kansler, "Indian Point Nuclear Generating Unit No. 3 -Request for Additional Information Regarding the Revision of Existing Exemptions from Title 10 of the Code of Federal Regulations Part 50, Appendix R Requirements (TAC No. MD2671)" 4. Entergy letter dated April 30, 2007, F.R. Dacimo to Document Control Desk,"Response to Request for Additional Information Regarding the Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 for Indian Point Nuclear Generating Unit No. 3" 5. Entergy letter dated May 23, 2007, F.R. Dacimo to Document Control Desk,"Supplemental Response to Request for Additional Information Regarding the Request for Revision of Existing Exemptions from 1.0 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 for Indian Point Nuclear Generating Unit No. 3 (TAC No. MD2671)" 6. Entergy Engineering Report IP-RPT-06-00062, Revision 0; "Comparison of IP3 Hemyc Electrical Raceway Fire Barrier System to NRC Hemyc Fire Test Results" NL-07-084 Docket No. 50-286 Attachment 1 Page 5 of 5 7. Hemyc (One-Hour)

Electrical Raceway Fire Barrier Systems Performance Testing;Cable Tray, Cable Air Drop, and Junction Box Raceways (Omega Point Laboratories Fire Test Report, Project 14790-123264, dated April 18,-2005)8. Report of Testing Hemyc 1-Hour ERFBS for Compliance with the Applicable Requirements of the Following Criteria: Generic Letter 86-10, Supplement 1 ýlntertek Testing Services NA Inc. Fire Test Report 3106846, dated January 16, 2007;Revised February 5, 2007)9. NRC letter dated February 2, 1984, D.G. Eisenhut to J.P. Bayne, "Exemptions from the Requirements of 10 CFR 50, Appendix R, for the Indian Point Nuclear Generating Plant, Unit No. 3 (IP-3)" 10. NYPA letter dated November 22, 1982, J.P. Bayne to H.R. Denton, "Indian Point 3.Nuclear Power Plant, Docket No. 50-286, Appendix R" 11. Entergy letter dated June 8, 2006, F.R. Dacimo to Document Control Desk,"Response to Generic Letter 2006-03, Potentially Nonconforming Hemyc and MT Fire Barrier Configurations" ATTACHMENT 2 to NL-07-084 Commitments made in Supplement to the Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 ENTERGY NUCLEAR OPERATIONS, INC INDIAN POINT NUCLEAR GENERATING UNIT 3 DOCKET NO. 50-286 I NL-07-084 Docket No. 50-286 Attachment 2 Page 1 of 1, This table identifies actions discussed in this letter for which Entergy commits to perform.Any other actions discussed in this submittal are described for the NRC's information and are not commitments. Number Commitment Type Scheduled Completion Date 3 Complete modification (including One-Time 12/01/2008 supporting engineering evaluation) to Action install additional protection of the electrical raceway supports and protection of certain metallic penetrating items associated with the existing Hemyc ERFBS located outside containment, and to install stainless steel over-banding on the box-type configuration (as described) located outside containment. [This is a further clarification of commitment 3 (licensee reference number COM-07-00034) which was initially made in Entergy Letter NL-06-060 dated June 8, 2006, and which was clarified in Entergy Letter NL-07-061 dated May 23, 2007] NL-06-078 Docket No. 50-286 Attachment 1 Page 7 of 14 6.2 The requested exemption does not present an undue risk to the public health and safety.... The Hemyc ERFBS configurations installed in IP3 Fire Areas ETN-4 and PAB-2 will provide a fire resistance capability of at least 30 minutes, as discussed in Section 5.0. The minimal fire hazards and ignition sources, combined with the nature of the fire hazards in the areas, the active and passive fire protection features, and the controls on transient combustibles and ignition sources, as discussed in Section 3.0, provide assurance that the credible fire challenge to the IP3 Hemyc ERFBS will be substantially less than that of an equivalent ASTM E 119 30-minute fire exposure. Therefore, as discussed in Section 4.0, the installed ERFBS can be expected to provide. adequate protection for the affected safe-shutdown raceways and enclosed cables.Therefore, given the existing level of fire protection defense in depth, combined With the minimal fire challenge presented by the credible fire scenarios in these areas, and the favorable FP equipment operating history, the change in credited ERFBS fire resistance rating from one hour to 30 minutes will not degrade the effectiveness of the IP3 fire protection program, nor will it challenge the credited post-fire safe-shutdown capability. Based on the determination that safe shutdown in the event of a-fire can be achieved and maintained with less than a one-hour fire resistance rating, the requested revision to the existing exemptions does not present an undue risk to the public health and safety.6.3. The requested exemption is consistent with the common defense and security The requested revision to the existing exemptions is not directly related to and should not adversely impact the common defense and security.6.4 Special circumstances are present -underlying purpose of the rule 10 CFR 50.12(a) requires that special circumstance be present inorder for the Commission to consider granting an exemption. Per 10 CFR 50.12(a)(2)(ii), one special circumstance is that application of the regulation in the particular circumstances would not serve the underlying purpose of the rule or is not necessary to achieve the underlying purpose of the rule.The underlying purpose of 10 CFR 50, Appendix R, Section II.G is to provide reasonable assurance that at least one means of achieving and maintaining safe shutdown conditions will remain available during and after any postulated fire. For the areas containing the Hemyc ERFBS installations, the credible fire challenge to the IP3 Hemyc ERFBS due to any postulated fire will be substantially less than that of an equivalent ASTM E-119 30-minute fire exposure. Therefore, a fire Program Plan For Utemyc (t-Ftour) and M.T. (3-Hour)Fire Protective Wrap Performance Testing Final January 16, 2003! Purpose and Scope Section 50.48, "Fire Protection," of 10 CFR Part 50 requires that each operating nuclear power plant have a fire protection-plan that satisfies General Design Criterion 3 of Appendix A to 10 CFR Part 50. Section 50.48 also requires that all plants with operating licenses issued prior to January 1, 1979, satisfy the requirements Sections of IlI.G, Il[.J, and 111.0 df Appendix R to10 CFR Part 50. (Post 1979 plants (per 10 CFR Part 50.48) have to comply with the provisions of their licenses.) Section IIIlG of Appendix R, which addresses fire protection of safe shutdown capability, requires that fire protection features be provided such that one train of systems necessary to achieve hot shutdown conditions remains free of fire damage. One acceptable means of satisfying this requirement is to separate cables and equipment and associated non-safety circuits of redundant systems necessary to achieve and maintain hot shutdown conditions located in the same fire area by a fire barrier having a,3-hour fire rating (Section IIl.G.2.a). Another means is to enclose cables and equipment and associated non-safety circuits of one redundant train in a fire barrier having a 1-hour fire rating and install fire detectors and an automatic fire suppression system in the fire area (Section III.G.2.c). The scope of this document is to describe the overall program for investigating the fire protection rating. of Hemyc (1-hour) and M.T. (3-hour) fire wraps. The primary approach will be to perform a series of ASTM E 119 furnace tests on a number of cable raceway types that are wrapped in either the Hemyc (with or without air gaps) or M.T. fire barrier material. The Hemyc wrap tests will be performed for a period of 60-minutes each, followed by a hose stream test and post-test visual inspection of the fire wrap. The M.T. test will be similar with the principal difference being that it will be conducted for a period of 3-hours. A description of these tests and-of the overall approach are provided below.2 Objective The objective of this program is to assess the fire protection rating of Hemryc and M.T. fire protection wraps by subjecting, various test specimens (conduit, cable trays, cable drops, condolets (access fittings), junction boxes, and raceway support structure analogues) that are enclosed within the wraps to standard temperature-time conditions as specified in NFPA 251 and ASTM E 119. The types and characteristics of the wraps enclosing the test specimens are intended to simulate as-installed configurations. A secondary objective of these tests is to assess the ability of Rockbestos Surprenant Firezone R fire rated cables to withstand the ASTM E 119 time-temperature environment. I Fire Protective Wrap Performance Testing Program Plan6 1/16/03 3 Approach The following sections describe the test specimens and the test conditions to be employed for the performance assessments of the Hemyc and M.T. fire barrier systems.3.1 Test specimens The principal test specimens. will include a variety of cable raceway types covered with either the Hemyc 1-hour fire wrap or M.T. 3-hour wrap. In one test, the test specimens will be wrapped with Hemyc fire barrier material directly (i.e., without air gaps). The test specimens in the second test will be enclosed in Hemyc wrap that is framed with structural supports to provide a 5-cm (2 in.) air gap between the wrap and the raceway. For the third test, the test specimens (conduits, condolets, a cable drop and junction box) will be covered with the M.T.fire barrier wrap and subjected to a 3-hour ASTM E 119 furnace exposure. A conduit and condolet LB (an "L' shaped conduit fitting with the access cover on the back, "B") assembly, direct wrapped in Hemyc fire barrier material and a number of support structure specimens directly wrapped with Hemyc material will also be included in the three-hour test, as will three Rockbestos Surprenant Firezone R cables that will be supported in an unwrapped cable tray.The types. of test specimens and the configurations of the fire barrier material wrapping selected for these tests are based principally on the application usage information provided to the NRC/NRR by industry (Letter: Emerson, NEI, to Frumkin, NRC/NRR, "Promatec Hemyc 1-Hour and MT 3-Hour Fire Barrier Systems," December 28, 2001 and via letter: Marion, NEI, to Hannon, NRC/NRR, "Comments on NRC Hemyc Test Plan," December 6, 2002). The testing of the Hemyc wrapped conduit/box assembly during the three-hour test run is being conducted in order to gain some additional data regarding the Hemyc material's performance beyond the one-hour time-temperature exposure conditions. The testing of empty raceways is intended to provide bounding qualification of the protective material performance under standard test conditions. For example, items of larger thermal mass should be bounded by these tests. Also, this method is per NRC guidance and represents current staff positions on bounding test approaches. Additionally, it is also intended that the assembly and installation of the Hemyc and M.T. fire barriers will be done in accordance with the vendor's specifications and meet all required vendor quality standards. The test specimens will include the following items: , A 27-mm (1 in.) steel conduit arranged in a modified "U" configuration such that one vertical leg and one end of the-horizontal span of the conduit intersect at a condolet LB access fitting, forming a right angle, while the other end of the horizontal span transitions to the second vertical leg via a conduit radius bend or elbow." A 63-mm (21/2 in.) steel conduit arranged in a modified "U" configuration such that one vertical leg and one end of the horizontal span of the conduit intersect at a condolet LB access fitting, forming a right angle, while the other end of the horizontal span will transition to the second vertical leg by means of a conduit radius bend or elbow.* A 103-mm (4 in.) steel conduit arranged in a modified "U" configuration such that one 2 Fire Protective Wrap Performance Testing Program Plan.1/16/03 vertical leg and one end of the horizontal span of the conduit intersect at a 30 cm x 61 cm x 25 cm (12" x 24" x 10") steel junction box, forming a right angle, while the other end of the horizontal span will transition to the second vertical leg through a conduit radius bend or elbow in one of the one-hour tests. For the three-hour test, the large diameter (103-mm) conduit will be coupled to the junction box at the mid-point of its horizontal span to allow a cable drop to intersect the top of the box from the furnace ceiling. In that test the sharp right angle transition will employ a large condolet LB fitting whilethe other horizontal-to-vertical transition will be made by means of a radius bend or elbow.* A 305-mm (12 in.) wide steel ladder-back cable tray. The cable tray will be constructed in a modified "U" configuration such that one vertical leg and one end of the horizontal span of the conduit intersect at a right angle, while the other end of the horizontal span will transition to the second vertical leg by means of a tray vertical curve.* A 610-mm (24 in.) wide steel ladder-back cable tray. The cable tray will be constructed in a modified "U" configuration such that one vertical leg and one end of the horizontal span of the conduit intersect at a right angle, while the other end of the horizontal span will transition to the second vertical leg by means of a tray vertical curve.* A 914-mm (36 in.) wide steel ladder-back cable tray. The cable tray will be constructed in a modified "U" configuration such that one vertical leg and one end of the horizontal span of the conduit intersect at a right angle, while the other end of the horizontal span will transition to the second vertical leg by means of a tray vertical curve.* Two short cable drops: one consisting of a single 8 AWG bare copper wire and the other being a 250 kcmil bare copper wire.* Four separate support structure test elements consisting of four different cross sections (threaded rod, Unistrut, angle iron and square tube) formed into a right angle ("L")configuration and partially covered by the Hemyc material. These structures are being included in the test program to evaluate the magnitude of heat transmission along their wrapped length and the possible thermal coupling effect on any supported assemblies. In addition, three Rockbestos Surprenant Firezone R cables will be subjected to the furnace environment during the three-hour test in order to evaluate their ability to withstand the ASTM E 119 time-temperature profile. One each of a power (3 conductor), control (5 conductor) and, instrument (2 conductor) type cables will be tested. These cables will be placed and secured in a separate, unwrapped 305-mm (12 in.) wide ladder-back cable tray during the three-hour test.During the test, the insulation resistance (IR) between the individual conductors to all of the other conductors in the Firezone R cables, and the IR between the individual conductors and electrical ground will be monitored continuously during the test using the Sandia Insulation Resistance Measurement System. The 305-mm steel cable tray supporting the three Firezone R cables will be electrically isolated from the other raceway test specimens. Each of the fire protection wrapped cable raceway test specimens will be tested without any cables routed through them. A bare #8 copper conductor, instrumented with thermocouples along its length, will be routed through each of the raceway test specimens. The thermocouples will be attached to the bare copper conductor at 150-mm (6 in.) spacing 03 Fire Protective Wrap Performance Testing Program Plan 1/16/03 intervals. Additional thermocouples will be attached to the outer, surfaces of the conduit test specimens and along the length of both side rails of the cable tray test specimens at 150-mm intervals. The protective wrap at one end of each conduit test specimen will be flared and attached to the furnace ceiling interface. The opposite end of these conduit test specimens will be insulated with fiber filler inside and around the outside wall at the ceiling interface. Likewise, the protective wrap at the top of all cable drops will be flared around the furnace ceiling penetration while the cable drop interface with other test specimens (tray or junction box) will not be flared.Table 1 presents the test conditions to be investigated in terms of fire wrap type and configuration of each of the test specimens during each test. Note that no conduits will be tested in the air gap framed configuration and that no trays will be tested with M.T. wrap. Also, the support structure specimens will be protected only with direct wrap Hemyc material in the tests using both 38-mm (11/ in.) and 50-mm (2 in.) thicknesses. In addition, a 27-mm (1 in.)conduit and condolet LB assembly, wrapped with Hemyc fire wrap will be included in the three-hour test.Table 1. Test Matrix Test 1 Test 2 Test 3 Hemyc Hemyc M.T.(1-Hour Direct Wrap) (Framed for Air Gap) (3-Hour Direct Wrap)27-mm Conduit X (Not included,) X*63-mm Conduit X (Not included) X 103-mm Conduit X (Not included) X 305- mm Tray X X (Not included)610-mm Tray X X (Not 'included) 914-mm Tray X X (Not included)8 AWG Cable Drop X X X 250 kcmil Cable X X (Not included)Drop Junction Box X X X Support Structures X (Hemyc direct wrap) (Hemyc direct wrap)Firezone R Cables (Not included) (Not included) (No protective wrap)Test 3 will also include a separate 27-mm conduit test specimen direct wrapped in Hemyc material.A detailed construction plan for each of the test specimens will be developed. The plan will 4 Fire Protective Wrap Pertbrmance Testing Program Plan 1/16/03 define the specific details of the design and assembly of each test specimen and the installation of the designated fire wrap. Drawings and descriptions of the dimensions and setup configurations in the furnace and instrumentation details will also be provided. The fabrication and installation of the fire protective wraps will conducted be in accordance with vendor procedures and provisions will be made to verify that all material/installation quality requirements are met. The detailed construction plan is expected to be distributed as an appendix to the final test plan.Following the completion of the detailed construction plan and final test plan the required materials and equipment will be procured. The type of material and equipment obtained will include cables, raceways (conduit, trays, condolets, and junction boxes), metal to fabricate the support structure specimens, Hemyc and M.T. fire barrier wrap assemblies, framing material for the fire barrier wraps, thermocouples and extension wire, miscellaneous hardware (nuts, bolts, screws, etc.) plus spare parts.The test specimens will be assembled in accordance with the detailed construction plan as the material and equipment are obtained. The process will include the installation of the thermocouples to the outer. surfaces of the test specimens and checkout for proper operation prior to the installation of the fire barrier wraps. It is possible that assembly checklists will be developed for each of the test specimens and included as part .of the final test plan. The fire barrier wraps will be installed around the test specimens per the manufacturer's procedures. Photographs, of the test specimens, both during. and after assembly, will be taken prior to testing and kept as part of the test documentation. 3.2 Test criteria The test specimens will be subjected to the ASTM E 119 time-temperature profile in the test furnace. An assessment of the fire barrier wrap performance will be based on two principal factors: 1. The time at which the average unexposed side temperature of the fire barrier system, as measured on. the exterior surface of the raceway or component, exceeds 139 C (250 F) above its initial temperature. Or the time at which a single temperature reading of a test specimen exceeds 30% of the maximum allowable temperature rise (i.e., 181 C [325 F])above its initial temperature. 2.. The fire barrier system remains intact during the fire exposure and water hose stream test without developing any openings through which the cable raceway is visible.3.3 Test facilities A Request for Proposal will be distributed soliciting bids on providing test services for the primary test series. Included in the RFP will be a discussion of the scope of the tests, specific 5 Fire Protective Wrap Performance Testing Program Plan 1/16/03 tasks to be performed, and furnace requirements. Desirable facility support capabilities will include the availability of a test specimen assembly area, data acquisition interfaces for the test specimen thermocouples, providing photo/video records of the test specimens and tests, and a summary report/documentation of the conduct of each test.Upon receipt of the proposals, they will be evaluated against the predetermined selection criteria until two finalists are left. It is expected that site visits will be made by SNL and/or NRC representatives to evaluate the specific capabilities and furnace dimensions to be incorporated into the detailed construction plan. Based on the results of these visits a finalist will be chosen and a contract will be negotiated and placed.3.4 Primary tests Three separate test runs will be conducted as part of the primary test series. Two of the tests will test the performance of 1-hour Hemyc fire barrier wrap systems and the third test will assess the performance of 3-hour M.T. fire barrier wrap. All of the primary tests will be conducted using the ASTM E 119 standard time-temperature furnace profile (Figure 1).As indicated above, these tests will be governed by the conditions provided in a formal test plan. Initially, a draft test plan will be written for review and comment by NRC. Then the final test plan, incorporating the changes directed by NRC, will be issued.The test specimens will consist of those items described in Section 3.1, Test Specimens, above. The specific setup and configuration for each test is discussed below. It should be noted, however, that the test conditions and configurations described below assume the availability and use of a floor furnace of specific dimensions; based on the outcome of the testing services solicitation and contracting process, certain details may require modification. 3.4.1 Test #1 The first test of the primary test series will be conducted on eleven test specimens directly wrapped with Hemyc fire barrier blankets (i.e., without framework to provide air gaps between the wrap and raceways). The nominal thickness. of the protective blankets will be 38 mm (11/2in.) for the cable trays and 50 mm (2 in.) for the conduit and cable drops. One of the support* structure specimens will be wrapped with a 38 mm thick Hemyc blanket and the other with a 50 mm thick blanket.Figure 2 shows the planned configuration of the test specimens inside the furnace. Looking at the elevation and plan views in the figure, the arrangement of the test specimens is as follows (from left to right):* The 27-mm (1 in.) conduit and condolet LB assembly,* the 305-mm (12 in.) wide cable tray with the small (8 AWG) cable drop entering from above,* two support structures (both formed out of threaded rod),* the 610-mm (24 in.) wide cable tray with the large (250 kcmil) cable drop entering from above, 6 Fire Protective Wrap Performance Testing Program Plan 1/16/03* the 103-mm (4 in.) conduit and 30 cm X 61 cm X 25 cm (12" x 24" x 10") junction box assembly,* the 914-mm (36 in.) cable tray, and* the 63-mm (21/2 in.) conduit and condolet LB assembly.This arrangement of the test specimens was selected in order to minimize the potential for one specimen to influence the response of another specimen to the thermal environment. Note that one end of each conduit test specimen has its protective wrap flared around the furnace ceiling penetration. The conduit and cable trays will be supported from the furnace ceiling in a modified "U" configuration. Each tray and conduit will include one sharp 90-degree transition from the horizontal span to one of the vertical legs. At the other transition point a radius bend will be used. In the case of the conduit test specimens, a condolet fitting or junction box will be employed to provide the right angle transition from horizontal to vertical. The cable trays will be modified and assembled to accommodate the right angle turn. The two vertical runs of these test articles will be approximately 0.6 m (24 in.) along each leg and the horizontal span will be-1.4 m (54 in.).Other test specimens will include two cable drop bundles and support structure analogues. A direct wrap cable bundle (250 kcmil bare copper wire) will be dropped through the top of the furnace and join the 610-mm (24 in.) cable tray at its mid-point. Similarly, a smaller (8 AWG bare copper wire) direct wrapped cable bundle will be dropped through the top of the furnace and join the 305-mm (12 in.) cable tray at its mid-point. The two partially direct wrapped support structure test specimens will be hung from the top of the furnace. The temperature data collected from these articles will be used to evaluate the potential transmission of heat along the wrapped portion of the specimens. The minimum distance from the furnace walls and the test specimens will be 30 cm (12 in.) and the minimum distance between adjacent test specimens will be -33 cm (13 in.).3.4.2 Test #2 The second primary test will be conducted on twelve test specimens, six of which will be wrapped with Hemyc fire barrier blankets and employing the necessary framework to provide a minimum of 50-mm (2 in.) air gaps between the wrap and item. The nominal thickness of the protective blankets will be 38 mm (111 in.). This test will also include six support structure test specimens, directly wrapped in the Hemyc fire barrier material without employing the 50-mm air gap. Three of the support structure specimens-one of each cross section-will be covered with a 38-mm (1% in.) thick Hemyc wrap and the remaining three will be covered with a 50-mm (2 in.) thick wrap.The planned arrangement of the test specimens in the furnace during Test #2 is shown in Figure 3. Looking at the elevation and plan views in the figure, the arrangement of the test specimens is as follows (from left to right):* The 305-mm (12 in.) wide cable tray with the small (8 AWG) cable drop bundle entering from above, 7 Fire Protective Wrap Performance Testing Program Plan 1/16/03* two support structures made of tube steel with 75 mm x 75 mm square cross sections,* the 610-mm (24 in.) wide cable tray with the large (250 kcmil) cable bundle entering from above,* two support structures made of Unistrut,* the 30 cm x 61 cm x 25 cm (12" x 24" x 10") junction box,* two support structures made of angle iron, and* the 914-mm (36 in.) cable tray...This arrangement of the test specimens was selected in order to minimize the potential for one specimen to influence the response of another specimen to the thermal environment. As was the case for Test #1, the cable trays will be supported from the furnace ceiling in a modified "U" configuration. Each tray and conduit will include one sharp 90-degree transition from the horizontal span to one of the vertical legs. At the other transition a radius bend will be used. The cable trays will be modified and assembled to accommodate the right angle turn.The two vertical runs of these test articles will be approximately 0.6 m (24 in.) along each leg and the horizontal span will be -1.3 m (50 in.).The junction box will be supported from the furnace ceiling by two Unistrut channels that are hung on four threaded rods. These junction box supports will be directly wrapped with Hemyc material separately from the box. (Note that the junction box supports are not considered as part of this test and will not be instrumented; however any failure in their performance during the test will be noted and investigated as deemed appropriate.) A wrapped (250 kcmil bare copper wire, with air gap) cable bundle will be dropped through the top of the furnace and join'the 610-mm (24 in.) cable tray at its mid-point. Another wrapped cable bundle (8 AWG bare copper wire, with air gap) will be dropped through the top of the furnace and join the 305-mm (12 in.) cable tray at it mid-point. The partially direct wrapped support structure test specimens will be hung from the top of the furnace. The temperature data collected from these articles will be used to evaluate the potential transmission of heat along the wrapped portion of the.specimens. The minimum distance from the furnace walls and the test specimens will be 30 cm (12 in.) and the minimum distance between adjacent test specimens will be -25 cm (10 in.).3.4.3 Test #3 The final test of the primary test series will be conducted on eleven test specimens, five of.which will be wrapped with M.T. 3-hour fire barrier blankets but without any framework to provide air gaps between the wrap and raceway. The nominal thickness of the M.T. protective covering, will be -76 mm (3 in.). In addition, four structural. support specimens, partially wrapped in 38-mm (11/2 in.) thick Hemyc wrap (direct wrapped), and one 27-mm (1 in.)conduit/pull box enclosed in Hemyc wrap, also direct wrapped, will be included in the third test.Three Rockbestos Surprenant Firezone R cables will be supported in an unwrapped 305-mm (12 in.) wide steel ladder back cable tray inside the furnace for this test. These cables will be continuously monitored for changes in their insulation resistance (conductor-to-conductor and 8 Fire Protective Wrap Performance Testing Program Plan 1/ 16/0?3 conductor-to-ground) during the three hour long test.Figure 4 shows the configuration of the test specimens in the furnace during Test 3. Looking at the elevation and plan views in the figure, the arrangement of the test specimens is as follows (from left to right):* The 27-mm (1 in.) conduit and condolet LB assembly, wrapped in M.T. material;* two support structures (one 75 mm x 75 mm square cross section tube steel and one angle iron), directly wrapped in Hemyc material;* the.103-mm (4 in.) conduit and 30 cm x 61 cm x 25 cm (12" x 24" x 10") junction box assembly, wrapped in M.T. material with a small cable bundle, also wrapped with M.T., entering at the top of the junction box;* two support structures ( one Unistrut channel and one threaded rod), directly wrapped with Hemyc material;* the 63-mm (21/ in.) conduit and pull box assembly, wrapped in M.T. material;* one 27-mm (1 in.) conduit and pull box, directly wrapped in Hemyc material; and* the unprotected 305-mm (12 in.) cable tray containing the three Firezone R test cables.As in the other two tests, the conduit assemblies will be supported from the furnace ceiling in a modified "U" configuration. Each conduit will include one sharp 90-degree transition from the horizontal span to one of the vertical legs and a radius bend will be used for the other transition. A condolet fitting will be employed to provide the right angle turn. The two vertical runs of these test articles will be approximately 0.6 m (24 in.) along each leg and the horizontal run will be-1.3 m (50 in.). One end of each conduit assembly will have its protective wrap flared at the furnace ceiling interface. No cable trays are included as test specimens for this test. The four partially protected (direct Hemyc wrap only-no air gap) support structure test specimens will be hung from the top of the furnace in between the other test specimen groups.The unwrapped 305-mm (12 in.) cable tray will be supported from the furnace ceiling in a "U" configuration. This tray is being employed only to support the fire resistant Rockbestos cables, thus the tray will not include any sharp~horizontal-to-vertical transitions. The purpose for including these Firezone R cables in the test is to determine their ability to withstand the ASTM E 119 temperature conditions. The minimum distance from the furnace walls and the test specimens will be 30 cm (12 in.) and the minimum distance between adjacent test specimens will be 45 cm (18 in.).3.5 Conduct of tests Each of the primary test runs will be conducted by exposing the test specimens to the time-temperature profile as specified in ASTM E 119, Standard Test Methods for Fire Tests of Building Construction and Materials. By this method, the temperature inside the furnace should reach 927 C (1700 F) at the end of the one-hour tests and 1052 C (1925 F) at the end of the 3-hour test. Figure 1 shows the desired temperature profile as a function of time.9 Fire Protective Wrap Performance Testing Program Plan 1/16/03 The insulation resistance of the three Rockbestos Surprenant Firezone R cables will be monitored continuously duringthe three-hour test. The insulation resistance of each conductor in the test cable to the other conductors in the cables as well as the insulation resistance between each conductor in the test cables to ground will be recorded as a function of time using the Sandia Insulation Resistance Measurement System. A single-phase 120 VAC source will be applied to each conductor in turn while leakage currents generated in the other conductors is monitored and logged. Peak leakage currents will be limited to 1 A or less. The cable tray supporting the Firezone R cables will be connected to electrical ground.Upon completion of each ASTM E 119 temperature run (one- and three-hours), the furnace will be opened (or the complete test assembly will be removed from the furnace) and a hose stream will be applied to all of the test articles. The hose stream test will consist of a water stream applied at random to all exposed surfaces of the test specimens through a 38-mm (11/2 in.) fog nozzle set at a discharge angle of 15 degrees with a nozzle pressure of 517 kPa (75 psi) at a minimum discharge rate of 284 Ipm (75 gpm) with the tip of the nozzle at a maximum distance of 3 m (10 ft) from the test specimen. The hose stream application will be continued for at least 5 minutes upon completion of the test.A visual inspection of all test articles will be conducted following the hose stream test The purpose of the inspection will be to ascertain whether the fire barrier wraps remained intact during the fire exposure and hose stream test without developing any openings or breaches.Visible indications of an opening will include obvious tears or displacement of a wrap section or a view of the covered raceway through the wrap.Photographs of the test specimens, both prior to and after disassembly, will be taken during the post-test inspection and kept as part of the test documentation. 3.6 [nstrumentation and data collection The primary data to be generated in these tests will be component temperatures as indicated by Type-K thermocouples. Test #1 will require the use of -340 thermocouples and Test #2 will require -240 thermocouples. Approximately 270 thermocouples will be needed for Test #3.The outputs of the thermocouples will be sent to a computerized data collection unit for recording and storage. Each thermocouple's output will be recorded at least once per minute.It is expected that Teflon coated thermocouples will be used during the M.T. test (Test #3) to ensure that there will not be interference from any gases evolving from the protective wraps.Figures 5-12 show the preferred attachment locations of the thermocouples on the conduit, trays, cable drops, junction box and support structure test specimens during the three tests.Routing the thermocouples for monitoring the tray temperatures will be by laying the bundles in the tray at the entry point and branching the thermocouples off for attachment to the tray rails and bare copper conductor at the appropriate locations. Similarly, for the cable drop thermocouples, the thermocouples will be bundled with the cable drop cables at the point of entrance on the ceiling of the furnace and branching off the thermocouples for attachment to the bare copper conductor wire at the appropriate points.Each conduit will have thermocouples attached to the outer surface located along the outside 10 Fire Protective Wrap Performance Testing Program Plan 1/t6/03.perimeter of the "U" shape (see Figures 5, 7 , 9 and 12). The routing of thermocouples for monitoring the temperature of the conduit will require that a series of small thermocouple bundles be placed around the circumference of the conduit and run to their individual attachment locations between the conduit and fire wrap. In order to minimize the effect of these small bundles on the test results, the conduit thermocouples will be run in underneath the wrap from both ends of the test specimen. In addition, the bare copper wires routed through the interior of the conduit test specimens will also be instrumented with thermocouples. The junction boxes and condolet fittings will have at least one thermocouple attached to each side (6 in all) located at or as closely as possible to the geometric center of the side walls.The reader should note that the thermocouple locations indicated in these figures are for information purposes only. The thermocouples will be installed at 150-mm (6 in.) intervals along the conduits, cable tray rails, condolets, junction boxes, and bare #8 copper wires in accordance with the guidance provided in Supplement 1 to Generic Letter (GL) 86-10 and Regulatory Guide (RG) 1.189.The Sandia Insulation Resistance Measurement System will be used to monitor the changes in insulation resistance occurring within the Rockbestos Surprenant Firezone R cables during Test 3. The concept of the SNL IR measurement system is based on the assumption that if one were to impress a unique signature voltage on each conductor in a cable (or cable bundle), then by systematically allowing for and monitoring known current leakage paths, it should be possible to determine if leakage from one conductor to another, or to ground, is in fact occurring. That is, part or the entire voltage signature may be detected on any of the other conductors in the cable (or in an adjacent cable), or may leak to ground directly.To illustrate, consider a three-conductor (3/C) cable, as illustrated in Figure 13. If 100 V are.applied to Conductor 2, the degree of isolation of Conductors land 3 from Conductor 2 can be determined by systematically opening a potential conductor-to-conductor. current leakage path and then reading the voltages of each conductor in turn while Conductor 2 is energized. Determining the IR between Conductors 1 and 2 at the time of voltage measurement on Conductor 2 is a simple calculation employing Ohm's law.The calculation of the three resistances for each conductor pair (one conductor-to-conductor path and, each of the two conductor-to-ground paths) requires the measured voltages (Vi and V) for two complementary switching configurations. For example, the complement for the case illustrated in Figure 13 is shown in Figure 14. As illustrated in Figure 13, Conductor 2 is connected to the input side and conductor 3 is connected to the measurement side. The complementary case shows Conductor 3 on the input side and Conductor 2 on the measurement side, as shown in Figure 14. This complementary pair provides four separate voltage readings that can be used to determine the three resistance paths affecting these two conductors; namely, R 2-3 , R 2.G, and R 3.G.This concept is scalable for virtually any number of conductors in a cable or bundle of cables.Another advantage is that only the two voltage measurements for each switching configuration need to be recorded in real time; determining the resistances can be deferred until after the test is completed. I1 Fire Protective Wrap Performance Testing Program Plan 1/16/03 Employing this method to monitor the changes in insulation resistance of the individual conductors in the Firezone R cables during the furnace test will provide sufficient data to determine the degree, if any, of cable degradation. In addition, this method is able to identify the indications of insulation resistance recovery (e.g., healing) as the temperature of the furnace is decreased following the test period. Since the Sandia IR measurement system presently exists and has been demonstrated previously the cost impact to the program to include the FireZone R cables' IR measurements is expected to be small.3.7 Follow-on tests The decision to plan and conduct follow-on tests will be made on the basis of the primary test results.4 Reporting and Documentation The test data will be analyzed and the fire barrier performance will be evaluated based on the acceptance criteria. A test report will be submitted to NRC that will include recommendations, if any, for follow-on testing.It should be recognized that the possibility exists that these test results may form the technical basis for broad acceptance of these fire protection systems by NRC, or provided the basis for enforcement action or backfit requirements, as deemed appropriate. 5 Recommendation for Research Enhancements The appendix to this document proposes several modifications to this plan that would enhance the quality of these tests for research purposes. These suggestions are based in large measure on comments received from industry (letter: Marion, NEI, t6Hannon, NRC/NRR,"Comments on NRC Hemyc Test Plan," December 6, 2002) on the previous draft of this program plan.12 Fire Protective Wrap Performance Testing Program Plan 1/16/03 Temperature-Time Curve 1200 1000 800 0 0.E 600 400 200 O 0 I-4-a I..0 0.E 0 I-0 1 2 3 Time (hr)Figure 1: Excerpt of the Standard Time-Temperature Curve (based on data provided in ASTM E 119)..13 Fire Protective Wrap Performance Testing Program Plan 1/16/03 End View Elevation View Figure 2: Test Specimen Layout for Test t.t .14 Fire Protective Wrap Performance Testing Program Plan 1/t6/03 End View 2.1j jn7)Elevation View 3.7 I 2)'1 _______Figure 3: Test Specimen Layout for Test 2.15 Fire Protective Wrap Performance Testing Program Plan 1/l 6/0 3 End View Elevation View Figure 4: Test Specimen Layout forTest 3. Note that the shaded elements represent the test specimens protected with the M.T. fire wrap. Unshaded elements are enclosed in Hemyc fire wrap. The Firezone R fire rated cables will be installed in an unprotected, open cable tray.16 Fire Protective Wrap Performance Testing Program Plan 1/16/03 Furnace Ceiling Plane Figure 5: Planned Thermocouple Locations on 27-mm (I in.) Conduit/Condolet LB Test Specimens. Note that at least one thermocouple will be attached to each face of the condolet fitting. A single bare copper wire (8 AWG) will be instrumented with thermocouples and routed inside the test specimen.17 Fire Protective Wrap Performance Testing Program Plan 1 /16/03 Figure 6: Planned Thermocouple Locations on the 305-mm (12 in.) and 610-mm (24 in.) Cable Tray Test Specimens during Tests Il and #2. Note that the locations indicated reflect relative positions on each tray side rail and on the bare 8 AWG copper wire attached to the tray rungs.. Also, note that the cable drop will consist of a bare 250 kcmil (610-amm tray) or a 8 AWG (305-mm tray) copper Wire to which the thermocouples are attached.18 Fire Pirotective Wrap Performance Testing Program Plan t1 /!6/0 3 Furnace Ceiling Plane Figure 7: Planned Thermocouple Locations on the 103-mm (4 in.) Conduit and Junction Box Assemblies during Test #1. Note that a thermocouple will be attached to each face of the junction box (6 total). A single bare copper wire (8 AWG) will be instrumented with thermocouples and routed inside the test specimen.19 Fire Protective Wrap Performance Testing. Program Plan 1/16/03-TE -TOE TOE Furnace Ceiling Plane-nTE<-TE T TE TE' TE TE TE A iN A A /N'N TE TEOE (tE ET Figure 8: Planned Thermocouple Locations on the 914-mm (36 in.) Cable Tray Test Specimens. Note that the locations indicated reflect relative positions on each tray side rail and on the bare 8 AWG copper wire attached to the tray rungs.20 ..Fire Protective Wrap Performance Testing Program Plan 1/16/03 Furnace Ceiling Plane Figure 9% Planned Thermocouple Locations on the 63-mm (2V2 in.)Conduit/Condolet LB Test Specimens. Note that at least one thermocouple will be attached to each face of the condolet LB fitting. Asingle bare copper wire (8 AWG) will be instrumented with thermocouples and routed inside the test specimen.21

• Fire Protective Wrap PerformanceTesting Program Plan 1/16/03 Furnace Ceiling Plane Figure 10: Planned Thermocouple Locations on the Partially Wrapped Support Structure Test Specimens.

22 Fire Protective Wrap Performance Testing Program Plan/1/16/03 Furnace Ceiling Plane I Threaded rod support hanger (Typ of 4)support (Typ of 2)Figure t1: Planned Thermocouple Locations on the 30 cm x 61 cmx 25 cm (12 in. x 24 in. x 10 in.) Junction Box during Test #2. A thermocouple will be attached to each face of the junction box (6 total).23 Fire Protective Wrap Performance Testing Program Plan 1/16/03 Figure 12: Planned Thermocouple Locations on the 103-mm (4 in.) Conduit and Junction Box/Cable Drop assemblies during Test #3. The cable drop will consist of a single bare copper wire (8 AWG) to which the thermocouples are attached. A thermocouple will also be attached to each of the six sides of the junction box.24 Fire Protective Wrap Performance Testing Program Plan 1/16/03 Vi 0 Figure 13: Schematic of the Insulation Measuring Circuit Showing Potential Leakage Current Paths.ii .0 Conductor 1 -0 2 R2-G R3-G Figure 14: Complementary Insulation Measuring Circuit with Respect to the Circuit Shown in Figure 11.25 Fire Protective Wrap Performance Testing Program Plan 1 / 1 6/0'3 APPENDIX Research Program Considerations The following items should be considered for inclusion in the test program to provide a research basis for the planned tests. Many of these recommendations were provided by industry comments received via letter.1 The following list of considerations were not included in the revised fire barrier performance testing program plan because they did not fit in well with the very limited objectives of the NRR program. However, they should be given consideration in broadening the. scope and objectives of a RES program.Fire Barrier Performance Model Development -It would be beneficial to tailor the test program such that one principal outcome is the development of a mathematical model, based on the test data, that could estimate the expected performance of fire barriers that might differ from the tested configurations. The development of such a model would require a significant effort to include a variety of protected raceways so that the data and resulting model(s) would be applicable to a wide range of applications. ANI Test Protocols and Multiple versus Single Raceways -The ANI Test Protocals test using a 'one layer' cable fill and circuit continuity. The current test protocal only tests single raceways not multiple raceways. The variety of cables, circuit voltages and raceway configurations used in actual plant configurations is diverse, and it would be difficult to consider a representative sample of cables, circuit voltages and multiple raceways within the same wrap in this test's scope. Such tests (using cable loading, energized circuits and multiple raceways)- would likely be useful in developing a model to estimate expected fire barrier performance (see above).Multiple Wrap Thicknesses -This test would test similar raceways in a variety of protective fire wrap thicknesses (e.g., 25-mm, 38-mm, 50-mm and 76-mm [1 in., 172 in. 2 in. and 3 in.]).This test would provide a basis for assessing the effectiveness of a particular fire wrap based on applied thickness. Industry Review and Observation -Consideration should be given to the industry's request that they be allowed to review and comment on the final test plan and detailed test specimen construction plans. They have also requested to be invited to be present to observe the construction of the test specimens, installation of the fire barriers and the conduct of the tests.Such. involvement by industry representatives would be useful in that any potentially controversial issues concerning the fire barrier performance tests will be identified early and can be resolved in a timely manner.'Letter: Marion, NEI, to Hannon, NRC/NRR, "Comments on NRC Hemyc Test Plan," December 6 2002.26 Nuclear Facility Risk Analysis 301 Risk Significance of HEMYCO Electrical Raceway Fire Barrier System Failures Raymond H.V. Gallucci, Ph.D., P.E.U.S, Nuclear Regulatory Commission. MS 0-11 A-I1, Washington. D.C. 20555. rttg(cnrc.gov INTRODUCTION' Approximately fifteen U.S. nuclear power plants (NPPs) employ the HEMYCO Electrical Raceway Fire Barrier System (HERFBS) to protect circuits in accordance with Nuclear Regulatory Commission (NRC)requirements [l]. Recent testing via Standard ASTM-El19 [21 indicated failures to achieve a one-hour fire rating [3-5]. We present a scoping analysis of the potential risk significance. PROBABILISTIC MODEL FOR TEST RESULTS Failures resulting, from shrinkage/tearing of the HERFBS covering were observed >15 min into the one-hour test, suggesting the following probabilistic model: I. The HERFBS failure probability (P) for the ASTM-El 19 fire ranges from 0 at_10 rmin to I at >60 min.2. P is a function of the temperature ".T" at time "t" or the area "A" at time "t" under the ASTM-E 119 curve, whichever is more severe.We linearized the ASTM-EI 19 curve (Fig. 1) and postulated failure thresholds of T = 704"C and A =.4870 min-"C at t 10 min, i.e.: P(T[t]) = (Tit] -704)/(920 -704) (1)P(A[t]) = (A[t] -4870)/(46470 -4870) (2)where T = 920 "C and A = 46470 min-"C at t 60 min.b ANALYSIS FOR TYPICAL NUCLEAR POWER PLANT FIRES The HERFBS will not fail if T < 704 'C, which bounds the temperatures reached by NPP fires where HERFBS is typically installed. However, NPP fires can expose a HERFBS to sufficiently high temperatures for long enough times to exceed the threshold A = 4870 min-"C. Fig. I shows a linearized CFAST' [61 simulation of an Emergency Diesel Generator (EDG) room oil fire with a rapid rise to T = 390 'C at t = 7.5 min and final T = 440"C at t -60 min, where the threshold value for A occurs at t = 16 min. At t = 60 min, A = 23250 min-"C and P(A)0.442 from Eq. (2).Assume an older NPP uses a HERFBS for safe shutdown cables in their EDG room to protect against an oil fire,'. with fast-acting smoke detection and pre-action/deluge sprinkler suppression. Based on the Fire Protection Significance Determination Process (FPSDP)[7], a medium loading of cables, two general electrical cabinets and one EDG yield a fire frequency = 4.8E-4/y +(2)(6.OE-5/y) + 0.0056/y = 0.0062/y. Conservatively we choose the FPSDP's more limiting severity characteristics and manual suppression curves -- "Indoor Oil-Filled Transformer" and "Turbine-Generator" (T-G) fires -- as surrogates for an oil fire severe enough to fail the HERFBS.The FPSDP recommends a severity factor of 0. 1. If we assume that the HERFBS damage fails any enclosed cables, it likely warrants nothing lower than 0.1 for conditional core damage probability (CCDP). We then express the core damage frequency (CDF) as 0.0062/y x 0. 1 x 0. 1 x P(A) x PNS = 6.2E-5/y x P(A) x PNS, where PNS is the non-suppression probability. For CDF < IE-6/y, we require P(A) x PNS < 0.016.'We expect rapid smoke detection; and, from the FPSDP, the non-suppression probability for the pre-action/deluge sprinklers is essentially zero, since the time-This paper was prepared by an employee of the U.S.NRC. The 'views presented do not represent an official staff position. Supporting material is available in NRC ADAMS (Accession

1. ML051300052)..b These failure temperatures refer to "furnace" temperatures, as per Standard ASTM-EI 19. The HERFBS covering begins to shrink at surface temperatures around 200 "C, but the shrinkage/tearing apparently does not translate into HERFBS failure as. defined by ASTM-EI 19 until furnace temperatures exceed 700 "C [8, 91.If a plant were to lose both offsite and emergency onsite AC power due to a fire in the EDG room (station blackout), it would have an alternate means in place to safely shut down, independent of the EDGs or any other equipment in the EDG rooms."When the calculated increase in CDF 'which cannot exceed the CDF itselfM is very small :i.e., < lE-6/yrý ...the chahge will be considered

acceptablek" [10]. This"very small change" is typically accepted as a threshold for low risk significance.

302 Nuclear Facility Risk Analysis to-damage (at least 16 min) minus the time-to-suppression (within, I min) > 10 min. The FPSDP recommends a 0.05 unavailability for a deluge system, thereby requiring manual suppression by the plant fire brigade 5% of the time. PNS for "T-G" fires, including this unavailability, =0.05/exp([0.021][At]), where At z t is the difference between times-to-damage and detection. The product P(A) x PNS rises from 0 at t = 16 min to 0.00627 at t = 60 min. Thus, it satisfies P(A) x PNS < 0.016, yielding a maximum CDF = (6.2E-5/yr)(0.00627) = 3.9E-7/y.Sensitivity Case For sensitivity, we assumed that P(T) and P(A)inversely varied quadratically and quartically to represent a rapid rise in the probability of HERFBS failure, followed by a gradual increase. We then calculated the maxima for P(A) x PNS and corresponding maximum CDFs shown in Table I. Even under these conservative bounding assumptions, we essentially satisfy P(A) x PNS< q.016 for CDF < IE-6/y.Other Nuclear Power Plant Fires The preceding analyses were repeated for two other.typical NPP fires, in an electrical switchgear room and make-up pump room. Each linearized CFAST* time-temperature curve, shown in Fig. I, is less severe than that for the EDG room fire. Table I summarizes these parallel analyses, each of which yields lower CDFs than its EDG room fire counterparts. CONCLUSIONS Within the assumptions of this analysis, which included conservatism from the FPSDP, the CDF due to recently indicated failures of the HERFBS appears to be bounded at IE-6/y for typical NPP fires. This suggests a potentially low level of risk significance.' REFERENCES I. U.S. Code of Federal Regulations, Title 10 (Energy), Part 50 (Domestic Licensing of Production and Utilization Facilities), Appendix R (Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979), Office of the Federal Register, Washington, DC (2005).2. ASTM-E 119-04, "Standard Test Methods for Fire Tests of Building Construction and Materials," This analysis is illustrative only. Plant-specific conclusions should be based on actual plant conditions and plant-specific analyses.ASTM Fire Test Standard, Sixth Edition, American Society of Testing and Materials_,. West Conshohocken, Pennsylvania.

3. U.S. NUCLEAR REGULATORY COMMISSION, Injbrmation

• Notice 2005-07 -Results oj'HEMYC4 Electrical Racewav Fire Barrier System Full Scale Testing, U.S. Nuclear Regulatory Commission, Washington, D.C. (2005) [ADAMS Accession

1. ML050890089].

4. D. PRIEST, C. HUMPHREY, HEMYC (1-Hour)Electrical Raceway Fire Barrier Svstems Pertbrmance Testing -Conduit and Junction Box Racewayvs, Omega Point Laboratories, Inc., Elmendorf, Texas (2005) [ADAMS Accession

1. ML05 1190014].5. D. PRIEST, C. HUMPHREY, HEMYC' (I-Hour)Electrical Raceway Fire Barrier Systems Perfbrmance Testing -Cable Tray. Cable Air Drop and Junction Box Racewa ys, Omega Point Laboratories, lnc., Elmendorf, Texas (2005)[ADAMS Accession
2. ML051190096].

6. R. PEACOCK, W. JONES, G. FORNEY, CFAST: Consolidated Model of Fire Growth and Smoke Transport (Version 5), User's Guide, NIST SP 1034, National Institute of Standards and Technology (NIST), Gaithersburg, Maryland (2004).7. U.S. NUCLEAR REGULATORY COMMISSION,"Fire .Protection Significance Determination Process," Inspection Manual Chapter 0609, Appendix F, U.S. .Nuclear Regulatory Commission, Washington, D.C. (2004).8. B. LEVIN, "Documents Supporting HEMYCý Tests and Insulation Fabrication," April 12, 2005, Letter to F. Wyant, Sandia National Laboratories, Albuquerque, New -Mexico , (2005) [ADAMS Accession

1. ML051190055].

9. HAVEG INDUSTRIES, INC., SILTEMP* Thermal Barrier Technical Bulletin HS-l 16, Wilmington, Delaware (1982).10. U.S. NUCLEAR REGULATORY COMMISSION, Regulatory Guide 1.174 -An Approach jbr Using Probabilistic Risk Assessment in Risk-lnlbrmed Decisions on Plant-Specific Changes to the Licensing Basis. 'Revision 1, U.S: Nuclear Regulatory Commission, Washington, D.C. (2002).

Nuclear Facility Risk Analysis 303 TABLE I. Analysis Results for Three Typical Nuclear Power Plant Fires in Areas Employing HERFBS EDG Room (Oil Fire) Electrical Switchgear Room tlake-up Pump Room Combustible Frequency Combustible Frequency Combustible Frequency (medium Cables (high Cables (low Cabdies loading 0.0014/y loading) 1.6E-5/y 4.8oadinoadng General General electrical (2)(6.OE-5/y) Electrical electrical (2)(6.0E-5/y) =cabinets l2) 1.2E-4/y switchear (25)(6.OE-5/y) = cabinets (2) l.2E-4/y Diesel ()25y0.00 15/y 5.6E-4/y (25) Pumps (6) (6)(.OE-4/y) =generator 6.0 E-4/y Analysis Total 0.0062/y Total 0.0029/y Total 7.4E-4/y Parameters Fire Indoor oil-filled Fire Large electrical Fire Large electrical Severitv, transformer Severityf fires Severityf fires Manual Manual .Manual suppression Turbine- Energetic arcing suppression All (fire) events cuprvesso generator fires .suppression fal curve curve curve PNS 0.05/exp(0.02 It) PNS 0.05/exp(O.05 It) PNS 0.05/exp(0.069t) CCDP 0.1 CCDP 0.1 CCDP 0.1 Maximum Maximum Maximum P(A) x PNS 0.016 P(A) x PNS 0.034 P(A) x PNS 0.14 (allowed) (allowed) (allowed)Maximum 000627 Maximum Maximum 2.2E-4 Base Case P(A) x PNS (at t = 60 min) P(A) x PNS (at t = 37.5 min) (A)ax PNS(ed (Linear) (calculated) (calculated) (calculated) CDF 3.9E-7/y CDF 3.OE-8/y CDF 1.7E-9/y Sensitivity Maximum 0.0105 MMaximum 9.57E-4 aimmMaximum 0.00322 P(A)7E-PN Cae Ma)xiu 0.010 P(A) x PNS (at=275ri) cluaed sensitiy P)xPNS (at t = 40 mrin) (atP(A) x PNS (at t = 32.5 in)(Quadratic) (calculated) _ (calculated) (calculated) CDF 6.5E-7/y CDF 9.3E-8/y CDF 7. 1 E-9/y Sesiit Maximum 0Maximum 0.00237 Maximum 0.0162 P(A) x PNS (atP(A) x PNS 0.502 CSenstvt P()PS (at t =75min) (acltd caseti (calcuin) (calculated) (at t -22.5 mi) (calculated) (at t = 30 mi)CDF [ l.OE-6/y CDF 2.OE-7/y CDF 1.8E-8/y The fire severity factor = 0.1. 304 Nuclear Facility Risk Analysis 9 0 0 .........

. ..., .......... , ..... ....... -- ---- ---...............

.. ......... ...1 0 0 0 .. ...................... ......... ...........-- -E D G R O O ( O" 7 01 ... ....... .....--------......... ... ....R O O ( O IL-----------.- --....U.P U M P R OO.600 .. ... ... ...-- -- -- -- --...R O 4 0.......... ... .. ... ..................

---

" PUM ROO:-40 0 ..... ...... .. .. .. .---"----------...

.... ... ...300 / --0 10. 20 30 40 50 60 Time (min)FIGURE 1. Linearized CFAST Time-Temperature Curves for Selected NPP Fires (Note: Shrinkage of HERFBS Covering Begins at SURFACE Temp -200 C) file:///CI/Users/utlrichi.ULRLCHWITTE/DOcuiments,/Docments/indiaii/`,2... i2ODiaz%2' 12-9-2003%20Project"/%20On%2OGovernim-ent% 2OOversigit-.txt -.pogo.org POGO Letter to NRC Chairman Niles Diaz 12/9/2003 Project On Government Oversight 0 December 9, 2003 POGO Letter to NRC Chairman Niles Diaz December 9, 2003 Chairman Niles J. Diaz Nuclear Regulatory Commission 11555 Rockville Pike Rockville, MD 20852 Via facsimile: (301) 415-1757*

Dear Chairman Diaz,

As you recall, in September [ wrote to you to respond to your letter to the New York Congressional delegation and local politicians claiming that this summer's force-on-force test at Indian Point had shown a "strong.defensive strategy and capability." The NRC responded to my letter by demanding that POGO not make the letter public, claiming that it contained homeland security sensitive and "safeguarded" material. The NRC threatened us, with civil and criminal sanctions were we to continue to make public either our letter or any of the sensitive material it allegedly contained. The NRC also took the position that it had no obligation to identify the passages in the letter that it claimed were sensitive. As a result, the NRC's initial position was that any effort by POGO to criticize the lack of security at Indian Point threatened the release of safeguards information and thus POGO did so at the risk of criminal prosecution. We believe that the agency took this position to stifle legitimate criticism of the agency by POGO.We did not let the matter end there. POGO retained counsel and threatened

• legal action against the NRC for stifling POGO's speech. Ultimately,the agency backed down andagreed to identify the portions of our September letter that were in the agency's view problematic.

We appreciate the file:///CI/Users/ulrich. U LRICH WITTE/Documents/Docu... 9-.003%_OProject %,2OGovernrnent2,0Oversight.txt (I or 6) [ 12/312007 10:28:49, PM]. tile:///Cl/Users/uIric1i.ULRICHWITTE/DOcumients/DOcuInents/,indian%2...s%2. Diaz%2/`.201 2-9-2003'/2)OProject%20n%2OGoveniinent%`/200versight.txt agency's willingness to engage POGO on this issue and believe that our discussions were helpful to all concerned. What follows is a redraft of.our original letter. We look forward to your prompt response.Our primary concern is that the way the force-on-force (FOF) tests were conducted do not give you the ability to reassure the public that the Indian Point security force has been proven capable to defend that facility against a credible terrorist attack. After a thorough review of the test of security at Indian Point, we continue to have the following concerns: Dumbed-Down Design Basis Threat (DBT) -It has been widely reported in the press I that prior to 9/1l, nuclear power plants were required to have defenses designed to protect against only a ridiculously small attacking force -three terrorists. In contrast, the intelligence community generally believes that terrorists would attack a target with a squad-sized force, which in the Army special forces is 12 and the Navy Seals is 14. In other words, the NRC would need to at least quadruple its old DBT.Having interviewed a number of people who have reviewed the NRC's new DBT, Swe do not believe that it is even close to reaching the 12 to 14 level we believe is appropriate. Representatives of other federal agencies have told POGO that the NRC's new DBT remains inadequate. The NRC argues that the new DBT is the largest threat against which a private security force can be expected to defend. This rationale is backwards and conflates two separate considerations -what is the size of the threat and what should the nuclear power industry be required to do to in the face of such threats. The NRC policy decision to limit the size of the DBT (under terrific pressure from the nuclear industry and its friends in Congress) was based mainly on its assessment of what is reasonable to ask of a private force. But that approach ignores the most fundamental question: what is the credible threat against the facilities? The size of the DBT must be based on that threat. Furthermore, NRC's justification of its too-low DBT rings hollow, as the Department of Energy (DOE) also relies on a private security force, yet at some facilities, DOE claims to protect its :facilities against twice as many terrorists as the NRC does.Under Use of Readily-Available Lethal Weapons -It is well known in* security circles that there are weapons that are available to terrorists that can penetrate bullet-resistant enclosures (BREs), which are quasi-guard towers. BREs are included in the defensive strategy of a file:///Cl/Users/ulrich.ULRICHWITTE/DocumLents/Docu...9z2003%20Pro.ject%200n%2OGovernnent%200versighlt.txt (2 of 6) [12/3/2007 10:28:49 PM] file:///Cj/Users/ulrich.ULRICH WITTE/Docuiments/Docurments/indian%2...s%2ODiaz%20 I 2-9-200"3%20 Project%'?'20 On%20Governrnent%200versight.txt number of nuclear power plants, including Indian Point. Some time ago, the Department of Energy abandoned the use of its state-of-the-art guard* towers (which are far more robust than most BREs) because of their vulnerability to readily-available weapons. Indian Point officers have been aware of the controversies surrounding BREs and have brought their concerns not only to Entergy, but also to the NRC Region I, with no response at all. Several years ago, the DOE developed a classified official Adversary Capabilities List which includes weapons and explosives that are readily available to terrorist groups. The NRC should review this list and ensure its Design Basis Threat includes them. For example, .50 caliber sniper rifles (which have been available since World War I) and Armor-Piercing Incendiary rounds (which are available in gun shops for $1 per round) made the DOE guard towers so vulnerable they were abandoned. Other weapons were also of concern, including the rocket-propelled grenades which have been used frequently by near-children around the world in war-torn countries, with great success against hardened targets.Unrealistic Timing and Location of Attack -It appears the NRC conducted the three FOF tests at Indian Point during the daylight at the beginning of the night shift, and began at least two of the tests in the owner-controlled area. There are several problems with this: The security force being tested had just come on duty and was not yet fatigued by a 12-hour shift, hours typically worked by Indian Point security officers five to six days a week.The security officers knew within the hour that the test was to begin, as the day shift was held over an extra hour to cover as a shadow force so that the night shift could be tested at the beginning of their shift.It is widely believed in the intelligence community that no one will attack during daylight, as it is to the attacker's advantage to have the cover of darkness. Despite this, all three FOF tests occurred between 4-6 pm. Furthermore, in two of the three tests, the mock terrorists were required to cross open fields in broad daylight in order to reach the protected area, making it that much easier for them to be observed by the security officers.* The mock terrorists attacked from only one entry point. In addition, the NRC and Entergy agreed that, if the attackers were successful in reaching the protected area fences, there would be a halt in the action Cile:///Cl/Users/uirich.ULRICHWITTE/Documients/Docti...9-2003%20Project%2o n%2oGovenrinent%200versight.txt (3 of 6) [12/3/2007 10:28:49 PM] fiIe:///CI/Users/ulrich. ULRICHWITTE/DOcumetnts/Dbcumnentesindian%2...s%20DiazVý2-O 2-9-2003%20Project%200n%20Government%200versight.txt and the adversaries would be brought inside of the fences (to prevent any actual damage to the fences during the exercise) -making it perfectly obvious from where the attack will be coming. POGO had previously alerted the NRC to a particular vulnerability involving the fences at most nuclear facilities and was assured that this vulnerability would be taken into account in future FOF tests. However, it was does not appear to have been taken into account during the Indian Point FOF.Amateur Mock Terrorists -A terrorist group has advantages that cannot be replicated in even the best mock attack FOF. However, the following limitations could have been partially ameliorated by the NRC,- but were not: No Surprise. The security force knew for months in advance that this test was going to occur, training specifically for the approved scenarios. They even knew within minutes that the test was to occur, because of all the visiting dignitaries and the fact that they had strapped on Multiple [ntegrated Laser Engagement System (MILES)equipment.

• No Violence of Action. During a mock FOF there is no real danger -no live ammo, no colleagues dying or being maimed or any other adverse impact that would normally create chaos and in some cases cause the protective forces to panic. As a result, security forces develop "MILES bravery." Safety First. The FOF tests are not conducted at high speed because of the overriding safety concerns.

Therefore, people and vehicles are not 9going full tilt the way they would during a real terrorist attack, giving the protective forces time to pause to make decisions -time that they wouldn't have in a real life situation. Safety was also used as the reason for not conducting the tests at night. Sources told us that Entergy was worried participants could trip over rocks or step on snakes.No Trained Adversaries. The mock terrorists were security officers from another nuclear plant who had no training as adversaries. This training* is critically important because it teaches the mock terrorist how to think and act offensively, as a real terrorist would, rather than defensively as a security guard would. Here again, both DOE and the ftle:///C!/Users/tulrich.ULRICHWITTE/Doct -neiits/DOCLI ... 9-_003 00n :0Governinent'/,_0Oversigit~txt (4 of 6) [12/3/200.7 10:28:49 PM] File:///Cl/Users/uLrich.ULRICHWITTE/DOcLrments/Documeints/indian/`2...s'V20Diaz'Y420I2-9-20 03`2Project% 0n%0,2n Govemrnment`200versight txt military use trained adversaries to test their security forces.The Security Forces Are On Their Own -It should be recognized that although the exercise was observed by the State Police and FBI, these law enforcement entities cannot respond to an attack with SWAT capability before it- is too late. Insofar as we know, these response times have not been tested at Indian Point. But tests at other -facilities have shown that.an attack is generally won or lost in between three and eight minutes, while it generally takes an hour or two for SWAT teams to respond.Poor Planning: Lives at Risk -One of the FOF tests was quickly aborted when Coast Guard personnel, who had not been previously informed that the test was to occur, threatened to use their live ammo against the mock attackers. It is unacceptably poor planning to allow this kind of lack of professionalism, putting lives at risk.Recommendations: The NRC should: Not allow so much advanced notice and training for the FOF -two weeks is sufficient; O Make the window of attack much less. obvious, therefore making it unclear to the participants at what time during the shift the test will take place;Administer most of the tests when it is dark;Use trained adversary teams from the military or develop its own trained adversary team;Conduct computer simulations -either Joint Tactical Simulations (JTS)or Joint Conflict .Adversary Tactical Simulations (JCATS) -used by the military and Department of Energy for years. These computer programs simulate the movement of personnel through architecturally-and terrain-accurate models of the facility. This preparation helps the security forces develop the best strategies for defeating any number of gft possible attacks;ile:///Cl/Users/Llricli.U LRIC HWITTE/DOCimenits/DOCLI,... 9-2)003%20Project%20On%20Govenent%20Oversight.txt (5 of 6) [12/3/2007 10:28:49 PM] file:///CI/Users/ul ricl.U LRICH WITTE/DocLuMIents/Doc u mnents/indian%/2... s%20OD Diaz%20I 9-2003 %20 Project%200n%2OGovetnoment% 20Oversight, txt Include the use of simulated rocket-propelled grenades, sniper rifles with .50 caliber armor-piercing incendiary rounds, gas, smoke and other* commonly used weapons and diversionary devices if they are not currently in the DBT; and Address the serious communications breakdowns that occurred during the recent Indian Point FOF.These issues are obviously very serious and need to be addressed promptly.We look forward to your response.Sincerely, Danielle Brian Executive Director cc Roy Zimmerman 1. U.S. News & World Report, September 17 2001; Chicago Tribune, July 12, 2002; The Boston Globe, May 14, 2002; Bulletin of the Atomic Scientists, January 1, 2002; New York Times Magazine, May 26, 2002.Home I Archives [ Expose I Search I Donations I Investigations [ About Us[ Contact Us I Press Room Site Map I Web Overseer l Site Policies© The Project On Government Oversight 2003 fi le:///C1/Users/ulrich. U L RICH W lTTE/Documents/Docu ... 972003%20 Project%200 20Govenent200versight.tXt (6 of 6ý [12/3/2007 10:28:49 PM ] file:///CI/Users/ulrich.U LR ,ICHW TE/DCments/Docinents/indiaii'/.20po... appendix%20r/ na1'20 r%2 submitta /COtmci 'sTerrrism%20copy.txt March 27, 2007 S: NRC Proposed Rule: Power Reactor Security Requirements (R[N 3 150-AG63)Annette Vietti-Cook, Secretary U.S. Nuclear Regulatory Commission Wash.ington, DC 20,555-0001 Attn: Rulemakings and Adjudications Staff Submitted via e-mail to SECY@nrc.gov COUNCIL ON INTELLIGENT ENERGY & CONSERVATION POLICY (CIECP) COMMENTS TO PROPOSED RULE 10. CFR PARTS 50,72 AND 73 REGARDING POWER REACTOR SECURITY REQUIREMENTS AT LICENSED NUCLEAR FACILITIES Nearly six years after September 11, 200 1, the 103 civilian nuclear reactors in the United States are still not in a position to repel attacks by adversaries with capabilities commensurate with those of either the 9/1l terrorists or with enemies of the United States currently operative on the world stage. The present Po.wer Reactor Security Requirements (PRSR) thus fall far short of the actual threat level faced by the U.S. today, much less the escalated level the ion wilt face as nations such as Russia, China and [ran improve and export clear engineering expertise. Indeed, as numerous security experts have pointed out, a terrorist group with access to sympathetic nuclear scientists and engineers would have sufficient sophistication to target the critical systems and weak links of nuclear reactors. The assistance that Pakistani nuclear scientists reportedly offered to Al Qaeda illustrates this threat.Recent National Intelligence Estimates and National Intelligence Council Reports describe the terrorist threat to the U.S. as real and as having no sign of abatement for many years to come. These reports further warn of a new class of da*¢professionalizeddC-terrorists -in part created by the Iraq war- who must be expected to have strong technical. skills and English language proficiency. Such individuals should, in the future, be expected to become major players in international terrorism. Al Qaeda and other terrorist groups have shown extraordinary tactical ingenuity and a complete lack of reverence for human life. Further there is ample evidence that U.S. nuclear power plants, particularly those sited near metropolitan areas, are viewed as attractive terrorist targets. Notably, the 9/l t Commission learned that the original plan for a terrorist spectacular was for a larger strike, using more planes, and including an attack on nuclear power , nts. In an AI-Jazeera broadcast in 2002, one of the planners of 9/t I said t a nuclear plant was the initial target considered. We also know from the 9/l t Commission's investigation that, even after the plot was scaled down, when Mohammed Atta was conducting his surveillance flights he spotted a nuclear power file:///Cl/Users/tulrich.ULRICHIWITTE/Documents/Docunie...inal'/,2Otbor'2,,UOsubmittal/Council'sTerrorisnm.,,,.Ocopy.txt (I of 17) [I 2/3/2007 10:28:52 PM[ file:///C/UUsers/ulricfi.U ..ap13ndix%20i./11na %2 /COnci srerrorisn%2 copy.txt plant (unidentified by name, but obviously the Indian Point nuclear power plant)and came close to redirecting the strike. National Research Council analyses W*d post'-9/l I. intelligence has also indicated that the U.S. nuclear_rastructure is viewed as an alluring target for a future terrorist spectacular. As the Chairman of the National [ntelligence Council stated in 2004, nuclear power plants .*eare high on Al Qaeda's targeting list,d.* adding that the methods. of Al Qaeda and other terrorist group may be a.*oevolving.aE* There is, thus, every reason to believe'that a sizable, well-planned and orchestrated military operation against a U.S. nuclear facility is well within both present and near-future terrorist intent and capability. In view of these realities, the current proposed PRSR is utterly inadequate. Consequently, the COUNCIL ON INTELLIGENT ENERGY & CONSERVATION POLICY (CIECP)urges the NRC to address the following realities in its PRSR: ACTIVE INSIDERS The voluminous, number of security breaches which have occurred at critical infrastructure, includingnuclear weapons and power facilities after 9/l1 (such as the 16 foreign-born construction workers who were able to gain access to the' 2 nuclear weapons plant with falsified documentation) demonstrates that clear HeeinsidersdEo must be deemed potential active participants in an attack.This threat is significantly augmented by nuclear power plant operators' increasing outsourcing. of on-site work in order to cut costs.Contractor oversight failures have been documented by the NRC. For example a December 22, 2003 NRC Special Inspection Report on the Indian Point Nuclear Generating. Station in Buchanan, New York (Indian Point) operated by Entergy Nuclear Northeast (Entergy) notes dE.ethe common theme of a lack of direct contractor oversight and quality control measures, along with the absence of Entergy subject matter experts to independently assess contracted work activitiesa* .d* Critically, the risk of sabotage is elevated at all power plants during, periods of refueling and major construction work when hundreds of outside contract workers have site access.The active participation of insiders, including contract workers, in a terrorist offensive need. not take place during the time of attack. It may occur days or even many months prior to an attackL In addition to actions such as surveillance of plant schematics, security features and protocols, pre-attack participation may involve the sabotage of critical instrumentation, computers, ing, electronic systems or any number of other components, where suchwould likely not be discovered prior to an emergency event.fi I e://CJ/Users/ulIrich. U LR ICH W rrTTE/DoCUnients/Docunme .. .inal%!(2Ofor%/`2OsubnlittaI/Counicil's~rerrorisnl%/`2Ocopy~txt (2 of] 7),[ 12/3/2.00.7 10:28:52 P ri file:l//Cl/Users/uIrich. U LRICEH]WITT E! DocumeiitslEbcumen ts/indian% 20po... 0appendi x"/,, Or/ i na 0 fo r%20Nub m itia I/Co urncil's-errorism%20copy, tx t COMPUTER SYSTEM COMPROMISE O*clear power plant computer systems, like those of other critical infrastructure, are subject to a range of vulnerabilities, including power outages, attacks by malicious hackers, viruses and worms. Compromise of integrity may also occur at the level of software development via backdoors written into. code or the implantation of logic bombs programmed to shut down a safety system at a particular time.Many terrorist networks have the resources and technical savvy to wreak havoc.For example, the alleged terrorist, Muhammad Naeem Noor Khan, picked up in Pakistan in 2004, and believed to have links with Al Qaeda, is a computer.engineer.The fact that U.S. nuclear reactors are not impregnable was demonstrated by the penetration of the Slammer worm into the Davis-Besse nuclear facility. That intrusion disabled a safety monitoring system for nearly 5 hours. In addition, computer hackers have broken into U.S. Department of Energy computers. Some of such intrus.ions were root-level compromises, indicating that hackers had enough access to install viruses.Computers at nuclear power stations are also vulnerable to acts of sabotage W aainst off-site power transmission, as was evidenced at Indian Point during the W 3 blackout which struck the Northeast. At Indian Point, various computer systems had to. be removed from service, including the Critical Function Monitoring, System, the Local Area Network, the Safety Assessment System/Emergency Data Display System, the Digital Radiation Monitoring System and the Safety Assessment System.It is, accordingly, a matter of pressing importance that the NRC engage independent experts to develop a comprehensive computer vulnerability and cyber-attack threat assessment. Such an assessment must evaluate the vulnerability of the full range of nuclear power plant computer systems and the potential consequences, of such vulnerabilities. The PRSR must incorporate such findings, and include a protocol for quickly detecting such an attack and recovering key computer functions, in the event of an attack.CHEMICAL WEAPONS The PRSR must fully address the potential consequences of the use of toxic chemicals as part of an attack scenario. There are numerous agents that can be deployed with atmost instantaneous effect and can immobilize targets via Sralysis, convulsions, blinding, suffocation or death. Such agents could be ployed as part of the initialization strategy. For, example, a truck or even large SUV filled with chlorine, boron trifluoride, hydrofluoric acid, liquid ammonia, or any number of other agents could be crashed into a perimeter ttle:///Cl/Users/ulrich. U R ICH Wr rT E/Documents/Docume ... (3 of 17) [I 2/3/2007 0:28:52 P'J-file:///CI/Users/ulrich. U LRICHwIfE/Documents/Documents/indian'X 20po. 0appendix"/,20r/fina PX.20tor%20submittal!Councilsrerrorisi!4,20copy.txt barrier, with the resulting fumes killing or disabling plant personnel, guarding the outdoor area of the facility.*emical agents could also be introduced surreptitiously into building ventilation systems. They may also be used strategically to neutralize workers endeavoring to maintain control of the situation. Many such agents are easy to make and do not require sophisticated delivery systems. Some can be carried in coffee mugs or in vials within body cavities.Phenarsazine chloride, an arsenic derivative, can be transported in minute quantities, even as a powder that can be dusted on paper. It is lethal if burned and even a spoonful can cause immediate extreme irritation of the eyes and breathing, passages. A chemical like chloroform ascitone methanol can be transported on filter paper, then combined with a heat source to create an explosion. CONVENTIONAL WEAPONRY Intelligence and military analysts-have repeatedly warned that extremists in Iraq, the tribal areas of Pakistan and elsewhere are currently developing a high level of military skill and experience. This reality underscores the need for nuclear plants to be able to defend against attackers utilizing the full range ,potential weaponry that terrorists are known to be capable of using, Uluding heavy caliber automatic weapons; sniper rifles; shoulder-fired rockets; mortars; platter charges; anti-tank weaponry; bunker busters; shaped charges; rocket-propelled grenades; and high-power explosives. Numerous weapons systems posing a threat to even the best trained and equipped civilian guard force, as well as to on-site installations, are readily available and easy to transport. To wit: o Assault rifles'and other rapid-fire battlefield weapons such as AK-47's, Uzi's and TEC-9's are freely available in the U.S. A weapon like the SKS 7.62-millimenter semiautomatic assault rifle can be purchased for under $200.In 2005 the Government Accountability Office reported that 47 individuals on a federal terrorism watch list were actually permitted to legally buy guns in 2004.o A standard M-24 sniper rifle with day and night scope can be carried in a canvas bag and fires 7.62-millimeter ammunition targeting up to 3000 feet o A .50-caliber Barrett rifle, which can be purchased for $1000 on the internet, weighs a mere 30 lbsl and can hit targets up to 6000 feet away with en~or-piercing bullets that can blow a hole through a concrete bunker, bring wn a helicopter or pierce an armored vehicle.o A rocket, propel-led grenade launcher is re-loadable, can fire at the speed fiIe://!CI/Users/ulrich.U LRICH W (4 of 17) [12/3/2007 10:28:52 PM! file:///Cl/Us e rs/ulrich U LRICHW ITTE/Doucum ents/Dc uments/indi n%20 p ... Oap pend ix% 2 Or/ ti naI'% 20 tfor%,20subm itta I/Counc ili'sTerrorism %2Ocopy. txt of 400 feet per second and can blow a vehicle into the air.' A TOW missile is an accessible form of military hardware used in over 40 untries and can be fired from a launcher on a flatbed truck. A 1998 test TOW fired into a nuclear waste transport cask (which is more robust than many on-site nuclear waste storage casks) blew out a hole the size of a grapefruit. The Kornet-E missile, developed by the Soviets and sold to Iraq, can travel over 3 miles and cut through over 3 feet of steel. The world's arms market is awash in thousands of Milan missiles. The 60-70 lb Milan missile system has an effective range of over 5000 feet and can blow a hole through more than 3 feet of armor plate.o The deployment of increasingly powerful and sophisticated explosives, including shaped charges and explosively formed penetrators (or E.F.P.s) by terrorists and insurgents in-Iraq show that the explosives use capabilities of enemies of the United States should not be underestimated. Notably, the 18 men arrested in Australia-in November 2005, and believed to have been planning an attack on an Australian nuclear reactor, had allegedly been stockpiling materials used to make the explosive triacetone triperoxide, or TATP.Terrorists targeting, a U.S. nuclear power plant may very well be able to draw on expertise developed during the Iraq insurgency as well as military experts and rocket scientists from the former Iraq government or from hostile nations such as [ran. In addition, the strategic utility of explosives is magnified when mbers are willing to blow themselves up. Suicide bombers able to gain access the internal areas of a nuclear power plant during the course of an attack could cause untold destruction. o Perhaps the most intractable military hardware threat is posed by shoulder-fired missiles stich as Stingers, SA-7's, SA-14's and SA-I8's. An estimated 500,000 such systems are scattered throughout the world and have been found in the possession of at least 27 terrorist or guerrilla groups. Some can.be bought easily on the black market for as little as several thousand dollars each. Critically, shoulder-fired missiles are easy to operate (Al Qaeda training videos offer instruction) and are designed for portability, typically being 5-6*feet long and weighing 35 lbs. They can be transported by and fired from a van, S.U.V., pickup truck or recreational boat. Even a single terrorist armed with a shoulder-fired missile can cause immediate and substantial damage to a targeted structure.. Traveling at more than 1,500 miles per hour, a typical shoulder-launched missile has a range of over 12,000 feet. If the target remains intact following the initial strike, the terrorist can attach a new missile tube to the grip stock launcher and fire again.WATERBORN ATTACKS*terborne defenses of nuclear plants adjacent to navigable waterways must be.significantly enhanced. Facilities must either be engineered to withstand damage from a waterborne attack or suited with physical. barriers that prevent tfil e:///Cl/Users/ulrich.U L RICH W ITTE/Documents/Docunie...inal%20for%20submnittal/Council's-Ferrorismn%/20copy.txt (5 of 17) [12/3/2007 10:28:52 PM] ti e:!/CI/Users/uirich.U LRICH 0 aWppendix%20r/1ina %20 r%20submitta /Counci srerrorisM2)copy.t. entry to the plant and/or critical cooling: intake equipment. ontinual cooling, is an essential component of nuclear plant safety. A meltdown n be triggered even at a scrammed reactor if cooling is obstructed. Water intake is also essential to the proper function of spent fuel pools. Yet at certain nuclear plants, cooling systems may be highly vulnerable. At both Indian Point and Millstone Power Station, in particular, water intake pipes have been identified by engineering experts as exposed and susceptible to waterborne sabotage.One or more boats laden with high energy explosives could severely compromise cooling water intakes easily and quickly. Indian Point, for instance, is located on the banks of the Hudson River in an area heavily trafficked by commercial and recreational vessels. The 900 foot f~ceExclusion ZonedE- -marked only by buoys- could be traversed by speed boats in 30 -40 seconds, well before any Coast Guard or other patrol boat could react. Patrol boats could also be readily taken out by suicide bomber boats crashing into them (in the manner a small explosives laden boat targeted the destroyer the USS Cole in 2000) or by weaponry like shoulder-fired missiles or rocket propelled grenades.AERIAL ASSAULT d cording to a terrorist coethreat matrixdE, issued by the National Research Council d the National Academies of Sciences and Engineering following the September 2001 attack, dfzeNuclear power plants may present a tempting high-visibility target for terrorist attack, and the potential for a September 11 -type surprise attack in the near term using U.S. assets such as airplanes appears to be high.d.In March 2005, a joint FBI and Department of Homeland Security assessment stated that commercial airlines are dacelikely to remain a target and a platform for terroristsdE* and that dEcethe largely unregulateda*, area of general aviation (which includes corporate jets, private airplanes, cargo planes, and chartered flights)remains especially vulnerable. The assessment further noted that Al Qaeda has aEceconsidered the use of helicopters as an alternative to recruiting operatives for fixed-wing, operations,dE, adding that the maneuverability and d.cenon-threatening appearancedEo of helicopters, even when flying at low altitudes, makes them dCceattractive targets for use during suicide attacks or as a medium for the spraying of toxins on targets below.dE-The vulnerability of nuclear power plants to malevolent airborne attack is detailed extensively in the Petition filed by the National Whistleblower Center and Randy Robarge in 2002 pursuant to 10 CFR Sec. 2.206. A number of studies of the issue are also reviewed in Appendix A to these Comments. The particular S 'nerability of nuclear spent fuel pools to this kind of attack is detailed in KJanuary 2003 report of Dr. Gordon Thompson, director of the Institute for Resource and Security Studies entitled dfteRobust Storage of Spent Nuclear Fuel: A Neglected Issue of Homeland SecuritydE, and in the findings of a file:///Cl/Users/ulrich.ULRICH WI-TTE/Documnents/Docune"..inal'!,,201br %,,20subrittal/Councii'sTerrorisln 2,_0copy.txt (6 of 17) [12/3/2007 10:28:52 PM] file:///CI/U,;;ers/ulrich.ULRIC HWITT-E/Docunients/Docunients/indian"., Opo... 0appeLn diRxC M0r/fi na al20 f r%2 2subm it ta I/CHou nWc il's-erroris %W20copy. t t multi-institution team study led by Frank N. Von Hippel, a physicist and co-director of the Program on Science and Global Security at Princeton rniversity and publ-ished in the spring 2003 edition of the Princeton journal Vience and Global Security under the title dEeReducing the Hazards from Stored Spent Power-Reactor Fuel in the United States.dE* It is worthy of note that, even post-9/l 1, general aviation aircraft have circled or flown closely over commercial nuclear facilities without military interception. The NRC's sole present strategy for averting a kamikaze attack upon a nuclear power plant is reliance upon aviation security upgrades implemented by the Transportation Security Administration and the Federal Aviation Administration and faith that U.S. intelligence will provide ample warning.it is this kind of governmental agency pass-the-buck mindset that brought the nation Katrina.The NRC's conjecture also betrays a reality disconnect reminiscent of the federal response to Katrina. Since 2001 there have been numerous breaches of airport security throughout the nation. Notably, in late 2005, there were three serious security breaches at Newark International Airport, one of the points of departure used by the September 1 I hijackers. The most serious occurred on November 12, 2005, when a man driving a large S.U.V. barreled through the armed security checkpoint and drove in a secured area for 45 minutes before being tind by NY/NJ Port Authority officers. Just this year, gaping holes in airport urity were exposed when workers with access to secure areas were able to carry firearms in their carry-on bags onto a commercial jet departing from Florida.The PRSR must furthermore be upgraded to include high-speed attack by a jumbo jet of the maximum size anticipated to be in commercial use (such as the expanded version of the Boeing 747 and the Airbus A380) as well as unexpected attack by general aviation aircraft and helicopters. The PRSR must contemplate all such aircraft to be fully loaded, fueled and armed with explosives. It is essential that the PRSR address not only the direct effect of impact, but the full potential aftereffects of (A) induced vibrations; (B) dislodged debris falling onto sensitive equipment; (C) a fuel fire; and (D) the combustion of aerosolized fuel (especially in combination with pre-existing on-site gases such as hydrogen). The PRSR must further take into consideration the cascading consequences of aerial assault on the full spectrum of plant installations. [narguably, there is a wide range of on-site structures, not within hardened containment, that are critical to the safe operation of a nuclear plant. Spent fuel pools are of StiCular concern because the disposition of water could uncover the fuel. If nt workers are unable to effectuate replacement of the water (either because of fire or because they are otherwise incapacitated), experts warn, an exothermic reaction could cause the zirconium clad spent fuel rods to ignite a filc:///CI/Users/ulrich.U LRICH W [TTE/Documnents/Docunie...inal 0/_20obr%`,0Osubmittal/CounciI'sierrorismA2O/,,0copy.txt (7 of 17) [I 2/3/2007 10:28:52-1 PM] file://CjtUserss/ulrich. ULRICH W TTE/Documnts/Document/indian%20po..appendix!2Or/ina1'21 r%2 submitta/COUnci sTerrorism'2 copv.txt nuclear waste conflagration that would very likely spew the entire radioactive contents of the spent fuel pool into, the atmosphere.

• ithout question, hardening a nuclear power plant against aerial threat will necessitate significant upgrades in plant fortification.

However even relatively modest measures such as the installation of Beamhenge and the placement of all sufficiently cooled spent fuel into Hardened On-Site Storage Systems (known as H.O.S.S.) would add measurable protection. STRATEGIC USES OF RIGS, TRUCKS AND S.U.V.'S In June 199 1, the NRC denied the truck bomb petition of the Committee to Bridge the Gap and the Nuclear Information Resource Service, on the grounds that it was not realistic to believe a truck bomb would be employed in the U.S. Two years later, on February 26, 1993, terrorists drove a rented van packed with explosives into the underground garage of the World Trade Center, -lighted a fuse and fled. Just a couple of weeks before that, a mentally unstable individual crashed his station wagon through the gates of the protected area of the Three, Mile Island nuclear power station and evaded security for several hours before finally wrecking his vehicle by crashing into the turbine building. Thereafter, the NRC reconsidered its earlier assessment and has, on a number of occasions, upgraded reactor security standard to include some protections against land*hicles. Such upgrades, however, are insufficient in a post-9/l I world.Large Sport Utility Vehicles and pickup trucks on the road today can weigh over 8 tons, loaded, and -as do commercial vans- have considerably carrying capacity.Such vehicles could be used strategically in a number of ways.The first is as a mobile short range projectile bomb. A large, heavy vehicle packed with high explosives, even if not successful in penetrating concrete barriers, could result in the death or incapacitation of large numbers of plant workers, including, security, personnel. Such casualties would be particularly likely to materialize if the vehicle bomb followed a previous diversionary event intended to draw security personnel to the plant perimeter. The second is as a transport vehicle for one team of attackers who are themselves armed or who wear explosive belts and could then themselves penetrate other areas of the facility. A terrorist wearing anexplosive body belt can, in effect, be a -precision guided weapon.The third and fourth scenarios are variations of the first two, with chemical agents substituted for or combined with explosives. (Indeed, insurgents in Iraq are increasingly combining explosives with chlorine gas and other chemical Wyloads in truck bomb detonations.) One or two such vehicles packed with the ht toxins, could be expected to kill or disable a substantial number of workers, again, especially if the release followed a prior event which drew security personnel to the area, or simply to areas outside facility enclosures. i le:/CI/Users/u lrich. ULRICHW ITTE/Documnents/Docume...inaI'O(,0for'/`2subniual/CouncirIsThrrorisni%.20copy.txt (8 of 17) [I /3/2007 010:2: PfJ file:///CI/Users/ulrich.U LRICH W rE/Documents/Docunents/indian/2-po... appendix%20r/ na1%20'2 Ubm itta /Counci sfefrorism%20copv.txt Certain toxins can be lethal to anyone within miles. Usingsuch agents, attackers wearing protective.gear could then gain access to other areas of the~cility.A fifth tactical use of vehicles would not even occur on site. Vehicles carrying explosives and/or chemical agents could be set off at critical regional transportation arteries such as major bridges, tunnels and highways. Notably, such incidents could be staged in a way that would not even alert authorities to the onset of terrorist activity. In the New York metropolitan region in which Indian Point is sited, for example,, a series of major accidents occurring at or about the same time would not be an unusual occurrence. In fact, on July 25, 2003, the very day the Federal Emergency Management Agency declared that the Indian Point emergency plan provided dceadequatedE* assurance of protection to the public, the entire New York metropolitan region was brought to a virtual traffic standstill after a tractor-trailer hit a beam on the George Washington Bridge and burst into flames, several minor accidents and a car fire took place on Interstate 95, and a truck got jammed under an overpass of the Hutchinson River Parkway. In 2006, a tanker truck carrying 8000 gallons of gasoline overturned on one of New York City's busiest highways, igniting a blaze that burned for hours and weakening, the steel beams of an above bridge. Earlier this month a liquid propane explosion closed a 23 mile stretch of the New York State Thruway for hours, while firefighters had to stand by and watch the fire bum out because it was too hot to approach.Se staging of a couple of incidents like those just noted, combined with an d&zeaccidentdC* involving a tanker carrying hazardous gasses or liquids like liquefied ammonia, propane, chlorine, or vinyl chloride, prior to an assault would almost assuredly forestall the provision of outside assistance to a nuclear facility Under attack.PLANTS MUST BE ABLE TO MOUNT A FULL DEFENSE WITHOUT RELIANCE ON OUTSIDE ASSISTANCE Whether or not an attack employs strategies designed to obstruct regional transportation routes, numerous studies and the actual events of 9/1 t, Katrina, and Rita (as well as relatively minor events such as the January 18, 2006 wind storm in NY) demonstrate beyond cavil that first responder forces and the National Guard do not have the resources, manpower, equipment or communications capabilities, to swiftly and adequately respond to a major assault on a nuclear facility. Just this very month, a report of the Commission on the National Guard and Reserves detailed the ongoing problem of inadequate human, equipment, communications and financial resources plaguing the National Guard. This report calls into question the ability of the government to bring all necessary assets bear in the immediate aftermath of a major domestic incident.In some regions -most notably the New York Metropolitan region, in which Indian Point is sited -roadway logistics and regular congestion alone would likely fi e:///CI/Users/ulrich. U LR C0-1 wITTE/Documents/DOcume... inaI%20for%20,submittail/COunciI'sTerrorism%20co py.txt (9 of 17) [12/3/2007 16:28:52 P" file:.///CI!Users/ulricIh.ULRICHWI-r E/Documents/Dochuni etnts/indian ) 20p ...ap ple'r ridrnat% 2 0 'Ofor% 2 0 subin ittalI/Counc lTerrorisin`X2 0copv.t xt prevent assisting forces from reaching a nuclear plant under attack in time. It bears mention that SWAT team assembly takes approximately 2 hours, whereas an sault could be over in a matter of minutes.It is accordingly crucial that the NRC cedes the faulty assumption that plant personnel need only fend off attackers until law enforcement or military aid arrives. The fact that most regional first responders have little detailed knowledge of either the operational or internal layout of nuclear facilities further testifies to the folly of reliance upon the Ho=ecavalrydc*. ELEVATED VULNERABILITY TO INFILTRATION DURING EVENT During a crisis event at a nuclear plant there also exists an elevated threat of infiltration -by terrorists posing as first responders or National Guard. And in fact the imposter tactic has been used by terrorists in recent years with substantial success.Terrorists disgufised as firefighters could take particularly strong advantage of this stratagem. Outside firefighters often respond to fires at nuclear power plants, and many attack scenarios would be expected to involve fire.Firefighters would presumptively be seen as benign by plant personnel and would have a legitimate reason to move throughout-a facility and d*echecka*. components eich as electrical wiring. Moreover, bulky firefighter uniforms and equipment n hold and hide a host of articles that could be used for destructive purposes.DEFENSE AGAINST A SIZABLE MULTI-TEAM, MULTI-DIRECTIONAL FORCE In January 199 1, the Nuclear Information Resource Service and the Committee to Bridge the Gap filed a joint Petition with the NRC requesting, inter alia, that the DBT be upgraded to 20 external attackers. The NRC rejected the petition in June 199 1, asserting that an attack involving more than 3 assailants was unrealistic. September 1 1 was a demonstration of the profound limitations of governmental foresight. The September 1I plot involved 20 attackers (although only 19 were ultimately able to-participate). The tragic 2004 siege at a school in Belsan, Russia involved more than 30 armed terrorists. It should be beyond questionat this point that a terrorist attack could involve scores of attackers. cordingly, the PRSR must assume at least two dozen attackers. Lessons learned 6m 9/l and the many multiple coordinated terrorist actions. that have transpired in Europe, Asia and the Middle East since then, also mandate the premise that attackers will act in several teams and that some of those teams rile:f.,./ C/Users/ulrich. ULRICHW ITTE/Docurnents/Documn...nal%2/O,, br /,20subrnittal/Council'sTerrorism %,,20copy.txt (.10 of 17) [ 1_/3/007 10:_8:5 PMJ file:H//Cl/Users/uLlrich.ULRICHWITE/DoC unieiits/DoC u iients/in dian% 21)po... 0a ppe ndiRxC2 Or/Hfi nHa IW20 for",2 0sub m ittaW/Coun il's'errorism% 20copy. tx t may be sizable.y carefully planned attack on a nuclear facility by knowledgeable individuals, uld also involve several different modus operandi. The PRSR should therefore take into account the consequences of near-simultaneous damage to different plant installations, systems and personnel (e.g., the effect of a small explosive-laden plane diving into the roof of a spent fuel pool coupled with the waterborne sabotage of the spent fuel pool intake system).A COORDINATED ATTACK ON MULTIPLE ON AND OFF-SITE TARGETS A related point is that, following 9/1l, the NRC can no longer ignore the very real possibility that an attack on a nuclear power plant would occur commensurate with an attack on other regional infrastructure such as chemical, plants and bridges. A coordinated attack designed to effectively eradicate a region would very likely preliminarily target communication, electrical power and/or transportation infrastructures. This would ensure that (A) the targeted region is reduced to mass confusion, (B) local and federal officials and responders would be overwhelmed, and (C) law enforcement and other first responders would be impeded from gaining access to the nuclear plant site.Certain areas of the U.S. offer a plethora of target opportunities and thus are 0rticularly vulnerable to multiple target scenarios. Prime among.them is the ater New York Metropolitan area (already in the terrorists' crosshairs) which contains numerous national landmarks, corporate headquarters, reservoirs, bridges, airports, transportation arteries and hazardous chemical plants, all in near vicinity to Indian Point, a mere 24 miles north of New York City.A CREDIBLE NUCLEARTPLANT SECURITY FORCE TESTING PROGRAM The deficiencies, failures, and chicanery that have long plagued the various manifestations of nuclear power industry security drills and force-on-force (FOF) testing have been exhaustively documented in recent years. Noteworthy investigations in this regard have been conducted by the Project on Government Oversight (augmented by testimony provided in 2002 Senate Environment and Public Works Committee hearings) and the United States General Accounting Office (which reported its findings in a September 2003 report entitled a&ceOversight of Security at Commercial Nuclear Power Plants Needs to Be Strengthenede*.) as well as by the press. Problems with the FOF program are also addressed in the July 2004 Petition for Rulemaking to amend 10 CFR Part 73 to upgrade the DBT filed by the Committee to Bridge the Gap and the Comments on the DBT filed in 2006 by the Union of Concerned Scientists. CIECP fully endorses the recommendations made infilings by the Committee to Bridge the Gap and the Union of Concerned W1ientists. CIECP urges the NRC in the strongest possible terms to upgrade drills and file:///Cl/Users/ulrich. ULRICH 020for%/,,20submittal/Council'sTerrorism% U,_0copv.txt (I I of 17) [ 12/3/2007 10:28:52 PM:J file:///Cl/U ers/ulri ch.U LRICH WITTE/Doc unVentS/DOCLu mlents/indiai/%.20p ... 0ap pendix% 20 11 n M420 Cor%,20sub I ittal/Co un il's" e rroris m % 20co py. tx t testing protocols to remedy the flaws that are a matter of public record and to take into account the realities noted herein. FOF .tests must be sufficiently allenging to provide high confidence in the defensive capabilities of the 1urity forces at the nation's 103 nuclear power plants. One clear failing of the FOF program todate has been the giving of excessive warning regarding upcoming tests. While some notice is necessary, one week should suffice. In addition, staff assignments should be frozen on the day of notice. This would eliminate the all too common practice of substituting a plant's most fit and accomplished security personnel in place of underachievers. It is also critical that drills and the FOF program be revamped to eliminate manifest conflicts of interest. Examples of-blatant conflicts of interest include: (I) The NRC allowing the nuclear industry's lobbying arm, the Nuclear Energy Institute (NEI) to award a FOF contract; and (2) The NEI, with NRC approval, then selecting Wackenhut, a corporation which contracts security guards to nuclear power plants in the U.S., to also be the contractor that supplies the mock adversary teams for the FOF tests.Such problems have reduced the value of testing to the point where the FOF program lacks public confidence. The program must be redesigned and monitored by an independent entity such as the very capable U.S. military.' TARGET APPEAL REACTORS Prior terrorist attacks and plots against the U.S. have focused on major cities.It is a matter of fundamental logic that plants sited in highly populated metropolitan areas, particularly those with high symbolic value, face the greatest risk of being selected as a target.It is thus imperative that the PRSR be modified to mandate a customized approach to high target nuclear facilities. SITE-SPECIFIC SAFETY-RELATED VULNERABILITIES It is highly unrealistic to exclude from the PRSR calculus the reality of aging structures, deteriorated conditions and compromised systems that exist at various nuclear power plants in the U.S. A facility-customized approach must be taken which adds problems which are known or reasonably suspected and which could have a significant effect upon the ability of plant operators to maintain control during'a major incident into the security equation.Prime among factors which may be site-specific are: Corrosion and Embrittlement: For example, a risk of corrosion of-the steel liner of the reactor containment at the Oyster Creek Nuclear Generating Station (Oyster Creek) was recently identified. A qualified corrosion expert tite:///Cl/Users/ulrich.ULRICH W[TTE/Documents/DoctLIm...nal%2Ofor%20subnmittal/Councit's'rerrorism%20copy.txt (12 of 17) [12/3/2007 10:28:52 PMI tile:///CV/Users/ulrich. U LR[CH WITTE/ DOL111C1etsDCmen ts/indian%2p...appendixI20r na1%20 r%20submittal/Counci sTerrorism%2fcopv.txt has warned that the risk may be high enough to cause buckling and collapse.Manifestly, corrosion or embrittlement-weakened structures and components are.ore vulnerable to the effects of heat and combustion. o Vulnerability to Fire: Fire detection and suppression equipment and fire barriers are crucial to. reactor safety. Over 20 years ago a worker at the Brown's Ferry Unit I reactor accidentally started a fire which destroyed emergency cooling systems and severely compromised the plant's ability to monitor its condition. In response, the NRC increased fire safety standards. In recent years, the NRC has effectively relaxed those standards. This is exceedingly unwise. During the chaos and threat level that would surely exist during, a terrorist attack, human beings cannot be presumed to be able to take the actions necessary to protect critical systems from fire. The systems themselves must have integral safeguards. Yet plants such as Arkansas Nuclear One, Catawba, Ginna, H.B. Robinson, Indian Point, James A. Fitzpatrick, McGuire, Shearon Harris, Vermont Yankee and Waterford have been identified as having fire barrier wrap systems that failed fire tests. Fireproofing problems such as these jeopardize safe shutdown and must be recognized as a degradation of defense-in-depth protection. In addition, any plant fire hazard analyses must assume damage to multiple rooms and multiple structures, a circumstance that could easily result from an aircraft impact.o Integrity of Structures that Support Mobility: While the focus of NRC* -ulatory review is on structures and equipment directly related to safe Werational function, the conditions that may prevail during an assault would likely require plant personnel to be able to move rapidly throughout the facility. The evaluation of the reliability of structural features such as stairways (which might buckle or melt during a fire) is accordingly critical.o Electrical System Problems: In 2003, a cable failure knocked out power to approximately half the safety systems at Oyster Creek, including security cameras, alarms, sensors, pumps and valves. In February 2003, all 4 of the backup generators at Fermi became simultaneously inoperable. In December 2001, Indian Point reactor 2 lost power due to a malfunction of the turbine, then lost back-up power to the reactor coolant system because of a second electrical failure. During the August 2003 blackout that struck the Northeast, following the loss of off-site power, two of Indian Point's emergency backup generators (both of which had been previously flagged as having problems) failed to operate. In view of the severe consequences failures such as these could have were they to occur during a major incident, known plant electrical system vulnerabilities must be taken into consideration. o Cooling System Problems: Cooling system problems and design deficiencies have plagued a number of plants in recent years. In some cases the NRC has owed plants to operate for long periods with compromised emergency cooling stems. For example, the Salem nuclear power station had experienced two years of repeated malfunctions of its high-pressure coolant-injection system prior to the time, in October 2003, when operators unsuccessfully tried to use it to fiie:lllCI/Userslulrich. ULRICH W ITTE/Docunients/Docum...nal %, 1Ofor%",.0subnittal/Council'sTerrorismi%2,ocopv.txt (13 of 17) [ 12/3/2007 10:28:52 PM] fici//ICI/Users/ukrich.U LRIC- W ITTEIDocurments/Documei.s/indian%203po...appendi x"/,20r/fina VV%20 (60Y%20submhitta/Counci VsTerrorisrm%20copy .txt stabilize water levels following a steam pipe burst. And the NRC has allowed reactors with emergency sump pumps flagged as likely to become clogged and inoperative to remain in operation for many years without repair. The Los.*lamos National Laboratory, for instance, concluded that the sump pumps at Indian Point reactors 2 and 3 could become clogged in as little as 23 minutes and 14 minutes, respectively. While, upgrades are being made, the failure of the NRC to mandate immediate correction of cooling system vulnerabilities calls.its oversight capabilities seriously into question. Indeed the functional declination of critical systems must be deemed a constituent element of site-specific PRSR analyses.ELIMINATE COMMERCIAL CONSIDERATIONS FROM THE PRSR CALCULUS The commercial interests of the nuclear industry are of valid concern to nuclear ,utilities and the NE[; they should not be of concern to the NRC. There is no justification for jeopardizing, national security and the health and safety of the public -even to the smallest degree -to safeguard corporate profits.The NRC has stated that its promulgated security standards are based upon the analysis of the largest threat against which a diceprivate security force could reasonably be expected to defendd.*o [emphasis added] 70 FR 67385.o th the NRC and the industry have acknowledged that, in their estimation, a Wivate guard force should not be reasonably expected to defend against a 9/1 l-type attack involving aircraft. Such an attack, apparently, is deemed to fall tinder the loophole of 10 CFR Sec. 50.13, which exempts reactor operators from defendingagainst Kwan enemy of the United States, a foreign government or other persond*.. The perimeter of this d*ceenemy of the United States provision has never been defined, so there is no way to know how far it extends. However, it is abundantly clear from the public record that the NRC has drawn the line at point where the profit margins of nuclear power operators mightbe significantly affected. Unfortunately, the terrorists are constrained by no such boundary.Congress has charged the NRC with the obligation to protect the public health and safety. This must not be viewed simply as a guideline; it must be viewed as an uncompromised mandate.If the NRC does not believe its licensees can afford the security upgrades necessary to protect the nation's nuclear reactors against the full potential threat, it must act with forthrightness and publicly demand that the Department of Homeland Security or the U.S. military assume responsibility for domestic nuclear power plant security.WNCLUSION The 9/I l Commission observed: dF*ceAcross the government, there were failures of file:///Cl/Users/tiurich.U LRICH 1'TTE/Docurneiits/Docunm...naI%2'tor%20submittal/Council'sr]errorisn1%20(ýopy.txt (14 of 17) [12/3/2007 10:28:52 PM] file:///CI/Users/ulrich.ULRICHwITr E/Docuiiients/Doctinients/inclia l % 20p ... 0awppen ix% 20 ri na 20 for% 20sit b i tta I/Cou nc il'serroris m %20copy. tx t imagination, policy, capabilitiesf*The most important failure was one of imagination. We do not believe leaders understood the gravity of the threat.dE* a public interest group we ask: What needs to happen before the gravity of the threat is not only understood, but acted upon?Respectfully submitted, COUNCIL ON INTELLIGENT ENERGY& CONSERVATION POLICY (New York)By Michel C. Lee, Esq.Chairman (914) 393-2930 OPENDIX A Since September [1, 2001, there has been much speculation about the vulnerability of nuclear power plants to aerial attack. Certainty, however, is in short supply.What is known is that none of the nuclear reactors presently operational in the United States were built to withstand the crash of a jumbo jet, much less the crash of superjumbo such as the A380 which will take to the air weighing 1.2 million pounds, has a wingspan almost as long as a football field, is 8 stories tall, and is3 times as large as the 767s that brought down the Twin Towers.Nevertheless studies that have addressed the prospect of planes hitting nuclear plants include the following: 1974: To date the only published peer reviewed study on the vulnerability of U.S. nuclear power plants was conducted by General Electric, the leading builder of nuclear plants, and published in the industry journal Nuclear Safety. GE looked at accidents -not terror attacks -and concluded that were a diCoeheavydEo airliner to hit a reactor building in the right place, it would almost certainly it apart. Such a hit would also most likely damage the reactor core and*h the cooling and emergency cooling systems. [NOTE: The GE study defined a dEceheavydE* plane as one weighing more than 6 tons. The Boeing 757 which gouged a tOO foot gash through the reinforced concrete of the Pentagon weighed between 80 tiIe:///CI/Users/ulrich.U LRICH WI-FE/DOCunents/DOCun...nal%20for%20submittaI/Council'slerrorisl%20copy.txt (15 o 1 17) [ 2/3/2007 10:28:52 PM] fi e:///CI/Users/ulrich. U L RIClH W ITT E1Docimse n ts/DorCrye n ts/i n dxiatn %20p ... Oappendix% 20r/fi 1%20 for% 20subm ittaI/Counc i'sTerrorisrn% 20copy. txt and OO tons. A fully loaded 767 weighs over 200 tons. The Airbus 380, expected to be launched into commercial use later this year, takes to the air weighing, 1.2 million pounds, hundreds of thousands of pounds heavier than the W eing 747, the currentjumbo of the sky.]1982: A technical report (previously publicly available) of a study conducted by the U.S. Army Corps of Engineers at the NRC's behest focused on plane crash analyses at the Argonne National Laboratory. The Corps concluded that planes traveling, at a speed of over 466 mph would crash through the average reactor containment structure noting d.ceaccount has been taken of the internal concrete wall which acts as a missile barrier*[t would appear, however, that this is too optimistic since vaporized.fuiel, hot gaseous reaction products, and to a certain extent portions, of liquid fuel streams will flow around such obstructions and overwhelm internal defensesdfiE.dE [NOTE: An FBI analysis estimated that American Airlines Flight 11, which hit the north tower of the World Trade Center, was traveling, at a speed of 494 mph, and that United Airlines Flight 175, which hit the south tower, was traveling at 586 mph, a speed far exceeding its design limit for the altitude.] 2000: A NRC study published less than a year before September I I calculated that I out 2 commercial airplanes flying in the year 2000 were large enough to penetrate even a 5, foot thick reinforced concrete wall 45% of the time.Specifically, the study states, diocaircraft damage can affect the structural

• tegrity of the spent fuel pool or the availability of nearby support systems, h as power supplies, heat exchangers, or water makeup sources and may also affect recovery actions,*[t is estimated that half the commercial aircraft now flying, are large enough to penetrate the 5 foot thick reinforced concrete walls.d,-

[NOTE: The thickness of the top of certain reactor domes is 3 and-a-half feet.].2002: The German Reactor Safety Organization (GRS) a scientific-technical research group that works primarily for nuclear regulators in Germany conducted an extremely detailed study that determined that terrorists can, with a strategically targeted airplane crash, initiate a nuclear accident. (A secret Ministry document that summarized the report was leaked to the German and Austrian press and subsequently translated into English.) The GRS study used dynamic computation modeling that looked at the potential consequences of a wide range of impact possibilities on different plant equipment and installations. Different types of airplanes, velocities, angles of impact, weight loads and fuel effects were considered, as were various sequences of events. Aside from the basic finding of vulnerability, the GRS study is significant for recognizing the limitations of even its highly complex analyses. Key unknowns include the impacts of fire loads on many kind of materials and equipment as well as the behaviors of various combustive materials under the conditions of a plane crash.2004: In 2004 the U.K. Parliamentary Office of Science and Technology (OST)issued a secret report on the risks of terrorist attacks on nuclear facilities tile:///Cl/Users/ulrich.ULRICEIiW l'TrE/Docunients/Docuni...nal%'2_0tfor',0Osubmittal/Council'sTerrorisn3/4l2,'(Ocopy.txt (16 of] 7) [ 12/3/2007 10:28:52 PMI file:///CI/U sers/ulrich. U LR IC H1 W ITT E1Doctt lle ntslDocuments/in dia n"/`,20po... 0appendix% 2Or/fi na I!,,20for% 2 0subni ittaI Counc i'sTerrorisnmY2tcopvy. txt to the U.K. House of Commons Defense Committee. The OST report was leaked.to the magazine New Scientist, which reported the OST conclusion that a large plane tlash into a nuclear reactor could release as much radiation as the 1986 accident WChernobyl, while a crash into the nuclear waste tanks at the U.K.'s Sellatield facility could cause several million fatalities. From these studies it is clear that there exists a reasonable basis forconcern regarding malevolent deployment of aircraft against nuclear power facilities. It should also be evident that all studies on this topic are, in substance, educated conjecture. The current state of computer modeling isnot up to analyzing, the full' range of physical and chemical interactions that could occur under the incalculable range of different kinds of aircraft, approaching at different angles, at different speeds, hitting different structures, which all have facility-unique room and equipment layouts, and different substance, chemical, and ventilation-related conditions. A lesson in the unpredictable consequences of airplane crashes was brought home on September I I (when even the 47 story tall 7 World Trade Center that was not struck collapsed for reasons engineers have yet to fully determine). A lesson in the limitations of advanced computer modeling can also be learned from the Columbia space shuttle disaster.ObBT and PRSR]See what's new at http://www.aol.com rile:///CI/UserS/Lilrich.U LRICHlwi-rTE/DOCurnients/-Docum ... nal%20'-'ror%/,20submiittal/COunICil'STerrorism%"/20copy.txt (1 7 or 17) [12/3/2007 1 0:28:52 PMJ nasa Nuclear Power Plants: Vulnerability to Terrorist AttackThis is the'httlI version ofthte file Ihttp://vietita.usetnbassy.gov/en/dowvnload/pd f/nttcl platnts attacks. pdfl G o o g I e automatically generates httnl versions ofdocutttents as sve crawl the wveb.To link to or hooktnark this page. tse the following url: ltttp:/ .ole.cnsearh?q=cache:Qants attacks.pdf+v+Car+erens+and+Mark+Ho Ncear+ cr+Plant:+Vnrailitv+to+Terrorist+Attack&hl=en&ct=clnk&cd=I&gl=us ioongle is neither affiliated with the authors of this page nor responsible for its content.These search teons have been highligtted: carl behrens mark holt nticlear power plants vtlnerability terrorist attack Page I Congressional Research Service tr. The Library ofCongressCRS Report for CongressReceived thtrotgl tte CRS WebOrder Code RS21131 Updated Atgust 9.20 0 5Nttclear Power Plants: Vulncrabilitv to Terrorist AttackCarl elhrens and Mark IloitSpecialists in Energy PolicyResotrces. Science. and Industry ivisionSttmnaryProtection of nuclear power plants frotn land-based assauhts.deliberate aircraftcrashes. and other terrorist acts has been a teighltened national prioritysince the attacksof September I1. 2001. The Nuclear Regulatory Commission (NRC) has strengthenedits regulations on nuclear reactor security.bttcritics contend that implementation bytheindtnstry has been too slow and titat fitlther measures are needed. Several provisions toincrease nuclear reactor security are included in the Energy Policy Act of 20fl5. signedAugust

8. 2005.The new law requires NRC to conduct *(Eeforce on forcei*, secttrityexercises at tntclear power plants at least once every three years and to revise theFsredesian-basis thtreatS, that ttclear plant secutrity forces nttst be able to inect. amongother measures.

This report will be updated as events warrant.Nuclear power plants have long been recognized as potential targets of terroristattacks. and critics havelongquestioned tlteadequacyoftlthemeasuresreqtnired of ntclearplant 6oerators to defend against such attacks. Followingthe September II. 20fl01.attacksot the Pentagon and the World Trade Center. the Nttclear RegtlatoryCommission (NRC)began a AEretop-to-bottotmod. review of its security reqtirements. On Febrtary 25. 2002, theagency issued ircminterim compensatory secttrity measttresdE, to deal with the ACregeneralizedhigh-level thtreat environmenttdE that continted to exist: and ott January 7. 2003. it issuedregtslator orders that tightened nuclear plant access. On April 29. 2003. NRC issuedthree orders to restrict securitv officer work hours. establishi new secturity force trainingand qtalification requirements. and increase the iiccdesign basis threatfE, thamnaclear secturityforces must be able to defeat.Security RegulationsUnder tile regulations ill place prior to the September I I attacks, all commercialtttclear power plants licensed by NRC must be protected by a series of physical ba1tiersand a trained secitrity force. The plant sites are divided into three zones: an 5Flrowner-controlled5*. buffer region. a 5*emprotected area.dE. and a A*revital area.5E. Access to the protectedarea is restricted to a portion of plant employees and monitored visitors. with stringent Page 2 CRS-21 General NRC requirements for nuclear power plant security can be found at If) CFR 73.55.2fovernment AccountabilityOffice. NstclearRegutlatotyConitnsssion: Prelintinttr Observationson Efforts to Inprove Security at Nuclear Poster Plants.Statement of.lit eWells. Director.Natural Resources and E-nvironment. Government Accountability Office. to the Sutbcommittecon National Security. Emerging Ttreats. and Intteosatiotal Relations. Illouse Comnmittee ontoverinment Reform.Sejitember

14. 2004. pt. I4.access barriers.

The vital area is fAtther restricted. with additional barriers and accessreqtirenments. The secturity force must comply with NRC requirements on pre-biringinvestigatiofis and training. I Design Basis Threat. The severity of attacks to be prepared for are specified inthe fornt of a dtedesien basis 'ldE (D1T1. One ofNRCdFCTEs April 2fl3 regtlatorv ordersctatged FI T ..... ............ P.. ..... .1t ,f5.1 2-7 ..: W the DOT to ,Frerepresent the largest reasonable threat against which a regtlatedprivate guard force should be expected to defend under existing lawE.ifo according to theNRC minotincemetn. The details of the revised DRT. which took effect October 29. 2004.were not released to the pnhTic.NRC requires each naclear plant to condutct periodic securityexercises to testits ability to defend against the design basis threat. In these AFteforce o0 forcefiF exercises.monitored bv NRC. an adversary force from outside the plant attempts -to penetrate theplantflh"'Fs vital area and damageordestroykeysafetycotnponents. Participants in the tightlycontrolled exercises carry weapons modified to fire only blanks and laser bttrsts tositnttlate bullets. and tltey wear laser sensors to indicate hits. Other weapons andexplosives. as well as destroction or breaching of physical secttritv harriers, may also besimttlated. While one squad of the plant,*1'Is gnuard force is participating in a force-on-forceexcrcise. another squid is also on dutvto maintain normal plant secutrity. Plant defendersknow that a tttock attack will take place sometime dturing a specific period ofseveralltours. bttt they do not knosv what the attack scenario will be. Mtltiple attack scenariosare condtcted over several days ofexercises.Ftll implementation of theforce-on-forceprogratn coincided with theeffectivedateoftthe new DBT in late 2064. Standard procedures and other requirements have beendeveloped for using the force-on-force exercises to evaltate plant security and as a hasisfor taking regulatory enforcement action. Many tradeoffs are necessary to make theexercises as reallistic and consistent as possible without endangering participants orregtlar plant operations and security. Each plant is reqtuired to condtict NRC-mottitoredforce-on-forcc exercises once every three ycars.NRC required the nuclear industrv to develop attd train a il~recotnposite adversaryforceAE.* comprising secutrity officers front nany plants to sitntlate terrorist attacks in tlheforce-on-force exercises. Iloowever. in Scptenthcr 2004 testitnotty. the GovertntttentAccotnttahilitvlyffice (GAO) criticized the indttstrydýxTf sselcctionof a secntritycornpantttatgtards about hialf of U.S. nuclear plants. Wackenhut. to also provide the adversat.'yforceltn addition to raising iiEmqtestions abott thie force6fTEs independence.AE* GAO noted thatWackenhult had been accused of cheating on previous force-on-force exercises by uheD6parmeent of Energy.2 Page 3 CRS-3Conuress imposed statutorvrequirements for thie DPT and force-on-force exercisesin the Energy Policy Act of 2005. signed Augnst S. 2005. The act requires that eachnttclear plant titdergo force-on-force exercises at least once every three years (NRCAfi"scttrrent policy). thattheexcrcises siniulatethethireats in thteDT. and thatNRC afiettitigateany potential conflict of interest that could infinetice the resttlts ofa force-on-forceexercise. as the Conintission determtines to be necessary and appropriate.,iFThe new law reqttires NRC to revise the DBT within 18 months. after consideringa wide variety of potential modes of attack (physical. chemical, biological, etc.). thepotential for large attacks by titthtiple teams. potential assistance by several ennployeesinside a facility, the effects of large explosives and othter modeot weaponry, and otherspecific factors.Emergency Response. After the 1979 accident at the Three Mile Island ntclearplant near Hiarrisburg. PA. Congress required that all nuclear power plants bIe covered byernergency plaits. NRC reqnires that within an approximately 1-mile EtiergencyPlanning Zone (EPZ) around each plant the operator Must matntain warning sirens antdregtlarly cohdtct evactation exercises monitored by NRC: atnd the Federal EtnergencyMauIagetnet Agency (I:MA). In light of the increased P'ossibility of terrorist attacksttat, if stccessftt, could result in release of radioactive material. critics have retewedcalls for expanding tile EPZ to inchnde larger loptlation centerstAnother controversial issue regarding emergency response to a radioactive releasefront a tutclear power plant is the distribution of iodine pills. A significant component ofan accidental or terrorist release frottm a nuclear reactor wtould be a radioactive fort1t ofiodine. uvhichl tends to concentrate in the thyroid glarnd of persois exposed to it. Takinga pill containing non-radiohctive iodine before exposttre wotld prevent absorption of theradioactive iodine. Emergency plans in many states inctlde distribtttion of iodine pillsto the poptnlation within the EPZ. which would protect from exposure to radioactiveiodine. although giving no Protection against other radioactive elencuits in the release.NRC in 2002 began providingiodine pills to states reqtiestingtltem fir populations withinthe I fl-tate EPZ.Nuclear Plant finsrshilityo perating nuclear reactors contain large amounts ofradioactive Fission ,,uctsw L if dispersed. could pose a direct radiation hiazard.4.... 0- ....... .. f 2 contaminate soil and vegelation.and be ingested by hunmans and animals. Ihlman expostlre at high enough levels cancansc both short-term illncss and death. and longer-tcnn deaths by cancer and othlerdiseases.To prevent dispersal of radioactive material, nuclear fuiel and its fission products areencased in metal cladding %%vithin a steel reactor vessel. i, hich is inside a stnlcture. ileat from the radioactive decay of fission prodnicts could meltthic fuel-rod cladding eve-n if the reactor were shut down. A major concern in operatinga nuclear powser plant, in addition to controlling the niclear reaction.is assuring that thecore does not lose its coolant and ,futmclt downAf- from the heat produced bythe radioactivefission products xwithin the fncl rods. Therefore. even if plant operators shut down thereactor as they are supposed to during a terrorist attack, the threat of a radioactive release%%ould not be eliminated. Page 4 CRS-431.etter from NRC Chairman Nils J. Diaz to Secretary of I lomeland Security Toni Ridge.September

9. 20(04.Commercial reactor containment structtres H*" made of steel-reinforced concreteseveral feet thick A" are designed to prevent dispersal of most of a radioactivematerial in the event of a loss of coolant and meltdown.

Without a breach in tbccontainment. and without some source of d.lm.'cil s.,hi as a chemical fire, the radioactive fission products that escaped from the meltingfuel claddingmostlyuould remain %%here theyw,-ere. The two major accidents thathave taken placein powver reactors, at Three Mile Island in 1979 and at Chcmnobyl in the Soviet Union inl'%6. illustrate this phenomenon. Both resnlted from a combination of operator error anddesign flaws. At Three Mile Island. loss of coolant caused the fuel to melt. bunt there wasno fire or explosion. and the contaitunent prevented the escape of substantial amounts ofraiioactivity. At Clicrnobyl. vltich had no containmetnt. a hydrogen explosion and afierce graphite fire caused a significant part of the radioactiv c core to be blown into theatmosphiere. where it contaminated large areas of the surrotnding countryside and wasdetected in smaller amounts litcrally around the ,,orld.Vulncrabilityfrotn Air Attack. Nuclear power plantts%%ere designed tovithstandliurricanes. earthquakes, and other extreme events. but attacks by large airliners loadedwitlt fuel. such as those that crashed into the World Trade Center and Pentagon. %vere notcontemplated %vlteit design requirements wvere determined. A taped interview sho%%nScptcmber

10. 2N102.on Arab TV station al-Jazeera.

which contains a statement that AlQaeda initially planned to include a nuclear plant in its 2(001 attack sites. intensifiedconcern about aircraft crashes.in light of the possibilityliat an air attack might petnetrate the containment buildingof a nuclear plant. some interest groups have suggested that such an ev ent could befolloed by a meltdown and %v-idespread radiation exposure. Nuclear induistryspokespersons have countered by pointing oit that relatively small. low-lying niclearpow{er plants are difficult targets for attack. anul have argued that penetration ofthecontainment is unlikely, and that even ifsuch penetration occurred it probablywould notreach the reactor vcssel.Theysuggest that a snstained fire. such as that wvhich melted tlhetsnictures in the World Trade Center buildings, would be impossible unless an attackingplane penetrated the containment completely. incluting its fuicl-bearing wings.Recentlycompleted NRC studies ifheconfirm that the likelihood of both damaging thereactor core andl releasing radioactivity that could affect public health and safetyis Iow.E.iaccording to NRC Chairman Nils Diaz. Hlowever. NRC is considering studies ofadditional measures to mitigate the effects of an aircraft crash.3Spent Fucl Storage. Radioactive AfcespcntAE. nuclear fuel Sr* uvhich is removeCd fromthe reactor core after it can no longer efficiently sustain a nuclear chain reactionti,*" isstored in pools of watcr in the reactor building or in dry casks elsesvhere on the plantgrounds. Because both types of storage are located outside the reactor containmenstrhncture. particutlar concern has been raised about the vulnerabilityof spent fuel to attackby aircraft or other means. Spent futel pools and dry cask storage facilities are subject toNRC security requirements. Page 5 CRS-.4National Academy of Sciences. Board on Radioactive Waste Management. Safety and Secutrityof Commercial Spent Nuclear Fuel Storage. Public Report (online version). released April 6.2005.510 CFR 73.55 (b)(3) states: fiArThe total number of guards. and armed, trained personnelimmediately available at the facility to fulfill these response requirements shall nominally he ten( I).unless specificallyreutiire.d.otherwise on a case bycasc basis bythe Commission: -.5iI IA in. ../ hosever.this number may not be reduced to less than five (5) gnards.A*.The primary concern is whether terrorists could breach the thick concrete waills ofa spent'fuel po0/i and drain the cooling water, which could cause the spent f .lelsrszirconiunu cladding to overheat and catch fire, A repeti released in April 2005 by theNational Academy of Sciences (NAS) found that idnesiiccessfitd terrorist attacks on spentfitel pools, though difficult, are possihleE.* and that iE5rif an attack leads to a propagatingzirconium cladding fire. it could restilt in the release of large amounts of radioactivernaterial.dEo NAS recomttended thatthelhottest spent fitelbeinterspersedwith coolerspentfuel to reduce the likelihood of Fire.and that water-spray systems be installed to coolspent fiel if pool water were lost. The report also called for NRC to conduct inoreanalysis of the issue and consider earlier movement of spent filel from pools into drystorage.4 Both tile Hlouse- atid Senate-passed versions oftthe FY2o0f, Energy and WaterDevelopment appropriations bill (H.R. 2419. T-.Rept. 109-96. S.Rept. 109-84) wotldprovide $21 million for NRC to catry oUt the NAS recommendations. The IHlottseAppropriationsComnittiueesvas partictilarlycriticalof NRhCr'iETs actions on spent fitelstoragesecurity: !fEwThe Committee expects tite NRC to redotbIe its efforts to address the NAS-identified deficiencies, and to direct, not request. industry to take prompt correctiveactions.,E Regn latorv and Legislative ProposalsCritics of sectrity mneasitres have demanded both short-term regulatorychanges and legislative reforms.A fundamental concern was the nature of the DBT. which critics contended shouthdbeincreased to include a number ofseparate. coordinated attacks. Critics also contendedthlt nearlyltalfofthe plants tested itt I NRC-ntonitored mock attacks before 9/li failed torepel even the stttall forces specified in the original DIIT. a charge that industry sotrcesvigorously denied.Critics also pointed outt that licensees are required to employ only atninimnrn of five sectritypersonnel ondttyper plant, which uheyargte is not etiough foolte job.SNuclear spokespersons responded that the acttal sectrity force for the ntationi~T~s(5 nuclear plant sites numbers more than 5.000, att average of1abot 75 per site (coveringtntthiple shifts). Ntclear plant security forces are also supposed to be aided by local lasvenforcement officers if an attack occttrs.ln .Febnruary2 0 0 2. NRC implemented svhat it called iF*rinterimn counpetnsatorwsecuuritynueasnres.d° incltding reqtnirettentls for increased patrols.atngtitctetcd security forces andcapabilities, additional securityposts. installatiot of additional phiysical barriers, vehiclecltecks at greater stand-off distances. enhanced coordination isith lats' enforcement atdrtni I ita ryatthorities. aand more restrictive site access controls for all personnel. The ftrther Page 6 CRS-6orders issued April 2,). 2003. expanded ott the earlier measnres, including revising theD13T, which critics continue to describe as inadeqnate. Continuing congressionalconcerns resutted in the newv criteria in the Etuergy Policy Act of 2005 for further Dh3Trevisions.Becaltseof the growinge'iu phasis ott security.NRtCestablished tte Office of NiclearSectirity and Incident Response on April 7.2002. The office centralizes securityoversight ofall NRC-rcgttlated facilities. coordinates with law enforcement andinuelligence agencies. atnd handles emergency planniitg activities. Force-on-forceexercises are att example of the officedC T\s responsibilities. Ot Ju.ne 17. 2003. NRCestablished tfie position of Deplity E-xecittive Director for tHomeland Protection andPreparedttess, whose purview incitdes the Office of Nuclear Security and incidentResponse.l~egisWation. Since the 9/il attacks. nttmerous legislative proposals. includingsonle by NRC. have focused ott nuttlCar power plant security issues. Several of th-oseideis, such as the revision of the design-basis threat and the force-ott-force securityexercises. wverc included in the Etnergy Policy Act of 2005. which also includes:!assigunnent of a federal sectritv coordinator for acat NRC region:! backutp power for nuclear plant emuergency warnintg systerns;!tracking of radiation sources:!fingerprinting and background checks fir nuclear facility workers:!atuthorizing use of fireartis by ntclear facility securitt personnel(preeuptting some state restrictions):!authorizing NRC to regutlate dangerous weapons at licensed facilities:!extending penalties for sabolage to cover nuuclearfacilities nnutdercotnstruucuiou

!reqtuiring a t1manifest and persotnunel background checks for import andexport of nuclear materials:

and!requuiring NRC t/ constilt with tie fleparltucnlt of Homelanid Secttrityonthe vulnerahility to terrorist attack of locations of proposed nuclearfacilities before issititig a license. A number of legislative propoisals ittrodutced since 9/Il to increase n clear plant 'CC ere tot included in the new lax,,w including the creation of 0... 0. a federal force withinthe NRC to rejpace tthepirivate guards at nuclear power plants. requiring emergencyplanning exercises within a 5f-mile radius around eacrl nuclear filant. and stockpilingiodine pills for populations within 2f0 miles of ttclear plants. Other ieastires proposedhutt not enacted incltde a task force to review security at 1U.S. nuclear power plants anda federal team to coordinate protection ofair. water, and ground access to nuclear powerplants. IIIs O f: -11 1 Wi'5 ýf5)112(l totara EDO Principal Correspondence Control FROM: DUE: 10/13/04 Representative Sue W. Kelly EDO CONTROL: G20040668 DOC DT: 09/17/04 FINAL REPLY: TO: Chairman Diaz FOR SIGNATURE OF:** PRI **CRC NO: 04-06-07 Chairman Diaz.DESC: ROUTING: Cable and Raceway System at Indian Point 2 (William Lemanski)D DATE: 09/30/04 Reyes Virgilio Kane Merschoff Norry Dean Burns/Cyr Dyer, NRR Rathbun, OCA ASSIGNED TO: RI CONTACT: Collins SPECIAL INSTRUCTIONS OR REMARKS: Ref. G20040464. TS SC'-OVI Eck/-O OFFICE OF TilE SECRETARY CORRESPONDENCE CONTROL TICKET p Date Printed: Sep 30, 2004 10:38 PAPER NUMBER: ACTION OFFICE: LTR-04-0607 EDO LOGGING DATE:- 09/2912004 AUTIIOR: AFFILIATION: ADDRESSEE:

SUBJECT:

ACTION: DISTRIBUTION: LETTER DATE: ACKNOWLEDGED SPECIAL HANDLING: NOTES: FILE LOCATION: REP Sue Kelly REP Nils Diaz The Commission's handling of theconcerns by former Indian Point 2 employee William Lemanski...plant's cable and raceway system Signature of Chairman RF, OCA to Ack 09/17/2004 No Commission Correspondence ADAM'S DATE DUE: 10/15/2004 DATE SIGNED: EDO --' G20 04 06 68 SUE W. KELLY 19"m OSvRcr. YORK COMMITTEE ON FINANCIAL SERVICES. VICE CHAIR CHAIRWOMAN. SUBCOMMITTEE ON IVIE RIGHT AND INVE STIGA1IONS SUBCOMMI"TIT[ ON FINANCIAL INSTITUTIONS AND CONSUMER CREDIT SUBCOMMITTnE ON CAPITAL MARKETS. INSURANCE AND GOVERNMENT SPONSORED ENTERPRISES COMMITTEE ON TRANSPORTATION AND INFRASTRUCTURE SUBCOMMITTEE ON AVIATION SUBCOMMITTEE ON HIGHWAYS. TRANSIT AND PIPELINES SUBCOMMITTEE ON WATER RESOURCES AND ENVFRONMENT COMMITTEE ON SMALL BUSINESS SUBCOMMITTEE ON REGULATORY REFORM AND OVERSIGHT SUBCOMMITTEE ON RURAL ENiTERPRISES. AGRICULTURE AND TECHNOLOGY ASSISTANT MAJORITY WHIP PLEASE REPLY tO: 0 1127 LONGWOATH HOUSE OFFKCE BUILDING WASHINGTON, DC 20515 (202) 225-5441 Co 21 OLD MAIN STREET, ROoM # 107 FISHKILL. NEW YORK 12524 (8454 857-'5200 CLongttW of tije ZhIiitcb &tata;J00115C of r~eprrecntati1.w5 EURM~Iingtont ~3Q 20515-32W1 0 ORANGE COUNTY GOVERNMENT CENTER 255 MAIN STREET, 3RD FLOOR GOSIEN, NEW YORK 10524 1845) 291-4100 o] 2025 CROMPOND ROAD YORKTOWN HEIGHTS. NEW YORK 10598 49141 962-0761 September 17, 2004 Dr. Nils J. Diaz Chairman U.S. Nuclear Regulatory Commission --W ashington,-DC--20006 --.... *-. ................ -

Dear Chairman Diaz:

The commission's handling of the concerns raised by former Indian Point 2 employee William Lemanski continues to trouble me. I am very disappointed that despite repeated requests for a complete walk-down of the plant's cable and raceway system, that this -proposal has not yet been supported by the NRC.Mr. Lemanski remains unsatisfied with the level of scrutiny given to this matter. The attached letter from David Lochbaum from the Union of Concerned Scientists seems to further underscore these concerns and compels me'to once again urge the NRC to appropriately address this issue. At a time when plant security and safety is of paramount concern to communities surrounding the Indian Point Energy Center, it is critically important that the NRC do everything it can to ensure the safe operation of this facility.Again, I urge. your support for an immediate and thorough inspection of the plant's cable and raceway system.Your prompt attention to this request is greatly appreciated. Sincerely, Sue W. Kelly \Member of Congress PRINTED ON RECYCLED PAPER 4 Union of Concerned Scientists Citizens and Scientists for Environmental Solutions September 17, 2004 Mr. Brian E. Holian, Director.Division of Reactor Projects United States Nuclear Regulatory Commission Region I 475 Allendale Road King of Prussia, PA 19406-1415

SUBJECT:

-ELECTRICAL CABLE SEPARATION SAFETY ISSUES -AT INDIAN POINT ENERGY CENTER 

Dear Mr. Holian:

NRC Inspection Report No. 50-247/2004009 dated August 20, 2004, documents the findings from the NRC's inquiry into the allegations made by former employee William Lemanski about cable separation issues affecting safety at Indian Point Unit 2. The NRC inspectors identified three violations of federal regulations that NRC characterized as Green in the reactor oversight process.From January.1980 until August 1983, I worked for the Tennessee Valley Authority (TVA) at their.Browns Ferry nuclear plant -the site of the infamous 1975 fire that disabled all of the safety systems used to cool the Unit I reactor and the majority of those systems on Unit 2. The near miss forced the NRC to promulgate Appendix R to 10 CFR Part 50 with expanded requirements for cable separation and fire protection. In researching TVA's extensive files on that pivotal event, I learned that the NRC's cable separation and fire protection regulations had been violated at Browns Ferry and that both TVA and the NRC had known about the many violations for a long time before the fire. TVA and NRC tolerated these many longstanding violations because they were deemed insignificant from a safety perspective -at least until the fire proved otherwise. I truly hope that there's a difference between Indian Point Unit 2 today and Browns Ferry then other than the fact that Indian Point has not yet had a fire test its deficiencies.Butdo not see much in the NRC inspection report to give me that hope. The violations at Indian Point that the NRC characterized as having "very low safety significance" are no less egregious than the violations the NRC knew about prior to the Browns Ferry fire. Because comparable "very low safety significance!-- violations at Browns Ferry would have prevented the 1975 fire from causing serious damage had they been corrected instead of tolerated, perhaps you can understand why no one living around Indian Point should take comfort in the NRC downplaying chronic cable separation violations at Indian Point. After all, TVA could claim ignorance of the fact that "very low safety significance" violations could contribute to a major accident.Entergy cannot claim ignorance given Browns Ferry's notoriety, leaving maybe only an insanity plea if a fire were to ravage Indian Point.Washington Office: 1707 H Street NW Suite 600

• Washington DC 20006-3919

i. 202-223-6133

• FAX: 202-223-6162 Cambridge Headquarters:

Two Brattle Square , Cambridge MA 02238-9105 -617-547-5552

• FAX: 617-864.9405 California Office: 2397 Shattuck Avenue Suite 203
• Berkeley CA 94704-1567 e 510-843-1872 e FAX: 510-843-3785 September 17, 2004 Page 2 of 3 Some specific comments on the NRC's inspection report: I. The NRC licensed Indian Point Unit 2 in the 1970s. At that time, the electrical cables were supposed to be properly separated.

Numerous reviews and evaluations have been conducted since then to re-verify cable routing such as following the issuance of Appendix R following the Browns Ferry fire, during the 1989-1995 Cable Separation Program, and during the development and issuance of IP2-DBD-222, "Design Basis Document for Cable Separation," Rev.. I, December 17, 2003 (see page 5 of the inspection report). Despite these initial and subsequent efforts, cable separation violations continue to be found, demonstrating that Indian Point has never been in compliance with the federal safety regulations.

2. On page 7, the NRC stated, "Simply put,-ECRIS, which is used at other plants, is not readily.compatible with IP2's specialized cable separation criteria." On page 1, the NRC stated "An NRC inspection was conducted

.... to review issues associated with Entergy's conversion from.. WARS to ECRIS."1 .[NOTE: WARS and ECRIS are acronyms for computer-based systems for tracking the routing of electrical cables.] On page 14, the NRC wrote, "They also acknowledged the existence of a large number of data errors in WARS." So, Entergy took the WARS database that was known to contain a large number of errors and converted it to ECRIS that was known to be incompatible with the cable separation schemes employed at Indian Point Unit 2. Collectively, the findings in the NRC inspection report strongly suggest that Entergy made a bad situation at Indian Point worse.'3. On page 14, the NRC stated "Because WARS and ECRIS are not relied upon in the manual cable routing process at IP2, the cable separation experts had confidence that the DVTR anomalies were not indicative of actual cable separation issues." Later in the very same paragraph NRC stated "The IP2 designers and engineers were in general agreement that WARS had been a valuable tool in aid them in developing the design modification drawings (DMDs) that acted as cable separation routing schedules needed to install cables at the plant." So, WARS was not used during the manual cable routing process, but the drawings developed from WARS were used. If WARS is flawed, then the drawings developed from corrupted WARS are also suspect.Thus, any cables routed using WARS, ECRIS, and/or the drawings developed from WARS/ECRIS may violate the cable separation criteria unless independently verified by field walk-downs.

4. On page 14, NRC stated "Because WARS and ECRIS are not relied upon in the manual cable routing process at IP2, the cable separation experts had confidence that the DVTR anomalies were not indicative of actual cable separation issues." On page 16, NRC states "WARS and ECRIS provide the only tool capable of generating cable schedules for IP2, and as such are useful as long as engineers and designers are sensitive to the inaccuracies in the data." Several* points: a. First, the statement On page 14 appears false. If WARS and ECRIS are the only tools for generating cable schedules, then WARS and/or ECRIS would have to be relied upon in the manual cabling routing process. [NOTE: A cable schedule is essentially the Rand McNally roadmap explaining how a cable is routed from Point A to Point B. The "roads" specify conduits, cable trays, and cable raceways.]

b. On page 13, NRC stated "The inspectors determined that training on the use of WARS was not provided to engineers and designers in a timely or systematic manner prior to the termination of the use of WARS in Ma)' 2002." It is extremely difficult for engineers and designers to be "sensitive to the inaccuracies in the data" unless they receive proper training, which clearly did not occur at Indian Point Unit 2. The statement about the engineers and designers being untrained but sensitive appears little more than a gratuitous attempt to gloss over a safety problem.

September 17,2004 Page 3 of 3 The NRC inspection report documented several unresolved cable separation problems that violated federal safety regulations. But since none of the few cable separation problems resolved so far revealed a major safety problem, NRC assumed that no major safety problem exists in the remaining unresolved problems. Whether NRC's guess is right or wrong is not the point. The burden is on the plant's owner to comply with regulations because compliance provides assurance of acceptable safety. Entergy has not met that burden. And. the NRC is Entergy's accomplice by improperly shifting the burden from Entergy to workers like Mr. Lemanski who must now not only find cable separation violations, but find ones so significant as to shake NRC from its Rhett Butler approach to safety. Absent full compliance (and the large inventory of cable separation problems at Indian Point Unit 2 makes full compliance impossible), no one knows if the plant has acceptable safety levels.In other words, the NRC is gambling today with known violations at Indian Point as it did in the 1970s with known violations at Browns Ferry. When the NRC lost the gamble with the 1975 fire at Browns Ferry, it reacted by promulgating more regulations. Law-making is futile when the NRC seems unable, or---unwilling, to prevent law-breaking. Sincerely,<ORIGINAL SIGNED By>David Lochbaum Nuclear Safety Engineer Washington Office U.S. HOUSE OF REPRESENTATIVES WASHINGTON, DC 20515-3219 PUBLIC DOCUMENT OFFICIAL BUSINESS BIk. Rt.THIS MAILING WAS PREPARED, PUBUSHED, AND MAILED AT TAXPAYER EXPENSE Dr. Nils J. Diaz Chairman U.S. Nuclear Regulatory Commission Washington,,DC 20006 ..2 00 0 's 111111ol #fl 111.1,1 loll ,';,' Exhibit FP No. 7 Security related information-withhold under 10 C.F.R. 2.390 Exhibit FP.No. 7 UNITED STATES NUCLEAR REGULATORY COMMISSION In the matler off ENTERGY NUCLEAR INDIAN POINT 2L.L.C),ENTERGY NUCLEAR ) License No. DPR 26 and INDIAN POINT 3, L.L.C, ) License No. DPR 64 And Entergy.Nuclear Operations, Inc. )and Entergy Northeast, Inc., ) Docket No. 50-247 and regarding the Indian Point Energy Center ) Docket No. 50-286 Unit 2 and Unit3 )License Amendment Regarding Fire Protection Program FIRST DECLARATION OF ULRICH WITTE PETITION FOR LEAVE TO INTERVENE, REQUEST FOR HEARING, AND CONTENTIONS REGARDING FIRE PROTECTION PROGRAM AT INDIAN POINT UNIT 3 AND UNIT 2 My name is Ulrich Witte. WestCAN, RCCA. PHASE, SIERRA CLUB, BEYOND NUCLEAR and New York State Assemblyman Richard Brodsky, have retained me under the auspices of the Indian Point Safe Energy Coalition as a consultant withý respect to the above-captioned proceeding. I am a mechanical engineer with over twenty-six year's professional experience in engineering, licensing, and regulatory compliance of fire protectionof nuclear commercial nuclear facilities. I have considerable experience and expertise in the areas of configuration management, engineering design change controls, and licensing Security related inforrmation-withhold under 10 C.F.R. 2.390 Page 1 Security related. information-withhold under 10 C.F.R. 2.390 Exhibit FP No. 7 basis reconstitution. I have authored or contributed to two EPRI documents in the areas of finite element analysis, and engineering design control optimization programs. I have led industry guidelines endorsed by the American National Standards Institute regarding configuration management programs for domestic nuclear power plants. My 26 years of experience has generally focused on assisting nuclear plant owners in reestablishing fidelity of the licensing and design bases with the current plant design configuration, and with actual plant operations. In short, my expertise is in assisting problematic plants where the regulator found reason to require the owner to reestablish competence in safely *operating the facility in -ccordance with regulatory requirements. My curriculum vitae is attached hereto as Attachment A.I submit the following comments in support of each coalition stakeholder in asserting the unlawful and frankly dangerous exemption to fire protection federal rules that was granted by the Nuclear Regulatory Commission and published on October 4 th, 2007 in the federal register.1. The exemption 2ranted by the commission allows the licensee to take manual action in suppressino a fire that is outside the limitations of the rule.In fact the exemption granted requires that in order for the reactor to maintain controlled criticality during and after a fire in either one of two electrical tunnels, the fire would have to be manually extinguished within 24 minutes. This Security related information-withhold under 10 C.F.R. 2.390 Page 2 Security related information-withhold under 10 C.F R. 2.390 Exhibit FP No. 7 time limit starts from first detecting the fire, then summoning the brigade, responding, and amongst various actions de-energizing the 480 volt e bus, and then fully suppressing the burning cable insulation in order to protect electrical cables from ground faults. In addition, these actions must in less than 24 minutes prevent shorting power cables from spuriously initiating other circuits to prevent inadvertently open or close valves inside containment. These actions involve a brigade donning nomex gear, donning scott air packs, organizing a team that in accordance with the 1P3 Technical Requirements Manual Exhibit FP No. 15 which will have only limited trained reactor operator assistance, entering an electrical tunnel, and then suppressing the fire knowing full well that energized circuits must be maintained for one train, while the burning trays containing the redundant cable only one foot away are de-energized and the fire suppressed prior to damaging cables. The brigades confidence in spraying water onto the electrical fire will further slow an already unrealistic response of a sprint to suppress the fire making full extinguishment in less than 24 minutes entirely unrealistic. Where this an "ordinary" electrical fire involving high voltage or medium voltage combined with high amperage equipment, without -threat to safe operation of the reactor core, the suppression scenario without the unfathomable time'constraint may be plausible, but accomplished with deliberate actions that Security related information-withhold under 10 C.F.R. 2.390 Page 3 Security related information-withhold under 10 C.F.R. 2.390 Exhibit FP No. 7 minimize risk to fire brigade members. But not in 24 minutes from ignition. See for example, NUREG-1 852, "Demonstrating The Feasibility And Reliability Of Operator Manual Actions In Response To Fire," October 2007.As to the aforementioned analysis, and as delineated in greater detail in subsequent sections, determining whether there is enough time available to perform the operator manual action should account for potential circumstances, such as (1) the potential need to recover from or respond to unexpected difficulties associated with instruments or other equipment, or communication devices, (2) environmental and other effects that are not-easily replicated in a demonstration, such as radiation, smoke, toxic gas*effects, and increased noise levels, (3) limitations of the demonstration to account for all possible fire locations that may lead to the need for such operator manual actions, (4) inability to show or duplicate the operator manual actions during a demonstration because of safety considerations while at power, and (5) individual operator performance factors, such as physical size and strength, cognitive differences, and the effects of stress and time pressure. The time available should not be so restrictive relative to the time needed to perform the actions that personnel are not able to recover from any initial slips or errors in conducting the actions (i.e., there is some"recovery" time built in, should it be needed).Exhibit FR No. 16.]U. The exemption !ranted by the commission rely on their belief of a low probability of the occurrence of the event, which is outside the parameters for Appendix R Rule.3. When enquiring as to how the Commission was able to grant this exemption. with members of the-NRC staff, the response was that the industry was moving away from deterministic approaches for managing fire threats to reactor core to a probabilistic analysis. 1 was told that even though the even would have severe consequences of this fire, the probability of it occurring was low enough by the Security related information-withhold under ] 0C.F.R. 2.390 Page 4 Security related infbrmation-withhold under 10 C.F.R. 2.390.Exhibit FP No. 7 licensees analysis, that the exemption was justified. With this kind of rationale, why bother to protect redundant cables at all?Essentially, by this approach no protection could be found acceptable for the tunnel, With no manual suppression, with no detection, and no actual preparedness in the event of a fire.In 1986 1 was responsible for fully implementing the requirements of I OCFR50.48 and Appendix R to the Ranch Seco Nuclear Power Station owned by the Sacramento Municipal Utilities District.As the Project Engineer, I was responsible for establishing compliance to Appendix R for the plant. This was a monumental effort, given that the licensee had delayed implementation, and in approximately one year, the physical changes.to the facility had to be designed, implemented, and where possible tested to meet sections III G of appendix R. Numerous procedures had to be developed from scratch, and operators required extensive training on successful safe shutdown of the facility with a fire initiated from any area of the plant that threatened safe shut down equipment. It was beyond comprehensible to think that any competent and reasonable operator would and should be required to take manual actions so desperately necessary that if not accomplished in 24 minutes with full suppression,. the fire could have led to core melt. Plant management, the NRC Inspection Team, and NRR a like would each have declared a program crediting actions such as Security related information-withhold under 10 C.F.R. 2.390 Page 5 Security related information-withhold under 10 C.F.R. 2.390 Exhibit FP No. 7 those as highly unrealistic, and would have never accepted them as successfully implementing Appendix R for the plant. An exemption request for this was unthinkable. It was ludicrous then, and it is ludicrous now. Of note is that this project was inspected by the NRC and was found as having zero open items regarding implementation of Appendix R.111. Use of alternative analysis under NFPA 805 as an escape from the deterministic rules enacted in 1979 and contains assumptions that counter recent codified law relevant to fire and Design Basis Threats.Use of NFPA 805 is being pushed by industry and the regulator alike. When the regulator acknowledged in 2002 the substantial non-compliance of numerous licensee holders to the requirements of Appendix R, in particular not crediting manual actions to maintain safety system and safe shutdown capability for one hour in certain areas, the alternative approach was invoked. The alternative approach fails to include the revised baseline assumptions required in I OCFR73.1 which includes fire induced events by personnel inside the facility having both knowledge of and target awareness of the consequences of the fire. The exemption granted requires an amended Safety Evaluation by the Staff, and as a result constitutes an unacceptable change to the operating license DPR No. 64 to the Indian Point Unit 3 Facility.I declare under the penalty of perjury that the foregoing is true and correct.Security related information-withhold under 10 C.F.R. 2.390 Page 6 12/83/2887 20:54 8453713721 MILTON B SHAPIRO PAGE 08 Security related infonration-withhold under 10 C.F.R. 2.390 Exhibit FP No. 7 Executed this 3 rd day of December, 2007.Ulrich K. Witte State of New York County of Rockland)), On the Y" day of _________ in the yea 2T- before me, the undersigned, personally appeared.SUa I C W (A) N-HI-e , personally known to me or proved to me on the basis of satisfactory evidence to be the individual(s) whose name(s) is (are)subscribed to the within instrument and acknowledged to me that he/she/they executed the same in his/her/their capacity(ies), and that by his/her their signatures(s) on the instrument, the individual(s) or the person upon behalf of which the individual(s) acted, executed the instrument. SUSAI' 1I.LANM Y SHAPIO-Notar Public -Swe of New York*-i No. 02SH6060466 Qualified in Rockland Conty i "-m/y Commission Ehxpires Junc 25. 20 fj'Securhy related infornation--withhold under 10 C.F.R. 2.390 0 ~Pnoo. '7 P SEntergy Entergy Nuclear Northeast Indian Point Energy Center 450 Broadway, GSB P.O. Box 249 Buchanan, NY 10511410249 Tel 914 734 6700 Fred Dacimo Site Vice President Administration July 24, 2006 Re: Indian Point Unit No. 3 Docket No. 50-286 NL-06-078 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

SUBJECT:

Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 1) NRC Information Notice 2005-07, "Results of HEMYC Electrical Raceway Fire Barrier System Full Scale Fire Testing," April 1, 2005

References:

2) NYPA Letter, J. C. Brons to S. A. Varga (NRC), "Appendix R Fire Protection Program," August 16, 1984 3) NYPA Letter, J. C. Brons to S. A. Varga (NRC), "Information to Support the Evaluation of IP3 to 10 CFR 50.48 and Appendix R to 10 CFR 50," September 19, 1985 4) NRC Letter and SER, S. A. Varga to J. C. Brons (NYPA), "Indian Point 3 Nuclear Power Plant -Exemption From Certain Requirements of Section III.G and III.J of Appendix R to 10 CFR Part 50," January 7, 1987 5) IPEC Letter NL-06-060, F. Dacimo to Document Control Desk,"Response to Generic Letter 2006-03 (Potentially Nonconforming Hemyc and MT Fire Barrier Configurations)," June 8, 2006

Dear Sir or Madam:

NRC Information Notice (IN) 2005-07 (Reference

1) notified licensees of potential performance concerns associated with the one-hour rated Hemyc electrical raceway fire barrier system (ERFBS), indicating that the system may be incapable of fulfilling the stated one-hour fire resistance rating when tested in accordance with Generic Letter 86-10, Supplement 1 criteria.

Indian Point Unit No. 3 (IP3) utilizes the one-hour rated Hemyc NL-06-078 Docket No. 50-286 Page 2 of 3 ERFBS that is the subject of IN 2005-07 in two areas of the plant. In a Safety Evaluation Report (SER) dated January 7, 1987 (Reference 4), the Staff granted a number of exemptions from specific requirements of 10 CFR 50, Appendix R, which included these two plant areas. Entergy has reviewed the Hemyc fire test results provided by the NRC in IN 2005-07 and has determined that it is necessary to revise the fire resistance rating of the Hemyc ERFBS configurations credited in two of the exemptions. The two affected exemptions are those applicable to Fire Area PAB-2 in the Primary Auxiliary Building, and Fire Area ETN-4 in the Electrical Tunnels and Electrical Penetration Areas.In accordance with 10 CFR 50.12, the purpose of this letter is to request revision of the January 7, 1987 SER to reflect that the installed Hemyc ERFBS configurations provide a 30-minute fire resistance rating, in lieu of the previously stated one-hour fire resistance rating. The requests for the.exemptions granted by the January 7, 1987 SER were docketed in NYPA Letters dated August 16, 1984 (Reference

2) and September 19, 1985 (Reference 3). Based on a review of these letters and of the NRC test results, it is Entergy's position that a Hemyc ERFBS fire resistance rating of 30 minutes will provide .sufficient protection for the affected raceways, with adequate margin, to continue to meet the intent of the original requests for exemption and the conclusions presented in the January 7, 1987 SER. This evaluation is summarized in Attachment 1.As documented in Attachment 1, it is Entergy's conclusion that the revised fire resistance rating of the Hemyc ERFBS does not reflect a reduction in overall fire safety, and presents no added challenge to the credited post-fire safe-shutdown capability.

The remainder of the credited fire protection features, the fire hazards and ignition sources, fire brigade and.operator response to fire events, and the credited post-fire safe-shutdown capability remain materially unchanged from the configuration as originally described in the NYPA letters and as credited in the January 7, 1987 SER.Entergy has reviewed the as-built configurations of the Hemyc ERFBS installed at IP3 against the results of the NRC Hemyc fire test program as referenced by IN 2005-07.This review has determined that the installed ERFBS can be expected to afford a thermal protection rating of at least 30 minutes, contingent upon the installation of a modification to augment raceway support protection and to install over-banding of certain enclosures. A commitment to install these modifications, is contained in our response to Generic Letter 2006-03 (Reference 5). The conclusions from the engineering evaluation are also summarized in Attachment 1.There are no new commitments contained in this letter. If you have any questionsor* require additional information, please contact Mr. Patric W. Conroy at 914-734-6668. NL-06-078 Docket No. 50-286 Page 3 of 3 Sinerelf,* _ ----F tfed .R .D a cim o "-(Y -Site Vice President Indian Point Energy Center Attachment 1: Request for Revision of Existing Exemptions from. 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas.ETN-4 and PAB-2 cc: Mr. Samuel J. Collins, Regional Administrator, NRC Region I Mr. John P. Boska, Senior Project Manager, NRC NRR DORL NRC Resident Inspectors Office, Indian Point Energy Center Mr. Paul Eddy, New York State Department of Public Service Mr. Peter R. Smith, NYSERDA ATTACHMENT I to NL-06-078 Request for Revision of Existing Exemptions from 10 CFR 50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2 Entergy Nuclear Operations, Inc.Indian Point Nuclear Generating Unit No. 3 Docket No. 50-286 NL-06-078 Docket No. 50-286 Attachment 1 Page 1 of 14 Request for Revision of Existing Exemptions from 10 CFR-50, Appendix R: One-Hour Hemyc Electrical Raceway Fire Barrier System, Fire Areas ETN-4 and PAB-2

1.0 INTRODUCTION

The Indian Point Unit No. 3 (IP3) electrical raceways provided with Hemyc ERFBS protection consist of several conduits, cable trays, and a box-type enclosure. The locations of the Hemyc ERFBS installations are illustrated by Figures 1 through 4.To support the request for revision to the two exemptions applicable to Fire Areas ETN-4 (Electrical Tunnels and Electrical Penetration Areas) and PAB-2 (Component Cooling Pump Area) contained in the January 7, 1987 SER (Reference 8.1), this attachment:

• Discusses the licensing basis for the one-hour Hemyc electrical raceway fire barrier system (ERFBS) (Section 2.0);* Discusses the fire hazards, combustible controls, and fire protection features of the areas (Section 3.0);Evaluates the acceptability of a 30-minute rating considering the current fire hazards and fire protection features in the areas (Section 4.0);Presents a summary description of the installed one-hour Hemyc ERFBS configurations, and of the evaluation of the results of the NRC Hemyc fire test program (Reference 8.11) (Section 5.0).As documented in Reference 8.11, the NRC Hemyc test specimens provided acceptable thermal performance for a period of at least 30 minutes, or the results provided insight into the observed failure mechanisms.

Further, each of the installed IP3 Hemyc configurations is bounded by one or more of the NRC test specimens, or is subject to a planned modification based on the insights learned from the NRC test program. As determined in Reference 8.11, the Hemyc ERFBS at IP3 can be expected to provide a fire resistance rating of a minimum of 30 minutes, consistent with ASTM E 119 temperature rise acceptance criteria. A fire resistance rating of 30 minutes will provide adequate protection for the affected IP3 safe-shutdown raceways, in consideration of the additional mitigating factors of low fire loading and active and passive fire protection features installed in each of the two affected plant areas. NL-06-078 Docket No. 50-286 Attachment I Page 2 of 14 2.0 EXISTING LICENSING BASIS FOR ONE-HOUR ERFBS IN AFFECTED PLANT AREAS 2.1 Electrical Tunnels and Penetration Areas: Fire Area ETN-4: Upper and Lower Electrical Tunnels (Fire Zones 7A and 60A, respectively) and Upper Penetration Area (Fire Zone 73A)By SER dated February 2, 1984 (Reference 8.4), the Staff approved an exemption from the Appendix R Section lII.G separation requirements, to the extent that redundant safe-shutdown systems are not separated by more than 20 feet free of intervening combustibles or fire hazards, and that redundant safe-shutdown systems are not separated by a one-hour rated fire barrier in an area which is protected by automatic fire detection and suppression systems. The bases for this exemption included the existing separation between redundant safe-shutdown trains, minimal fire hazards, flame-retardant characteristics of cable insulation, and.the installed active and passive fire protection features.Following a comprehensive reassessment of the IP3 Appendix R compliance basis, by letters dated August 16, 1984 and September 19, 1985 (References 8.3 and 8.2, respectively), NYPA informed the NRC of the need for additional separation measures to be installed in Fire Area ETN-4. These measures included the installation of one-hour rated fire wrap on several safe-shutdown raceways. By SER dated January 7, 1987 (Reference 8.1), the Staff acknowledged this clarification and the addition of one-hour rated fire wrap, and confirmed the continued validity of the exemption granted by the February 2, 1984 SER (Reference 8.4).2.2 Primary Auxiliary Building, Fire Area PAB-2: Fire Zone 1. 41' Elevation CCW Pump Area In the SER dated January 7, 1987 (Reference 8.1), the Staff approved an exemption from the Section 11i.G separation requirements for this fire zone, to the extent that an automatic suppression system has not been provided, and redundant safe-shutdown systems are not separated by more than 20 feet free of intervening combustibles. The bases for this exemption included the existing separation between redundant safe-shutdown trains, low fire loading, a fire detection system, manual hose stations and portable extinguishers, a partial height noncombustible barrier designed to protect the CCW pump against radiant heat from a fire, and a one-hour fire rated cable wrap around the normal power feed conduit to the 33 CCW pump. NL-06-078 Docket No. 50-286 Attachment 1 Page 3 of 14 3.0 FIRE HAZARDS, COMBUSTIBLE CONTROLS, AND FIRE PROTECTION FEATURES IN FIRE AREAS ETN-4 AND PAB-2 3.1 Evaluation of Hazards/Ignition Sources and Combustible Controls The fire hazards and ignition sources in Fire Areas ETN-4 and PAB-2 remain materially unchanged from the characteristics of these areas as described in the SERs dated February 2, 1984 (Reference 8.4) and January 7, 1987 (Reference 8.1), and the NYPA correspondence referenced therein, as applicable to the specific fire zone.Transient combustible and hot work controls have been enhanced since the transition from NYPA to Entergy operation of IP3, with the issuance of procedures EN-DC-127, "Control of Hot Work and Ignition Sources" (Reference 8.8) and ENN-DC-161, "Transient Combustible Program" (Reference 8.9). Notably, per Transient Combustible Program procedure ENN-DC-161, Fire Areas ETN-4 and PAB-2 are designated as "Level 2" combustible control areas, which 'constrains transient combustibles to moderate quantities. Any planned introduction of more than the allowable quantities of combustibles into these areas requires a prior review by Fire Protection Engineering, which will include the definition of additional protective/compensatory measures as determined to be applicable. In addition, per procedure EN-DC-127, any planned hot work in IP3 Fire Areas ETN-4 or PAB-2 requires the prior review and approval of Fire Protection Engineering. This constraint provides assurance that hazards and potential effects consistently receive proper prior evaluation, and that compensatory measures, as applicable, are adequately defined in advance of the hot work activity.The administrative controls imposed by ENN-DC-161 and the structured Fire Protection Engineering review of planned hot work activities per EN-DC-127 provide additional assurance that the potential for, and potential effects of, significant floor-based transient combustible fires is sharply limited.3.2 Active Protection: Fire Detection and Suppression Features.The installed fire detection systems and automatic and manual fire suppression features in the affected zones of Fire Areas ETN-4 and PAB-2 remain functionally unchanged from those described in SERs dated February 2, 1984 (Reference 8.4)and January 7, 1987 (Reference 8.1), and the NYPA correspondence referenced therein, as applicable. Preaction automatic water spray suppression is provided in ETN-4 for protection of cable trays; manual suppression capabilities are provided in both Fire Areas ETN-4 and PAB-2, in the form of accessible fire hose stations and portable fire extinguishers. NL-06-078 Docket No. 50-286 Attachment 1 Page 4 of 14 3.3 Passive Fire Protection Features The installed passive fire protection features (fire barriers and penetration seal systems) in Fire Areas ETN-4 and PAB-2 remain functionally unchanged from those described in SERs dated February 2, 1984 (Reference 8.4) and January..7, 1987 (Reference 8.1), and the NYPA correspondence referenced therein, as applicable.

3.4 Transient

Combustible Control and FP Equipment Operating History A review of IP3 condition reports for the period beginning with Entergy ownership through the .present indicated that no significant fire protection related deficiencies applicable to Fire Zones 1, 7A, 60A, or 73A were identified during this time period.Topics searched included fire barriers, ERFBS, fire suppression, fire detection, and housekeeping/combustible loading. Hence, there is reasonable assurance that the design and operational controls (as described above) in place since the transition to Entergy operation of IP3 have maintained the fire protection defense-in-depth measures consistent with the IP3 fire protection licensing basis.4.0 ADEQUACY OF A 30-MINUTE ERFBS TO PROTECT SAFE-SHUTDOWN CABLES 4.1 Fire Area ETN-4, Fire Zones 7A, 60A, and 73A As described in the SER dated February 2, 1984 (Reference 8.4), the fire hazards in the affected zones of this area are small. As given by Reference 8.7, the calculated fire severity in Fire Area ETN-4 is less than 60 minutes, of which less than one minute of fire severity is attributable to the expected transient fire loading.The balance of the combustible inventory is predominantly asbestos-jacketed, flame-retardant electrical cable insulation. The flame-retardant characteristics of the principal combustible ensure that fire will not propagate along the cables to any significant degree, thereby limiting the rate of development and damage incurred by credible fires. As the credible fire scenarios involve floor-based transient combustibles, the impact of such a fire, at any location within the area, is expected to be slight, and insufficient to involve substantial quantities of the predominant fixed combustibles (the flame-retardant cables in trays). In addition, the fire detection, automatic cable tray fire suppression system, and manual fire suppression features provide further assurance that fire damage will be limited in scope and severity. Therefore, based on the current Fire Hazards Analysis, an ERFBS with a 30-minute fire resistance rating is adequate to protect the safe-shutdown cables in this area. NL-06-078 Docket No. 50-286 Attachment 1 Page 5 of 14 Based on a review of the fire zones in this area using the guidance and tools of NUREG-1805 (Reference 8.10), it was found that the credible fire challenge would be less severe than that imposed by an ASTM E 119 fire exposure. Further, with the installed smoke detection system and the preaction water spray system for the cable trays in the area, the credible fire challenge in the affected zones of Fire Area ETN-4 can be expected to result in a temperature profile that is substantially less severe than that of the ASTM E 119 time-temperature curve. Therefore, based on the insights using NUREG-1805 guidance and tools, the expected fire effects in this Fire Area will not challenge a Hemyc ERFBS installation that has a fire resistance rating of 30 minutes.4.2 Fire Area PAB-2, Fire Zone 1 As described in the SER dated January 7, 1987 (Reference 8.1), the fire load in this area is low. As given by Reference 8.7, the calculated fire severity in Fire Area PAB-2, Fire Zone 1 is less than 10 minutes. The small quantity of combustible materials (e.g., CCW pump lubricating oil or transient materials) would be expected to result in a credible fire which is localized, with a low aggregate heat release, and no challenge to redundant safe-shutdown cables or components caused by radiant or convective energy. The installed fire detection system would ensure timely detection, enable prompt manual suppression of the fire, and provide assurance that any fire damage will be limited in scope and severity.Therefore, the credible fire challenge can be expected to result in a temperature profile less severe than that of the ASTM E 119 time-temperature curve.Hence, an ERFBS capable of providing at least 30 minutes of protection for the enclosed cables when tested in accordance with ASTM E 119 will provide adequate protection for the safe-shutdown cables in this area, given the hazards in the area and the active fire protection features.5.0 EVALUATION OF IP3-SPECIFIC HEMYC ERFBS VERSUS NRC-TESTED CONFIGURATIONS The installed IP3 Hemyc ERFBS is summarized as follows: Two 4" rigid steel conduits, each with a cable percent fill of approximately 30%.The two 4" rigid steel conduits are protected with direct-attached 2" thick Hemyc blanket wrap.Seven 18" cable tray sections,. with a cable percent fill in -these trays ranging fromr approximately 10% to 25%. Also wrapped are two 24" cable tray sections, each with a cable percent fill of approximately 50%. All cable trays NL-06-078 Docket No. 50-286 Attachment I Page 6 of 14 are wrapped using 1-1/2" thick Hemyc blanket with a 2" air gap between the blanket and the protected raceway.* Box-type enclosure at containment electrical penetrations H19/H20, consisting of 2" thick Hemyc blanket directly attached to the enclosure. The IP3 Hemyc ERFBS configurations have been compared to the size, orientation, materials, methods of construction, and thermal performance of the test specimens of References 8.5 and 8.6 in an engineering evaluation -(Reference 8.11). The detailed thermal performance results of the NRC Hemyc fire tests indicated that several of the tested configurations provided at least 30 minutes of protection for the enclosed safe-shutdown cables, or provided insights into the failure mechanisms that occurred during testing. The engineering evaluation compares the details of these tested configurations with the details of the 1P3 Hemyc ERFBS configurations. This evaluation establishes that the IP3 Hemyc ERFBS configurations are sufficiently comparable to the NRC-tested configurations, with minor enhancements to several IP3 configurations, which include the need to augment the ERFBS on raceway supports and to install additional over-banding on certain enclosures. Pending implementation of those modifications to the affected configurations, all of the IP3 Hemyc ERFBS configurations can be expected to provide a fire resistance capability of at least 30 minutes for the enclosed safe-shutdown cables.6.0 REGULATORY ANALYSIS 10 CFR 50.12(a) states that the Commission may grant exemptions from the requirements of the regulations contained in 10 CFR 50 which are: (1) Authorized by law, will not present an undue risk to the public health and'safety, and are consistent with the common defense and security; and, (2) If special circumstances are present.This request for revision of existing exemptions meets the criteria set forth in 10 CFR 50.12, as discussed herein.6.1 The requested exemption is authorized by law 10 CFR 50.12(a) authorizes the NRC to grant exemptions from its regulations, and no law is known that precludes the NRC from granting the requested revision to the existing exemptions. NL-06-078 Docket No. 50-286 Attachment I Page 7 of 14 6.2 The requested exemption does not present an undue risk to the public health and safety The Hemyc ERFBS configurations installed in IP3 Fire Areas ETN-4 and PAB-2 will provide a fire resistance capability of at least 30 minutes, as discussed in Section 5.0. The minimal fire hazards and ignition sources, combined with the nature of the fire hazards in the areas, the active and passive fire protection features, and the controls on transient combustibles and ignition sources, as discussed in Section 3.0, provide assurance that the credible fire challenge to the IP3 Hemyc ERFBS will be substantially less than that of an equivalent ASTM E 119 30-minute fire exposure. Therefore, as discussed in Section 4.0, the installed ERFBS can be expected to provide adequate protection for the affected safe-shutdown raceways and enclosed cables.Therefore, given the existing level of fire protection defense in depth, combined with the minimal fire challenge presented by the credible fire scenarios in these areas, and the favorable FP equipment operating history, the change in credited ERFBS fire resistance rating from one hour to 30 minutes will not degrade the effectiveness of the IP3 fire protection program, nor will it challenge the credited post-fire safe-shutdown capability. Based on the determination that safe shutdown in the event of a-fire can be achieved and maintained with less than a one-hour fire resistance rating, the requested revision to the existing exemptions does not present an undue risk to the public health and safety.6.3 The requested exemption is consistent with the common defense and security The requested revision to the existing exemptions is not directly related to and should not adversely impact the common defense and security.6.4 Special circumstances are present -underlying purpose of the rule 10 CFR 50.12(a) requires that special circumstance be present in order for the Commission to consider granting an exemption. Per 10 CFR 50.12(a)(2)(ii), one special circumstance is that application of the regulation in the particular circumstances would not serve the underlying purpose of the rule or is not necessary to achieve the underlying purpose of the rule.The underlying purpose of 10 CFR 50, Appendix R, Section IIL.G is to provide reasonable assurance that at least one means of achieving and maintaining safe shutdown conditions will remain available during and after any postulated fire. For the areas containing the Hemyc ERFBS installations, the credible fire challenge to the IP3 Hemyc ERFBS due to any postulated fire will be substantially less than that of an equivalent ASTM E 119 30-minute fire exposure. Therefore, a fire NL-06-078 Docket No. 50-286 Attachment 1 Page 8 of 14 resistance capability of at least 30 minutes provides protection of the components required for achieving and maintaining safe shutdown. Therefore, the underlying purpose of the rule is satisfied and the application of the regulation in these particular circumstances is not necessary to achieve the underlying purpose of the rule.

7.0 CONCLUSION

The defense-in-depth objectives of the Fire Protection Program are to 1) Prevent fires from occurring;

2) Detect, control, and extinguish promptly those fires that do occur; and, 3) Provide protection from the effects of a fire for structures, systems, and components needed to achieve and maintain safe shutdown.The fire hazards analysis of the fire zones containing the Hemyc ERFBS installations and the existing protection (after completion of modifications discussed in Section 5.0) of the electrical raceways show that these objectives are met. The first objective is supported by the fact that there are few significant ignition sources' in the areas, and transient combustibles are controlled.

Supporting the second objective are the active fire detection and suppression features in each area. The third objective is supported by the Hemyc ERFBS configurations which provide protection from credible fire exposures, which have an expected duration less than that of the proposed 30 minute rating.This request for revision of existing exemptions is warranted under the provisions of 10 CFR 50.12, in that it is authorized by law, does not present an undue risk to the public health and safety, and is consistent with the common defense and security. Further, it meets the requirement for a special circumstance in that it satisfies the underlying purpose of 10 CFR 50 Appendix R by providing an ERFBS that will provide protection for the duration of any postulated fire such that safe shutdown can be achieved and maintained. Ignition sources in the affected fire zones consist of limited transient combustibles (all zones), several equipment cabinets and (3kVA) 480/120V instrument power transformer BH8 (Fire Zone.73A), and a CCW pump motor (Fire Zone 1) NL-06-078 Docket No. 50-286 Attachment I Page 9 of 14

8.0 REFERENCES

8.1 NRC Letter and SER, S. A. Varga to J. C. Brons (NYPA); Indian Point 3 Nuclear Power Plant -Exemption From Certain Requirements of Section III.G and III.J of Appendix R to 10 CFR Part 50, January 7, 1987 8.2 NYPA Letter, J. C: Brons to S. A. Varga (NRC); Information to Support the Evaluation of IP3 to 10 CFR 50.48 and Appendix R to 10 CFR 50, September 19, 1985 8.3 NYPA Letter, J. C. Brons to S. A. Varga (NRC); Appendix R Fire Protection Program, August 16, 1984 8.4 NRC Letter and SER, S. A. Varga to J..C. Brons (NYPA); Exemptions From the Requirements of 10 CFR 50, Appendix R, for the Indian Point Nuclear Generating Plant, Unit No. 3 (IP-3), February 2, 1984 8.5 Hemyc (One-Hour) Electrical Raceway Fire Barrier Systems Performance Testing;Conduit and Junction Box Raceways (Omega Point Laboratories Fire Test Report, Project 14790-123263, dated April 11, 2005)8.6 Hemyc (One-Hour) Electrical Raceway Fire Barrier Systems Performance Testing;Cable Tray, Cable Air Drop and Junction Box Raceways (Omega Point Laboratories Fire Test Report, Project 14790-123264, dated April 18, 2005)8.7 iP3-ANAL-FP-02143, Indian Point 3 Fire Hazards Analysis, Revision 4 8.8 EN-DC-127, Control of Hot Work and Ignition Sources, Revision 2 8.9 ENN-DC-161, Transient Combustible Program, Revision 1 8.10 NUREG-1805, "Fire Dynamics Tools (FDTs) Quantitative Fire Hazard Analysis Methods for the U.S. NRC Fire Protection Inspection Program," December 2004.8.11 Entergy Engineering Report IP-RPT-06-00062, Revision 0; "Comparison of IP3 Hemyc Electrical Raceway Fire Barrier System to NRC Hemyc Fire Test Results." NL-06-078 Docket No. 50-286 Attachment 1 Page 10 of 14 9.0 FIGURES 9.1 Hemyc ERFBS in Fire Zone 1 9.2 Hemyc ERFBS in Fire Zone 7A 9.3 Hemyc ERFBS in Fire Zone 60A 9.4 Hemyc ERFBS in Fire Zone 73A NL-06-078 Docket No. 50-286 Attachment 1 Page 11 of 14 Unit 3 Primary Aux. Bldg.-Component Cooling Pumps Elev. 41'-0" PIPE TUNNEL CORRIDOR , Enteigy IHwnyc ERFSS In IF3 FW. Zon~e I (ComIPonnt Cool ng Purnp A-)2 Figure 9.1: Hemyc ERFBS In Fire Zone 1 NL-06-078 Docket No. 50-286 Attachment 1 Page 12 of 14 Unit 3 Lower Electrical Tunnel LOWER ELECT. Ele v. 335'- 0" PENETRATION AREA MINI CONTAINMENT AREA Floor EL35'PAB PIPE TUNNEL Floor EL 32-6" SAFETY INJ.PUMP ROOM MAIN TRANSFORMER YARD AREA PAB CORRIDOR DEMINERALIZERS r to Elect. Tunnel 3-hr Rated 1,38 KV Exhaust ron Vent Dampers SWITCHYARD Control Panel (7p) UUnder Crating Control Panel {l'ypin Floor at EL 33' 4 CABLE SPREADING ROOM @ ne~IPEC Hemyc ERFBS In 1P3 Fie Zone 7A ( LowPr Ewcoftal TuP-Figure 9.2: Hemyc ERFBS In Fire Zone 7A NL-06-078 Docket No. 50-286.Attachment 1 Page 13 of 14., Enterg IPEC Hemyc ERFBS In IP3 Fire Zone cOA (Upper Electrcal Tunnel)Figure 9.3: Hemyc ERFBS In Fire Zone 60A NL-06-078 Docket No. 50-286 Attachment I Page 14 of 14 P'P-358 Figure 9.4: Hemyc ERFBS In Fire Zone 73A Security related i nformation-withhold under 10 C.F.R. 2.390 Exhibit FP No. 7 UNITED STATES NUCLEAR REGULATORY COMMISSION In the matter of ENTERGY NUCLEAR INDIAN POINT 2L.L.C),ENTERGY NUCLEAR ) License No. DPR 26 and INDIAN POINT 3, L.L.C, ) License No. DPR 64 And Entergy Nuclear Operations, Inc. )and Entergy Northeast, Inc., ) Docket No. 50-247 and regarding the Indian Point Energy Center ) Docket No. 50-286.Unit 2 and Unit3 )License Amendment Regarding Fire Protection Program FIRST DECLARATION OF ULRICHWITE PETITION FOR LEAVE TO INTERVENE, REQUEST FOR HEARING, AND CONTENTIONS REGARDING FIRE PROTECTION PROGRAM AT INDIAN POINT UNIT 3 AND UNIT 2 My name is Ulrich Witte. WestCAN, RCCA. PHASE, SIERRA CLUB, BEYOND NUCLEAR and New York State Assemblyman Richard Brodsky, have retained me under the auspices of the Indian Point Safe Energy Coalition as a consultant with respect to the above-captioned proceeding. I am a mechanical engineer with over twenty-six year's professional experience in engineering, licensing, and regulatory compliance of fire protection of nuclear commercial. nuclear facilities. I have considerable experience and expertise in the areas of configuration management, engineering design change controls, and licensing Security related information-withhold under 10 C.F.R. 2.390 Page ] Security related information--withhold under 10 C.F.R. 2.390 Exhibit FP No. 7 basis reconstitution. I have authored or contributed to two EPRI documents in the areas of finite element analysis, and engineering design control optimization programs. I have led industry guidelines endorsed by the American National Standards Institute regarding configuration management programs for domestic nuclear power plants. My 26 years of experience has generally focused on assisting nuclear plant owners in reestablishing fidelity of the licensing and design bases with the current plant design configuration, and with actual plant operations. In short, my expertise is in assisting problematic plants where the regulator found reason to require the owner to reestablish competence in safely operating the facility in accordance with regulatory requirements. My curriculum vitae is attached hereto as Attachment A.I submit the following comments in support of each coalition stakeholder in asserting the unlawful and frankly dangerous exemption to fire protection federal rules that was granted by the Nuclear Regulatory Commission and published on October 4 th, 2007 in the federal register I. The exemption 2ranted by the commission allows the licensee to take manual action in suppressin2 a fire that is outside the limitations of the rule.In fact the exemption granted requires that in order for the reactor to maintain controlled criticality during and after a fire in either one of two electrical tunnels, the fire would have to be manually extinguished within 24 minutes. This Security related infbrmation-withhold under 10 C.F.R. 2.390 Page 2

• Security related information--withhold under 10 C.F.R. 2.390 Exhibit FP No. 7 time limit starts from first detecting the fire, then summoning the brigade, responding, and amongst various actions de-energizing the 480 volt e bus, and then fully suppressing the burning cable insulation in order to protect electrical cables from ground faults. In addition, these actions must in less than 24 minutes prevent shorting power cables from spuriously initiating other circuits to prevent inadvertently open or close valves inside ,containment.

These actions involve a brigade donning nomex gear, donning scott air packs, organizing a team that in accordance with the IP3 Technical Requirements Manual Exhibit FP No. 15 which will have only limited trained reactor operator assistance, entering an electrical tunnel, and then suppressing the fire knowing full well that energized circuits must be maintained for one train, while the burning trays containing the redundant cable only one foot away are de-energized and the fire suppressed prior to damaging cables. The brigades confidence in spraying water onto the electrical fire will further slow an already unrealistic response -of a sprint to suppress the fire making full extinguishment in less than 24 minutes entirely unrealistic. Where this an "ordinary" electrical fire involving high voltage or medium voltage combined with high amperage equipment, without threat to safe operation of the reactor core, the suppression scenario without the unfathomable time constraint may be plausible, but accomplished with deliberate actions that Security related information-withhold under 10 C.F.R. 2.390 Page 3 Security related information-withhold under 10 C.F.R. 2.390 Exhibit FP No. 7 minimize risk to fire brigade members. But not in 24 minutes from ignition. See for example, NUREG-1852, "Demonstrating The Feasibility And Reliability Of Operator Manual Actions In Response To Fire," October 2007.As to the aforementioned analysis, and as delineated in greater detail in subsequent sections, determining whether there is enough time available to perform the operator manual action should account for potential circumstances, such as (1) the potential need to recover from or respond to unexpected difficulties associated with instruments or other equipment, or communication devices, (2) environmental and other effects that are not easily replicated in a demonstration, such as radiation, smoke, toxic gas effects, and increased noise levels, (3) limitations of the demonstration to account for all possible fire locations that may lead to the need for such operator manual actions, (4) inability to show or duplicate the operator manual actions during a demonstration because of safety considerations while at power, and (5) individual operator performance factors, such as physical size and strength, cognitive differences, and the effects of stress and time pressure. The time available should not be so restrictive relative to the time needed to perform the actions that personnel are not able to recover from any initial slips or errors in conducting the actions (i.e., there is some"recovery" time built in, should it be needed).Exhibit FR No. 16.1l. The exemption pgranted by the commission rely on their belief of a low probability of the occurrence of the event, which is outside the parameters for Appendix R Rule.3. When enquiring as to how the Commission was able to grant this exemption with members of the NRC staff, the response was that the industry was moving away from deterministic approaches for managing fire threats to reactor core to a probabilistic analysis. ] was told that even though the even would have severe consequences of this fire, the probability of it occurring was low enough by the Security related information-withhold under 10 C.F.R. 2.390 Page 4 Security related informati6n-withhold underl 0 C.F.R. 2.390 Exhibit FP No. 7 licensees analysis, that the exemption was justified. With this kind of rationale, why bother to protect redundant cables at all?Essentially, by this approach no protection could be found acceptable for the tunnel, with no manual suppression, with no detection, and no actual preparedness. in the event of a fire.In 1986 I was responsible for fully implementing the requirements of I OCFR50.48 and Appendix R to the Ranch Seco Nuclear Power Station owned by the SacramentoMunicipal Utilities District.As the Project Engineer, I was responsible for establishing compliance to Appendix R for the plant. This was a monumental effort, given that the licensee had delayed implementation, and in approximately one year, the physical changes'to the facility had to be designed, implemented, and where possible tested to meet sections III G of appendix R. Numerous procedures had to be developed from scratch, and operators required extensive training on successful safe shutdown of the facility with a fire initiated from any area of the plant that threatened safe shut down equipment. It was beyond comprehensible to think that any competent and reasonable operator would and should be required to take manual actions so desperately necessary that if not accomplished in 24 minutes with full suppression, the fire could have led to core melt. Plant management, the NRC Inspection Team;and NRR a like would each have declared a program crediting actions such as Security related information-withhold under 10 C.F.R. 2.390 Page 5 Security related infofmation-withhold under 10 C.F.R. 2.390 Exhibit FP No. 7 those as highly unrealistic, and would have never accepted them as successfully implementing Appendix R for the plant. An exemption request for this was unthinkable. It was ludicrous then, and it is ludicrous now. Of note is that this project was inspected by the NRC and was found as having zero open items regarding implementation of Appendix R.IMi. Use of alternative analysis under NFPA 805 as an escape from the deterministic rules enacted in 1979 and contains assumptions that counter recent codified law relevant to fire and Design Basis Threats.Use of NFPA 805 is being pushed by industry and the regulator alike. When the regulator acknowledged in 2002 the substantial non-compliance of numerous licensee holders to the requirements of Appendix R, in particular not crediting manual actions to maintain safety system and safe shutdown capability for one hour in certain areas, the alternative approach was invoked. The alternative approach fails to include the revisedbaseline assumptions required in IOCFR73.1 which includes fire induced events by personnel inside the facility having both knowledge of and target awareness of the consequences of the fire. The exemption granted requires an amended Safety Evaluation by the Staff, and as a result constitutes an unacceptable change to the operating license DPR No. 64 to the Indian Point Unit 3 Facility.1 declare under the penalty of perjury that the foregoing is true. and corTect.Security related information-withhold under 10 C.F.R. 2.390 Page 6 Exhibit FP No. 7 Exhibit FP No. 5 OMB Clearance No.: 3150-0011 UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION WASHINGTON, D.C. 20555-0001 April 10, 2006 NRC GENERIC LETTER 2006-03: POTENTIALLY NONCONFORMING HEMYC AND MT FIRE BARRIER CONFIGURATIONS ADDRESSEES All holders of operating licenses for light-water nuclear power reactors, except those who have ceased operations and have certified that fuel has been permanently removed from the reactor vessel.PURPOSE The U.S. Nuclear Regulatory Commission (NRC) is issuing this generic letter (GL) to: (1) Request that addressees evaluate their facilities to confirm compliance with the existing applicable regulatory requirements in light of the information provided in this GL and, if appropriate, take additional actions. Specifically, although Hemyc and MT 1 fire barriers in nuclear power plants (NPPs) may be relied on to protect electrical and instrumentation cables and equipment that provide safe shutdown capability during a fire, 2005 NRC testing has revealed that both materials failed to provide the protective function intended for compliance with existing regulations, for the configurations tested using the thermal acceptance criteria from the National Fire Protection Association (NFPA) Standard 251, "Standard Methods of Fire Tests of Building Construction and Materials." 2 The NRC staff applied the supplemental guidance in GL 86-10, Supplement 1, "Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used to Separate Redundant Safe Shutdown Trains Within the Same Fire Area" for the test details of thermocouple number and location, and (2) Require that addressees submit a written response to the NRC in accordance with NRC regulations in Title 10 of the Code of Federal Regulations (10 CFR)Section 50.54(f).ML053620142 Hemyc and MT are commonly-used names for the fire barrier types discussed in this GL. The references to Hemyc and MT.in this GL apply to any fire barriers using the materials and configuration described on pages 4 and 5 of this GL.2 American Society for Testing and Materials E-1 19, "Fire Test of Building Construction Materials," and NFPA 251 are essentially equivalent. GL 2006-03 Page 2of 12 BACKGROUND The NRC's concern with the performance of fire barriers at NPPs began with the failure of Thermo-Lag to pass performance tests in October 1989 at Southwest Research Institute. The tests were done for the Gulf States Utilities Company after visual observations of degradation of Thermo-Lag at River Bend Station. In June and August 1992, two sets of full-scale fire endurance tests on Thermo-Lag were conducted at Omega Point Laboratories in San Antonio, Texas, by Texas Utilities Electric Company for Comanche Peak Steam Electric Station, with similar results. In July 1992, the NRC sponsored a seriesof small-scale fire endurance tests at the National Institute of Standards and Technology. Again, 1-hour and 3-hour rated Thermo-Lag barrier material failed to consistently provide its intended protective function.On August 6, 1991, the NRC issued Information Notice (IN) 91-47, "Failure of Thermo-Lag Fire Barrier Material to Pass Fire Endurance Test," the first in a series of INs issued between 1991 and 1995 on performance test failures and installation deficiencies related to Thermo-Lag 330 fire barrier systems.Because of questions about the ability of 1-hour and 3-hour rated Thermo-Lag fire barrier material to perform its specified function, and because of the widespread use of Thermo-Lag in the nuclear industry, the NRC issued the following generic communications to inform licensees of the Thermo-Lag test results and to request that licensees implement appropriate compensatory measures and develop plans to resolve any noncompliances with 10 CFR 50.48:* Bulletin 92-01, "Failure of Thermo-Lag 330 Fire Barrier System To Maintain Cabling in Wide Cable Trays and Small Conduits Free From Fire Damage," June 24, 1992, Bulletin 92-01, Supplement 1, "Failure of Thermo-Lag 330 Fire Barrier System To Perform its Specified Fire Endurance Function," August 28, 1992, GL 92-08, "Thermo-Lag 330-1 Fire Barriers," December 17, 1992, and Supplement 1 to GL 86-10, "Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used To Separate Redundant Safe Shutdown Trains Within the Same Fire Area," March 25, 1994.GL 92-08 included the NRC staff expectation that licensees review other fire barrier materials and systems credited for 10 CFR 50.48 compliance and consider actions to avoid problems similar to those identified with Thermo-Lag. in response, the licensees reviewed their fire protection safe shutdown plans to determine if corrective actions were needed. Some licensees had made conservative commitments and installed Thermo-Lag in locations where it was not needed to satisfy NRC requirements; therefore, no corrective actions were required. Where fire barrier materials were required, licensees took one or a combination of the following corrective actions: Rerouted cables through other fire areas so that redundant safe shutdown trains were not located in the same fire area, GL 2006-03 Page 3 of 12 Replaced Thermo-Lag, or the affected material, with an alternative rated fire barrier material, Upgraded the installed fire barriers to a rated configuration, and Concluded that certain Thermo-Lag barriers were no longer required.Subsequently, deficiencies were also identified in other fire barrier materials. In 1993, for example, Kaowool installed as a 1-hour rated fire barrier was found to be unable to pass circuit integrity tests. In response, the NRC staff reassessed previous reviews of Kaowool' fire barriers and informed the industry and the Commission of the potential failure of Kaowool' to perform as intended and suggested additional testing of Kaowool (SECY-99-204; Agencywide Documents Access and Management System (ADAMS) Accession No. ML992810028). To resolve the issue, the industry took voluntary corrective actions.In August 1993, the Nuclear Energy Institute (NEI) formed a Fire Barrier Review Ad Hoc Advisory Committee to address the adequacy of fire barrier materials other than Thermo-Lag. The Committee performed reviews of the original testing of the fire barrier material Hemyc in the early 1980s in Spain, and concluded that Hemyc was differently constructed than Thermo-Lag 330-1 and was not subject to the same failure modes as Thermo-Lag.330-1. In May 1994, this review was documented in the NEI report, "Documentation of the Adequacy of Fire Barrier Materials in Raceway Applications Vis-a-vis Failure Characteristics Inherent to the Thermo-Lag 330-1." In September 1993, the NRC staff conducted pilot-scale fire endurance tests at the National Institute of Standards and Technology to investigate the performance characteristics of fire barrier materials. Because simplified and small-scale assembly models were used, the NRC staff intended to apply the test results for screening purposes only. The test results indicated unacceptable performance in approximately one-third of the assemblies tested. Although Hemyc was tested, the result was inconclusive because the configuration tested was inconsistent with the installation configuration recommended by the manufacturer. Details of these tests are documented in a March 1994 report (ADAMS Accession No. ML96101 70283).In September 1995, after assessing the scope of licensees' corrective actions, the NRC staff informed the Commission that a broader scope of inspections was needed to-close out the Thermo-Lag. action plan due to the broad range of corrective action options submitted by licensees. Rather than the stand-alone Thermo-Lag fire barrier inspection program .proposed in the original action plan (submitted to the Commission in 1992), the NRC staff recommended a Fire Protection Functional Inspection (FPFI) program. SECY-96-267 (ADAMS Accession No.ML9701080067) provides details of the proposed FPFI, and includes a review of safe shutdown.design and licensing bases. The NRC staff developed and implemented the FPFI program following issuance of the Commission's staff requirements memorandum in February 1997.Beginning in late 1999, three plant-specific findings by the NRC staff raised concerns about the performance of Hemyc and MT fire barriers.In November 1999, during an inspection at Shearon Harris Nuclear Power Plant (IR 50-400/99-13, ADAMS Accession No. ML003685341), the inspection team noted thatthe acceptance of the Hemyc and MT fire barrier materials used was based on American Nuclear Insurers (ANI) Bulletin No. 5 test acceptance criteria, even though GL 2006-03'Page 4 of 12 the ANI test methodology clearly stated that the tests were for insurance purposes only and were not the equivalent of fire barrier endurance tests for fire barrier ratings.In October and November 2000, during an inspection at McGuire, Units 1 and 2 (IR 50-369/00-09, 50-370/00-09, ADAMS Accession No. ML003778709), the inspection team noted that the licensee was unable to provide documentation demonstrating protection by Hemyc fire barrier material used to separate safe shutdown functions for two trains within a-single fire area.In September 2000, during an inspection at Waterford 3 (IR 50-382/00-07, ADAMS Accession No. ML003773900), the inspectors noted that the Hemyc materials were installed in.. configurations which were usually not bounded by the existing tests.In June 2001, the NRC initiated confirmatory fire tests in response to Task Interface Agreement 99-028 (ADAMS Accession No. ML003736721), after concluding that existing testing was likely insufficient to qualify Hemyc or MT as rated fire barriers. The NRC tests were based on ASTM E-1 19 standard time-temperature conditions, for typical Hemyc and MT installations used in U.S. NPPs. Thermocouple placement was based on the current NRC guidance in GL 86-10, Supplement

1. :The test results indicated that Hemyc and MT fire barriers.did not pass the criteria to achieve a 1-hour fire rating for Hemyc or a 3-hour fire rating for MT for the configuration tested.On April 1, 2005, the NRC issued IN 2005-07, "Results of Hemyc Electrical Raceway Fire*Barrier System Full Scale Fire Testing." This IN describes the results of the NRC-sponsored confirmatory testing of Hemyc. However, the NRC staff recognized that additional evaluations would be needed to determine whether regulatory compliance exists in light of the concerns identified in IN 05-07.On April 29, 2005, the NRC staff held a public meeting with licensees and interested members of the public to discuss the Hemyc and MT test results and the NRC staff's intention to take additional regulatory action to ensure that appropriate measures were under way for compliance with 10 CFR 50.48 requirements at affected plants. This GL is the follow-on to IN 05-07.On January 20, 2006, the Director of the Office of Nuclear Reactor Regulation (NRR).published a notice in the Federal Register (71 FR 3344) announcing the issuance of a Director's Decision granting in part a 10 CFR 2.206 petition filed by the Nuclear Information and Research Service.The petition requested, among other things, that the NRC determine the extent of condition of'the inoperable fire barrier through the use of a generic communication, and require sites that use these fire barriers to provide justification for operation in their response to the generic communication.

The Director of NRR granted these requested actions in the petition and will use this generic communication to perform the requested actions. Issuance of this GL constitutes the regulatory action referred to in the Director's Decision.The NRC has established a Web page to keep the public informed of the status of the Hemyc/MT fire barrier issue at http://www.nrc..qov/reactors/operatinq/ops-experiencei fire-protection/fire-barriers.html. This page provides links to information on related fire protection issues, along with documentation of NRC interactions with industry (including generic communications, industry submittals, meeting notices, presentation materials, and meeting summaries). The NRC will continue to update this Web page as new information becomes available. GL 2006-03 Page 5 of 12 Hemyc Construction-Hemyc fire barrier material consists of mats of 2 inch Kaowool ceramic fiber insulation inside an outer covering of Refrasil3 high-temperature fabric. The mats are custom-sized for the electrical raceway, junction box, or other intended application, and machine-stitched to produce the factory mats. Hemyc mats, which are installed over a metal frame to embody the 2 inch air gap design, are identical except that 11/2 inch Kaowool is used instead of 2 inch material.MT Construction-MT is usually used with conduits and has four layers. The first layer, closest to the conduit or other intended application, is 1 inch of Kaowool' ceramic fiber blanket wrapped in a fiberglass fabric. The second layer is a 2 mil sheet of stainless steel. The third layer is a hydrate packet. This packet is made, by stitching together packets of aluminum trihydrate in a fiberglass-coated fabric. The fourth and outermost layer is a 11/2 inch Kaowool'blanket wrapped in Refrasil'. The configuration is slightly different for air drops and structural supports. Air drops use a 3 inch blanket of Kaowool' as the inner layer. Structural supports do not have the hydrating packet layer or the stainless steel sheet.DISCUSSION Hemyc and MT fire barrier systems were installed at NPPs to protect circuits and other electrical and instrumentation features in order to meet regulatory requirements and in accordance with plant-specific commitments. The NRC conducted confirmatory testing of Hemyc and MT materials at the Omega Point Laboratories in San Antonio, Texas. The tests indicated that when tested to NFPA 251 thermal acceptance criteria, with thermocouples placed in accordance with the guidance in GL 86-10, Supplement 1, neither the Hemyc-nor the MT fire barrier system could provide its rated fire barrier protection. Fire barriers installed in configurations that are not capable of providing the designed level of protection are considered nonconforming installations. The NRC staff noted at least two failure modes in the limited test program. One failure mode resulted from shrinkage of the outer covering, exposing the interior surfaces or layers to the fire. The second failure mode resulted from failure to adequately protect steel structural supports intruding into the fire barrier. The standard used by some utilities required protection of 3 inches of intruding steel for the Hemyc 1-hour fire barrier and 18 inches of intruding steel.for the MT 3-hour fire barrier. The test results indicated that additional protection of intruding steel was required to achieve a 1-hour or 3-hour fire rating.Based on these test results, the NRC is concerned that the Hemyc and MT fire barriers may not provide the level of fire endurance intended by licensees, and that licensees that use Hemyc or MT may not be conforming with their licensing basis. 10 CFR 50.48 requires that each operating NPP have a fire protection plan that satisfies 10 CFR Part 50, Appendix A, General Design Criterion (GDC) 3, "Fire Protection." GDC 3 requires that structures, systems, and components important to safety be designed and located to minimize, in a manner consistent with other requirements, the probability and effect of fires and explosions. Fire protection features required to satisfy 10 CFR 50.48 include features to limit fire damage to structures, systems, or components important to safety so that the capability to shut down the plant safely is ensured. One means of complying with this requirement is to separate one safe shutdown train from its redundant train with rated fire barriers. The duration of fire resistance required of 3 Refrasil was used during NRC tests. Siltemp and Refrasilr were tested by the NRC and determined to be essentially equivalent (ADAMS Accession No. ML051190055). GL 2006-03 Page 6 of 12 the barriers, usually 1-hour or 3 hours, depends on the other fire protection features in the fire area. The NRC issued guidance on acceptable methods of satisfying GDC 3 in the branch technical positions (BTPs) and GLs identified in the "Applicable Regulatory Guidance" section of this GL.The NRC staff requests licensees to review their fire protection programs in light of information in IN 05-07 and this GL and implement appropriate compensatory measures and develop plans to resolve any nonconformances. NRC Inspection Manual, Part 9900, Technical Guidance, "Operability Determinations &Functionality Assessments for Resolution of Degraded or Nonconforming Conditions Adverse to Quality or Safety," dated September 26, 2005, provides guidance on acceptable treatment of nonconformances. Licensees are also encouraged to review Regulatory Issue Summary 2005-07, "Compensatory Measures to Satisfy the Fire Protection Program Requirements," in determining the appropriate compensatory measures to meet fire protection program requirements for nonconforming fire barrier installations. All licensees should consider the impact of fire barrier functionality on affected equipment and assess the impact on plant safety.If licensees identify nonconforming conditions, they have several options. A licensee may make plant modifications, for example, replacing the Hemyc or MT fire barriers with an appropriately rated fire barrier material, upgrading the Hemyc or MT to a rated barrier, or rerouting cables or instrumentation lines through another fire area. Alternatively, licensees may voluntarily commit to 10 CFR 50.48(c), NFPA 805 Standard, and by following the process in the rule and the NFPA 805 standard, establish compliance through the application of technical evaluations that consider potential adverse effects, risk, defense-in-depth (DID), and safety margins.APPLICABLE REGULATORY REQUIREMENTS NRC regulations in 10 CFR 50.48 and 10 CFR Part 50, Appendix A, GDC 3, require each operating NPP to have a fire protection plan providing ,post-fire safe shutdown. That is, a means must be provided to limit fire damage to structures, systems, or components important to safetyso that the capability to shut down the plant safely is ensured.APPLICABLE REGULATORY GUIDANCE The NRC issued guidance on acceptable methods of satisfying the regulatory requirements of GDC 3 in Auxiliary and Power Conversion Systems Branch (APCSB) BTP 9.5-1, ."Guidelines for Fire Protection for Nuclear Power Plants," May 1, 1976; AppendixA to APCSB BTP 9.5-1, February 24, 1977; and Chemical Engineering Branch BTP 9.5-1, "Fire Protection for Nuclear Power Plants," July 1981. In response to licensees' questions, the NRC staff provided additional guidance on fire barriers in GL 86-10, "Implementation of Fire Protection Requirements." In the BTPs and in GL 86-10, the NRC staff stated that the fire resistance ratings of fire barriers should be established in accordance with NFPA 251, by subjecting a test specimen that represents the materials, workmanship, method of assembly, dimensions, and configuration for which a fire rating is desired to a "standard fire exposure." Supplement 1 to GL 86-1.0 provides additional guidance for testing fire barrier endurance and for evaluating deviations from tested GL 2006-03 Page 7 of 12 configurations. This guidance is repeated in RG 1.189, "Fire Protection for Operating Nuclear Power Plants." REQUESTED ACTIONS Within 60 days of the date of this letter, all addressees are requested to determine whether or not Hemyc or MT fire barrier material is installed and relied upon for separation and/or safe shutdown purposes to satisfy applicable regulatory requirements. In addition, licensees are asked to describe controls that were used to ensure the adequacy of other fire barrier types, consistent with the assessment requested in GL 92-08.Addressees that credit Hemyc or MT for compliance are requested to provide information regarding the extent of the installation, whether the material complies with regulatory requirements, and any compensatory actions in place to provide equivalent protection and maintain the safe shutdown function of affected areas of the plant in light of the recent findings associated with Hemyc and MT. Licensees are requested to provide evaluations to support conclusions that they are in compliance with regulatory requirements for the Hemyc and MT applications. Licensees that cannot justify their continued reliance on Hemyc or MT are requested to provide a description of corrective actions taken or planned and a schedule for milestones, including when full compliance will be achieved.Compensatory and corrective actions must be implemented in accordance with existing regulations commensurate with the safety significance of the nonconforming condition. The NRC expects all licensees to fully restore compliance with 10 CFR 50.48 and submit the required documentation to the NRC by December 1, 2007.REQUESTED INFORMATION All addressees are requested to provide the following information:

1. Within 60 days of the date of this GL, provide the following:

a. A statement on whether Hemyc or MT fire barrier material is used at their NPPs and whether it is relied upon for separation and/or safe shutdown purposes in accordance with the licensing basis, including whether Hemyc or MT is credited in other analyses (e.g., exemptions, license amendments, GL 86-10 analyses).

b. A description of the controls that were used to ensure that other fire barrier types relied on for separation of redundant trains located in a single fire area are capable of providing the necessary level of protection..

Addressees may reference their responses to GL 92-08 to the extent that the responses address this specific issue.2. Within 60 days of the date of this GL, for those addressees that have installed Hemyc or MT fire barrier materials, discuss the following in detail: a. The extent of the installation (e.g., linear feet of wrap, areas installed, systems protected), GL 2006-03 Page 8 of 12 b. Whether the Hemyc and/or MT installed in their plants is conforming with their licensing basis in light of recent findings, and if these recent findings do not apply, why not, c. The compensatory measures that have been implemented to provide protection and maintain the safe shutdown function of affected areas of the plant in light of the recent findings associated with Hemyc and MT installations, including evaluations to support the addressees' conclusions, and d. A description of, and implementation schedules for, corrective actions, including a description of any licensing actions or exemption requests needed to support changes to the plant licensing basis.3. No later than December 1, 2007, addressees that identified in 1.a. Hemyc and/or MT configurations are requested to provide a description of actions taken to resolve the nonconforming conditions described in 2.d.REQUIRED RESPONSE In accordance with 10 CFR 50.54(f), an addressee is required to respond as described below so that the NRC can determine whether a facility license should be modified, suspended, or revoked, or whether other action should be taken.Within 30 days of the date of this GL, addressees are required to submit a written response if they are unable to provide the information or it cannot meet the requested completion date.Addressees are requested to address any alternative course of action that they-.propose to take, including the basis for the acceptability of the proposed alternative course of action.The required written response should be addressed to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, 11555 Rockville Pike, Rockville, Maryland 20852, under oath or affirmation under the provisions of Section 182a of the Atomic Energy Act of 1954, as amended, and 10 CFR 50.54(f). In addition, a copy of the response should be submitted to the appropriate regional administrator. REASON FOR INFORMATION REQUEST The recent confirmatory testing of the Hemyc and MT fire barriers revealed that similar barriers installed at NPPs may not perform their intended protective function during a fire. The NRC staff will review the responses to this GL and will notify addressees if concerns are identified regarding compliance with NRC regulations. The NRC staff may also conduct inspections to determine addressees' effectiveness in addressing the GL.RELATED GENERIC COMMUNICATIONS

1. Regulatory Issue Summary 05-07, "Compensatory Measures To Satisfy the Fire Protection Program Requirements," April 19, 2005.2. IN 05-07, "Results of HemycElectrical Raceway Fire Barrier System Full Scale'Fire Testing," April 1,. 2005.

GL 2006-03 Page 9 of 12 3. IN 99-17, "Problems Associated with Post-Fire Safe-Shutdown Circuit Analysis," June 3, 1999.4. IN 95-52, Supplement 1, "Fire Endurance Test Results for Electrical Raceway Fire Barrier Systems Constructed from 3M Company Interam Fire Barrier Materials," March 17, 1998.5. IN 95-49, Supplement 1, "Seismic Adequacy of Thermo-Lag Panels," December 10, 1997.6. RIS 2005-20, Revision to Guidance Formerly Contained in NRC Generic Letter 91-18,"Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability,"ýSeptember 26, 2005.7. IN 97-70, "Potential Problems With Fire Barrier Penetration Seals," September 19, 1997.8. IN 97-59, "Fire Endurance Test Results of Versawrap Fire Barriers," August 1, 1997.9. IN 94-86, Supplement 1, "Legal Actions Against Thermal Science, Inc., Manufacturer of Thermo-Lag," November 15, 1995.10. IN 95-52, "Fire Endurance Test Results for Electrical Raceway Fire Barrier Systems Constructed from 3M Company Interam Fire Barrier Materials," November 14, 1995.11. IN 95-49, "Seismic Adequacy of Thermo-Lag Panels," October 27, 1995.12. IN 95-32, "Thermo-Lag 330-1 Flame Spread Test Results," August 10, 1995.13. IN 95-27, "NRC Review of Nuclear Energy Institute, "Thermo-Lag 330-1 Combustibility Evaluation Methodology Plant Screening Guide," May 31, 1995.14. IN 94-86, "Legal Actions Against Thermal Science, Inc., Manufacturer of Thermo-Lag-" December 22, 1994.15. IN 94-34, "Thermo-Lag 330-660 Flexi-Blanket Ampacity Derating Concerns," May 13, 1994.16. IN 94-28, "Potential Problems With Fire Barrier Penetration Seals," April 5, 1994.17. GL 86-10, Supplement 1, "Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used to Separate Redundant Safe Shutdown Trains Within the Same Fire Area," March 25, 1994.18. IN 94-22, "Fire Endurance and Ampacity Derating Test, Results for 3-Hour Fire-Rated Thermo-Lag 330-1 Fire Barriers," March 16, 1994..19. IN 93-41, "One Hour Fire Endurance Test Results for Thermal Ceramics Kaowool, 3M Company FS-195 and 3M Company Interam E-50 Fire Barrier Systems," May 28, 1993. GL 2006-03 Page 10 of. 12 20. IN 93-40, "Fire Endurance Test Results for Thermal Ceramics FP-60 Fire Barrier Material," May 26, 1993.21. GL 92-08, "Thermo-Lag 330-1 Fire Barriers," December 17, 1992.22. IN 92-82, "Results of Thermo-Lag 330-1 Combustibility Testing," December 15, 1992.23. Bulletin 92-01, Supplement 1, "Failure of Thermo-Lag 330 Fire Barrier System to Perform its Specified Fired Endurance Function," August 28, 1992.24. IN 92-55, "Current Fire Endurance Test Results for Thermo-Lag Fire Barrier Material," July 27, 1992.25. Bulletin 92-01, "Failure of Thermo-Lag 330 Fire Barrier System to Maintain Cabling in Wide Cable Trays and Small Conduits Free From Fire Damage,." June 24, 1992.26. IN 92-46, "Thermo-Lag Fire Barrier Material Special Review Team Final Report Findings, Current Fire Endurance Tests, and Ampacity Calculation Error," June 23, 1992.27. IN 91-79, "Deficiencies in the Procedures for Installing Thermo-Lag Fire Barrier Materials," December 6, 1991.28. IN 91-47, "Failure of Thermo-Lag Fire Barrier Material To Pass Fire Endurance Test," August 6, 1991.29. IN 88-56, "Potential Problems With Silicone Foam Fire Barrier Penetration Seals," August 4, 1988.30. GL 88-12, "Removal of Fire Protection Requirements From Technical Specifications," August 2, 1988.31. GL 86-10, "Implementation of Fire Protection Requirements," April 26, 1986.32. GL 83-33, "NRC Position on Certain Requirements of Appendix R to 10 CFR Part 50," October 19, 1983.33. GL 81-12, "Fire Protection Rule (45 FR 76602, November 19, 1980)," February 20, 1981.BACKFIT DISCUSSION Under the provisions of Section 182.a of the Atomic Energy Act of 1954, as amended, and 10 CFR 50.54(f), this GL asks addressees to evaluate their facilities to confirm compliance with the existing applicable regulatory requirements discussed in this GL. Specifically, although Hemyc and MT fire barriers in NPPs may be relied on to protect electrical and instrumentation cables and equipment that provides safe shutdown capability during a fire, 2005 NRC testing.revealed that these materials may not provide the protective function intended for compliance GL 2006-03 Page 11 of 12 with existing regulations. The NRC staff performed these tests using the fire barrier thermal acceptance criteria from NFPA 251; the test details of thermocouple spacing and arrangement were applied in accordance with the guidance in GL 86-10, Supplement 1.This GL is an information request in accordance with 10 CFR 50.54(f). Information requests are not considered by the NRC to be subject to the Backf it Rule, 10 CFR 50.109. Furthermore, this GL is based on current regulations and guidance and does not constitute a change in NRC staff position. Accordingly, the NRR staff's interpretations of current fire protection requirements in this GL do not constitute backfitting as defined in 10 CFR 50.109(a)(i). The NRC staff has determined, in accordance with 10 CFR 50.54(f), that the information sought in this GL is necessary to verify licensee compliance with current licensing basis for each facility. If licensees identify nonconforming conditions, they have several options. A licensee may make plant modifications, for example, replacing the Hemyc or MT fire barriers with an appropriately rated fire barrier material, upgrading the Hemyc or MT to a rated barrier, or rerouting cables or instrumentation lines through another fire area. Alternatively, licensees may voluntarily commit to 10 CFR 50.48(c), NFPA 805 Standard, and by following the ,process in the rule and the NFPA 805 Standard, establish compliance through the application of technical evaluations that consider potential adverse effects, DID, and safety margins.FEDERAL REGISTER NOTIFICATION A notice of opportunity for public comment on this GL was published in the Federal Register (70 FR 42596) on July 25, 2005.SMALL BUSINESS REGULATORY ENFORCEMENT FAIRNESS ACT In accordance with the Small Business Regulatory Enforcement Fairness Act of 1996, the NRC has determined that this GL is not a major rule and the Office of Information and Regulatory Affairs of the Office of Management and Budget (OMB) has confirmed this determination. PAPERWORK REDUCTION ACT STATEMENT This GL contains information collection requirements that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). These information collections were approved by OMB, clearance no. 3150-0011, which expires February 28, 2007.The burden to the public for these mandatory information collections is estimated to average 120 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the information collection. Send comments on any aspect of these information collections, including suggestions for reducing the burden, to the Records and FOIA/Privacy Services Branch (T5-F52), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, orby Internet electronic mail to INFOCOLLECTS@NRC.GOV; and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202 (3150-0011), Office of Management and Budget, Washington, DC 20503. GL 2006-03 Page 12 of 12 Public Protection Notification The NRC may not conduct or sponsor, and a person, is not required to respond to, an information collection, unless the requesting document displays a currently valid OMB control number.CONTACT Please direct any questions about this matter to the technical contacts orthe Lead Project Manager listed below, or to the appropriate NRR project manager.IRA by H. Nieh for!Christopher I. Grimes, Director Division of Policy and Rulemaking Office of Nuclear Reactor Regulation Technical Contacts: Daniel Frumkin, DRA/NRR Angie Lavretta, DRA/NRR (301) 415-2280 (301) 415-3285 E-mail: dxfl@nrc.gov E-mail: axl3@nrc.gov Lead Project Manager: Quynh T. Nguyen, PGCB/NRR 301-415-8123 E-mail: qtn@nrc.gov Note: NRC generic communications may be found on the NRC public Web site, http://www.nrc.gov, under Electronic Reading Room/Document Collections. Exhibit FP No. 8 Wu q, 9A1T3 q10+~~31119t , -l>_ 1* .. .I ct- *-ýA1 rA- 4 PR,-1_.S- ION SECT IONQ- G~ottO. 'S-P.]S--------- --PAR~iAL PA~l TUSNLE40.... ..... Z r- *L-4 -*1 P.A.B.- LCTO VM~n.OWED CrnMs ,=NOLDATED EDISON COMPANY A ~A )A L I--Q" Exhibit FP No. 10 REPORT ON THE NUCLEAR REGULATORY COMMISSION REACTOR SAFETY REVIEW PROCESS By Robert D. Pollard Project Manager Division of Project Management U. S. Nuclear Regulatory Commission February 6, 1976 The purpose of this report is to prove two points. The points are that in reviewing the safety of nuclear reactors the Nuclear Regulatory Commission suppresses the existence of unresolved safety problems and fails to resolve those problems prior to allowing reactors to operate. The principal evidence of this practice is contained in "For Official Use Only" docu-ments of the AEC and the NRC in which staff experts discuss reactor safety problems not brought to the attention of the public, particularly if to do so could delay the issuance of a license for a reactor.This report is not a definitive statement of every unre-solved and previously undisclosed safety problem. Such a re-port would require months of preparation by a task force and free, unfettered access to all of the internal documents of the NRC. In the brief time available all that could be done is to select some specific examples of what are recurring prob-lems. The two large reactors owned by Consolidated Edison Company of New York and the Power Authority of the State of New York known as Indian Point 2 and Indian Point 3 have been selected for more thorough review. Their proximity to New York City (24 miles) and the substantial controversy that has sur-rounded them made them particularly appropriate for study. The public attention would presumably have produced the maximum dis-closure of safety problems. The proximity to New York City would presumably warrant the most careful safety review. As will be seen, even here where the highest safety should have been achieved, glaring defects remain.This report is not a definitive safety evaluation of the Indian Point plants. Such an analysis has purportedly been completed by the Regulatory Staff. Rather specific examples are selected to illustrate the point being made. The examples begin in the late 1960'.s during the construction of Indian Point 2 and follow the history of Indian Point 2 and 3 through to today. This historical perspective highlights the. long-standing existence of the review practices which suppress. the existence and ignore the resolution of serious safety problems --practices which have survived four Commission Chairpersons and seen two complete turnovers in the membership of the Commission. Clearly the problems are deep-rooted and extensive and the cure will require a far greater involvement of the Commissioners them-selves than has previously occurred and a real commitment to the principle of "adequate protection for public health and safety" rather than "necessary protection for the vendor and utility investment". This will hopefully be the first of many reports on the NRC safety review process. Further reports will depend upon the NRC's willingness to-continue to allow access to internal docu-ments. A decision now to shut the door on access to those documents will of course not solve the problems, only hide them.What is most needed now is an open, public scrutiny of the NRC hand in hand with a Commissioner directed and conducted investi-gation. Unless this is done the same forces responsible for the sordid Indian Point story will apologize, camouflage and obfuscate the problems out of the public domain and it will once again be business as usual.The four specific examples discussed in this Report relate to serious safety problems which currently exist at Indian Point 2 and 3. However, they are also to some extent generic problems which affect many plants. For instance the problem of reactor coolant pump overspeed remains unresolved for all PWRs. The problems described are by no means isolated examples. The Tech-nical.Activities Safety Report for December, 1975, a document claimed to be an "internal working paper" although it is pub-lished- quarterly and lists the status of technical reviews seek-ing to resolve safety problems, lists nearly 183 specific serious unresolved safety problems as "currently receiving attention, [and]which have an important impact on the licensing review process" (Category A)'. Another 44equally serious unresolved safety problems are described as "requiring NRR [Office of Nuclear Reactor Regulation] attention, but review has not been initiated because of manpower limitations or information is not available" (Category B). A third category of 8 serious unresolved safety problems involve. technical safety activities "planned for the future that would improve the quality of the review or facilitate thereview process" (Category C).These generic unresolved safety problems are so-fundamental to the basic evaluation of reactor safety that it is not possible to conclude on a technical basis that operation of any nuclear reactors is safe enough. to provide reasonable assurance of ade-quate protection for the public health and safety. Even com-pliance with safety regulations can not be determined unless and until the unresolved safety problems have been resolved.The seriousness of the unresolved problems is apparent to anyone who reads the December, 1975 Status Report. For illustra-tion purposes a few examples are cited below: Cateoorv A -- Currently receiving attention and have an im-portant impact on 'the licensing review process.Title: Definition of Experimental Program for Structural Response Evaluation to Turbine Missile Impacts Problem Definition: Information in the area of structural response to impacts of tur-bine missiles is seldom available if not totally lacking. The safety concerns derived from consideration of occurrence of a missile generated by failure of a turbine have been consistently expressed in almost all the ACRS letters to the Commission recom-mending issuance of CP or OL licenses during the last two years.Since there are significant differences between the parameters governing turbine generated missiles and that associated with tornado, the design procedures applicable to tornado generated missiles may not be applicable to protection barrier design against turbine missiles. An experimental program intended to develop design procedures and criteria for use in the protection barrier design against turbine missiles is urgently needed to resolve the outstanding concerns' of both the ACRS and the NRC staff. Current Status Only limited information related to turbine missiles is avail-able. As a part of the work scope for item II.A.B.I, a pre-liminary definition for turbine missile experimental program was planned. However, NSWC could not undertake this task due to lack of available personnel. EPRI has indicated its in-terest to undertake limited tests designed to evaluate the im-pact of turbine missiles on reinforced concrete barriers.Plans for Resolution: A fairly extensive experimental program intended for obtaining the structural response data to turbine missile impacts will be proposed in FY 77. The program scope will depend on future work to be undertaken by EPRI. [EPRI is industry supported) Schedule for Comoletion: To be established later.Cateaorv B-- Require attention but review not*yet initiated due to lack Of manpower or lack of information. Title: Calculation of Dose Rates from Certain Radioactive Sources at Nuclear Facilities Problem Definition: In order to evaluate radiation exposure to nuclear power plant employees, visitors, onsite construction workers, etc., it is necessary to determine the dose rate at specific onsite loca-tions due to specific radioactive sources in the plant. These include storage tanks for low level radioactive liquids, the turbine building sources in a BWR, etc. Simple calculational methods are needed to give reasonably accurate, fast results for these cases for various evaluations which the staff is re-quired to carry out.Current Status: Some empirical formula exist for such cases. These are limited in application, in both accuracy and useful range. New data have been taken at two BWR power plants and are being evaluated. Plans for Resolution: Discussions have been held with various contractors in the area of radiation transport calculations. Measurements have been made around certain BWR nuclear -power plants. It is our plan to use the information gathered in both these activities to develop either better empirical formula or to develop calcula-tional methods which will treat the cases of concern.Schedule for Comoletion: One Year Category C -- Reviews planned for the future that would improve the quality of or facilitate the safety reviews.Title: Economics of Occupational Radiation Exposure Reduction at Nuclear Facilities Problem Definition: Very little data exists on the costs related to the many methods available for occupational radiation exposure reduction at nuclear power plants. Information is also lacking on the-benefit in man-rem reduction that is related to these methods. These data are needed in order to make a quantitative determination of the oc-cupational radiation exposure that is ALAP for a particular nuclear facility.Current Status: Talks have been held with various segments of industry. Data has been collected on exposure related to certain activities and steps have been taken to get additional pertinent input.Plans for Resolution: As data and information become available, Radiation Protection Section staff members will develop a generic description of the proper means to evaluate the economics of radiation exposure reduction. Some guidance in this regard is being developed for the revised Regulatory Guide 8.8, now in progress.Schedule for Completion: Two years What follows is a description of four specific serious safety problems at Indian Point 2 and 3 which have not been resolved but the existence of which are well known to those at NRC charged with the responsibility of deciding whether to allow a reactor to begin operating or to continue to operate. These "responsible" officials have no adequate technical justification for allowing reactor operation in the face of these problems. The justifica-tion is the implementation of the NRC policy that priority be given to the goal that reactor operations not be interrupted or delayed. On rare occasions this goal has not been achieved such as when an Intervenor "discovers" the existence of one of these unresolved safety problems (i.e. the fuel densification problem resulting in derating or operating modifications to twenty BWRs). Hopefully the disclosures contained in this Re-port will result in similar actions. IL1USTRATIVE! SAFETY PROBLEMS T. CONTAINMENT ISOLATION The General Design Criteria set forth in Appendix A to 10 CFR Part 50 establish the "minimum requirements for the princi-pal design' criteria for water-cooled nuclear power plants".(10 CFR Part 50.34) General Design Criteria 54, 55, 56 and 57 establish minimum requirements concerning isolation of piping systems that penetrate the reactor containment. Criterion 55 and Criterion 56 specify four containment isolation valve ar-rangements. Each isolation valve arrangement involves a combi-nation of locked closed isolation valves and/or automatic iso-lation valves to prevent the release of radioactive material.These criteria specify that one of the four valve arrangements"shall be provided -- unless it can be demonstrated that the containment isolation provisions for a specific class of lines, such as instrument lines, are acceptable on some other defined basis".In contrast to these specific requirements, the staff is aware that many of the lines at the Indian Point 3 plant do not have isolation valve arrangements which correspond to any of the arrangements specified by Criterion 55 and Criterion

56. Further-more, neither the staff nor the licensee has identified a "specific class of lines" that need not utilize the specified arrangements.

Nor has either the staff or licensee identified "some other de-fined basis" on which the Indian Point 3 isolation valve arrange-ment can be demonstrated to be acceptable. Rather than adhere to the requirements of the General Design Criteria, the licensee has proposed technical specifications which-would permit plant operation with containment isolation valves (which have no provision for automatic closure) in their open positions. The licensee states that reliance on the reactor operator to manually initiate closure of such valves is adequate.The staff apparently gives tacit approval to this evasion of NRC regulations by stating the "We have reviewed the isolation valve arrangements for conformance to General Design Criteria 54, 55, 56 and 57, and conclude that the design meets the intent of these criteria". (Safety Evaluation of the Indian Point Nuclear Generating Unit No. 3, dated September 21, 1973).This is one of the safety problems I became aware of as pro-ject manager for Indian Point 3. The pressure to issue a license on a schedule compatible with the applicant's desires notwith-standing, I questioned those staff personnel with specific exper-tise in the reactor containment area about their bases for ac-cepting the Indian Point 3 design. Their responses indicated that: a) it was known that the design did not meet the General Design Criteria, b) the design was not different than other li-censed nuclear power plants, and c) it was too late to require design changes to the plant. These experts stated that they saw no reason to change their previous conclusions as stated in the Indian Point 3 Safety Evaluation Report and referenced above. The bases for these conclusions remain obscure if not non-existent. The staff's' Safety Evaluation Report mentions~the "double barrier protection -- provided so that no single valve or piping failure can result in loss of containment integrity". Also described briefly are the two groups of containment isolation valves which are closed automatically by the safety injection signal and the actuation of containment spray. No mention is made of the non-automatic containment isolation valves, the criteria used to judge the acceptability of reliance on manual operator action, or the specific "closed system" which is purported to constitute one of the barriers to escape of radioactive materials. I believe that the-provisions for containment isolation fol-lowing an. accident at Indian Point 3 should be evaluated or re-evaluated. If the present design and proposed technical specifi-cations are found acceptable, the NRC should state the specific technical bases for its conclusion that the design meets the NRC regulations. Indian Point 2 should also be evaluated in this regard. It is likely that the situation there is the same as or more hazardous than the situation at Indian Point 3.The staff should have discussed the non-automatic containment isolation valves, the nature of the "closed.systems upon.which the "acceptability" was partially based, and the criteria used. -II-to judge the adequacy of manual operator action.The Safety Evaluation Report, in discussing only those aspects of containment isolation which were not a problem and then stating the conclusion that the design meets the "intent" of the General Design Criteria, presented a more favorable picture of contain-ment isolation than the actual design warrants. By presenting only the favorable aspects, the remainder of the licensing pro-cess, i scrutiny by public, independent decisions by the licensing boards, was subverted and therefore less likely to be able to reach a sound decision based on all the facts.II. SUBMERGED VALVES During my assignment as project manager for the Indian Point 3 plant, the problem concerning submerged valves arose. Basically, this problem is that following an accident, much of the water from the reactor coolant system and from operation of the emer-gency core cooling systems collects in the containment. Recently, it has been discovered that many valves located inside the contain-ment, including some valves intended to be used to mitigate the consequences of accidents, could become submerged and, thereby, rendered inoperable. Whythe vendor, applicant or staff did not discover this problem over the past years is a question worth ex-plaining. for the future, with the aim of preventing similar funda-mental oversights. For now, it is better to concentrate on deter-mining an acceptable solution to the problem. Con Ed has proposed a scheme to solve the problem. Basically, their proposal is to elevate only a few of the valve motors (but not the valves) above the calculated water level which is ex-pected following anaccident. For most of the valveswhose motors will be sacrified, Con Ed has expressed their conclusion that this will have no adverse effect on accident consequences. Since not all the valve motors (which were previously to be relied upon to cope with the accident) will be elevated, it is necessary to modify equipment and to develop new operating procedures for the manual operator actions that are required soon after the accident.Whether the new procedures and resulting core cooling system per-formance using these new procedures have been evaluated as thor-oughly as the original design by either the staff or the appli-cant is questionable. Whether the plant operators have been adequately "debriefed" on the old procedures and retrained in the use of the new procedures is also questionable. The deficiencies in the evaluation of the. revised design and operating procedures are illustrated by the following ques-tions which have not been adequately analyzed:" a) Do the platforms used to support the elevated motors have adequate capability to withstand an earthquake?(Of course, until a decision concerning the magnitude of the earthquake that must be withstood is reached, the question of the seismic adequacy of the'entire plant remains unanswefable.) b) Is there any circumstance under which the sub-merged valves might be needed to cope with an accident, especially if the accident sequence does not follow the predicted sequence?C) What "new" .equipment will need to be relied on, p.a.. core cooling svstem flow instrumentatior? Has this equipment been designed, procured and installed in accordance with the regulations and standards applicable to safety equipment?. d) What are the disadvantages (and what are their significance) of using operator's trained on Unit 2 to operate Unit 3 which has had substantive design changes compared to Unit 2?e) What other equipment besides valves will become submerged following an accident? Has the effect on safety of submerging this equipment been evalu-ated?More urgent from a public safety viewpoint than the review of Indian Point 3 is the question of the status of Indian Point 2 and other operating plants. The most recent correspondence on this matter (Reference

35) of which I am aware seems to in-dicate that nothing will be done to alter plant design or operating procedures prior to "the first refueling outage (which)IS currently scheduled to commence April 1, 1976". 1 consider this to be a totally irresponsible course of action. The NRC should not allow continued operation of a plant when there is good cause to believe that an unresolved safety question exists and that the plant is not in compliance with the regulations.

In fact, the regulations would appear to require a completely different course of action (see 10 CFR 50.100). Legal inter-pretation of the regulations notwithstanding, the proper course for a purely regulatory agency to follow is to permit operation only when there are sound technical bases to demonstrate safety of operation rather than to permit operation until the licensee or public can provide the sound technical bases for requiring immediate shutdown of the plant.III. PUMP FLYWHEEL MISSILES GENERATED BYREACTOR COOLANT PUMPOVERSPEED References 37 through 50 are some of the documents which discuss this unresolved safety problem As a result of a reactor coolant system pipe rupture and the blowdown of reactor coolant through the reactor coolant pump,"the pump impeller may act as a hydraulic turbine causing the pump, motor, and the flywheel to overspeed and become potential sources of missiles". (Reference

38) This is a significant problem because of the tremendous inertial energy of the missiles, especially flywheel parts, and the difficulty of predicting the course of these missiles.

Whether containment integrity can be maintained and whether the performance of emergency core-cooling systems can be assured if pump missiles are generated following a LOCA are significant unresolved questions. Numerous statements by experts on the staff and outside the agency indicated the severity of the problem. It is not prac-tical to limit overspeed by mechanical braking systems because of the significant amounts of energy they would have to absorb.Furthermore, inadvertent operation of a braking system could result in a locked rotor accident. Provision of barriers to retain any missiles also appears impractical and could also significantly increase the cost of construction. During the review, expert after expert expressed the con-clusion that empirical data was needed to determine the magni-tude of the threat to the health and safety of the public. For example: "Unfortunately, due to the sparsity of empirical information, the above statement (that the pump may not overspeed) has to be considered as specu-lative at the present time." (Reference 41)"Two-phase pump performance is an area which re-quires further investigation. The evaluation of the accuracy of any particular model depends on the performance of adequate pump tests which simulate the conditions expected during a LOCA." (Reference 37)"A large uncertainty is associated with the prediction of the hydraulic torque generated by a time-varying, two-phase fluid passing through the impeller at sonic or near sonic conditions... Although the theory of pump and turbine performance is under-stood, designers resort to experimental programs or at least to confirmatory tests even for normal operation to establish performance characteristics".(Reference

44)

-1 6-"The summary of my presentation incorrectly Crtais the assertion that the current treat-ment of two-phase flow behavior results in conservative overspeed predictions. My posi-tion is that we do not know whether the results are conservative or not and to the best of my recollection that is the view I expressed in the presentation". (Reference 49 enclosure) Attempts to justify continued licensing and operation of plants while this problem remains unresolved met with similar expressions of disagreement. Aside ;fom the generic excuse that the occurrence has a low probability the only other argument available is the use of electrical braking to -prevent overspeed. Reference 45 details the arguments against electrical braking as a method of protecting' the health and safety of the public.Reference' 47 also expresses succinctly a disagreement with un-supported reliance on expected experimental results, low prob-ability of occurrence, or electrical braking.In summary, the potential for missiles from pump overspeed remains an unresolved safety problem for Indian Point 2 and 3, as wells other plants. Based on the files concerning review of the Westinghouse topical report, WCAP-8163, the status of resolution is that, as. of August 13, 1975, the staff is waiting for information. I believe this matter should be reconsidered in connection with continued operation of Indian Point 2 and commencement of operation of Indian Point 3 as well as a similar reconsideration in connection with all PWRs..*/ The low 'probability argument has not been accompanied by a discussion of the consequences of such an accident-. -i 7-IV. SEPARATION OF ELECTRICAL EOUIPMENT Much emphasis is placed on the single failure criterion in attempting-to assure the public that nuclear plants are safe.Much less emphasis is given to the underlying assumptions which must be satisfied in order that the single failure criterion be a valid criterion. One of these basic assumptions is that failures will occur only in a random manner. Stated another way, the assumption is that failure (or operation) of one system or comnponent will not affect the performance of its redundant counter-part.One of the basic methods used to try to satisfy this assump-tion is to physically separate redundant equipment. The separa-tion must be sufficient both to assure that failure of one safety system does not cause failure of the other and to assure that failures in non-safety systems do not cause failure of either safety system. A more detailed explanation of this philosophy can be found in IEEE Std 379 and the NRC standard review plan Chapter 7.Based on my knowledge of the Indian Point 2 and 3 designs and the current separation criteria, I conclude that the physical separation provisions at Indian Point 2 and 3 are not adequate for the health and safety of the public. There is no. adequate basis for concluding that a common mode failure will not result in avery serious accident other than sheer good luck. In fact, -i8-based on the documents in the NRC files, this conclusion appears to be almost identical to the conclusions other knowledgeable staff members reached as early as 1969.An ACRS Subcommitteemeeting was held in April, 1970 and the staff made a rather detailed presentation of the poorer design aspects related to the Indian Point. 2 protection and electrical systems. This included discussion of the single cable tunnel, the engineered safety feature manual actuation panel in the con-trol room without separation in-the panel, the common diesel location in a sheet metal structure, cable separation, and cable penetrations at the containment. "The Subcommittee was 'appalled' at the situation. They asked if we did not have an Oyster Creek situation in hand and whether we should not have the applicant make an independent review of his work as we required of Jersey Central." (Reference 18)By the time the Electrical Systems Branch provided its input (Reference

22) for use in preparing a report to ACRS the elec-trical items which did not meet present day criteria earlier in the review, had either been "accepted", "resolved", or "approved with some reluctance", or they remained "unresolved".

The two reports to the ACRS prepared by the staff and classi-fied as "Official Use Only" (References 26 and 28) should be re-viewed by NRC to determine whether the previous bases for reluc-tantly accepting design deficiencies are adequate for protecting 1 9-the health and.safety of the public. Based on those reports, it appears that many items were accepted solely because so many other areas of the plant were deficient that it wouldn't do much good to require upgrading only a few. In other cases, it appears that a judgment-was made that the cost in time and money needed to provide substantial additional protection for the public health and safety was too great. The bases for this staff conclusion should be made public.In the case of the separation between Unit 2 diesels, the apparent resolution is inconsistent in itself. The applicant claimed that there was no history of diesel explosions that damaged the diesel's environs. Nevertheless, a concrete wall was installed to protect the common control panel but no similar protection was installed between the diesels.In summary, I consider the physical separation, or more ac-curately the lack of adequate physical separation, to be one of the significant safety hazards at Indian Point 2 and 3 which should be reconsidered. The single electric cable tunnel, the cable spreading room, the containment electrical penetration area, the main control board, the-safety injection pump and con-tainment spray pump areas, and the auxiliary fee~dwater pump areas are among the vital areas that should be re-evaluated.

• 1 The fact that Unit 3 has two cable tunnels is not significant Because the system logic requires that two out of three systems be operable following an accident.

In addition, the problem of associated circuits was apparently not considered at all. -2 0-C ON CLUSITON Attached as Appendix I to this Report is a bibliography of documents providing even greater detailed evidence of the existence of unresolved safety problems and of the deliberate refusal of the Regulatory Staff to take these problems into account in their safety reviews on individual reactors or even to publicly reveal the existence of the problems. Most of these documents have not been placed in the Public Document Room or otherwise made available to the general public. The release of.these and similar so-called internal memoranda is essential if public participation in licensing decisions and independent li-censing board reviews is to have any meaning. At present these processes involve a very limited examination of licensing deci-sions, inhibited by the Staff refusal to honestly disclose the serious, unresolved safety problems that are known to it and that are relevant to licensing decisions. This Report is based on materials contained in the NRC internal files and available to any NRC official sufficiently concerned to want to look into the files. The Report demonstrates that the NRC is fully aware of serious unresolved safety problems but de-liberately refuses to allow these problems to interfere with li-censing. If any NRC official wants to be responsive to the con-cerns of this report he or she should focus on ways of removing the censorship from disclosure and handling of these problems in licensing reviews, not to ask those responsible for suppressing the existence of the problems to give rationalizations for their prior failures to take action on these problems.This is a great cross-roads for the NRC. It can continue on the current path of. encouraging rapid and uninterrupted reactor licensing while seeking to defend itself from valid criticism or it can follow the new path charted for it by Congress in declaring that the sole agency function is to regulate nuclear power to pro-tect the public health and safety regardless of the impact on the nuclear industry or electric utilities. The purpose of this Re-port is to inform the public of the present state of the NRC safety review process and to thereby put pressure on the NRC to fulfill its statutory responsibilities. APPENDIX I DOCUMENTS RELATED TO OR BEARING ON THE REPORT ON THE NUCLEAR REGULATORY COMMISSION REACTOR SAFETY REVIEW PROCESS BY ROBERT D. POLLARD DATED FEBRUARY 6. 1976 A. INDIAN POINT 2 DOCUMENTS 1. Report to the Advisory Committee on Reactor Safeguards in the matter of Indian Point Unit No. 2, February 23, 1968 -OFFICIAL USE ONLY.2. Memorandum to R. S. Boyd from V. A. Moore, March 11, 1969, reporting the results of "a cursory examination of the In-dian Point t2 FSAR in order to identify major areas of con-cern 3. Memorandum to Roger S. Boyd from V. A. Moore, March 17, 1969, reporting additional areas of concern as a result of meeting with the applicant on March 12, 1969.4. Memorandum to R. S. Boyd from Karl Kniel, April 17, 1969, summarizing the discussions with the applicant on March 12, 1969.5. Memo Route Slip to R. C. DeYoung from V. A. Moore, June 10, 1969, discussing problems with the proposed Indian Point No. 2 questions dated June 6, 1969.6. Memo Route Slip to Ray Fraley from Roger S. Boyd, August 19, 1969, transmitting "some draft copies of an informal report on our Indian Point 2 review -- for use by the (ACRS) Sub-committee at the August 23 meeting".7. Report to the ACRS, Indian Point Nuclear Generating Unit No. 2, August.19, 1969 -OFFICIAL USE ONLY.8. Memorandum to Peter A. Morris from Voss A. Moore, Jr., September 8, 1969, discussing and providing additional in-formation on the areas' of concern identified by 3. above.9. "Note to Pete (Morris)" from R. S..Boyd, September 19, 1969 responding to "poison pen memo RT-671A". (Note; RT-671A is item 8. above) "2-10. Memorandum to R. T. Carlson from Olan D. Pare and Vincent D. Thomas, January 5, 1970, transmitting results of the Indian Point No. 2 Plant inspection of December 15-19,1969. !i. Memorandum to Saul Levine from 0. D. Parr and R. D. Pollard, January 12 1970, providing minutes of meetings held on December' and 30, 1969.12. Memorandum to Peter A. Morris from Voss A. Moore, Jr., January 16, 1970, discussing "electric items which do not meet present day criteria".

13. Memorandum to Saul Levine from 0. D. Parr and R. D. Pollard, January 29, 1970, providing the minutes of the meeting held on January 16, 1970, and identifying unresolved items.14 Memo randum to Peter A. Morris from Edson G. Case, April 3, 1 70, regarding "unresolved electrical and instrumentation items". (Note: The Electrical, Instrumentation, & Control Systems Branch's file copy also has identified whether the eight areas were "accepted", "resolved" or remained "un-resolved".

No explanation is recorded concerning the dif-ference between "accepted" and "resolved".)

15. Memo Route Slip to Edson G. Case from Voss Moore, April 7, 1970, providing a tabulation of those areas "which we be-lieve have been resolved but not documented".

16. Letter to R. C. DeYoung from M. W. Libarkin, April 2, 1970, regarding the tentative agenda for the ACRS Subcommittee meeting on April 25, 1970.17. Memo Route Slip to Edson G. Case from Voss A. Moore, April 14, 1970, regarding assignments to prepare to discuss each of the items on the ACRS Subcommittee agenda.18. Memorandum to P. A. Morris from R. C. DeYoung, May 5, 1970, transmitting a "summary report of the ACRS Subcommittee meeting on Indian Point 2 held at O'Hare Airport on April 25,. 1970".19. Letter to R. C. DeYoung from M.' W. Libarkin, May 15, 1970, regarding the tentative agenda for the ACRS Subcommittee meeting on May 28, 1970.20. Memorandum to R. C. DeYoung from Karl Kniel, May 15, 1970, transmitting a "summary report of a meeting on Indian Point 2 held at 1717 H Street on May 5, 1970."

-J_21. Memorandum to P. A. Morris from Edson G. Case, May 18, 1970;transmitting a report on the engineered safety feature manual actuation panels to be used in case "the ACRS agrees to con-sider the problem".22. Memorandum to P. A. Morris from Edson G. Case, May 19, 1970, transmitting a "report -- prepared by the DRS Electrical Systems Branch for use in the DRL ACRS report concerning the Indian Point No. 2 plant".23. Memorandum to R. C. DeYoung from Karl Kniel, May- 25, 1970, transmitting a "summary report of an ACRS Subcommittee Meet-ing, held at the site on May 11, 1970".24. Letter to Dr. Joseph M. Hendrie from Peter A. Morris, June 5, 1970, transmitting a "Special Report to the ACRS, Indian Point Nuclear Generating Unit No. 2, Operating License Re-view" relating to two unresolved items concerning reactor protection and engineered safety feature instrumentation and controls -OFFICIAL USE ONLY.25. Letter to Dr. Peter A. Morris from R. F. Fraley, June 17, 1970, regarding "resolution of items discussed during the 122nd ACRS meeting".26. Report to the ACRS, Indian Point Nuclear Generating Unit No. 2, Operating License Review, July 2, 1970 -USE ONLY.27. Letter to Consolidated Edison from Peter A. Morris, July 24, 1970, transmitting additional questions regarding In-dian Point 2.28. Report to the ACRS, Indian Point Nuclear Generating Unit No.2, Operating License Review, Report No. 2, September 4, 1970 -OFFICIAL USE ONLY.29. Memorandum to P. A. Morris from Edson G. Case, September 10, 1970, transmitting additional information to supplement the report transmitted on May 19, 1970 (Item 22. above).30. Safety Evaluation by the Division of Reactor Licensing in the-matter of Indian Point Nuclear Generating Unit No. 2, November 16, 1970.31. Memorandum to J. P. O'Reilly from N. C. Moseley, March 18, 1971, transmitting CO Report No. 247/71-4 by G. L. Madsen dtd 3/10/71.

32. Supplements Nos. 1, 2 and 3 to the Safety Evaluation by the Division of Reactor Licensing in the matter of Indian Point Nuclear Generating Unit No. 2.33. memorandum to R. C. DeYoung from R. H. Engelken, November 16, 1971, regarding a preliminary report of the Indian Point fire.34. Memorandum to J. G. Keppler from Eldon J. Brunner, February 4, 1972, transmitting Co Inquiry Report No. 50-247/7203.

35. Letter to Robert W. Reid from William J. Cahill, Jr., September 15, 1975, regarding future action for resolution of the submerged valve problem and analysis of the Indian Point 2 emergency core cooling system performance.

36. Memorandum to Robert W. Reid from Zoltan R.*Rosztoczy, December 8, 1975, regarding "evaluation of Con Ed's pro-posed change of reactor coolant pump underfrequency trip setpoint".

B. DOCUMENTS RELATED TO MISSILES GENERATED BY REACTOR COOLANT PUMP OVERSPEED DURING A LOSS OF COOLANT ACCIDENT..

37. Report; R. F. Farman and N. R. Anderson, "A Pump Model for Loss-of-Coolant Accident Analysis, date unknown. (This work was performed by Aerojet Nuclear Company for AEC under Contact AT(10-1) -1375. )38. Memorandum to R. C. DeYoung from R. R. Maccary, January 26, 1973, regarding evaluation of pump flywheel overspeed.

39. Note to R. C. DeYoung from R. W. Kiecker, March 14, 1973;transmitting copies of notes of the meeting held with reactor vendors regarding reactor coolant pump overspeed during a LOCA.40. Memorandum to D. F. Ross from Paul E. Norian, June 19, 1973, regarding calculations of PWR pump overspeed during a LOCA.41. Note to' R. C. DeYoung from R. W. Klecker, July 5, 1973, pro-viding a brief discussion of reactor coolant pump overspeed during.a LOCA "which may be useful as background information for further AEC deliberations regarding this matter".

5--42. Memorandum to R. C. DeYoung from R. W. Klecker, July 10, 1973, transmitting minutes of a joint meeting on pump overspeed analytical models.43. Letter to Mr. Howard Arnold of Westinghouse from R. C.DeYoung, July 19, 1973, requesting a report on various aspects of the pump overspeed problem. (Note: Distribu-tion did not. include the-Public Document Room)44. Note to S. H. Hanauer et al. from R. C. DeYoung, July 27, 1973, transmitting a draft of the proposed presentation to ACRS on pump overspeed during a LOCA.45. Memorandum to Victor Stello, Jr. from T. A. Ippolito, August 3, 1973, transmitting an evaluation of electrical braking as a means of limiting pump overspeed during a LOCA.46. Letter to Harold C. Mangelsdorf from R. C. DeYoung, August 6, 1973, transmitting the staff's report on reactor coolant pump overspeed during a LOCA.47. Memorandum to John F. O'Leary from S. H. Hanauer, August 9, 1973, titled "Pump Overspeed Patches" transmitting comments on. the report on reactor coolant pump overspeed during a LQCA.48. Memo Route Slip to R. C. DeYoung, et al. from Dr. Hendrie, August 10, 1973, transmitting item 4.7 above and discussing future action.49. Memorandum to R. W. Klecker from Roger J. Mattson, September 7, 1973, transmitting an ANC internal memorandum which cor-rects the minutes of the June 21, 1973 meeting on pumps, i.e., Memorandum from R. F. Farman to W. A. ii.50. Letter to R. C. DeYoung from Romano Salvatori (Westinghouse), September 20, 1973, transmitting topical report WCAP-8163,"Reactor Coolant Pump Integrity In LOCA", in response to item 43. above.C. GENERIC DOCUMENTS 51. Technical Safety Activities Report -December, 1975 -Divi-sion of Technical Review, transmitted by Robert E. Heinman's note dated January 5, 1976. 52. Memo Route Slip to EI&CS Branch from T. Ippolito, April 4, 1974, regarding evaluation of interruption of power to ESP au a during the accident sequence.53. Memorandum to Joseph M. Hendrie from Thomas A. Ippolito, September 12, 1973, regarding a technical position on the application of the single failure criterion to manually-controlled electrically-operated valves.54. Memo Route Slip to T. Ippolito from J. Hendrie, September 17, 1973, responding to item 53 above.55. Memorandum to R. C. DeYoung and V. A. Moore from Victor Stello, Jr., October 1, 1973, transmitting "Technical Position on the Application of the Single Failure Criterion to Manually-Controlled Electrically-Operated Valves".56. Letter to L. ManningMuntzing from W. Kerr, January 14, 1975 regarding "Locking Out of ECCS Power Operated Valves".57. Note to Lester Rogers from A. Gianmbusso, October 24, 1973, regarding the need for and requ irements on instruilnenlation to monitor 'post-accident conditions.

58. Memorandum to Victor Stello, Jr. from Thomas A. Ippolito, September 6, 1973, transmitting recommendations.

on "Design Improvements for Standard Plant Reviews".59. Note to V. Stello from Thomas A. Ippolito, January 9, 1974, regarding "certain assumptions made in the analyses of the following accidents (which) are in violation with the es-tablished Staff's requirements".

60. Memorandum to Electrical, Instruinentation and Control Systems Branch Members from Thomas A. Ippolito, October 22, 1975, regarding responsibilities for evaluation of steam line break accidents.

61. Letter to Commissioner Gilinsky from S. H. Hanauer, March 13, 1975, entitled "Technical Issues". Dr. Hanauer discusses some technical issues he believes "to be important subjects for Commission consideration, although not necessarily in the immediate future".

Exhibit FP No. 11 UNITED STATES NUCLEAR REGULATORY COMMISSION REGION I 475 ALLENDALE ROAD KING OF PRUSSIA, PENNSYLVANIA 19_40C-1415 Ma' 11, 1995 Mr. Leslie M. Hill, Jr.Resident Manager New York Power Authority Indian Point 3 Nuclear Power Plant Post Office Box 215 Buchanan, NY 10511

SUBJECT:

SPECIAL INSPECTION TO REVIEW FIRE PROTECTION AND APPENDIX R RESIART ITEMS, INSPECTION REPORT NO. 50-286/95-81

Dear Mr. Hill:

This refers to the team inspection led by Mr. R. A. Skokowski of this office from January 30 through March 24, 1995, at the Indian Point 3 Nuclear Power Plant, Buchanan, New York, and at the NRC Region I office in King of Prussia, Pennsylvania. The inspectionfocused on the adequacy of your efforts related to the resolution of restart issues identified in the "'Restart Action Plan." Particularly, issues pertaining to your fire protection and Appendix R programs, and previously identified issues resulting from the electrical distribution system functional inspection (EDSFI) were reviewed.Mr. Skokowski discussed the findings of this inspection with you and/or members of your staff on February 10 and 17, and March 24, 1995.The inspection was directed towards areas important to public health and safety. Areas examined during this inspection are described in the NRC inspection report enclosed with this letter. The inspection consisted of selected examinations of design documents, procedures, representative records, interviews with personnel, and observations made by the team.Based on the team's review, your actions were considered appropriate to close both the fire protection/Appendix R and EDSFI-related restart issues.However, with respect to the fire protection/Appendix R issue, the team noted that compensatory fire watches, in place for the penetration seals, are required until the completion of your effort to verify that the generic information used in your fire seal analysis appropriately represents the cables installed at Indian Point 3 or that the cables in question are otherwise qualified. This issue was discussed during several telephone conversations between NRC and members. of your staff, concluding-with a conversation on May 10, 1995, between Mr. Ruland and yourself. During this conversation, you committed to maintain compensatory fire watches as described above. Additionally, during this conversation, Mr. Ruland confirmed your commitment to complete all fire protection and Appendix R-related startup labeled ACTS items -and work requests prior to plant restart. U. S. NUCLEAR REGULATORY COMMISSION REGION I REPORT/DOCKET NO: 50-286/95-81 LICENSEE: FACILITY: LOCATION: New York Power Authority Indian Point 3.Nuclear Power Plant Buchanan, New York DATES: INSPECTORS: TEAM LEADER: APPROVED BY: January 30, 1995 -March 24, 1995 R. Bhatia, Reactor Engineer, DRS L. Harrison, Reactor Engineer, DRS A. Singh, Fire Protection Engineer, NRR R. Skokowski, Reactor Engineer, DRS E. Connell, Sr. Fire Protection Engineer, Richard A. Skokowski, Reactor Vgineer Electrical Section Division of Reactor Safety William H. Ruland, Chief Electrical Section Division of Reactor Safety NRR Date Date EXECUTIVE

SUMMARY

Purpose: The purpose of this inspection was to review and determine the adequacy of the licensee's follow-up actions to resolve fire protection/Appendix R and electrical distribution system functional inspection (EDSFI) follow-up issues categorized by the NRC as restart issues. Acceptable solution of these issues were included in the Indian Point 3 "Restart Action Plan" (RAP) and-was a prerequisite for the plant to start-up for normal operation. The NRC based the acceptability of the issues on information provided by the licensee and independent verifications of selected portions of that information. RAP Item 11.3; Fire Protection/Appendix R Programs Overall, the team considered New York Power Authority's (NYPA) efforts to improve and gain control of the fire protection/Appendix R programs to be effective. The majority of work items reviewed were found to be extensive and well thought-out. The team did identify a few discrepancies, however. These, discrepancies did not detract from the overall good performance. Based on the team's review, NYPA's actions were considered appropriate to close the fire protection/Appendix R restart issue, with the compensatory fire watches in place for the penetration seals until the completion of their evaluation for cable ignition temperatures associated with Unresolved Item 50-286/93-24-03. To address outstanding fire protection and safe shutdown issues, NYPA developed the "Indian Point Unit 3 Appendix R & Fire Protection Improvement Plan." To accomplish the objectives of this improvement plan, NYPA developed a number of short-term issues, which were required for restart, and other long-term issues tracked for implementation following start-up. The details of the team's review of the short-term issues is included in this report. The team also reviewed previously identified violations, unresolved items, Licensee Event Reports (LERs), and other issues. These other issues were related to the fire protection and Appendix R programs and included management oversight, the reactor coolant pump (RCP) oil collection system (OCS.), the Appendix R emergency diesel generator (EDG), and system certifications. Fire Protection/Appendix-R Manaqement Oversight The team considered the development of the Fire Protection/Appendix R Task Force and the oversight committee as an aggressive initiative for -providing technically appropriate resolutions to the fire protection issues.The development and assignment of a safety and fire protection general supervisor was also considered a good initiative. This assignment -provi~ded needed planning, scheduling, and additional management oversight of the Fire Protection Program. Reactor Coolant Pump Oil Collection System The team evaluated the RCP OCS to verify compliance with Appendix R. Included in this evaluation was the performance of system walkdowns and review of applicable design and implementation documents. During the walkdowns, the team identified several material deficiencies which were subsequently corrected by NYPA. Based on the team's review of the OCS design and installation, the team concluded that the OCS was adequate to meet the requirements of 10 CFR Part 50, Appendix R, Section 111.0. However, the team determined that additional management attention was needed to ensure that concerns identified during this review are properly addressed. During the review of a recent modification to the RCP OCS, a concern regarding the use of engineering change notices (ECNs), for material substitutions and technical evaluations to support substitutions, was identified. This issue was determined to be an unresolved item. Additionally, the team identified that there was a previous concern by NYPA regarding the use of ECNs at FitzPatrick approximately two months earlier. This issue was discussed with various organizations at Indian Point 3 (IP3). These discussions indicated that no means had been established to ensure that information is shared between IP3 and FitzPatrick for common NYPA processes. Removal of the Fire Protection Technical Specification Requirements On February 8, 1994, the detailed requirements associated with fire protection were removed from technical specifications (TS) and re-established through administrative controls in TS 6.8.1.j. This TS required that written procedures shall be established, implemented, and maintained covering the fire protection program. The team identified that the required procedures were not in place until after the changes to the TS were completed. Subsequently, actions were taken by NYPA staff to address this issue and to assure control the fire protection program had not been compromised. Additionally, a review of the operating logs performed by NYPA staff identified no conditions that could have caused limiting conditions for operation (LC'O) to be entered. This issue was considered a non-cited violation of the TS-requirements. Conclusion -RAP Item 11.3; Fire Protection/Appendix R Proqram Based on the team's review, RAP Item II.3,.pertaining to the Indian Point 3 Fire Protection/Appendix R Programs, is closed.RAP Item 11.19; EDSFI Items Unresolved Item 50-286/91-80-10 EDG Transient Loadinq_Several calculations, studies, and tests associated with this effort were reviewed. Based on this review, the team considered NYPA's actions pertaining to EDG transient loading acceptable for restart. However, the associated Unresolved Item, 50-286/91-80-10, will remain open until Completion of the final validation. The team considered NYPA's efforts pertaining to the EDG iii transient loading completed to date, extensive. Additionally, their retesting of the safety injection pump motor, to verify that recent work on the pump did not impact the motor model, was considered by the team as an example of a good questioning attitude.Unresolved Item 93-18-02 EDG kW Meter Tolerance for Load Management This issue was reviewed by the team and found to be thoroughly evaluated by the licensee. The completed work by NYPA to develop the associated calculation was considered by the team to be an example of good communications between the engineering and operations departments. This item is considered closed.Conclusion -RAP Item 11.19; EDSFI Items Based on the team's review, RAP item 11.19, pertaining to EDSFI Items, is closed.iv TABLE OF CONTENTS PAGE TABLE OF CONTENTS ...... ..... ....... ...... ... ............... v

1.0 INTRODUCTION

..... ..... ...................... ......... 1 2.0 FIRE PROTECTION/APPENDIX R RESTART ISSUES (64150) .1............I 2.1 Short-Term Fire Protection/Appendix R-Related Corrective Actions (Inspector Follow-up Item (IFI) 50-286/93-24-01) i 2.1.1 PIP 177.1 Task 5 (RCIP Task #1); Impact of Modifications on IP3 Safe Shutdown Capability (Unresolved Item 50-286/93-24-05) ..... ..2 2.1.2 PIP 177.1 Task 6 (RCIP Task #2); Primary Auxiliary Building (PAB) Heating, Ventilating, and Air Conditioning (HVAC) ..... ............. 3 2.1.3 PIP 177.1 Task 7 (RCIP Task #3); Fire Wrap Adequacy ... .................... 4 2.1.4 PIP 177.1 Task 8 (RCIP Task #4); Installation of Marinite Board in Containment .... ........... 4 2.1.5 PIP 177.1 Task 9 (RCIP Task #5); Adequacy of Fire Doors ...4............... .4 2.1.6 PIP 177.1 Task 10 (RCIP Task #6); Penetration Seal Adequacy (Unresolved Item 50-286/93-24-03 &LER 93-29) 5....... ............... 5 2.1.7 PIP 177.1 Task 1] (RCIP Task #7); Cable Tunnel Suppression System ..... ..... ............. .7 2.1.8 PIP 177.1 Task 12 (RCIP Task #8); Instrument Sensing Line Separation 8...............8 -2.1.9 PIP 177.1 Task 13 (RCIP Task #9); Adequacy of Fire Dampers ...9...............9 2.1.10 PIP 177.1 Task 14 (RCIP Task #10); Review of Safe Shutdown Procedures .... ............ 10 2.1.11 PIP 177.1 Task 15 (RCIP Task #11); Adequacy of Cold Shutdown Repair Procedures ............. 11 2.1.12 PIPo177.1 Task 16 (RCIP Task #12); AppendixR -Commitments For Compliance .... ......... ... 11 2.1.13 PIP 177.1 Task 17 (RCIP Task #13); Testing of Appendix R Alternate Shutdown Equipment ..... .. 12 2.1.14 PIP 177.1 Task 18 (RCIP Task #14); Appendix R Emergency Battery Light Issues ... ......... ... 13 2.1.15 PIP 177.1 Task 19 (RCIP Task #15); Development of Modification for Additional Emergency Lights Turbine and Administration Buildings ..... .... 13 2.1.16 .-PIP 177.1 Task 20 (RCIP Task #16); Safe Shutdown Communication Review ..... .............. ... 13 2.1.17 PIP 177.1 Task 2] (RCIP Task #17); Development of Fire Protection Plan ...... ... .. .. ......13 2.1.18 PIP 177.1 Task 22 (RCIP Task #18);Validation/Confirmation of 1P3 Fire Hazards Analysis ..... ..... ........... .... ..... 14 v TABLE OF CONTENTS (CONT'D)PAGE 2.1.19 PIP 177.1 Task 23 (RCIP Task #19); Operations Review Group Item Review ... .... ....... ..15 2.1.20 PIP 177.1 Task 24 (RCIP Task #20); Quality Assurance Item Resolution (Violation 50-286/91-09-03 & Unresolved Item 50-286/93-04-07) .....16 2.1.21 PIP 177.1 Task 25 (RCIP Task #21); Generic Letter 86-10 Resolution ... ............. 18 2.1.22 PIP 177.1 Task 26 (RCIP Task #22); Request for Engineering Services Resolution ............... 19 2.1.23 PIP 177.1 Task 27 (RCIP Task #23); Cable Tunnel.Entryway Exemption Request ........ .... 20 2.1.24 PIP 177.1 Task 28 (RCIP Task #24); Inspection of Control Building Internal Seals (Unresolved Item 50-286/93-24-04) ... ............. ... 20 2.1.25 PIP 177.1 Task 29 (RCIP Task #25); Absent Fire Barrier Wrap (LER 93-038) .. .............. 21 2.1.26 PIP 177.1 Task 30 (RCIP Task #26); Appendix R Compliance Summary ..... ... ............... 22 2.1.27 PIP 177.1 Task 31 (RCIP Task #27); Multiple High Impedance Faults ....... ................ ...23 2.1.28 PIP 177.1 Task 32 (RCIP Task #28); Temporary Modification Review ... ............... 24 2.1.29 Conclusion -Short-Term Fire Protection/Appendix R-Related Corrective Actions .... .......... ...24 2.2 Emergency Lighting Issues ... .................. 25 2.2.1 PIP 177.1 Task 18 (RCIP Task #14); Appendix R Emergency Battery Light Issues (Violation 91-09-03 and Unresolved Item 50-286/93-04-07) ... ..... 25 2.2.2 PIP 177.1 Task 19 (RCIP Task #15); Development of Modification for Additional Emergency Lights in Turbineand Administration Buildings ........ 27 2.3 PIP 177.1 Tasks 7 AND 8 (RCIP Tasks #3 & 4); Fire Wrap/Penetration Related Issues (Unresolved Items 50-286/93-08-07 & 50-286/93-24-06) ........ ..... .......... ... 27 2.3.1 Fire Barrier Inside Containment ..... ......... 2,8 2.3.2 Fire Barrier Wrap Outside Containment .... ...... 29 2.3.3 Conclusion -PIP 177.1 Tasks 7 and -8; Fire Wrap/Penetration Related Issues ........... ....30 2.4 Reactor Coolant Pump Oil Collection System ............... 30 2.4.1 Modifications ..... ............ ...... ... 30 2.4.2 Walkdowns ....................32 2.5 Appendix R EDG ..... ...........................34 2.5.1 CAR 828 .......... .................... .. 34 2.5.2 Reverse Power Trips of the Appendix R EDG due to Operator Error ..... ... ..................... 36 2.6 Fire Protection System Certification .............. .36 2.7 .Management Oversight ..... ....... .................... 37 2.8 Conclusion -Fire Protection/Appendix R Restart Issues ...38 TABLE OF CONTENTS (CONT'D)PAGE 3.0 OUTSTANDING EDSFI-RELATED ISSUES-(92903) .... ... ... ......... 38*3.1 (Update) EDG Transient Loading (Unresolved Item 50-286/91- .80-10) .. ................................ 39 3.2 (Closed) EDG kW Meter Tolerances (Unresolved Item 50-286/93-18-02) ........................... ........ 41 3.3 Conclusion -Outstanding EDSFI Issues ................ ..42 4.0 INFORMATION NOTICE 93-33 (92903) ......... .............. ...42 5.0 MANAGEMENT MEETINGS ........... ....... .............. .. 43 DETAILS

1.0 INTRODUCTION

The purpose of this inspection was to review and determine the adequacy of the licensee's follow-up actions to resolve fire protection/Appendix R and electrical distribution system functional inspection (EDSFI) follow-up issues, categorized by the NRC as restart issues. The Indian Point 3 "Restart Action Plan" (RAP) stated that acceptable solution of these issues was a prerequisite for plant start-up. Each item was uniquely identified by a RAP number in the plan, and this number was used in this report to identify the associated NRC review and evaluation. The RAP item, associated with fire protection/Title 10 Code of Federal Regulations (CFR) Part 50, Appendix R issues, is Number 11.3 and the RAP item associated with EDSFI issues is Number 11.19.Inspection Methodology The team based the acceptability of the issues on information provided by the licensee and independent verification of selected portions of this information. The information provided by the licensee included evaluations, reports, calculations, procedures, and other applicable documents. The team verified this information through selected system walkdowns, personnel interviews, independent calculations, and comparison to industry standards and NRC regulations. The items selected for independent review were based on safety significance, quality of the licensee evaluation of the issues, and scope of the licensee's review.2.0 FIRE PROTECTION/APPENDIX R RESTART ISSUES (64150)The team examined several issues related to both the fire protection and Appendix R programs at Indian Point 3 (IP3) to determine the acceptability for restart. This examination included previously identified violations, unresolved and inspector follow-up items, Licensee Event Reports (LERs), review of the reactor coolant pump (RCP) oil collection system (OCS), the Appendix R emergency diesel generator (EDG), system certifications, of selected fire protection and Appendix R systems, and management oversight in the areas of fire protection and Appendix R programs.2.1 Short-Term Fire Protection/Appendix R-Related Corrective Actions (Inspector Follow-up Item (IFI) 50-286/93-24-01) To address outstanding fire protection and safe shutdown issues, New York Power Authority (NYPA) developed the "Indian Point Unit 3 Appendix R & fire Protection Improvement Plan." To accomplish the objectives of this improvement plan, NYPA developed a number of short-term issues, required for restart, and other long-term issues. Additionally, these short-term and long-term issues were included in the Indian Point Unit 3 Performance Improvement Plan (PIP) as Items 177.1 and 177, respectively. Subsequently, the PIP was revised and renamed the Restart and Continuous Improvement Plan (RCIP). Both the PIP and the RCIP were submitted to the NRC in January 1993 and May 1994, respectively. The team reviewed the short-term issues, as tracked by the original PIP numbers. These reviews are described below. The review of the long-term issues will be completed during future NRC inspections. 2 2.1.1 PIP 177.1 Task 5 (RCIP Task #1); Impact of Modifications on IP3 Safe Shutdown Capability (Unresolved Item 50-286/93-24-05) Overview This task and Unresolved Item 50-286/93-24-05 pertained to the development of a fire protection/Appendix R modification procedure to assure adequate control of plant modifications. At the conclusion of the October 1993 fire protection and Appendix R Inspection 50-286/93-24, the inspectors identified that NYPA had no adequate measures in place. to verify and review the impact of modifications on the safe shutdown capability of the plant. NYPA committed to establish a method to review all outstanding modifications and determine the impact of changes on the fire protection and Appendix R programs, and related documents, prior to plant restart.Details During this inspection, the team noted that NYPA had completed the review of the outstanding field modifications installed in the plant up through January 1993. NYPA, with the assistance of their contractor (Engineering Planning and Management (EPM)), Inc., as a part of this effort, had reviewed.the impact of these modifications on safe shutdown capability and the impact on fire protection documents. According to the licensee, all applicable data from previously installed modifications had been updated in the Appendix R Analysis and Fire Hazard Analysis documents, with the exception of 14 modifications listed on their configuration controlled data base. In addition, the team noted that the impact of the remaining and ongoing modifications on fire protection and Appendix R-related documents was -being tracked under the established procedure to assure timely updating of these documents. The team reviewed NYPA's issued procedure ESM, FPES-04B, Revision 0, dated April 11, 1994, to evaluate the impact of ongoing modifications. The team noted that this procedure provided adequate guidance to review, evaluate,, and control the process for updating Appendix R-related documents during plant modifications to ensure compliance with 10 CFR 50 Appendix R requirements. The procedure requires that the responsible design engineer complete a fire protection and Appendix R compliance checklist to ensure the design applicability to these requirements. The checklist is used to determine whether the design requires a detailed fire protection review. If needed, a fire protection engineer performs the detailed review. Based on the review of this established procedure and sample review of the completed recent modification checklist input, the team concluded that adequate controls were established to ensure that ongoing modifications and future modifications are adequately evaluated against the requirements of Appendix R.The team noted that the installed modifications were reviewed by NYPA for fire protection impact on both the Appendix R Analysis and Fire Hazard Analysis.These modifications were listed in Attachment B of these documents. 3 The team-reviewed two randomly selected modifications listed in each document to ensure that data was valid and appropriate. In addition, a sample of the recently completed modification fire protection checklist were reviewed and no concerns identified. The team concluded that the modification fire protection program review checklist was being completed in accordance with the established administrative procedures by the responsible design and fire protection engineers. Conclusion Based on the above review, the team concluded that adequate measures had been established to identify, review, and update the fire protection documents. Additionally, the team found that the applicable fire protection documents were appropriately updated to include previously-installed modifications. The team concluded that NYPA had demonstrated that adequate controls had been established and implemented in this area to restart the plant at this time.PIP 177.1 Task 5 and Unresolved Item 50-286/93-24-05 are closed.2.1.2 PIP 177.1 Task 6 (RCIP'Task

1. 2); Primary Auxiliary Building (PAB)Heating, Ventilating, and Air Conditioning (HVAC)Overview The purpose of this task was for NYPA to evaluate, update, and improve the existing Primary Auxiliary Building HVAC calculations to document the consequences of a PAB loss of ventilation.

In addition, the cables and components associated with the PAB ventilation were required to be assessed from an Appendix R compliance perspective. Details During this inspection, the team noted that NYPA had further evaluated the results of the completed PAB loss of ventilation calculations. The licensee developed test Procedure ENG-560, which was conducted on November 21; 1994, to evaluate the rise in air temperature in the PAB and its effect on equipment, including the motor control center (MCC), component cooling:water (CCW), and charging pump rooms following a loss of ventilation that could occur during a postulated loss of coolantfaccident '(LOCA) and Appendix R fire condition. Based on the heat generation analysis and extrapolation of data obtained during the test, the licensee determined that, following a loss of PAB ventilation, the air temperature. in the MCC area at the 55 ft. elevation would increase approximately 27F in one hour during the LOCA, and then reach steady state conditions. This small temperature increase was due to the reduced electrical load that would be present during this plant condition. In the case of a postulated fire condition, when offsite power would be available, the licensee determined that the rise in air temperature would increase approximately 9 0 F in the MCC area after one hour. Based on the small rise in temperature compared to the original higher calculated, the licensee concluded that the original calculation results were overly conservative. 4 NYPA indicated that the temperature profiles calculated in the latest UE&C Calculation (6604.327-6-PAB-002, Revision 2), showed that all safe shutdown equipment in the PAB areas, except the thermal overload relays of the MCCs, would continue to remain operable for at least four hours following a loss of ventilation. Therefore, the temperature profiles calculated in the updated calculations were appropriately conservative. Through review of licensee documents, the team determined, based on this review, that the cables and components associated with the PAB ventilation were assessed by NYPA from an Appendix R perspective and found to be acceptable. Conclusion Based on the above completed actions, the team concluded that the licensee had adequately resolved and completed the above task. Therefore, PIP 177.1 Task 6 is closed.2.1.3 PIP 177.1 Task 7 (RCIP Task #3); Fire Wrap Adequacy Refer to Section 2.3 for discussion and closure of this item.2.1.4 PIP 17.7.1 Task 8 (RCIP Task #4); Installation of Marinite Board in Containment Refer to Section 2.3 for discussion and closure of this item.2.1.5 PIP 177.1 Task 9 (RCIP Task #5); Adequacy of Fire Doors Overview The purpose of this PIP Item 177.1 Task 9 was to perform a National Fire Protection Association (NFPA) Standard 80 code compliance review of installed fire doors and to take appropriate corrective actions for the nonconformances and deviations identified. Details During the 50-286/93-24 inspection, the inspectors concluded that PIP Task 9 was incomplete due to the-hardware repairs that were not complete. In response to this task, the licensee performed a code compliance study to ensure that the fire-rated doors installed in the plant meet NFPA Code 80,"Standard for Fire Doorsand Windows." This code compliance study was performed by an independent contractor. The study identified conditions that were not in strict compliance with the requirements of the standard and provided recommendations to correct the noted noncompliance issues. For those 5 items requiring more extensive efforts to achieve strict compliance, the recommendations made by the contractor were evaluated, and appropriate actions were taken to bring the concerned doors into compliance. The following is the summary of the noncompliance conditions identified: (1) Minor maintenance items such as small holes in the surface of doors and frames, doors that would not close and latch when released from an open position, missing or inoperative top and/or bottom bolts on the inactive leaf of double swinging fire doors, painted or broken fusible links on doors, and unlabeled doors and frames.(2) Gaps between doors, frames, and door latches with less than the required latch throw.(3) Unlabeled gasket material installed on various doors and/or frames.(4) Fire doors which were not included in procedure FP-19, "Fire Door Inspection." During this study, the contractor found 10 of the 100 Appendix R doors installed for use as a 3-hour fire barrier. The licensee stated that although the above issues were not in strict compliance with the requirements of.NFPA 80, they would perform their intended function for providing separation of fire areas as required by Appendix R. The team noted that the licensee had taken all the appropriate corrective actions to bring these doors into compliance. Additionally, the team observed several fire doors during plant walkdowns and identified no concerns.Conclusions Based on the above review, the team concluded that the licensee has taken appropriate corrective action to resolve this task. Therefore, this task is closed.2.1.6 PIP 177.1 Task 10 (RCIP Task #6); Penetration Seal Adequacy (Unresolved Item 50-286/93-24-03 & LER 93-29)Overview The purpose of Task 10 was to perform a baseline inspection of 100 percent of plant fire barrier penetrations, document appropriate information, and initiate appropriate repairs and corrections. Fire barrier penetration seal maintenance and repair procedures were to be reviewed by the licensee and revised as necessary prior to start-up. During the 50-286/93-24 inspection, the inspectors created Unresolved Item 50-286/93-24-03, associated with this task pending the licensee's verification of the cable insulation temperature to assure that the maximum unexposed side temperatures were sufficiently below the cable-insulation ignition temperature. Also related to penetration seal adequacy, NYPA submitted LER 93-29 regarding nonfunctional penetration fire seals and fire barriers located in the walls between EOG cells. To address.the adequacy of penetration seals, the team reviewed this PIP task item, Unresolved Item 50-286/93-24-03 and LER 93-29. 6 Details The team reviewed Engineering Acceptance Test ENG-527, "Fire Barrier Inspections," and the significance of any deficiencies identified during the inspection effort. The licensee inspected approximately 1200 fire seals of which 8% of the seals were judged to be non-functional and the remaining 92%judged to be functional. Approximately 450 of the 1200 fire seals inspected were repaired. The majority of the repaired were completed to provide a means to impede mechanical damage to seals located in high traffic areas. In addition, some of the seals were reworked to enhance their integrity and maintain consistency between installed seal configurations and typical design details. The fire seals which were repaired were determined by the licensee to be functional. For example, enhancement repairs included: filling of minor holes or voids in the seal surface, repairing existing damming material, repairing the flamemastic layer of certain fire stops, installing a protective elastomer cap on seals in high traffic areas, adding additional seal material to the existing seals, and installing smoke and hot gas seals to enhance the provided level of protection. The licensee has established procedures associated with the installation and repair of silicone foam, silicone elastomer, and flamemastic fire stops. The team's review of these procedures did not identify any concerns. The team also reviewed the qualification of the installers and did not identify any concerns.Additionally, the team reviewed LER 93-29 and performed a walkdown of the penetrations separating the EDGs and verified the modification completed to address these previously improperly installed penetration fire seals. The team did not identify any further concerns.The team reviewed the licensee's evaluation provided in response to Unresolved Item 50-286/93-24-03 titled, "FIRE SEAL ANALYSIS -Self Ignition Temperature of Cable Insulation as it Relates to the Design of Fire Seals," dated January 25, 1995. Evaluation No. IP3-ANAL-FP-01392-, Revision 0. The licensee concluded in this evaluation that the self-ignition temperature of the cable insulation is not less than 785 0 F, and that this temperature is sufficiently above the 700'F maximum allowable unexposed surface. temperature criteria for penetration seal designs at IP3. The licensee based this conclusion on.generic cable flammability data published by Electri~c Power Research Institute (EPRI). During a telephone conference with NYPA personnel, Region I and Nuclear Reactor Regulation (NRR) staff on April 3, 1995, the licensee stated that they had determined that the cables at IP3 are "similar" to the cables referenced in the EPRI reports, but they could not provide reasonable assurance, such as manufacturer, date of ma.nufacture, and cable type, t-hat-the cables specified in the EPRI report are representative of the cables installed.at iP3. The licensee also stated that plant-specific cable flammability data*was not available from the manufacturer. Due to th.e broad range in flammability data -for cables of "similar" construction, and the'different test protocols for obtaining the flammability data, and the licensee was not able to provide reasonable assurance that the data referenced in the licensee's January25, 1995, evaluation was applicable to cables installed at IP3;therefore, the team was concerned with the generic cable data used in the 7 licensee's fire seal analysis to adequately represent the cables installed at IP3. Subsequently, telephone conversations with NYPA, NRR, and Region I were held on April 7, April 28, and May 4, 1995, to discuss NYPA's actions to address this concern. During this conversation, NYPA stated that they intended to do further research to verify the applicability of the generic information Used in their evaluation. Additionally, NYPA intends to test a sample of installed cables to verify the ignition temperatures of the cables if needed. This item remains unresolved pending the completion of NYPA's effort and subsequent NRC review. The licensee has implemented fire watches in all plant areas where the penetration seals in question are located. These compensatory measures, coupled with the other elements of the licensee's fire protection program, ensure an adequate level of fire safety is provided. The team determined that the licensee's actions were acceptable for restart.Conclusions Based on the above, the team concluded that NYPA has taken appropriate corrective actions to repair the degraded seals at IP3. Therefore, PIP 177.1 Task 10 is closed. Additionally, the team reviewed LER 93-29 and found it to be appropriate. However, the associated Unresolved Item 50-286/93-24-03 remains open pendingthe completion of the licensee's effort and subsequent NRC review. The compensatory fire watches, coupled with the other elements of the licensee's fire protection program, ensure an adequate level of fire safety is provided for restart.2.1.7 PIP 177.1 Task 11 (RCIP Task #7); Cable Tunnel Suppression System Overview The purpose of this PIP Item 177.1 task was to review the electrical cable tunnel suppression system design and previous analyses for establishing suppression adequacy to meet Appendix R safe shutdown concerns.Details Amendment No. 24 to the Indian Point Unit 3 Facility Operating License No.DPR-64 required the licensee to complete Modifications

3.1.1 through

3.1.14 of the NRC Safety Evaluation Report (SER), dated March 6, 1979. Modification

3.1.8 required

installation of dry-pipe preaction-type sprinkler systems to provide coverage of all trays in the electrical tunnels and electrical penetration area that were not already covered by the existing system. It was the NRC's staff position that the system would comply with NFPA-15.During the October fire protection inspection (No. 50-286/93-24), the inspectors reviewed the sprinkler drawings and hydraulic calculations for the cable tunnel suppression system. At that time, the inspectors also verified the installation of the sprinkler system by performing a walkdown of the electric-al cable tunnel. Based on review of the SER, hydraulic calculations, and walkdown of the system, the team concluded that the sprinkler system installed was adequate to control and/or extinguish a fire. Therefore, this suppression system was considered acceptable for plant restart. 8 Conclusions Based on the above in-depth inspection results and NRC acceptance of actions taken by the licensee to complete this task, the team concluded that the electrical cable tunnel sprinkler system was adequate to control and/or extinguish a fire, and was determined to be acceptable for plant restart at this time. Therefore, PIP 177.1 Task 11 is closed.2.1.8 PIP 177.1 Task 12 (RCIP Task #8); Instrument'Sensing Line Separation Overview The stated purpose of this PIP Item 177.1 task was to review the separation of instrumentation lines in containment, along with cables, for effects of fire on instrument 'capability. Details This task pertains to the potential effect of fire on the performance of steam generator and pressurizer level instrumentation. This issue was identified by the licensee in their 1984 reanalysis to achieve safe shutdown conditions of the reactor in the event of fire within the non-inerted containment of IP3.Based on the 1984 configuration of sensing lines within containment for the steam generator and pressurizer level instruments, it appeared that they did not satisfy the requirements of Section III.G.2, Paragraphs D, E, and F. If an exposure fire was postulated to occur within containment, exposure of'the instrument sensing lines to the resulting elevated temperatures may result in a loss of accuracy and operability of these instruments, or cause previously unanalyzed spurious actuation due to the generation of false pressurizer or steam generator level signals.During the previous fire protection inspection in October 1993, the licensee stated that their evaluation of this concern had concluded that, due to the low probability of fire within the containment fire area, the low combustible loading in the area, and other physical aspects of the plant design and construction such as the routing of instrument sensing lines in steel Uni-Strut supports, an adequate technical basis exists to seek an exemption from the specific technical requirements of Appendix R, Section III.G.2.d, e, and f. Therefore, this task remained open pending submitting an exemption request to the NRC Office of Nuclear Reactor Regulation. The team noted that the licensee had submitted the required exemption request to the NRC office per their letter, dated November 30, 1993, and supplemental letter dated July 6, 1994. By letter, dated January 5, 1995, NRC granted to IP3 the above exemption from the requirements of 10 CFR Part 50, Appendix R, paragraph IIIG.2.f, to the extent that redundant wide-range steam generator water level sensing lines and the redundant pressurizer level sensing lines, located inside containment, need not be separated by noncombustible radiant energy shields. 9 Conclusion Based on review of the above letters, the team concluded that the licensee had adequately completed the above committed task. Therefore, PIP 177.1 Task 12 is closed.2.1.9. PIP 177.1 Task 13 (RCIP Task #9); Adequacy of Fire Dampers Overview The purpose of this PIP Item 177.1 task was to perform an NFPA 90A code compliance review of installed fire dampers and to make recommendations on nonconformances and deviations. Details During the 1993 fire protection inspection, licensee representatives indicated-that the following non-Appendix R fire wall fire dampers were not inspected as required by their commitments presented in their fire protection plan. This fire protection plan was established to meet Appendix A to Branch Technical Position (BTP) 9.5-1: DAMPER NUMBER Number 6 Number 29 Number 32 Number 38 Number 39 Number 40 Number 41 FIRE AREA CTL-3/11&CTL-3/35A PAB-2/8A&PAB-2/10A PAB-2/5A&PAB-2/9 PAB-2/5&PAB-2/21A PAB-2/6&PAB-27 PAB-2/17A& PAB-2/7 PAB-2/17A& PAB-2/20A LOCATION 33 foot of the Control Building 15 foot elevation of the Primary Auxiliary Building 34 foot elevation of the Primary Auxiliary Building 55 foot elevation of the Primary Auxiliary Building 55 foot elevation of the Primary Auxiliary Building 73 foot elevation of the Primary Auxiliary Building 55 foot elevation of the Primary Auxiliary Building In addition, the licensee stated that they were in the process of improving their fire damper surveillance program and the fire damper surveillance procedures. These procedures were to be revised to include the above-mentioned dampers and all other fire dampers for a drop test to be performed once a year. 10 During this inspection, the team noted that the licensee had completed the NFPA 90A Code Compliance Review of all dampers by November 1993. The team reviewed the code compliance effort and verified that the above fire dampers were included .in this evaluation effort. The team noted that this portion of the damper effort was included in the code compliance record of air conditioning and ventilation systems, issued'on May 27, 1994. Per discussion with the licensee and review of the documentation, the team ascertained that the only open issue remaining from this effort was to repair non-Appendix R fire damper No. 40 in the PAB building. Work Order 94-525 had been issued to replace the damper fuse link and missing blade locks. At this time, the licensee was awaiting parts delivery from their order. These replacements will be completed in the near future; however, the team determined that this repair was not essential for restart. The team also noted that the licensee had completed the fire damper drop test checks in May 1994, by means of the established work order process, to satisfy the TS requirements. Per discussion with the licensee, the team found that the Preventative Maintenance (PM) Procedure FIR-005-FIR, pertaining to damper maintenance, is under development and is expected to be completed in March 1995. This issue was being tracked under their Action Commitment Tracking System (ACTS) Item 4108.Based on the above review of related documentation and tests presented of this effort,-the team concluded that the above dampers were adequately inspected and satisfied annual code PM and TS requirements. Conclusions The team concluded that this task was adequate for the restart of the unit at this time. Therefore, PIP.177.1 Task 13 is closed.2.1.10 PIP 177.1 Task 14 (RCIP Task #10); Review of Safe Shutdown Procedures Overview Tasks 14 and 15 was initiated.to document the review of Alternate Shutdown Procedures including cooldown. The purpose of these tasks encompassed the review of ONOP-FP-1A and ONOP-FP-IB to ascertain if there were any operational concerns with the methodology stated in. the&;e procedures. Details The licensee formed a task force which provided detailed oversight of the fire protection program at IP3. The task force reviewed these procedures to ascertain if there were any operational concerns with the methodology stated in these procedures. In addition, the licensee walked down both ,Off Normal Operating. Procedures (ONOPs) to ensure manual operations called out by the procedures could be performed. The licensee verified that all the procedures worked as written. However, some procedure enhancements were identified and were discussed with the operations group for incorporation and revision. I1 The team discussed the enhancements with the operations group and did not identify any concerns. Included in this discussion was a review of selected portions of the following procedures:

• ONOP-FP-1, "Plant Fires," Revision 7;* ONOP-FP-IA, "Safe Shutdown from Outside the Control Room," Revision 9;* ONOP-FP-IB, "Cooldown from Outside the Control Room," Revision 6;* ONOP-FP-IC, "Fire Area Evaluation," Revision 0;* SOP-ESP-I, "Local Operations of Safe Shutdown Equipment," Revision 0;and* SOP-EL-12, "Operations of the Alternate Safe Shutdown Equipment," Revision 9.The team also reviewed Nuclear Safety Evaluation 95-3-098FP pertaining to the updates to the Appendix R safe shutdown procedures.

Additionally, the team observed an in-plant drill requiring safe shutdown of the plant from outside the control room. The watch-team performed well, demonstrating familiarity with the plant equipment, and worked smoothly through the new procedures. As a result of the training of all watch-teams, NYPA identifi.ed a number of additional enhancements to be added to the procedures. At the end of this inspection, NYPA was in the process of evaluating these enhancements and stated their intentions to revise procedures as needed.Conclusions Based on the above review, the team concluded that the procedures provided sufficient guidance and detail to enable the operators to perform required actions. No deficiencies were identified during the procedures review. The licensee has taken appropriate corrective actions to resolve the issues stated in the above tasks. Therefore, these tasks are closed.2.1.11 PIP 177.1 Task 15 (RCIP Task #11); Adequacy of Cold Shutdown Repair Procedures Refer to Section 2.1.10 for discussion and closure of this item.2.1.12 PIP 177.1 Task 16 (RCIP Task #12); Appendix R Commitments For Compliance Overview This task was required to be performed by NYPA to demonstrate that commitments they made to the NRC, as summarized in the Design Basis Licensing Database for 10 CFR 50, Appendix R, Sections I11.G, J, L, and 0, were properly implemented. Details During Inspection 50-286/93-24, the inspectors determined that NYPA had made progress in the review of their commitments to ensure compliance with all committed actions. Of 80 commitments reviewed, nine (9) could not be verified as complete and were being addressed by NYPA at the completion of that inspection. During this inspection, the team verified the completion of those remaining nine items as documented in the internal NYPA memorandum ADM-QH93-343, dated August 27, 1993. The issues pertaining to these nine commitments were reviewed in detail, and the description of these reviews are contained in the following sections of this report: 0 Generic Letter 86-10 Resolution (Section 2.1.21);* Emergency Lighting Issues (Section 2.2);* Fire Dampers (Section 2.1.9); and,* Quality Assurance Item Resolution (Section 2.1.20)Conclusion The team concluded that this task was adequate for the restart of the unit.Therefore, PIP 177.1 Task 16 is closed.2.1.13 PIP 177.1 Task 17 (RCIP Task #13); Testing of Appendix R Alternate Shutdown Equipment Overview This PIP task was initiated to identify, document, and/or resolve concerns associated with the testing of Appendix R safe shutdown equipment. Details In response to this PIP.task, NYPA performed an item-by-item assessment of each Appendix R-related component versus the testing or maintenance activity associated with the components. The scope of NYPA's review was based on those components required for safe shutdown-as described in the plant.fire operating procedures. The results of NYPA's review identified a few components without previously developed periodic testing requirements and a few other components without PM coverage. The testing concerns were addressed by developing test procedures and subsequent satisfactory completion of these tests. The PM concerns were directed to the IP3 Site PM Coordinator and processed in accordance with plant procedures. The team reviewed the results of NYPA's effort to address this PIP task item, including a sampled review of test procedures. The team determined that licensee corrective actions were appropriate. 13 Conclusion The team concluded that this task was adequate for the restart of the unit.Therefore, PIP 177.1 Task 17 is closed.2.1.14 PIP 177.1 Task 18 (RCIP Task #14); Appendix R Emergency Battery Light Issues Refer to Section 2.2.1 for discussion and closure of this item.2.1.15 PIP 177.1 Task 19 (RCIP Task #15); Development of Modification for Additional Emergency Lights Turbine and Administration Buildings Refer to Section 2.2.2 for discussion and closure of this item.2.1.16 PIP 177.1 Task 20 (RCIP Task #16); Safe Shutdown Communication Review Overview The purpose of this PIP Item 177.1 Task 20 was to review the safe shutdown communications, and the maintenance and testing of the communications equipment. Details In response to this task, the licensee developed a procedure which included the testing of communication equipment capabilities to perform the alternate shutdown procedures. During this inspection, the team reviewed test Procedure 3PT-RI52, Revision 1, "Operability Test of Safe Shutdown Instrumentation," dated October 29, 1993. The licensee stated that the safe shutdown communications will be verified prior to start-up. The licensee also verified that radio communication links required for ONOP-FP-IA were established and functioned satisfactorily. The team did not identify any deficiencies in this area.Conclusions Based on the above review, the team concluded that the licensee has taken appropriate corrective actions to mitigate the above concern. Therefore, this task is closed.2.1.17 PIP 177.1 Task 21 (RCIP Task #17); Development of Fire Protection Plan Overview The stated purpose of this PIP task was to develop and implement an updated fire protection program plan. 14 Details During Inspection 50-296/93-24, the inspectors reviewed the recently developed"Fire Protection Plan for Indian Point 3 Nuclear Power Plant," Revision 0, dated June 30, 1993, and determined it did not provide sufficient detail to determine the extent and effectiveness of the Fire Protection Program. At the time of Inspection 50-286/93-24, it was NYPA's intention to revise the Fire Protection Plan; however, due to an ongoing reorganization within the NYPA engineering organization, NYPA has yet to complete the revisions to the Fire Protection Plan. NYPA has recently established a temporary task force to resolve the numerous outstanding fire protection/Appendix R-related issues.The guidance used by this task force was provided in Indian Point 3 Standing Order EDSO-O1, "Closure of Open Fire Protection Items," Revision 1, effective November 11, 1994. Further discussions of this task force are provided in Section 2.7 of this report. Additionally, NYPA initiated ACTS Item 8170 to track the revision of the Fire Protection Plan upon completion of NYPA's reorganization. During this inspection, the team reviewed EDSO-01, and other fire protection/Appendix R-related procedures and documents, and found them to provide adequate guidance to define the Fire Protection Plan at Indian Point 3 for restart. The team noted the need for revision of the Fire Protection Plan pending completion of the task force's duties and the reorganization of NYPA staff, as stated in the above mentioned ACTS item.Conclusions Based on the established administrative controls in place, the team concluded adequate guidance was in place to control fire protection-related activities for restart. However, it was the team's understanding that the Fire Protection Plan will be revised upon the completion of the task force's assigned duties following the reorganization of NYPA staff. Therefore, this PIP task is closed based on NYPA's assurance that this task will be completed as described. 2.1.18 PIP 177.1 Task 22 (RCIP Task #18); Validation/Confirmation of IP3 Fire Hazards Analysis Overview The purpose of this PIP Item 177.1 task was to validate and confirm the Fire Hazard Analysis (FHA.), to check assumptions regarding low fire loading, and verify.the adequacy of updated combustible loading analyses to ensure that.the FHA information is properly maintained for plant needs.Details During this inspection, the team noted that the licensee had updated the IP3 Fire Hazard Analysis (FHA) on January 11, 1995. This analysis superseded the existing fire/area zone analysis, Section 6.0 of the Fire Protection Program Manual (FPPM). The FPPM manual, issued by NYPA, was considered as a reference fire protection document that included field modifications installed sincethe last update in January 1991. NYPA, as discussed in Section 2.1.1, completed this work as a part of the PIP 177.1, Task 5 effort, after reviewiflg all the 15 outstanding field modifications and had updated the FHA and the Appendix R Analysis to reflect these changes. To date, with the exception of 14 recent modifications, all applicable data have been properly reflected in this report. Per discussion with the licensee, the team noted that *ongoing remaining modifications, having impact on FHA and Appendix R documentation, was being tracked Under the established configuration control procedure and applicable documents would be updated on an as-needed basis.The team noted that the licensee's FHA document clearly defined the basic objective, scope, background, and regulatory requirements to provide adequate guidance for its users. In addition, a list of installed modifications reviewed by NYPA was contained in Appendix B of the FHA. The team noted that the licensee had included all areas containing equipment

• or systems necessary for achieving or maintaining cold shutdown during a single fire event, and those areas representing an exposure to any of the foregoing areas in this document.

A sample review by the team of the FHA data, as-built design drawings, and observation of a computer simulation demonstration for a control room fire, revealed no concerns.Conclusions The team concluded that the licensee had adequately validated and incorporated the outstanding modifications for fire protection impact on the FHA and Appendix R documents. Therefore, this task is closed.2.1.19 PIP 177.1 Task 23 (RCIP Task #19); Operations Review Group Item Review Overview This task was initiated to identify, document, and/or resolve Operations Review Group (ORG)-identified fire protection and Appendix R start-up issues.Details During this inspection, the team noted that NYPA collected all fire protection and Appendix R-related issues, including the ORG tasks, and listed them as either start-up issues or not. Each issue was provided an individual ACTS number.The team noted that the NYPA ACTS program was established by Procedure AP-37.4. This system tracks and controls all NYPA's commitments, including required fire protection restart issues of all organizations. The team reviewed the ACTS open and closed items list for the fire protection and Appendix R issues and found no concerns. The team noted the open restart issues were adequately reflected as requiring completion prior to restart. 16 Conclusion Based on the above review, the team concluded that the ORG tasks have been adequately incorporated into the ACTS program, and that the remaining open restart ACTS items will be completed prior to restart. Therefore, this item is closed.2.1.20 PIP 177.1 Task 24.(RCIP Task #20); Quality Assurance Item Resolution (Violation 50-286/91-09-03 & Unresolved Item 50-286/93-04-07) Overview The purpose of this task was to identify, document, and resolve fire protection and Appendix R start-up issues identified by the, Quality Assurance (QA) Department. Previous NRC Inspection Reports 50-286/91-09 and 50-286/93-04 and NYPA QA Audits FPA-89 and 90-42 documented the ineffectiveness of the tracking system and actions to resolve QA-identified deficiencies. Some of these deficiencies had existed since 1986. NYPA's failure to take timely corrective action on issues was indicative of a weakness in their ability to prioritize issues properly, assess them for safety significance and. regulatory requirements, and establish appropriate compensatory measures. These issues were presented in NRC Violation 50-286/91-09-03 and again in Unresolved Item 50-286/93-04-07. Details As stated in NYPA's violation response letter, dated August 1, 1991, all previously required audits were completed by the Corporate Appraisals and Compliance Group Fire Protection Organization from the White Plains office.This group utilized independent procedures and processes, and did not -have the items tracked within the Site QA Corrective Action Tracking Process. This means failed to allow for an effective escalation process or complete resolution of identified issues.Corrective actions taken by the licensee included the implementation of one station-wide corrective action system, ACTS. This system was described in Administrative Procedure AP-37.4, Revision 0, "Action and Commitment," and was administered by the IP3 ORG. This system had been in place since November 1, 1993. The ACTS report notifies station department heads, general managers, and the resident manager of unresolved corrective action items weekly.All items identified within the 1990 QA. audit report that remain open, including the issues from 1986 through 1989, were captured in the ACTS. In addition, the QA organizations were found to require that all fire protection. audits are performed in a formal, planned manner within the administrative framework of the site QA group. Three general manager positions have been created to oversee station activities and report to the resident manager.These general managers receive the described reports and have been tasked to ensure prompt corrective actions. 17 QA has also dispositioned and resolved other fire protection deficiencies or nonconformances identified in 1991, in addition to the previous audit findings.The team reviewed QA audits performed between 1986 and 1994 and the corrective actions taken to resolve a sample of previously identified deficiencies. The following QA findings were reviewed: 0 Recommendation 832, EDG fanhouse fire protection penetration seal;0 Recommendation 725, Ventilation of paint room;0 Finding 91-14-01, Operability for non-surveilled fire damper;0 Finding FPA-88-R02, Insufficient ventilation for safe shutdown equipment; and 0 Corrective Action Request 768E, Operability Criteria for smoke detector functional test.Conclusion Based on this review, the team concluded that appropriate measures had been taken by NYPA to track and resolve QA-identified deficiencies. NYPA has initiated LERs, where appropriate, completed evaluations, implemented. modifications, and completed corrective actions described in response to Violation 50-286/91-09-03. The team concluded that corrective actions taken have been adequately prioritized and have appropriately assessed safety impact and significance. As a result of extent of condition reviews performed during initial correct~ive action work, ACTS items and tasks have been assigned for tracking and future resolution of issues identified. Based on this review, the team concluded-that adequate corrective actions had been-taken to resolve QA-identified deficiencies associated with fire protection. For the issues that were determined to require further action necessary for resolution, appropriate measures had been established to track them for closure. The team confirmed that commitments, made by NYPA in response to Violation 50-286/91-09-03-and as discussed under Unresolved Item 50-286/93-04-07, had been implemented. Additional discussions regarding these inspection items is provided in Section 2.2 of this report. PIP 177.1 Task 24 is closed.. 19 that operations would have responded properly to any events that would have challenged the fire protection systems. This was considered a violation of the TS. However, the violation was not cited because the criteria for discretion specified in the NRC Enforcement Policy, Section VII.B., was met.The team noted that the licensee had compared the 1984 Appendix R reevaluation against Generic Letter 86-10 for IP3, and concluded that the previous 1984 Appendix R analysis did not address the following two issues: 1. the vulnerability of the equipment and personnel in room or zone due to the environment created by the fire or suppression systems; and 2. the consideration of high impedance faults for all associated circuits located in the fire area of concern required to meet theseparation criteria of Section III.G.2 and III.G.3 of Appendix R.The first issue was addressed in Task 27, described in Section 2.1.23 of this report. This task required development of an exemption request to approving operator access to the instrument isolation cabinets for a postulated fire at the entryway. The team noted that such an exemption existed for this location for NYPA, as referenced in the recent NRC letter to NYPA, dated December 20, 1994. To address the second issue, the licensee had issued Task 31, which is described in Section 2.1.27 of this report.Conclusions Based on the above described review, NYPA appropriately addressed the Generic Letter 86-10 concerns. Therefore, PIP 177.1 Task 25 is closed.2.1.22 PIP 177.1 Task 26 (RCIP Task #22); Request for Engineering Services Resolution Overview The purpose of PIP Item 177.1 Task 26 was to resolve the fire protection and Appendix R-related Requests for Engineering Services (RES) that were identified as required for start-up.Details During this inspection, the team noted that the licensee had reviewed all the fire protection RESs as part of the ongoing PIP task. Additionally, NYPA has replaced the RES process with the engineering work request process (EWR). The team reviewed the outstanding EWR list with the system engineer. This list contained approximately 40 items, some of which were in the process of being*addressed and would be closed out prior to start-up. The team found the system engineer knowledgeable of all the open EWRs. The review of the outstanding EWRs indicated no significant issue affecting the start-up concerns. 20 Conclusions Based on the above described review, the team concluded that NYPA has adequately established the control of backlogged fire protection and Appendix R-related RESs/EWRs. Therefore, the PIP Task 26 is closed.2.1.23 PIP 177.1 Task 27 (RCIP Task #23); Cable Tunnel Entryway Exemption Request Overview This task was initiated to track the completion of an exemption request to approve operator access to instrument isolation cabinets during a postulated fire at the entryway to the cable tunnels.Details During this inspection, the team noted that NYPA, in their letter, dated November 17, 1993, and supplemental letter, dated September 6, 1994, submitted a request for exemption from Section III.G.3 of Appendix R to 10 CFR 50. In response to this exemption request, the NRC in a letter, dated December 20, 1994, explained that the previously existing Appendix R exemption granted pertaining to the cable tunnel fire zone area, was valid and therefore, another exemption requested was not needed. The previous exemption was reviewed and granted by the NRC in their letter, dated February 2, 1984.Conclusion Based on the review of the above documentation, the team concluded that NYPA had adequately addressed the above issue. Therefore, PIP Task 27 is closed.2.1.24 PIP 177.1 Task 28 (RCIP Task #24); Inspection of Control Building Internal Seals (Unresolved Item 50-286/93-24-04) Overview The purpose of this task was for NYPA to complete the technical evaluation associated with the flamemastic seals in the control building floor and the cable spreading room. This was also identified as Unresolved Item 50-286/93-24-04. Details The team reviewed the licensee's response tc, the task and the. associated. unresolved item. The licensee performed the reinspection of the flamemastic fire stops of the control building and cable spreading room floors. The results of this reinspection were documented in Evbluation Number 18 of ENG-21 527, "Fire Barrier Inspections." This reinspection was conducted in two stages, each consisting of thirteen random reinspections. This reinspecti~on was limited to the fire stops in the control building and cable spreading room floors. The licensee concluded the following:

1. Fourteen fire stops did not contain any foreign material and contained acceptable quantity of fiber.2. Ten fire stops contained relatively insignificant foreign material (both combustible and non-combustible), with acceptable quantity of fiber.3. One fire stop was void of both foreign material and fiber glass fill, thus creating an airspace between the transite bottom and marinite top.The penetration was a spare penetration (such that, no penetrating items passing through the opening).4. One fire stop contained a significant piece of combustible material (a 14-inch long piece of 2-inch by 4-inch wood). This penetration did contain an acceptable quantity of fill.The team walked down these areas and did not identify any deficiencies.

The team also reviewed the packages that showed that the above discrepancies had been corrected. Conclusions Based on the above review, the team concluded that the licensee has taken appropriate corrective actions to satisfy the above discrepancies. Therefore, Task 28 and associated Unresolved Item 50-286/93-24-04 are closed.2.1.25 PIP 177.1 Task 29 (RCIP Task #25); Absent Fire Barrier Wrap (LER 93-038)Overview This task was initiated to address resolution of fire barrier wrap missing on the amplifier box for No. 31 source range flux detector penetration area. The licensee also issued LER 93-038 documenting the missing fire barrier wrap in the penetration area.Details On September 30, ]993, with the unit in cold shutdown, the licensee determined that the plant was not in compliance with 10 CFR 50, Appendix R, Section 1I1.G.2, because a fire barrier wrap was not installed or barriers were deficient for some plant specific areas. The licensee stated that the probable cause, was a personnel error during the plant modification. To restore compliance,. the licensee took the following corrective actions: 1. Reviewed the Appendix R modifications to assure that the modifications were performed in accordance with Appendix R requirements. 22 2. Reviewed in detail maintenance/repair and surveillance procedures for the installed fire barrier wrap.3. The licenseerevised Surveillance Procedure, 3PT-R102, "Fire Barrier/Radiant Energy Shield Inspection," which incorporated more stringent requirements for the inspection of fire barrier wrap configurations.

4. The licensee had replaced all the missing wrap with the exception of additional 120 feet of 1-hour fire barrier wrap on.N-31 conduit 1VF/JA.This additional wrap would extend from the point where the existing fire wrap stops (approximately 20 foot into the upper electrical tunnel from the upper penetration area) to the point where the existing fire wrap continues again, such that the entire conduit runs inside theupper penetration area, and the upper electrical tunnel including the entryway is protected.

At the end of this inspection, this work was in progress.The licensee stated that this work will be completed prior to start-up.The team walked down the areas where the fire barrier was being wrapped. The team did not identify any deficiencies in this area.Conclus ions Based on the above review, the team concluded that the licensee has taken appropriate corrective actions to eliminate the above-mentioned concerns.Therefore, the Task 29 and the associated LER 93-038 are closed.2.1.26 PIP 177.1 Task 30 (RCIP Task #26); Appendix R Compliance Summary Overview This task was initiated to outline the compliance summary information, contained in the 1984 reevaluation rep6rt in a'style and format more. friendly to technical personnel not intimately familiar with Appendix R requirements, IP3, or both. The. completion of this task was not required for restart.Details The team reviewed portions of NYPA's "IP3 Appendix R, Section III.G & III.L Compliance Summary," IP3-ANAL-FP-01251, Revision 0, dated March 1995, and found it appropriate to address this task item. Additionally, the team reviewed portions of "Appendix R Operational Specifications," dated March 27, 1995, and Nuclear Safety Evaluation (NSE) 95-3-100 used to approve these operational specifications.-- These operational specifications identified actions to be taken should the systems, structures, or components become inoperable, and restricts the duration for which these components can remain inoperable while the plant is at operating conditions; 23 Conclusion Based on the above review, the team concluded that the licensee has taken appropriated actions to address PIP 177.1 Task 30. Therefore, this item is closed.2.1.27 PIP 177.1 Task 31 (RCIP Task #27); Multiple High Impedance Faults Overview This task was initiated as a result of..the review of Generic Letter 86-10*efforts in the area of fire protection and Appendix R. After NRC Inspection 50-286/93-24, a new task, PIP Item 177.1, Task 31, was undertaken by NYPA to address the potential effects of Multiple High-Impedance Faults (MHIF) on safe shutdown capability. The concern associated with MHIF is a potential tripping of incoming supply circuit breakers, used for powering safe shutdown buses, due to multiple high impedance faults resulting from a fire.Details The team evaluated-NYPA's resolution of this concern by reviewing selected portions of Report Number IP3-RPT-FP-01383, "Multiple High Impedance Fault Study," Revision 0. Through review of this report and discussions with NYPA staff, the team considered the assumptions and methodology, used to determine the potential susceptibility of the safe shutdown buses, to be appropriate and consistent with those accepted by the NRC in the past. The results of this study indicated that 8 of 26 buses could incur a trip of the incoming breaker due to postulated fires. To address these eight concerns, the report provided* a listing of the fire areas in which the bus failed, and indicated specific loads which need to be shed via manual actions to prevent the loss of safe shutdown loads associated with the bus. The team verified that these manual actions were incorporated into ONOP-FP-1, "Plant Fires," Revision 7.The team was concerned with the review and update of the MHIF study with future modifications to the plant. In response to this concern, NYPA instituted the following ACTS items: ' ACTS Item 5575, which will update MCM-19, "Modification Closeout," to include the IP3 MHIF study as a potential affected document when performing modification closeout;* ACTS Item 4557, which will update FPES-4B, "Fire Protection/Appendix R Compliance Procedure (IP3)," to include the IP3 MHIF study as a potential affected document when performing an Appendix R compliance review; and ACTS Items 7335, which will update EES-6, "Control of Electrical Distribution System Changes," to include the IP3 MHIF study as a potential affected document when reviewing changes to the IP3 electrical distribution system.The team considered this appropriate to address this concern. 24 Conclusion The team considered the MHIF study to be thorough and well documented, with the recommended manual actions appropriately captured in the plant fire procedures. Therefore, PIP Task 31 is closed.2.1.28 PIP 177.1 Task 32 (RCIP Task #28); Temporary Modification Review Overview This task was initiated to review temporary modifications installed prior to AP-13, "Temporary Modification Procedure," Revision 13. Prior to Revision 13 of AP-13, no guidance was provided to verify the impact of temporary modifications on the fire protection/Appendix R programs.Details For this task, approximately 73 temporary modifications were reviewed by a NYPA contractor. No temporary modifications were found that adversely affected the IP3 Appendix R compliance strategy. The team reviewed the guidance used by NYPA's contractor to evaluate the impact of the temporary modification on the Fire Protection/Appendix R Programs and considered it to be comprehensive. Additionally, the team verified that AP-13, Revisions 13 and 15, contained appropriate controls to ensure subsequently installed temporary modifications would not adversely impact the Fire Protection/Appendix R Programs. The team also reviewed the currently installed temporary modifications and identified no concerns.Conclusion The team considered NYPA's actions to address this PIP task to be appropriate. Therefore, PIP Task 32 is closed.2.1.29 Conclusion -Short-Term Fire Protection/Appendix R-Related Corrective Actions*Based on the above review of NYPA's efforts to address the short-term fire protection/Appendix R-Related corrective actions, Inspector Follow-up Item 50-286/93-24-01 is closed. Unresolved Item 50-286/93-24-04, pertaining to operability determination of degraded and potentially nonconforming fire barrier penetrations seals and Unresolved Item 50-286/93-24-05, pertaining to the impact of modification on Appendix R, were also closed. Unresolved Item 50-286/93-24-03, pertaining to the verification of cable insulation ignition temperatures, remains unresolved. The compensatory fire watches, coupled with the other elements of the licensee's fire protection program, ensures that an adequate level of fire safety is provided for restart. Also, the team reviewed and found appropriate NYPA's LERs 93-29 and 93-38. 25 2.2 Emergency Lighting Issues The team reviewed the adequacy of installed emergency lights required during loss of normal and backup lighting for vital plant areas and equipment. Lighting for these areas and equipment are required to achieve and maintain hot shutdown. This review was performed to verify compliance with Appendix R, Section III.J. of 10 CFR Part 50, and to verify adequate illumination to execute the alternate safe shutdown actions to be taken by plant operators. The team performed a walkdown of all plant areas required in a blackout condition to support their assessment and verify adequate illumination to execute the alternate safe shutdown actions. The team's review also included an assessment of corrective actions taken by the licensee to address previously identified emergency lighting issues.2.2.1 PIP 177.1 Task 18 (RCIP Task #14); Appendix R Emergency Battery Light Issues (Violation 91-09-03 and Unresolved Item 50-286/93-04-07) Overview The purpose of this task was to resolve emergency lighting deficiencies associated with 8-hour discharge testing, blackout testing, proper aiming, and maintenance and surveillance procedures in accordance with industry and vendor recommendations. NRC concerns related to these deficiencies were identified in several inspection reports, including Violation 50-286/91-09-03 and Unresolved Item 50-286/93-04-07. Details NYPA has addressed these concerns by completing a design review of the installed emergency battery lighting (EBL) units, revising procedures, and by performance of a blackout test, ENG-533, Revision 3, "Appendix R Emergency Battery Lighting Area Blackout Test." Concerns related to 8-hour discharge testing, monthly functional test procedures, and the lack of adequately installed emergency lighting in the plant turbine areas were adequately resolved and were documented in NRC Inspection Report 50-286/94-29. To address the issues regarding the illumination acceptability of installed EBLs, mispositioning of the installed EBLs, and the lack of documentation to indicate that tests had been performed to verify light adequacy, the licensee has completed detailed EBL pathway drawings and Procedure ENG-533. ENG-533 served to verify the adequacy of Appendix R lighting utilized during an alternative shutdown fire scenario that requires evacuation of the control room. Off Normal Operating Procedure ONOP-FP-]A, Revision 8, "Safe Shutdown From Outside The Control Room," presents the necessary equipment needed by plant operators to achieve and maintain safe shutdown. 26 During performance of ENG-533, Revision 1, the licensee identified insufficient emergency lighting to illuminate the 6.9 kV switchgear area, turbine front standard, and three standby gas turbine substation cubicles, which required manual actions to operate safe shutdown equipment. Subsequently, the licensee submitted LERs 93-055 and 93-055-01 and corrective actions to address these deficiencies. Actions taken by NYPA to correct these deficiencies included the development and implementation of modifications for installing EBLs in those identified areas (Design Change DC94-3-212 EML, Revision 0). The team verified the adequacy of EBLs for all plant areas, equipment, and access/egress pathways required for alternate safe shutdown as presented in ONOP-FP-1A. This verification was performed by the team during execution of the blackout test Procedure ENG-533, Revision 3. This test was performed in a blackout condition using a senior reactor operator to simulate the required alternate safe shutdown actions. The team noted that EBLs were verified under this procedure for equipment and areas needed to achieve and maintain the plant in cold shutdown. This verification was above the minimum requirements for only achieving hot shutdown. EBLs were adjusted where necessary to provide maximum illumination. Almost all EBLs had alignment markings applied for ease of future verification of proper EBL orientation. Exceptions to those EBLs marked included EBL units located in areas of high clearance that require ladders to adjust and could not be disturbed easily.Review of licensee actions to resolve fire protection and Appendix R lighting issues included a telephone conversation held between NYPA and the NRC on December 21, 1994. During this conversation, NYPA provided their position on the use of existing security lighting in lieu of installing additional exterior 8-hour emergency lighting needed during certain Appendix R scenarios. These scenarios included operator actions to read level indication for the condensate and refueling water storage tanks, cleaning of backup service water strainers, and manually backflushing main service water strainers. The team verified that ACTS numbers and tasks had been assigned for tracking and future resolution of these issues. On March 15, 1995, the licensee formally submitted an exemption request to utilize yard area lighting in lieu of 8-hour battery-powered lights in outside areas. The Office of Nuclear Reactor Regulation issued the exemption request on March 29, 1995.Conclusion The team concluded that the blackout testing performed properly verified EBL aiming and illumination levels required by Appendix R to ensure necessary actions can be performed. Additionally, EBLs needed to achieve and maintain cold shutdown were also verified through performance of the blackout test.Corrective actions taken by the licensee to resolve previously identified lighting deficiencies were adequate. The team determined that actions taken by NYPA appropriately resolved NRC emergency lighting concerns associated with Violation 50-286/91-09-03 and Unresolved Item 50-286/93-04-07. Additional discussion associated with these inspection items is made in report Section 2.1.20. Based on the above review, these inspection items and PIP 177.1 Task 18 (RCIP Task #14) are closed. 27 2.2.2 PIP 177.1 Task 19 (RCIP Task #15); Development of Modification for Additional Emergency Lights in Turbine and Administration Buildings Overview The purpose of this task was to resolve emergency light deficiencies identified in LER 93-007. This LER was initiated to address two specific access pathways that were found not to have 8-hour EBLs installed. These pathways were within the turbine and administration buildings. Specifically, one pathway was for senior reactor operator (SRO).egress to the primary auxiliary building needed during evacuation of the central control room during an Appendix R scenario, and the other pathway was for shift supervisor egress from the turbine building 53-foot elevation to the 15-foot level via the turbine building middle stairway. This route was required for access to alternate safe shutdown equipment located on the 15-foot level of the turbine building.Details Corrective actions initiated by NYPA in response to this identification included-development and implementation of minor modification 93-3-253EML, Revision 0, "Emergency Battery Light Coverages in the Turbine and Administration Building." In addition, the licensee created a fire protection system engineer position at Indian Point 3, responsible for monitoring and assessing fire protection and Appendix R compliance issues, and semi-annual maintenance Procedure ELC-018-GEN, Revision 4, "Inspection, Replacement and Semi-Annual Operability Testing of Appendix R Lighting Units," for periodic verification of EBL adequacy. Furthermore, the adequacy of EBL aiming and illumination was verified by the team during performance of ENG-533, as discussed in report Section 2.2.1.Conclusion Based onNYPA's actions to install the 8-hour EBLs and establish measures to verify, inspect, and maintain EBLs, the team concluded that the concerns associated with this task had been adequately resolved. Also, the team verified the acceptance of these EBLs during performance of ENG-533. Based on this review, PIP 177.1 Task 19 (RCIP Task No. 15) is closed.2.3 PIP 177.1 Tasks 7 AND 8 (RCIP Tasks #3 & 4); Fire Wrap/Penetration Related Issues (Unresolved Items 50-286/93-08-07 & 50-286/93-24-06) Overview The stated purpose of PIP Item 177.] Task 7 and the associated Unresolved Item 50-286/93-24-06 was to walkdown the HEMYC wrap installed throughout the plant and credited for 10 CFR 50, Appendix R, compliance to: (1) define the purpose of the wrap; (2) detail improvements and changes needed; and (3) revise the identified procedures for the repair and surveillance of the HEMYC wrap. The purpose of Task 8 was to walk down the marinite board currently installed ' 'inside containment and credited for 10 CFR 50, Appendix R, compliance to: (1)define the board placement and purpose; (2) detail improvements and -changes 28 needed; and (3) identify and revise the procedures for the repair and surveillance of the Appendix R-credited marinite board. Additionally, the team reviewed Unresolved Item 50-286/93-08-07, pertaining to the adequacy of NYPA's surveillance program to identify seal penetration deficiencies. 2.3.1 Fire Barrier Inside Containment Details During this inspection, the team reviewed engineering procedure ENG-534, dated August 31, 1993, "Fire Barrier Wrap and Radiant Shields Inspections." This procedure established the definitions and functional integrity of fire barrier wraps and radiant energy shields used to establish compliance with the requirements 10 CFR Part 50, Appendix R. The functional integrity of fire barrier wraps and radiant energy shield materials including HEMYC wrap was defined in this procedure to demonstrate the ability to perform its intended function. The licensee has used HEMYC wrap and marinite board inside containment to separate redundant safe shutdown cabling and equipment. Marinite board was an acceptable material for use as per the guidance provided in GL 86-10, as a radiant energy shield inside containment. The team determined that the specific application of HEMYC wrap inside containment provided an acceptable level of protection against the anticipated hazards of a localized fire. Therefore, the use of HEMYC wrap was determined to be an acceptable radiant energy heat shield for the specific installed applications observed by the team.The team visually inspected several radiant energy heat shields, installed by the licensee, containing HEMYC wrap and marinite board inside containment. The team did not observe any unacceptable conditions. The licensee also has established installation/repair and surveillance procedures for HEMYC wrap and marinite board. The team reviewed these procedures and did not identify any discrepancies in these procedures. With respect to marinite boards, the team also investigated a concern regarding missing and damaged marinite boards that were identified following the 1989 outage. The boards in question were mostly installed to satisfy FSAR cable separation requirements, while others were installed to satisfy 10 CFR 50, Appendix R requirements. The NYPA management team, in place at that time, made a decision only to replace some of the boards at that time. A safety evaluation to support this decision was apparently not completed. Based on this inspection and previous NRC and NYPA inspections of the issue in 1991, the remaining missing and damaged boards were verified to have been replaced. The team understands that NYPA is currently in the process of determining how much, if any, of the missing or damaged boards were Appendix R-related. Based on the team's review of the above procedure, walkdown of selected penetration seals,*and review of LERs 93-18 and 93-4] performed and documented in Inspection Report 94-09, Unresolved Item 50-286/93-08-07 is closed. 29 Conclusions The team concluded that the licensee has adequately addressed Unresolved Item 50-286/93-08-07. 2.3.2 Fire Barrier Wrap Outside Containment Overview Appendix R to 10 CFR Part 50, Sections III.G.2.a, b, and c specify fire protection methods to separate redundant safe shutdownequipment and associated nonsafety-related circuits. Section III.G.2.c allows enclosure of cable and equipment and associated nonsafety-related circuits of one redundant train in a fire barrier qualified to a 1-hour fire rating when fire detectors and an automatic suppression system has been installed. Outside containment, the licensee used HEMYC wrap to meet these 1-hour separation requirements at Indian Point 3 Nuclear Station. During the 50-286/93-24 inspection, the team identified Unresolved Item 50-286/93-24-06, concerning the use of fire barrier HEMYC wrap outside containment, based on the lack of acceptable American Society for Testing of Materials (ASTM) E-119 I-hour fire tests representative of the installed plant-configuration. Details During this inspection, the licensee provided the team with engineering evaluations of the two fire tests to support the design and installation of HEMYC fire barrier wrap for compliance with Appendix R, I-hour separation criteria (III.G.2.c). The team reviewed the engineering evaluation for the use of HEMYC wrap in various areas of the plant outside of containment. The differences between the tested and plant configurations were judged by NYPA to have no safety significance within this evaluation. Further, the licensee has provided automatic fire detection systems, which provide area-wide coverage and an automatic suppression and detection system covering all of the cables located in trays throughout the area. The team did not identify any concerns regarding this evaluation. Conclusions Based on this evaluation, the team concluded that the unresolved item was closed. However, the use of all fire barrier wrapping materials are being evaluated on a generic basis for its acceptance by the NRR staff. Therefore, the staff will follow-up on the use of this material, following NRR's completed review, during a future inspection if necessary. 3C 2.3.3 Conclusion -PIP 177.1 Tasks 7 and 8; Fire Wrap/Penetration Related Issues The team concluded that the licensee has adequately addressed PIP 177.1 Tasks 7 and 8, and Unresolved Items 50-286/93-08-07 and 50-286/93-24-06. Therefore, these issues are closed.2.4 Reactor Coolant Pump Oil Collection System Overview The team reviewed the adequacy of the design, installation, and maintenance of the oil collection system (OCS) for each of the four reactor coolant pumps (RCPs) for compliance with Section III.0 to Appendix R of 10 CFR 50. This assessment included walkdowns of the installed OCS and review of the as-built drawings, design change documentation for system installation, seismic analysis, and license conditions related to the OCS.Details Appendix R to 10 CFR Part 50 requires such collection systems to be capable of collecting lube oil from all potential pressurized and unpressurized leak sites in the RCP lube oil systems. Leakage shall be collected and drained to a vented closed container that can hold the entire lube oil inventory. A flame arrester is required in the vent if the flash point characteristics of the oil presents the hazard of fire flashback. Leakage points to be protected shall include lift pump and piping, overflow lines, lube oil cooler, oil fill and drain lines and plugs, flanged connections on oil lines, and lube oil reservoirs where such features exist on the RCPs. The drain line shall be large enough to accommodate the largest potential oil leak.2.4.1 Modifications In a letter, dated March 6, 1979, the NRC issued Amendment No. 24 to the IP3 operating license. Section 3.1.12 of the Safety Evaluation Report, accompanying the license amendment, documented the requirements for the OCS.The original RCP OCS design included drip pans, enclosures, and associated piping and supports to prevent the possibility of oil making contact with the RCP components and piping and igniting. This design was purchased from Westinghouse and installed under Modification No. 80-3-083. Under the configuration and design controls in place at the time, the only documents provided for the system were the fabrication and installation drawings for the enclosures and drip pans. No drawings of the piping or piping supports were provided. The OCS is QA Category M (important to safety), but is not safety-related. It has been established to prevent an oil fire inside containment. In a letter, dated November 16, 1981, NYPA stated that there was reasonable assurance that the OCS would remain functional during and after a safe shutdown earthquake. This assessment was based on visual examination of the system.. A reanalysis of the seismic qualification of the OCS piping and associated supports was provided to the NRC in a letter, dated August 13, 1984. The results of this analysis substantiated the prior 31 conclusion that the OCS would not fail during a design basis event (DBE).However, NYPA stated their intentions to further enhance the seismic capability of the OCS. Seismic Calculation No. IP3-CALC-RCS-01252, Revision O, "RCP Oil Collection Pipe Support Retrofitting," was completed for the enhancement modification to piping above elevation 65 feet, and documented the adequacy of the seismicity for the system. Based on the results of this calculation, the modification was not implemented. Based on review of the above documentation substantiating the seismic capability of the OCS, the team concluded that the design and installation of the system was acceptable to perform its intended safety function during a DBE.The team reviewed design change DC-94-3-293, Revision 0, "RCP Oil Collection System Enclosure and Drip Pans," to evaluate the quality of the change to resolve the identified deficiencies. During this review, the team identified an engineering change notice (ECN) that did not have an engineering evaluation to support the change. ECN No. 94-3-293-001 authorized the use of a 3M epoxy gasket sealant in lieu of the originally required material, Loctite, presented on the Westinghouse installation drawings. This ECN failed.to contain or reference any technical evaluation to support the product substitution. The team reviewed the procurement data for the 3M epoxy and found this epoxy to be described for uses as a pneumatic or door seal. No product data sheets were available to compare the characteristics of each epoxy. The team identified, through further discussions with engineering, that this epoxy was used for facilitating construction of the new OCS enclosures and not for use as a leak-tight sealant.The team reviewed another ECN to DC-94-3-293 for a substitution of fastener types used to make up the joints of the drip pans and enclosures. This change was found to be supported by a technical justification/engineering evaluation. However, the team identified that other deficiencies related to ECNs have been identified. Particularly, Deviation and Event Report (DER) 94-11.26, initiated from the FitzPatrick site approximately two months earlier, presented deficiencies with ECNs, including the failure to attain required reviews, incorrect drawing and ECN numbers, and missing documentation. This issue was discussed with various organizations at IP3 and it was determined that there was no means in place to ensure that information for NYPA common processes for IP3 and Fitzpatrick is shared.The team reviewed Modification Control Manual (MCM), Procedures No. 9, Revision 5, "Engineering Change Notice," and No. 7, Revision 0, "Parts and Material Substitutions." Based on this review, the team observed that material substitutions are not prohibited from being performed under the ECN process. In addition, the team expressed concern that neither the technical evaluation nor detailed guidance provided in MCM Procedure No. 7, was presented or referenced in MCM No. 9. Based on this observation and the identification of deficiencies related to ECNs, the team considered the use of ECNs and the extent of ECNs implemented without adequate justification or evaluation, to be an unresolved issue. This issue remains unresolved pending NRC further review of the IP3 ECNs and the ECN process. The team determined that this issue was not related to start-up operations and would be reviewed during a future NRC inspection. '(Unresolved Item 50-286/95-81-01) 32 2.4.2 Walkdowns The team walked. down each of the four RCP.OCSs subsequent to the system certification, completed on November 7, 1994, and system engineer walkdowns as presented in procedure TSP-043, Revision 1. The system certification documented.that the reactor coolant system, of which OCS is a part, was in acceptable working condition and available to the Operations Department. The certification also stated that additional work was required to be completed prior to declaring the system operable. The system engineer walkdown procedure presented the attributes that shouldbe typically reviewed when conducting a walkdown. Material condition attributes listed included reference to leaking components and addressed the identification of evidence of debris in electrical enclosures. The team performed a walkdown to evaluate the installation of the OCS and to verify compliance with Appendix R.The oil collection system for each RCP included a series of collection pans that were strategically placed to collect oil at postulated leakage points, which drained into 2-inch stainless steel piping to one of four 275-gallon collection tanks. Each collection tank had a flame arrestor located on top of the tank. The RCP motors are vertical, six-pole, squirrel.cage induction motors equipped with upper and lower radial bearings and a two-way thrust bearing. The oil capacities are 175 gallons for the upper oil pot and 25 gallons for the lower. The flash point of the oil was 400'F. The upper lube oil system was considered the most significant risk for the leakage of the lube oil from the RCP motors. However, the oil lift system for the upper lube oil was found to be fully enclosed in a metal shroud designed to collect oil leakage. An ionization detector capable of detecting fire in its incipient stage was found to be located above each RCP. In addition, operators monitor RCP parameters, including oil level and thrust bearing temperatures, as indicators of pump performance. These parameters have associated annunciators located in the central control room.The team's initial walkdown of the OCS was conducted on January 31, 1995. The team identified several discrepancies that indicated that the system did not meet the design details. These deficiencies included missing bolts, gaps in OCS enclosures, misalignment of drip pans for oil collection, leaking oil, and debris found inside the high pressure oil left pump enclosure for RCP No'. 31.The licensee initiated DER 95-0183 to address the debris found and addressed the other deficiencies by expanding the work scope of open maintenance work packages. The team verified that thes'e open work packages and the system certification did not previously address these deficiencies. (Work Request Nos. 93-10003-00, 93-00164-08, 91-32391-08, and 93-10005-00 for each of the respective RCPs Nos. 11, 12., 13, & 14.) -Following the initial walkdown, NYPA performed corrective maintenance and closed out the repair work packages. The team performed another OCS walkdown and'identified additional deficiencies. Enclosures required to be leaktight and designed to coll-ect oil from flanges located between the'RCP and upper Tube oil cooler were found to have gasket material missing and gaps where some enclosures, were fitted together. The licensee initiated another DER, No.95-0283, to correct these deficiencies. The team noted that, during 33 Inspection 50-286/93-24, it was also observed that appropriate maintenance procedures needed to be developed for the OCS. NRC Inspection Report 50-286/93-24 also stated that licensee representatives recognized this observation and agreed to review these issues and take corrective actions, as appropriate. The team did not identify any licensee actions to address the appropriateness of maintenance procedures. However, the licensee implemented immediate corrective actions to restore the OCS to the required leak-tight design. The team concluded that the OCS for each RCP was adequately restored to fulfill Appendix R requirements. Subsequently, DER 95-0283 was closed.The team questioned. whether compliance with Appendix R had been met or maintained, considering the identified deficiencies. The license~e initiated DER No. 95-0311 to address this concern. On February 17, 1995, NYPA personnel held a critique meeting to obtain background information to address the poor material condition of the OCS and resolve DER 95-0311. The licensee determined that the root cause for the missing bolts and sealant (gasket) was the disassembly and reassembly of the OCS each time maintenance was performed on the RCP motors. In addition, the Westinghouse design drawings for the drip pans and enclosures, depicting the OCS above elevation 65 feet, were not found in the drawing system, and therefore, were not available to the maintenance department for their use in reassembling the system. In an internal letter, dated February 27, 1995, from A. Ettlinger to J. Perrotta, NYPA resolved DER 95-0311, and concluded that while the OCS did deviate from the original design, and that some of these deviations may have adversely affected its operation, the system remained-and is in compliance with Appendix R.Corrective actions and associated ACTS numbers presented in this letter included the following:

• As-built drawings are being developed for all enclosures and drip pans (ACTS No. 6808);* Maintenance procedure for disassembly,/assembly of each RCP motor will be upgraded to include a formal checklist for the OCS reassembly (ACTS No.6812); and* A quality control inspection will be performed in lieu of a functional test of the OCS and will be included in the maintenance procedure (ACTS No. 6812).,During the inspection, the team made two additional observations.

First, the team noted that a fibrous thermal barrier cloth insulation was installed in the immediate areas surrounding the RCPs. As discussed in NRC Information Notice (IN) 94-58, concerns have been identified by the NRC following a fire at Haddam Neck in 1994 regarding conditions that -existed at Haddam Neck where oil that had been dispelled from the RCP, due to high velocity air currents from the RCP self cooling air. and containment fans, was absorbed by the pipe insulation present in the vicinity of the RCPs. The licensee stated that ACTS Item 4178 had been issued to implement future field inspections during the next refueling outage per either a special procedure or in plant surveillance 34 3PT-CS-25, Revision 3, "RCP Oil Collection Tank" to verify the effectiveness of the OCS and subsequently, disposition IN 94-58. The team concluded that the licensee's assigned ACTS items to perform future field inspections of the RCPs and to evaluate the adequacy of the OCS and any oil spray patterns was appropriate. The final observation made by the team involved the addition of oil to the RCP. The team determined that no process existed for notifying the system engineer of the quantities of oil being added by the lubrication department or operations. Therefore, trending of pump performance and amounts. of oil being added cannot be adequately monitored. The licensee has assigned ACTS No. 6819 to address this issue.The team reviewed the last two completed surveillances for determining the level in each of the four RCP oil collection tanks. Surveillanc.e Procedure 3PT-CS-25, Revision 2, data taken on September 8, 1994, and December 9, 1994, demonstrated that the volume of oil present in each of the tanks would not affect the capability to collect the entire lube oil inventory from any RCP.Conclusion Based on this review of the OCS design and installation, the team concluded that the OCS was adequate to meet the requirements of 10 CFR Part 50, Section 111.0.- However, the team determined that management attention was needed to ensure concerns identified during this review are properly addressed. Further evaluations by the licensee were also needed to ensure the adequacy of the installed configuration for collecting oil dispelled .by each RCP as described in IN 94-58. A future NRC inspection of the use and justification for supporting ECNs will be performed to address Unresolved Item 95-81-01.2.5 Appendix R EDG The team reviewed NYPA's response to Corrective Action Request (CAR) 828 pertaining to the adequacy of Appendix R EDG-related protective relay setpoints, and to a concern pertaining to recent reverse power trips of the Appendix R EDG due to operator error.2.5.1 CAR 828 Overview CAR 828 was initiated on May 23, 1993; it pertained to the adequacy of the.Appendix R EDG-related protective relays. The CAR indicated that the protective relay setpoints have not been evaluated since 1985. Since that time, various modifications were implemented that could have changed the EDG loading and the required relay setpoints. 35 Details NYPA performed Evaluation IP3-RPT-ED-00922, "Appendix R Diesel Generator System Evaluation," Revision 0. This evaluation included the following studies: 0 Equipment Loading Analysis;.System Voltage Drop Analysis;0 Breaker Fault Current Rating Analysis; and* Equipment Protection and Device coordination Analysis.Two coordination issues were identified through this evaluation; however, the impact of these issues was reviewed by the licensee and determined not to detrimentally affect the safe shutdown analysis. NYPA did initiate design document open items (DDOIs) to track the identification of these issues for possible future resolution. Additionally, future evaluations of the Appendix R EDG were planned by NYPA to enhance the protective device calibration and testing procedures, and to evaluate actual system performance. These evaluations were being tracked through ACTS Item 3669.The team reviewed portions of Evaluation Report Number IP3-RPT-ED-00922, Revision 0. The purpose of this evaluation report was to perform a detailed system analysis calculation and evaluations to establish

a. sound design basis for sizing of the Appendix R diesel generator, its auxi.liaries, and the associated distribution network, including the 480V MCC 312A safe shutdown equipment and protective relay setpoints.

The team walked down selected components, compared the nameplate data to that used in the supporting calculations, and identified no concerns. Additionally, the team reviewed NYPA's safe shutdown determination pertaining to the coordination issues and found it to be appropriate. The team also discussed with NYPA the root cause and corrective actions performed to ensure Appendix R-related documents are evaluated and updated during future changes to the plant. The corrective actions included the change to the electrical calculation change form, which requires the update of applicable documents associated with Appendix R EDG and associated setpoints during the modification process.Conclusion The team considered NYPA's action to address CAR 828 appropriate, and had no further questions regarding this issue. 36 2.5.2 Reverse Power Trips of the Appendix R EDG due to Operator Error Overview On August 23, 1993, during the performance of the Operations Department Performance Test 3PT-Q65, "Appendix R Diesel Generator Functional Test," the governor and voltage regulator switches were operated in the wrong direction, causing the generator to trip on reverse power. This incident was described in NRC Inspection Report 50-286/93-16. Details As documented in Inspection Report 50-286/93-16, the August 23, 1993, reverse power trip of the Appendix R EDG was the second similar trip within one year.The first trip occurred on April 23, 1993, during the performance of the test.NYPA initiated a root cause evaluation of the recurring trips and determined the cause to be the operating orientation of the two switches. Typically, the handles for these type switches are turned clockwise to raise speed or voltage. However, on the Appendix R EDG, the operator must turn the handles counter-clockwise to raise the speed or voltage. Even though the switches were appropriately labeled and the procedures provided cautions to the operation of these switches, operator errors related to these switches continued to occur. To address this concern, NYPA rewired the governor and voltage regulator switches for the Appendix R EDG to be consistent with standard industry practice. Also, the operators were informed of the switch rewiring through an Operation Shift Order, the switches were relabeled to indicate the proper configuration, and procedure cautions were removed.The team reviewed portions of Type I Change 94-3-267 ARDG, "Appendix R EDG Governor & Voltage Control Switch Reversal," Revision 0, and found it appropriate. In addition, the team verified that the labels and procedures were properly updated. Discussion with the Appendix R EDG system engineer indicated that there were-no subsequent testing concerns after the changes to the switches in question.Conclusion The team considered NYPA's actions appropriate to address the concern pertaining to the recent reverse power trips of the AppendixR EDG, due to operator error.2.6 Fire Protection System Certification Overview.To ensure systems were ready to exit cold shutdown conditions, IP3 systems engineers were required to perform walkdowns of their systems, and also verify the completion of open work items, or determine the acceptability to defer the work item until a later time. 37 Details The team reviewed several NYPA memorandums associated with the system certification of the following systems: 0 Appendix R EDG;0 Fire Protection System; and 0 Emergency Battery Lighting.The team found these memorandums identified the open work items associated with the system and provided a basis for items deferred. These memorandums were provided to all departments with the major communications between Operations Department and Technical Services. The team verified selected information from these memorandums and discussed with the licensee the controls in place to ensure all open work items required for restart would be completed and tested as needed. The team reviewed selected tests performed on various fire protection/Appendix R equipment and found them to be appropriate. The team also performed walkdowns of various fire protection/Appendix R systems and identified no concerns, with the exceptions of those in the RCP OCS described in Section 2.4.2 of this report.Conclusion The team concluded that the system certifications of fire protection and Appendix R-related systems provided an adequate level of assurance that the systems will be acceptable for restart.2.7 Management Oversight The team assessed the management oversight.pertaining to the IP3 Fire Protection and Appendix R programs. The team based their assessment on discussions with various NYPA management and staff and the review of related documents. The team considered the following three areas as positive efforts: 1) The development of the Fire Protection/Appendix R Task Force. This task force was assigned the responsibility to evaluate the related open items, both NRC and NYPA-identified issues, and addressed them as needed. This task force provided concentrated resources, including the use of contracted industry specialists to act as an oversight committee to ensure adequate technical resolve for both the fire protection and Appendix R issues. Several of the NYPA-identified issues were provided to the NRC in Letter IPN-94-115, dated September 9, 1994. As documented in this letter, the resolution of issues would be complete prior to start-up. Since this letter, a number of additional potential concerns were identified by NYPA. Several of these issues and potential concerns were evaluated by the team as described in the previous sections of this report. The team also. discussed the methodology used to address these issues and potential concerns with members of the task 38 force. The team was. confident that the issues were being addressed properly. At the close of this inspection, five issues were still in the process of being resolved, but NYPA intended to complete the resolution prior to start-up.However, NYPA is still in the process of evaluating the cumulative impact of the issues (see their 4-hour event notification of March 20, 1995). This notification requires the completion of a LER, in which NYPA intends to include the evaluation of the cumulative impact of the issues. Since the team verified the appropriate completion of the resolution to several of the issues, and the team had confidence in NYPA to appropriately address these issues and potential concerns, the NRC will evaluate the cumulative impact of these issues after the completion of the LER. This is not a restart issue.2) The development of the Fire Protection and Safety General Supervisor position in October 1994 provided experienced supervision for the fire protection system engineer, fire protection supervisor, and the fire protection technicians. This was considered a good initiative, providing needed planning, scheduling, and additional management oversight to the fire protection program.3) The addition of personnel with fire protection and Appendix R responsibilities to site engineering staff.The team also noted ACTS Item 6292, requiring the development of a fire protection self-assessment program, and an implementation plan to train the staff, to be a good initiative.

2.8 Conclusion

-Fire Protection/Appendix R Restart Issues Based on the above described review, the team considered-NYPA's actions appropriate to close RAP Item 11.3 pertaining to fire protection and Appendix R programs, with the compensatory fire watches for the penetration seals in place until the completion of their evaluation of the cable ignition temperatures associated with Unresolved Item 50-286/93-24-03. NYPA's commitment to maintain.these fire watches was confirmed during a May 10, 1995, telephone conversation between Mr. W. Ruland of Region I, and Mr. L. Hill, Indian Point 3 Resident Manager. Additionally, during this conversation, Mr. Ruland confirmed NYPA's commitment to complete all Fire Protection/Appendix R-related startup labeled ACTS items and work requests prior to plant restart.Overall, the team considered NYPA's efforts to improve and gain control of the Fire Protection/Appendix R Programs to be effective. The majority of work items reviewed were found to be extensive and well thought-out. The team did identify a few discrepancies; however, these discrepancies did not detract from the overall good performance. 39 3.0 OUTSTANDING EDSFI-RELATED ISSUES (92903)The two remaining EDSFI-related issues, Unresolved Item 50-286/91-80-10 pertaining to the EDG transient loading, and Unresolved Item 50-286/93-18-02 pertaining to EDG kW meters and associated tolerances, were reviewed. The RAP Item 11.19 is associated with the outstanding EDSFI issues.3.1 (Update) EDG Transient Loading (Unresolved Item 50-286/91-80-10) Overview During the EDSFI, the inspectors identified three potential concerns pertaining to the EDG transient loading capabilities. These potential concerns included: (1) the load sequencer timer tolerance acceptance criteria; (2) the recording of the EDG critical parameters; and (3) the capability of the EDGs to accelerate and load the required safety-related equipment during an accident condition. Subsequent to the EDSFI, this issue was updated in Inspection Report 50-286/94-25, and subtasks (1) and (2) described above were reviewed and determined acceptable. Additionally, in Inspection Report 50-286.94-25, the inspector reviewed-an IP3 EDG transient loading study (PTI Report 1R7-93);however, the validation of the model was not complete at this time.Details During this inspection, the team reviewed the results of NYPA's work related to the EDG transient loading capabilities, including the following documents: 0 Report No. 9780.01, "Evaluation of the Emergency Diesel Generator Limits for Their Transient Performance Capability to Ensure Safe Operation of Indian Point 3," Revision I;0 Calculation No. IP3-CALC-480V-01412, "Evaluation of Motor Starting on Emergency Diesel Generator," Revision 0;0 NSE IP3-NSE-94-3-387, "480V Emergency Diesel Generator Units Transient Loading Capability to Start, Accelerate, and Support Safeguard Loads Sequenced During a LOCA Condition Coincident with Loss of Offsite Power," Revision 0; and 0 NYPA Memorandum IP-DEE-95-58, "SI Blackout Test; Emergency Diesel Generator Transient Performance," dated March 24, 1995.Report No. 9780.01 was completed after PTI Report No. R7-93, and incorporated the results of individual motor starting, with the exception of the containment spray pump and generator excitation system field test. In addition to the manufacturer supplied data initially used, the use of field test data allowed for the validation of the generator and the motor models.However, the diesel model still required Validation. The validation of the diesel model will be described later in this section. Report No. 9780.01 contained the results of the computer s-imulation for all the safety-related 40 EDGs transient loading capabilities for various scenarios. The EDGs frequency remained above 95% rated frequency and 75% rated voltage at the motor terminal with few exceptions. The exceptions identified were determined to be acceptable in Calculation No. IP3-CALC-480V-01412; the team determined this calculation used appropriate assumptions and standard industry methodology. Additionally, the team found no concerns with the results that the identified equipment was still capable of starting with reduced voltages at the motor terminals. The results of Report 9780.01 and Calculation 1P3-CALC-480V-01412 were documented in NSE IP3-NSE-94-3-387. This NSE also documented that the overall model verification, including that of the diesels, will be performed based on the results of the safety injection (SI) Blackout Test. Correlation of discrete points between the SI-blackout test and a computer simulation of a similar scenario within +3% of predicted voltage, and +2% of predicted frequency would be considered acceptable for confirmation of the accuracy of the worst-case scenario. Subsequently, NYPA will complete a simulation utilizing the final model and document the result in a NSE to be issued within 60 days after the completion of the SI Blackout Test, as tracked by ACTS Item 1943. This upcoming simulation is to include a field test of the containment spray pump (CSP) and SI pump motors. The CSP motor field test data was needed because no earlier testing was performed, and the SI pump motor was being retested to verify that recent work on the SI pump did not alter the motor model.The SI Blackout Test was performed on March 12, 1995; this test was observed by the resident inspector and documented in Inspection Report 50-286/95-02. The team discussed the results of this test with the licensee and reviewed Memorandum IP-DEE-95-58. As documented in the memorandum, the comparison between the SI Blackout Test results and the computer simulation indicated only two deviations from the acceptance criteria identified in the NSE. In both deviations, the test values showed better performance than the simulation and, therefore, NYPA considered these results acceptable. This memorandum also identified the following two observations as a result of the SI Blackout Tests: 1. Three auto sequencer timer actuations during the SI Blackout Test were outside their "as left" tolerances. Containment recirculation fan (CRF)34 and residual heat removal pump (RHRP) 32 timers were marginally outside the allowable zone; however, auxiliary feeder water pump (AFWP)31 was significantly outside the allowable tolerance.

2. The EDG output voltages under steady-state conditions were lower than 480V, indicating that the voltage regulator setpoints were below 480V;EDGs 31, 32, and 33 were found to be,470V, 475V, and 472V, respectively.

These EDG voltages, lower than 480V, will be considered in the final evaluation of the "worst-case" diesel loading for the final safety evaluation. ( 41 The team discussed these two observations with NYPA, and the team was informed that the timers found out of specification were replaced and calibrated. With respect to the EDG voltage, NYPA has reviewed the methodology for setting the voltage regulator, which is performed monthly as part of the surveillance program, and will be accomplished at least once for each EDG between the time of the SBO test and restart of the plant. Additionally, NYPA is evaluating the feasibility of making enhancements to the methodology used in the setting of the voltage regulators. Conclusion Based on the above review, the team considered NYPA's EDG transient loading demonstrated a reasonable assurance that the final validation of the model and the evaluation results will be acceptable. Therefore, this issue is acceptable for restart. However, associated Unresolved Item, 50-286/91-80-10, will remain open until the completion of the final validation of the model and the software and evaluations of the worst-case scenario; it should include provisions for tolerances of the sequencer timers and the voltage regulators and the accuracy assumptions determined for the simulation. The team considered NYPA's effort pertaining to the EDG transient loading, completed to date, to be extensive. Additionally, their retesting of the SI pump motor, to verify that the recent work on the pump did not impact the motor model, was considered an example of a good questioning attitude.3.2 (Closed) EDG kW Meter Tolerances (Unresolved Item 50-286/93-18-02) Overview Unresolved Item 50-286/93-18-02 pertained to the potential for the load management program to overload the EDG because the meter and associated circuitry tolerances were not considered. Details To address this issue, NYPA performed the following: 0 Modified the electrical distribution system to minimize the loading of safety-related 480V buses;0 Revised the emergency operations procedures (EOPs) so that loading in accordance with the EOPs does not overload the EDGs; and* Installed more accurate EDG kW meters and transducers. The team reviewed NSE-94-3-380-ED, "Emergency Operating Procedures Revision Impact to Safeguards Bus Loading," Revision 1. The purpose of this NSE was to evaluate the impact of the, latest revision to the EOPs and to ensure that they would not result in the 480V safeguard switchgear exceeding their design margin for load carry capacity........ 42 Additionally, the impact of the EOP revision was evaluated to ensure they would not result in exceeding the EDG continuous rating of 1750 kW for more than 2 hours, or the maximum peak rating of 1950 kW. To verify the information provided in this-NSE, the team reviewed selected portions of the following documents: 0 Indian Point 3 Emergency Operating Procedures;

• Calculation IP3-CALC-ED-207, "480V Bus 2A, 3A, 5A, & 6A, and EDGS 31, 32& 33 Accident Loading," Revision 4; and* Calculation IP3-CALC-ED-01427, "Control Room EDG kW Meter Calibration and Loop Accuracy Limits," Revision 0.The team found the calculations to be thorough, using standard industry methodology.

NYPA also initiated ACTS items 6357 and 6598, associated with the recently installed kW meters. ACTS Item 6357 will track the development of a procedure to perform loop calibration on the control room EDG kW meters and transducers. ACTS Item 6598 will evaluate the operating performance of the new meter after installation to ensure the calibration frequency is adequate.The team had discussions with both the engineering and operations staff.These discussions indicated that during the revision to the EOPs, the two departments worked together to ensure the procedures would not allow for overloading the EDGs without the use of load management. Additionally, the available loading margin for each EDG was greater than the EDG meter and loop tolerances. This should prevent the kW meters from indicating greater than the allowable kW due to inaccuracies, which would require operator action to needlessly reduce EDG loading during an accident.Conclusion The team determined NYPA's effort to address Unresolved Item 50-286/93-18-02 to be thorough. The team also considered the work between the operations and.engineering staff to coordinate the EOPs and the loading calculation, to be an example of good interdepartment communications. Therefore, Unresolved Item 50-286/93-18-02 is closed.3.3 Conclusion -Outstanding EDSFI Issues Based on the team's review of Unresolved Items 50-286/91-80-10 and 50-286/93-18-02, RAP Item 11.19 is closed.4.0 INFORMATION NOTICE 93-33 (92903.)Overview The team examined NYPA's review of NRC Information Notice (IN) 93-33,"Potential Deficiency of Certain Class IE Instrumentation and Control Cables." 43 Details IN 93-33 alerted all licensees to a potential deficiency in the environmental qualification (EQ) of certain Class iE instrumentation and controls (I&C)cables. Specifically, the IN identified that Sandia National Laboratories (SNL), under contract to the NRC, conducted tests on cables to determine the long-term aging degradation behavior of typical I&C cables, and to determine the potential for using condition monitoring for assessing residual life.The team examined NYPA's review of IN 93-33 as documented in their memorandum IP-TC-S-93-306 to file, dated May 14, 1993. NYPA's neview was extended to all cables installed at IP3, and determined that the subject of the IN was applicable to some of the cables at IP3. NYPA concluded that the cables described in IN 93-33 were subjected to EQ testing which exceeded the required environmental parameters for IP3. The ability of the installed cables to withstand the IP3 harsh environment conditions has been demonstrated-by test and was documented in the environmental qualification documentation packages for the specific cables. The team verified that the environmental qualification parameters for IP3 were less severe than the SNL test conditions. Additionally, NYPA re-evaluated IN 93-33 as part of their NRC IN pre-startup sample review program with no identified concerns.Conclusion The team concluded that the potential EQ concerns raised in IN 93-33 were not applicable to the installed EQ I&C cables at the IP3 facility. The team found the evaluation by the IP3 staff pertaining to this issue to be comprehensive.

5.0 MANAGEMENT

MEETINGS During the conduct of the inspection, the team met with the licensee representatives on February 10 and 17, 1995, to inform the licensee management of the scope and the findings of the inspection up to that date.Additionally, the team leader met with the licensee representative on March 24, 1995, to inform NYPA management of the remainder of the inspection findings. Subsequent to March 24, 1995, a number of telephone conversations were held between the NRC and members of NYPA's staff to discuss various topics, particularly, the concern associated with cable ignition temperatures, as described in Section 2.1.6 of this report, concluding with a telephone conversation with the Resident Manager on May 9, 1995. During this May 9, 1995, telephone conversation, NYPA's commitments to maintain fire watches, for seal penetrations until the completion of their to verify the generic information used in the Fire Seal Protection/Appendix R-related startup labeled ACTS items and work requests prior to plant startup. The licensee acknowledged the findings and did not indicate that any proprietary material was included within the scope of the inspection.

Attachment:

Persons Contacted ATTACHMENT I PERSONS CONTACTED New York Power Authority M.A.* F.# W.R.#* 3.*+ V.# + 3.#* + T.#* + J..# N.#* + A.#* C.# R.* 3.M.TI* C.J.#* L.N.R.3.# + 3.#* J.# T.+ R.+ J.#* N.K.-F.-*+ P.#* K.J.C.* L.A.* T.*+ S.D.*+ S.# j3.Badorini.Bartlik Bioise Cahill, Jr.Casalaina Comiotes Coulehan DeRoy Dougherty Dube Eggemeyer Ettlinger Faison Finger Gagliardo Garofalo Guarnieri Hays Higgins Hill Houborgon Johnston Kaczor Kaucher Kelly Klein Lauricella Odendahl Papaije Parkinson Pellizzari Peloquin Peters Raffaele Reiniger Retier Russo Storey Van Buren Vinchkoski Wilkie Zach Sr. Staff Engineer Senior Fire Protection Engineer Fire Protection Engineering Manager Chief Nuclear Officer Electrical Engineer General Manager General Superv-isor General Manager, Maintenance Vice President, Nuclear Engineering Fire Protection and Fire Safety Manager Operations Manager Director, Nuclear Engineering-Director, Nuclear Licensing Acting Quality Assurance Manager Consultant Sr. Quality Assurance Engineer Diesel System Engineer Technical Manager Systems Engineer Resident Manager Maintenance Manager Information Notice Review Group Project Manager (General Physics)System Engineer Director, Design Engineering Vice President, Regulatory Affairs Manager of Electrical and I&C Engineering Fire Protection Systems Engineer Instrument and Controls Manager Sr. Quality Assurance Engineer Fire Protection Oversight Committee Member (Sonalyists Inc.)Systems Engineer Quality Assurance Manager Licensing Manager Electrical Engineer Operations Engineer Fire Protection Manager Electrical Engineer Fire Protection Oversight Committee Member (SAIC)Fire Protection Supervisor Sr. Operations Engineer Fire Protection Engineer General Manager, Operations Attachment 1 (Cont'd) 2 U.S. Nuclear Regulatory Commission

• N. Conicella Project Manager C. Cowgill Chief, Projects Branch No. 1#* + T. Frye Resident Inspector* R. Rasmussen Resident Inspector* W. Ruland Chief, Electrical Section* Denotes those in attendance at the February 10, 1995, meeting.+ Denotes those in attendance at the February 17, 1995, meeting.# Denotes those in attendance at the March 24, 1995, meeting.

Exhibit FP No. 12 IP3 FSAR UPDATE CHAPTER 7 INSTRUMENTATION AND CONTROL 7.1 GENERAL DESIGN CRITERIA Complete supervision of both the nuclear and turbine-generator sections of the plant is accomplished by the instrumentation and control systems from the control room. The instrumentation and control systems are designed to permit periodic on-line test to demonstrate the operability of the reactor protection system.Criteria applying in common to all instrumentation and Control Systems are given in Section 7.1.1. Thereafter, criteria which are specific to.one of the instrumentation and control systems are discussed in the appropriate portion of the description of that system, as referenced in Section 7.1.2.The General Design Criteria presented and discussed in this section are those'which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.The Authority has completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NRC) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.7.1.1 Instrumentation and Control Systems Criteria Instrumentation and Control Systems Criterion: Instrumentation and controls shall be provided as required to monitor and maintain within prescribed operating ranges essential reactor facility operating variables.(GDC 12 of 7/11/67)Instrumentation and controls essential to avoid undue risk to the health and safety of the public are provided to monitor and maintain neutron flux, primary coolant pressure, flow rate, temperature, and control rod positions within prescribed operating ranges.The non-nuclear regulating process and containment instrumentation measures temperatures, pressure, flow, and levels in the Reactor Coolant System, Steam Systems, Containment and other Auxiliary Systems.Process variables required on a continuous basis for the startup, power operation, and shutdown of the plant are controlled form and indicated or recorded at the control room, access to which is supervised. The quantity and types of process instrumentation provided ensure safe and orderly operation of all systems and processes over the full operating range of the plant.7.1.2 Related Criteria 1 of 108 IP3 FSAR UPDATE The following are criteria which are related to all instrumentation and control systems but are more specific to other plant features or systems; and therefore are discussed in other chapters, as listed.Title of Criterion (7/11/67 issue) Reference Suppression of Power Oscillations (GDC 7) Chapter 3 Reactor Core Design (GDC 6) Chapter 3 Quality Standards (GDC 1) Chapter 4 Performance Standards (GDC 2) Chapter 4 Fire Protection (GDC 3) Chapter 5 and 9 Missile Protection (GDC 40) Chapters 4, 5, and 6 Emergency Power (GDC 39 and GDC 24) Chapter 8 7.2 PROTECTIVE SYSTEMS The protective systems consist of both the Reactor Protection System and the Engineered Safety Features. Equipment supplying signals to any of these protective systems is considered a part of that protective system.7.2.1 Design Bases The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently, made a part of 10 CFR 50.The Authority has completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NCR) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980 and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.Control Room Criterion: The facility shall be provided with a control room from which actions to maintain safe operational status of the plant can be controlled. Adequate radiation protection shall.be provided to permit continuous occupancy of the control room under any credible post-accident condition or as an alternative, access to other areas of the .facility as necessary to shut down and maintain safe control of the facility without excessive radiation exposure of personnel. (GDC 11 of 7/11/67)2 of 108 IP3 FSAR UPDATE Indian Point 3 is equipped with a Control Room which contains those controls and instrumentation necessary* for operation of the reactor and turbine generator under normal and accident conditions. The Control Room is provided with emergency lighting; color coding, labeling and demarcation of reactor coolant control and display panels; switch protection; and other aids as required to ensure proper operation of the reactor, turbine generator and auxiliaries under all operating and accident conditions. The Control Room is continuously occupied by qualified operating personnel under all operating and Maximum Credible Accident (MCA) conditions. The Post Accident Monitoring instrumentation available to the operator for monitoring plant conditions is provided in Table 7.5-1. The instrumentation complies with Regulatory Guide 1.97 requirements, as documented in NRC Letter, J.D. Neighbors to R. Beedle, dated 4/3/91, entitled "Emergency Response Capability -Conformance To RG 1.97 Revision 3, for Indian Point 3" (TAC No. 51099).The instrumentation originally available to the operator for monitoring conditions in the Reactor, Reactor Coolant System and the Containment Building are provided in Historical Tables 7.2-4 and 7.2-5.Historical Table 7.2-4 lists indication (meters, recorders, etc.) available for providing information following moderate and infrequent faults as originally analyzed in Chapter 14. Similarly, Historical Table 7.2-5 relates to limiting faults such as a LOCA as originally analyzed in Chapter 14.Thedesign criteria used in the selection of the original readouts were: 1) The range of readouts extend over the maximum expected range of the variable being measured as a result of faults originally analyzed in Chapter 14.2) The combined indicated accuracies are within the errors originally assumed in the safety analysis.Sufficient shielding, distance, and containment integrity are provided to assure that control room personnel shall not be subjected to doses under postulated, accident conditions during occupancy of, ingress to and egress from the Control Room which, in the aggregate, would exceed that limits in 10 CFR 100. The control room ventilation consists of a system having a large percentage of recirculated air. The fresh air intake can be closed automatically or by manual backup to stop the intake of airborne activity if monitors indicate that such action is appropriate. Core Protection Systems Criterion: Core protection systems, together with associated equipment, shall be designed to prevent or to suppress conditions that could result in exceeding acceptable fuel damage limits. (GDC 14 of 7/11/67)The basic reactor tripping philosophy is to define a region of power and coolant temperature conditions allowed by. the primary tripping functions, the overpower AT trip, the overtemperature AT trip and the nuclear overpower trip. The allowable operating region within these trip settings 3 of 108 IP3 FSAR UPDATE is provided to prevent any combination of power, temperatures and pressure which would result in DNB with all reactor coolant pumps in operation. Additional tripping functions such as a high pressurizer pressure trip, low pressurizer pressure trip, high pressurizer water level trip, loss of flow trip, steam and feed-water flow mismatch trip, steam generator low-low water level trip, turbine trip, safety injection trip, nuclear source and intermediate range trips, and manual trip are provided as backup tot he primary tripping functions for specific accident conditions and mechanical failures.A dropped rod signal blocks automatic rod withdrawal and also provides a turbine load cutback if above a given power level: The dropped rod is indicated from individual rod position indicators or by a rapid flux decrease on any of the power range nuclear channels.Over power AT, overtemperature AT, and Tavg deviation rod stops prevent abnormal power conditions which could result from excessive control rod withdrawal initiated by a malfunction of the Reactor Control System or by operator violation of administrative procedures. Engqineered Safety Features Protection Systems.Criterion: Protection systems shall be provided for sensing accident situations and initiating the operation of necessary engineered safety features (GDC 15 of 7/11/67).Instrumentation and controls provided for the protective systems are designed to trip the reactor in order to prevent or limit fission product release from the core, and to limit energy release, to signal containment isolation, and to control the operation of engineered safety features equipment. The Engineered Safety Features are actuated by the engineered safety features actuation channels, Each coincidence network energizes an engineered safety features actuation device, which operates the associated engineered safety features equipment, motor starters and valve operators. The channels are designed to combine redundant sensors, independent channel circuitry, coincident trip logic and different parameter measurements so that a safe and reliable system is provided in which a single failure will not defeat the protective function. The. action initiating sensors, bistables and logic is shown in the figures which are included in the detailed engineered safety features instrumentation description given in the design section for each system. The engineered safety features instrumentation system actuates (depending on the severity of the condition) the Safety Injection System, the Containment Isolation System, the Containment Air Recirculation System, and the Containment Spray System.The passive accumulators of the Safety Injection System do not require signal or power sources to perform their function. The actuation of the active portion of the Safety Injection System is described later in this section.The containment air recirculation coolers are normally in use during plant operation. These units are, however, in the automatic sequence, which actuates the engineered safety features upon receiving the necessary actuating signals indicating an accident condition. The fan cooler bypass valves open on a safety injection signal to provide maximum service water flow.Containment spray is actuated by coincident, and redundant high containment pressure signals (high-high level).4 of 108 IP3 FSAR UPDATE The Containment Isolation System provides the means of isolating the various pipes passing through the containment walls as required to prevent the release of radioactivity to the 'outside environment in the event of a Loss-of-Coolant Accident.Protection Systems Reliability Criterion: Protection systems shall be designed for high functional reliability and in-service testability necessary to avoid undue risk to the health and safety of the public. (GDC 10 of 7/11/67)The reactor uses the high speed version of the Westinghouse magnetic-type control rod drive mechanisms. Upon a loss of power to the coils, the Rod Cluster Control (RCC) assemblies with full length absorber rods are released and fall by gravity into the core.The reactor internals, fuel assemblies and drive system components were designed as seismic Class I equipment. The RCC assemblies are fully guided through the fuel assembly and for the maximum travel of the control rod into the guide tube. Furthermore, the RCC assemblies are never fully withdrawn from their guide thimbles in the fuel assembly. For this reason, and because of the flexibility designed into the RCC assemblies, abnormal loadings and misalignments can be sustained without impairing operation of the RCC assemblies. The Rod Cluster Control assembly guide system is locked together with pins throughout its length to ensure against misalignments which might impair control rod movement under normal operating conditions and credible accident conditions. An analogous system has successfully undergone 4132 hours of testing in the Westinghouse Reactor Evaluation Center during which about 27,200 feet of step-driven travel and 1461 trips were accomplished with test misalignments in excess of the maximum possible misalignment experienced when installed in the plant.All primary reactor trip protection channels required during power operation are supplied with sufficient redundancy to provide the capability for channel calibration and test at power.Removal of one trip circuit is accomplished by placing that circuit in a tripped mode i.e., a two-out-of-three circuit becomes a one-out-of-two circuit. A Channel bistable may also be placed in a bypassed mode, i.e., a two-out-of-three circuit becomes a two-out-of-two circuit. Testing in a bypassed mode does not trip the system even if a trip condition exists in a concurrent channel.Reliability and independence are obtained by redundancy within each tripping function. In a two-out-of-three circuit, for example, the three channels are equipped with separate primary sensors. Each channel is continuously fed from its own independent electrical source. Failure to de-energize a channel when required would be a mode of malfunction that would affect only that channel. The trip signal furnished by the two remaining channels would be unimpaired in this event.Protection Systems Redundancy and Independence Criterion: Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure on removal from service of any component or channel of such a system will result in loss of the protection function. The redundancy provided shall include, as a minimum, two channels of protection function to be served. (GDC 20 of 7/11/67)5 of 108 IP3 FSAR UPDATE The Reactor Protection Systems were designed so that the most probable modes of failure (loss of voltage, relay failure) in each protection channel result in a signal calling for the protective trip. Each protection system design combines redundant sensors and channel independence with coincident trip philosophy so that a safeand reliable system is provided in which a single failure will not defeat the channel function, cause a spurious plant trip, or violate reactor protection criteria.The design basis for the Reactor Protection System and Engineered Safety Features equipment radiation exposure was that the equipment must function after the exposure associated with the TID-14844 model accident. The maximum anticipated exposure for components located within the Containment was calculated to be 1.6 x 108 rads, which is accumulated during one year following the accident. (Note that the integrated exposure for safeguards equipment during 40 years of operation was calculated to be less than 5 x 10 5 rads.) In the determination of exposure, no credit was taken for containment cleanup or other removal mechanism other than isotope decay. The expected integrated exposure on the outside of the Containment Building, again assuming TID-14844 releases and no credit for cleanup, will be less than 102 rads integrated over a year at the containment outside surface.Protection system instrument cables are divided into four channels. Channeling separation is continuous from instrument sensor to receiver. Bistable or digital type outputs 120 volts AC or 125 volts DC to protection system logic relays are divided into the same four channels.Power and control cables for engineered safeguards are divided into three basic channel systems. Power and control cabling for reactor trip and containment isolation valves are divided into two channels.In addition to channels of separation, cables were assigned to individual routing systems in accordance with their voltage level, size, and function. Six independent conduit and tray systems are employed on Indian Point 3 as follows: 1) 6900 volt power 2) Heavy 125 volts DC power cables and heavy 480 volts AC (over 100 hp) power cables 3) Lighting panel feeders and medium power (greater than No 12 AWG wire size) 480 volts AC cables 4) Control and light (non-heavy) power cables 5) Instrument cables 6) Rod control cables Conduit fill for all systems is based on standard national Electric Code Recommendations. Criteria for tray fill are given in Section 8.2 Cables in the conduit and cable schedule are identified by a circuit code, in addition to their routing, to assure that the cable will be installed in the proper tray systems, as well as the proper channel.6 of 108 IP3 FSAR UPDATE Separation of channels was established throughout the plant by the use of separate trays or conduits (exceptions are documented and justified in Reference 1). In addition, whenever a heavy power tray was located less than three feet beneath any tray of a different channel, a transit fire barrier was installed between the trays. A vertical barrier was installed where trays of different channels were installed less than one foot apart, horizontally. Vertically barriers and, fire wraps were installed to separate cables and equipment and associated non-safety circuits of redundant trains to protect against radiant energy from a 10 CFR 50, Appendix R assumed fire.Additionally, a horizontal barrier was installed where trays (other than heavy power) were installed less than one foot beneath any tray of a different channel.In the area of the electrical tunnel between the Control Building and Containment Building and containment penetration area, two tunnels provide the separation for the four channels. A cross section of this portion of the tunnel is shown in the PlantDri ing 9321,-F-31193 [Formrly Fig;r 72-181.In general, control board switches with their associated indicating lights are contained in a.modularized structure which provides physical separation between power "trains." Where more than one train is required to connect to a single switch, the wiring is routed to different quadrants within the module itself. Separate connectors for each redundant circuit are used, and board wiring is channelized to separate terminal blocks contained in individual channelized vertical risers located above separated floor slots. The wiring "trains" within the board are divided into three separate groups. Train "X" is that wiring which is associated with buses fed from diesel generator No. 32, Train "Y" is that wiring which is associated with buses fed from diesel generator No. 33 and Train "Z" is that wiring which is associated with buses fed from diesel generator No. 31. These "trains" are physically separated from each other by horizontal raceways which route the wiring to its appropriate vertical riser.The wiring of local control panels which contain cabling from different channels have -been separated by interior metal barriers or were separated into more than one panel. The main three phase power circuits are protected by means of three-pole breakers. Individual small power feeds from the motor control centers have three phase protection by means of fuses and"heater" overload devices. Single phase circuits are protected by single pole devices including. fuses and/or breakers. (See Section 8.2)Channel independence is carried throughout the system extending from the sensor to the relay actuating the protective function. The protective and control functions are fully isolated, control being derived from the primary protection signal path through an isolation amplifier. As such, a failure in the control circuitry does not affect the protection channel. This approach is used for pressurizer pressure and water level channels, steam generator water level, Tavg and AT channels, steam flow-feedwater flow and nuclear instrumentation channels.The analog type equipment associated with the Reactor Protection and Engineered Safety Features Systems is considered to be the most susceptible to temperature effects because of the accuracies involved. Excessive temperature for long periods in areas containing switchgear, cables, etc. would result in a slight degradation of life but would not affect performance. The Control Room is the limiting case for reactor shutdown with regard to electrical equipment. The protective equipment in the control and relay rooms was designed to operate in an environment up to 120°F without loss of function.7 of 108 ItP3 FSAR UPDATE Temperature. in the Control Room and adjoining equipment room is maintained for personnel comfort at 70 +/- 100F.. Protective equipment in this space was designed to operate within a design tolerance over this temperature range. Design specifications for this equipment specified no loss of protective function up to 120'F. Exceptions to this are evaluated in NSE 95-3-032, Revision 1 (See FSAR Section 9.9.2). Thus, there is a wide margin between design limits and the normal operating environment for control room equipment. The engineered safety features equipment is actuated by one or the other of the engineered safety features actuation channels. Each coincidence network actuates an engineered safety actuation device that operates the associated engineered safety features equipment, motor starters and valve, operators. As an example, the control circuit of a safety injection pump is typical of the control circuit for a large pump operated from switchgear. The actuation relay, energized by the Engineered Safety Features Instrumentation System, has normally open contracts. These contacts energize the circuit breaker closing coil to start the -pump when the control relay is energized. The Engineered Safety Features Instrumentation System actuates (depending on the severity of the condition) the Safety Injection System, the Containment

• Isolation System, Containment Air Recirculation System and Containment Spray System.In the Reactor Protection.

System, two reactor trip breakers are provided to interrupt power to the full length rod drive mechanisms. The breaker main contacts are connected in series (with power supply) so that opening either reactor trip breaker interrupts power to all full length rod mechanisms, permitting them to fall by gravity into the core.In. the event of a loss of reactor trip breaker control power, the reactor trip breaker under voltage coils and associated relays are de-energized and the breakers trip to an open mode. An electrical interlock prevents both bypass breakers from being closed concurrently. Further detail on redundancy is provided through the detailed descriptions of the respective systems covered by the various sections in this chapter. In summary, reactor protection was designed to meet all presently defined reactor protection criteria and is in accordance with the IEEE-279-1971, "Standard for Nuclear Plant Protection Systems." Required continuous electrical supply is discussed in Chapter 8.Demonstration of Functional Operability of Protection Systems Criterion: Means shall be included for suitable testing of the active components of protection systems while-the reactor is in operation to determine if failure or loss of redundancy has occurred. (GDC 25 of 7/11/67)The analog equipment of each protection channel in service at power is capable of being tested and tripped independently by simulated analog input signals to verify its operation. The trip logic circuitry includes means to test each logic channel through to the trip breakers. Thus, the operability of each trip channel can be determined conveniently and without ambiguity. Testing of the diesel-generator starting may be performed from the diesel generator control board. The generator breaker is not closed automatically after starting during this testing. The generator may be manually synchronized to the 480 Volt bus for loading. Complete testing of the starting of diesel generators can be. accomplished by tripping the associated 480 Volt undervoltage relays and providing a coincident simulated safeguards signal. The ability of the 8 of 108 IP3 FSAR UPDATE units to start within the prescribed time and to carry load can be periodically checked. (The Electrical Systems are discussed in more detail in Section 8.2.3.)The reactor coolant pump breakers open trip is not testable at power; it is a backup trip which is testable only during shutdown. Testing at power (opening the breakers) would involve a loss of flow in the associated loop.Protection Against Multiple Disability for Protection Systems Criterion: The effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protection function or shall be tolerable on some basis. (GDC 23 of 7/11/67)The components of the protection system were designed and laid out so that the mechanical and thermal environment accompanying any emergency situation in which the components are required to function does not interfere with that function.Separation of redundant analog protection channels originates at the process sensors and continues back through the field wiring and containment penetrations to the analog protection racks. Physical separation is used to the maximum practical extent to achieve separation of redundant transmitters. Separation of field wiring is achieved using separate wire ways, cable trays, conduit runs and containment penetrations for each redundant channel. Redundant analog equipment is separated by locating redundant components in different protection racks.Each redundant channel is energized from a different vital instrument bus.Protection System Failure Analysis Design Criterion: The protection systems shall be designed to fail into a safe state or into a state established as tolerable on a defined basis if conditions such as disconnection of the system, loss of energy (e.g., electrical power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are experienced.(GDC 26 of 7/11/67)Each reactor trip circuit was designed so that trip occurs when the circuit is de-energized; therefore, loss of channel power causes the system to go into its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from an independent electrical bus. Failure to de-energize when required is a mode of malfunction that affects only one channel. The trip signal furnished by the two remaining channels is unimpaired in this event.Reactor trip is implemented by interrupting power to the magnetic latch mechanisms on all drives allowing the full length rod clusters to insert by gravity. The protection system is thus inherently safe in the event of a loss of power.The engineered safety features actuation circuits were designed on the "energize to operate" principle unlike the reactor trip circuits.The steam line isolation signal on high-high containment pressure, which uses the same circuitry as the containment spray actuation signal, was also designed on the "energize to operate", principle. There are a total of six high-high containment pressure instruments which 9 of 108 IP3 FSAR UPDATE are separated into three channels. The three high-high containment pressure instrument channels are powered from three separate independent sources (one channel from instrument Bus No. 31 powered from Battery No. 31, the second channel from instrument Bus No. 33 powered from Battery No. 33, and the third channel from instrument Bus No. 34 powered from Instrument Bus No. 34 powered from Battery No. 34 with alternate supply from safeguards Motor Control Center No. 36B).This assures operation of a sufficient number of containment pressure instruments in the event of a power failure to one of the instrument channels.In the event that power to any instrument bus is lost, there is no single failure that could occur to prevent any protective action. Reactor trip initiation signals are de-energized to actuate. The containment spray initiation signals, of which only two of three are required, are powered from three separate power sources (i.e., Instrument Buses No. 31, No. 33, and No. 34).If power would ever be lost to any instrument bus, channel trip annunciators, etc. associated with the protective functions powered from this bus would alarm. This would mean to the operator that this one complete protective channel is in the trip mode. The event would be indicative of the loss of power for this particular channel of protective devices.The above design is consistent with all of the instrument buses regardless of their source of power, as the loss of any one instrument bus, for any reason, would give channel trip alarms and indications for the respective channel of protection devices. These alarms would be a true indication because on loss of instrument power the associated protective channel is indeed in the trip mode. This complies with the requirements of Section 4.20 of IEEE-279. (See Section 8.2)Each emergency diesel-generator is started by undervoltage on its associated 480 Volt bus or by the safety injection signal independent of the other 480 Volt buses and diesel generators. Engine cranking is accomplished by a stored energy system supplied solely for the associated diesel generators. The undervoltage relay scheme was designed so that loss of 480 Volt power does not prevent the relay scheme from functioning properly.Redundancy of Reactivity Control Criterion: Two independent control systems, preferably of different principles, shall be n provided. (GDC 27 of 7/11/67)One of the two Reactivity Control Systems employs rod cluster control assemblies to regulate the position of Ag-In-Cd neutron absorbers within the reactor core. The other Reactivity Control Systern employs the Chemical and Volume Control System to regulate the concentration of boric acid solution (neutron absorber) in the Reactor Coolant System.A detailed description of the Reactivity Control System for Indian Point 3, sufficient to demonstrate redundancy and capability as established under the provisions of this criterion, is presented in Section 3.1.Reactivity Control Systems Malfunction Criterion: The reactor protection system shall be capable of protecting against any single malfunction of the reactivity control system, such as unplanned continuous 10 of 108 IP3 FSAR UPDATE withdrawal (not ejection or dropout) of a control rod, by limiting reactivity transients to avoid exceeding acceptable fuel damage limits. (GDC 31 of 7/11/67)Reactor shutdown with rods is completely independent of the normal control functions since the trip breakers completely interrupt the power to the full length rod mechanisms regardless of existing control signals. Effects of continuous withdrawal of a rod control assembly and of deboration are described in Sections 7.3.1, 7.3.2, 9.2 and 14.1.Principles of Design Redundancy and Independence The protective systems are redundant and independent for all vital inputs and functions. Each channel is functionally independent of other redundant channels and is supplied from an independent power source. Isolation of redundant protection channels is described in further detail elsewhere in this section and in Section 7.2.2.Manual Actuation Means are provided for manual initiation of protective system action. Failures in the automatic system do not prevent the manual actuation of protective functions. Manual actuation requires the operation of a minimum of equipment. Channel Bypass or Removal from Operation The system was designed to permit any one channel to be maintained and when required, tested or calibrated during power operation without system trip. During such operation the active parts of the system continue to meet the single failure criterion. Since the channel under test is either tripped or superimposed, test signals are used which do not negate the process signal.It should be noted that the "one-out-of-two" logic systems are permitted to violate the single failure criterion during channel bypass, provided that acceptable reliability of operation can be otherwise demonstrated and bypass time interval is short.Capability for Test and Calibration The bistable portions of the protective system (e.g., relays, bistables, etc.) provide trip signals only after signals from analog portions of the system reach preset values.Capability is provided for calibrating and testing the performance of the bistable portion of protective channels and various combinations of the logic networks during reactor operation. The analog portion of a protective channel provides analog signals proportional to a reactor or plant parameter. The following means are provided to permit checking the analog portion of a protective channel during reactor operation: a) Varying the monitored variable b) Introducing and varying a substitute transmitter signal 11 of 108 IP3 FSAR UPDATE c) Cross checking between identical channels or between channels which bear a known relationship to each other and which have readouts available. The design permits the administrative control of the means for manually by-passing channels or protective functions. The design permits the administrative control of access to all trip settings, module calibration adjustments, test points, and signal injection points.Information Readout and Indication of Bypass The protective systems were designed to provide the operator with accurate, complete, and timely information pertinent to their own status and to plant safety.Indication is provided in the Control Room if some part of the system has been administratively bypassed or taken out of service.Trips are indicated and identified down to the channel level.Vital Protective Functions and Functional Requirements The Reactor Protective System monitors parameters related to safe operation and trips the reactor to protect the reactor core against fuel rod cladding damage caused by departure from nucleate boiling (DNB) and to protect against Reactor Coolant System damage caused by high system pressure. The engineered safety features instrumentation system monitors parameters to detect failure of the Reactor Coolant System and initiates containment isolation and engineered safety features, operation to contain radioactive fission products.This section covers those protective systems provided to: a) Trip the reactor to prevent or limit fission product release from the core and to limit energy release.b) Isolate containment and activate the Isolation Valve Seal Water System when necessary. c) Control the operation of engineered safety features provided to mitigate the effects of accidents. The core protective systems in conjunction with inherent plant characteristics were designed to prevent anticipated abnormal conditions from causing fuel damage exceeding limits established in Chapter 3 or Reactor Coolant System damage exceeding effects established in Chapter 4.Completion of Protective Action Where operating requirements necessitate automatic or manual bypass of a .protective function, the design is such that the bypass is removed automatically whenever permissive conditions are not met. Devices used to achieve automatic removal of the bypass of a protective function are part of the protective system and were designed in accordance with the criteria of this section.12 of 1.08 IP3 FSAR UPDATE The protective systems were designed so that once initiated, a protective action goes to completion. Return to normal operation requires administrative action by the operator.Multiple Trip Settings Where it is necessary to change to a more restrictive trip setting to provide adequate protection for a particular mode of operation or set of operating conditions, the design provides positive means of assuring that the more restrictive trip setting is used. The devices used to prevent improper use of less restrictive trip settings are considered a part of the protective system and were designed in accordance with the other provisions of these criteria.Interlocks and Administrative Procedures Interlocks and administrative procedures required to limit the consequences of fault conditions other than those specified as limits for the protective function comply with the protective function comply with the protective system criteria.Protective Actions The Reactor Protective System automatically trips the reactor to protect the reactor core under the following conditions: a) The reactor power, as measured by neutron flux, reaches a pre-set limit.b) The temperature rise across the core, as determined from loop AT, reaches a limit either from an overpower AT set point or an overtemperature AT set point (function of Tavg and pressurizer pressure, adjusted by neutron flux distribution). Overtemperature AT set point is adjusted by neutron flux distribution. c) The pressurizer pressure reaches an established minimum limit.d) Loss of reactor coolant flow as sensed by low flow, loss of pump power or pump breakers opening.e) Pressurizer pressure or level trips the reactor to protect the primary coolant boundary when the pressurizer pressure or level reaches an established maximum limit.Interlocking functions derived from the Reactor Protective System inhibit control rod withdrawal on the occurrence of a specified parameter reaching a value lower than the value at which reactor trip is initiated. For anticipated abnormal conditions, protective systems in conjunction with inherent plant characteristics and engineered safety features are designed to ensure that limits for energy release to the Containment and for radiation exposure (as in 10 CFR 100) are not exceeded.Seismic Design Criteria For either the operational or design basis earthquake, the equipment was designed to assure that it does not lose its capability to perform its function, i.e., shut the plant down and maintain it 13 of 108 IP3 FSAR UPDATE in a safe shutdown condition. For the design basis earthquake, permanent deformation of the equipment is acceptable provided that the capability to perform its function is maintained.

7.2.2 System

Design Reactor Protective

System Description

Figure 7.2-2 is a block diagram of the Reactor Protective System; Figure 7.2-3 illustrates the core thermal limits and shows the trip points that are used for the protection system. The solid lines are a locus of limiting design conditions representing the core thermal limits at five pressures. The core thermal limits are based on the conditions which yield the applicable limit value for departure from nucleate boiling ratio (DNBR) or those conditions which preclude bulk boiling at the vessel exit. The dashed lines indicate the maximum permissible trip points for the overtemperature high AT reactor trip including allowances for measurement and instrumentation errors.The maximum and minimum pressures shown (2470 psia and 1750 psia) represent the set points for the high pressure and low pressure reactor trips.Adequate margins exist between the worst steady state operating point, (including all temperature, calorimetric, and pressure errors), and required trip points to preclude a spurious plant trip during design transients. Indication All transmitted signals (flow, pressure, temperature, etc.) which can cause a reactor trip are either indicated or recorded for every channel.Engineered Safety Features Instrumentation Description Plant DrawingsIP~3V-O0i71 -0qJ9Wi IPV-0 f71~-0056 565TD72 Sheets 10, 12, and 12A [Formerly Figures 7.2-4, 7.2-5 6a show the action initiating sensors, bistables and logic for the engineered safety features instrumentation. The engineered safety features actuation system automatically performs -the following vital functions:

1) Start operation of the Safety Injection System upon low pressurizer pressure signal or high containment pressure signals (approximately 10% of containment design pressure), or on coincidence of high differential pressure between any two steam generators, 2 sets of 2/3 high-high pressure [energize to actuate], or after time delay (maximum 6 seconds)in coincidence with high steam flow in 2/4 lines in coincidence with (a) low Tavg in 2/4 lines or (b) low steam line pressure in 2/4 lines.2) Operate the containment isolation valves in non-essential process lines upon detection of high containment pressure signals (Phase A containment isolation).

The Isolation Valve Seal Water System is actuated upon automatic actuation of the Safety Injection System.14 of.108 IP3 FSAR UPDATE 3) Start the Containment Spray System and operate the remaining containment isolation valves upon detection of a containment pressure signal higher than required in item (2)above (Phase B containment isolation; approximately 24 psig).4) Start operation of the safeguards equipment actuation sequence signal. This includes actuating signals to such components as the Safety Injection System and the Containment Air Recirculation, Cooling and Filtration System.Steam Line Isolation Any of the following signals will close all steam line isolation valves: 1) After time delay (maximum 6 seconds) in coincidence with high steam flow in 2/4 lines in coincidence with (a) low Tavg in 2/4 lines or (b) low steam line pressure in 2/4 lines.2) High containment pressure signals (two sets of 2/3 high-high pressure) [energize to actuate].3) Steam line isolation valves can also be closed one at a time by manual action.Feedwater Line Isolation Any safety injection signal will isolate the main feedwater lines by closing all control valves (including associated MOVs) and the pump discharge valves. The closure of the pump discharge valves will cause the main feedwater pumps to trip.ATWS Mitigatinq System Actuation Circuitry (AMSAC) Description The ATWS Mitigating System Actuation Circuitry (AMSAC) is installed at IP3 in accordance with the requirements of 10 CFR 50.62 "Reduction of Risk From Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants." An ATWS is an anticipated operational occurrence (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) that is accompanied by a failure of the Reactor Protection System (RPS)to shut down the reactor. The ATWS Rule requires specific improvements in the design and operation of commercial nuclear power facilities to reduce the probability of failure to shut down the reactor following anticipated transients and to mitigate the consequences of an ATWS event.AMSAC provides an alternate means of tripping the turbine and actuating auxiliary feedwater (AFW) flow apart from the reactor protection system (RPS). The AMSAC equipment is reasonably diverse from the existing RPS equipment to minimize the potential for common cause failures. Also, AMSAC logic power supplies and logic .circuitry are independent from the RPS power supplies and logic circuitry. The turbine trip and AFW flow actuation will provide adequate assurance that the reactor coolant system (RCS) would not be subject to potential damage as a result of overpressure. The pressure limit (3200 psig) corresponds to the ASME boiler and Pressure Vessel Code Level C Service Limit stress criteria. Past ATWS analyses, see WCAP-8330 for example, show there are only two ATWS transients for which the ASME Service level limit may be approached. These transients are the Complete Loss of Normal Feedwater Without Scram and the Loss of Load Without Scram.0 15 of 108 IP3 FSAR UPDATE The Complete Loss of Normal Feedwater transient can occur due to the simultaneous tripping of the main feedwater or condensate pumps or the simultaneous, closing of the main feedwater control valves or main feedwater pump discharge valves.The Loss of Load transient considered for ATWS is one in which the vacuum in the main condenser is lost, resulting in a complete loss of normal feedwater. This could occur, for.example, if the circulating water pumps trip. The main turbine will then trip on high backpressure as will any, turbine-driven main feedwater pump that exhausts into the main condenser. Since, in both of the above described transients (and in only these transients) the main feedwater is completely lost, the AMSAC is designed to actuate the auxiliary feedwater flow when the complete loss of main feedwater flow is anticipated. Short-term protection against high reactor coolant system pressures is not required until 70% of nominal power. However, in order to minimize the amount of reactor coolant system voiding during an ATWS, AMSAC operates at and above 40% of turbine power. Furthermore, the potential exists for spurious AMSAC actuations during start-up at the lower power levels. To assure the above requirements are met, AMSAC is automatically blocked at turbine loads less than 40% by the C-20 permissive. In the event of a turbine trip, both turbine power transmitter indications will drop below 40% of full scale turbine power level. A timer in the AMSAC circuitry will maintain the trip permissive (C-20) for 330 seconds to ensure that the AMSAC system is still armed. However, in the event of an ATWS below 40% of nominal load, operator action will be required to provide long-term core protection by initiating auxiliary feedwater flow.Actuation of AMSAC will occur on low main feedwater flow as measured by the low feedwater flow transmitters. The setpoint to actuate AMSAC is approximately 21% of nominal main feedwater flow. Although 21% flow is more than ample to protect against overpressure in the event of an ATWS, instrumentation error would become unacceptably large if a substantially lower set point were used.An AMSAC output is initiated after a predetermined time delay whenever turbine power is 40%or greater coincident with three of the four feedwater flow transmitters indicating feedwater flow of 21% or less. The time delay is determined by the highest Turbine Power Level sensed at the time the % low feedwater flow is sensed. 60 second lag units maintain Turbine Power Level close to the pre-turbine trip condition, for determination of the variable time delay. The time delay varies from a maximum of 300 seconds at 40% power to 25 seconds at 100% power (in accordance with the WOG curves). The purpose of this time delay is twofold. First, this time delay allows the reactor protection system to respond initially to a low feedwater flow condition. Secondly, during this time delay, the operator is provided with an AMSAC alert annunciator in the CR. If during the AMSAC alert period the operator increases feedwater flow above 21%, AMSAC will not actuate and the timer will reset. However, once an AMSAC signal is initiated, the signal will be maintained for at least 40 seconds to ensure all required actions occur.Turbine trip, turbine power auxiliary feedwater valve actuation and steam generator isolation and sample valve closure functions are immediately actuated by AMSAC. The motor.driven auxiliary feedwater pumps have a 28 second time delay built into their starting circuits. As such, the motor driven auxiliary feedwater pumps will start 28 seconds after an AMSAC signal is initiated. This time delay is in accordance with 1;0 CFR 50.62 (the AMSAC Rule) which requires that the AMSAC AFW initiation function is performed within 90 seconds following initiation of an AMSAC signal. The AMSAC output signal is energized to actuate, so that a loss of power to the AMSAC cabinet will not initiate an AMSAC trip.16 of 108 IP3 FSAR UPDATE The AMSAC Logic Diagram is shown in Plant Drawing 9321-LL-38077[Fomerly Figure 7-2-19I.Reactor Protective System Safety Features Separation of Redundant Protection Channels The Reactor Protection System was designed on a channelized basis to achieve separation between redundant protection channels. The channelized design, as applied to the analog as well as the logic portions of the protection system, is illustrated by Figure 7.2-1 and is discussed below. Although shown for four channel redundancy, the design is applicable to two and three channel redundancy. Separation of redundant analog channels originates at the process sensors and continues through the field wiring and containment penetrations to the analog protection racks.Physical separation was used to the maximum practical extent to achieve separation of redundant transmitters. Separation of field wiring was achieved using separate wireways, cable trays, conduit runs and containment penetrations for each redundant channel. Analog equipment was separated by locating redundant components in different -protection racks. Each redundant protection set is energized from a separate AC power feed.The reactor trip bistables are mounted in the protection racks and are the final operational component in an analog protection channel. Each bistable drives two logic relays ("C" & "D").The contacts from the "C" relays are interconnected to form the required actuation logic for Trip Breaker No. 1 through DC power feed No. 1. The transition from channel identity to logic identity is made at the logic relay coil/relay contact interface. As such, there is both electrical and physical separation between the analog and the logic portions of the protection system.The above logic network is duplicated for Trip Breaker No. 2 using DC power feed No. 2 and the contacts from the "D" relays. Therefore, the two redundant reactor trip logic channels will be physically separated and electrically isolated from one another. Overall, the protection system is comprised of identifiable channels which are physically, electrically and functionally separated and isolated from one another.Physical Separation The physical arrangement of all elements associated with the protective system reduces the probability of a single physical event impairing the vital functions of the system.System equipment is distributed between instrument cabinets so as to reduce the probability of damage to the total systems by some single event.Wiring between vital elements of the system outside of equipment housing was routed and protected so as to maintain the true redundancy of the systems with respect to physical hazards. The same channel isolation and separation criteria as described for the reactor protection circuits were applied to the engineered safety features actuation circuits.Loss Power 17 of 108 IP3 FSAR UPDATE A loss of power in the Reactor Protective System causes the affected channel to trip. All bistables operate in a normally energized state and go to a de-energized state to initiate action.Loss of power, thus, automatically forces the bistables into the tripped state.Availability of power to the engineered safety features instrumentation is continuously indicated. The loss of instrument power to the sensors in the engineered safety feature instrumentation starts the engineered safety features equipment associated with the affected channels, except for containment spray which requires instrument power for actuation. Steam line isolation on high-high containment pressure, which utilizes the same actuation circuitry as the containment spray actuation, also requires power to actuate. There are a total of six high-high containment pressure instruments which are separated into three instrument channels. The three high-high containment pressure instrument channels are powered form three separate, independent sources to assure operation in the event of a power failure to one of the instrument channels.Engineered Safety Features Systems Testing At least once per 24 months, the master relays will be operated with test input to actuate the safeguards sequences. The test will be terminated upon verification that the associated valves are properly aligned and associated pumps are started by the automatic actuation circuits. No flow is introduced into the Reactor Coolant System; verification of pump startup is by breaker position indication and visual inspection of local flow meters in the mini-flow lines, where applicable. The tests will be performed in accordance with the Technical Specification. Process Analog Protection Channel Testinq The basic arrangement of elements comprising a representative analog protection channel is shown in Figure 7.2-7. These elements include a sensor or transmitter, power supply, bistable, bistable trip switch and proving lamp, test-operate switch, test annunciator, test signal injection jack, and test points. A portion of the logic system is also included to illustrate the overlap between the typical analog channel and the corresponding logic circuits. The analog system symbols are given in Figure 7.2-14.Each protection rack include a test panel containing those switches, test jacks and related equipment needed to test the channels contained in the rack. An interlocked hinged cover encloses the test panel. Opening the cover or placing the test-operate switch in the "TEST" position automatically initiates an alarm. These alarms are arranged in rack "sets" to annunciate entry to more than one rack or redundant protection "sets" or channels at any time.The test panel cover is designed such that it cannot be closed (and the alarm cleared) unless the test signal plugs (described below) are removed. Closing the test panel cover mechanically returns the test switches to the "OPERATE" position.Test procedures allow the bistable output relays of the channel under test to be placed in the tripped mode prior to proceeding with the analog channel tests. Thus, for the channel under test, the relay elements in the two-out-of-three or the two-out-of-four coincident matrices will be in the tripped mode during the entire test of the channel. This ensures that the remaining channels of the two-out-of-three or the two-out-of-four protective functions meet the single failure criterion during the entire channel test. Placing the bistable trip switch in the tripped mode de-energizes (trips) the bistable output relays and connects a proving lamp to the bistable output circuit. This permits the electrical operation of the solid-state bistable to be observed and the bistable set point relative to the channel analog signal to be verified. Test procedures also allow the bistable output relays of the channel under test to be -placed in the bypassed mode 18 of 1.08 IP3 FSAR UPDATE prior to proceeding with the analog channel test; i.e., a two-out-of-three circuit becomes a two-out-of-two circuit. Testing in bypass mode is depicted in Figures 7.2-20, 7.2-21, and 7.2-22.This may only be done for circuits whose hardware does not require the use of jumpers or lifted leads to be placed in the bypass mode. Upon completion of test of the analog channel, the bistable trip switches must be manually reset to their operate mode. Closing the cover of the test panel will not transfer the bistable trip switches from their tripped to their operate position.The following circuits are equipped with trip bypass capability: REACTOR TRIP AUTO SAFETY INJECTION ACTUATION Overpower Delta T Hi Containment Pressure Over Temperature Delta T Steam Line Delta P Lo Steam Generator Level Hi Steam Flow SI Lo-Lo Steam Generator Level Lo Steam Line Pressure Steam Flow > Feedwater Flow Mismatch Lo Tavg Pressurizer Hi Pressure Lo Pressurizer Pressure Pressurizer Lo Pressure Pressurizer Hi Level TURBINE TRIP Lo Reactor Coolant Flow Steam Generator Hi-Hi Level Stop Rod Withdrawal Analog channel tests are accomplished by simulating a process measurement signal, varying the simulated signal over the signal span and checking the correlation of bistable set points, channel readouts and other loop elements with precision portable read-out equipment. Test jacks are provided in the test panel for injection of the simulated process signal into each process analog protection channel. Test points are provided in the channel to facilitate an independent means for precision measurement and correlation of the test signal. This procedure does not require any tools nor does it involve in any way the removal or disconnection of wires in the channel under test. In general, the analog channel circuits are arranged so that the channel power supply is loaded and is providing sensing circuit power during channel test. Load capability of the channel power supply is thereby verified by the channel test.Nuclear Instrumentation Channel Testingq Nuclear Instrumentation Channel Systems (NIS) channels are tested by superimposing the test signal on the actual detector signal being received by the channel. The output of the bistable is not placed in a tripped condition prior to testing. A valid trip signal would then be added to the existing test signal, and thereby cause channel trip at a somewhat lower percent of actual reactor power. Protection bistable operation is tested by increasing the test signal (level signal)to the bistable trip level and verifying operation at control board alarms and/or at the NIS racks.A NIS channel which can cause a reactor trip through one-out-of-two protection logic (source or intermediate range) is provided with a bypass function which prevents the initiation -of a reactor trip from that particular channel during the short period that it is undergoing test. The power range channels do not require bypass of the reactor trip function for test purposes since the protection logic is two-out-of-four. The power range dropped rod function is operated from a one-out-of-four protection logic; therefore, a bypass function is provided on each of the power range channels to prevent load cutback during the dropped rod channel test. Over-riding the dropped rod circuitry from causing a spurious turbine runback due to instrument ýbus noise has 19 of 1-08 IP3 FSAR UPDATE no impact on the utilization of the Rod Drop Bypass Switch on each Power Range Nuclear Instrument for nuclear instrument testing.In all cases the bypass condition and the channel test condition are alarmed on the NIS drawer and at the main control board. An interlock feature between the bypass switch and channel test switch on each channel keeps the test signal from being activated until the bypass function has been inserted. Administrative control is required to ensure that only one protection channel is placed in the bypass condition at any one time. The power range reactor trips are not affected by the bypass function described above. Therefore these power range trips will be active if required. No provision was made in the channel test circuit for reducing the channel signal level below that signal being received from the NIS detector.Logic Channel Testinq The general design features of the logic system are described below. The trip logic channels for a typical two-out-of-three and a two-out-of-four trip function are shown in Figure 7.2-8. The analog portions of these channels are shown in Figure 7.2-9. Each bistable drives two relays ("A & B" for level and "C" & "D" for pressure). Contacts from the "A" and "C" relays are arranged in a 2/3 and 2/4 trip matrix for Trip Breaker No. 1 (RTB). The above configuration is duplicated for Trip Breaker No 2 (RTA) using contacts from the "B" and "D" relays. A series configuration is used for the trip breakers since they are actuated (opened) by undervoltage coils. This approach is consistent with a de-energize-to-trip preferred failure mode. The planned logic system testing includes exercising the reactor trip breakers to demonstrate system integrity. Bypass breakers are provided for this purpose. During normal operation, these bypass breakers are open. Administrative control is used to minimize the amount of time these breakers are closed. Closure of the breaker is controlled from its respective logic test panel in the Control Room. An interlock is provided that trips both bypass breakers open if a second.bypass breaker is closed. The status of the breaker is indicated in the Control Room by indicating lights.As shown in Figure 7.2-8 the trip signal from the logic network is simultaneously applied to the main trip breaker associated with the specific logic chain as well as the Bypass Breaker associated with the alternate trip breaker. Should a valid trip signal occur while Bypass Breaker No. 1 (BYB) is bypassing Trip Breaker No. 1 (RTB), Trip Breaker No. 2 (RTA) will be opened through its associated logic train. The trip signal applied to Trip Breaker No. 2 (RTA) is simultaneously applied to bypass breaker No. 1 (BYB) thereby opening the bypass around Trip Breaker No. I (RTB). RTB would either be opened manually as part of the test or-would be opened through its associated logic train which would be operational or tripped during a test.Two auxiliary relays are located in parallel with the undervoltage coils of the trip breaker. The output contacts (normally closed) of these relays are connected in series and initiate actuation of the shunt trip coil of both the reactor trip and the associated bypass breaker upon a reactor trip signal. The above contacts are connected to the respective breaker shunt trip coil circuit through test switches which, during the. testing of the undervoltage trip device, block the undervoltage trip signal. The test switches are supervised by control room annunciation. In addition, key operated test switches are provided for each train to allow energization of breaker shunt trip coil independent of the undervoltage trip device. The two sets of test switches in conjunction permits selection of particular reactor or bypass breaker to be tested. During response time testing, the shunt trip relay is tied to a portable recorder which is used to indicate transmission of a trip signal through the logic network. Lights are also provided to indicate, the status of the individual logic relays.20 of 108 IP3 FSAR UPDATE The following procedure illustrates the method used for testing Trip Breaker No. 1 (RTB) and its associated logic network: a) Manually set and trip Bypass Breaker No. 1 (BYB) to verify operation. b) Set BYB; trip Trip Breaker No. 1 (RTB).c) Place key operated switch "Train-Auto Defeat" to test position, verify alarm and test lamp illumination. d) Sequentially de-energize the trip relays 9A1, A2, A3) for each logic combination (1-2, 1-3, 2-3). Verify that the logic network de-energizes the UV coil on Trip Breaker No. 1 (RTB) for each logic combination. Since the neon light monitors the signal applied to the UV coil, operation of the UV coil can be determined from the neon light.e) Repeat "D" for every logic combination in each matrix.f) Reset Trip Breaker No. 1 (RTB).g) Trip RTB to validate prior test results as evidenced by the neon light.h) Reset Trip Breaker No. 1 (RTB). Trip BYB.In order to minimize the possibility of operational errors from either the standpoint of tripping the reactor inadvertently or only partially checking all logic combinations, each logic network includes a logic channel test panel. This panel includes those switches, indicators and recorders needed to perform the logic system test. The front panel arrangement is shown in Figure 7.2-10. The test switches used to de-energize the. trip bistable relays operate through interposing relays as shown in Figures 7.2-7 and 7.2-9. This approach avoids violating the separation philosophy used in the analog channel design. Thus, although test switches for redundant channels are conveniently grouped on a single panel to facilitate testing, physical and electrical isolation of redundant protection channels are maintained by the inclusion of the interposing relay which is actuated by the logic test switches.If the logic test switches in both -engineered safeguards logic trains are placed in the test mode simultaneously, the automatic safeguards actuation will be blocked for the two trains. However, a separate alarm on the main control board is provided for each safeguard trainto indicate when each train is in test.The test switches are located in separate safeguards racks and administrative control prevents the simultaneous operation of Train A and Train B test switches.It should be noted that either one of the safeguards train, which is blocked by its test switch, can always be unblocked and actuated by the manual safety injection switch at the main control board.Safeguards Initiating Circuitry The safeguards actuation circuitry and hardware layout are designed to maintain circuit isolation through the bistable operated logic relays. The channelized design follow through is shown on the Figure 7.2-15 block diagram.21 of 108 IP3 FSAR UPDATE The orderly arrangement of equipment for the Reactor Protection System and Engineered Safety Features Actuation System helps facilitate testing and maintenance. A color code of red, white, blue and yellow is used for analog protection channels in sets I, II, Ill, and IV, respectively. Large identification plates with the appropriate background color are attached at the front and back surfaces of each analog rack. The protection logic cabinets, housing the Train A logic, master relays, and slave relays, are physically separated from cabinets housing Train .B equipment and identified by large identification plates on the input side of the racks where protection signals from the various protection channels are received. Small electrical components have nameplates on the enclosure which houses them. All cables are numbered with identification tags. These numbers are cross-referenced with cable schedule which specifies cable routing and function. The cable trays are color coded with each, of the four channels having a different color assigned.The safeguards bistables, mounted in the analog protection racks, drive both "A" and "B" logic matrix relays. Each matrix contains its own test light and test circuitry. The "A" and "B" logic matrices operate master relays for actuating channels A and B respectively, as shown in Figure 7.2-16.Control power for logic channels A and B, is supplied from DC distribution panel No. 31 and No.34, respectively. These redundant actuating channels operate the various safeguards components required with the large loads sequenced as necessary. Protection channel identity is lost in the intermixing of the relay matrix wiring. Separation of A and B logic channels is maintained by the separate logic racks.0 For safety injection, manual reset of the safeguards actuation relays may be accomplished two minutes following their operation. Once reset action is taken, the master relay is reset and its operation blocked, except for manual initiation. The engineered safeguards circuitry can be unblocked by resetting the reactor trip breaker.Hinged safety covers on the reset pushbuttons in the circuitry of the Safety Injection, Containment Spray, Containment Isolation Phase A and Phase B, and Containment Ventilation Isolation Systems require deliberate action by the operators to actuate these pushbuttons and facilitate placing adequate administrative controls on the actuation of these pushbuttons. The Containment Ventilation Isolation System cannot be placed in a bypass condition while any of the automatic safety signals is present.Separate and independent key-lock switches, one for each SI train, are provided in series to each of the auto SI actuation relays to allow manual blocking of the Engineered Safeguards System actuation. (See Section 6.2.2)Logic Channel Testinq Figures 7.2-1.6 and 7.2-17 show the basic logic test scheme. Test switches are located in associated relay racks rather than in a single test panel. The following procedure is used for testing the logic matrices: 1) Following administrative procedure, test Channel A or B, one at a time 0 22 of 108 IP3 FSAR UPDATE 2) Depress the test relay switch to energize the rack test relays. An alarm will sound on the main board and a light at the rack will indicate that the safeguards rack is now in test.3) Select a matrix and depress the logic test switches. The master relay will energize and matrix test lights will indicate upon actuation of the particular matrix being tested. The slave relay test lights will verify that the master relay contact associated with a particular slave relay has functioned and will also verify the integrity of the slave relay coils.4) Reset the master relay by depressing the master relay reset switch. Reset the test relays by depressing the test reset switch. A lamp will glow as long as the test relays are energized. If a test relay contact in a particular slave relay circuit does not return to its normal position, then the slave relay test lamps will indicate such. Test lights can be tested by depressing the lens.Primary Power Source The primary source of control power for the Reactor Protective System is the vital instrument buses described in Chapter 8. The source of power for the measuring elements and the actuation circuits in the engineered safety features instrumentation is also from those buses.Protective Actions Reactor Trip Description, The Reactor Protection System acts to shut the reactor down by means of various reactor trips which are designed to occur when a measured plant variable exceeds predetermined limits.The protection system consists of all instrumentation which monitors the process variables and initiates trip if the process variables approach safety limits. It includes, but is not limited to, sensing elements, transmitters, converters, relays, actuating devices, interlocks, alarms, signal lines, etc. The trips function to provide rapid reduction of reactivity by the insertion of full-length RCC assemblies under free fall into the reactor core. The full-length RCC assemblies must be energized to remain withdrawn from the core.Automatic reactor trip occurs upon the loss of power to the full-length control rods. All power to the full-length control rod mechanisms are interlocked by duplicate series connected circuit breakers. The trip breakers are opened by the undervoltage coils on both breakers. The undervoltage coils, which are normally energized, become de-energized by any one of the several trip signals.Certain reactor trip channels (low reactor coolant flow, etc.) are automatically bypassed at low power where they are not required for safety. Nuclear source range, intermediate range and power range (low setpoint) trips, which are specifically provided for protection at low power or subcritical operation, are bypassed by operator manual action after receiving a permissive signal from the next higher range of instrumentation to allow power escalation during startup.During power operation, a sufficiently rapid shutdown capability in the form of RCC assemblies is administratively maintained through the control rod insertion limit monitors. Administrative control requires that all shutdown rods be in the fully withdrawn position during power operation. A resume of reactor trips, including means of actuation and the coincident. circuit requirements, is given in Table 7.2.1. The permissive circuits referred to (e.g., P-7) are listed in Table 7.2-2.23 of 108 IP3 FSAR UPDATE Manual Trip The manual actuating devices are independent of the automatic trip circuitry and are not subject to failures which might make .the automatic circuitry inoperable. Either of two manual trip devices located in the Control Room will initiate a reactor trip.High Nuclear Flux (Power Range) Trip This circuit trips the reactor when two of the four power range channels read above the trip setpoint. There are two independent trip settings, one high and one low setting. The high trip setting provides protection during normal power operation. The low setting, which provides protection during startup, can be manually bypassed when two out of the four power range channels read above approximately 10% .power (P-10). Three out of the four channels below 10% automatically reinstates the trip protection. The high setting is always active.High Nuclear Flux (Intermediate Range )Trip This circuit trips the reactor when one out of the two intermediate range channels reads above the trip setpoint. This trip, which provides protection during reactor startup, can be manually bypassed if two out of four power range channels are above approximately 10% (P-10). Three out of four channels below this value automatically reinstate the trip protection. The intermediate channels (including detectors) are separate from the power range channels.High Nuclear Flux (Source Range) Trip This circuit trips the reactor when one of the two source range channels reads above the trip setpoint. The trip, which provides protection during reactor startup, can be manually bypassed when one of two intermediate range channels reads above the P-6 setpoint value and is automatically reinstated when both intermediate range channels decrease below this value (P-6). This trip is also bypassed by two out of four high power range signals (P-10). It can also be reinstated below P-10 by an administrative action requiring coincident manual actuation. The trip point is set between the intermediate range lower limit of instrument sensitivity and the upper limit of the source range instrument range.Overtemperature AT Trip The purpose of this trip is to protect the core against DNB. This circuit trips the reactor on coincidence of two-out-of-the-four signals with one channel (two temperature measurement, hot.and cold) per loop. The set point for this reactor trip is continuously calculated for each channel by solving equations of this form: ATtrip -AT, [K 1 K 2 (Tavg -T') + K 3 (P -P') -f (Al)]where ATo indicated AT at rated power, F 24 of 108 IP3 FSAR UPDATE Tavg -reactor coolant average temperature, two measurements in each loop. (Tavg signal is rate compensated), F T' indicated Tavg at nominal condition at rated power, F P -pressurizer pressure, four independent measurements, psia P1 -nominal pressure at rated power, psia K 1 -set point bias, F K 2 , K 3 -constants based on the effect of temperature and pressure on the DNB limits f (AI) -a function of the indicated difference between top and bottom detectors of the power range nuclear ion chambers with gains selected based on measured instrument response during plant startup tests.Overpower AT Trip The purpose of this trip is to protect against excessive power (fuel rod rating protection). This circuit trips the reactor on coincidence of two out of the four signals with one channel (one pair of temperature measurements) per loop.The set point for this reactor trip is continuously calculated for each channel by solving equations of the form;ATset point " AT. [K 4 -K 5 -dT-av -K 6 (Tavg -T')]dt where ATo -indicated AT at rated power, F Tavg -Average temperature, F T' Indicated Tavg at nominal conditions at rated power, F K 4 Set point bias K 5 -Constant K 6 -Constant Low Pressurizer Pressure Trip The purpose of this circuit is to protect against excessive core steam voids which could lead to DNB. The circuit trips the reactor on coincidence of two out of the four low pressurizer pressure signals. This trip is blocked when any three of the four power range channels and two of two turbine first stage (inlet) pressure channels read below approximately 10% power (P-7).25 of 108 IP3 FSAR UPDATE High Pressurizer Pressure Trip The purpose of this circuit is to limit the range of required protection from the overtemperature AT trip and to protect against Reactor Coolant System over-pressure: This circuit trips the reactor on coincidence of two out of the.three high pressurizer pressure signals.High Pressurizer Water Level Trip This trip is provided as a backup to the high pressurizer pressure trip. The coincidence of two out of the three high pressurizer water level signals trips the reactor. The trip is bypassed when any three of the four power range channels and two of the two turbine first stage (inlet) ,pressure channels read below approximately 10% power (P-7).Low Reactor Coolant Flow Trip The trip protects the core form DNB following a loss of coolant flow accident. The means of actuating the loss of coolant flow accident trip are: a) Measured low flow in the reactor coolant loop. The low flow trip signal is actuated by the coincidence of 2/3 signals of any reactor coolant loop. The loss of flow in any two loops causes a reactor trip above approximately 10% power (P-7). Above the P-8 setpoint any one loop causes a reactor trip. The sensor used for flow measurement is an elbow tap and is discussed in Chapter 4.b) Reactor coolant pump circuit breaker open functions similarly to the low flow signal with one sensor per reactor coolant pump breaker.c) Underfrequency on any two of the four reactor coolant pump buses will trip all four reactor coolant pumps and cause a reactor trip above approximately 10% power (P-7).d) Undervoltage on any two of the four reactor coolant pump buses causes a direct reactor trip above approximately 10% power (P-7).Safety Iniection System (SIS) Actuation Trip A reactor trip occurs when the Safety Injection System is actuated. The means of actuating the SIS trips are: 1) Low pressurizer pressure (two out of three). This signal may be manually blocked or unblocked during start-up and shutdown. This block is accomplished by separate switches for each of the redundant safety injection initiation circuits. The block will be automatically removed above a designated setpoint.2) High containment pressure (two out of three) set at approximately 10% of containment design pressure.3) High differential pressure between any two steam lines (two out of three).4) After time delay: high steam flow in 2/4 lines (one out of two. per line), in coincidence with either low Tav, in 2/4 lines or low steam line pressure in 2/4 lines, 26 of 108 IP3 FSAR UPDATE 5) High-high containment pressure (two sets of two-out-of-three), set at approximately 50%of containment design pressure [energize to actuate].6) Manual.Turbine Generator Trip A turbine trip is sensed by two out of three signals from auto-stop oil pressure. A turbine trip is accompanied by a direct reactor trip above P-8 and a controlled short term release of steam to the. condenser occurs which removes sensible heat from the Reactor Coolant System while avoiding steam generator safety valve actuation. Any reactor trip will generate a turbine trip.Further details are discussed in Chapter 10.Steam/Feedwater Flow Mismatch Trip This trip protects the reactor from a sudden loss of heat sink. The trip is actuated -by one steam/feedwater flow mismatch in selected coincidence with one low steam generator water level in that steam generator. There are two steam/feedwater flow mismatches and two low steam generator water level signals per loop.Low-Low Steam Generator Water Level Trip The purpose of this trip is to protect the steam generators for the case of a sustained steam/feedwater flow mismatch. The trip is actuated on two out of the three low-low water level signals in any steam generator. A diagram of the steam generator level control and protection system is shown in Plant Drawing IP3V-0171-0355 [Formerly Figure7.2-13]. Rod Stops A list of rod stops is listed in Table 7.2-3. Some of these have been previously noted under permissive circuits, but are listed again for completeness. Rod Drop Protection Two independent systems are provided to sense a dropped rod: a rod bottom position detection system and a system which senses sudden reduction in out-of-core neutron flux. Both protection systems initiate protective action in the form of blocking automatic rod withdrawal, and also, a turbine load cutback if above a given power level. This action compensates for accessible adverse core power distributions and permits an orderly retrieval of the dropped RCC.The primary protection for the dropped RCC accident is the rod ,bottom signal derived for each rod from its individual position indication system. With the position indication system, initiation of protection is independent of rod location of reactivity worth.Backup protection is provided by use of the out-of-core power range nuclear detectors and is particularly effective for large nuclear flux reductions occurring in the region of the core adjacent to the detectors. The rod drop detection circuit from nuclear flux consists basically of a comparison of each ion chamber signal with the same signal taken through a first order lag network. Since a dropped 27 of 1.08 IP3 FSAR UPDATE RCC assembly will rapidly depress the local neutron flux, the decrease in flux will be detected by one or more of these four sensors. Such a sudden decrease in ion chamber current will be seen as a difference signal. A negative signal output greater than a preset value (approximately 10%) from any of the four power range channels will actuate the rod drop protection. Figure 7.4-2 indicates schematically the dropped rod detection circuits and the Nuclear Protection System in general. The potential consequences of any dropped RCC without protective action are presented in Section 14.1.4.Alarms Any of the following conditions actuate an alarm: a) Reactor trip (first-out annunciator) b) Trip of any reactor trip channel c) Significant deviation of any major control variable (pressure, Tavg, pressurizer water level, and steam generator water level)d) Actuation of any permissive circuit or override. (Certain permissive are provided with indication light only on the flight panel.)Control Group Rod Insertion Limits The control rod insertion limit system is used in an administrative control procedure with the objective to maintain an RCCA shutdown margin.The control group rod insertion limits, ZLL, are calculated as a linear function of reactor power and reactor coolant average temperature. The equation is: ZLL -A (AT)avg + B (Tavg) + C where A and B are preset manually adjustable gains and C is a preset manually adjustable bias.These set points may be different for each control bank. The (AT) av, and (Ta,,) are the average of the individual temperature differences and the coolant average temperatures, respectively, measured from the reactor coolant hot leg and cold leg.One insertion limit monitor with two alarm set points is provided for each control bank. A description of control and shutdown rod groups is provided in Section 7.3. The low alarm alerts the operator of an approach to a reduced shutdown reactivity situation requiring boron addition by following normal procedures with the Chemical and Volume Control System (Chapter 9).Actuation of low-low alarm requires the operator to take immediate action to add boron to the system by any one of several alternate methods.7.2.3 System Evaluation Reactor Protection System and DNB The following is a description of how the reactor protection system prevents DNB.28 of 108 IP3 FSAR UPDATE The plant variables affecting the DNB ratio are: Thermal power Coolant flow Coolant temperature Coolant pressure Distribution Core power (hot channel factors)Figure 7.2-11 illustrates the core limits for which DNBR for the hottest rod is at the design limit and shows the overpower and overtemperature AT reactor trips locus as a function of Tavg and pressure.Excessive axial offset reduces the overtemperature AT setpoint associated with both the block on control rod withdrawal and the reactor trip actuation. If the AT of any RCS loop exceeds the calculated overpower or overtemperature AT setpoints, permissive signals will be generated which will initiate a block on control rod withdrawal. The setpoint on these AT rod blocks are approximately 20 F less than the corresponding AT setpoints usedr to actuate reactor tip. This provides a margin or buffer prior to achieving operating conditions requiring a reactor trip on overpower or overtemperature. Rod block on AT circuitry is not redundant, whereas the AT reactor trips are protective grade and meet the standards of IEEE-279.Reactor trips for a fixed high pressurizer pressure and for a fixed low pressurizer pressure are provided to limit the pressure range over which core protection depends on the variable overpower and overtemperature AT trips.Reactor trips on nuclear overpower and low reactor coolant flow are provided for direct, immediate protection against rapid changes in these variables. However, for all cases in which the calculated DNBR approaches the applicable DNBR limit, a reactor trip on overpower and/or overtemperature AT would be actuated.The AT trip functions are based on the differences between measurements of the hot leg and cold leg temperatures, which are proportional to core power.The overtemperature AT trip function is provided with a nuclear flux feedback to reflect a measure of axial power distribution. This will assist in preventing an adverse distribution which could lead to exceeding allowable core conditions. Overpower Protection In addition to the high power range nuclear flux trips, an overpower AT trip is provided (2 out of 4 logic) to limit the maximum overpower. A rod stop function and turbine runback function is provided in the form: AT rod stop = ATtrip -BP Bp = set point bias (F)The logic for the runback is one out of four.29 of 108 IP3 FSAR UPDATE Overtemperature Protection A second AT trip (2 out of 4 logic) provides an overtemperature trip which is a function of coolant average temperature and pressurizer pressure derived as previously discussed. A similar rod stop function is provided in the form;AT rod stop = ATtrip -8 T BT = set point bias, F The logic for the rod stop is one out of four.In summary, in the event the difference between top and bottom detectors exceeds the desired range, automatic feedback signals are provided to reduce the overtemperature trip setpoint and to block rod withdrawal to maintain appropriate operating margins to the trip setpoint.Interaction of Control and Protection The design basis for the control and protection systems permits the use of a detector for both protection and control functions. Where this is done, all equipment common to both the protection and control circuits are classified as part of the protection system. Isolation amplifiers prevent a control system failure from affecting the protection system. In addition, where failure of a protection system component can cause a process excursion which requires protective action the protection system can withstand another independent failure without loss of function.Generally, this is accomplished with two-out-of-four trip logic. Also, wherever practical, provisions are included in the protection system to prevent a plant outrage because of single failure of a sensor.Specific Control and Protection Interactions Nuclear Flux Four power range nuclear flux channels are provided for nuclear overpower protection. Isolated outputs from all four channels are averaged for automatic control rod regulation of power. If any channel fails in such a way as to produce a low output, that channel is incapable of proper nuclear overpower protection. In principle, the same failure would cause rod withdrawal and, overpower. Two-out-of-four nuclear overpower trip logic will ensure a nuclear overpower trip if needed even with an independent failure in another channel.In addition, the control system will respond only to rapid changes in indicated nuclear flux; slow changes or drifts are overridden by the temperature control signals. Also, a rapid decrease of any nuclear flux signal will block automatic rod withdrawal as part of the rod drop protection circuitry. Finally, an overpower signal from any nuclear channel will block automatic rod withdrawal. The set point for this rod stop is below the reactor trip set point.Coolant Temperature 30 of 108 IP3 FSAR UPDATE Four Ta,,, channels are used for overtemperature-overpower protection. SeePlant I P3V3 171-0052, -0053, -0054, and -0055 [Formerly Figyre 72-12] for single channel). Isolated output signals from all four channels are also averaged for automatic control rod regulation. In principle, a spuriously low temperature signal from one sensor could cause rod withdrawal and overtemperature. Two-out-of-four overtemperature and overpower AT logic will ensure a trip is needed even with an independent failure in another channel. In addition, channel deviation alarms in the control system will block automatic rod withdrawal if any temperature channel deviates significantly from the others. Automatic rod withdrawal blocks will also occur if any one of four nuclear channels indicates an overpower condition or if any one of the four temperature channels indicates an overtemperature condition. Finally, as shown in Section 14.1, the combination of trips on nuclear overpower, high pressurizer water level, and high pressurizer pressure also serve to limit an excursion for any rate of reactivity insertion. Narrow range RCS hot leg temperature is measured for each channel through the use of three RTDs located 1200 apart. The three RTD signals are averaged by a microsprocessor to produce the hot leg signal for the channel. The microprocessor has the capability to detect a failure of any of the hot leg RTDs.Pressurizer Pressure Four pressure channels are used for high and low pressure protection and for overpower-overtemperature protection. Three of these are also used for high pressure protection. Isolated output signals from these channels are also used for pressure control. These are discussed separately below: 1) Pressure Control. Spray, power-operated relief valves, and heaters are controlled by isolated output signals from the pressure protection channels: a) Low Pressure A spurious high pressure signal from one channel can cause low pressure by actuation of a pressurizer spray valve. Spray reduces pressure at a low rate, and some time is available for operator action (about three minutes at maximum spray rate) before a low pressure trip is reached. Additional redundancy is provided by the protection system to ensure underpressure protection, i.e., two-out-of-four low pressure reactor trip logic and two-out-of-three safety injection logic.Each pressurizer relief valve is interlocked to prevent opening on a single high pressure signal. Furthermore, the valve setpoint is at a higher pressure than the normal high pressure signal actuation pressure.b) High Pressure The pressurizer heaters are incapable of overpressurizing the Reactor Coolant System.Maximum steam generation rate with heaters is about 15,000 lbs/hr, compared with a total capacity of 1,260,000 lbs/hr for the three safety valves and total capacity of 358,000 lbs/hr of the two power-operated relief valves. Therefore, overpressure protection is not required for a pressure control failure. Two-out-of-three high pressure trip logic is therefore used.31 of 108 IP3 FSAR UPDATE In addition, either of the two relief valves can easily maintain pressure below the high pressure trip point. The two relief valves are controlled by independent pressure channels, one of which is independent of the pressure channel used for heater control.Finally, the rate of pressure rise achievable with heaters is slow, and ample time and pressure alarms are available for operator action.An Overpressure Protection System prevents the reactor vessel pressure from exceeding the Technical Specification limits, as described in Section 4.3.4.c) Pressurizer Level The presssurizer level channels are used for high level reactor trip two out of three.Isolated output signals from these channels are used for volume control, increasing or decreasing water level. A level control failure could fill or empty the pressurizer at a slow rate (on the order of half an hour or more).2) Higqh Level A reactor trip on pressurizer high water level is provided to prevent rapid thermal expansions of reactor coolant fluid from filling the pressurizer; the rapid change from high rates of steam relief to water relief can be damaging to the safety valves and relief piping and pressure relief.tank. However, a level control failure cannot actuate the safety valves because the high pressure reactor trip is set below the safety valve set pressures. Therefore, a control failure does not require protection system action. In addition, ample time and alarms are available for operator action.3) Low Level For control failures which tend to empty the pressurizer, a low level signal from either of two independent level control channels will isolate letdown, thus preventing the loss of coolant.Ample time and alarms exist for operator action.A low pressurizer level will result for all Loss-of-Coolant Accidents except for a special class of breaks in the range of 2 to 6 inches which occur in the vapor space of the pressurizer. For this special class which does not result in low pressurizer water level, the reactor will be tripped on either low pressure or DT overtemperature as the pressure drops, and DNB will be prevented. Following reactor trip, there will be no core damage as long as the core remains covered.Sufficient time is available in accidents of this type for the operator to take manual control of makeup to assure core cooling during subsequent cold shutdown procedures. Sufficient redundancy is provided to accommodate the loss of one level channel without jeopardizing functional capability of the reactor protection system. In the Technical Specifications, limits are set on the minimum number of operable channels and required plant status for all reactor protection instrumentation. Steam Generator Water Level; Feedwater Flow Before describing control and protection interaction for these channels, it is beneficial to review the protection system basis for this instrumentation. 32 of 108 IP3 FSAR UPDATE The basic function of the reactor protection circuits associated with low steam generator water level and low feed water flow is to preserve the steam generator heat sink for removal of long term residual heat. Should a complete loss of feedwater occur with no protective action, the steam generators would boil dry and cause an overtemperature-overpressure excursion in the reactor coolant. Reactor trips on temperature, pressure, and pressurizer water level will trip the plant before there is any damage to the core or reactor coolant system. However, residual heat generated after the reactor trip would cause a pressure spike in the pressurizer that lifts the pressurizer relief valves and causes discharge of liquid reactor coolant to the Containment. Redundant auxiliary feedwater pumps are provided to prevent this. Reactor trips act before the steam generators are dry to reduce the required capacity and starting time requirements of these pumps and to minimize the thermal transient on the reactor coolant system and steam generators. Independent trip circuits are provided for each steam generator for the following reasons: 1) Should severe mechanical damage occur to the feedwater line to one steam generator, it is difficult to ensure the functional integrity of level and flow instrumentation for that unit. For instance, a major pipe break between the feedwater flow element and the steam generator would cause high flow through the flow element. The rapid depressurization of the steam generator would drastically affect the relation between downcomer water level and steam generator water inventory.

2) It is desirable to minimize thermal transient on a steam generator for credible loss of feed water accidents.

It should be noted that controller malfunctions caused by a protection system failure affect only one steam generator. Also, they do not impair the capability of the main feedwater system under either manualcontrol or automatic Tavg control. Hence, these failures are far from being the worst case with respect to decay heat removal with the steam generators. a) Feedwater Flow A spurious high signal from the feedwater flow channel being used for control would cause a reduction in feedwater flow and prevent that channel from tripping. A reactor trip on low-low water level, independent of indicated feedwater flow, will ensure a reactor trip if needed.In addition, the three-element feedwater controller incorporates reset on level, such that with expected gains, a rapid increase in the flow signal would cause only a 12-inch decrease in level before the controller reopened the feedwater valve. A slow increase in the feedwater signal would have no effect at all.b) Steam Flow A spurious low steam flow signal would have the same effect as a high feedwater signal, discussed above.c) Level A spurious high water level signal from the protection channel used for control will tend to close the feedwater valve. This level channel is independent of the level and flow channels used for reactor trip on low flow coincident with low level.33 of 108 IP3 FSAR UPDATE 1) A rapid increase in the level signal will completely stop feedwater flow and actuate a reactor trip on low feedwater flow coincident with low level.2) A slow drift in the level signal may not actuate a low feedwater signal. Since the level decrease is slow, the operator has time to respond to low level alarms. Since only one steam generator is affected, automatic protection is not mandatory and reactor trip on two out of three low-low level is acceptable.

7.2.4 Qualification

Testing Typical protection system equipment is subjected to type tests, under simulated seismic acceleration to demonstrate its ability to perform its functions. Type testing is performed using conservatively large accelerations and applicable frequencies. The peak accelerations and frequencies used are checked against those derived by structural analysis of operational and design basis earthquake loadings. Typical -switches and indicators for safety features components have been tested to determine their ability to withstand seismic forces without malfunction which would defeat automatic operation of the required component. For testing there is no adequateway of knowing what combination of vertical and horizontal input motion produces the worst effects (e.g., stresses, deflections). There is a greater probability that due to the phase relationship of the two simultaneously applied input motions, the resulting combined motion produces less severe effects than when these motions are applied separately. Testing in one direction at a time is considered the best way to obtain positive proof of the equipment's capability. (The independent testing in each of the three directions is also recommended in the IEEE Guide for Seismic Qualifications of Class I Electric Equipment.) Furthermore, the uni-directional testing was performed in a conservative manner, thus providing a margin against any greater effects which may possibly result from the worst combination of simultaneous testing. These conservatisms consist of: (1) an input sine beat motion with 10 cycles per beat, (2) resonant testing at all determined and applicable natural frequencies, (3) further testing at other selected frequencies, and (4) high input acceleration values, particularly for the vertical direction. Qualification testing was performed on various safety systems such as process instrumentation and nuclear instrumentation. This testing involved demonstrating operation of safety functions at elevated ambient temperatures to 120'F for original control room equipment. To establish the combined effect upon protection systems of long term operation followed by exposure to accident conditions inside the containment, selected components were subjected to thermal aging followed by irradiation. In addition, components were first irradiated and then subjected to thermal aging. Results of the tests indicate that the components would perform satisfactorily following a Design Basis Accident.Cables of the type used for Indian Point 3 were tested Using the same approach as described above, i.e., irradiation, thermal aging followed by steam exposure and thermal age, and irradiation followed by steam exposure. During exposure to steam, the cables carry nominal voltage and current.Westinghouse Topical Reports, WCAP-7817(1), WCAP-7817 Supplement 1(2), and WCAP-8234(3) provide the seismic evaluation of safety related equipment. The type tests covered by these reports are applicable to Indian Point 3.34 of 108 IP3 FSAR UPDATE References

1) Vogeding, E. L., "Seismic Testing of Electrical and Control Equipment," WCAP-7817, December 1971.2) Vogeding, E. L., "Seismic Testing of Electrical and Control Equipment (WCID Process Control Equipment)," WCAP-7817 Supplement 1, December 1971.3) "Seismic Testing and Functional Verification of By-Pass Loop Reactor Coolant RTD's," WCAP-8234 (Westinghouse Non-Proprietary Class 3), June 1974.4) NSE 94-3-124 ED, Rev. 0 "Evaluation of Cable Channelization Deficiencies." 35 of 108 S IP3 FSAR UPDATE Table 7.2-1 LIST OF REACTOR TRIPS & CAUSES OF ACTUATION OF: ENGINEERED SAFETY FEATURES, CONTAINMENT AND STEAM LINE ISOLATION

& AUXILIARY FEEDWATER I COINCIDENCE CIRCUITRY AND INTERLOCKS I COMMENTS REACTOR TRIP 1) Manual 1/2, no interlocks

2) Over'power nuclear flux 2/4 High and low settings; manual block and automatic reset of low setting by P-1O, Table 7.2-2 3) Overtemperature

!T 2/4, no interlocks

4) Overpower

!T 2/4, no interlocks

5) Low pressurizer pressure 2/4, blocked by P-7 6) High pressurizer.

pressure (fixed set 2/3, no interlocks points)7) High pressurizer water level 2/3, blocked by P-7 8) a. Low reactor coolant flow 2/3, per loop, blocked by P-7, P-8 b. Reactor coolant pump breaker 1/1, per loop, blocked by P-7, P-8 Reactor coolant pump breaker is tripped on underfrequency

c. Undervoltage on reactor coolant 2/4, per loop, blocked by P-7 pump bus .d. Underfrequency on reactor coolant 2/4 Underfrequency trips all reactor coolant pump bus pumps 9) Safety injection signal (Actuation) 2/3, low pressurizer pressure (manual block permitted by 2/3 low pressurizer pressure):

or 2/3 high containment pressure (high-level): or 2/3 high differential pressure between any two steam lines, or manual 1/2, or two sets of 2/3 hi-hi containment pressure (high-high pressure) [energize to actuate], or after delay (maximum 6 seconds) with high steam flow in 2/4 lines coincidence with (a)low Tavg in 2/4 lines or (b) low steam line pressure in 2/4 lines 10). Turbine generator 2/3, blockedby P-8 Low auto-stop oil pressures signal 11) Steam/feedwater flow mismatch 1/2 steam/feedwater flow mismatch in selected coincidence with low steam generator water level 36 of 108 IP3 FSAR UPDATE Table 7.2-1 LIST OF REACTOR TRIPS & CAUSES OF ACTUATION OF: ENGINEERED SAFETY FEATURES. CONTAINMENT AND STEAM LINE ISOLATION & AUXILIARY FEEDWATER I COINCIDENCE CIRCUITRY AND INTERLOCKS I COMMENTS in that steam generator 12) Low-low steam generator water level 2/3, per loop _13) High intermediate range nuclear flux 1/2, manual block permitted by P-1 0 Manual block and automatic reset 14) High source range nuclear flux 1/2, manual block permitted by P-6, block Manual block and automatic reset of P-6;maintained by P10 manual reset of P-10 CONTAINMENT ISOLATION ACTUATION 15) Safety Injection Signal (Phase A) See Item 9 Actuates all non-essential service containment isolation trip valve and actuates Isolation Valve Seal Water System 16) Containment pressure (Phase B) Coincidence of two sets of 2/3 containment Actuates all essential service containment pressure (High-high pressure [energize to isolation trip valves actuate], same signal which actuates containment spray), or manual 2/2 17) Containment ventilation (High 1/2 high activity signal, from air particulate detector This additional signal closes containment containment activity) or radiogas detector or containment isolation purge supply, exhaust ducts and pressure I phase "A" signal, or spray actuation signal relief duct only ENGINEERED SAFETY FEATURES ACTUATION 18) Safety injection signal (S) See Item 9 19) Containment spray signal (P) Coincidence of two sets of 2/3 containment pressure (high-high pressure); or manual 2/2 (Note: -Bistables are energize-to-operate), 20) Spray additive valves Coincidence of two sets of 2/3 contaiment pressure (high-high pressure, same signal which actuates containment spray (Note: Bistables are energize-to-operate)

21) Containment air recirculation cooling Safety injection signal initiates starting of all fans and filtration signal in accordance-with the safety injection starting sequence, 2/3 high containment pressure or manual 1/2 22) Isolation valve seal water signal Safety injection signal 37 of 108 IP3 FSAR UPDATE Table 7.2-1 LIST OF REACTOR TRIPS & CAUSES OF ACTUATION OF: ENGINEERED SAFETY FEATURES.

CONTAINMENT AND STEAM LINE ISOLATION & AUXILIARY FEEDWATER I COINCIDENCE CIRCUITRY AND INTERLOCKS I COMMENTS STEAM ISOLATION ACTUATION 23) Steam flow After time delay (maximum 6 seconds) with high steam flow in 2/4 lines in coincidence with (a) low Tavg in 2/4 lines or (b) low steam line pressure in 2/4 lines 24) Containment pressure Coincidence of two sets of 2/3 Containment pressure (high-high pressure)(Note: Bistables are energize-to-operate)

25) Manual 1/1 per steam line AUXILIARY FEED WATER ACTUATION 26) Turbine driven pump Coincidence of 2/3 low level in two steam generators; or a non-SI blackout sequence signal from 480 volt buses 3A or 6A; or manual 1/; or AMSAC Actuation 27) Motor driven pumps 2/3 low level in any steam generator; or trip of 1/2/main feedwater pump turbines; or safety injection signal; or manual 1/; or a non-SI blackout sequence signal from 480 volt bus 3A to start pump 31; or a non-SI blackout sequence signal from 480 volt bus 6A to start pump 33; or AMSAC Actuation MAIN FEEDWATER ISOLATION 28) Close main feedwater control valves, Any safety injection signal (See Item 9)(including associated MOVs) trip main feedwater pumps 38 of 108 IP3 FSAR UPDATE TABLE 7.2-2 INTERLOCK AND PERMISSIVE CIRCUITS Number Function Input for Blockinq 1 +Prevent rod withdrawal on overpower Auto-rod withdrawal stop at low power Auto-rod withdrawal stop on rod drop 1/4 high nuclear flux (power range) or 1/2 high nuclear flux (intermediate range or 1/4overtemperature AT or 1/4 overpower AT Low MWe load signal 1 rapid decrease of nuclear flux (power range) or 1/1 rod bottom indication 2 3+4*[BLANK -See Note]5+6 7 Steam dump interlock Manual block of source range level trip Permissive power (block various trips required only at power)Block single primary loop loss of flow trip and Block Reactor Trip on Turbine Trip Manual block of low setpoint trip (power range) and intermediate range trips Turbine tripsignal 1/ high intermediate range flux allows manual block, 2/2 low intermediate range defeats block/ low-low nuclear flux (power range) and 2/2 low turbine impulse chamber pressure signal 3 low nuclear flux (power range)2/4 high nuclear flux allows manual block, % low nuclear flux (power range) defeats manual block 8 9*10 NOTE:* not applicable to this plant+ alarmed 39 of 108 IP3 FSAR UPDATE TABLE 7.2-3 ROD STOPS Rod Stop 1. Rod Drop 2. Nuclear Overpower 3. High AT*4. Low Power 5. Tavg Deviation Actuation Signal1/414 rapid power range nuclear flux decrease or any rod bottom signal1/4 high power range nuclear flux or 1/2 high intermediate range nuclear flux 1/4 overpower AT or /overtemperature AT Low turbine first stage pressure load signals1/4 Tavg deviation from average Tavg Rod Motion to be blocked Automatic Withdrawal Actuation of rod stop (Item 1)initiates a turbine load reduction above a given power level Automatic and Manual Withdrawal Automatic and Manual Withdrawal Automatic Withdrawal Automatic Withdrawal

• NOTE: Actuation of rod stop (Item 3) initiates a load cutback at any power level.0 40 of 108 IP3 FSAR UPDATE TIRRABLE 7.2-4E tAI§LE OF MAIN CONTROL BO3ARD tIWDICATOR AND/OR RECORDERS "ORIGINALLY" AVAILAB1LE TO THE OPERATOR-111111STORICALI NO. OF CHANNELSýAVAIL REQUIRED kANGff'PARAMETiER ACCU~RACY REQUIRED, mbbERATE & INFI-ýEQUEfNt FAULTS 1. TCold or Thot 4THot "Al iNDICA1TOR/PREC ORD~ER Both channels are recorded on each loop.PURPOSE 6b7YoooF+4%of Full range ([easured,~Wide range), 4 TCold 2PreS~SUrizer, WLater Level-5 2 Entire Distance Betwveen Taps+3%10of Levelat All 3 charinlis channel is selected for recording.

Indicated and recorded Ensure ~maintenance of proper cooldown 1 rate to ensure maintenance o~f proper relationship between systemi pressure and temperature for NRTT considerationis. Ensure mainteniance o proper reactor coolant inventory. Ensure m aintenance--of proper relationship between system pressure and temperature for NfDTT~consideration. 3.Reactor System Pressure (Wide range)Pb-ýpOq psig 41 of 108 IP3 FSAR UPDATE 4.Containment Pressur~e Steam Line Prelssurel

6. 'S'tea m Generator Water Level (Wijde range)7. Steam Generator Water Level (Narrow range)~4: (3/& G.)I-5pig( to +7 psig ,0-1460 ps~ig 4 (~1/Lop)+/-3~% of Full ran~ge+/-,'-3% of Full Scai+/-5)/6 f LeelSp3an-%ofj Lev'el Span (Hot), All6 re in~dicated.

All 4 channels , :"ord d ..All '12 Channels indicated; the 4 channels used for control are recorded.Monitorontimn conditions to indicate need for potential safeguards actuation. Mo rtear generator temperature conditions during hot sutdown and cooldownand for use in recovery from steam generator tube ruptures.En~sure m~aint~enance of rea(ýctor ah~t sink.*fr~eom noial from nominal fu~llload water.level*Same as 6.inmm equir ents On lee hne e ta enerator (E~ithr Wide or Narrow Rý'ngej with at le~ast T~wo V~ide ,Ranige Channels 42 of 108 0 IP3 FSAR UPDATE TABLE 7.2-5'TALE&F MAIN CONTROL BOARD INDICATOR AND/OR RECORDERS "'ORIGIN~ALLY" AVAILABLE TO THE OPERATOR rHistoricali Pa ra mPete ri No. of Channels Avail Require.d Range A~ccuracy Required lnclicator/Re-co der P~urpose Limiting Faults 1. 'Containment Pressure 2.Refueling Water Storage Tank Walter, Level 3Steamn Water~ L~eve (narrow range), 4. Ste am Genierato. Water Level (wide range)6 2-5 psig to +7t Psig 0-100"o ojf span+<10%~o'f Full Scale 1+/-3 %of leveklspan All6 are indicated One is indicated and both are 3/S§team*Generato,-1iS~tearri ý1 G 7 6nerato, from nomninal full load leveI fromn nominal Lulllo~ad li'e+ 10~%of levelspan All chaninels indicated-,the channels uised for control a~re recorded All channels re recorded Monitor Post-LOCA conrtainment conditions. Ensure that water is f lowing to the saf ety injection systemafter LOCA and determine when to 'shi~ftfromv injection to recirculation mode.Detect steam genertor tube rupture, mnonitor steam generatorsteam watelevel following a line break.tube rupture: monitor~steamn generator water _level followin~g a stem line 43 of 108 0 0 IP3 FSAR UPDATE 5. Steam Line 6. Pressurizer Water Flow Level Flow 3/Seam .1Stea.m 0-1400.psig line line 3 2 En~tire distance betweeni taps+/-5% of fu sc le Indicate that level is somiewh'ere between 0 and 100% of spqn+10% of spaq.All channes re.All 3tare indicated and one is for recor~ding All are indicated Mon itor steam line pressures following steam generator udbe rupture or steamn line br~eak.Indicate that water has returned to the pressurizer following cooldow'n after steam generator tube rupture steam line.realk.'Monitor recirculation flow.4 3" -1~000~GPM (1~) For the steam break, when the water level charnnel is exposed to a hostileenvironment, the accuracy requiredca~n berelaxed. The indication need only convey to the perator that water leeyl in the steam~ generator is soerewhere betw~een the narrow range*stam gen~erator water level taps. 6 __________ Miiu euieet. One Level Channel prSeam Generator (either Wide or Narrovw kange) wi at least Two WieRng C~hannels. Three requi~ird to alilow possibility of low head ~recirculation. None reqciure~d to allow high hedrcruain 44 of 108 IP3 FSAR UPDATE 7.3 REGULATING SYSTEMS 7.3.1 Design Basis The Reactor Control System is designed to limit nuclear plant transients for prescribed design load perturbations, under automatic control, within prescribed limits to preclude the possibility of a reactor trip in the course of these transients. Overall reactivity control is achieved by the combination of chemical shim and 53 control rod clusters of which 29 are in 4 control banks and 24 are in 4 shutdown banks. Long-term regulation of core reactivity is accomplished by adjusting the concentration of boric acid in the reactor coolant. Short-term reactivity control for power changes or reactor trip is accomplished by movement of control rod clusters.The primary function of the Reactor Control System is to provide automatic control of the rod clusters during power operation of the reactor. The system uses input signals including neutron flux; coolant temperature and pressure; and plant turbine load. The Chemical and Volume Control System (Chapter 9) serves as a secondary reactor control system by the addition and removal of varying amounts of boric acid solution.There is no provision for a direct continuous, visual display of primary coolant boron concentration. When the reactor is critical, the best indication of reactivity status in the core is the position of the control group in relation to plant power and average coolant temperature. There is a direct, predictable, and reproducible relationship between control rod position and power and it is this relationship which establishes the lower insertion limit calculated by the rod insertion limit monitor. There are two alarm setpoints to alert the operator to take corrective action in the event a control bank approaches or reaches its lower limit. Rod position is also a function of core life.Any unexpected change in the position of the control banks when under automatic control or a change in- coolant temperature when under manual control provides a direct and immediate indication of a change in the reactivity status of the reactor. In addition, periodic samples of coolant boron concentration are taken. The variation in concentration during core life provides a further check on the reactivity status of the reactor including core depletion. The Reactor Control System is designed to enable the reactor to follow load changes automatically when the plant output is above 15% of nominal power. Control rod positioning may be performed automatically when plant output is above this value, and manually at any time._Overriding the rod stop and turbine runback signals from the Overpower or Overtemperature AT circuitry, or from the Power Range Nuclear Instrument Dropped Rod circuitry has no impact on the prevention of automatic control rod withdrawal below 15% of nominal power. Overriding one channel of these signals has no impact on reactor protection in the event of an approach to an overpower condition in as much as the reactor trips associated with such a condition remains unaffected. Additionally, since only one channel at a time is permitted to be affected, the other three channels remain available for rod stop and turbine runback on either Overpower or Overtemperature AT, or on Power Range Nuclear Instrument Rod Drop signals.45 of 108 IP3 FSAR UPDATE The system enables the nuclear plant to accept the following transients without reactor trip subject to possible xenon limitations: a) Step load increases to 10% within the load range of 15% to 90% of full power b) Step load reduction of 10% within the load range of 100% to 25%of full power c) A 5% per minute ramp load change within the load range of 15% to 100% of full power.The operator is able to select any single bank of rods (shutdown or control) for manual operation. Using a single switch, he may not select more than one bank from these two functions. He may also select automatic reactor control, in which case, the control banks can be moved only in their normal sequence with some overlap as one bank reaches its full withdrawal position and the next bank begins to withdraw. Interlocks are provided to preclude simultaneous withdrawal of more than two banks of control rods or shutdown rods.The control system is capable of restoring coolant average temperature to within the programmed temperature deadband, following a scheduled or transient change in load.The reactor plant can be placed under automatic control in the power range between 15 percent of load and full load and will accept the following design transients while in automatic control: a) Step load increases of 10% within the load range of 15% to. 90% of full power (without turbine bypass)b) Step load reductions of 10% within the load range of 1.00% to 25% of full power (without turbine bypass)c) A 5% per minute ramp load change within the load range -15% to 100% of full power (without turbine bypass)m)inut1",( to0,0cange in load, at a maximum tu~rbine unloading, rate of 200% per mnut om appoximately 00% load with steam dump (load rejection capability depends on full power Thyg; see Se'ction 7. 3.2) withI turb~ine by~pass).A programmed pressurizer water level as a function of Tavg is provided to minimize the requirements of the Chemical and Volume Control and Waste Disposal Systems resulting from coolant density changes during loading and unloading from full power to zero power.Following a reactor and turbine trip, sensible heat stored in the reactor coolant is removed without actuation of steam generator safety valves by means of controlled steam bypass to the condenser and by injection of feedwater to the steam generators. Reactor Coolant System temperature is reduced to the no load condition. This no load coolant temperature is maintained by steam bypass to the condensers to remove residual heat.The control system is designed to operate as a stable system over the full range of automatic control throughout core life without requiring operator adjustment of set points other than normal calibration procedures.

7.3.2 System

Desiqn 46 of 108 'P3 FSAR UPDATE A block diagram of the Reactor Control System is shown in Figure. 7.3-1.Rod Control There are 53 total RCC assemblies. The assemblies are grouped. into (1) 4 shutdown banks having rod clusters of 8, 8, 4, 4, rod clusters and (2), 4 control banks 8, 4, 8 and 9 rod clusters.Figure 3.2-1 shows the location of the RCC assemblies in the core. The four control banks are the only rods that can be manipulated under automatic control. The banks are divided into groups to obtain smaller incremental reactivity changes. All RCC assemblies in a group are electrically paralleled to step simultaneously. Position indication foe each RCC assembly type is the same.Control Group Rod Control The Reactor Control System is capable of restoring programmed average temperature following a scheduled or transient change in load. The coolant average temperature is programmed to increase linearly from zero power to the full power conditions. The control system will also compensate initially for reactivity changes caused by fuel depletion and/or xenon transients. Final compensation for these two effects is periodically made with adjustments of boron concentration. The control system then readjusts the control rods in response to changes in coolant average temperature resulting from changes in boron concentration. The coolant average temperatures are measured from the hot leg and the cold leg in each reactor coolant loop. The average of the four measured average temperatures is the main control signal. This signal is sent to the control rod programmer through a proportional plus rate compensation unit. The control rod programmer commands the direction and speed of control rod motion. A compensated pressurizer pressure signal, and a power-load mismatch signal are also employed as control signals to improve the plant performance. The power-load mismatch channel takes the difference between nuclear power (average of all four power range channels)and a signal of turbine load (first stage (inlet)' turbine pressure), and -passes it through a high-pass filter such that only a rapid change in flux or power causes rod motion. The pressure compensation and the power-load mismatch compensation serve to speed up system response and to reduce transient peaks.The control bank rods are divided into four banks comprising 8, 4, 8 and 9 RCC assemblies respectively, to follow load changes over the full range of power operation. Each control rod bank is driven by a sequencing, variable speed rod drive control unit. The assemblies in each control bank are divided into two groups. The groups are moved sequentially one step at a time. The sequence of motion is reversible, that is, a withdrawal sequence is the reverse of the insertion sequence. The variable speed sequential rod control affords the ability- to insert a small amount of reactivity at low speed to accomplish fine control of reactor coolant average temperature about a small temperature deadband. Any reactor trip signal causes the rods to drop by gravity into the core.Manual control is provided to manually move a control bank in or out at a preselected fixed speed.47 of 108 IP3 FSAR UPDATE Proper sequencing of the RCC assemblies is assured: first, by fixed programming equipment in the Rod Control System, and second, through administrative control of the reactor plant operator. Startup of the plant is accomplished by first manually withdrawing the shutdown rod banks to the full out position. This action requires that the operator select the SHUTDOWN BANK position on a control board mounted selector switch and then position the IN-HOLD-OUT level (which is spring return to the HOLD position) to the OUT position.RCC assemblies are then withdrawn under manual control of the operator by first selecting the MANUAL position on the control board mounted selector switch and then positioning the IN-HOLD-OUT LEVER to the OUT position. In the MANUAL selector switch position, the rods are withdrawn (or inserted) in a predetermined programmed sequence by the automatic programming equipment. When the reactor power reaches approximately 15% of rated -power, the operator may select the AUTOMATIC position, where the IN-HOLD-OUT lever is taken out of service,, and rod motion is controlled by the Reactor Control and Protection Systems. A permissive interlock limits automatic control to reactor power levels above 15%. In the AUTOMATIC position, the rods are again withdrawn (or inserted) in a programmed sequence by the automatic programming equipment. Programming is set so that as the first bank out (control bank A) reaches a preset position, the second bank out (control bank B) begins to move out simultaneously with first bank. When control bank A reaches the top of the core, it stops, and control bank B continues until it reaches a preset position near the top of the core where control bank C motion beings, etc. The withdrawal sequence continues until the plant reaches the desired power level. The programmed insertion sequence is the opposite of the withdrawal sequence, i.e., the last control bank out is the first control bank in.With the simplicity of the rod program, the minimal amount of operator selection, and two separate direct position indications available to the operator, there is very little possibility that rearrangement of the control rod sequencing could be made.Shutdown Rod Control The shutdown rods together with the control rods are capable of shutting the reactor down.They are used in conjunction with the adjustment of chemical shim to provide shutdown margin of at least one percent following reactor trip with the most reactive control rod in the fully withdrawn position for all normal operating conditions. The shutdown banks are manually controlled during normal operation and are moved at a constant speed with staggered stepping of the groups within the banks. Any reactor trip signal causes them to drop by gravity into the core. They are fully withdrawn during power operation and are withdrawn first during startup.Criticality is always approached with the control rods after withdrawal of the shutdown banks.Four shutdown banks with a total of 24 clusters are provided.Interlocks The rod control group is used for automatic control and is interlocked with measurements of turbine-generator load to prevent automatic control rod withdrawal below 15% of nominal power.The manual and automatic controls are further interlocked with measurements of neutron flux, eT and rod drop indication to prevent approach to an overpower condition. 48 of 108 IP3 FSAR UPDATE Rod Drive Performance The control banks are driven by a sequencing, variable speed rod drive programmer. In each control bank of RCC assemblies, two groups (each containing a small number of RCC assemblies) are moved sequentially in a cycle such that both groups are maintained within one step of each other.The sequence of motion is reversible, that is, withdrawal sequence is the reverse of the insertion sequence. The sequencing speed is proportional to the control signal from the Reactor Control System. This provides control group speed control proportional to the demand signal from the control system.The output of two paralleled motor generator (M-G) sets provides power to the rod drive mechanism coils through a solid state control system. Two reactor trip breakers are placed in series with the output of the M-G sets. To permit on-line testing, a bypass breaker is provided across each of the two breakers.RCCA Position Indication Two separate systems are provided to sense and display control rod position as described below: a) Analog System -An analog signal is produced for each individual rod by a linear position transmitter. An electrical coil stack is located above the stepping mechanisms of the control rod magnetic jacks, external to the pressure housing, but concentric with the rod travel.When the associated control rod is at the bottom of the core, the magnetic coupling between the primary and secondary coil winding of the detector is small and there is a small voltage induced in the secondary. As the control rod is raised by the magnetic jacks, the relatively high permeability of the lift rod causes an increase in magnetic coupling. Thus, an analog signal proportional to rod position is obtained.Direct, continuous readout of every control rod is presented to the operator on individual indicators. A deviation monitor alarm is actuated if an individual rod position deviates from its relative bank position by a preselected distance.Lights are provided for rod bottom positions for each rod. The lights are operated by bistable devices in the analog system.b) Digital System -The digital system counts pulses generated in the rod drive control system. One counter is associated with each group of control and shutdown rods.Readouts of the digital system are in the form of electromechanical. add-subtract counters reading the number of steps of rod movement with one display for each group. These readouts are mounted on the control panel.The digital and analog systems are separate systems; each serves as backup for the other.Operating procedures require the reactor operator to compare the digital and analog readings upon recognition of any apparent malfunction. Therefore, a single failure in rod position 49 of 108 IP3 FSAR UPDATE indication does not in itself lead the operator to take erroneous action in the operation of the reactor.Full Length Rod Drive Power Supply The full length control rod drive power supply concept, using a single trip bus system, has been successfully employed on all Westinghouse PWR Plants. Potential fault conditions with a single trip bus system are discussed in this section. The unique characteristics of the latch type mechanisms with its relatively large power requirements makes this system with the redundant series trip breakers particularly desirable. The solid state rod control system is operated from two parallel connected 438 kVA generators which provide 260 volt line to line, three phase, four wire power to the rod control circuits through two series connected reactor trip breakers.This AC power is distributed from the trip breakers to a line-up of identical solid state power cabinets and a DC holding cabinet using a single overhead run of enclosed bus duct which is bolted to and therefore comprises part of the power cabinet arrangement. Alternating current from the motor-generator sets is converted to a pulsed direct current by the power cabinet and is then distributed to the mechanism coils. Each complete rod control system includes a single 125/70 volt DC power supply which is used for holding the mechanisms in position during maintenance of normal power supply.This 125/70 volt supply, which receives its input from the AC power source downstream of the reactor trip breakers, is distributed to each power cabinet and permits holding mechanisms in groups of four by manually positioning switches located in the power cabinets. The 70/40 ampere output capacity limits the holding capability to eight rods.Reactor Trip Current to the mechanisms is interrupted by opening either of the reactor trip breakers. The 125/70 volt DC maintenance supply will also be interrupted since this supply receives its input power through the reactor trip breakers.Trip Breaker Arrangement The trip breakers are arranged in the reactor trip switchgear in individual metal enclosed compartments. The 1000 ampere bus work, making up the connections between trip breakers are separated by metal barriers to prevent the possibility that any conducting objects could short circuit, or bypass, trip breaker contacts.Maintenance Holding Supply The 125/70 volts DC holding supply and associated switches have been provided to avoid the need for bringing a separate DC power source to the rod control system during maintenance on the power cabinet circuits. This source is adequate for holding a maximum of five mechanisms and satisfies all maintenance holding requirements. Control System Construction S 50 of 108 IP3 FSAR UPDATE The rod control system equipment is assembled in enclosed steel cabinets. Three phase power is distributed to the equipment through a steel enclosed bus duct, bolted to the cabinets. DC power connections to the individual mechanisms are routed to the reactor head from the solid state cabinets through insulated cables, enclosed junction boxes, enclosed reactor containment penetrations, and sealed connectors. In view of this type of construction, an accidental connection of either an AC or DC power source, either internal or external to the cabinets, is not considered credible.AC Power Connections The three phase four wire supply voltage required to energize the equipment is 260 volts line to line, 58.2 Hz, 438 kVA capacity, zig-zag connected. It is unlikely that any power supply, and in particular one as unusual as this four wire power source could be accidentally connected, in phase, in the required configuration. Also it should be noted that this requires multiple connections, not single connections. The closest outside sources available in the plants are 480 volt auxiliary power source and 208 volt lighting source.Connections of either a 480 or 208 volt, 60 Hz source to. the single AC bus supplying the rod control system causes currents to flow between the sources due to an out of phase condition. These currents flow until the generator accelerates to a speed synchronous with the 60 Hz outside source, a time sufficient to trip the generator breakers. The out-of-phase currents for an unlimited capacity outside source, an outside source with a capacity equivalent to the normal generator kVA, and for either one or two M-G sets in service are tabulated below: Out of Phase Currents (Amperes)One M-G Set Two M-G Sets in Service In Service 480 volts Unlimited Capacity 25,000 50,000 438 kVA Capacity 12,000 25,000 208 volts Unlimited Capacity 16,000 32,000 438 kVA Capacity 8,000 16,000 All of the foregoing currents are sufficiently high to trip out the generator breakers on either overcurrent or reverse current. This trip-out is detectable by annunciation in the Control Room.If the outside power source trips, the connection is of no concern.Each solid state power cabinet is tied to the main AC bus through three fused disconnect switches; one for the stationary gripper coil circuits, one for the movable, gripper coil circuits, and one for the lift coil circuits. Reference voltage to operate the control circuits for all three coil circuits must be in phase with the supply to all coil circuits for .proper operation of the system. If the outside power source were brought into an individual cabinet, nine (9) normal source connections would have to be disconnected and the outside source would have to be tied in phase to the proper nine (9) points plus one (1) neutral point to allow movement of the rods.This is not considered credible.51 of 108 IP3 FSAR UPDATE Connection of a single phase AC source (i.e., one line to neutral) is also considered improbable. This would again require a high capacity source which would have to be connected in-phase with the non-synchronous M-G set supply. Again, more than one connection is needed to achieve this condition. Each power cabinet contains three alarm circuits (stationary, movable and lift) that would annunciate the condition to the operator. In addition, calculations show that a single phase source of 208 volts, 260 volts, or 480 volts will not supply enough current to hold the rods. Therefore, a jumper across two trip circuit breaker contacts in series which results in a single phase. remaining closed would not provide sufficient current to hold up the rods.The normal source generators are connected in a zig-zag winding configuration to eliminate the effects of direct current saturation of the machines resulting from the direct currents that flow in the half wave bridge rectifier circuits. If this connection were not used, the generator core would saturate and loss of generating action would occur. This condition would also occur in a transformer. An outside source not having the zig-zag configuration would have to have a large capacity (400 kVA) to avoid the loss of transformer action from saturation. Most of the components in the equipment are applied with a 100% safety factor. Therefore, the possibility exists that the system will operate at 480 volts with a source of sufficient capacity.The system will definitely operate at 208 volts with a source of sufficient capacity.The connection of an outside source of AC power to one rod control system would first require a need for this source. No such need exists since two power sources (M-G sets) are already provided to supply the system. If the source were connected in spite of the need, extreme measures would have to be taken by the intruder to complete the connection. The outside source would have to be a large capacity (400 kVA) one. The currents that flow would require the routing of large conductors or bus bars, not the usual clip leads. Then the disassembly of switchgear or enclosed bus duct would be required to expose the single AC bus. Large bolted cable or bus bar terminations would have to be completed. A total of four conductors would have to be connected in phase with a non-synchronous source. To expect that a connection could be completed with the equipment either energized or de-energized in view of the obstacles which would prevent such a connection is incredible. However, even if the connection were completed, the outside source connection would be detectable by the operator through the tripping of the generator breakers.DC Power Connections An external DC source could, if connected inside the power cabinet, hold the rods in position.This would require a minimum supply voltage of 50 volts. Since the holding current for each mechanism coil is 4 amperes, the DC current capacity would have to be approximately 180 amperes to hold all rods. Achieving this situation would require several acts -bringing in a power source which is not required for any type of operation in the rod control system, preferentially connecting it into the system at the correct points, and actuating specific holding switches so as to interconnect all rods. Closure of twelve switches in four separate cabinets would be required to hold all rods. One switch could hold as many as four rods.The application of a DC voltage to an individual rod external to the power cabinet would affect only a single rod connection with other rods in the group being prevented by the blocking diodes in the power circuits.52 of 108 IP3 FSAR UPDATE Should an external DC source be connected to the system, the system is. provided with features to permit its detection. Each solid state power cabinet contains circuitry which compares the actual currents in the stationary and movable gripper coils with the reference signals from the step sequencing unit (slave cycler). In taking a single step, the current to the stationary gripper coil will be profiled from the holding value to the maximum, to zero and return to holding level. Correspondingly, the movable gripper coil must change from zero to maximum and return to zero. The presence of an external DC source on either the stationary or movable would prevent the related currents from returning to zero.This situation would be instantaneously annunciated by way of the comparison circuit.Therefore, any rod motion would actuate an alarm indicating the presence of an external DC source. In addition, an external DC source would prevent rods from stepping. Thus, an external source could be detected by the rod position indication system indicating failure of the rod(s) to move,.Connection of an external DC power source to the output lines of the 125/70 volt DC -power supply can be detected by opening the three phase primary input of the supply and checking the output indication lights.Evaluation Summary In view of the preceding discussion, the postulated connection of an external power source (either AC or DC) or occurrence of short circuits that could prevent dropping of the rods is not considered credible.Specifically: a) The need for an outside power source has been eliminated by incorporating built-in holding sources as part of the rod control system and by providing two M-G sets.b) The equipment is contained within enclosed steel cabinets precluding the possibility of an accidental connection of either AC or DC power in the cabinets.c) AC power distribution is accomplished using steel enclosed bus duct. The high capacity (438 kVA) AC power source is unique and not readily available. Multiple connections are required.d) DC power is distributed to the individual mechanisms through insulated cables and enclosed, electrical connections precluding the accidental connection of an outside DC source external to the cabinets. The high capacity DC source required to hold rods is not readily available in the rod control system, would require multiple connections, and would require deliberate positioning of switches within the enclosed cabinets.e) Provisions are made in the system to permit detection of an external DC source which could preclude a rod release.The total capacity of the system including the overload capability of each motorgenerator set is such that single set out of service does not cause limitations in rod motion during normal plant 53 of 108 IP3 FSAR UPDATE operation. In order to minimize reactor trip as a result of a unit malfunction, the power system is normally operated with both units in service.Turbine Bypass A turbine bypass system is provided to accommodate a reactor trip with turbine trip and in conjunction wihatmaiectrcnrl anacco~mmodate a load ~recto witout reactor turbine trip. -The maximum load rejection that can be accommodated without reactor vand turbine trip depends on the fulm load avg t A maximum of a 1op load rejection can be acotmmrodated for theminimual acoeptabtefull load (Tavg T f)550.6Fn .As the ful vload Tavg i secondFb large tejections a he accommodate.l Fori fll lad Tank vas reqieof 565'F or higher, load rejections of 5 abcan be accommodated. pThe trbineebyass t syinae removw steamtoreducethe transient imi upo the reactor clooant systemsso thratthe codtrol rood c~an reduce the reactor power to a jnew equilibrium value without allowijng 6oeriemiperature, overpressure condump idtcrea Reacsorti onllant Svystem The steam dump is actuated by an electrical load decrease rate greater than a preset value.This signal supplies air to the dump valves, which then allows them to open and close according to the temperature error signal, a compensated (Tdvgp Tre) signal. The dump valves modulate open proportionally to this temperature error signal with a stroke time of approximately 20 seconds. For large temperature errors the valves will trip open in two banks as required for fast response with a stroke time of about three seconds. Upon reduction of the error signal below the trip-open setpoints, the respective valve groups return to modulating control.The steam dump decreases proportionally as the control rods act to reduce the coolant average temperature. The artificial load is therefore removed as the coolant average temperature is restored to its programmed value. When steam dump is no longer required, the air supply to the valves may be manually removed.Since the steam dump valves exhaust into the condenser, all steam dump is blocked when the condenser in unavailable. The turbine bypass steam system is described in Section 10.2. The bypass flows to the main condenser. Feedwater Control Each steam generator is equipped with two three element feedwater control systems (one for the main regulator valve and the second for the low flow regulator valve) which maintain a programmed water level as a function of load on the secondary side of steam generator. The three element feedwater control system continuously compares actual feedwater flow with steam flow compensated by steam pressure with a water level set point to regulate the feedwater valve opening. The individual steam generators are operated in parallel, both on the feedwater and on the. steam side.Continued delivery of feedwater to the steam generator is required as a sink for the heat stored and generated in the, coolant following a reactor trip and turbine trip. A reactor trip signal provides an override signal to the feedwater control system. After a trip, all feedwater valves open fully thereby insuring the full supply of feedwater following a reactor trip and turbine trip.Another override signal then closes the feedwater valves when the coolant average temperature 0 54 of 108 IP3 FSAR UPDATE falls below a preset temperature value or when the respective steam generator level rises to a preset value. Manual override of the feedwater control systems is also provided.Pressure Control The reactor coolant system pressure is maintained at constant value by using heaters in the water region and spray in the steam region of the pressurizer. Electrical immersion heaters are located near the bottom of the pressurizer. A portion of the heater groups are proportional heaters and are used for small pressure variation control and to compensate for heat losses and the smaller continuous spray. Up to three sets of backup heaters may be turned on manually and operated continuously. The remaining (backup) heaters are turned on either when the pressurizer pressure controller signal is below a preset value or when the pressurizer level exceeds the programmed level setpoint by a preset amount.The spray valves for the pressurizer are located near their respective RCS cold legs, and the spray nozzle is located at the top of the pressurizer. Spray is initiated when the pressure controller signal is above a preset set point. Spray rate increases proportionally with increasing pressure until it reaches the maximum spray capacity.Steam condensed by spray reduces the pressurizer pressure. A small continuous spray is normally maintained to reduce thermal stress and thermal shock when the spray valves open and help maintain uniform water chemistry and temperature in the pressurizer. Two power operated relief valves (PORVs), PCV-455C and PCV-456, prevent the RCS pressure from exceeding the Technical Specifications limits of 10 CFR 50 Appendix "G" during low temperature, low pressure and water solid modes of operation. The PORVs are armed below a preset temperature of 319'F, and will open at a programmed pressure which is set to prevent exceeding the Appendix "G" curves. The two PORVs are supplied with nitrogen. The instrument N 2 system for the PORVs is tapped from the N 2 supply line to the four safeguards accumulators. The accumulators are sized to provide for 200 valve operating cycles. The actual take-off point for this N 2 system is downstream of the pressure regulator valve NNE-863.The PORV accumulators individually hold 6 cu ft of N 2 at a minimum pressure of 550 psig.During low temperature shutdown operations, the Overpressure Protection System requires an N 2 supply of sufficient capacity which, in case of loss of main N 2 supply, can support the number of PORV cycles resulting from an overpressure event of 10 minute duration. This N 2 supply is provided by one Safety Injection Accumulator having its associated N 2 fill valve blocked open.One PORV is operated on the pressurizer pressure controller signal, the other one is operated on the actual pressure signal. A separate interlock is provided for each so that if a second pressure channel indicates abnormally low, are the time the relief valve operation is called for by the other channel, the valve activation is blocked. The logic for each is thus basically two out of two. However, during normal operation at normal pressure, the interlock is not actuated and only the operating signals are required to actuate the valve. The interlock is set above normal operating pressure to prevent spurious operation. Three spring-loaded safety valves limit system pressure to 2750 psia following a complete loss of load without direct reactor trip or actuation of turbine bypass.Reactor coolant flow to the residual heat removal loop is from the hot leg_of Loop 2 through two motor operated valves (No. 731 and 730). Valves 731 and 730 are pressure interlocked to prevent opening should reactor coolant pressure go above 450 psig. This arrangement 55 of 108 IP3 FSAR UPDATE prevents, inadvertent pressurization of the residual heat removal loop when the Reactor Coolant System is above 450 psig. These valves will be opened when RCS pressure is lower than 450 psig. Valve position indication lights and position selector switches for both valves are provided in the control room. These valves are closed during power operation to preclude RHRS over-pressurization. To open the valve, the switch is held over to the Open position and if RCS pressure is less than 450 psig, the valve will open. If these valves are open and RCS pressure increases to 550 psig, they will auto-close. A narrow range pressure recorder with an operator controlled alarm point, which actuates warning lights and audible device, has been added to instrument loop for PT-402. This is designed to attract the operators attention to a potential overpressure transient in progress, to allow him to take necessary action to minimize the magnitude of overpressure event while the RCS is operating at low pressure. The system is not required for safe shutdown of the reactor, .and the operator may deactivate the recorder and.alarms, which removes the potential for distracting alarms when a normal RCS pressure.To prevent inadvertent isolation of the RHR loop when the Reactor Coolant System is below 2Q0 degrees, depressurized, and vented to an equivalent opening of greater than two (2) square inches AC-MOV-730 and 731 may be de-energized open.These valves are also interlocked with containment sump valves 885A and B. To open valves 885A and B, the RHR suction valves 730 and 731, respectively, must be closed. This prevents the reactor coolant water from being drained to the contained sump. High Head SI Suction Valves 888A and B are also interlocked with valves 730 and 731, respectively. A valve 884A and B will not open if 730 and 731, respectively, are opened.SI-MOV-883 is interlocked with AC-MOV-730 and AC-MOV-731 so that the valve can only be opened if both MOV-730 and MOV-731 are fully closed. If valve SI-MOV-883 is open and valve AC-MOV-730 or AC-MOV-731 leave their closed limit seats, valve SI-MOV-883 will auto-close. The interlock prevents inadvertent opening of valve SI-MOV-883 during cool down and subsequent diversion of reactor coolant to the RWST or over pressurization of a lower pressure SI piping system.Valves AC-MOV-730 and -731 may be de-energized during cold shutdown if the RCS is depressurized and vented through a minimum equivalent opening of two (2) square inches. De-energizing these valves while the RHR pumps are in service prevents inadvertent isolation of the RHR pump suction supply, which could potentially cause pump failure. De-energizing these valves will also cause a loss of all of the interlock protection associated with AC-MOV-730 and -731. When AC-MOV-730 and -731 are de-energized, administrative controls are established to replace the protective functions of these interlocks. These administrative controls prevent unanticipated communication of reactor coolant with the containment sump and the RWST.These controls also prevent overpressurization of the RHR and SI system piping and components.

7.3.3 System

Design Evaluation Plant Stability The control system is designed to maintain a stable reactor coolant average temperature within acceptable limits. Continuous oscillation at a low frequency and small amplitude is expected.Proper adjustment of the control loop static and dynamic gains (with respect to the process response) can reduce this oscillation almost to zero and will also avoid instability induced by the control system itself. Because stability is more difficult to maintain at low power under 56 of 108 IP3 FSAR UPDATE automatic control, no provision is made to provide automatic control below 15 percent of full power.The control system is designed to operate as a stable system over the full range of automatic control throughout core life.Step Load Changes Without Turbine Bypass A typical reactor power automatic control requirement is to restore equilibrium conditions without a plant trip, following 10 percent step load demand increases within the range of 15 to 90 percent of full power and 10% step load demand reductions within the range of 100% to 25% of full power. The design was necessarily based on conservative conditions and a greater transient capability is expected for actual operating conditions. A load demand greater than full power is inhibited by the turbine control load limit devices in response to input from the Reactor Protection System. Although turbine bypass is provided for added control after large load decreases, it will not be necessary during the 10% load changes.The function of the control system is to minimize the reactor coolant average temperature deviation during the transient within an acceptable value and to restore average temperature to the programmed set point within an acceptable time. Excessive pressurizer pressure variations are prevented by using spray and heaters in the pressurizer. The margin to over-temperature AT reactor trip is of primary concern for the step load changes.This margin is influenced by nuclear flux, pressurizer pressure, and reactor coolant average temperature and temperature rise across the core.Ramp Loading and Unloading Ramp loading and unloading is provided over the 15 to 100 percent power range under automatic control. The function of the control system is to maintain the coolant average temperature and the secondary steam pressure as functions of turbine-generator load within acceptable deviation from the programmed values. The minimum control rod speed provides a sufficient reactivity rate to compensate the. reactivity changes resulting from the moderator temperature coefficient and the power coefficient. The coolant average temperature is increasing during loading and there is a continuous in-surge to the pressurizer resulting from coolant expansion. The sprays limit the resulting pressure increase. Conversely, as the coolant average temperature is decreasing during unloading, there is a continuous out-surge from the pressurizer resulting from coolant contraction. The heaters limit the resulting system pressure decrease. The pressurizer level is programmed such that the water level has an acceptable margin above the low level heater cutout set point during the loading and unloading transients. The primary concern for the loading is to limit the overshoot in coolant average temperature to provide sufficient margin to the over-temperature AT trip.The automatic load controls are designed to safely adjust the unit generation to match load requirements within the limits of the unit capability and licensed rating.Loss of Load With Turbine Bypass 57 of 108 IP3 FSAR UPDATE The Reactor Control System is designed to accept a 10% to 50/ (depending on full power Tavg; see Section 7.3.2') lo~ssof load accomplished as a turbine runback at a maximum rate of 200% per minute without requiring arecortrip. The automatic turbine bypass system is able to accommodate this abnormal load rejection by reducing the thermal transient imposed upon the reactor coolant system. The reactor power is reduced at a rate consistent with the capability of the rod control system. The reducing of the reactor power is automatic down to 15 percent of full power. Manual control is used when the power is below this value. The steam bypass is removed as fast as the control rods are capable of inserting negative reactivity. The pressurizer relief valves might be actuated for the most adverse conditions, e.g., the most negative Doppler coefficient, and the minimum incremental rod worth. The relief capacity of the power operated relief valves is sized large enough limit the system pressure to prevent actuation of high pressure reactor trip for the most adverse conditions. Turbine-Generator Trip With Reactor Trip Turbine-generator unit trip is accompanied by reactor trip. With a secondary system design pressure of 1100 psia, the plant is operated with a programmed average temperature as a function of load, with the full load average temperature significantly greater than the saturation temperature corresponding to the steam generator safety valve set point. This, together with the fact that the thermal capacity in the Reactor Coolant System is greater than that of the secondary system, requires a heat sink to remove heat stored in the reactor coolant to prevent actuation of steam generator safety valves for turbine and reactor trip from full power.This heat sink is provided by the combination of controlled release of steam to the condenser and by makeup of cold feedwater to the steam generators. The turbine bypass system is controlled from the reactor coolant average temperature signal whose reference set point is reset upon trip to the no load value. Turbine bypass actuation must be rapid to prevent steam generator safety valve actuation. With the bypass valves open the coolant average temperature starts to reduce quickly to the no load set point. The automatic control of reactor coolant average temperature acts to proportionally close the valves and thus minimize the total amount of steam bypassed.Following turbine trip, the steam voids in the steam generators will collapse and the fully opened feedwater valves will provide sufficient. feedwater flow to restore water level in the downcomer. The feedwater flow is cut off if the reactor coolant average temperature decreases below a preset temperature value or if the steam generator water level reaches a preset high set point.Additional feedwater makeup may then be controlled manually to restore and maintain steam generator-level while maintaining the reactor coolant at the no load 'temperature. Long term residual heat removal is maintained by the steam generator pressure controller (manually selected) which controls the steam pressure (and thus, indirectly, the temperature) by adjusting the amount of turbine bypass to the condensers. The controller operates the same bypass valves to the, condensers which are controlled by coolant average temperature during the initial transient following turbine and reactor trip.The pressurizer pressure and water level fall very fast during the transient resulting from the coolant contraction. If heaters become uncovered following the trip, the Chemical and Volume Control System.will provide full charging flow to restore water level in the pressurizer. Heaters are then turned on to heat up pressurizer water and restore pressurizer pressure to normal.58 of 108 IP3 FSAR UPDATE The turbine bypass and feedwater control systems are designed to prevent the coolant average temperature falling below the programmed no load temperature following the trip to ensure adequate reactivity shutdown margin.59 of 108 IP3 FSAR UPDATE 7.4 EXCORE NUCLEAR INSTRUMENTATION

7.4.1 Design

Bases The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the basis for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.The Authority has completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission ýNRC) in.10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.Fission Process Monitors and Controls Criterion' Means shall be provided for monitoring or otherwise measuring and maintaining control over the fission process throughout core life under all conditions that can reasonably be anticipated to cause variations in reactivity of the core. (GDC 13 of 7/11/67).The excore Nuclear Instrumentation System is provided to monitor reactor power from source range, through intermediate range and power range, up to 120 percent of full power. The system provides indication, control and alarm signals for reactor operation and protection. Additionally, per Regulatory Guide 1.97 requirements, an Excore Neutron Flux Monitoring System (NFMS) (see Plant Drawig9321-LL-65531ForrIrly Figure 7.4-4) consisting of two detectors has been installed to provide reactor power indication from source range through power range. The Regulatory Guide 1.97 excore Neutron Flux Monitoring System provides local indication elsewhere in the plant, in addition to indication only provided to the control room via QSPDS and CFMS. These other indication locations are in the upper electrical tunnel and at the charging station in the PAB for use during shutdown from outside the control room.The operational status of the reactor is monitored from the Control Room. When the reactor is subcritical (i.e., during cold or hot shutdown, refueling and approach to criticality) the relative reactivity 'status (neutron source multiplication) is continuously monitored and indicated by proportional counter detectors located in instrument wells in the primary shield adjacent to the reactor vessel. Two source range detector channels are provided for supplying information on multiplication while the reactor is subcritical. A reactor trip is actuated from either channel if the neutron flux level becomes excessive. This system is checked prior to operations in which criticality may be approached. This is accomplished by the use of an incore source to provide a meaningful count rate even at the refueling shutdown condition. Any appreciable increase in the neutron source multiplication is slow enough to give ample time to start corrective action (boron dilution stop and/or emergency. boron injection) to prevent the core from becoming critical When the reactor is critical, means for showing the relative reactivity status of the reactor are:* 1) Rod Position 2) Source, Intermediate and Power Range Detector Signals 60 of 108 IP3 FSAR UPDATE 3) Qualified Safety Parameters Display System (QSPDS)4) Boron Concentration

5) Hot Leg Temperatures The position of the control banks is directly related to the reactivity status of the reactor when at power, and any unexpected change in the position of the control banks under automatic control or change in the hot leg coolant temperature under either manual or automatic control provides a direct and immediate indication of a change in the reactivity status of the reactor. Periodic samples of the coolant boron concentration are taken. The variation in concentration during core life provides a further check on the reactivity status of the reactor including core depletion.

High nuclear flux protection is provided both in the power and intermediate ranges by reactor trips, actuated from either range, if the neutron flux level exceeds trip set-points. When the reactor is critical, the best indication of the reactivity status in the core (in relation to the power level and average coolant temperature) are the control room display of the rod control group position and the boron concentration in the coolant.7.4.2 System Design Nuclear Instrumentation System (NIS)The three instrumentation ranges of the Nuclear Instrumentation System (NIS) overlap so that continuous readings are available during transition from one range to another. The sensitivities of the neutron detectors are illustrated on Figure 7.4-1. The Nuclear Instrumentation System diagram is shown on Figure 7.4-2.Detectors The excore system consists of twelve independent detectors in six instrument wells located around the reactor, as shown in Figure 7.4-3. The six assemblies provide the following instrumentation:

1. Power Range This range consists of four independent, long, uncompensated ionization chamber assemblies.

Each assembly is made up of two sensitive lengths. One sensitive length covers the upper half of the core, and the other length covers the lower half of the core.In effect the arrangement provides a total of eight separate ionization chambers approximately one-half the core height. The eight uncompensated (guard-ring) ionization chambers sense thermal neutrons in the range from 5.0 x 102 to 1.0 x 1011 neutrons per sq cm per sec.Each chamber initially had a nominal sensitivity of 3.1 x 10-13 amperes per neutron per sq cm (see Figure 7.4-1). The four long ionization chamber assemblies are located in vertical instrument wells adjacent to the four "corners" of the core. The 61 of 108 IP3 FSAR UPDATE assembly is manually positioned in the assembly holders and is electrically isolated from the holder by means of insulated standoff rings.Due to redesign of the Nuclear Core (low leakage core design) and resultant decrease in thermal neutrons at the detectors, new Power Range Moderators have been installed on the four (4) Power Range uncompensated ionization chambers.The Power Range Moderators increase the normal sensitivity of the chambers by approximately 700%.2. Startup Range (Intermediate and Source)There are two separate startup range assemblies. Each assembly contains one compensated ionization detector (intermediate range) and one proportional counter detector (source range).The source range neutron detectors are proportional counters with an initial nominal sensitivity of 10 counts per sec per neutron per sq cm per sec (see Figure 7*4-1).The detectors sense thermal neutrons in the range from 101 to 5. x 10 5 neutrons counts per second. The range of the source range channel is 100 to 106 counts per second.The Source Range detectors are positioned in detector assembly containers by means of a linear, high density moderator insulator. The detector and insulator units are packaged in a housing which is inserted into the detector wells. The detector assembly is electrically isolated from the detector well by means of insulated stand-off rings.The intermediate range neutron detectors are compensated ionization chambers that sense thermal neutrons in the range form 2.5 x 102 to 2.5 x 1010 neutrons per sq cm per sec and initially had a nominal sensitivity of 4 x 10-14 amperes per neutron per sq cm per second (see Figure 7.4-1). They produce a corresponding direct current of 1011 to 10-3 amp. These detectors are located in the same detector assemblies as the proportional counters for the source range channels.Other than the source range pre-amplifier, which is located in containment, the electronic components for each of the source, intermediate and power range channels for the NIS are contained in a draw-out-panel mounted in racks in the Control Room.Power Range Channel There are threesets of power range measurements. Each set utilizes four individual currents as follows: a) Four currents directly from the lower sections of the long ionization chambers b) Four currents directly from the upper sections c)- Four total currents of (a) and of (b), equivalent to the average of each section.For each of the four currents in (a) and (b), the current measurement is indicated directly by a microammeter, and isolated signals are available for control console indication and recording. An analog signal proportional to individual currents is transmitted through buffer amplifiers to the 62 of 108 IP3 FSAR UPDATE overtemperature AT channel and provides automatic reset of the trip point for these protection functions. The total current, equivalent to the average, is then applied through a linear amplifier to the bistable trip circuits. The amplifiers are equipped with gain and bias controls for adjustment to the actual output corresponding to 100 percent of rated reactor power.Each of the four amplifiers also provides amplified isolated signals to the main control board for indication and for use in the Reactor Control System. Each set of bistable trip outputs is operated as a two-out-of-four coincidence to initiate a reactor trip. Bistable trip outputs are provided at low and high power set points depending on the operating power. To provide more protection during startup operation the low range power bistable is used. This trip is manually blocked after a permissive condition is obtained by two of four power range channels. The high power trip bistable is always active.The overpower trip is set so that, with the maximum instrumentation and bistable set point error, the maximum reactor overpower condition will be limited to 118 percent. This limit is accomplished by the use of solid state instrumentation and long ionization chambers,* which permit an integration of the flux external to the core over the total length of the core, thereby reducing the influence of axial flux distribution changes due to control rod motion.The ion chamber current of each detector is measured by sensitive meters with an accuracy of 0.5 percent. A shunt assembly and switch in parallel with each meter allow selection of one of four meter ranges. The available ranges are 0-100, 0-500, 0-1,000 and 0-5,000 microamperes. The shunt assemblies are designed in such a manner that they will not disconnect the detector current to the summing assembly upon meter failure or during switching. An isolation amplifier provides an analog signal proportional to ion chamber current for recording, data logging and delta flux indication. A test calibration unit provides necessary swtiches and signals for checking and calibrating the power range channels.The linear amplifier accepts the output currents from each of the two chamber sections and derives a nuclear power signal proportional to the summed direct currents. This unit amplifies the currents and converts the normal current signal to a voltage signal suitable for operation of associated components such as bistables and isolation amplifiers. Multiple power supplies furnish necessary positive and negative voltages for the individual channels and detector power.Mounted on the front panel of each power range channel drawer are the ion chamber current meters, the shunt selector switches with appropriate positions, and the nuclear power indicator (0 to 120 percent of full power).The isolated nuclear power signals are available for recording by the nuclear instrumentation system recorder. An isolated nuclear power signal is available for recording overpower conditions up to 200% of full power.Alarm signals for dropped-rod-rod stop, overpower-rod stop, overpower (low and high range)-reactor trips, and channel tests are annunciated on the main control board. Control signals which are sent to -the reactor control and protection system include dropped-rod-rod stop, overpower-rod stop, overpower-reactor trip, and permissive circuit signals. These are described in Section 7.2 63 of 108 IP3 FSAR UPDATE Over-riding the turbine runback and rod stop signals from a Power Range Nuclear Instrument Dropped Rod circuit in a single channel, or over-riding any turbine runback signal alone has no impact on reactor safety.Intermediate Range Channels There are two intermediate range channels which utilize two compensated ionization chambers.. Direct current from the ion chambers is transmitted through triaxial cables to transistor logarithmic current amplifiers in the nuclear instrumentation equipment. The logarithmic amplifier derives a signal proportional to the logarithm of the current as received from the output of the compensated ion chamber. The output of the logarithmic amplifier provides an input to the level bistables for reactor protection purposes and source range cutoff.The bistable trip units are similar to those in the other ranges. The trip outputs can be manually blocked after receiving a permissive signal from the power range channels. On decreasing power, the intermediate range trips for reactor protection are automatically inserted when the power range permissive signal is not present.Low voltage power supplies contained in each drawer furnish the necessary positive and negative voltages for the channel electronic equipment. Two medium voltage power supplies, one in each channel, furnish compensating voltage to the two compensated ion chambers. The high voltage for the compensated ion chambers is supplied by separate power supplies also located in the intermediate range drawers.Neutron (log N) flux level indicators are mounted, one each, on the front panel of the intermediate range channel cabinet and on the control board. These indicators are calibrated in terms of ion chamber current (1011 to 10-3 amp).Isolated neutron flux level signals are available for recording and startup rate computation. The startup rate for each channel is indicated at the main control board in terms of decades per minute over the range of -0.5 to 5.0 DPM.Channel test, high flux level rod stop, and reactor trip signals are alarmed on the main control board annunciator. The latter signal is sent to the Reactor Protection System.Source Rancqe Channels There are two source range channels utilizing proportional counter detectors. Neutron flux, as measured in the primary shield area, produces current pluses in the detectors.. These preamplified pulses are applied to transistor amplifiers and discriminators located in the racks.Triaxial cable is used for all interconnections from the detector assemblies to the instrumentation in the racks. The preamplifiers are located inside the Reactor Containment. These channels indicate the source range neutron flux and startup rate. They provide high flux level reactor trip and alarm signals to the Reactor Control and Protection Systems. The reactor trip signal is manually blocked when a permissive signal from the intermediate range is available. These channels are also used at shutdown to provide audible alarms in the Reactor Containment and Control Room of any inadvertent increase in reactivity. An audible count rate signal is used during initial phases of startup and is audible in both the Reactor Containment and Control Room.S 64 of 108 IP3 FSAR UPDATE Amplifiers are used to obtain a high level signal prior to elimination of noise and gamma pulses by the discriminator. The discriminator output is shaped for use by the log integrator. The log integrator generates an analog signal proportional to the logarithm of the number of pulses per unit time as received from the output of the previous unit. This unit performs log integration of the pulse rate to determine the count rate, and a linear amplifier amplifies the log integrator output for indication, recording, control, and rate computation through isolation amplifiers. Each source range channel contains two bistable trip units. Both units trip on high flux level, but one is used during shutdown to alarm reactivity changes and the other provides overpower protection during shutdown and startup. The shutdown alarm unit is blocked manually prior to startup or can serve as a startup alarm. When the input to either unit below its set point, the bistable is in its normal position and assumes a "fully-on" status. When an input from the log amplifier reaches or exceeds the set point, the unit reverses its condition and goes "fully-off." The output of the reactor trip unit controls relays in the Reactor Protection System.Power supplies furnish the protective and negative voltages for the transistor circuits, the alarm lights, and the adjustable high voltage for the neutron detector.A test calibration unit can insert selected test or calibration signals into the preamplifier channel input or the log amplifier input. A set of precalibrated level signals are provided to perform channel tests and calibrations. An alarm is registered on the main control board annunciator whenever a channel is being tested or calibrated. A trip bypass switch is also provided to prevent a reactor trip during channel test under certain reactor conditions. The neutron detector high-voltage cutoff assembly receives a trip signal when a one-out-of-two matrix, controlled by intermediate range channel flux level bistables, and manual block condition are present. The cutoff assembly disconnects the voltage from the source range channel high voltage power supply to prevent operation of the proportional counter outside its design range.High voltage and reactor trip circuits are reactivated automatically when two of the intermediate range signals are below the permissive trip setting.Mounted on the front panel of the source range channel is a neutron flux level indicator calibrated in terms of count rate level (100 to 106 cps). Mounted on the control board is a neutron count rate level indicator (100 to 106 cps). Isolated neutron flux signals are available for recording by the Nuclear Instrumentation System recorder and for startup rate computation. The startup rate for each channel is indicted at the main control board in terms of decades per minute over the range of -0.5 to +5.0 DPM. The isolation network for these signals prevents any electrical malfuncton in the external circuitry from affecting the signal being supplied to the flux level bistables. The signals for the channel test, high neutron flux at shutdown, and source range reactor trip are alarmed on the main control board annunciator. Excore Neutron Flux Monitorinq System The Excore Neutron Flux Monitoring System consists of two redundant trains, each with a Wide range flux detector, locally mounted amplifier and processor, local indications and dedicated penetration feedthroughs and cabling (see 'PlantDrawing9321LL-96553 [[ormerlyFigyre 74-,4]),. Detector sensitivities are illustrated on Figure 7.4-1).65 of 108 IP3 FSAR UPDATE Each of the detectors are fission chambers consisting of two aluminum electrodes electroplated with uranium, insulators and fill gas all included in a titanium assembly. The detectors are located at the 90' and 270' instrument wells and replace the back-up source range detectors that were originally located there. (See Figure 7.4-3)The amplifiers and microprocessors are located outside the Containment Building in the electrical penetration area in local panels. Redundant trains are powered by redundant instrument bus power supplies. Through isolation devices the Excore Neutron Flux Monitoring System provides the 10 CFR 50, Appendix R, and Reg. Guide 1.97 required shutdown signal.Although both channels provide local and control room (via QSPDS & CFMS) indication, only the detector at the 270' location has the alternate electrical feed capability for Appendix R.The magnitude of the neutron flux in the reactor core is proportional to the fission power in the reactor. The number of neutron pulses per unit time from the detector is proportional to the magnitude of the neutron flux at the detector and since this magnitude is proportional to the neutron flux in the core, the detector pulse rate is therefore proportional to reactor power.The number of pulses from the detector is monitored and the mean square value of the variance signal from the detector is measured. This mean square value is proportional to the average rate of neutron pulses. The signal processor takes this signal and processes it into a measure of the logarithm of the countrate, the rate of change of countrate, the logarithm of reactor power and the rate of change of reactor power. It provides analog voltage outputs for each of these signals and also provides the isolated outputs as required.Auxiliary Equipment Comparator Channel The comparator channel compares the four nuclear power signals of the power range channels with one another. A local alarm on the channel is actuated when any two channels deviate from one another by a preset adjustable amount. During full power operation, the comparator serves to sense and annunciate channel failures and/or deviations. Dropped rod Protection As backup to the primary protection for the dropped RCC accident, i.e., the rod bottom signal, independent detection is provided by means of the out-of-core power range nuclear channels.The dropped-rod sensing unit contains a difference amplifier, which compares the instantaneous nuclear power signal with an adjustable power lag signal and responds with a trip signal to the bistable amplifier when the difference exceeds a preset adjustable amount. Above*a given power level, the signal blocks automatic rod withdrawal. and initiates protective action in the form of a turbine load cutback. No credit is taken in the dropped rod accident analysis for turbine runback.Audio Count Rate Channel The auto count rate channel provides audible source range information during refueling operations in both the Control Room and the Reactor Containment. In addition, this channel signal is fed to a scaler-timer assembly which produces a visual display of the count rate for an adjustable sampling period.66 of 108 IP3 FSAR UPDATE Recorders One large, two-pen strip chart recorder is mounted on the main control board for recording the complete range of the source and intermediate channels. It is also possible to record any two power range channels as linear signals. Variable chart speeds have been provided.Switching of inputs to the recorders does not cause any spurious signals that would initiate false alarms Or reactor trips.Two two-pen recorders are provided to record the flux level from each of the four nuclear power range quadrants. Power Supply The Nuclear Instrumentation System is powered by four 120 volts AC independent vital bus circuits. (See Chapter 8)7.4.3 System Evaluation Loss of Power The nuclear instrumentation draws its primary power from vital instrument buses discussed in Chapter 8.Loss of nuclear instrumentation power would result in the initiation of all reactor trips associated with the channel power failure. In addition, all trips which were blocked prior to loss would be unblocked and initiated. Reliability and Redundancy The requirements established for the reactor protective system apply to the nuclear instrumentation. All channel functions are independent of every other channel.Safety Factor The relations of the power range channels to the Reactor Protective System has been described in Section 7.2. To maintain the desired accuracy in trip action, the total error from drift in the power range channels is held to +/-1 percent of full power. Routine tests and recalibration ensure that this degree of deviation is not exceeded. Bistable trip set points of the power range channels are also held to an accuracy of +/-1 percent of full power. The accuracy and stability of the equipment were verified by vendor tests.Overpower Trip Set Point The overpower trip set point for the Indian Point 3 Reactor is 109%. This trip set point was selected to provide adequate assurance that spurious reactor trips would not occur during normal operation. Table 7.4-1 lists the factors which make up the maximum overpower level of 118% based upon a trip set point of 109%.67 of 108 IP3 FSAR UPDATE TABLE 7.4-1 INSTRUMENTATION DRIFT AND CALORIMETRIC ERRORS NUCLEAR OVERPOWER TRIP CHANNEL Set Point and Error Allowances: (% of rated power)Estimated Instrument Errors: (% of rated power)Nominal Set Point Calorimetric Error Axial power distribution effects on total ion chamber current Instrumentation channel drift and set point reproductibility Maximum overpower trip point assuming all individual errors are simultaneously in the most adverse direction 109 2 5 2 1.55 3 1.0 118 S 68 of 108 IP3 FSAR UPDATE 7.5 PROCESS INSTRUMENTATION

7.5.1 Design

Bases The non-nuclear process instrumentation measures temperatures, pressures, flows, and levels in the Reactor Coolant System, Steam System, Reactor Containment and Auxiliary Systems.Process variables required on a continuous basis for the startup, operation, and shutdown of the unit are indicated, recorded and controlled from the Control Room. The quantity and types of process instrumentation provided ensure safe and orderly operation of all systems and processes over the full operating range of the plant.Certain controls which require a minimum of operator attention, or are only in use intermittently, are located on local control panels near the equipment to be controlled. Monitoring of the alarms of such control systems are provided in the Control Room.Certain process variable indications for normal operation and post accident conditions are made available in the Control Room and the emergency response facilities through the Critical Function Monitoring System (CFMS).7.5.2 System Design Much of the process instrumentation provide din the plant has been described in the Reactor Control System, the Reactor Protection System and the Nuclear Instrumentation System descriptions (see Sections 7.2, 7.3 and 7.4, respectively). The most important instrumentation used to monitor and control the plant have been described in the above systems descriptions. The remaining portion of the process instrumentation is generally shown on the respective systems process flow diagrams.Condensate pots and wet legs are used to prevent process temperatures from actually reaching the transmitters. Reactor Vessel Level Indicating System (RVLIS)The Reactor Vessel Level Indicating System (RVLIS) provides a means to monitor the water level in the reactor vessel during a postulated accident. It is designed to function under all normal, abnormal, accident and post-accident conditions concurrent with seismic events. The RVLIS consists of two redundant trains, with redundant power supplies, which automatically compensate for variations in fluid density as well as for the effects of reactor coolant pump operation. The level instrumentation is divided into the full range (ApF) and the dynamic range (ApF) in order to measure level under all conditions. The full range gives level indication from the -bottom of the reactor vessel to the top of the reactor head during natural circulation conditions. The dynamic range gives indication of reactor vessel liquid level for any combination of running RCP's. Comparison of indicated d/p against an algorithm derived AP gives a relative void content of the coolant in the core. (See Figure 7;5-2)The RVLIS utilizes RCS penetrations to manual isolation valves. At the valves are sealed capillary impulse lines (two at the reactor head and two at the seal table) which transmit pressure measurements to dip transmitters located outside the Containment Building in the in S 69 of 108 IP3 FSAR UPDATE the Primary Auxiliary Building. The capillary impulse lines are sealed at the RCS end and at the penetrations (inside Containment) with sensor bellows which serve as hydraulic couplers. The impulse lines extend through the Containment wall to hydraulic isolators which seal and isolate the lines as well as provide hydraulic coupling to capillary tubes going to the d/p transmitters. Inside the Containment Building, strap-on RTD's are utilized for vertical runs of impulse lines to correct the reference leg density contributions to the d/p measurement. (See Figure 7.5-2)Engineered Safety Features The following instrumentation ensures coverage of the effective operation of the engineered safety features: Containment Pressure The containment pressure is transmitted to the main control board for post accident monitoring. Six transmitters, two in each of three safety channels, are installed outside the containment to prevent potential missile damage. The pressure is indicated (all six measurement loops) on the main control board; the range is -5 psig to 75 psig.The six measurement loops, monitoring containment pressure, reflect the effectiveness of engineered safety features.Separate from the above, a continuous record of containment pressure is provided in a separate recorder panel in the Control Room. Two redundant and separately channeled safety related, Containment Building pressure measurements are transmitted to and recorded in the Control Room; their range is -5 psig to +200 psig. Each pressure measurement loop consists of a pressure transmitter, a pressure recorder and the necessary signal conditioning equipment, including a power supply, located in the Control Room. Each measurement loop is powered from a separate safety related 118 volts AC instrument bus. (See Section 5.5)Containment Building Hydrogen Concentration Indication of hydrogen in the Containment Building during and after a postulated accident is available from redundant sample conditioners and analyzers. The concentration is continually recorded by 2 recorders located in the Control Room.Containment Building and Sump Water Level There are measuring loops for monitoring water level in the Containment Sump, Recirculation Sump and the Containment Building. Each loop consists of a sensor and transmitter located in the Containment Building and a power supply and recorder in the Control Room.In addition, to alert the operator in the event of a flooding incident, a reactor pit water level alarm provides indication in the Control Room; and a water level sensing probe and remote control unit provide containment sump overflow indication to the Control Room.Refueling Water Storage Tank Level Two redundant channels indicate that Safety Injection and Containment Spray Systems have removed water from the storage tank. One level indication and two low level alarms are transmitted from the tank to the control board.70 of 108 IP3 FSAR UPDATE Safety Injection Pumps Discharge Pressure These channels show that the safety injection pumps are operating. The transmitters are outside the Containment. Safety Injection System Flows Flow indication is provided to the control board for the high and low head injection lines, the recirculation phase containment spray lines, and the spray additive rank outlet line.Pump Energization All pump motor power feed breakers indicate that they have closed by energizing indicatng lights on the control board.Valve Position All engineered safety features valves have position indication on the control board to show proper positioning of the valves. Air operated and solenoid operated valves are selected so as to move in a preferred direction on the loss of air or power. Motor-operated valves remain in the position they held at the time of loss of power to the motor.Residual Heat Exchangers Individual exit flows are indicated, plus combined inlet temperature and individual exit temperatures are recorded, on the control board to monitor operation of the residual heat exchangers. Service Water Individual service water pump flows are monitored through the use of an annubar flow measurement system. This system provides flow indication at the service water pump location.Air Coolers Local flow indication is provided outside containment for service water flow to each cooling unit.Abnormal flow alarms are provided in the Control Room. Service water common inlet temperatures, and all outlet temperatures are displayed at the critical function monitoring system (CFMS). A Control Room alarm is actuated if the flow is low coincident with a safety injection signal. The transmitters are outside the Reactor Containment. In addition, the exit flow is monitored for radiation and alarmed in the Control Room if high radiation should occur. This is a common monitor and the faulty cooler can be located by manually blocking the flow to each unit in turn with locally operated valves.Alarms Visual and audible alarms are provided to call attention to abnormal conditions. The alarms are of the individual acknowledgment type; that is, the operator must recognize and silence the audible alarm for each alarm point. For most control systems, the sensing device and circuits for the alarms are independent, or isolated from, the control devices.71 of 108 IP3 FSAR UPDATE In addition to the above, the following local instrumentation is available: a) Containment spray test lines total flow b) Safety injection test line pressure and flow Monitorinq Systems A Safety Parameter Display System (SPDS) is provided to the Control Room which continuously displays information from which plant status can be assessed._Information on the following functions is provided: a) Reactivity Control b) Reactor core cooling and heat removal from the primary system c) Reactor coolant system integrity d) Radioactivity control e) Containment conditions The SPDS consists of the Critical Functions Monitoring System (CFMS) and the Qualified Safety Parameters Display System (QSPDS). The CFMS displays and alarms of critical safety functions (set of actions, which preserve integrity of one or more physical barriers against radiation) are indicated in the Control Room (CR) and the three emergency response facilities Technical Support Center (TSC), Emergency Operations Facility (EOF) and Alternate Emergency Operations Facility (AEOF). The CFMS is a redundant computer system not designed to seismic and electrical class 1 E criteria. The QSPDS is a backup display system to the CFMS that is qualified to seismic and electrical class 1E standards. The QSPDS design and display is based on NRC Regulatory Guide 1.97 criteria. The CFMS provides for historical data storage and retrieval capability (HDSR). The HDSR system will record, store, recall and display historical information either as graphs and trends or printed logs.The CFMS/QSPDS receive signals from various plant equipment. The CFMS receives signals from safety related and non-safety related sources, and adequate electrical separation is maintained by use of fiber optic links.In order to comply with the requirements of Regulatory Guide 1.97, additions to the original plant design parameters were made. Transmitters monitoring many process variables were installed and the CFMS is utilized to alarm and display these parameters. In some cases local indicators are also provided to facilitate local operation needs. Besides additions, replacement of existing components were made to upgrade them to meet the requirements.

7.5.3 System

Evaluation Redundant instrumentation has been provided for all inputs to the protective system and vital control circuits.Where wide process variable ranges and precise control are required, both wide range and narrow range instrumentation is provided.All electrical and electronic instrumentation required for safe and reliable operation is supplied from four redundant instrumentation buses.72 of 108 IP3 FSAR UPDATE 7.5.4 Instrument Required Table 7.5-1 identifies the instruments used to demonstrate compliance with NRC Regulatory Guide 1.97. Exemptions to compliance are noted in the table.The Technical Specifications establish required actions and completion times for Regulatory Guide 1.97 Type A and Category 1 instrument channels.In addition, inoperability of the following associated recorders is limited to 14 days: Containment Pressure, Containment Water Level, Recirculation Sump Water Level, Containment Hydrogen Monitor, Steam Generator Water level (Wide Range), RCS Pressure (Wide Range), Cold Leg Temperature (Wide Range), Hot Leg Temperature (Wide Range), Pressurizer Water Level, RCS Subcooling Monitor.Surveillance requirements for Regulatory Guide 1.97 Type A and Category 1 instruments are established in the Technical Specifications. In addition, a Channel Operational Test is required, as follows, for alarms that are associated with Type A and Category 1 instruments, but which have no Regulatory Guide function: " Main Steam Line Radiation (R62), Quarterly" Gross Failed Fuel Detector (R63), Quarterly* Containment Hydrogen Monitor, Monthly 73 of 108 S IP3 FSAR UPDATE TABLE 7.5-1 Reaulatorv Guide 1.97 Instruments Reauired S REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP -NOTES 101A Al Primary Coolant Pressure, Reactor Coolant System, Loop 1 P402 J 101B Al Primary Coolant Pressure, Reactor Coolant System,. Loop 4 P403 J 102A Al Primary Coolant Temperature, Hot Leg Loop No. I T413A P 102B Al Primary Coolant Temperature, Hot Leg Loop No. 2 T423A P 102C Al Primary Coolant Temperature, Hot Leg Loop No. 3 T433A P 102D Al Primary Coolant Temperature, Hot Leg Loop No. 4 T443A P 103A Al Primary Coolant Temperature, Cold Leg Loop No. 1 T413B P 103B Al Primary Coolant Temperature, Cold Leg Loop No. 2 T423B P 103C Al Primary Coolant Temperature, Cold Leg Loop No. 3 T433B P 103D Al Primary Coolant Temperature, Cold Leg Loop No. 4 T443B P 104A Al Steam Generator 31 Level, Wide Range L417D K 104B Al Steam Generator 31 Level, Narrow Range L417A K 104C Al Steam Generator 31 Level, Narrow Range L417B K 104D Al Steam Generator 31 Level, Narrow Range L417C K 104E Al Steam Generator 32 Level, Wide Range L427D K 104F Al Steam Generator 32 Level, Narrow Range L427A K 104G Al Steam Generator 32 Level, Narrow Range L427B K 104H Al Steam Generator 32 Level, Narrow Range L427C K 1041 Al Steam Generator 33 Level, Wide Range L437D K 104J Al Steam Generator 33 Level, Narrow Range L437A K 104K Al Steam Generator 33 Level, Narrow Range L437B K 104L Al Steam Generator 33 Level, Narrow Range L437C K.104M Al Steam Generator 34 Level, Wide Range L447D K 104N Al Steam Generator 34 Level, Narrow Range L447A K 1040 Al Steam Generator 34 Level, Narrow Range L447B K 104P Al Steam Generator 34 Level, Narrow Range L447C K 105A. Al Pressurizer Level, Channel I L459 105B All Pressurizer Level, Channel II L460 105C Al Pressurizer Level, Channel III L461 74 of 108 0 S IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 106B Al Containment Wide Range Pressure, Channel I P1421 0 106C Al Containment Wide Range Pressure, Channel II P1422 0*107A A1 Steam Generator 31 Pressure, Channel I P419A 107B Al Steam Generator 31 Pressure,-Channel II P419B 107C Al Steam Generator 31 Pressure, Channel IV P419C 107D Al Steam Generator 32 Pressure, Channel I P429A 107E Al Steam Generator 32 Pressure, Channel II P429B 107F Al Steam Generator 32 Pressure, Channel IV P429C 107G Al Steam Generator 33 Pressure, Channel I P439A 107H All Steam Generator 33 Pressure, Channel II P439B 1071 Al Steam Generator 33 Pressure, Channel IV P439C 107J Al Steam Generator 34 Pressure, Channel I P449A 107K Al Steam Generator 34 Pressure, Channel II P449B 107L Al Steam Generator 34 Pressure, Channel IV P449C 108A Al Refueling Water Storage Level, Alarm L920 N Tank 108B Al Refueling Water Storage Level, Alarm L921 N Tank 109A Al Containment Water Level L1253 L 109B Al Containment; Water Level L1254 L 111A Al Containment Radiation, Area, High Range R25 11lB. Al Containment Radiation, Area, High Range R26 112A Al Secondary Cooling Radiation, Main Steam R62 SS 113A Al Primary Coolant Temperature, Core Exit CE-T-*** TT 114A Al Condensate Storage Tank Water Level Lll28 Level 114B Al Condensate Storage Tank Water Level L1128A Level 115A Al Primary Coolant Temperature, Degrees of RCS Subcooling QSPDS-A M 75 of 108 IP3 FSAR UPDATE TABLE 7.5-1 Reaulatorv Guide 1.97 Instruments Reauired IREG GUIDE 1.97 I STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 115B Al Primary Coolant Temperature, Degrees of RCS Subcooling QSPDS-B M.201A B1 Neutron Flux Excore Radiation, Intermediate Range Channel I N38 201B B1 Neutron Flux Excore Radiation, Intermediate Range Channel II N39 202A B3 Control Rods Position N/A 203A B3 Primary Coolant Sampling, Soluble Boron Concentration N/A Grab Sample 204A B3 Primary Coolant Temperature, Cold Leg, Loop No. 1 T413B P 204B B3 Primary Coolant Temperature, Cold Leg, Loop No. 2 T423B P 204C B3 Primary Coolant Temperature, Cold Leg, Loop No. 3 T433B P 204D B3 Primary Coolant Temperature, Cold Leg. Loop No. 4 T433B P 205A B1 Primary Coolant Temperature, Hot Leg, Loop No. 1 T413A P 205B B1 Primary Coolant Temperature, Hot Leg, Loop No. 2 T423A P 205C B1 Primary Coolant Temperature, Hot Leg, Loop No. 3 T433A P 205D B1 Primary Coolant Temperature, Hot Leg, Loop No. 4 T443A P 206A B1 Primary Coolant Temperature, Cold Leg, Loop No. 1 T413B P 206B B1 Primary Coolant Temperature, Cold Leg, Loop No. 2 T423B P 206C B1 Primary Coolant Temperature, Cold Leg, Loop No. 3 T433B P 206D B1 Primary Coolant Temperature, Cold Leg, Loop No. 4 T443B P 207A B1 Primary Coolant Pressure, Reactor Coolant System, Loop 1 P402 J 207B B1 Primary Coolant Pressure, Reactor Coolant System, Loop 4 P403 J 208A B3 Primary Coolant Temperature, Core Exit CE-T-*** TT 209A B1 Primary Coolant Level, Reactor RVLIS TR-A & B 210A B2 Primary Coolant Temperature, Degrees of Subcooling QSPDS-A 2!0B B2 Primary Coolant Temperature, Degrees of Subcooling QSPDS-B 21 1A B1 Primary Coolant Pressure, Reactor Coolant System, Loop 1 P402 J 211 B B1 Primary Coolant Pressure, Reactor Coolant System, Loop 4 P403 J 212C B2 Containment Level, Containment Sump Water Channel I L1255 L 212D B2 Containment Level, Containment Sump Water Channel II L1256 L 212E B1 Containment Level, Wide Range Channel I L1253 L 76 of 108 IP3 FSAR UPDATE TABLE 7.5-1 Requlatorv Guide 1.97 Instruments Reauired REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 212F Bi Containment Level, Wide Range Channel II L1254 L 2121 B2 Containment Level, Wide Range Redundant Channel: L1251 L Recirculation Sump Level-Channel I 212J B2 Containment Level, Wide Range Redundant Channel: L1252 L Recirculation Sump Level-Channel II 213B B1 Containment Pressure, Channel I P1421 0 213C B1 Containment Pressure, Channel II P1422 0 214A B1 Containment Position, Isolation valve N/A Y 215B B1 Containment Pressure, Channel I P1421 0 215C B1 Containment Pressure, Channel II P1422 0 301A C1 Primary Coolant Temperature, Core Exit CE-T-*** TT 302A C1 Primary Coolant Radiation, Radioactivity Concentration R-63A&B 303A C1 Primary Coolant Radiation, Gamma Spectrum N/A W 304A C1 Primary Coolant Pressure, Reactor Coolant System Loop 4 P402 J 304B C1 Primary Coolant Pressure, Reactor Coolant System Loop 1 P403 J 305B C1 Containment Pressure, Channel I P1421 0 305C Cl Containment Pressure, Channel I1 P1422 0 306C C2 Containment Level, Containment Sump Water Channel I L1255 L 306D) C2 Containment Level, Containment Sump Water Channel II L1256 L 306E C1 Containment Level, Wide Range Channel I L1253 L 306F C1 Containment. Level, Wide Range Channel II L1254 L 3061 C1 Containment Level, Wide Range Redundant Channel: L1251 L Recirculation Sump Level-Channel I 306J C1 Containment Level, Wide Range Redundant Channel: L1252 L Recirculation Sump Level-Channel II 307A C3 Containment Radiation, Area R25 307B C3 Containment Radiation, Area R26 308A C3 Cond Air Removal Sys Radiation, Effluent Noble Gas R15 77 of 108 IP3 FSAR UPDATE TABLE 7.5-1 Reaulatorv Guide 1.97 Instruments Reauired REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES Exhaust 309A C1 Primary Coolant Pressure, Reactor Coolant System, Loop 1 P402 J 309B C1 Primary Coolant Pressure, Reactor Coolant System, Loop 4 P403 J 310B C1 Containment Air Sampling, Hydrogen Concentration Channel I HCMC-A 310C C1 Containment Air Sampling, Hydrogen Concentration Channel II HCMC-B 311B C1 Containment Pressure, Channel I _P1421 0 311C C1 Containment Pressure, Channel II P1422 0 312A C2 Containment Radiation, Effluent, Noble Gas, Penetration Area R12 AA 314B C2 Penetration Area Radiation, Area, Electrical Tunnel In N/A BB Area of Electrical Penetration 314C C2 Penetration Area Radiation, Area, 83' Personnel Airlock Area N/A BB 314D C2 Penetration Area Radiation, Area, Containment Purge Valve Area N/A BB Between Containment & Fan House 314E C2 Penetration Area Radiation, Area, 95' Personnel & Equipment N/A BB Hatch Area 314F C2 Penetration Area Radiation, Area, Fuel Transfer Area Between N/A BB Containment & Fuel Storage Buildings 314G C2 Fuel Storage Building Radiation, Area, Penetration Area, In Area of Fuel R5 BB Tran sfer Tube 314H C2 PAB 34' FL EL Radiation Area, Piping Tunnel In Area of N/A BB Containment Sump Drain Pent 314J C2 PAB 54' FL EL Radiation, Area, Piping Tunnel in Area of Piping N/A BB Penetrations 401A D2 Residual Heat Removal Flow Rate, Header 31 F638 401B D2 Residual Heat Removal Flow Rate, Header 32 F640 401C D2 Residual Heat Removal Flow Rate, Loop 4 FT946A 4010 D2 Residual Heat Removal Flow Rate, Loop 3 FT946B 401E D2 Residual Heat Removal Flow Rate, Loop 2 FT946C 401F D2 Residual Heat Removal Flow Rate, Loop 1 FT9460 78 of 108 0 IP3 FSAR UPDATE TABLE 7.5-1 Requlatory Guide 1.97 Instruments-Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO -INST LOOP 'NOTES 402A, D2 Residual Heat Removal Temperature, Heat Exchanger 31 Outlet T639 402B D2 Residual Heat Removal Temperature, Heat Exchanger 32 Outlet T641 403A D2 Safety Injection Level, Accumulator Tank 31 L934A Z 304B8 D2 Safety Injection Level, Accumulator Tank 32 L934B Z 403C D2 Safety Injection Level, Accumulator Tank 33 L934C Z 403D D2 Safety Injection Level, Accumulator Tank 34 L934D Z 403E D2 Safety Injection Pressure, Accumulator Tank 31 P937A Z 403F D2 Safety Injection Pressure, Accumulator Tank 32 P937B Z 403G D2 Safety Injection Pressure, Accumulator Tank 33 P937C Z 403H D2 Safety Injection Pressure, Accumulator Tank 34 P937D Z 404A D2 Safety Injection Pressure, Accumulator Tank 31 Isolation Valve N/A HH 894A 404B D2 Safety Injection Pressure, Accumulator Tank 32 Isolation Valve N/A HH 894B 404C D2 Safety Injection Pressure, Accumulator Tank 33 Isolation Valve N/A HH 894C 404D D2 Safety Injection Pressure, Accumulator Tank 34 Isolation Valve N/A HH 894D 405A D2 Safety Injection Flow, Boric Acid Charging F128 H 406A D2 Safety Injection Flow, High Head, Cold Leg Loop I F926 406B D2 Safety Injection Flow, High Head, Cold Leg Loop I F924A .406C D2 Safety Injection Flow, High Head, Cold Leg Loop 2 F981 406D D2 Safety Injection Flow, High Speed, Cold Leg Loop 2 F925 406E D2 Safety Injection Flow, High Speed, Cold Leg Loop 3 F980 406F 02 Safety Injection Flow, High Speed, Cold Leg Loop 3 F926A 406G 02 Safety Injection Flow, High Speed, Cold Leg Loop 4 F982 406H D2 Safety Injection Flow, High Speed, Cold Leg Loop 4 F927 407A D2 Safety Injection Flow, Low Head F638 79 of 108 IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 407B D2 Safety Injection Flow, Low Head F640 408A D2 Safety Injection Level, Refueling Water Storage Tank L920 409A D3 Primary Coolant Status, Reactor Coolant Pump 31 N/A 409B D3 Primary Coolant Status, Reactor Coolant Pump 32 N/A 409C D3 Primary Coolant Status, Reactor Coolant Pump 33 N/A 409D D3 Primary Coolant Status, Reactor Coolant Pump 34 N/A 410A D2 Primary Coolant Position, Safety Relief Valve, Power Operated N/A Acoustica Relief Valve 455C I Monitor At Valve 410B D2 Primary. Coolant Position, Safety Relief Valve, Power Operated N/A Acoustica Relief Valve 456 I Monitor At Valve 410C D2 Primary Coolant Position, Safety Relief Valve, ASME Code Safety N/A Acoustica Valve 464 I Monitor At Valve 410D D2 Primary Coolant Position, Safety Relief Valve, ASME Code Safety N/A Acoustica Valve 466 I Monitor At Valve 410E D2 Primary Coolant Position, Safety Relief Valve, ASME Code Safety N/A Acoustica Valve 468 I Monitor At Valve 41 1A D1 Primary Coolant Level, Pressurizer Channel I L459 411B D1 Primary Coolant Level, Pressurizer Channel II L460 411C D1 Primary Coolant Level, Pressurizer Channel III L461 412A D2 Primary Coolant Status, Pressurizer Heater- Control Group N/A U 412B D2 Primary Coolant Status, Pressurizer Heater- Back-up Group 31 N/A U 412C D2 Primary Coolant Status, Pressurizer Heater- Back-up Group 32 N/A U 412D D2 Primary Coolant Status, Pressurizer Heater -Back-up Group 33 N/A U 413A D3 Primary Coolant Level, Pressurizer Relief Tank 31 L470 80 of 108 S IP3 FSAR UPDATE TABLE 7.5-1 Regqulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 414A D3 Primary Coolant Temperature, Pressurizer Relief Tank 31 T471 415A D3 Primary Coolant Pressure, Pressurizer Relief Tank 31 P472 416A D1 Secondary Cooling Level, Steam Generator 31 L417D K 416B " _D_ 1Secondary Cooling Level, Steam Generator 32 L427D K 416C D1 Secondary Cooling Level, Steam Generator 33 L437D K 416D D1 Secondary Cooling Level, Steam Generator 34 L447D K 417A D2 Secondary Cooling Pressure, Steam Generator 31, Channel I P419A 417B D2 Secondary Cooling Pressure, Steam Generator 32, Channel I P429A 417C D2 Secondary Cooling Pressure, Steam Generator 33, Channel I P439A 417D D2 Secondary Cooling Pressure, Steam Generator 34, Channel I P449A 418A D2 Secondary Cooling Flow, Main Steam From Steam Generator 31 F419A&B 418B D2 Secondary Cooling Flow, Main Steam From Steam Generator 32 F429A&B 418C D2 Secondary Cooling Flow, Main steam From Steam Generator 33 F439A&B 418D D2 Secondary Cooling Flow, Main Steam From Steam Generator 34 F449A&B 419A D3 Secondary Cooling Flow, Main Feedwater To Steam Generator 31 F418A&B 419B D3 Secondary Cooling Flow, Main Feedwater To Steam Generator 32 F428A&B 419C D3 Secondary Cooling Flow, Main Feedwater To Steam Generator 33 F438A&B 419D D3 Secondary Cooling Flow, Main Feedwater To Steam Generator 34 F448A&B 420A D2 Secondary Cooling Flow, Auxiliary Feedwater To Steam Generator 31 F1200R 420B D2 Secondary Cooling Flow, Auxiliary Feedwater To Steam Generator 32 F1201R 420C D2 Secondary Cooling Flow, Auxiliary Feedwater To Steam Generator 33 F1202R 420D D2 Secondary Cooling Flow, Auxiliary Feedwater To Steam Generator 34 F1203R 421A D1 Secondary Cooling Level, Condensate Storage Tank Water L1128 G 421_B D_1 Secondary Cooling Level, Condensate Storage Tank Water L 128A G 422A D2 Containment Flow, Spray From Residual Heat Removal Heat F945B II Exchanger 31 422B D2 Containment Flow, Spray From Residual Heat Removal Heat F945A 11 Exchanger 32 423A D2 Containment Flow, Heat Removal By System-Service Water F1121 81 of 108 IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES RCFC 31 423B D2 Containment Flow, Heat Removal By system-Service Water F1 122 RCFC 32 423C D2 Containment Flow, Heat Removal By System-Service Water F1 123 RCFC 33 423D D2 Containment Flow, Heat Removal By System-Service Water F1 124 RECF 34 423E D2 Containment Flow, Heat Removal By System-Service Water F1125 RCFC 35 423F D2 Containment Temperature, Heat Removal By System-Service T-1415-1 Water Diff RCFC 31 423G D2 Containment Temperature, Heat Removal By System-Service T-1415-2 Water Diff RCFC 32 423H 'D2 Containment Temperature, Heat Removal By System-Service T-1415-3 Water Diff RCFC 33 423J D2 Containment Temperature, Heat Removal By-System-Service T-1415-4 Water Diff RCFC 34 423K D2 Containment Temperature, Heat Removal By System-Service T-1415-5 Water Diff RCFC 35 424A D2 Containment Temperature, Atmosphere T1203 425A D2 Containment Temperature, Sump Water NONE I 426A D2 Chemical & Volume Flow, Make-up In F128 Control 427A D2 Chemical & Volume Flow, Letdown Out F134 B Control 428A D2 Chemical & Volume Level, Volume Control Tank Li 12 C Control 429A D2 Component Cooling Temperature, Component Cooling Heat T602A 0 Exchanger 31 Output 82 of 108 0 IP3 FSAR UPDATE TABLE 7.5-1 Requlatorv Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 429B D2 Component Cooling Temperature, Component Cooling Heat T602B D Exchanger 32 Output 430A D2 Component Cooling Flow, Component Cooling Heat Exchanger 31 F601A E Output 430B D2 Component Cooling Flow, Component Cooling Heat Exchanger 32 F601 B E Output 431A D3 Radwaste Level, High-Level Radioactive Waste Hold-up L1001 Tank 31 431B D3 Radwaste Level, High-Level Radioactive Waste Hold-up L168 JJ Tank 32 (3HBT01A)431C D3 Radwaste Level, High-Level Radioactive Waste Hold-up L170 JJ Tank 33 (3HBT01B)432A D3 Radwaste Pressure, Large Radioactive Gas Decay Tank 31 P1036 KK 432B D3 Radwaste Pressure, Large Radioactive Gas Decay Tank 32 P1037 KK 432C D3 Radwaste Pressure, Large Radioactive Gas Decay Tank 33 P1038 KK 432D D3 Radwaste Pressure, Large Radioactive Gas Decay Tank 34 P1039 KK 432E D3 Radwaste Pressure, Small Radioactive Gas Decay Tank 31 P1052 KK 432F D3 Radwaste Pressure, Small Radioactive Gas Decay Tank 32 P1053 KK 432G D3 Radwaste Pressure, Small Radioactive Gas Decay Tank 33 P1054 KK 432H D3 Radwaste Pressure, Small Radioactive Gas Decay Tank 34 P1055 KK 432J D3 Radwaste Pressure, Small Radioactive Gas Decay Tank 35 P1056 KK 432K D3 Radwaste Pressure, Small Radioactive Gas Decay Tank 36 P1057 KK 433A D2 Ventilation Position, Reactor Containment Fan Cooler 31 N/A GG.,_Damper A & B 433B D2 Ventilation Position, Reactor Containment Fan Cooler 31 N/A GG Damper A & B 433C 02 Ventilation Position, Reactor Containment Fan Cooler 31 N/A GG Damper D & Blow-in Door 433D D2 Ventilation Position, Reactor Containment Fan Cooler 32 N/A GG 83 of 108 0 IP3 FSAR UPDATE TABLE 7.5-1 Requlatorv Guide 1.97 Instruments Reauired REG GUIDE 1.97 " STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES Damper A & B 433E D2 Ventilation Position, Containment Fan Cooler 32 Damper C N/A GG 433F D2 Ventilation Position, Reactor Containment Fan Cooler 32 N/A GG Damper D & Blow-in Door 433G D2 Ventilation Position, Reactor Containment Fan Cooler 33 N/A GG Damper A & B 433H D2 Ventilation Position, Reactor Containment Fan Cooler 33 N/A GG Damper C 433J D2 Ventilation Position, Reactor Containment Fan Cooler 33 N/A GG Damper D & Blow-in Door 433K D2 Ventilation Position, Reactor Containment Fan Cooler 34 N/A GG Damper A & B 433L D2 Ventilation Position, Reactor Containment Fan Cooler 34 N/A GG Damper C 433M D2 Ventilation Position, Reactor Containment Fan cooler 34 N/A GG_____Damper D & Blow-in Door 433N D2 Ventilation Position, Reactor Containment Fan Cooler 35 N/A GG Damper A & B 433P D2 Ventilation Position, Reactor Containment Fan Cooler 35 N/A GG Damper C 433R D2 Ventilation Position, Reactor Containment Fan Cooler 35 N/A GG Damper D & Blow-in Door 433S D2 Ventilation Position, Fuel Storage Building Forced Air Unit 31 N/A GG Emergency Damper 433T D2 Ventilation Position, Fuel Storage Building Forced Air Unit 32 N/A GG Emergency Damper 433U D2 Ventilation Position, Fuel Storage Building Normal Airflow N/A GG Top Damper 433V D2 Ventilation Position, Fuel Storage Building Normal Airflow N/A GG Bottom Damper 84 of 108 IP3 FSAR UPDATE TABLE 7.5-1 Reaulatorv Guide 1.97 Instruments Reauired REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 433W D2, Ventilation Position, Fuel Storage Building Emergency Airflow N/A GG Filter Intake Damper 433X D2 Ventilation Position, Fuel Storage Building Emergency Airflow N/A GG Filter Exhaust Damper 433Y D2 Ventilation Position, Primary Auxiliary Building Exhaust N/A GG Charcoal Damper -Face 433Z D2 Ventilation Position, Primary Auxiliary Building Exhaust N/A GG Charcoal Damper -Bypass 434A D2 Emergency Power Current, AC Bus 31 N/A 434B D2 Emergency Power Current, AC Bus 32 N/A 434C D2 Emergency Power Current, AC Bus 33 N/A 434D D2 Emergency Power Current, AC Bus 34 N/A 434E D2 Emergency Power Voltage, AC Bus 31 N/A 434F D2 Emergency Power Voltage, AC Bus 32 N/A 434G D2 Emergency Power Voltage, AC Bus 33 N/A 434H D2 Emergency Power Voltage, AC Bus 34 N/A 4341 D2 Emergency Power Current, DC Bus 31 N/A F 434J D2 Emergency Power Current, DC Bus 32 N/A F 434K D2 Emergency Power Current, DC Bus 33 N/A F 434L D2 Emergency Power Current, DC Bus 34 N/A F 434M D2 Emergency Power Voltage, DC Bus 31 N/A 434N D2 Emergency Power Voltage, DC Bus 32 N/A 4340 D2 Emergency Power Voltage, DC Bus 33 N/A 434P D2 Emergency Power Voltage, DC Bus 34 N/A 434Q D2 Emergency Power Current, Diesel 31 N/A 434R D2 Emergency Power Current, Diesel 32 N/A 434S D2 Emergency Power Current, Diesel 33 N/A 434T D2 Emergency Power Voltage, Diesel 31 N/A 434U D2 Emergency Power Voltage, Diesel 32 N/A 85 of 108 0 IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 434V D2 Emergency Power Voltage, Diesel 33 N/A 434W D2 Emergency Air Supply Pressure, Instrument Air Receiver Tank P1207 434X D2 Emergency Air Supply Pressure, Diesel 31 Starting Air Receiver Tank N/A 434Y D2 Emergency Air Supply Pressure, Diesel 32 Starting Air Receiver Tank N/A 434Z D2 Emergency Air Supply Pressure, Diesel 33 Starting Air Receiver Tank N/A 501A E 1 Containment Radiation, Area, High Range R25 501 B El Containment Radiation, Area, High Range R26 502A E3 Central Control Room Radiation, Area R1 MMCCX 502B E3 PAB 80' Radiation, Area, Charging Pump Room R4 DD 502C E3 Fuel Storage Building Radiation, Area R5 502D E3 PAB 55' Radiation, Area, Sampling Room (North Wall) R6 X 502E E2 Containment Radiation, Area, (AT Seal Table) In-core R7 X, DD Instrument Room 502F E2 PAB 55' Radiation, Area, Drumming Station R8 X, DD 502G E2 Aux Boiler Feed Pump Radiation, Area, (West Wall Opposite Main Steam NONE X Bldg Penetrations 31 & 32)502H E2 PAB 55' Radiation, Area, On Column Across From Sample R64 Room 502J E2 PAB 73' Radiation, Area, Entrance Way To Volume N/A X Control Tank 502K E2 PAB 73' Radiation, Area, Hall Next To NPO Office R65 502L E2 PAB 41' Radiation, Area, South Wall Area Of Refueling N/A X Water Purification Pumps 86 of 108 S IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required IREG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 502P E2 PAB 41' Radiation, Area, Pipe Tunnel In Area Of R67 Chemistry Post Accident Sampling Station 502Q E2 PAB 15' Radiation, Area, On North Wall Adjacent To RHR R68 Valve Gallery 502R E2 RAB 15' Radiation, Area, Hall On Wall At Entry To Filter N/A X Cell 502S E2 PAB 54' Radiation, Area, Within The Doorway On The R69 Wall, Pipe Penetration 502T E2 PAB 67' Radiation, Area, Above Pipe Penn In Area Of N/A X Hydrogen Recombiner Panels 502U E2 Fan Building 92' Radiation, Area, In Area Of 4 Channel Iodine R70 Monitors 502V E2 Fan Building 72' Radiation, Area, Outside Plenum In Area Of R70 Differential Pressure Instruments 503A E2 Containment Radiation, Effluent, Noble Gas R27 Via Plant Vent 504A E2 Reactor Shield Building Radiation, Effluent, Noble Gas N/A Annulus 505A E2 Auxiliary Building Radiation, Effluent, Noble Gas, Or Others R27 Via Plant Containing Primary System Gases Vent 506A E2 Cond Air Removal Sys Radiation, Effluent, Noble Gas R15 NN Exhaust 506B E2 Cond Air Removal Sys Radiation, Effluent, Noble Gas -Flow Rate R15 Exhaust 507 A E2 Common Plant Vent Radiation, Effluent, Noble Gas R27 SS 507B E2 Common Plant Vent Radiation, Effluent, Flow Rate R27 SS 508A E2 Steam Generator Radiation, Effluent, Noble Gas From Safety Relief R62 FF Valves Or Atm Dump Valves 509A E2 Admin Bldg Exhaust Vent Radiation, Effluent, Noble Gas From 4 th Floor R46 00, CC 87 of 108 0 IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 509B E2 Admin Bldg Exhaust Vent Radiation, Effluent, Flow Rate, 4 th Floor NONE 00 509C E2 Radioactive Machine Radiation, Effluent, Noble Gas R59 Shop Exhaust Vent 509D E2 Radioactive Machine Radiation, Effluent, Flow Rate FT-1776 Shop Exhaust Vent 509E E2 Steam Generator Radiation, Effluent R19 Blowdown 509F E2 Steam Generator Radiation, Effluent, Flow Rate F538 Blowdown 510A E3 Common Plant Vent Radiation, Effluent, Particulates N/A EE, SS 51OB E3 Common Plant Vent Radiation,, Effluent, Halogens N/A EE, SS 51OC E3 Common Plant Vent Radiation, Effluent, Flow Rate R27 510D E3 Admin Bldg Exhaust Vent Radiation, Effluent, Particulates From The 4 th N/A DD, 00 Floor 510E E3 Admin Bldg Exhaust Vent Radiation, Effluent, Halogens From The 4 th Floor N/A DD, 00 51OF E3 Admin Bldg Exhaust Vent Radiation, Effluent, Flow Rate, 4 th Floor NONE DD, 00 51OG E3 Radioactive Machine Radiation, Effluent, Particulates N/A CC Shop Exhaust Vent 51OH E3 Radioactive machine Radiation, Effluent, Halogens NONE CC shop exhaust vent 510J E3 Radioactive machine Radiation, Effluent, Flow Rate FT-1776 shop exhaust vent 511A E3 Environs Radiation, Exposure Rate N/A RR 512A E3 Environs Radiation, airborne radiohalogens and N/A portable particulates instrum.513A E3 Environs Radiation, photons N/A portable instrum.513B E3 Environs Radiation, beta and low energy photons N/A portable I instrum.88 of 108 0 IP3 FSAR UPDATE TABLE 7.5-1 Reaulatorv Guide 1.97 Instruments Reauired REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 514A E3 Environs Radioactivity, multi channel gamma-ray N/A spectrometer 515A E3 Meteorological Met, wind direction N/A 516A E3 Meteorological Met, wind speed N/A 517A E3 Meteorological Met, atmospheric stability N/A 518A E3 Sampling Primary coolant and containment sump water N/A W,R analysis -gross activity 518B E3 Sampling Primary coolant and containment sump water N/A W,R analysis -.gamma spectrum 518C E3 Sampling Primary coolant and containment sump water N/A W,R analysis -boron content 89 of 108 IP3 FSAR UPDATE Table 7.5-1 Regulatory Guide 1.97 Instruments Required NOTES General Notes that apply to all items have an as an identifier. NOTE A: DELETED NOTE B: The letdown flow is controlled by opening a remote operated valve, which allows flow through fixed orifice plates. The maximum CVCS letdown flow allowed administratively is limited to 120 gpm. It is the Authority's position that the indicated range (0-125 gpm) is adequate.NOTE C: The existing level (18% to 82%) transmitter range is adequate. The modification necessary to obtain the additional level (0%-100%) required by 1.97 is not warranted based on manrem exposure and cost versus benefit.NOTE D: The existing range indication for component cooling heat exchanger temperature is adequate for all modes of normal operation of off-normal modes of operation. The temperature of the component cooling system to date has not decreased below the existing range of 50 0 F. In addition, in the event of a major accident the temperature would be expected to increase as opposed to decrease, further assuring that the temperature would not decrease below the low range of the temperature system.NOTE E: The existing range indication for component cooling heat exchanger flow is adequate for all modes of normal operation or off-normal modes of operation. The component cooling flow indication during normal operation may decrease below the existing range however; this condition does not cause any concern warranting a modification. The pump can be assured that it is functioning via low pressure and pump breaker status alarms. The components that are being cooled have local flow devices that are used to regulate the flow; therefore, minimum pump flow conditions can be met. In addition, in the event of a major accident, the flow would increase as opposed to decrease.NOTE F: It is the Authority's position that sufficient indication to D.C. bus status is provided to the operators such that during post accident conditions, the operators will be aware of the operability of the D.C. buses.NOTE G: Condensate storage tank level is currently monitored by two-(2) independent qualified transmitters. Diverse indication of CST level can be derived by auxiliary feedwater suction pressure indication. It is the Authority's position that the existing monitoring of CST level complies with the requirements of Regulatory Guide 1.97.NOTE H: Boric acid flow to the RCS is monitored by the high-pressure injection (HPI) flow transmitters. Refer to index number 406 A-H which meets Reg. Guide 1.97 requirements. 90 of 108 IP3 FSAR UPDATE NOTE I: Based on conversations with the NRC staff, the intent of this variable may be satisfied by the indication of several other variables. IP-3 has indication of RHR outlet temperature, containment spray flow and containment temperature which provides adequate indication of containment heat removal capability. NOTE J: Adequate diverse measurement to PT-402 and PT-403 is obtained from pressure transmitters used to monitor pressurizer pressure (PT-455, 456, 457 and 474) for the range of 1700-2500 psig. Additionally, R.C.S. pressure, 0-3000 psig is indicated on a pressure gauge located in an area accessible to plant operators. NOTE K: Each Steam Generator contains four (4) transmitters to indicate steam generator water level Three (3) transmitters per steamgenerator indicate narrow range level which is a span that begins at the top of the tube bundles to the moisture separator. The remaining level transmitter covers the span from the bottom tube sheet up to the moisture separator. Based on above, diversity exists from the top portion of the steam generator. Two (2) auxiliary feedwater flow indicators provide a diverse indication for the steam generator. In addition, since two of our four steam generators are required for heat removal, redundantwide range level for each generator is deemed not necessary. NOTE L: Two (2) redundant level transmitters (LT-t253 & 1254) provide containment water level indication to the Central Control Room (CCR) operators. In addition, the containment sump and recirculation sump each contain (2) qualified level transmitters. The refueling water storage tank provides a diverse measurement for the containment water level.NOTE M: Diversity is met via a third system which records saturation pressure margin and also use of steam tables.NOTE N: Containment water level provides a diverse method to determine refueling water storage tank level.NOTE 0: Additional Containment pressure instrumentation exists (PT 948A, B & C and PT 949A, B & C) to provide a diverse means of establishing containment pressure.NOTE P: Redundancy for the Hot Leg Reactor Coolant Temperature will be by the use of the core exit thermocouples (Diverse Variable). Redundancy for the Cold Leg Reactor Coolant Temperature is provided by the steamline pressure instrument PT 419 A, B & C; PT 429 A, B, & C; PT 439 A, B, & C and PT 449 A, B, & C (Diverse Variable). NOTE Q: DELETED NOTE R: DELETED NOTE S*: On March 4, 1983, the NRC conducted a workshop in Chicago, Illinois in order to clarify the technical requirement of NUREG-0737, Supplement I. The handout distributed by the NRC at this workshop states that with respect to seismic qualification requirement for operating reactors, it will suffice to state that instrumentation systems comply with the seismic qualification program which was the basis for plant licensing. Accordingly, the seismic requirement is indicated 91 of 108 IP3 FSAR UPDATE in Enclosure B as being satisfied if that instrumentation complies with the licensing basis for seismic qualification. [GENERAL NOTE]NOTE T*: As noted in Regulatory Guide 1.97, Revision 3, Category 1 and 2 instrumentation should be qualified in accordance with Regulatory Guide 1.89, "Qualification of Class 1 E Equipment for Nuclear Power Plants," and the methodology described in NUREG-0588, "Interim Staff Position on Environmental Qualification of Safety-Related Electrical Equipment." Enclosure B reflects this requirement for all Category 1 and 2 instrumentation. However, certain Category 1 and 2 instrumentation are located in mild post-accident environments and therefore are not within the scope of Regulatory Guide 1.89. For the sake of convenience, the Category 1 and 2 instrumentation located in a mild post-accident environment are noted as meeting Environmental Qualification (E.Q.) requirement. Hence, that instrumentation noted in Enclosure B as satisfying the E.Q. requirement either satisfy the requirements of 10 CFR 50.49 or are located in a mild post-accident environment. NOTE U: Since the purpose of Pressurizer Heater Status is to ensure that they do not overload a diesel, adequate diesel generator loading information is available to the operators. The heaters are supplied by a safety related electrical bus and are stripped from that bus in the event of a Safety Injection Signal. They must be manually placed in service by the control room operator and procedures are in place that provide the guidance to ensure the diesels are not overloaded. In addition, heater electrical breaker status lights are available. The pressurizer pressure and temperature response also provides verification that the heaters are operational. NOTE V: DELETED NOTE W: The Authority concurred with the NRC approach to post-accident sampling capability review. The deviations are beyond the scope of the Regulatory Guide 1.97 submittal and are best addressed via our submittal to NuReg-0737, Item ll.B.3 NOTE X: Portable survey meters are the primary source of data on the radiation exposure rates inside buildings. These portable instrume"nts are used to 1) verify the indication of the existing installed radiation monitors, and 2) determine exposure rates where there are no installed radiation monitors. It is Entergy's opinion that the portable survey meters meet the intent of the Guide.NOTE Y: The automatic containment isolation valves at the facility meet all of the requirements of the Regulatory Guide on position indication. Non-automatic containment isolation valves are not provided with position indication: Valves that are considered essential and non-automatic are maintained in the open position and are closed after the initial phases of an accident. Approved emergency procedures are utilized to control the closing of these valves. Non-essential 92 of 108 IP3 FSAR UPDATE containment isolation valves are maintained in the closed position and may be opened, if necessary, for plant operation and for only as long as necessary to perform the intended function, as required by Indian Point 3 Technical Specifications. These valves are additionally administratively controlled in the following manner: 1. Shift Manager approval for opening a non-automatic containment isolation valve is required.2. An operator must be dedicated to the operation of these valves as long as they are in the open position.3. Operator must have communications established with the Central Control Room, and 4. Operators first response to any emergency condition while the valve is open is to insure that the valve is returned to the closed position.NOTE Z: Since the accumulators will discharge immediately when RCS pressure drops below accumulation pressure, these variables are unnecessary following an accident. Since power to the isolation valves is locked out at the circuit breaker, the operator would not be able to utilize these variables for manual actions, except for events in which the RCS pressure is decreasing very slowly. For such events, the present indicators are expected to function properly. Letter from NRC (N.F. Conicella) to R. Beedle, dated 9/28/92, entitled "REGULATORY GUIDE 1.97 -INSTRUMENTATION TO FOLLOW THE COURSE OF AN ACCIDENT FOR INDIAN POINT GENERATING UNIT NO. 3 (TAC No. M51099)", relaxed the requirement for Accumulator Pressure and Level Instrumentation and deleted the commitment for upgrading Accumulator Pressure and Level Instrumentation. NOTE AA: The original radiation monitor used to monitor containment effluent radioactivity (R-12) is located in a non-harsh environmental area. Therefore, the environmental qualification requirements of the regulatory guide are satisfied. The combination of R-12 and an additional environmentally qualified effluent radiation monitor (R-27) sufficiently meets the range requirements of the Regulatory Guide.NOTE BB: Radiation exposure rates inside buildings or areas in direct contact with primary containment where penetrations and , hatches are located can be sufficiently monitored by portable radiation monitoring detectors. NOTE CC: The existing sampler or radiation monitors for these areas do not meet the range requirements of the Regulatory Guide, however, it is Entergy's position that the indicated range is sufficient for the highest levels that are postulated for these areas.NOTE DD: The existing area radiation monitors for these areas do not meet the range requirements of the Regulatory Guide, however, it is Entergy's position that these areas need not be monitored for the mitigation of an accident.93 of 108 IP3 FSAR UPDATE NOTE EE: To accommodate the range requirements of these radiation detectors, Entergy will use the Post Accident Sampling System.NOTE FF: NOTE GG: The plant computer will record the steam release duration and mass flow rate.Damper indication status is provided via red-green indicating lamps in the control room. The lamps are illuminated by a single limit switch, which is toggled when the damper is in the opened or closed position.The Containment Fan Cooler units are provided with flow switches, which will cause an annunciation in the control room if low flow exists. In addition, a Weir system exists to quantify the cooling and condensing features of the ventilation unit.Since failure of dampers are rare and it is improbable that the limit switch or some diverse variable would not detect the failure, it is Entergy's position that no modifications are warranted. The white lights used to satisfy Index 404A, B, C, and D are on when the valves are fully open and off when not fully open. These lights are always operable.NOTE HH: The valves are opened and the power and control circuits are de-energized when the RCS pressure is above 1000 psi.When these circuits are energized, each valve has red and green indicator lights which tell the operator whether the valve is full open, full closed or at some intermediate position.NOTE II: The containment spray system consists of 4 spray headers. Two headers are used during the initial phase of the accident and the other two headers are used later in the accident. Manual operator action based on spray system flow rates is required in the later phase of the accident. As such, the spray flow indications described in Enclosure B are provided by the two headers used later in the accident only.NOTE JJ: The existing level represents approximately 94% of the tank range. Since the tanks are horizontal cylindrical, the level actually monitors greater than 94% of its volume. These tanks are back up to 31 Waste Hold-Up tanks.NOTE KK: The range that is required by the Guide, 0 tO 165 psig, exceeds the tank design pressure and the tank safety valve setting, i.e., 150 psig. As additional status of tank pressure, an alarm is actuated when tank pressure reaches 110 psig.It is therefore Concluded that the actual range of tank pressure is acceptable and meets the intent of .the Regulatory Guide.94 of 108 IP3 FSAR UPDATE NOTE LL: DELETED -Monitor R-10 has been removed from the plant.NOTE MM: NOTE NN: NOTE 00: The control room monitor's range is considered adequate. The operators would evacuate the control room prior to fields reaching the upper range prescribed in Reg. Guide 1.97.This possible atmospheric release point is designed to divert into the containment at relatively low levels. In addition, prior to reaching 1.97 levels, you would have to have fuel damage, steam generator tube failures and failure of the diversion to containment feature, which are highly improbable. Main steam radiation monitors are capable of detecting activity that would escape from condenser air ejectors. It is Entergy's position that the existing monitor is adequate to monitor the release point.The monitor is located and provides radiation level in an area that is not considered part of the plant proper. No radioactivity materials are expected to be brought into this area that would warrant any increase in the range of the existing monitors or the addition of flow monitoring devices.NOTE PP*: As per Regulatory Guide 1.97 Rev. 3, seismic qualification is not required for Category II variables. [GENERAL NOTE]NOTE QQ: DELETED NOTE RR: No longer required as per Rev. 3 of Regulatory Guide 1.97.NOTE SS: If the plant vent sampling capability, the wide-range vent monitor, or the main steam line radiation monitor is inoperable in MODES 1, 2, or 3, initiate a preplanned alternate sampling / monitoring capability as soon as practical, but no later than 72 hours after identification of the failure.NOTE TT: The present list of qualified Core Exit Thermocouples is: K-11, L-12, K-13, C-12, F-12, E-10, D-9, A-11, B-3, B-6, E-5, F-5, G-4, R-10, P-13, H-5, K-3, J-7, N-2, & L-1 95 of 108 IP3 FSAR UPDATE 7.6 IN-CORE INSTRUMENTATION

7.6.1 Desiqn

Basis The in-core instrumentation is designed to yield information on the neutron flux distribution and fuel assembly outlet temperatures at selected core locations. Using the information obtained from the in-core instrumentation system, it is possible to confirm the reactor core design parameters and calculated hot channel factors. The system provides means for acquiring data and performs no operational plant control.7.6.2 System Design The in-core instrumentation system consists of thermocouples, positioned to measure fuel assembly coolant outlet temperature at preselected locations; and flux thimbles, which run the length of selected fuel assemblies to measure the neutron flux distribution within the reactor core.The data obtained from the in-core temperature and flux distribution instrumentation system, in conjunction with previously determined analytical information, can be used to determine the fission power distribution in the core at any time throughout core life. This method is more accurate than using calculational techniques alone. Once the fission power distribution has been established, the thermal power distribution and the thermal and hydraulic limitations determine the core capability and maximum power output.The in-core instrumentation provides information which may be used to calculate the coolant enthalpy distribution, the fuel burnup distribution, and an estimate of the coolant flow distribution. Both radial and azimuthal symmetry of power may be evaluated by comparing the detector information from quadrant to quadrant.Thermocouples Chromel-alumel thermocouples are passed through into guide tubes that penetrate the reactor vessel head through seal assemblies, and terminate at the exit flow end of the fuel assemblies. The thermocouples are provided with two primary seals, a conoseal and swage type seal from conduit to head. The thermocouples are enclosed in stainless steel sheaths within the above tubes to allow replacement if necessary. Thermocouple readings are obtainable via the plant computer and at a manually selected display unit in the control room. The support of the thermocouple guide tubes in the upper core support assembly is described in Chapter 3.Moveable Miniature Neutron Flux Detectors Mechanical Configuration Six fission chamber detectors (employing U 3 0 8 , which is 93 percent enriched in U 2 3 5) can be remotely positioned in retractable guide thimbles to provide flux mapping of the core. Maximum chamber dimensions are 0.188-inch in diameter and 2.10 inches in length. The stainless steel detector shell is welded to the leading end of the helical wrap drive cable and the stainless steel sheathed coaxial cable. Each detector is designed to have a minimum thermal neutron.sensitivity of 1.5 x 1017 amps/nv and a maximum gamma sensitivity of 3 x 1014 amps/R/hr. 96 of 108 IP3 FSAR UPDATE Maximum thermal neutron flux for these detectors is 5 x 1013 nv. Other miniature detectors, such as gamma ionization chambers and boron-lined neutron detectors, can also be used in the system. The basic system for the insertion of these detectors is shown in Figures 7.6-2 to 7.6-4. Retractable thimbles into which the miniature detectors are driven are pushed into the reactor core through conduits which extend from the bottom of the reactor vessel down through the concrete shield area and then up to a thimble seal zone.The thimbles will be closed at the leading ends, are dry inside, and serve as the pressure barrier between the reactor water pressure and the atmosphere. Mechanical seals provided on the retractable thimbles and on the conduits are shown on Figure 7.6-4.During reactor operation, the retractable thimbles are stationary. They are extracted downward from the core during refueling to avoid interference within the core. A space above the seal line is provided for the retraction operation. The drive system for the insertion of the miniature detectors consists basically of six drive assemblies, six 5-path rotary group selector assemblies and six 10-path rotary selector assemblies, as shown in Figures 7.6-2 and 7.6-3. The drive system pushes hollow helical-wrap drive cables into the core with the miniature detectors attached to the leading ends of the cables and small diameter sheathed coaxial cables threaded through the hollow centers back to the ends of the drive cables. Each drive assembly generally consists of a gear motor which pushes a helical-wrap drive cable and detector through a selective thimble path by means of a special drive box and includes a storage device that accommodates the total drive cable length.Further information on mechanical design and support is described in Chapter 3.Control and Readout Description The control and readout system provides means for inserting the miniature neutron detectors into the reactor core and withdrawing the detectors at a selected speed while plotting a level of induced radioactivity versus detector position. The control. system consists of two sections, one physically mounted with the drive units, and the other contained in the control room. Limit switches in each path provide, feedback of path selection operation. Each gear box -drives an encoder for position feedback. One 5-path group selector is provided for each drive unit to route the detector into one of the flux thimble groups. A 10-path rotary transfer assembly is a transfer device that is used to route a detector into any one of up to ten selectable paths.Manually operated isolation valves allow free passage of the detector and drive wire when open, and prevents steam leakage from the core in case of a thimble rupture, when closed. A common path is provided to permit cross calibration of the detectors. The control room contains the necessary equipment for control, position indication, and flux recording. Panels are provided to indicate the core position of the detectors, and for plotting the flux level versus the detector position. Additional panels are provided for such features as drive motor controls, core path selector switches, plotting and gain controls. A "flux-mapping" consists, briefly, of selecting (by panel switches) flux thimbles in given fuel assemblies at various core quadrant locations. The detectors are driven or inserted to the top of the core and stopped automatically. A x-y plot (position vs. flux level) is initiated with the slow withdrawal of the detectors through the core from top to a point below the bottom. In a similar manner other core locations are selected and plotted.The system that will be used to monitor the distribution of power in the X-Y plane is described in WCAP-7669, "Topical Report -Nuclear Instrumentation System." 97 of 108 Program Hemyc (I-Hour) and ]\ItT. Fire Protective \Vrap Performance January I Purpose and Scope Section 50.48, "Fire Protection," of 10 CFR Part 50 requires that each operating nuclear power plant have a fire protection plan that satisfies General Design Criterion 3 of Appendix A to 10 CFR Part 50. Section 50.48 also requires that all plants with operating licenses issued prior to January 1, 1979, satisfy the requirements Sections of III.G, IILJ, and 111.0 of Appendix R to 10 CFR Part 50. (Post 1979 plants (per 10 CFR Part 50.48) have to comply with the provisions of their licenses.) Section III.G of Appendix R, which addresses fire protection of safe shutdown capability, requires that fire protection features be provided such that one train of systems necessary to achieve hot shutdown conditions remains free of fire damage. One acceptable means of satisfying this requirement is to separate cables and equipment and associated non-safety circuits of redundant systems necessary to achieve and maintain hot shutdown conditions located in the same fire area by a fire barrier having a 3-hour fire rating (Section III.G.2.a). Another means is to enclose cables and equipment and associated non-safety circuits of one redundant train in a fire barrier having a 1-hour fire rating and install fire detectors and an automatic fire suppression system in the fire area (Section III.G.2.c). The scope of this document is to describe the overall program for investigating the fire protection rating of Hemyc (1-hour) and M.T. (3-hour) fire wraps. The primary approach will be to perform a series of ASTM E 119 furnace tests on a number of cable raceway types that are wrapped in either the Hemyc (with or without air gaps) or M.T. fire barrier material. The Hemyc wrap tests will be performed for a period of 60-minutes each, followed by a hose stream test and post-test visual inspection of the fire wrap. The M.T. test will be similar with the principal difference being that it will be conducted for a period of 3-hours. A description of these tests and of the overall approach are provided below. 2 Objective The objective of this program is to assess the fire protection rating of Hemyc and M.T. fire protection wraps by subjecting various test specimens (conduit, cable trays, cable drops, condolets (access fittings), junction boxes, and raceway support structure analogues) that are enclosed within the wraps to standard temperature-time conditions as specified in NFPA 251 and ASTM E 119. The types and characteristics of the wraps enclosing the test specimens are intended to simulate as-installed configurations. A secondary objective of these tests is to assess the ability of Rockbestos Surprenant Firezone R fire rated cables to withstand the ASTM E 119 time-temperature environment. 3 Fire Protective Wrap Performance Testing Program Plan Ii[6103 Approach The following sections describe the test specimens and the test conditions to be employed for the performance assessments of the Hemyc and M.T. fire barrier systems. 3. L Test specimens The principal test specimens will include a variety of cable raceway types covered with either the Hemyc 1-hour fire wrap or M.T. 3-hour wrap. In one test, the test specimens will be wrapped with Hemyc fire barrier material directly (i.e., without air gaps). The test specimens in the second test will be enclosed in Hemyc wrap that is framed with structural supports to provide a 5-cm (2 in.) air gap between the wrap and the raceway. For the third test, the test specimens (conduits, condolets, a cable drop and junction box) will be covered with the M.T. fire barrier wrap and subjected to a 3-hour ASTM E 119 furnace exposure. A conduit and condolet LB (an "L" shaped conduit fitting with the access cover on the back, "B") assembly, direct wrapped in Hemyc fire barrier material and a number of support structure specimens directly wrapped with Hemyc material will also be included in the three-hour test, as will three Rockbestos Surprenant Firezone R cables that will be supported in an unwrapped cable tray. The types of test specimens and the configurations of the fire barrier material wrapping selected for these tests are based principally on the application usage information provided to the NRC/NRR by industry (Letter: Emerson, NEI, to Frumkin, NRC/NRR, "Promatec Hemyc Hour and MT 3-Hour Fire Barrier Systems," December 28, 2001 and via letter: Marion, NEI, to Hannon, NRC/NRR, "Comments on NRC Hemyc Test Plan," December 6,2002). The testing of the Hemyc wrapped conduit/box assembly during the three-hour test run is being conducted in order to gain some additional data regarding the Hemyc material's performance beyond the one-hour time-temperature exposure conditions. The testing of empty raceways is intended to provide bounding qualification of the protective material performance under standard test conditions. For example, items of larger thermal mass should be bounded by these tests. Also, this method is per NRC guidance and represents current staff positions on bounding test approaches. Additionally, it is also intended that the assembly and installation of the Hemyc and M.T. fire barriers will be done in accordance with the vendor's specifications and meet all required vendor quality standards. The test specimens will include the following items: A 27-mm (1 in.) steel conduit arranged in a modified "U" configuration such that one vertical leg and one end of the horizontal span of the conduit intersect at a condolet LB access fitting, forming a right angle, while the other end of the horizontal span transitions to the second vertical leg via a conduit radius bend or elbow. A 63-mm (2Y:! in.) steel conduit arranged in a modified "U" configuration such that one vertical leg and one end of the horizontal span of the conduit intersect at a condolet LB access fitting, forming a right angle, while the other end of the horizontal span will transition to the second vertical leg by means of a conduit radius bend or elbow. A 103-mm (4 in.) steel conduit arranged in a modified "U" configuration such that one Fire Protective Wrap Performance Testing Program Plan I.l6/03 vertical leg and one end of the horizontal span of the conduit intersect at a 30 cm x 61 cm x 25 cm (12" x 24" x 10") steel junction box, forming a right angle, while the other end of the horizontal span will transition to the second vertical leg through a conduit radius bend or elbow in one of the one-hour tests. For the three-hour test, the large diameter (1 03-mm) conduit will be coupled to the junction box at the mid-point of its horizontal span to allow a cable drop to intersect the top of the box from the furnace ceiling. In that test the sharp right angle transition will employ a large condolet LB fitting while the other horizontal-to-vertical transition will be made by means of a radius bend or elbow. A 305-mm (12 in.) wide steel ladder-back cable tray. The cable tray will be constructed in a modified "U" configuration such that one vertical leg and one end of the horizontal span of the conduit intersect at a right angle, while the other end of the horizontal span will transition to the second vertical leg by means of a tray vertical curve. A 610-mm (24 in.) wide steel ladder-back cable tray. The cable tray will be constructed in a modified "U" configuration such that one vertical leg and one end of the horizontal span of the conduit intersect at a right angle, while the other end of the horizontal span will transition to the second vertical leg by means of a tray vertical curve. A 914-mm (36 in.) wide steel ladder-back cable tray. The cable tray will be constructed in a modified "U" configuration such that one vertical leg and one end of the horizontal span of the conduit intersect at a right angle, while the other end of the horizontal span will transition to the second vertical leg by means of a tray vertical curve. Two short cable drops: one consisting of a single 8 AWG bare copper wire and the other being a 250 kcmil bare copper wire. Four separate support structure test elements consisting of four different cross sections (threaded rod, Unistrut, angle iron and square tube) formed into a right angle CL") configuration and partially covered by the Hemyc material. These structures are being included in the test program to evaluate the magnitude of heat transmission along their wrapped length and the possible thermal coupling effect on any supported assemblies. In addition, three Rockbestos Surprenant Firezone R cables will be subjected to the furnace environment during the three-hour test in order to evaluate their ability to withstand the ASTM E 119 time-temperature profile. One each of a power (3 conductor), control (5 conductor) and instrument (2 conductor) type cables will be tested. These cables will be placed and secured in a separate, unwrapped 305-mm (12 in.) wide ladder-back cable tray during the three-hour test. During the test, the insulation resistance (IR) between the individual conductors to all of the other conductors in the Firezone R cables, and the IR between the individual conductors and electrical ground will be monitored continuously during the test using the Sandia Insulation Resistance Measurement System. The 305-mm steel cable tray supporting the three Firezone R cables will be electrically isolated from the other raceway test specimens. Each of the fire protection wrapped cable raceway test specimens will be tested without any cables routed through them. A bare #8 copper conductor, instrumented with thermocouples along its length, will be routed through each of the raceway test specimens. The thermocouples will be attached to the bare copper conductor at 150-mm (6 in.) spacing 3 Fire Protedive Wrap Performance Testing Program Plan l/ l6/03 intervals. Additional thermocouples will be attached to the outer surfaces of the conduit test specimens and along the length of both side rails of the cable tray test specimens at 150-mm intervals. The protective wrap at one end of each conduit test specimen will be flared and attached to the furnace ceiling interface. The opposite end of these conduit test specimens will be insulated with fiber filler inside and around the outside wall at the ceiling interface. Likewise, the protective wrap at the top of all cable drops will be flared around the furnace ceiling penetration while the cable drop interface with other test specimens (tray or junction box) will not be flared. Table 1 presents the test conditions to be investigated in terms of fire wrap type and configuration of each of the test specimens during each test. Note that no conduits will be tested in the air gap framed configuration and that no trays will be tested with M.T. wrap. Also, the support structure specimens will be protected only with direct wrap Hemyc material in the tests using both 38-mm (1:h in.) and 50-mm (2 in.) thicknesses. In addition, a 27-mm (1 in.) conduit and condolet LB assembly, wrapped with Hemyc fire wrap will be included in the hour test. Table 1 Test Matrix Test 1 Test 2 Test 3 Hemyc (1-Hour Direct Wrap) Hemyc (Framed for Air Gap) M.T. (3-Hour Direct Wrap) 27-mm Conduit X (Not included) X* 63-mm Conduit X (Not included) X 103-mm Conduit X (Not included) X 305-mm Tray X X (Not included) 610-mm Tray X X (Not included) 914-mm Tray X X (Not included) 8 AWG Cable Drop X X X 250 kcmil Cable Drop X X (Not included) Junction Box X X X Support Structures X (Hemyc direct wrap) (Hemyc direct wrap) ! Firezone R Cables (Not included) (Not included) (No protective wrap)

• Test 3 will also include a separate 27-mm conduit test specimen direct wrapped in Hemyc material.

A detailed construction plan for each of the test specimens will be developed. The plan will 4 Fire Protective Wrap Performance Testing Program UI6/03 define the specific details of the design and assembly of each test specimen and the installation of the designated fire wrap. Drawings and descriptions of the dimensions and setup configurations in the furnace and instrumentation details will also be provided. The fabrication and installation of the fire protective wraps will conducted be in accordance with vendor procedures and provisions will be made to verify that all material/installation quality requirements are met. The detailed construction plan is expected to be distributed as an appendix to the final test plan. Following the completion of the detailed construction plan and final test plan the required materials and equipment will be procured. The type of material and equipment obtained will include cables, raceways (conduit, trays, condolets, and junction boxes), metal to fabricate the support structure specimens, Hemyc and M.T. fire barrier wrap assemblies, framing material for the fire barrier wraps, thermocouples and extension wire, miscellaneous hardware (nuts, bolts, screws, etc.) plus spare parts. The test specimens will be assembled in accordance with the detailed construction plan as the material and equipment are obtained. The process will include the installation of the thermocouples to the outer surfaces of the test specimens and checkout for proper operation prior to the installation of the fire barrier wraps. It is possible that assembly checklists will be developed for each of the test specimens and included as part of the final test plan. The fire barrier wraps will be installed around the test specimens per the manufacturer's procedures. Photographs of the test specimens, both during and after assembly, will be taken prior to testing and kept as part of the test documentation. Test criteria The test specimens will be subjected to the ASTM E 119 time-temperature profile in the test furnace. An assessment of the fire barrier wrap performance will be based on two principal factors: The time at which the average unexposed side temperature of the fire barrier system, as measured on the exterior surface of the raceway or component, exceeds 139 C (250 F) above its initial temperature. Or the time at which a single temperature reading of a test specimen exceeds 30% of the maximum a{{owable temperature rise (i.e., 181 C [325 FJ) above its initial temperature. The fire barrier system remains intact during the fire exposure and water hose stream test without developing any openings through which the cable raceway is visibfe. Test facilities A Request for Proposal will be distributed soliciting bids on providing test services for the primary test series. Included in the RFP will be a discussion of the scope of the tests, specific 5 Fire Prote{.:tive \Vrap Performance Testing Program Plan l/l6/03 tasks to be performed, and furnace requirements. Desirable facility support capabilities will include the availability of a test specimen assembly area, data acquisition interfaces for the test specimen thermocouples, providing photo/video records of the test specimens and tests, and a summary report/documentation of the conduct of each test. Upon receipt of the proposals, they will be evaluated against the predetermined selection criteria until two finalists are left. It is expected that site visits will be made by SNL and/or NRC representatives to evaluate the specific capabilities and furnace dimensions to be incorporated into the detailed construction plan. Based on the results of these visits a finalist will be chosen and a contract will be negotiated and placed. 3.4 Primary tests Three separate test runs will be conducted as part of the primary test series. Two of the tests will test the performance of 1-hour Hemyc fire barrier wrap systems and the third test will assess the performance of 3-hour M.T. fire barrier wrap. All of the primary tests will be conducted using the ASTM E 119 standard time-temperature furnace profile (Figure 1). As indicated above, these tests will be governed by the conditions provided in a formal test plan. Initially, a draft test plan will be written for review and comment by NRC. Then the final test plan, incorporating the changes directed by NRC, will be issued. The test specimens will consist of those items described in Section 3.1 , Test Specimens, above. The specific setup and configuration for each test is discussed below. It should be noted, however, that the test conditions and configurations described below assume the availability and use of a floor furnace of specific dimensions; based on the outcome of the testing services solicitation and contracting process, certain details may require modification. 3.4.1 Test #1 The first test of the primary test series will be conducted on eleven test specimens directly wrapped with Hemyc fire barrier blankets (Le., without framework to provide air gaps between the wrap and raceways}. The nominal thickness of the protective blankets will be 38 mm (1 Yz in.) for the cable trays and 50 mm (2 in.) for the conduit and cable drops. One of the support structure specimens will be wrapped with a 38 mm thick Hemyc blanket and the other with a 50 mm thick blanket. Figure 2 shows the planned configuration of the test specimens inside the furnace. Looking at the elevation and plan views in the figure, the arrangement of the test specimens is as follows (from left to right): The 27-mm (1 in.) conduit and condolet LB the 305-mm (12 in.) wide cable tray with the small (8 AWG) cable drop entering two support structures (both formed out of threaded the 61 O-mm (24 in.) wide cable tray with the large (250 kcmil) cable drop entering 6 1./16/03 Fire Protective Wrap Performance Testing Program Plan the 103-mm (4 in.) conduit and 30 cm X 61 cm X 25 cm (12" x 24" x 10") junction the 914-mm (36 in.) cable tray, the 63-mm in.) conduit and condolet LB This arrangement of the test specimens was selected in order to minimize the potential for one specimen to influence the response of another specimen to the thermal environment. Note that one end of each conduit test specimen has its protective wrap flared around the furnace ceiling penetration. The conduit and cable trays will be supported from the furnace ceiling in a modified au" configuration. Each tray and conduit will include one sharp 90-degree transition from the horizontal span to one of the vertical legs. At the other transition point a radius bend will be used. In the case of the conduit test specimens, a condolet fitting or junction box will be employed to provide the right angle transition from horizontal to vertical. The cable trays will be modified and assembled to accommodate the right angle turn. The two vertical runs of these test articles will be approximately 0.6 m (24 in.) along each leg and the horizontal span will be -1.4 m (54 in.). Other test specimens will include two cable drop bundles and support structure analogues. A direct wrap cable bundle (250 kcmil bare copper wire) will be dropped through the top of the furnace and join the 610-mm (24 in.) cable tray at its mid-point. Similarly, a smaller (8 AWG bare copper wire) direct wrapped cable bundle will be dropped through the top of the furnace and join the 305-mm (12 in.) cable tray at its mid-point. The two partially direct wrapped support structure test specimens will be hung from the top of the furnace. The temperature data collected from these articles will be used to evaluate the potential transmission of heat alol1g the wrapped portion of the specimens. The minimum distance from the furnace walls and the test specimens will be 30 cm (12 in.) and the minimum distance between adjacent test specimens will be -33 cm (13 in.). 3.4.2 Test #2 The second primary test will be conducted on twelve test specimens, six of which will be wrapped with Hemyc fire barrier blankets and employing the necessary framework to provide a minimum of 50-mm (2 in.) air gaps between the wrap and item. The nominal thickness of the protective blankets will be 38 mm (11h in.). This test will also include six support structure test specimens, directly wrapped in the Hemyc fire barrier material without employing the 50-mm air gap. Three of the support structure specimens-one of each cross section-will be covered with a 38-mm (11h in.) thick Hemyc wrap and the remaining three will be covered with a 50-mm (2 in.) thick wrap. The planned arrangement of the test specimens in the furnace during Test #2 is shown in Figure 3. Looking at the elevation and plan views in the figure, the arrangement of the test specimens is as follows (from left to right): The 305-mm (12 in.) wide cable tray with the small (8 AWG) cable drop bundle entering from above, 7 Fire Protective Wrap Performanee Testing Program Plan l/l6/03 two support structures made of tube steel with 75 mm x 75 mm square cross the 610-mm (24 in.) wide cable tray with the large (250 kcmil) cable bundle from two support structures made of the 30 cm x 61 cm x 25 cm (12" x 24" x 10") junction two support structures made of angle iron, the 914-mm (36 in.) cable This arrangement of the test specimens was selected in order to minimize the potential for one specimen to influence the response of another specimen to the thermal environment. As was the case for Test #1, the cable trays will be supported from the furnace ceiling in a modified "U" configuration. Each tray and conduit will include one sharp 90-degree transition from the horizontal span to one of the vertical legs. At the other transition a radius bend will be used. The cable trays will be modified and assembled to accommodate the right angle turn. The two vertical runs of these test articles will be approximately 0.6 m (24 in.) along each leg and the horizontal span will be -1.3 m (50 in.). The junction box will be supported from the furnace ceiling by two Unistrut channels that are hung on four threaded rods. These junction box supports will be directly wrapped with Hemyc material separately from the box. (Note that the junction box supports are not considered as part of this test and will not be instrumented; however any failure in their performance during the test will be noted and investigated as deemed appropriate.) A wrapped (250 kcmil bare copper wire, with air gap) cable bundle will be dropped through the top of the furnace and join the 610-mm (24 in.) cable tray at its mid-point. Another wrapped cable bundle (8 AWG bare copper wire, with air gap) will be dropped through the top of the furnace and join the 305-mm (12 in.) cable tray at it mid-point. The partially direct wrapped support structure test specimens will be hung from the top of the furnace. The temperature data collected from these articles will be used to evaluate the potential transmission of heat along the wrapped portion of the specimens. The minimum distance from the furnace walls and the test specimens will be 30 cm (12 in.) and the minimum distance between adjacent test specimens will be -25 cm (10 in.). 3.4.3 Test #3 The final test of the primary test series will be conducted on eleven test specimens, five of which will be wrapped with M.T. 3-hour fire barrier blankets but without any framework to provide air gaps between the wrap and raceway. The nominal thickness of the M.T. protective covering will be -76 mm (3 in.). In addition, four structural support specimens, partially wrapped in 38-mm (1 Y2 in.) thick Hemyc wrap (direct wrapped), and one 27-mm (1 in.) conduit/pull box enclosed in Hemyc wrap, also direct wrapped, will be included in the third test. Three Rockbestos Surprenant Firezone R cables will be supported in an unwrapped 305-mm (12 in.) wide steel ladder back cable tray inside the furnace for this test. These cables will be continuously monitored for changes in their insulation resistance (conductor-to-conductor and 8 Fire Protective Wrap Performance Testing Program Plan 11[6/03 conductor-ta-ground) during the three hour long test. Figure 4 shows the configuration of the test specimens in the furnace during Test 3. Looking at the elevation and plan views in the figure, the arrangement of the test specimens is as follows (from left to right): The 27-mm (1 in.) conduit and condolet LB assembly, wrapped in M.T. two support structures (one 75 mm x 75 mm square cross section tube steel and angle iron), directly wrapped in Hemyc the 103-mm (4 in.) conduit and 30 cm x 61 cm x 25 cm (12" x 24" x 10") junction assembly, wrapped in M.T. material with a small cable bundle, also wrapped with entering at the top of the junction two support structures ( one Unistrut channel and one threaded rod), directly with Hemyc the 63-mm (21;j in.) conduit and pull box assembly, wrapped in M.T. one 27-mm (1 in.) conduit and pull box, directly wrapped in Hemyc material; the unprotected 305-mm (12 in.) cable tray containing the three Firezone R test As in the ather two tests, the conduit assemblies will be supported from the furnace ceiling in a modified "u" configuration. Each conduit will include one sharp 90-degree transition from the horizontal span to one of the vertical legs and a radius bend will be used for the other transition. A condolet fitting will be employed to provide the right angle turn. The two vertical runs of these test articles will be approximately 0.6 m (24 in.) along each leg and the horizontal run will be -1.3 m (50 in.). One end of each conduit assembly will have its protective wrap flared at the furnace ceiling interface. No cable trays are included as test specimens for this test. The four partially protected (direct Hemyc wrap only-no air gap) support structure test specimens will be hung from the top of the furnace in between the other test specimen groups. The unwrapped 305-mm (12 in.) cable tray will be supported from the furnace ceiling in a "u" configuration. This tray is being employed only to support the fire resistant Rockbestos cables, thus the tray will not include any sharp horizontal-to-vertical transitions. The purpose for including these Firezone R cables in the test is to determine their ability to withstand the ASTM E 119 temperature conditions. The minimum distance from the furnace walls and the test specimens will be 30 cm (12 in.) and the minimum distance between adjacent test specimens will be 45 cm (18 in.). 3.5 Conduct of tests Each of the primary test runs will be conducted by exposing the test specimens to the temperature profile as specified in ASTM E 119, Standard Test Methods for Fire Tests of Building Construction and Materials. By this method, the temperature inside the furnace should reach 927 C (1700 F) at the end of the one-hour tests and 1052 C (1925 F) at the end of the hour test. Figure 1 shows the desired temperature profile as a function of time. 9 Fire Protective Wrap Performance Testing Program Plan l/l6i03 The insulation resistance of the three Rockbestos Surprenant Firezone R cables will be monitored during the three-hour test. The insulation resistance of each conductor in the test cable to the other conductors in the cables as well as the insulation resistance between each conductor in the test cables to ground will be recorded as a function of time using the Sandia Insulation Resistance Measurement System. A single-phase 120 VAC source will be applied to each conductor in turn while leakage currents generated in the other conductors is monitored and logged. Peak leakage currents will be limited to 1 A or less. The cable tray supporting the Firezone R cables will be connected to electrical ground. Upon completion of each ASTM E 119 temperature run (one-and three-hours), the furnace will be opened (or the complete test assembly will be removed from the furnace) and a hose stream will be appiied to all of the test articles. The hose stream test will consist of a water stream applied at random to all exposed surfaces of the test specimens through a 38-mm (1 Yz in.) fog nozzle set at a discharge angle of 15 degrees with a nozzle pressure of 517 kPa (75 psi) at a minimum discharge rate of 284 Ipm (75 gpm) with the tip of the nozzle at a maximum distance of 3 m (10 ft) from the test specimen. The hose stream application will be continued for at least 5 minutes upon completion of the test. A visual inspection of all test articles will be conducted following the hose stream test. The purpose of the inspection will be to ascertain whether the fire barrier wraps remained intact during the fire exposure and hose stream test without developing any openings or breaches. Visible indications of an opening will include obvious tears or displacement of a wrap section or a view of the covered raceway through the wrap. Photographs of the test specimens, both prior to and after disassembly, will be taken during the post-test inspection and kept as part of the test documentation.

3.6 lnstrumentation

and data collection The primary data to be generated in these tests will be component temperatures as indicated by Type-K thermocouples. Test #1 will require the use of -340 thermocouples and Test #2 will require -240 thermocouples. Approximately 270 thermocouples will be needed for Test #3. The outputs of the thermocouples will be sent to a computerized data collection unit for recording and storage. Each thermocouple's output will be recorded at least once per minute. It is expected that Teflon coated thermocouples will be used during the M.T. test (Test #3) to ensure that there will not be interference from any gases evolving from the protective wraps. Figures 5-12 show the preferred attachment locations of the thermocouples on the conduit, trays, cable drops, junction box and support structure test specimens during the three tests. Routing the thermocouples for monitoring the tray temperatures will be by laying the bundles in the tray at the entry point and branching the thermocouples off for attachment to the tray rails and bare copper conductor at the appropriate locations. Similarly, for the cable drop thermocouples, the thermocouples will be bundled with the cable drop cables at the pOint of entrance on the ceiling of the furnace and branching off the thermocouples for attachment to the bare copper conductor wire at the appropriate points. Each conduit will have thermocouples attached to the outer surface located along the outside lO Fire Protective Wrap Performance Testing Program Plan II 16/03 perimeter of the "U" shape (see Figures 5, 7 , 9 and 12). The routing of thermocouples for monitoring the temperature of the conduit will require that a series of small thermocouple bundles be placed around the circumference of the conduit and run to their individual attachment locations between the conduit and fire wrap. In order to minimize the effect of these small bundles on the test results, the conduit thermocouples will be run in underneath the wrap from both ends of the test specimen. In addition, the bare copper wires routed through the interior of the conduit test specimens will also be instrumented with thermocouples. The junction boxes and condolet fittings will have at least one thermocouple attached to each side (6 in all) located at or as closely as possible to the geometric center of the side walls. The reader should note that the thermocouple locations indicated in these figures are for information purposes only. The thermocouples will be installed at 150-mm (6 in.) intervals along the conduits, cable tray rails, condolets, junction boxes, and bare #8 copper wires in accordance with the guidance provided in Supplement 1 to Generic Letter (GL) 86-10 and Regulatory Guide (RG) 1.189. The Sandia Insulation Resistance Measurement System will be used to monitor the changes in insulation resistance occurring within the Rockbestos Surprenant Firezone R cables during Test 3. The concept of the SNL IR measurement system is based on the assumption that if one were to impress a unique signature voltage on each conductor in a cable (or cable bundle), then by systematically allowing for and monitoring known current leakage paths, it should be possible to determine if leakage from one conductor to another, or to ground, is in fact occurring. That is, part or the entire voltage signature may be detected on any of the other conductors in the cable (or in an adjacent cable), or may leak to ground directly. To illustrate, consider a three-conductor (3/C) cable, as illustrated in Figure 13. If 100 V are applied to Conductor 2, the degree of isolation of Conductors 1 and 3 from Conductor 2 can be determined by systematically opening a potential conductor-to-conductor current leakage path and then reading the voltages of each conductor in turn while Conductor 2 is energized. Determining the IR between Conductors 1 and 2 at the time of voltage measurement on Conductor 2 is a simple calculation employing Ohm's law. The calculation of the three resistances for each conductor pair (one conductor-to-conductor path and each of the two conductor-to-ground paths) requires the measured voltages (Vi and Vj) for two complementary switching configurations. For example, the complement for the case illustrated in Figure 13 is shown in Figure 14. As illustrated in Figure 13, Conductor 2 is connected to the input side and conductor 3 is connected to the measurement side. The complementary case shows Conductor 3 on the input side and Conductor 2 on the measurement side, as shown in Figure 14. This complementary pair provides four separate voltage readings that can be used to determine the three resistance paths affecting these two conductors; namely, R Z*3' R 2_G , and R 3-G. This concept is scalable for virtually any number of conductors in a cable or bundle of cables. Another advantage is that only the two voltage measurements for each switching configuration need to be recorded in real time; determining the resistances can be deferred until after the test is completed. It Fire Protedive Wrap Performance Testing Program Plan l/l603 Employing this method to monitor the changes in insulation resistance of the individual conductors in the Firezone R cables during the furnace test will provide sufficient data to determine the degree, if any, of cable degradation. In addition, this method is able to identify the indications of insulation resistance recovery (e.g., healing) as the temperature of the furnace is decreased following the test period. Since the Sandia IR measurement system presently exists and has been demonstrated previously the cost impact to the program to include the Firezone R cables' IR measurements is expected to be small. 3.7 Follow-on tests The decision to plan and conduct follow-on tests will be made on the basis of the primary test results. 4 Reporting and Documentation The test data will be analyzed and the fire barrier performance will be evaluated based on the acceptance criteria. A test report will be submitted to NRC that will include recommendations, if any, for follow-on testing. It should be recognized that the possibility exists that these test results may form the technical basis for broad acceptance of these fire protection systems by NRC, or provided the basis for enforcement action or backfit requirements, as deemed appropriate. 5 Recommendation for Research Enhancements The appendix to this document proposes several modifications to this plan that would enhance the quality of these tests for research purposes. These suggestions are based in large measure on comments received from industry (letter: Marion, NEI, to Hannon, NRC/NRR, "Comments on NRC Hemyc Test Plan," December 6, 2002) on the previous draft of this program plan. l2 Fire Protective \Vrap Performance Testing Program Plan [/l6/03 Temperature-Time Curve 1200 -2000 1000 -U 800 -LL--(1J (1J -1200 :::::I res 600 -res :::::I (1J (1J c. c. i*********t E E (1J (1J I--800 400 o o 1 2 3 Time (hr) Figure 1: Excerpt of the Standard Time-Temperature Curve (based on data provided in ASTM E 119), [3 Fire Protective Wrap Performance Testing Program Plan l1[6/OJ End View Elevation View -f ....:--'"' '=' . '--' -: 71111 >=< ml Plan View 0 r==i @ 0 @ bd @ Figure 2: Test Specimen Layout for Test 1. 14 1116/03 Fire Protective Wrap Perforrrumcc Testing Program Plan End View Elevation View I j '. LJ ro I 'L. I u <-= -01 i I ******-2.1 ..,;*--*-------------***--5_5 m( Plan View III I II ------'---L...- ___________________

---

I Figure 3: Test Specimen Layout for Test 2. 15 fire Protective Wrap Performanee Testing Program Plan l/ 16/03 End View Elevation View Plan View 2. t 7'1 @) Figure 4: Test Specimen Layout for Test 3. \'ote that the shaded elements represent the test specimens protected with the M.T. fire wrap. Unshaded elements are enclosed in Hemyc fire wrap. The Firezone R fire rated cables win be installed in an unprotected, open cable tray. 16 Fire Protective Wrap Performance Testing Program Plan UI6i03 Furnace Ceiling Figure 5: Planned Thermocouple Locations on 27-mm (1 in.) ConduitlCondolet LB Test Specimens.

Note that at least one thennocouple will be attached to each face of the condolet fitting. A single bare copper wire (8 A WG) will be instrumented with themlOcouples and routed inside the test specimen. 17 Fire Protective Wrap Perfonnance Testing Program Plan lil6iOJ Q..2 a Figure 6: Planned Thermocouple Locations on the 305-mm (l2 in.) and 610-mm (24 in.) Cable Tray Test Specimens during Tests #1 and Note that the locations indicated reflect relative positions on each tray side rail and on the bare 8 A WG copper wire attached to the tray nmgs. Also, note that the cable drop will consist of a bare 250 kcmil (61 O-mm tray) or a 8 A WG (305-mm tray) copper wire to which the thermocouples are attached. 18 Fire Protective Wrap Performance Testing Program Plan II 16/03 'TEL 7 Furnace Ceiling Plane iTE' ,--J Figure 7: Planned Thennocouple Locations on the 103-mm (4 in.) Conduit and Junction Box Assemblies during Test #1. Note that a thennocouple will be attached to each face of the junction box (6 total), A single bare copper wire (8 A WG) will be instrumented with them10couples and routed inside the test speCimen. [9 Fire Protective Wrap Performance Testing Program Plan l! 16/03 Furnace Ceiling Plane '-./ J, .'\ .' ',,-_/I I erE}ITE; (TEl \f§; !§ (TE; ,TE, '"..../.7 '_.7 Figure 8: Planned Thermocouple Locations on the 9l4-mm (36 in.) Cable Tray Test Specimens. Note that the locations indicated reflect relative positions on each tray side rail and on the bare 8 AWG copper wire attached to the tray rungs. 20 Fire Protective Wrap Performance Testing Program Plan lI16/OJ Furnace Ceiling Figure 9: Planned Thermocouple Locations on the 63-mm (2V2 in.) Conduit/Condolet LB Test Specimens. Note that at least one thermocouple will be attached to each face of the condo let LB fitting. A single bare copper wire (8 AWG) will be instrumented with thermocouples and routed inside the test speclmen. 2l Fire Protective Wrap Performance Testing Program Plan lIl6/03 Furnace Ceiling Plane Approximate outline of protective vvrap l' lfE) rT8 erE)'---/ '-_/ Figure 10: Planned Thennocouple Locations on the Partially Wrapped Support Structure Test Specimens. Fire Protective Wrap Performance Testing Program Plall [ il6!03 Threaded rod support hanger (Typ of 4) Unistrul R) support (Typ of 2) Figure ll: Planned Thermocouple Locations on the 30 cm x 61 cm x 25 cm (12 in. x 24 in. x lOin.) Junction Box during Test #2. A thennocouple will be attached to each face of the junction box (6 total). Fire Protective Wrap Perfonnance Testing Program Plan lJ 16103 Furnace Ceiling l.....Plane a --Q) ..-..Q co U Figure 12: Planned Thermocouple Locations on the I 03-mm (4 in.) Conduit and Junction Box/Cable Drop assemblies during Test #3. The cable drop will consist of a single bare copper wire (8 A WG) to which the thermocouples are attached. A thermocouple will also be attached to each of the six sides of the junction box. 24 Fire Protective Wrap Performance Testing Program Plan [/[6/03 : j Figure LJ: Sdlematie of the lnsulation Measuring Circuit Showing Potential Leakage Current Paths. Figure 14: Complementary [nsulation Measuring Circuit with Respect to the Circuit Shown in Figure 11. 25 Fire Protecti ve Wrap Performance Testing Program Plan [116/03 Research Program The. following items should be considered for inclusion in the test program to provide a research basIs for the planned tests. Many of these recommendations were provided by industry comments received via letter. 1 The following list of considerations were not included in the revised fire barrier performance testing program plan because they did not fit in well with the very limited objectives of the NRR program. However, they should be given consideration in broadening the scope and objectives of a RES program. Fire Barrier Performance Model Development -It would be beneficial to tailor the test program such that one principal outcome is the development of a mathematical model, based on the test data, that could estimate the expected performance of fire barriers that might differ from the tested configurations. The development of such a model would require a significant effort to include a variety of protected raceways so that the data and resulting model(s) would be applicable to a wide range of applications. ANI Test Protocols and Multiple versus Single Raceways -The ANI Test Protocals test using a 'one layer' cable fill and circuit continuity. The current test protocal only tests single raceways not multiple raceways. The variety of cables, circuit voltages and raceway configurations used in actual plant configurations is diverse, and it would be difficult to consider a representative sample of cables, circuit voltages and multiple raceways within the same wrap in this test's scope. Such tests (using cable loading, energized circuits and multiple raceways) would likely be useful in developing a model to estimate expected fire barrier performance (see above). Multiple Wrap Thicknesses -This test would test similar raceways in a variety of protective fire wrap thicknesses (e.g., 25-mm, 38-mm, 50-mm and 76-mm [1 in., 1 Yi in. 2 in. and 3 in.]). This test would provide a basis for assessing the effectiveness of a particular fire wrap based on applied thickness. Industry Review and Observation -Consideration should be given to the industry's request that they be allowed to review and comment on the final test plan and detailed test specimen construction plans. They have also requested to be invited to be present to observe the construction of the test specimens, installation of the fire barriers and the conduct of the tests. Such involvement by industry representatives would be useful in that any potentially controversial issues concerning the fire barrier performance tests will be identified early and can be resolved in a timely manner. I Letter: Marion, NEI, to Hannon, NRC!NRR, "Comments on NRC Hemyc Test Plan," December 6 2002. 26 301 Nuclear Facility Risk Analysis Risk Signit1cance of HEMYC" Electrical Raceway Fire Barrier System Failures Raymond H.V. Gallucci, Ph.D., P.E. u.s. Vuclear RegulatorI' Commission. MS 0-1 I A-II. Washington. D,C. Approximately fifteen U,S, nuclear power plants (NPPs) employ the HEMYC' Electrical Raceway Fire Barrier System (HERFBS) to protect circuits ll1 accordance with Nuclear Regulatory Commission (NRC) requirements [I], Recent testing via Standard E 119 [21 indicated failures to achieve a one-hour tire rating [3-5]. We present a scoping analysis of the potential risk signt tlcance. PROBAB[LlSnC MODEL FOR TEST RESULTS Failures resulting from shrinkage/tearing of the HERFBS covering were observed:::: 15 min into the hour test, suggesting the following probabilistic model: The HERFBS failure probability (P) for the E I 19 fire ranges from 0 at :510 min to I at ::::60 min, P is a function of the temperature "T" at time "f' or the area "A" at time "t" under the ASTM-E 119 curve, whichever is more severe. We linearized the ASTM-E 119 curve (Fig. I) and postulated failure thresholds of T 704°C and A = 4870 min-DC at t 10 min. i.e.: P(T[t}) (T[t] -704 )/(920 -7(4) (I) P(A[t]l (A[t]-4870)/(46470 4870) (2) where T 920°C and A 46470 min-oC at t = 60 min.b ANALYSlS FOR TYP[CAL NUCLEAR ,lOWER PLANT FlRES This papl?r was prepared by an employee of the l:.S. NRC. The views preo;ented do not represent an official staff Supporting material to; available in NRC ADAMS (Acces:iion "MLO:5lJOO(52). These failure temperatures refl?r to "furnace" tl?mperaturl?s. as per Standard ASTM-E 119. The HERFBS covl?ring hegins to shrink at surface temperatures arounu :::00 "c. but th\:! shrinkage,'tl;!aring apparl?ntly dOl?s not translate into HERFBS failure as defind by ASTM-E tl9 until tllrnace The HERFBS will not fail if T :5 704 "C, which bounds the temperatures reached by NPP fires where HERFBS is typically instatled. However, NPP fires can expose a HERFBS to sufficiently high temperatures for long enollgh times to exceed the threshold A = 4870 "C. -Fig, l shows a linearized CF AST" [6] simulation of an Emergency Diesel Generator (EDG) room oil fire with a rapid rise to T 390 uC at t 7.5 min and final T = 440 °c at t 60 min, where the threshold value for A occurs at t = 16 min. At t = 60 min. A = 23250 min-"C and peA) == 0.442 from Eq. (2). Assume an older NPP uses a HERFBS for safe shutdown cables in their EDG room to protect against an oi I fire.' with fast-acting smoke detection and action/deluge sprinkler suppression. Based on the Fire Protection Significance Determination Process (FPSDP) [7], a medium loading of cables. two general electrical cabinets and one EDG yield a fire frequency 4.8E-4iy (2)(6.0E-5/y) -'" 0.0056!y= 0.0062/y. Conservatively we choose the FPSDP's more limiting severity characteristics and manual suppression curves --"Indoor Oil-Filled Transformer" and "Turbine-Generator" (T-G) fires --as surrogates for an oil fire severe enough to fail the HERFBS. The FPSDP recommends a severity factor of 0.1. If we assume that the HERFBS damage fails any enclosed cables, it likely warrants nothing lower than 0.1 for conditional core damage probability (CCDP). We then express the core damage frequency (CDF) as 0.0062!y x 0.1 x 0.1 x peA) x PNS = 6,2 x peA) x Pi\iS, where PNS is the non-suppression probability. For CDF IE-6!y, we require peA) x PNS ::: 0.0 l6 d We expect rapid smoke detection; and. from the FPSDP, the non-suppression probability for the action/deluge sprinklers is essentially zero. since the time-If a plant w.:rl? to lose both offsite anu emergency onsite AC power due to :t fire in the EDG room (station blackout). it would have an alternate means in place to safely shut down. independICnt of the EDGs or any other equipment in the EDG room:;, "When the calculated increase in CDF : which cannot exceed the CDF itsel fi is very small ii,e.. I E-6/yr} the chunge will be consiuereu

acceptable:" [10]. This "very change" is typically accepted as a threshold for temperatures I;!xceeu 700 "C [8. low risk signiticance.

302 to-damage (at least 16 min) minus the time-to-suppression (within I min);;' 10 min. The FPSDP recommends a 0.05 unavailability for a deluge system, thereby requiring manual suppression by the plant fire brigade 50!, of the time. PNS for "'T-G" fires, including this unavailability, = 0.05exp([0.021 ][I'lt]). where 21t t is the difference between times-to-damage and detection. The product PCAl x PNS rises tl'om 0 at t 16 min to 0.00627 at t 60 min. Thus, it satisties peAl x PNS s: 0.016, yielding a maximum CDF = (6.2E-5iyr)(0.00627) = 3.9E-7/y. Sensitivity Case For sensitivity. we assumed that peT) and peA) inversely varied quadratically and quartically to represent a rapid rise in the probability of HERFBS failure, followed by a gradual increase. We then ealeulated the maxima for peA) x PNS and corresponding maximum CDFs shown in Table L Even under these conservative bounding assumptions, we essentially satisfy peA) x PNS :;0.016 forCDF lE-6!y. Other Nuclear Power Plant Fires The preceding analyses were repeated for two other typieal NPP fires, in an electrical switchgear room and make-up pump room. Each linearized CF AST" temperature curve, shown in I, is less severe than that f()r the EDG room fire. Table I summarizes these parallel analyses, each of which yields lower CDFs than its EDG room tire counterparts. CONCLUSIONS Within the assumptions of this analysis, which included conservatism from the FPSDP, the CDF due to recently indicated failures of the HERFBS appears to be bounded at I E-6/y for typical KPPfires. This suggests a potentially low level of risk significance G REFERENCES U.S. Code of Federal Regulations, Title to (Energy), Part 50 (Domestic Licensing of Production and Utilization Facilities), Appendix R (Fire Protection Program for Nuclear Power Facilities Operating Prior to January l, 1979), Otlice of the Federal Register, Washington, DC (2005). ASTM-EI19-04, "Standard Test Methods for Fire Tests of Building Construction and Materials," fhis analysis is illustrative only. Plant-sp<!cific conclusions should be based on actual plant condition; and spt:cific analyses. Nuclear Facility Risk AnalysiS ASTM Fire Test Standard, Sixth Edition, American Society of Testing and Materials, West Conshohocken, Pennsylvania. U.S. NUCLEAR REGULATORY COMMlSS[ON. tn/ormation Notice :;005-07-Results of HEJfYC'Y Electrical Race,l'ay Fire Barrier System Fill! Scale Testing, U.S. Nuclear Regulatory Commission, \Vashington, D.C. (2005) [ADAMS Accession

1. ML0508900891* D. PRIEST, C. HUMPHREY, (I-Hour) Electrical Racewacv Fire Barrier Systems Performance Testing Conduit and Junction Box Raceways, Omega Point Laboratories.

Inc., Texas (2005) [ADAMS Accession

1. ML051190014]. D. PRIEST, C. HUMPHREY, HEJIYC" (I-Holtri Electrical Racewa.\*

Performance Testing and Junction Box Laboratories, Inc., [ADAMS Accession

1. Fire Barrier S:vstems Cable Tray, Cable Air Drop Racewavs, Omega Point Elmendorf, Texas (200.5) YfL051190096]. R. PEACOCK, W. JONES, G. FORKEY, CF1ST: Consolidated

vfodel of" Fire Growth and Smoke Transport (Version 5). User's Guide, NlST SP 1034, National Institute of Standards and Technology (NIST), Gaithersburg, Maryland (2004). U.S. NUCLEAR REGULATORY COyIMISS[ON, "Fire Protection Significance Determination Process," Inspection ivtanual Chapter 0609. AppendiX F, U.S. Nuclear Regulatory Commission, Washington, D.C. (2004). B. LEVIN, "Documents Supporting HEMYC Tests and Insulation Fabrication," April 12, 2005, Letter to F. Wyant, Sandia National Laboratories, Albuquerque, New Mexico (2005) [ADAyIS Accession

1. ML051190055]. HA VEG INDUSTRIES, INC., SILTEMP'" Thermal Barrier Technical Bulletin HS-116, Wilmington, Delaware ( 1982). U.S. l\UCLEAR REGULATORY COMMISSION, Regularory Guide 1.174 -An Approach for Using Probabilistic Risk Assessment in Risk-tn/armed Decisions on Plant-Specific Changes to the Licensing Basis, Revision l. U.S. Nuclear Regulatory Commission, \Vashington, D.C. (2002i.

303 Nuclear Facility Risk Analysis TABLE I. Analysis Results for Three Typical Nuclear Power Plant Fires in Areas Employing HERFBS Analysis Parameters Base Case (Linear) Sensitivity Case (medium ) General electrical Ylaximum PIA) x PNS 4.8E-4!y (2)(6.0E-5iy) l.2E-4iy 0.016 0.00627 Electrical switchgear (251 Maximum P(A) x Pf\iS Maximum PiA) x PNS 0.OOI4/y (25)(6.0E-5!y) 0.00 I 0.034 0.00lO4 General electrieal Ylaximum PIA) x P:SS Maximum PiA) x PNS 1.6E-5y (2)(6.0E-5!y) = 1.2E-4ly 0.14 (Quadratic) ...... ____-I Sensitivity Case (Quartic) The fire severity factor = 0.1. 304 1000 900 800 """" 700 U ...'" ..... 600 Q ....., 500" 400 ;; ::::;:) 300 :200 100 0 Nuclear Facility Risk Analysis --ASTM E-119 --EDG ROOM (OlL) _. SWGRROOM *** MU PUMP ROOM / . . . -...-...--........ -...: --...-...: -_ ... _ ..., .. -.* 0 10 20 30 40 50 Time (min) FIGURE I. Linearized CFAST Time-Temperature Curves for Selected NPP Fires (,,"ote: Shrinkage of HERFBS Covering Begins at SURFACE Temp -200 C) 60 fi 1 e: "'q Users!1I Iri eh, U L RfC H ,VITT E'OocuITIcnts/Oot:lIm.:n t3 indian' ,,2...,;",,20 Oi az()'".20 i 2.C).20D 3 -;,200n'%20Govanmen t%200ver,; i ght. txt pogo.org POGO Letter to NRC Chairman NLles Diaz 12/9/2003 Project On Government Oversight December 9,2003 POGO Letter to NRC Chairman Niles Diaz December 9, 2003 Chairman Niles 1. Diaz Nuclear Regulatory Commission 11555 Rockville Pike Rockville, MD 20852 Via facsimile: (30l)4l5 1757

Dear Chairman Diaz,

As you recall, in September [ wrote to you to respond to your letter to the New York Congressional delegation and local politicians claiming that this summer's force-on-force test at [ndian Point had shown a "strong defensive strategy and capability." The NRC responded to my letter by demanding that POGO not make the letter public, claiming that it contained homeland security sensitive and "safeguarded" material. The NRC threatened us with civil and criminal sanctions were we to continue to make public either our letter or any of the sensitive material it allegedly contained. The NRC also took the position that it had no obligation to identify the passages in the letter that it claimed were sensitive. As a result, the NRC's initial position was that any effort by POGO to criticize the lack of security at Indian Point threatened the release of safeguards intormation and thus POGO did so at the risk of criminal prosecution. We believe that the agency took this position to stifle legitimate criticism of the agency by POGO. 'vVe did not let the matter end there. POGO retained counsel and threatened legal action against the NRC for stifling POGO's speech. Ultimately, the agency backed down and agreed to identify the portions of our September letter that were in the agency's view problematic. We appreciate the ...(I of 6) [12J/2007 10:28:l9 PM] Ii Ie: ul ri ch. U L R[C H WITTE'OoculT\iOn i nd ian" ;,2" ,,;",,20 Oi az"<,20 12--1 -2003"/olO 'lo20Go vanmcnt';',,200versigh

t. tx t agency's willingness to engage POGO on this issue and believe that discussions were helpful to all concerned.

vVhat follows is a redraft our original letter. vVe look forward to your prompt Our primary concern is that the way the force-on-force (FOF) tests conducted do not give you the ability to reassure the public that [ndian Point security force has been proven capable to defend facility against a credible terrorist attack. After a thorough review the test of security at [ndian Point, we continue to have the Dumbed-Down Design Basis Threat (DBT) -[t has been widely reported in press I that prior to 9/11, nuclear power plants were required to defenses designed to protect against only a ridiculously small force three terrorists. [n contrast, the intelligence generally believes that terrorists would attack a target with squad-sized force, which in the Army special forces is 12 and the Seals is 14. [n other words, the NRC would need to at least quadruple old Having interviewed a number of people who have reviewed the NRC's new we do not believe that it is even close to reaching the 12 to 14 level believe is appropriate. Representatives of other federal agencies told POGO that the NRC's new DBT remains The NRC argues that the new D BT is the largest threat against vvhich private security force can be expected to defend. This rationale backwards and conflates two separate considerations -what is the size the threat and what should the nuclear power industry be required to do in the face of such threats. The NRC policy decision to limit the size the DBT (under terrific pressure from the nuclear industry and its in Congress) was based mainly on its assessment of what is reasonable ask of a private force. But that approach ignores the most question: what is the credible threat against the facilities? The size the DBT must be based on that threat. Furthermore, NRC's justification its too-low DBT rings hollow, as the Department of Energy (DOE) relies on a private security force, yet at some facilities, DOE claims protect its facilities against twice as many terrorists as the NRC Under Use of Readily-Available Lethal vVeapons -£t is well known security circles that there are weapons that are available to that can penetrate bullet-resistant enclosures (BREs), which quasi-guard towers. BREs are included in the defensive strategy of fi!.o:,:iCi!Us.:rsfulrich.ULRICHWfTTE!Documents!Oocu ... 9-2003°/,,20Projccl%,200n%20Gov (2 of 6) [[ 2112007 10:28:49 PM] ti Ie: 'i iqU Serg/u lri eh. U LRI C H WITTE Documents': Document;/i mli an"'"':;...,,";,':;ODi al" :,':;0 [::-9-2003"*;,20 Project";,200n%20Govcm mento*;)200versight. txt number of nuclear power plants, including [ndian Point. Some time ago, Department of Energy abandoned the use of its state-of-the-art towers (which are far more robust than most B REs) because of vulnerability to readily-available weapons. [ndian Point officers been aware of the controversies surrounding BREs and have brought concerns not only to Entergy, but also to the NRC Region I, with response at alL Several years ago, the DOE developed a official Adversary Capabilities List which includes weapons and that are readily available to terrorist groups. The NRC should review list and ensure its Design Basis Threat includes them. For example, caliber sniper rifles (which have been available since World War I) Atmor-Piercing Incendiary rounds (which are available in gun shops tor per round) made the DOE guard towers so vulnerable they were Other weapons were also of concern, including the grenades which have been used frequently by near-children around the in war-torn countries, with great success against hardened Unrealistic Timing and Location of Attack -[t appears the NRC the three FOF tests at Indian Point during the daylight at the of the night shift, and began at least two of the tests in owner-controlled area. There are several problems with The security force being tested had just come on duty and was not fatigued by a 12-hour shift, hours typically worked by Indian security officers five to six days a The security ofticers knew within the hour that the test was to as the day shift was held over an extra hour to cover as a shadow so that the night shift could be tested at the beginning of their it is widely believed in the intelligence community that no one attack during davlight. as it is to the attacker's advantage to have _ '-' f '-' cover of darkness. Despite this, all three FOF tests occurred 4-6 pm. Furthermore, in two of the three tests, the mock terrorists required to cross open fields in broad daylight in order to reach protected area, making it that much easier tor them to be observed the security The mock terrorists attacked from only one entry point. In addition, NRC and Entergy agreed that, if the attackers were successful reaching the protected area fences, there would be a halt in the fik:/ iI C/Csers/ulrich.ULRICHWITTE/Documents/Doctl ... (3 of 6) [12.'3 1 100 7 I 0:28:49 PM} fi

C!!C s.:r,\t1 ri ch. CLR[ C HW[TT Ei Documcnts,'i noi an%2...,",',,20 Diazo /,20 [ 2 -9*200 3 \J e,lO ght.lx l and the adversaries would be brought inside of the fences (to prevent any actual damage to the fences during the exercise)

-making it perfectly obvioLls from where the attack will be coming. POGO had previously alerted the NRC to a particular vulnerability involving the fences at most nuclear facilities and was assured that this vulnerability would be taken into account in future FOF tests. However, it was does not appear to have been taken into account during the Indian Point FOF. Amateur Mock Terrorists A terrorist group has advantages that cannot be replicated in even the best mock attack FOF. However, the following limitations could have been partially ameliorated by the NRC, but were not: No Surprise. The security force knew for months in advance that this test was going to occur, training specifically for the approved scenarios. They even knew within minutes that the test was to occur, because of all the visiting dignitaries and the fact that they had strapped on Multiple Integrated Laser Engagement System (MILES) equipment. No Violence of Action. During a mock FOF there is no real danger -no live ammo, no colleagues dying or being maimed or any other adverse impact that would normally create chaos and in some cases cause the protective forces to panic. As a result, security forces develop "MILES bravery." Safety First. The FOF tests are not conducted at high speed because of the overriding safety concerns. Therefore, people and vehicles are not going full tilt the way they would during a real terrorist attack, giving the protective forces time to pause to make decisions time that they wouldn't have in a real life situation. Safety was also used as the reason for not conducting the tests at night. Sources told us that Entergy was worried participants could trip over rocks or step on snakes. No Trained Adversaries. The mock terrorists were security officers from another nuclear plant who had no training as adversaries. This training is criticaHy important because it teaches the mock terrorist how to think and act otTensively, as a real terrorist would, rather than defensively as a security guard would. Here again, both DOE and the rlle://I Q!Uscrs/ulrich.ULRlCHWfITEiDoClItnents/Docu",9*2003%20Proiect O;;,200no:;)20Governmelll ll ;,200ve[sighuxt (4 of 6) [11]12007 10:11):49 P:v1] fi Ie: "q'c 50!',/III ri c 11. LJ LR[C HWITT E.DoClImcll ts/D"clI tncnts: indian ';,,2...j');,20 D i az') i 2-9-2003 ':;)20 ProjcctO;,2 OOn');,]'OGov crnmcnt%200 V0rs ight.tx t military use trained adversaries to test their security The Securitv Forces Are On Their Own -[t should be recognized although the exercise was observed by the State Police and FBr, these law enforcement entities cannot respond to an attack with S\rVAT capability before it is too late. Insofar as we know, these response times have not been tested at Indian Point. But tests at other facilities have shown that an attack is generally won or lost in between three and eight minutes, white it generally takes an hour or two for S\rV AT teams to respond. Poor Planning: Lives at Risk One of the FOF tests was quickly when Coast Guard personnel, who had not been previously informed that test was to occur, threatened to use their live ammo against the attackers. [t is unacceptably poor planning to allow this kind of lack professionalism, putting lives at Recommendations: The NRC Not allow so much advanced notice and training for the FOF two is Make the window of attack much less obvious, therefore making it to the participants at what time during the shift the test will Administer most of the tests when it is dark; Use trained adversary teams from the military or develop its own trained adversary team; Conduct computer simulations -either Joint Tactical Simulations or Joint Contlict Adversary Tactical Simulations (JCA TS) used by military and Department of Energy for years. These computer simulate the movement of personnel through architecturally-terrain-accurate models of the facility. This preparation helps security forces develop the best strategies for defeating any number possible tik: 'iiC',lscfS/ltirich.LJLRICHWITTE/DOCllI11ClltS!DoCll ... (5 of 6) [t 2:3/2007 [0:28:49 PM] tilt!: "C/Ust!rs,'ui rich. C LRiC HW[1TE,'Document;/DoCltmtmt,;, i indian o i,':'".s",;,':'ODi:lz" ;,:W gbt.txt [nclude the use of simulated rocket-propelled grenades, sniper with .50 caliber armor-piercing incendiary rounds, gas, smoke and commonly used weapons and diversionary devices if they are not in the DBT; Address the serious communications breakdowns that occurred during the recent Indian Point FOF. These issues are obviously very serious and need to be addressed 'We look forward to your Sincerely, Danielle Executive cc Roy Zimmerman

1. U.S. News & World Report, September 172001; Chicago Tribune, luly 2002; The Boston Globe, May 14, 2002; Bulletin of the Atomic January 1, 2002; New York Times Magazine, May 26, Home [ Archives [ Expose I Search I Donations

[ Investigations [ About Cs [Contact Us [ Press Room Site Map I \Veb Overseer I Site Policies The Project On Government Oversight 2003 tile:, LR[CHvVITTElDocul11t!nts/DoclI ... (6 of 6) [12132007 10:1X:49 PM] March 27, 2007 NRC Proposed Rule: Power Reactor Security Requirements (RlN 3 150-AG63) Annette Vietti-Cook, Secretary U.S. Nuclear Regulatory Commission \Vashington, DC 20555-0001 Attn: Rulemakings and Adjudications Staff Submitted via e-mail to SECywnrc.govCOUNCLL ON rNTELUGENT ENERGY & CONSERVA nON POUCY (ClECP) COMMENTS TO PROPOSED RULE to CFR PARTS 50, AND 73 REGARDrKG POWER REACTOR SECURrTY REQUlREMENTS AT UCENSED NUCLEAR FAClUnES Nearly six years after September II, 200 I, the 103 civilian nuclear reactors in the United States are still not in a position to repel attacks by adversaries with capabilities commensurate with those of either the 9/ II terrorists or with enemies of the United States currently operative on the world stage. The present Power Reactor Security Requirements (PRSR) thus fall far short of the actual threat level faced by the U.S. today, much less the escalated level the ",tion will face as nations such as Russia, China and [ran improve and export ,(clear engineering expertise. lndeed, as numerous security experts have pointed out, a terrorist group with access to sympathetic nuclear scientists and engineers would have suftlcient sophistication to target the critical systems and weak links of nuclear reactors. The assistance that Pakistani nuclear scientists reportedly offered to Al Qaeda illustrates this threat. Recent National lntelligence Estimates and National [ntelligence Council Reports describe the terrorist threat to the U.S. as real and as having no sign of abatement for many years to come. These reports further warn of a new class of aEceprofessionalizedaE* terrorists -in part created by the [raq war-who must be expected to have strong technical skills and English language proficiency. Such individuals should, in the future, be expected to become major players in international terrorism. Al Qaeda and other terrorist groups have shown extraordinary tactical ingenuity and a complete lack of reverence for human life. Further there is ample evidence that U.S. nuclear power plants, particularly those sited near metropolitan areas, are vie\ved as attractive terrorist targets. Notably, the 9/ II Commission learned that the original plan for a terrorist spectacular was tor a larger strike, using more planes, and including an attack on nuclear power "lOtS. [n an AI-Jazecra broadcast in 2002, one of the planners of 9/[1 said cO.Lat a nuclear plant was the initial target considered. \Ve also know from the 9/11 Commission's investigation that, even after the plot was scaled down, when Mohammed Atta \vas conducting his surveillance tlights he spotted a nuclear power ... inal%2Otor";,20submittal,COlll1cil'sT crrori$m"',,2()copy.txt (I of 17) [12.'J'2007 10:28:52 P:Vlj Ii k:!!JC:'L,c:rs' llirich. L LRI CH W ITTE ia nO*;,20po...Oaprcndix'!;,20c tlnal'o';,20

.20subm i ttal

CclLlncil'sT errorislll%20cOtlY plant (unidentified by name, but obviously the lndian Point nuclear power plant) and came close to redirecting the strike. National Research Council analyses 51l1d post-9/l1 intelligence has also indicated that the U.S. nuclear j'astructure is viewed as an alluring target for a future terrorist spectacular.

As the Chairman of the National [ntelligence Council stated in 2004, nuclear power plants a*ceare high on Al Qaeda's targeting list,a.** adding that the methods of Al Qaeda and other terrorist group may be a*ceevolving.a.** There is, thus, every reason to believe that a sizable, well-planned and orchestrated military operation against a U.S. nuclear facility is well within both present and near-future terrorist intent and capability. Ln view of these realities, the current proposed PRSR is utterly inadequate. Consequently, the COUNCLL ON [NTELLlGENT ENERGY & CONSERVAT[ON POLlCY (C[ECP) urges the NRC to address the following realities in its PRSR: AcnVE lNS[DERS The voluminous number of security breaches which have occurred at critical infrastructure, including nuclear weapons and power facilities after 9111 (such as the 16 foreign-born construction workers \vho were able to gain access to the v-12 nuclear weapons plant with falsified documentation) demonstrates that .c1ear a*ceinsidersa** must be deemed potential active participants in an attack. This threat is significantly augmented by nuclear power plant operators' increasing outsourcing of on-site work in order to cut costs. Contractor oversight failures have been documented by the NRC. For example a December 22, 2003 NRC Special [nspection Report on the [ndian Point Nuclear Generating Station in Buchanan, New York (Indian Point) operated by Entergy Nuclear Northeast (Entergy) notes a*cethe common theme of a lack of direct contractor oversight and quality control measures, along with the absence of Entergy subject matter experts to independently assess contracted work activitiesa*:.a** Critically, the risk of sabotage is elevated at all power plants during periods of refueling and major construction work when hundreds of outside contract workers have site access. The active participation of insiders, including contract workers, in a terrorist offensive need not take place during the time of attack. £t may occur days or even many months prior to an attack. [n addition to actions such as surveillance of plant schematics, security features and protocols, pre-attack participation may invo 1 ve the sabotage of critical instrumentation, computers, ',ing, electronic systems or any number of other components, where such 0c.lJotage would likely not be discovered prior to an emergency event. tiI0::/:QiLsersoulrich. ITTEDocull1cnts, DOClll1le... inalo,;,20tOr%20submitlllL Council' (2 of I Tj l12/V2007 10:28:52 P[\.l J ttl,,:.. *C':c

h. C L RI ClI W ITT ian':*,,20po

...OapPcl1dix";,20r. tina!"<,20for";,20slIbm i tt3i.'C ounei I's T crrorism;n20copy .txt COMPUTER SYSTEM COMPROMISE ,uclear power plant computer systems, like those of other critical infrastructure, are subject to a range of vulnerabilities, including power outages, attacks by malicious hackers, viruses and worms. Compromise of integrity may also occur at the level of software development via backdoors written into code or the implantation of logic bombs programmed to shut down a safety system at a particular time. Many terrorist networks have the resources and technical savvy to wreak havoc. For example, the alleged terrorist, Muhammad Naeem Noar Khan, picked up in Pakistan in 2004, and believed to have links with Al Qaeda, is a computer engmeer. The fact that U.S. nuclear reactors are not impregnable was demonstrated by the penetration of the Slammer worm into the Davis-Besse nuclear facility. That intrusion disabled a safety monitoring system for nearly 5 hours. [n addition, computer hackers have broken into U.S. Department of Energy computers. Some of sllch intrusions were root-level compromises, indicating that hackers had enough access to install viruses. Computers at nuclear power stations are also vulnerable to acts of sabotage off-site power transmission, as was evidenced at Indian Point during the }03 blackout which struck the Northeast. At Indian Point, various computer systems had to be removed from service, including the Critical Function Monitoring System, the Local Area Network, the Safety Assessment System/Emergency Data Display System, the Digital Radiation Monitoring System and the Safety Assessment System. It is, accordingly, a matter of pressing importance that the NRC engage independent experts to develop a comprehensive computer vulnerability and cyber-attack threat assessment. Such an assessment must evaluate the vulnerability of the full range of nuclear power plant computer systems and the potential consequences of such vulnerabilities. The PRS R must incorporate such findings and include a protocol for quickly detecting such an attack and recovering key computer functions in the event of an attack. CHEMICAL WEAPONS The PRSR must fully address the potential consequences of the use of toxic chemicals as part of an attack scenario. There are numerous agents that can be deployed with almost instantaneous effect and can immobilize targets via 'ralysis, convulsions, blinding, suffocation or death. Such agents could be ,.llployed as part of the initialization strategy. For, example, a truck or even large SUV filled with chlorine, boron trit1uoride, hydrot1uoric acid, liquid ammonia, or any number of other agents could be crashed into a perimeter tilc:'C:;C5ers/ulrich.L:UUCHW lTTEiDoClIll1cnts; Doculllc ... il1aj"';,2lJt(lr%20S11bll1ittaj'Coullcii'sTerrorism%20copy.lxt (3 of 17) [!2, 32007 !O:28:52 PM! barrier, with the resulting fumes killing or disabling plant personnel guarding the outdoor area of the facility. lemical agents could also be introduced surreptitiously into building ventilation systems. They may also be used strategically to neutralize workers endeavoring to maintain control of the situation. Many such agents are easy to make and do not require sophisticated delivery systems. Some can be carried in coffee mugs or in vials within body cavities. Phenarsazine chloride, an arsenic derivative, can be transported in minute quantities, even as a powder that can be dusted on paper. [t is lethal if burned and even a spoonful can cause immediate extreme irritation of the eyes and breathing passages. A chemical like chloroform ascitone methanol can be transported on filter paper, then combined with a heat source to create an explosion. CONVENTIONAL WEAPONRY [ntelligence and military analysts have repeatedly warned that extremists in [raq, the tribal areas of Pakistan and elsewhere are currently developing a high level of military skill and experience. This reality underscores the need for nuclear plants to be able to defend against attackers utilizing the full range ,f potential weaponry that terrorists arc known to be capable of using, ;luding heavy caliber automatic weapons; sniper riHes; shoulder-fired rockets; mortars; platter charges; anti-tank weaponry; bunker busters; shaped charges; rocket-propelled grenades; and high-power explosives. Numerous weapons systems posing a threat to even the best trained and equipped civilian guard force, as ,>vell as to on-site installations, are readily available and easy to transport. To wit: o Assault rines and other rapid-fire battlefield weapons such as AK-4Ts, Uzi's and TEC-9's are freely available in the U.S. A weapon like the SKS 7.62-millimenter semiautomatic assault riHe can be purchased for under $200. In 2005 the Government Accountability Office reported that 47 individuals on a federal terrorism watch list were actually permitted to legally buy guns in 2004. o A standard M-24 sniper rUle with day and night scope can be carried in a canvas bag and fires 7.62-millimeter ammunition targeting up to 3000 feet o A .50-caliber Barrett riHe, which can be purchased for S 1000 on the internet, weighs a mere 30 Ibs and can hit targets up to 6000 feet away with 'TIor-piercing bullets that can blow a hole through a concrete bunker, bring ..Jwn a helicopter or pierce an armored vehicle. o A rocket propelled grenade launcher is re-Ioadable, can fire at the speed Iii,,: "'C'/Ls"rS!1lIridl.LLR1CH rerrllrisl11" ,,20copy,txt I'" of 17) :, 12;312007 PM I Ii Ie:. 'C!: Lst:rSi L LRIC H WriTE Docull1cl1t;!Doeul11cnts.'ind ian':;,2tJpo" .Oappcnd;x%20c' ti na!"',,,:!() tor" ,,20:5Llbmittai. COline; l'sTcrwrism') "lOwpy, txt of 400 feet per second and can blow a vehicle into the air. " A TOW missile is an accessible form of military hardware used in over 40 Juntries and can be fired from a launcher on a flatbed truck. A 1998 test TOW fired into a nuclear waste transport cask (which is more robust than many on-site nuclear waste storage casks) blew out a hole the size of a grapefruit. The Kornet-E missile, developed by the Soviets and sold to Iraq, can travel over 3 miles and cut through over 3 feet of steel. The world's arms market is awash in thousands of Milan missiles. The 60-70 Ib Milan missile system has an effective range of over 5000 feet and can blow a hole through more than 3 feet of armor plate, o The deployment of increasingly powerful and sophisticated explosives, including shaped charges and explosively formed penetrators (or E.F.P.s) by terrorists and insurgents in Iraq show that the explosives use capabilities of enemies of the United States should not be underestimated. 1\otably, the 18 men arrested in Australia in November 2005, and believed to have been planning an attack on an Australian nuclear reactor, had allegedly been stockpiling materials lLsed to make the explosive triacetone triperoxide, or TATP. Terrorists targeting a U.S. nuclear power plant may very well be able to draw on expertise developed during the Iraq insurgency as well as military experts and rocket scientists from the former Iraq government or from hostile nations such as fran. (n addition, the strategic utility of explosives is magnified when ""mbers are wilting to blow themselves up. Suicide bombers able to gain access the internal areas of a nuclear power plant during the course of an attack could cause untold destruction. o Perhaps the most intractable military hardware threat is posed by shoulder-fired missiles such as Stingers, SA-7's. SA-14's and SA-18's. An estimated 500,000 such systems are scattered throughout the world and have been found in the possession of at least 27 terrorist or guerrilla groups. Some can be bought easily on the black market for as little as several thousand dollars each. Critically, shoulder-fired missiles are easy to operate (AI Qaeda training videos offer instruction) and are designed for portability, typically being 5-6 feet long and weighing 35 lbs. They can be transported by and fired from a van, S.U.V., pickup truck or recreational boat. Even a single terrorist armed with a shoulder-fired missile can cause immediate and substantial damage to a targeted structure. Traveling at more than 1,500 miles per hour, a typical shoulder-launched missile has a range of over 12,000 feet. [f the target remains intact following the initial strike, the terrorist can attach a new missile tube to the grip stock launcher and fire again. WATERBORN ATTACKS ., dterborne defenses of nuclear plants adjacent to navigable waterways must be significantly enhanced. Facilities must either be engineered to withstand damage from a vvaterborne attack or suited with physical barriers that prevent tiie:,'/ICL,ers/ulrich,LLRICHWITTEDoCLll11enls;DoC:llme,,,inal':';,20tor"!i,20submittaLCouncil'sT"rrorism"';,20copy,txt (5 of I [1232007 11J:2x:52 PM J til.::" L LRICH W DOClll11.:ntS indian"o20pu",Ilappcndix"',,2()r tinal"i,2I)te,r";,20suiJll1ittaLCotlnci [',Tcrrorism"',20copy .Lxt entry to the plant and/or critical cooling intake equipment Continual cooling is an essential component of nuclear plant safety. A meltdown ,n be triggered even at a scrammed reactor if cooling is obstmcted. Water intake is also essential to the proper function of spent fuel pools. Yet at certain nuclear plants, cooling systems may be highly vulnerable. At both [ndian Point and Miltstone Power Station, in particular, water intake pipes have been identified by engineering experts as exposed and susceptible to waterborne sabotage. One or more boats laden with high energy ex.plosives could severely compromise cooling \vater intakes easily and quickly. [ndian Point, for instance, is located on the banks of the Hudson River in an area heavily trafficked by commercial and recreational vessels. The 900 foot iiEceExclusion ZoneiiE* -marked only by buoys-could be traversed by speed boats in JO -40 seconds, welt before any Coast Guard or other patrol boat could react. Patrol boats could also be readily taken out by suicide bomber boats crashing into them (in the manner a small explosives laden boat targeted the destroyer the USS Cole in 2000) or by weaponry like shoulder-fired missiles or rocket propelled grenades. AER[AL ASSAULT '\ ccording to a terrorist iiEcethreat matrixiiE* issued by the National Research Council .d the National Academies of Sciences and Engineering following the September 200 I attack, iiEceNuclear power plants may present a tempting high-visibility target for terrorist attack, and the potential for a September II-type surprise attack in the near term using U.S. assets such as airplanes appears to be high.iiE* In March 2005, a joint FB[ and Department of Homeland Security assessment stated that commercial airlines are ii*celikely to remain a target and a platform for terroristsii** and that a*cethe largely unregulatedii** area of general aviation (which includes corporate jets, private airplanes, cargo planes, and chartered flights) remains especially vulnerable. The assessment further noted that Al Qaeda has a*ceconsidered the use of helicopters as an alternative to recruiting operatives for fixed-wing operations,a** adding that the maneuverability and aEcenon-threatening appearanceaE* of helicopters, even when flying at low altitudes, makes them a*ceattractive targets for use during suicide attacks or as a medium for the spraying of tox.ins on targets The vulnerability of nuclear power plants to malevolent airborne attack is detailed extensively in the Petition filed by the National Whistleblower Center and Randy Robarge in 2002 pursuant to 10 CFR Sec. 2.206. A number of studies of the issue are also reviewed in Appendix A to these Comments. The particular 'Inerability of nuclear spent fuel pools to this kind of attack is detailed in January 200} report of Dr. Gordon Thompson, director of the [nstitute for Resource and Security SUldies entitled aEceRobust Storage of Spent Nuclear Fuel: A Neglected [ssue of Homeland SecurityaE* and in the findings of a Ilk" 'c'. ..s' ulrich. t; LRICHW ITTEiDoc1ll110I1ls!Documc ... L Coullci!',T,,"ro.. (6 of [7) l [ 2'3,2007 10:28:52 PM 1 tik: 'iC.*C:icf:iittlrich. C UUCH \V cnE. Docllmcnt:i. Document,. imlian",,20po ...Oappcmlix'J.,,2lJr tina I" ;,20tor" ,,2(bubmittaL'Cout1cil's T crrorism'**,,2()wpy.txt multi-institution team study led by Frank N. Von Hippel, a physicist and co-director of the Program on Science and Global Securitv at Princeton r Jniversity and published in the spring 2003 edition of the Princeton journal ..:ience and Global Security under the title a*ceReducing the Hazards from Stored Spent Power-Reactor Fuel in the United States.a** It is worthy of note that, even post-91l1, general aviation aircraft have circled or flown closely over commercial nuclear facilities without military interception. The NRC's sole present strategy tor averting a kamikaze attack upon a nuclear power plant is reliance upon aviation security upgrades implemented by the Transportation Security Administration and the Federal Aviation Administration and faith that U.S. intelligence will provide ample warning. [t is this kind of governmental agency pass-the-buck mindset that brought the nation Katrina. The NRC's conjecture also betrays a reality disconnect reminiscent of the federal response to Katrina. Since 200 I there have been numerous breaches of airport security throughout the nation. Notably, in late 2005, there were three serioLls security breaches at Newark International Airport, one of the points of departure used by the September II hijackers. The most serious occurred on November 12,2005, when a man driving a large S.U.V. barreled through the anned security checkpoint and drove in a secured area for 45 minutes before being t"und by NY/NJ Port Authority officers. Just this year, gaping holes in airport were exposed when workers with access to secure areas were able to carry firearms in their carry-on bags onto a commercial jet departing from Florida. The PRSR must furthermore be upgraded to include high-speed attack by a jumbo jet of the maximum size anticipated to be in commercial use (such as the expanded version of the Boeing 747 and the Airbus A380) as well as unexpected attack by general aviation aircraft and helicopters. The PRSR must contemplate all such aircraft to be fully loaded, fueled and armed with explosives. It is essential that the PRSR address not only the direct effect of impact, but the full potential aftereffects of (A) induced vibrations; (B) dislodged debris falling onto sensitive equipment; (C) a fuel tire; and CD) the combustion of aerosolized fuel C especially in combination with pre-existing on-site gases such as hydrogen). The PRSR must further take into consideration the cascading consequences of aerial assault on the tull spectrum of plant installations. Inarguably, there is a wide range of on-site structures, not within hardened containment that are critical to the safe operation of a nuclear plant. Spent fuel pools are of 'rticular concern because the disposition of water could uncover the fuel. [f rant workers are unable to effectuate replacement of the water (either because of fire or because they are otherwise incapacitated), experts warn, an exothermic reaction could cause the zirconium clad spent fuel rods to ignite a lile:.' WlTTE/DocumentsDocllrllc ... inal%20forO*;.2ttmbmittaliCounlOil'sTerrori,;m",,2(k:opy.txt (7 llf I 7) [i 2;].2007 I PM]

'c: C,crs, ulrich, L: LRICll WITTE; Documents Terrori:;m"i)20copy, txt nuclear waste conflagration that would very likely spew the entire radioactive contents of the spent fuel pool into the atmosphere. ithout question, hardening a nuclear power plant against aerial threat will necessitate significant upgrades in plant fortification. However even relatively modest measures such as the installation of Beamhenge and the placement of all sufficiently cooled spent fuel into Hardened On-Site Storage Systems (known as H.O.S.S.) would add measurable protection. STRATEG[C USES OF RIGS, TRUCKS AND S.U. V.'S [n June 1991, the NRC denied the truck bomb petition of the Committee to Bridge the Gap and the Nuclear [nformation Resource Service, on the grounds that it was not realistic to believe a truck bomb would be employed in the U.S. Two years later, on February 26, 1993, terrorists drove a rented van packed with explosives into the underground garage of the World Trade Center, lighted a fuse and fled. Just a couple of weeks betore that, a mentally unstable individual crashed his station wagon through the gates of the protected area of the Three Mile [sland nuclear power station and evaded security for several hours before finally wrecking his vehicle by crashing into the turbine building. Thereafter, the NRC reconsidered its earl ier assessment and has, on a number of occasions, upgraded reactor security standard to include some protections against land Such upgrades, however, are insufficient in a post-9/ II world. Large Sport Utility Vehicles and pickup trucks on the road today can weigh over 8 tons, loaded, and -as do commercial vans-have considerably carrying capacity. Such vehicles could be used strategically in a number of ways. The first is as a mobile short range projectile bomb. A large, heavy vehicle packed with high explosives, even if not successful in penetrating concrete barriers, could result in the death or incapacitation of large numbers of plant workers, including security, personneL Such casualties would be particularly likely to materialize if the vehicle bomb followed a previous diversionary event intended to draw security personnel to the plant perimeter. The second is as a transport vehicle for one team of attackers who are themselves armed or who wear explosive belts and could then themselves penetrate other areas of the facility. A terrorist wearing an explosive body belt can, in effect, be a precision guided weapon. The third and fourth scenarios are variations ofthe first two, with chemical agents substituted for or combined with explosives. (Indeed, insurgents in Iraq are increasingly combining explosives with chlorine and other chemical 'yloads in truck bomb detonations.) One or two such vehicles packed with the <'.sht toxins, could be expected to kill or disable a substantial number of workers, again, especially if the release followed a prior event which drew security personnel to the area, or simply to areas outside facility enclosures. tik L LRICHW1TTEfDoclImc:ntsiDocume, .. ina!',,20for",,20submlttaIColIncil'sTcrrorism"'[,20copy,txt (3 of ! 7) [12i), 20()7 10:28:52 Pivl J nlc"* 'C" L,.ers.ulrici1. L LRICH l,V'iTTE Docu!1lcnt,/DoclIl11<!ms.'ind ian'!*;,20pe ..Oappcndix";,20r

,20S11bmittaL COLillcil'sT.errorisl11" J20cory. txt Certain toxins can be lethal to anyone within miles. Using sllch agents, attackers wearing protecti ve gear could then gain access to other areas 0 f the f1cility.

A fifth tactical use of vehicles would not even OCCllr on site. Vehicles carrying explosives and/or chemical agents could be set off at critical regional transportation arteries such as major bridges, tunnels and highways. Notably, such incidents could be staged in a way that would not even alert authorities to the onset of terrorist activity. In the New York metropolitan region in which Indian Point is sited, for example, a series of major accidents occurring at or about the same time would not be an unusual occurrence. [n fact, on July 25, 2003, the very day the Federal Emergency Management Agency declared that the Indian Point emergency plan provided a*ceadequatea** assurance of protection to the public, the entire New York metropolitan region was brought to a virtual traffic standstill after a tractor-trailer hit a beam on the George Washington Bridge and burst into tlames, several minor accidents and a car fire took place on Interstate 95, and a truck got jammed under an overpass of the Hutchinson River Parkway. In 2006, a tanker truck carrying 8000 gallons of gasoline overturned on one of New York City'S busiest highways, igniting a blaze that burned for hours and weakening the steel beams of an above bridge. Earlier this month a liquid propane explosion closed a 23 mile stretch of the :\lew York State Thruway for hours, while firefighters had to stand by and watch the fire burn out because it was too hot to approach. ,e staging of a couple of incidents like those just noted, combined with an involving a tanker carrying hazardous gasses or liquids like liquefied ammonia, propane, chlorine, or vinyl chloride, prior to an assault would almost assuredly forestall the provision of outside assistance to a nuclear facility under attack. PLANTS MUST BE ABLE TO MOUNT A FULL DEFENSE WITHOUT RELIANCE ON OUTSIDE ASS [STANC E Whether or not an attack employs strategies designed to obstruct regional transportation routes, numerous studies and the actual events of 9/ 11, Katrina, and Rita (as well as relatively minor events such as the January 18,2006 wind storm in NY) demonstrate beyond cavil that tirst responder forces and the National Guard do not have the resources, manpower, equipment or communications capabilities to swiftly and adequately respond to a major assault on a nuclear facility_ Just this very month, a report of the Commission on the National Guard and Reserves detailed the ongoing problem of inadequate human, equipment, communications and tinancial resources plaguing the National Guard. This report calls into question the ability of the government to bring all necessary assets bear in the immediate aftermath of a major domestic incident. [n some regions -most notably the New York Metropolitan region, in which lndian Point is sited -roadway logistics and regular congestion alone would likely tile:/i:q/I.;,ers':ulrich.LLRICII WITTEiDocumcnls/Doculll<! .. .inal'\:;J20for'!<,20Sllbmittal:Council',T ,,20copy.txt (9 of 17) [12,},2007 10:23:52 P'vIJ ti 1 ulrich, I; L RIC H\V ITTE Doeu[lJcnls'Documcnts,'inciian""20po,,, Oa ppcnd ixU ,,201'.' ti nal"'n20 to r" ,,20su billi ltaL C Ollnc i i's Tcrrorisl1l" ,,20copy . tx t prevent assisting forces from reaching a nuclear plant under attack in time. [t bears mention that S W AT team assembly takes approximately 2 hours, whereas an :-lssault could be over in a matter of minutes. [t is accordingly crucial that the NRC cedes the faulty assumption that plant personnel need only fend off attackers until law enforcement or military aid arrives. The fact that most regional first responders have little detailed knowledge of either the operational or internal layout of nuclear facilities further testifies to the folly of reliance upon the aErecavalryaE*. ELEVATED VULNERAB[UTYTO [NFlLTRATION DURING EVENT During a crisis event at a nuclear plant there also exists an elevated threat of infiltration by terrorists posing as first responders or National Guard. And in fact the imposter tactic has been used by terrorists in recent years with substantial success. Terrorists disguised as firefighters could take particularly strong advantage of this stratagem. Outside firefighters often respond to fires at nuclear power plants and many attack scenarios would be expected to involve fire. Firefighters would presumptively be seen as benign by plant personnel and would have a legitimate reason to move throughout a facility and aErecheckaE* components <;;1lch as electrical wiring. Moreover, bulky firefighter uniforms and equipment .1 hold and hide a host of articles that could be used for destmctive purposes. DEFENSE AGA£NST A S[ZABLE MULT[-TEAM, MUL TI-D[RECTIONAL FORCE [n January 1991, the Nuclear [nformation Resource Service and the Committee to Bridge the Gap filed a joint Petition with the NRC requesting, inter alia, that the DBT be upgraded to 20 external attackers. The NRC rejected the petition in June 1991, asserting that an attack involving more than 3 assailants was unrealistic. September 11 was a demonstration of the profound limitations of governmental foresight. The September II plot involved 20 attackers (although only 19 were ultimately able to participate). The tragic 2004 siege at a school in Belsan, Russia involved more than 30 anned terrorists. [t should be beyond question at this point that a terrorist attack could involve scores of attackers. ,-"cordingly, the PRSR must assume at least two dozen attackers. Lessons learned Jm 9/ 1 t and the many multiple coordinated terrorist actions that have transpired in Europe, Asia and the Middle East since then, also mandate the premise that attackers will act in several teams and that some of those teams L U{[CH WITTE/Dm;ul11ents/DoclIl1l ..na!l;,';Olor%20slIbmittal'Collncil'sT t 10 of 17) [1 3120(\7 1 P'viJ tik: Q!L'CrS/lllric:i1, CLRICH W ITTE,DoclIl11cnls.Documcnr:;, indian') ocOpo ,(Jappenciix";.20(tinal" ..20for",,20:;ubmittaiiCollncil'if crrof'i';Il1" :,20copy ,txt may be sizable. I\ny carefully planned attack on a nuclear facility by knowledgeable individuals, )uld also involve several different modus operandi. The PRSR should therefore take into account the consequences of near-simultaneous damage to different plant installations, systems and personnel (e.g., the effect of a small explosive-laden plane diving into the roof of a spent fuel pool coupled with the waterborne sabotage of the spent fuel pool intake system). A COORD[NATED ATTACK ON MULTIPLE ON AND OFF-S[TE TARGETS A related point is that, following 9/11, the NRC can no longer ignore the very real possibility that an attack on a nuclear power plant would occur commensurate with an attack on other regional infrastmcture such as chemical plants and bridges. A coordinated attack designed to effectively eradicate a region would very likely preliminarily target communication, electrical power and/or transportation infrastructures. This would ensure that (A) the targeted region is reduced to mass confi.lsion, (B) local and federal officials and responders would be overwhelmed, and (C) law enforcement and other tirst responders would be impeded from gaining access to the nuclear plant site. Certain areas of the U.S. offer a plethora of target opportunities and thus are n::trticularly vulnerable to multiple target scenarios. Prime among them is the New York Metropolitan area (already in the terrorists' crosshairs) which contains numerous national landmarks, corporate headquarters, reservoirs, bridges, airports, transportation arteries and hazardous chemical plants, all in near vicinity to rndian Point, a mere 24 miles north of New York City. A CREDIBLE NUCLEAR PLANT SECURITY FORCE TESTING PROGRAM The deticiencies, failures, and chicanery that have long plagued the various manifestations of nuclear power industry security drills and force-on-force (FOF) testing have been exhaustively documented in recent years. Noteworthy investigations in this regard have been conducted by the Project on Government Oversight (augmented by testimony provided in 2002 Senate Environment and Public Works Committee hearings) and the United States General Accounting Oftice (which reported its Endings in a September 2003 report entitled of Security at Commercial Nuclear Power Plants Needs to Be Strengtheneda**) as well as by the press. Problems with the FOF program are also addressed in the July 2004 Petition for Rulemaking to amend 10 CFR Part 73 to upgrade the DBT tiled by the Committee to Bridge the Gap and the Comments on the DBT tiled in 2006 by the Union of Concerned Scientists. CIECP fully endorses the recommendations made in tilings by the Committee to Bridge the Gap and the Union of Concerned _ientists. ClECP urges the NRC in the strongest possible terms to upgrade drills and errori;;m"",20copy.txt III of 17) [12 Ji2(J07 I P:'vl J testing protocols to remedy the flaws that are a matter of public record and to take into account the realities noted herein. FOF tests must be sufficiently to provide high confidence in the defensive capabilities of the forces at the nation's lO3 nuclear power plants. One clear failing of the FOF program to date has been the giving of excessive warning regarding upcoming tests. "Vhile some notice is necessary, one week should suffice. [n addition, staff assignments should be frozen on the day of notice. This would eliminate the all too common practice of substituting a plant's most fit and accomplished security personnel in place of underachievers. [t is also critical that drills and the FOF program be revamped to eliminate manifest conf1icts of interest. Examples of blatant conflicts of interest include: (I) The NRC allowing the nuclear industry'S lobbying arm, the Nuclear Energy [nstitute (NEl) to award a FOF contract; and (2) The NEe with NRC approval, then selecting Wackenhut. a corporation which contracts security guards to nuclear power plants in the U.S., to also be the contractor that supplies the mock adversary teams for the FOF tests. Such problems have reduced the value of testing to the point where the FOF program lacks public confidence. The program must be redesigned and monitored by an independent entity such as the very capable U.S. military. I-JIGH TARGET APPEAL REACTORS Prior terrorist attacks and plots against the U.S. have focused on major cities. [t is a matter of fundamental logic that plants sited in highly populated metropolitan areas, particularly those with high symbolic value, face the greatest risk of being se lected as a target. [t is thus imperative that the PRSR be modified to mandate a customized approach to high target nuclear facilities. S[TE-SPEC[F[C SAFETY-RELATED VULNERAB[UTlES It is highly unrealistic to exclude from the PRS R calculus the reality of aging stmctures, deteriorated conditions and compromised systems that exist at various nuclear power plants in the U.S. A facility-customized approach must be taken which adds problems which are known or reasonably suspected and which could have a significant effect upon the ability of plant operators to maintain control during a major incident into the security equation. Prime among factors which may be site-specitic are: Corrosion and Embrittlement: For example, a risk of corrosion of the steel liner of the reactor containment at the Oyster Creek Nuclear Generating Station (Oyster Creek) was recently identified. A qualified corrosion expert tLk:,'CillJ,ers;ulrich, ULRICH Doeum".nal'!;,:!Ot<x"",:!OsubmittaLCOllllcil'sT"rrori,m"';,20copy,txt 112 of 17) [12,J20(J7 1 1':Vl J Ii Ie :,' 'qCsers, ulrich, L LR[CH W ITT L Docull1el1 ts DOCml1cll[:l,'indian":,20po" Jlappcl1Ji x",,20r tina 1";,20 l(x':';,:;OSll on,iltaliColll1ci!' s Terrorism";,:; Ocopy, tx t has warned that the risk may be high enough to cause buckling and collapse. Manitestly, corrosion or embrittlement-weakened structures and components are more vulnerable to the effects of heat and combustion. o Vulnerability to Fire: Fire detection and suppression equipment and tire barriers are crucial to reactor safety. Over 20 years ago a worker at the Brown's Ferry Unit I reactor accidentally started a tire which destroyed emergency cooling systems and severely compromised the plant's ability to monitor its condition. In response, the NRC increased tire safety standards. In recent years, the NRC has effectively relaxed those standards. This is exceedingly unwise. During the chaos and threat level that would surely exist during a terrorist attack, human beings cannot be presumed to be able to take the actions necessary to protect critical systems from fire. The systems themselves must have integral safeguards. Yet plants such as Arkansas Nuclear One, Catawba, Ginna, H.B. Robinson, Indian Point, James A. Fitzpatrick, McGuire, Shearon Harris, Vermont Yankee and Waterford have been identified as having tire barrier wrap systems that failed fire tests. Fireproofing problems such as these jeopardize safe shutdown and must be recognized as a degradation of defense-in-depth protection. In addition, any plant fire hazard analyses must assume damage to multiple rooms and multiple structures, a circumstance that could easily result from an aircraft impact. o Integrity of Structures that Support Mobility: While the focus of NRC review is on structures and equipment directly related to sate . erational function, the conditions that may prevail during an assault would likely require plant personnel to be able to move rapidly throughout the facility. The evaluation of the reliability of structural features such as stairways (which might buckle or melt during a fire) is accordingly criticaL o Electrical System Problems: In 2003, a cable failure knocked out power to approximately half the safety systems at Oyster Creek, including security cameras, alarms, sensors, pumps and valves. [n February 2003, all 4 of the backup generators at Fermi became simultaneously inoperable. In December 2001, Indian Point reactor 2 lost power due to a malfunction 0 f the turbine, then lost back-up power to the reactor coolant system because of a second electrical failure. During the August 2003 blackout that stmck the Northeast, tollowing the loss of off-site power, two of Indian Point's emergency backup generators (both of which had been previously t1agged as having problems) failed to operate. [n view of the severe consequences failures such as these could have were they to occur during a major incident, known plant electrical system vulnerabilities mLlst be taken into consideration. o Cooling System Problems: Cooling system problems and design deficiencies have plagued a number of plants in recent years. In some cases the NRC has "owed plants to operate for long periods with compromised emergency cooling _; stems. For example, the Salem nuclear power station had experienced two years of repeated malfunctions of its high-pressure coolant-injection system prior to the time, in October 2003, when operators unsuccessfully tried to use it to ..l1al(\'o20IorO',,2(Jsubl1littaL COlllldi',Tcrrorisl1l i ',,20copy,txt ( 13 or '7) [12.3 '2007 10:211:52 PM j stabilize water levels following a steam pipe burst. And the NRC has allowed reactors with emergency sump pumps tlagged as likely to become clogged and inoperative to remain in operation for many years without repair. The Los amos National Laboratory, for instance, concluded that the sump pumps at Indian Point reactors 2 and 3 could become clogged in as little as 23 minutes and 14 minutes, respectively. While, upgrades are being made, the failure of the NRC to mandate immediate correction of cooling system vulnerabilities calls its oversight capabilities seriously into question. Indeed the functional declination of critical systems must be deemed a constituent element of site-specific PRSR analyses. EUMINATE COMMERCIAL CONSIDERA nONS FROM THE PRSR CALCULUS The commercial interests of the nuclear industry are of valid concern to nuclear utilities and the NEI; they should not be of concern to the NRC. There is no justification for jeopardizing national security and the health and safety of the public -even to the smallest degree -to safeguard corporate profits. The NRC has stated that its promulgated security standards are based upon the analysis of the largest threat against which a aEreprivate security force could reasonably be expected to defendaE-[emphasis added] 70 FR 67385. Roth the NRC and the industry have acknowledged that, in their estimation, a ,_ ,vate guard force should not be reasonably expected to defend against a 9/1 I-type attack involving aircraft. Such an attack, apparently, is deemed to fall under the loophole of to CFR Sec. 50.13, which exempts reactor operators from defending against aErean enemy of the United States, a foreign government or other personaE-. The perimeter of this aEreenemy of the United States provision has never been defined, so there is no way to know how far it extends. However, it is abundantly clear from the public record that the NRC has drawn the line at point where the profit margins of nuclear power operators might be significantly affected. Unfortunately, the terrorists are constrained by no such boundary. Congress has charged the NRC with the obligation to protect the public health and safety. This must not be viewed simply as a guideline; it must be viewed as an uncompromised mandate. [f the NRC does not believe its licensees can afford the security upgrades necessary to protect the nation's nuclear reactors against the full potential threat, it must act with forthrightness and publicly demand that the Department of Homeland Security or the U.S. military assume responsibility for domestic nuclear power plant security. _JNCLUS[ON The 9111 Commission observed: aEreAcross the government, there were of ,v ITTE*'f)oClIment" D(l(;llln ... (J 4 of 17) (12.'3'2007 10:2:>(;52 PM] ilk: c, iC: c L so::rsc'ul rich, lJ LRICH \'1 I TTE Documcnts'DoCLHllcnls,cind ian%20po" c Oa ppcnJi ,,",,2ndl nai'!',,20 for" ',,20su0l11itta I;C oune! I 'sT crrorism%20copy, txt imagination, policy, capabilitiesa*;The most important failure was one of imagination. We do not believe leaders understood the gravity of the threat.a** -' , a public interest group we ask: What needs to happen before the gravity of the threat is not only understood, but acted upon? Respectfully submitted, COUNC[L ON [NTELUGENT ENERGY & CONSERVATION POLlCY (New York) By Michel C. Lee, Esq. Chairman (914) 393-2930 'PEND[X A Since September II, 200 I, there has been much speculation about the vulnerability of nuclear power plants to aerial attack. Certainty, however, is in short supply. What is known is that none of the nuclear reactors presently operational in the United States were built to withstand the crash of a jumbo jet, much less the crash of super jumbo such as the A380 which will take to the air weighing 1.2 million pounds, has a wingspan almost as long as a football field, is 8 stories tall, and is 3 times as large as the 767s that brought down the Twin Towers. Nevertheless studies that have addressed the prospect of planes hitting nuclear plants include the following: 1974: To date the only published peer reviewed study on the vulnerability of U.S. nuclear power plants was conducted by General Electric, the leading builder of nuclear plants, and published in the industry journal Nuclear Safety. GE looked at accidents -not terror attacks -and concluded that were a airl iner to hit a reactor building in the right place, it would almost certainly it apart. Such a hit would also most likely damage the reactor core and o.:h the cooling and emergency cooling systems. [NOTE: The GE study detined a a*ceheavya*- plane as one weighing more than 6 tons. The Boeing 757 which gouged a 100 foot gash through the reinforced concrete of the Pentagon weighed between 80 tilc:,I'C>'Lscrs/ulrkh,lJLRICH WITTEiDocumcntsii.)ocul1l",nal"',,20for%20subn1!ttaliCOllnc!l'sTcrro,-!sm"'i,20eopy,lxll 15 of 1 71 [12:3 200 7 1 O:2H:52 ti k. *C[.L sa.;:ltlrich. L; L R[CH\\ iTT ta n",,20po ... Oaprendi x': ;,:;Or .ti l1a,";,20 f,"'" ,,2l)subm i ttal C onnei l'sTerrorism" ,,20copy. txt and 100 tons. A fuliy loaded 767 weighs over 200 tons. The Airbus 380, expected to be launched into commercial use later this year, takes to the air weighing 1.2 million pounds, hundreds of thousands of pounds heavier than the Jcing 747, the current jumbo of the sky.] 1982: A technical report (previously publicly available) of a study conducted by the U.S. Army Corps of Engineers at the NRC's behest focused on plane crash analyses at the Argonne National Laboratory. The Corps concluded that planes traveling at a speed of over 466 mph would crash through the average reactor containment structure noting ii*reaccount has been taken of the internal concrete wall which acts as a missile barriera*:rt would appear, however, that this is too optimistic since vaporized fuel, hot gaseous reaction products, and to a certain extent portions of liquid fuel streams will tlow around such obstructions and overwhelm internal defenses'l*:.a*o (NOTE: An FBI analysis estimated that American Airlines Flight II, which hit the north tower of the World Trade Center, was traveling at a speed of 494 mph, and that United Airlines Flight 175, which hit the south tower, was traveling at 586 mph, a speed far exceeding its design lim it for the altitude.] 2000: A NRC study published less than a year before September II calculated that lout 2 commercial airplanes flying in the year 2000 were large enough to penetrate even a 5 foot thick reinforced concrete wall 45% of the time. Specifically, the study states, aEreaircraft: damage can affect the structural

'1tegrity of the spent fuel pool or the availability of nearby support systems, as power supplies, heat exchangers, or water makeup sources and may also affect recovery actionsiiE

[t is estimated that hal f the commercial aircraft now flying are large enough to penetrate the 5 foot thick reinforced concrete walls.clEo [NOTE: The thickness of the top of certain reactor domes is 3 and-a-half feet.] 2002: The German Reactor Safety Organization CGRS) a scientific-technical research group that works primarily for nuclear regulators in Germany conducted an extremely detailed study that determined that terrorists can, with a strategically targeted airplane crash, initiate a nuclear accident. (A secret Ministry document that summarized the report was leaked to the German and Austrian press and subsequently translated into English.) The GRS study used dynamic computation modeling that looked at the potential consequences of a wide range of impact possibilities on different plant equipment and installations. Different types of airplanes, velocities, angles of impact, weight loads and fuel effects were considered, as were various sequences of events. Aside from the basic finding of vulnerability, the GRS study is significant for recognizing the limitations of even its highly complex analyses. Key unknowns include the impacts of fire loads on many kind of materials and equipment as well as the behaviors of varioLls combustive materials under the conditions of a plane crash. 2004: In 2004 the U.K. Parliamentary Ot1ice of Science and Technology (OST) issued a secret report on the risks of terrorist attacks on nuclear facilities lik: 'Ci/Ls.:r,;:ulrich.L; LRICII \V rITEDoClInlCnt5:DoclInl .. nai'(*;,20tor%20sub:nitlaL'Council'"T crrorism";,20cllPytxt ( 16 (If ! 71 ll21320117 1 PM] ti Ie: 'fCiL: L LR Ie H\1/ 1 TT E: Documents.DocLlments ind ian"*,,2()po ...Oappcndix'Yc,20r' ti IfC0L1nci I's T crrori,m"<',20copy, L'{t to the U.K. House of Commons Defense Committee. The OST report was leaked to the magazine New Scientist, which reported the OST conclusion that a large plane ('rash into a nuclear reactor could release as much radiation as the 1986 accident Chernobyl, while a crash into the nuclear waste tanks at the U.K.'s Sellafield facility could cause several million fatalities. From these studies it is clear that there exists a reasonable basis for concern regarding malevolent deployment of aircraft against nuclear power facilities. [t should also be evident that all studies on this topic are, in substance, educated conjecture. The current state of computer modeling is not up to analyzing the full range of physical and chemical interactions that could occur under the incalculable range of different kinds of aircraft, approaching at different angles, at different speeds, hitting different stmctures, which all have facility-unique room and equipment layouts, and different substance, chemical, and ventilation-related conditions. A lesson in the unpredictable consequences of airplane crashes was brought home on September II (when even the 47 story tall 7 World Trade Center that was not struck collapsed for reasons engineers have yet to fully determine). A lesson in the limitations of advanced computer modeling can also be learned from the Columbia space shuttle disaster. DBT and PRSR] ************************************** See what's new at http://www.aoLcom til,,:i 'CI/C:;ersiulrich.C LR!CHWiTTE;DoCLIITIcnL,'DncLllll".nal%20for"",20submittaIiCml11cil'"r arorislll"*;,20copy.txt 117 of [71 [12, V20()7 [0' f'1\Il J

< S "f)

:;-, ., on g

.;y ;c ;;2 " 2t 'r? ( I, "I 11iiTfTf nn T jn the !'c<lsomlhlc ihre<11 l112il;nst which a gU;lrd li'lTt' !'hollld br-cxpectcd to defend onder t"'xIslmg l'l\\'.;lf* acton!in£! tn tl1{';.JR(' ,l11nOHlKC111ent The del nil!' 01' the re"i:::ed DBT. " hieh tonk ("freel (ktnhn ,If), :!004,wcre not rclcC'!:;;cd to the pnhlit:,NRC reqnires each ntlClc<lr power plant conduct periodic !'ccIIl'iryc'I(crci!'C-: to te!'tit!' <1oility ilcfend ;Jgain,-:t 111c 111re"L rn th('sc flfrrforcc on 1'nrveilr* c'{crci-scs,monitorco hy NHC. nn nfl\'('rS(lry f0!"CC from outside the plant atlempts to pellctrMc thcplan!;lFHf s \'j1;;11 a1'('<1 "no ciamagc0rO{\-;trny\"e:v'snfctycnrnpnncnts, Pnr1icir'lrlts in thc tigh!lycnntrnllcd c....;crcisc::.: C.1rry weapons modificd tn fire only hhmks and i;lscr hursis tosfIHlIinte Dnd they \year !'cnsors tn ini1it';Hf" hits, Other wcapc'1ls anciexploslvc,;;. well dcsrnlcttnn 01' hrc(lchil1g of ph:::;:Ic[l1 Inny hcsimulmed, \Vhik 011(' or the gl1:1rd rnrcc is rl1rlicipl1!lnp. in rnru'-(11l-forcec'(crrisc. anolhn 5:qu:1d j:;; i'\iso nn dutyto lTInlnlnin 1101'1'1"131 pfant seclldty, Phlnt ddcndcrsknow that ;1 111()ck nttack \dO ttlkc r1nce dllring (l <\pccifk pcrTflo sc\'cr;:,IllOms. hilt they do not kHow wlmt the att[lck scenario will hc, 8tttlck ::Icf"ll<1rio>.:arc cnnducted o\'er d:1YS or rxcf'c;sc5;,FIl!l irnpfcmcnlntion nr thef<w'Ce-l1n-rorceprogr:1111 coincided with lhccffcctlvcdnlt'ofthc new nnT il1lntc 1004. Slnndnrd procedurcs rll){i othcr rCfluircl1wntr.; h"l\'c hcendc\'clopcd for w;,ing the ('>.:crciscs to ('\'alwHl" plClIH ;.;et:llnly

mo a;.; iI trlking regulatnry enforcement

Clcllnn, tradcoffs Brf' l1eccl'snry In make ns rcnliqie (lnd pn:-;\.,ihle wilhoni cndangering participant:" CllTcgl!lnf p1mH and security, Filch plan! is f'cf]tlircrl to c0ntiHel NHC-11l(,niloredfhrn>0n-fo,'cc

('xcrelses nntc cvery fhrce yctlt1-,NRC Tequil cd thc 11IJCic:lr In (ic\'clot" ,and tl"nin a <jhrc0lTlpnsitc iHh'er,"'myfol'ccfif* cOlnrrL.;;ing rdlkcrs tI'011l 1llfmy plants tn slmul()h.' tcrrnri;.;! in c:-:cf'ciscs, 1 I{)\\'CYCL in Septemher 2()ft4 testimnny. the (,m'C'TmnCI1!

\ccnilntahihtyOfficC" (( JAO) nitici7(;o the fl .,;;ccllritycnmp;'lIlythntglwrd;.;

annut half of'lI.S. nucleiu pl(lnb. \V:1ckenlmL tn also prm'ide nw 'ldn:.'rsnryft'I'i."'e.In 3dditioll tn r;1ising: Jfrcque:-tlolls ilMnnt the fnrcC'JfT'ls ind('pcndct1ce.11f* (If\,() nofed thn1\\/;lCkcIlhut had heen ()((used of ch('{11i1)p: nn prc\'lotlf' hy tlwf)crmimt'nl nf Energy J. Paf!C' iDr the nnT and the FnCff!Y Policy Act of2005. sigllcd 100:'. The nct 1hm earhnudcl1t' pkWf I1nderp-n forcc-ol1- /0rc{' C,\C'IT1SCS ill lenst nnce t'ycry thr('c ye<lrs pnlicy). thn!lheC':"(ercisCR simnllltcthrthrcatl' in thenRT. "n1<l thalNRC nFremitig{lteany p01cntial cnnflict nf interef't that could influence 1hc rrsu1t<\ nf., IhrcC'-on-forcC'c'Xcrri!'l", the delcrmincs to he and l1pprnpriatc,<j(-* Tlw I1('W l(lw requirl':- NRC In revise the nRT within I g 111(111111s. nfter considcring.-J wi(lc \'arrety of pntC'HliFd rnodcs nl" att(l('k chemicilL hl(llngical. etc.), thcpotcntial fnr Imp:C' hy multiple tcmns. pNPntiai :lssistal1cc hy i\('\'("rnl ctnp!nyccsinsicic n filcility. the Clf" tnrgc c.xp'nsin':- and ()thcr 11l0dern \\'(';lrOnry. nne! othcl'spcciric f:1ctnrs. Emergency Response, A fterthc I ()7() accident ,I! the ThrcC' Mik Lsland nuc!enrphm! !lear llanishurg. PA, ('nngrc's!' reqmrcd thnl <111 nuclear power plimts he cn\'t'J'cd hyemcrgenc y' plnlls, NRC requires tlwt within nppl"f'lximnte!y In-mile EmcrgellcyPillnfllnt:: Zone (EP1) nrnttnd ench plnni the npcrn10r mu.;;t mi1intl1in waming an<ircgularly ((lndnct c\'acwltinn nwnitnrC'ct hy NRC nnd Ihe FCc1CJ"(lt Fmergcl1t.:yManagel1wnt Agency (FFMA}. fn light of the incrc(lsl"d I"()ssihilitv of"terrnrist <Htflcksth1L if sHtcessfuL could l'c:,uh in relC"",sc of" n'ldinflctl\'C n1atcri<l1. critiCS hl1\'c rCl1cwcdc;:111s fi)]'expnnding lhr FrZ to ine1ndC' poplilatiml controversial rcg;1ni1ng emergency tn " rclCH.".ef"rnm ,1 llUrlC':H fW\\,('!' plnnt i:: il1C rlis1rihllltnll or 10<1,1\r pill:.;, .t\ significant cnmpol1rnt ofnn m:cidcnlnl nr tClTflr1S1 rc1c;rs(" from it nllcl(,<l1' rr<1ctOI' would he [l form nfiodinc. 'which I('nd;;; cnnct'lHrMc in the Ihv1'01<1 g!<l1ld ofpersnnf' (<posed to it. T;,kinf,!,' pill containing lH)fH'rldinnctivc iodin(' hd(1"t' cXI,n,,"u\,c woufd prCYtmt ah;.;(wptinn (If incllnc. Filiergency pl<lrlS in many stntes inciwlc of iodine pill;.:to the rH11"Hiatinl1 \vithin fhe EPZ. which wOllrd protect Ihml exposure tn l"ndinncti\'C'iodhle, nllhough giving no prott'cllon Hgilins! nlhl"r radi0<lClrvC elemellts in the 111 2002 hegan pnwidingtodine pill.:; to states f'nr popnl;ltiPT1S withinfhc lO-mile FP7.Nncle;:1r Planf Vlllner.nhjhty()pet':lting tlIKlear reac!ors cont[lln l.nrgc ;11110\lnl:- nf 1..1dinnctTvc ri;;sion I"rnductswhich. if diSopcrscd. ('ou!d pnse <I dlreel radial inn h<17i!nL 1l1) i ::... :! 1; ::; :=. 2. 4' c; -:: &-;;! ;:....., g 1 g 3 -' __ Iii ---- .. " '§. ol* 1!I:lll l ,. :3 " ;! OJ) ::-: ?!! ....., ::::.z §. 2;':l ..., Jl " :3 n --§.. ;" I t,k C !'T-; lilt numher no1 1)(' fc-dllCCct wIess 111;111 fi\'(' g:t1mds.<if"Thc primary {'OtlCC'I"!1

whether

('ould href-lch lhe 1hick concrt:'te On1 srent fuel !,oo1 and d!'aill t\lf> C()o1inl1 \\'fllcf. \vhich could the :-penl clnddinf: jn ovcrhcrlt C,1Ic11 firf'. A rcp()rt in :'\rril 200:' hy !heNi1!i011<11 AC(ldcl11v of Scil'nce,I'\ (NAS) fotmd lhM tcrrnrl:-t ,)trncks: on Slwl1lfll('l rnois, tl10ugh difficult arc pnssihJc.;"if:. and lh(11 f1fccif "n i1it<1ck lC'nds In <l rrorap-min2!/ircnnimn cbdding fire. it c(\l!ld result in or large nf radinnctivemiitcriaLif" NAS n'col1ltrlenoed thauhchnHes1

pel11 fuclhC'!ntrL"pcrsed\\'llh cooJerspcntfucilo reduce the likelihooD of firc. th(l(

be in:;;t;:dlc(i tn ('onlsjlenl f!lel ifroo! water WCfe The feport :llsn called fnr NRC tn conduct nf (be and (,<lr1 ler l1w\'('\TlC'T11 of spent fuel frnm pools in1n the nne; Scm11c-pas:;:ed \'C'I'SlnnS nf the FY2006 Energy <,md \\!aterDcvciormcn! ap!,1'0rriahnn., j,ill nr.H. ,410. H.Rer!. 1 O'LR6. S,Rer!. 100 R4) wOllldrmvide $21 millioll for tn rarry out the NAS rccomll"lcl1dMions, The parlicuinrlycrilicfllnfNRC,)fn'1;;; actions 0)) fue!"u'lrt1gcsccllri1y: ,)f(rThc Committce the NRC tn rcdouhk efrons to nddrc% 111<" NAS-idcntifkd deficiencies;, [lnd to dirC'ct. Hot rcquest. industry jo pn'lT'tpj <1l1d (If srrurity In('(1SIll'(,S lul\'c dcrmmdcrl hoth :-hnrf-tcrn"l rind Icgislali\'C' fund8mcHt;'t! COil cern W8S nnture nflhc nnT. which crillc" contended shnuldheinncascd !o include " number 0f SCr!lfiitC. ('oorriina1cd (1n'leks. Critics ,11so cnntcndcdthnl nenrlyhHlf (lfthc planls tc;;:ted in NHC-monitol'cd !1wck att(lck:-hcfnre ()/ll f("tiled tnrepci C\Tn lhl' smill! f{llTe:" specified in the OrJf!!Il?! nRT. il chnrgc thflt denied Critic:.; "lISt) poinled ntH 111<1t lin">n5:(,cs arc rcqnirc(i In emplny only flll1111imum 0f s{'('urilYI1t:!"5\ntHlel nn rlntyre!' ptnnL which thcynrp:uc is not cl1t1ugh fnrlhe .10h.5Nudcar srokcspcrsons !'c.:;p0ndcd tint the (lctu(li sC'clIl"ity forcc.101" the 1l<ltion;lf"T\ l st'=, nuclcnr phmt numher:" more t11'111 :-;JiOO,:111 (lVcT(lge or ah(1llt per s1te ((,,(,)'Tring.multipk shifts). rhmt forces (t1"(' supposed In he nidcd ,",)i l0c3! 1(lwcnf{)!TcnlCn1 0ffkcf£\ If ,,111 (ltiack nceursJn NHC l!11piementni \\'ll<it it called ,1f(1'Illtcrlrn COl1lllC'l1S:1WrysC'cllrilY1l1CI1S1!fCS.Bf-lncltlding rCCJllircmcnts for innc[l);t:'d riltrols, 11ugrnented security forces andt'npahil1tlcs, 11ddilifll181 s('cl1ritypnsts. insU111t1tin!1 ()f <iddi!loll.11 physict11 harriers. \'chiclcchccb !'!:md oil di!'l<lnc{'s. cnh<lllccd ('()ornmalion with law cnk'l'ccl11cnt flndmilita!Y<HI!hnrilie;r.:. nnd more n'strirtin' contl'ol" !01' nil pc!"snl1l1c!. The fun\1el' Pnge b issued April 2n, 200J. expanded nn the c<1rlier measures. incl11ding theORI. which continue. descrihe inndcqu<ltc. Cnnl1nuing: resulted in jhc new criteria in Ihe Policy Ar! of 20fl:; ror further of the on security. NR(,cstnhlishcrl thr-Office or Nnr!c:lrSecllnly ilnd Inddent Respollse on Arri! 2no1. Tll0. nflfcf'

.;C'C'nrilynvcrsigi1t of

111 NRC-rc-gttl;Hccl facilities.

cnnrdinMes wilh k1\\' C'nforcement .:1ndinte!!if!C'l1fC f1!1C'l1cics. Hnd hnnd1e;; emergency plnnning "lcl ivitics. Fnrcr-nn rnrccC':xerc;::;es arc an cXllmplc of the rc:-:ponsihililics. ()n .Tunc 17, lOIn. 1he of Deputy ExC'c!lti,,{' DirN'tnr fl)" I fonlClrmd PrOi('ction \\*ho'c purview inelwies the OfTicc ofN"dcar Security nnd incidc-ntRrsrnnse.Lcgis!;1tinn. Since the f)q 1 <I!!ilCks. mnnt'l'PHS legi!'lativc PWP{)S'l!:'. incilHhngsnmc hy NHC, {)n lll1c!enr pfl\\'cr Sc"cml of SHch the n."'isinn nfthc 1111"C'<1.1 (lnd the f{)lTC'-on-r'{)fCl' were included in Energy Pnlicy I\ct of 10():" which <1lso inclndes:

(l:'::-:lglllncnt of n fcdcn11 security cOf'rdillatnr for ("lc11 NRC power f(w !luclear plmli etrlC'rg.ency w<lrning of lacti<ttion and checks for nucle,\!*

nlcility lIse ()ffircarm;; 1H1cle;l1' f':lciiity sC'cllrity pcrsonnellprccmpting' NRC I'cf!ulntc dangerous '\"C,lPOl1S racili!ies:!cx!ending pcna!jics !Of >;clhnlngl' tn ('(wcr 1111c1cnr f:'1cilitics n manifC'!'! (,lnd personnel hnckr.:rnund checks f{'r import 8ndcxpnrt of nuclear 181,,: ;md!rcquiring consult with the Tkpnrtm('nl pfl'nmcl(1nd \'ulne!":lhility to terrorisf

1l1(lck nr loentions I)f prnpn::>C'o nnclL'arracilltiC's hcf(wl' j,,;;slling n licens(', /\ ll\llllhcr flr IC1!isiati\'('

prnposals introduced <.:incc q!r I to incn.'tlsc nm:1car plant:-:t'l'urii**wcrc not 1l1cludcd 111 thc nt'W leI\\". inl'lllding 1h(' (,1"(';,1trflll nf' nl-}}