NUREG- 1776

Regulatory Effectiveness of

the Station Blackout Rule

U.S. Nuclear Regulatory Commission

Office of Nuclear Regulatory Research

Washington, DC 20555-0001
AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

NRC Reference Material

As of November 1999, you may electronically access

NUREG-sernes publications and other NRC records at

NRC's Public Electronic Reading Room at

http:/Iwww.nrc.aov/readina-rm.html.

Publicly released records include, to name a few,

NUREG-series publications; Federal Register notices;

applicant, licensee, and vendor documents and

correspondence; NRC correspondence and internal

memoranda; bulletins and information notices;

inspection and investigative reports; licensee event

reports; and Commission papers and their attachments.

NRC publications in the NUREG series. NRC

regulations, and Title 10, Energy, in the Code of

Federal Regulations may also be purchased from one

of these two sources.

1. The Superintendent of Documents

U.S. Government Printing Office

Mail Stop SSOP

Washington, DC 20402-0001

Internet: bookstore.gpo.gov

Telephone: 202-512-1800

Fax 202-512-2250

2. The National Technical Information Service

Springfield, VA 22161-002

www.ntis.gov

1-800-553-6847 or, locally, 703-605-6000

A single copy of each NRC draft report for comment is

available free, to the extent of supply, upon written

request as follows:

Address: Office of the Chief Information Officer,

Reproduction and Distribution

Services Section

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

E-mail: DlSTRIBUTION~nrc.gov

Facsimile: 301-415-2289

Some publications in the NUREG series that are

posted at NRC's Web site address

httnIllAmwuwu n nnv/rp-ldinn-rmidorc-collertinns/n, renNon-NRC Reference Material

Documents available from public and special technical

libraries include all open literature items, such as

books, Journal articles, and transactions, Federal

Register notices, Federal and State legislation, and

congressional reports. Such documents as theses,

dissertations, foreign reports and translations, and

non-NRC conference proceedings may be purchased

from their sponsoring organization.

Copies of industry codes and standards used In a

substantive manner in the NRC regulatory process are

maintained atThe NRC Technical Library

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852-2738

These standards are available in the library for

reference use by the public. Codes and standards are

usually copyrighted and may be purchased from the

originating organization or, if they are American

National Standards, fromAmerican National Standards Institute

11 West 42"d Street

New York, NY 10036-8002

www.ansLorg

212-842-4900

Legally binding regulatory requirements are stated

only In laws; NRC regulations; licenses, including

technical specifications; or orders, not In

NUREG-series publications. The views expressed

in contractor-prepared publications in this series are

not necessarily those of the NRC.

The NUREG series comprises (1) technical and

administrative reports and books prepared by the

staff (NUREG-XXXX) or agency contractors

(NUREG/CR-XXXX), (2) proceedings of

conferences (NUREGICP-XXXX), (3) reports

resulting from International agreements

(NUREG/IA-XXXX), (4) brochures

(NUREGIBR-XXXX), and (5) compilations of legal

decisions and orders of the Commission and Atomic

and Safety Licensing Boards and of Directors'

decisions under Section 2.206 of NRC's regulations

(NUREG-0750).

are updated periodically and may differ from the last

printed version. Although references to material found

on a Web site bear the date the material was accessed,

the material available on the date cited may

subsequently be removed from the site.
NUREG-1776

Regulatory Effectiveness of

the Station Blackout Rule

Manuscript Completed: August 2000

Date Published: August 2003

Prepared by

W.S. Raughley

Division of Systems Analysis and Regulatory Effectiveness

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001
NUREG-1776, has been reproduced from

the best available copy.
ABSTRACT

The Nuclear Regulatory Commission's Office of Nuclear Regulatory Research is reviewing

selected regulations, starting with the station blackout (SBO) rule, to determine if the

requirements are achieving the desired outcomes. This initiative is part of an evolving program

to make NRC activities and decisions more effective, efficient, and realistic. This report

evaluates the effectiveness of the SBO rule by comparing regulatory expectations to outcomes.

A set of baseline expectations was established from the SBO rule and related regulatory

documents in the areas of coping capability, risk reduction, emergency diesel generator

reliability, and value-impact. The report concludes that although there are opportunities to

improve the clarity of SBO related regulatory documents, the SBO rule is effective and the

industry and the NRC costs to implement the SBO rule were reasonable considering the

outcome.

iii
CONTENTS

ABSTRACT .............................................. iii

EXECUTIVE SUMMARY . .............................................. vii

FOREWORD.............................................................. xi

ABBREVIATIONS ......................................................... xiii

1 INTRODUCTION .......................................................... 1

2 BACKGROUND .............................................. 1

2.1 Station Blackout and the Station Blackout Rule ......................... 1

2.2 Technical Basis for SBO Regulatory Requirements and Guidance ..... ..... 2

3 ASSESSMENT OF THE STATION BLACKOUT RULE ......... ................... 4

3.1 Method for Assessing Regulatory Effectiveness of the Station Blackout Rule . . 4

3.2 Comparison of Expectations and Outcomes .. 5

3.2.1 Risk Reduction .6

3.2.2 Emergency Diesel Generator Reliability .9

3.2.3 Minimum Acceptable Coping Capability, Plant Procedures,

Training, and Modifications .16

3.2.4 Value-impact Analysis .16

3.2.5 Insights From Operating Experience Reviews .19

4 CONCLUSIONS ............ 22

5 REFERENCES ............ 24

APPENDICES

A Technical Basis of the Station Blackout Rule and Additional Background .A-1

B Plant-Specific Station Blackout Information by Reactor Type and Operating Status . B-1

C Comparison of Selected Station Blackout Characteristics .C-1

D Emergency Diesel Generator Trigger Values .D-1

E Station Blackout Rule Activity and Modification Summary .E-1

F Operating Events .F-1

G Resolution of External Comments . G-1

FIGURES

1 Preliminary unit average emergency diesel generator unreliability compared to the

unreliability estimates using the probabilistic risk assessment/individual plant

examination emergency diesel generator performance assumptions .12

v
TABLES

1 Summary of station blackout rule expectations and outcomes . . 5

2 The number of plant units in station blackout core damage frequency

ranges before and after station blackout rule implementation . . 6

3 Probabilistic risk assessmentrindividual plant examination sensitivity analyses ... 7

4 Estimated increase in the station blackout core damage frequency due to a

decrease in emergency diesel generator reliability from 0.975 to 0.95 . .10

5 Effects of maintenance out of service while the reactor is at power

on emergency diesel generator reliability .. 11i.................... 

6 Station blackout rule value-impact summary ............... . 17

7 Dominant station blackout risk factor trends - offsite power system .... ......... 20

B-1 Operating pressurized-water reactors .. B-1

B-2 Operating boiling-water reactors .. B-6

B-3 Reactors no longer operating .. B-9

C-1 Comparison of selected station blackout characteristics .. C-1

D-i Industry emergency diesel generator trigger failure rates . .D-2

D-2 Statistical confidence that emergency diesel generator reliability is met . .D-4

D-3 Statistical confidence that emergency diesel generator reliability is NOT met .. D-5

E-1 Station blackout rule activity and modification summary . .E-1

F-1 Losses of offsite power since 1990 having recovery times greater than 4 hours ... F-1

F-2 Station blackout challenges .. F-4

vi
EXECUTIVE SUMMARY

The Nuclear Regulatory Commission's Office of Nuclear Regulatory Research (RES) is

reviewing selected regulations, starting with the station blackout (SBO) rule, to determine if the

regulatory expectations are achieving the desired outcomes. This initiative is part of an

evolving program to make NRC activities and decisions more effective, efficient, and realistic.

As part of this program, RES is also reviewing the effectiveness of generic safety issue

resolution.

The NRC designated SBO, which is a loss of all offsite and onsite ac power concurrent with a

turbine trip, as Unresolved Safety Issue A-44 in 1980. In 1988, the Commission concluded that

additional SBO regulatory requirements were justified and issued the SBO rule (Title 10 Code

of Federal Regulations [CFR] Section 50.63 [10 CFR 50.63]) to provide further assurance that a

loss of both offsite and onsite emergency ac power systems would not adversely affect public

health and safety. The SBO rule expected a reduction in the risk as a result of licensees

maintaining highly reliable onsite emergency ac electric power supplies; ensuring that the plants

can cope with an SBO for some period of time; developing procedures and training to restore

offsite and onsite emergency ac power should either become unavailable; and making

modifications necessary to meet the SBO rule requirements.

To assess the regulatory effectiveness of the SBO rule, the expectations were established from

objective measures as stated in SBO related regulatory documents in the areas of coping

capability, risk reduction, emergency diesel generator (EDG) reliability, and value-impact. The

outcomes were obtained from realistic information to include the operating experience and NRC

equipment reliability studies based on actual safety performance. Comparison of the

expectations to the outcomes showed whether the expectations were achieved. Discrepancies

between expectations and outcomes prompted a review of the related regulatory documents to

find areas that need NRC staff attention. To increase public confidence, earlier drafts of the

report were made publicly available and stakeholder comments were openly addressed in an

appendix of the report.

The report's conclusion is that the SBO rule was effective considering that the risk expectations

were achieved, and that industry and NRC costs to implement the SBO rule were reasonable.

In implementing the SBO rule, some plants made hardware modifications (e.g., the addition of

diesel generator or gas turbine generator power supplies); and all plants generally maintained

EDG reliability at 0.95 or better, and established SBO coping and recovery procedures.

Consequently, the plants have gained SBO coping capability, reduced risk, increased the

tolerance to a loss of ac offsite or onsite power, and many plants benefitted economically from

the addition of power supplies. To elaborate:

* The reduction in the estimated mean SBO core damage frequency (CDF) was

approximately 3.2E-05 per reactor-year, slightly better than the 2.6E-05 per reactor-year

expected after implementation of the SBO rule. As a result of the improvements made

under the SBO rule, more plants achieved a lower SBO CDF than expected, and the

plants with the greatest numbers of loss of offsite power from plant events and

extremely severe weather conditions made the most improvement by providing access

to an alternate ac power (Aac) supply. In addition, maintaining high EDG target

reliability levels provides assurance that probabilistic risk assessment (PRA)Alndividual

vii
plant examination (IPE) EDG performance assumptions are valid. With some

exceptions, the observed EDG reliability performance generally exceeds the mean

reliability EDG performance assumptions in the PRANIPEs indicating that SBO CDFs are

smaller and better than stated in many PRANIPEs. As the SBO rule risk reduction

objectives have been exceeded, further investigation of strategies for reducing SBO

frequencies (as suggested in NUREG-1560, "Individual Plant Examination Program:

Perspectives on Reactor Safety and Plant Performance," December 1997) may not be

needed.

* As a result of the SBO rule all plants have (1) established SBO coping and recovery

procedures; (2) completed training for these procedures; (3) implemented modifications

as necessary to cope with an SBO; and (4) ensured a 4- or 8-hour coping capability.

* Before the SBO rule was issued, only 11 of 78 plants surveyed had a formal EDG

reliability program, 11 of 78 plants had a unit average EDG reliability less that 0.95, and

2 of 78 had a unit average EDG reliability of less that 0.90. Since the SBO rule was

issued, all plants have established an EDG reliability program that has improved EDG

reliability. A report shows that only 3 of 102 operating plants have a unit average EDG

reliability less than 0.95 and above 0.90 considering actual performance on demand,

and maintenance (and testing) out of service (MOOS) with the reactor at power.

However, the analysis of EDG performance on demand indicates MOOS with the

reactor at power is more than expected and can have a significant effect on the EDG

reliability calculations. Increased MOOS explains why licensees appear to be having

difficulty meeting a 0.975 EDG target reliability. Decreased EDG reliabilities and/or

increased MOOS unavailabilities erode the risk benefits obtained from implementing the

SBO rule.

* The operating experience indicates that the SBO rule has increased defense-in-depth.

The SBO related hardware and procedures have been used in response to unplanned

events and provided additional protection. The SBO rule provides additional

defense-in-depth to compensate for potential degradation of the ac offsite power system

that may result from deregulation of the electric power industry or longer than expected

recovery of offsite power after extremely severe weather conditions.

* A comparison of the value-impact expectations to the outcomes indicates that the

value-impact was within the expected range of reductions in public dose-per-dollar of

cost. As expected, there was wide variation in plant-specific values and impacts

because the SBO rule allowed flexibility. Not expected was the addition of costly power

supplies, which accounted for 75 percent of the estimated industry cost impact and

explains why the NRC value-impact analysis underestimated the cost by a factor of 4.

However, it appears licensees justified the cost of the power supplies by counting on

offsetting monetary benefits, such as more operating flexibility from increased EDG

allowed outage times. Thus the value was also underestimated. The remaining

25 percent of the estimated industry cost impact appears reasonable, considering the

outcomes: known coping capabilities, industry risk reduction from plant-specific

procedural and hardware enhancements, and additional defense-in-depth.

viii
A comparison of the SBO rule expectations to the corresponding outcomes indicates that

resolution of the generic issue of SBO was effective as no additional generic actions are

warranted and no new generic safety issues have been identified.

Although the SBO rule was effective for the reasons stated above, consistent with adhering to

Principles of Good Regulation that include clarity (coherent and practical regulations) and

reliability (regulations based on operating experience), there are opportunities to revise the

regulatory guidance and inspection documents. The proposed revisions are not intended to

impose any new regulatory requirements, are consistent with the SBO technical basis

(NUREG-1032); ensure high levels of EDG reliability; maintain present levels of safety by

ensuring the risk benefits obtained from implementing the SBO rule do not erode; provide

practical guidance for reactor shutdowns with limited offsite or onsite power sources; and use

operating experience to improve the predictability and consistency of NRC decisions in the area

of EDG reliability. The opportunities are as follows:

(1) Regulatory Guide (RG) 1.155, "Station Blackout," August 1988; RG 1.9, "Selection,

Design, Qualification of Diesel-Generator Units Used as Standby (Onsite) Electric Power

Systems at Nuclear Power Plants," Rev. 3, July 1993; and RG 1.160, "Monitoring the

Effectiveness of Maintenance at Nuclear Power Plants," Rev. 2, March 1997; which

address use of the existing EDG reliability terms, criteria, and measurements may need

to be revised in a coherent manner to: (a) clarify that EDG unavailability because of

MOOS with the reactor at power should be included in the reliability calculation;

(b) clarify that licensees should balance increased EDG reliability against the increased

EDG unavailability to maintain the RG 1.155 minimum individual EDG target reliabilities;

(c) clarify that the EDG system boundary used in the reliability calculation should include

the load sequencer and the bus between the EDG and the loads; and (d) establish

common EDG start and load-run criteria for the guidance.

Inspection documents Temporary Instruction 25151125, inspection of Implementation of

Station Blackout Rule," (no date); and Inspection Procedure 62706, "Maintenance Rule,"

December 31, 1997; may need revision to delete use of the Nuclear Management and

Resources Council (NUMARC) (now NEI) trigger values to assess compliance with the

0.95 and 0.975 EDG target reliability. The NUMARC trigger values, which are not

endorsed by the regulatory guidance, do not provide high levels of confidence that the

EDG target reliability is being met; this is inconsistent with ensuring high EDG reliability,

delays corrective action, and erodes the risk benefits obtained from implementing the

SBO rule.

(2) Operating events indicate that the availability of some Aac power supplies is dependent

on offsite or onsite power supplies. SBO-related inspection documents may need

inspection attributes to verify that the Aac sources meet NUMARC 87-00, "Guidelines

and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light

Water Reactors," Rev. 1, May 1993; Appendix B, B.8, "Minimal Potential for Common

Cause Failure.'

(3) RG 1.93, "Availability of Electric Power Sources," December 1974; the basis for

technical specifications in the area of ac onsite and offsite power supply availability,

provides for shutdown of the reactor following extended ac power supply unavailability.

Plant shutdown with one or more offsite or onsite power supplies unavailable could

ix
exacerbate the grid condition or remove redundant sources to operate decay heat

removal systems, increasing the likelihood of an SBO. Additional practical guidance

may minimize the likelihood of an SBO.

(4) Follow-up at 2 plants revealed a large difference between the unit average EDG

reliability based on load-run tests and unplanned demands and the reliability calculated

by the licensee based on the last 100 start and load-run tests and unplanned demands.

This difference confirms a previous finding in INEL-95/0035, "Emergency Diesel

Generator Power System Reliability," February 1996, that the current testing and

inspection activities (as prescribed by the NRC) may not be focusing on the dominant

contributors to unreliability during actual demands. Accordingly, NRC inspection

documents may need to be modified to better factor in the conditions and experiences

gained from actual system demands to facilitate inspection of EDG compliance.

As lessons learned: (a) to the extent that the NRC staff revises existing regulatory documents

to be more risk-informed and performance-based, they may need to be modified to ensure

consistent interpretation and use of terms, goals, criteria, and measurements; and (b) new

regulations or the accompanying regulatory documents should include quantitative objectives to

facilitate evaluation of its regulatory effectiveness.

x
FOREWORD

This report evaluates the effectiveness of the station blackout (SBO) rule by comparing

regulatory expectations to outcomes in the areas of coping capability, risk reduction, emergency

diesel generator reliability, and value-impact. The report concludes that although some

regulatory documents may require clarification consistent with the Principles of Good

Regulation, the SBO rule is effective and the industry and the NRC costs to implement the SBO

rule were reasonable considering the outcome. The report also concludes that resolution

of the generic issue of SBO was effective, as no additional generic actions are warranted, and

no new generic safety issues have been identified. As a result of this report, the relevant

inspection procedure guidance was revised to discontinue acceptance of licensee use of EDG

trigger values.

The report also identifies lessons learned for future regulations as follows: (a) to the extent that

the NRC staff revises existing regulatory documents to be more risk-informed and performancebased, they may need to be modified to ensure consistent interpretation and use of terms,

goals, criteria, and measurements and (b) new regulations or the accompanying regulatory

documents should include quantitative objectives to facilitate evaluation of its regulatory

effectiveness.

The report is consistent with the NRC strategic performance goals. For example, in the area of

making NRC activities more effective, efficient, and realistic, the report applied the Principles of

Good Regulation of clarity and reliability by concluding that three regulatory guides that use the

EDG reliability terms, criteria, and measurements may need to be revised in a coherent

manner.

In the area of maintaining safety, the report proposed revisions to the related regulatory

documents consistent with the SBO technical basis, to ensure high levels of EDG reliability, and

to maintain the risk benefits obtained from implementing the SBO rule. In the area of public

confidence, the report invited stakeholder comment that were stated and addressed in

Appendix G.

AzU_

Farouk Eltawila, Director

Division of Systems Analysis and Regulatory Effectiveness

Office of Nuclear Regulatory Research

xi
ABBREVIATIONS

Aac alternate ac

ACRS Advisory Committee on Reactor Safeguards

AOT allowed outage time

CDF core damage frequency

CFR Code of Federal Regulations

EDG emergency diesel generator

GSI generic safety issue

IN information notice

INEEL Idaho National Engineering and Environmental Laboratory (formerly INEL)

IPE individual plant examination

LER licensee event report

LOOP loss of offsite power

MOOS maintenance (and testing) out of service

NEI Nuclear Energy Institute (formerly NUMARC and USCEA)

NRC Nuclear Regulatory Commission, U.S.

NUMARC Nuclear Management and Resources Council (now NEI)

PRA probabilistic risk assessment

RES Nuclear Regulatory Research, Office of (NRC)

RG regulatory guide

RY reactor-year

SBO station blackout

SSC structure, system, and component

US! Unresolved Safety Issue

xiii
1 INTRODUCTION

The Nuclear Regulatory Commission's (NRC's) Office of Nuclear Regulatory Research (RES) is

reviewing regulations, starting with the station blackout rule (SBO), to determine if the

requirements are achieving the desired outcomes. This initiative is part of an evolving program

to address regulatory effectiveness to make NRC activities and decisions more effective,

efficient, and realistic.

SBO can be a significant contributor to core damage frequency (CDF) and, with the

consideration of containment failure, can be an important contributor to reactor risk. In 1980, the

Commission designated the SBO issue as Unresolved Safety Issue (USI) A-44, "Station

Blackout," to determine the need for additional safety requirements. On June 21, 1988, the NRC

concluded that additional SBO safety requirements were justified and published the SBO rule in

the Federal Register Notice 23203 (Title 10 of the Code of Federal Regulations Section 50.63 [10

CFR 50.63], "Loss of all alternating current power") [Ref. 1]. The amendment was intended to

provide further assurance that a loss of both offsite and onsite emergency ac power systems

would not adversely affect public health and safety.

In May 1997, the staff briefed the Commission on the individual plant examination (IPE) insight

report, "Individual Plant Examination Program: Perspectives on Reactor Safety and Plant

Performance," NUREG-1560, December 1997 [Ref. 2]. The report concluded that SBO remains

a dominant contributor to the risk of core melt at some plants, even after implementation of the

SBO rule; that SBO frequencies are above 1 E-05 per reactor-year (RY) for many plants; and that

these results warrant further investigation of strategies for reducing SBO frequencies. In a staff

requirements memorandum, "Briefing on IPE Insight Report," May 28,1997 [Ref. 3]; the

Commission asked the staff to provide a scope and schedule for using IPE results to assess

regulatory effectiveness in resolving major safety issues. The staff responded in SECY-97-180,

"Response to Staff Requirements Memorandum of May 28, 1997, Concerning Briefing on IPE

Insight Report," August 6,1997 [Ref. 4], noting that the probabilistic risk assessment (PRA)

Implementation Plan was tracking activities to assess the regulatory effectiveness of major

efforts to resolve safety issues, including SBO. SECY-97-180 noted that these activities would

determine whether additional generic action is warranted, assess whether any new generic safety

issues (GSIs) warrant attention, and whether the IPE results justify plant-specific actions.

2 BACKGROUND

2.1 Station Blackout and the Station Blackout Rule

Federal Register Notice 23203 amended the regulations to define an SBO and add the SBO rule.

In 10 CFR 50.2, "Definitions," SBO is defined as the complete loss of ac electric power to the

essential and nonessential electric switchgear buses in a nuclear plant (i.e., loss of the offsite

electric power system concurrent with a turbine trip and unavailability of the emergency ac power

system). In 10 CFR 50.63, the SBO rule requires that nuclear power plants be capable of

withstanding an SBO for a specified duration and of maintaining core cooling during that period.

The specified duration would be determined for each plant by comparing the individual plant

design with factors that have been identified in NRC technical studies as the main contributors to

the risk of core melt resulting from an SBO. These risk factors are identified in the SBO rule as

1
(1) the redundancy of the onsite emergency ac power sources, (2) the reliability of the onsite

emergency ac power sources, (3) the frequency of loss of offsite power (LOOP), and (4) the

probable time needed to restore offsite power.

The SBO rule requires licensees to propose and justify an SBO coping duration based on their

ability to: (1) maintain highly reliable onsite emergency ac electric power supplies; (2) ensure

that the plants can cope with an SBO for some period of time based on the probability of an SBO

at the site and the capability to restore power to the site; (3) develop procedures and training to

restore offsite and onsite emergency ac power should either become unavailable; and (4) if

necessary, make modifications necessary to meet the SBO rule requirements. The SBO rule

also requires that the staff do a regulatory assessment of each of the licensee's response to the

SBO rule and notify the licensee of the staff's conclusions.

Before the SBO rule, some regulatory documents addressed SBO risk factors such as the

unavailability of either offsite or onsite power sources and emergency diesel generator (EDG)

reliability. Regulatory Guide (RG) 1.93, "Availability of Electric Power Sources," December 1974

[Ref. 5], provides limiting conditions for reactor unit operation if offsite or onsite power sources

are unavailable. RG 1.108, "Periodic Testing of Diesel Generator Units Used as Onsite Electric

Power Systems at Nuclear Power Plants," Rev. 1, August 1977 [Ref. 6], expected licensees to

periodically demonstrate EDG reliability by means of 69 consecutive valid tests per plant or 23

per EDG with no failures. RG 1.108 discussed that Branch Technical Position EICSB 2, "DieselGenerator Reliability Qualification Testing," of the Standard Review Plan established an EDG

reliability goal of 0.99 (at 50 percent confidence). RG 1.9 "Selection, Design, Qualification of

Diesel-Generator Units Used as Standby (Onsite) Electric Power Systems at Nuclear Power

Plants," Rev. 2, December 1979 [Ref. 7], calls for 300 valid start and load qualification tests with

no more than three failures.

Before SBO rule was implemented, a survey was documented in NUREG/CR-4557, "A Review of

Issues Related to Improving Nuclear Power Plant Diesel Generator Reliability," March 1986

[Ref. 8], that revealed that only 7 of 56 nuclear power plant sites had an EDG reliability program;

11 of the 56 sites kept EDG records of the demands and failures experienced by each EDG

following RG 1.108; and 3 of 56 sites kept a report of each EDG's reliability. In addition,

NUREG/CR-4557 reveals that 11 of 78 nuclear power plants had a unit average EDG reliability

significantly below 0.95, and 2 of the 78 plants had a unit average EDG reliability below 0.90.

Appendix A, "Summary of the SBO Technical Bases and Additional Background," is summarized

in the next section and gives details about the SBO regulatory documents and terms mentioned

in this report.

2.2 Technical Basis for SBO Regulatory Requirements and Guidance

The SBO rule was based on several plant-specific probabilistic safety studies; operating

experience; and reliability, accident sequence, and consequence analyses completed between

1975 and 1988. In 1975, WASH-1400, "Reactor Safety Study,* indicated that SBO could be an

important contributor to the total risk from nuclear power plant accidents. This study concluded

that if an SBO persists for a time beyond the capability of the ac-independent systems to remove

decay heat, core melt and containment failure could follow. In 1980, the Commission designated

the SBO issue as USI A-44 and the staff completed several technical studies to determine if any

2
additional safety requirements were needed. NUREG-1032, "Evaluation of Station Blackout at

Nuclear Power Plants," June 1988 [Ref. 9], integrated the findings of the technical studies

completed for USI A-44. NUREG-1 032 presented the staff's major technical findings for the

resolution of USI A-44, and provided the basis for the SBO rule and the accompanying RG

1.155, "Station Blackout," August 1988 [Ref. 10]. NUREG-1032 provided the bases for RG 1.155

by analyzing the effect of variations in various offsite and onsite ac power system designs and

plant locations, EDG reliability, and SBO coping capability on the SBO CDF. RG 1.155 allows

flexibility for implementing the SBO regulatory requirements plant-specific basis. Consequently,

the values and impacts associated with the SBO rule were expected to vary significantly.

NUREG-1 109, "RegulatoryfBackfit Analysis for the Resolution of Unresolved Safety Issue A-44,

'Station Blackout,' 'June 1988 [Ref. 11], established risk reduction expectations, estimated

industry and NRC implementation costs, and used these factors to analyze the value-impact.

The public and the industry provided comments on the drafts of the SBO Rule, RG 1.155, and

NUREG-1 109. The industry comments resulted in significant increases in the estimates of

industry costs to implement the SBO rule.

As part of the industry involvement in developing the SBO rule, the Nuclear Management and

Resources Council (NUMARC) (now NEI) submitted NUMARC 87-00, "Guidelines and Technical

Bases for NUMARC Initiatives Addressing Station Blackout at Ught Water Reactors," November

1987 [Ref. 12], as an alternative to complying with the SBO rule. In content, NUMARC 87-00

followed RG 1.155 and added prescriptive, practical guidance which was endorsed by RG 1.155.

The NRC SBO initiatives expected that the resolution of GSI B-56, "Diesel Generator Reliability,"

would elaborate an EDG reliability program consistent with RG 1.155. SECY-93-044, "Resolution

of Generic Safety Issue B-56, Diesel Generator Reliability," February 22, 1993 [Ref. 13],

recommended that the staff incorporate (by reference or example) EDG unavailability (i.e.,

maintenance [and testing] out of service [MOOS]) operating experience and the NUMARC EDG

reliability program (Appendix D of NUMARC 87-00, Rev. 1, "Guidelines and Technical Bases for

NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," August 1991

[Ref. 14]) into the regulatory guide and the NUMARC guideline being developed for the

maintenance rule. The recommendation was implemented in RG 1.160, "Monitoring the

Effectiveness of Maintenance at Nuclear Power Plants," June 1993 [Ref. 15], and

NUMARC 93-01, "Nuclear Energy Institute Industry Guideline for Monitoring the Effectiveness of

Maintenance at Nuclear Power Plant," May 1993 [Ref. 16].

The NRC completed safety evaluations for each plant (they can be found in the NRC Public

Document Room under each plants docket number). The NRC also completed eight pilot

inspections by October 1994 using Temporary Instruction 2515/120, "Inspection of

Implementation of Station Blackout Rule," (no date) [Ref. 17]. Inspection Procedure 62706,

"Maintenance Rule," December 31, 1997 [Ref. 18], concerns SBO-related EDG performance

verifications under the maintenance rule.

3
3 ASSESSMENT OF THE STATION BLACKOUT RULE

The scope of the SBO rule assessment is to determine whether the SBO rule is effective and

whether certain areas may need the staff's attention. This assessment focuses on the SBO

rule and related SBO regulatory documents, and not plant specific issues. The assessment

reviews and uses plant specific risk and reliability information to make conclusions about the

adequacy of the regulatory documents, the assessment does not address plant-specific issues

as these continue to be identified and addressed elsewhere in the regulatory process.

3.1 Method for Assessing Regulatory Effectiveness of the Station Blackout Rule

For the purposes of this assessment, the regulatory documents present expectations (desired

outcomes) in terms of specific objectives, requirements, and guidance. Hence, the

requirements are an integral part of the set of "expectations7 which are collectively used as the

basis for conducting effectiveness review.

The regulatory documents are considered effective if the expectations are being achieved.

Discrepancies between expectations and outcomes prompted a review of the related regulatory

documents to find areas that may need attention. The expectations were established from

objective measures stated in the SBO rule, RG 1.155, 53 FR 23203, and NUREG-1109 in the

areas of coping capability, risk reduction, EDG reliability, and value-impact. The use of multiple

regulatory documents provided an examination of the regulatory process. The value-impact

assessment was used to determine if the NRC costs and industry costs to implement the SBO

rule were reasonable.

Plant-specific data on the actual SBO rule outcomes relative to the expectations for SBO coping

capability, selected EDG target reliability, and modifications are shown in Appendix B,

'Plant-Specific SBO Information by Reactor Type and Operating Status.' The data were

collected only from publicly available sources such as licensee PRAIPEs dated from

November 30, 1991 to July 27, 1994, as recorded in the NRC PRANPE databases, licensee

event reports (LERs), and NRC/licensee correspondence, particularly that related to the SBO

rule safety evaluations. When using the above PRA/IPEs it should be recognized that their

data are estimates do not always reflect the current design or operating performance of safety

systems.

Completed NRC system risk and reliability studies that analyzed the dominant SBO risk factors

were also a source of data to measure outcomes. INEL-95/0035, "Emergency Diesel

Generator Power System Reliability," February 1996 [Ref. 19], presents an analysis of the

reliability of some of EDG power systems at U.S. nuclear plants during the period 1987-1993

and includes SBO insights relative to risk and EDG reliability. INEL-9510035 was updated to

reflect the operating experience through 1998, and provides a reasonable estimate of EDG

performance (INEEUEXT-99-01312 [Ref. 20]). Both Idaho National Engineering and

Environmental Laboratory (INEEL) (formerly INEL) reports were used. In NUREG/CR-5496,

Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1980-1996,0 November

1998 [Ref. 21], the NRC contractor has analyzed LOOP events at U.S. nuclear plants from

1980-1996 to determine their likelihood and duration. Appendix B also contains a tabulation of

the NUREG-1032 and NUREG/CR-5496 data on plant-specific LOOP events and notes LOOP

events that had recovery times 4 hours or longer.

4
3.2 Comparison of Expectations and Outcomes

Table 1, "Summary of station blackout rule expectations and outcomes," summarizes the SBO

rule (and related regulatory guidance and industry guidelines) in the areas of coping capability,

risk reduction, EDG reliability, and value-impact.

Table 1 Summary of station blackout rule expectations and outcomes

Station Blackout Rule Expectations

Actual Outcomes Observations Area Expected Result

Minimum 100 plants will analyze and All plants have 4-or 8-hour coping Expectations exceeded.

Acceptable select a 2-, 4-, 8-, and 16- capability.

Coping hour coping capability.

Capability 100 plants will develop 108 plants developed procedures,

procedures and training. completed training.

39 plants complete 72 plants completed modifications.

modifications.

Industry-Wide 2.6E-05/RG delta 3.2E-05/RG delta Expectations exceeded. Overall

Risk Reduction risk reduced.

in Mean SBO

CDF (delta) Most vulnerable plants

completed Initiatives to attain low

SBO CDF.

RG 1.93 actions to shut down

with unavailable power supplies

not practical.

EDG Reliability RG 1.155 plant Individual Overall industry unit average unit EDG Individual EDG reliabilities not

target EDG reliability of 0.9S reliability Is generally better than 0.95 publically available; used unit

or 0.975. assuming EDG however, the EDG 0.975 EDG average EDG reliabiliy- based

unavallability due to MOOS reliability target appears to be difficult safety system demands.

while the reactor is hI a to achieve considering MOOS while the

power or non-power status is reactor Is at power. Observed EDG performance

negligible. generally exceeds PRAAPE EDG

MOOS while the reactor Is at power is performance assumptions;

not negligible additional SBO CDF reductions

possible. However, MOOS and

SBO regulatory documents contain failure to meet EDG target

multiple EDG performance bases and reliability could erode risk

expectations. benefits from the SBO rule.

There are opportunities to darify

the regulatory guidance

Value-Impact 2400 person-rem averted per 954 person-rem averted per $M. Outcome was near the low end

$M. Expected range was Based on averting 178.000 person-rem of the expected range. The total

700 to 5000 person-renV$M. at a total cost of $187M. costs were underestimated by a

Based on averting 145K factor of 3because of additions

person-rem at a total cost of of power supplies.

$61.5M.

5
3.2.1 Risk Reduction

In NUREG-1 109, the staff estimated that on an industry wide basis the implementation of the

SBO rule would result in an industry risk reduction of 2.6E-05 per RG. This expectation is based

on a mean SBO CDF before and after the SBO rule of 4.2E-05 per RG and 1.6E-05 per RG,

respectively. In addition, as indicated in NUREG-1 109, the staff expected that more plants would

be in lower SBO CDF ranges after implementation of the SBO rule. The expected range

changes are shown in Table 2, "The number of plant units in station blackout core damage

frequency ranges before and after station blackout rule implementation," which compares the

number of plants in each SBO CDF range before and expected after SBO rule implementation.

These data were obtained from NUREG-1 109, which estimated a plant's SBO CDF before SBO

rule implementation from plant-specific dominant risk factor characteristics identified in

NUREG-1 032 assuming that all plants could cope with an SBO for at least 2 hours, various plantspecific NRC and licensee PRANIPEs, and other data available around the 1985 time-frame.

Information from Appendix B was used in Table 2 to show the actual outcome as changes in the

SBO CDF range numbers after implementation of the SBO rule.

Table 2 The number of plant units In station blackout

core damage frequency ranges before and

after station blackout rule Implementation

Parameter Number of Plants In SBO CDF Range (E-05 per RG)

SBO CDF < 0.5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 1 0

Range .99 1.49 1.99 2.49 2.99 3.49 3.99 4.49 4.99 9.99 35

Before SBO rule 5 13 14 7 13 4 9 5 4 3 13 10

tmplementaton

(Estimated)

Expected After 23 23 14 9 6 5 6 5 4 0 5 0

SBO rule

Implementation

Actual Outcome 46 22 13 17 1 3 1 3 0 1 1 0

After SBO rule

Implementation

On the basis of the SBO CDF data for all plants in Appendix B, the mean SBO CDF associated

with SBO rule implementation is 1.OE-05 per RG. Therefore, the reduction in the estimated

mean SBO CDF was approximately 3.2E-05 per RG, slightly better than the 2.6E-05 per RG

expected. Comparison of the range numbers of the expected to the actual outcome after SBO

implementation in Table 2 shows more plants have lower SBO CDFs and fewer plants have

higher CDFs than expected. The actual outcome is even more favorable when compared to the

corresponding SBO CDF range values before SBO rule implementation.

Appendix C, "Comparison of Selected SBO Characteristics," was prepared from the data in

Appendix B to facilitate comparisons and analyses of SBO characteristics. The comparison of

the actual LOOP initiating frequencies while at power from 1968 to 1996 (obtained from

NUREG-1 032 and NUREG/CR-5496) to the values used in the PRA/IPEs shows that the

PRANIPE LOOP initiating frequencies may have been underestimated by more than a factor

6
of 2-39 for eight plants. Analysis of Appendix C also indicates that the SBO rule was effective in

addressing the plants most vulnerable to extremely severe weather and plant-centered LOOPs.

In addition, the 15 of the 21 plants that have the greatest vulnerability to a plant-centered LOOP

(a LOOP initiating frequency greater than 1.0E-01 per RG) have access to an alternate ac (Aac)

power supply, and 19 of the 21 plants have insignificant SBO CDFs with an order of magnitude

of 1.OE-06 or smaller. Last, the 8 operating plants that have the highest expected frequency of

extremely severe weather frequency (Category 5) and the 10 plants that have an 8-hour coping

time have an Aac power supply.

Table 3, Probabilistic risk assessment/individual plant examination sensitivity analyses, was

prepared from information in plant-specific PRA/IPE sensitivity analyses to show the effect of

typical SBO rule modifications on the overall risk. Licensees modified PRA/IPEs based on

plant-specific hardware and procedural modifications related to the SBO rule implementation.

The modified PRA/IPEs consistently showed a reduction in the plant CDF, thus providing strong

evidence for the risk reduction gained from promulgation of the SBO rule. Table 3 lists the

modifications due to the SBO rule addressed in the PRA/IPE sensitivity analysis and the

corresponding risk reduction associated with the modification as a percentage of the total plant

CDF. Table 3 indicates that the overall risk (i.e., the risk from SBO and other initiators) dropped

for plants that made major SBO rule modifications, such as adding a power supply, or even

simple SBO rule procedural changes (e.g., shedding dc loads).

Table 3 Probabilistic risk assessment!

individual plant examination sensitivity analyses

Effect on Overall Risk

Description of Modification (Percent Reduction of Plant

CDF)

Adding EDGs

Calvert lfffs (one safety and one nonsafety EDG) 24

Turkey Point (two safety EDGs) 20

Adding safety EDG

Diablo Canyon 14-18

Add nonsafety EDG for site

Arkansas Nuclear 1 23-36

Arkansas Nuclear 2 43-47

Procedural

Arkansas Nuclear 1: EDG service water supply valve open 7

Monticello: Depressurize during SB 0 17

Monticello: Battery load shed 17

Credit of combustion turbine generator

Fermi 10

Extend battery life from 2 to 4 hours

Arkansas Nuclear 1 16

Improve reliability of onsite gas turbine generator

Point Beach 13

AC cross-tie

Fermi 49

AC cross-connect and automatic depressurization system

Monticello 38

7
Previous Assessment of the Effect of the Station Blackout Rule on Core Damaae Frequencies

The NRC staff evaluated the impact of the SBO rule on CDFs in NUREG-1 560. NUREG-1 560

concluded that SBO remained a dominant contributor to risk at many plants, even after

implementation of the SBO rule, SBO frequencies exceed 1 E-05 per RG for many plants, and

that the results warrant further investigation of strategies for reducing SBO frequencies.

NUREG-1560 provides SBO risk perspectives based on comparing the SBO CDFs for the

56 plants whose PRANIPEs addressed the impacts of the SBO rule to the SBO CDFs for

51 plants where the impact of the SBO rule on SBO CDF was not known or credited, or was

assumed in the PRANIPEs to have no impact. NUREG-1560 observed that (1) the average

reported reduction in total CDF is consistent with the average reduction in SBO CDF from the

backfit analysis of the SBO rule; (2) the average SBO CDF for all plant units considered in the

evaluation is comparable to a "typical" estimate in an evaluation of SBO accidents at nuclear

plants; and (3) the large variability in the SBO CDF results for the plant units evaluated is also

consistent with the variability in the SBO CDF results from other SBO studies.

Generic Safety Issue 23 "Reactor Coolant Pump Seal Failure'

In the memorandum "Closeout of Generic Safety Issue 23, Reactor Coolant Pump Seal Failure,"

November 8, 1999, the staff also reviewed SBO coping analyses using reactor coolant pump seal

leakage rates from their research. The staff concluded that no additional cost-beneficial generic

requirements should be proposed in part because implementation of the SBO rule has added

alternate power sources and reduced the likelihood of an reactor coolant pump seal LOCA.

Plant Shutdown With Power SupDpy Unavailability May Increase the Likelihood of an Station

Blackout

RG 1.93, 'Availability of Electric Power Sources," December 1974 [Ref. 22], provides for the

nuclear unit to shut down following extended unavailability of either the offsite power source or

emergency onsite power sources, and is the basis for technical specifications in this area. Plant

shutdown with the one or more offsite or onsite power supplies unavailable could exacerbate the

grid condition or remove redundant sources to operate decay heat removal systems. The

extended unavailability of one or more offsite or onsite power supplies should prompt an

altemate approach, such as assuring the immediate availability of coping systems, reducing

power, or assuring availability of adequate electric grid reserves.

Assessment

The SBO rule was effective in achieving the desired reduction in the SBO CDF. The reduction in

the estimated mean SBO CDF was approximately 3.2E-05 per RG, slightly better than

the 2.6E-05 per RG expected. The SBO rule caused meaningful reductions in the risk at many

plants. Also, more plants have lower CDFs and fewer plants have higher CDFs than expected.

As a result of the SBO rule, the plants with the most LOOPs from plant events and extremely

severe weather improved the most. Consequently, these plants have relatively low SBO CDFs.

However, the mean LOOP initiating frequencies of eight plants used in the PRANIPE analysis

may have been underestimated by factors of 2-39 in comparison to the actual number of plant

LOOPs experienced. In addition, RG 1.93, which addresses plant shutdown following

extended unavailability of offsite and onsite power supplies, potentially increases the likelihood of

an SBO.

8
3.2.2 Emergency Diesel Generator Reliability

Emergency Diesel Generator Performance

After implementation of the SBO rule, all licensees committed to establish an EDG reliability

program and to maintain a minimum individual EDG target reliability of 0.95 or 0.975.

Accordingly, all licensees have committed to an information and data collection system to monitor

the achieved reliability levels and compare them to the target values. In addition, all licensees

have monitored EDG unavailability since 1989.

INEL-95/0035 and the INEL-9510035 DRAFT update investigated the performance of EDG trains

on demand. The INEL-95/0035 DRAFT update was used in this assessment even though it

contains preliminary results. However, the INEL-95/0035 DRAFT, has more data on the time

period since the implementation of the SBO rule and better illustrates the EDG reliability outcome

of SBO implementation.

INEL-9510035 and the INEL-95/0035 DRAFT compare the EDG train performance on demand to

the RG 1.155 EDG target reliability expectations. These comparisons are somewhat unequal.

The INEEL studies compare the unit average EDG reliability based on performance of its safety

mission" (a loss of voltage to the safety buses that results in both a start and a load-run) to the

RG 1.155 0.95 and 0.975 individual EDG reliabilities. Ucensees generally calculated RG 1.155

individual EDG reliability using data from plant-specific valid starts and load-runs over different

time interval. The INEEL studies calculated a unit average EDG reliability using (a) 12-years of

test and unplanned demand data that simulate the safety mission and (b) Bayes' empirical

methods, which allow consideration of the plant-specific and industry data to establish new

estimates of the mean reliability and its uncertainty bounds. Nevertheless, the INEEL

comparison is valid. Since the 0.95 or 0.975 individual EDG reliability is the target,

demonstrations of the EDG's ability to perform their safety mission over several years should

result in unit average EDG reliabilities of 0.95 or 0.975 or higher; lower would indicate the

individual EDG reliabilities are not consistent with RG 1.155.

The INEEL reports evaluated the validity of the RG 1.155, Section B, assumption that so long as

the EDG unavailability due to MOOS is not excessive, the maximum specified EDG reliabilities of

0.95 and 0.975 would result in an acceptable overall reliability for the emergency power system.

INEEL evaluated only the EDG MOOS with the reactor at power as it has higher risk due to the

possibility of a demand while the EDG is unavailable and the reactor is at power. Appendix A

explains MOOS in detail.

The following insights were obtained from the INEEL analyses of EDG safety performance:

(1) The INEL-95/0035 DRAFT update indicates that the 58 plants that committed to a

0.95 minimum EDG target reliability achieved a unit average EDG reliability of 0.945 to

0.989, with and without consideration of MOOS with the reactor at power; INEL-9510035

EDG reliabilities are similar ranging from 0.934 to 0.99.

(2) INEEL studies indicate that the plants that committed to a 0.975 minimum individual EDG

target reliability are having difficulty achieving a 0.975 unit average EDG target reliability.

With MOOS while the reactor unit is at power, the INEL-95/0035 DRAFT update indicates

only 8 of the 44 operating plants that committed to a 0.975 minimum EDG reliability

achieved a unit average EDG reliability above 0.975; plant reliabilities ranged from 0.917

9
to 0.98. INEL 95/0035 EDG reliabilities are similar: none of the 19 plants considered

achieved a unit average EDG reliability of 0.975. Without MOOS, the INEL-95/0035

DRAFT update indicates that approximately 36 of the 44 plants that committed to a

0.975 minimum EDG reliability had a 0.975 or higher unit average EDG train reliability;

INEL 9510035 differs: 18 of the 19 plants considered had a 0.975 or better unit average

EDG reliability.

Under RG 1.155 licensees, could select the 0.975 EDG target reliability to achieve shorter

coping durations to avoid modifications. In addition, the plants with the least

independence and redundancy in onsite emergency power supplies for safe shutdown

equipment had to select the 0.975 minimum EDG target reliability to achieve a lower SBO

CDF. Consequently, failure to meet the 0.975 EDG target reliability could significantly

erode these risk reductions. The effect of a 0.025 decrease in EDG reliability on the SBO

CDF was evaluated using Table 4, uEstimated increase in the station blackout core

damage frequency due to a decrease in emergency diesel generator reliability from 0.975

to 0.95.m Table 4 was developed from NUREG-1032, Table C.4, "Tabulated estimated

values of total core damage frequency for SBO accidents as a function of EDG

configuration, EDG reliability, offsite power cluster, and ability to cope," assuming the

coping duration was constant. NUREG-1032 grouped each plant's offsite power system

into one of five offsite power clusters based on its susceptibility to grid and weather

conditions. Table 4 illustrates that a 0.025 decrease in EDG reliability could increase the

SBO CDF by 1.0 E-05 per RG or more in plants in the offsite power clusters 2-5

(approximately 60 plants). Increases in the SBO CDF of 1.0 E-05 per RG or more erode

the 3.2 E-05 per RG risk reduction obtained from implementing the SBO rule.

Table 4 Estimated Increase In the station blackout core damage frequency

due to a decrease In emergency diesel generator

reliability from 0.975 to 0.95

Emergency ac Coping Offsite power cluster

power system duration

configuration 1 2 3 4 5

1/2 4 <E-05 1.1 E-05 2.6E-05 6.6E-05 1.4E-04

8 <E-05 <E-05 <E-05 1.7E-05 5.1 E-05

2/3 4 <E-05 3.2E-05 8.OE-05 0.3E-04 4.5E-04

8 <E-05 1.1 E-05 2.OE-05 4.5E-05 1.3E-04

2/4 4 <E-05 <E-05 <E-05 1.3E-05 4.8E-05

8 <E-05 <E-05 <E-05 <E-05

(3) The INEEL studies indicate that MOOS has a significant effect on the reliability

calculation. Table 5, "Effects of maintenance out of service while the reactor is at power

on emergency diesel generator reliability," was prepared from data in the INEL-95/0035

DRAFT update. Table 5 indicates that consideration of MOOS while the reactor is at

power lowers the unit average EDG train reliabilities for the 0.95 and 0.975 groups by

0.034 and 0.012, respectively. INEL-95/0035 gives similar results.

10
Table 5 Effects of maintenance out of service

while the reactor Is at power on emergency diesel generator reliability

EDG target Mean industry unit average EDG reliability

reliability without MOOS with MOOS decrease in reliability

0.95 0.985 0.954 0.034

0.975 0.978 0.967 0.012

NUREG/CR-5994, "Emergency Diesel Generator: Maintenance and Failure

Unavailability, and Their Risk Impacts," October 1994 [Ref. 23], analyzed the effects of

MOOS increases on the CDFs for five plants. The data indicate that when MOOS

increases from 0.007 (assumed in RG 1.155, Section B) to 0.02, the plant CDF may

increase by less than 1.OE-06, which is insignificant; however, an increase in MOOS to

0.04 may cause increases in plant CDF of more than 1.OE-05 and could offset the risk

reduction obtained by implementing of the SBO rule.

(4) The INEL-95/0035 DRAFT update indicates that three of 102 operating plants have a unit

average EDG reliability less than 0.95 without MOOS. Follow-up at 2 of the 3 plants

revealed that the unit average EDG reliability was 0.99 or higher based on the last

100 EDG start and load-run tests and/or unplanned demands; this is 0.05-0.07 more than

corresponding INEEL plant-specific values, which are based only on load-run tests and

unplanned demands that simulate the EDG safety mission. This finding may indicate that

plant-start testing is not identifying the causes of EDG unreliability during demands that

simulate the EDG safety mission. This confirms an INEL 95/0035 finding based on a

review of LERs, that the current testing and inspection activities may be missing the

dominant contributors to unreliability during actual demands and may need to be modified

to better consider the conditions and experiences gained from actual system demands.

(5) The INEEL-95/0035 DRAFT indicates that many licensees could demonstrate additional

reductions in the plant SBO CDF from improved EDG performance. In addition,

maintaining high EDG reliability levels provides assurance that the PRA/IPE EDG

performance assumptions are valid. Each INEEL study has a figure similar to Figure 1,

"Preliminary Plant-Specific EDG Unit Average EDG Unreliability Compared to the

Unreliability Estimates Using the PRAIIPE EDG Performance Assumptions," which shows

EDG unreliability for 44 plants grouped by 24, 8, and 6 hour mission time. Figure 1

indicates (a) that 0.05 and 0.025 unreliabilities (which correspond to the 0.95 and 0.975),

RG 1.155 EDG reliability targets are generally in the upper end of the PRAIPE EDG

uncertainty interval and (b) that except for a few cases, the mean PRA/IPE EDG

unreliability values are higher than the corresponding values calculated from the

operating experience.

11
|" L&Viakdty - UflcM, bi1W--

mN PRAWPEA nppwast4A waftvqkftei

|~~~~~

bfta RVM daNV

kd~~~~~~~~~~k~~~~~~~i&*~~~~~~~ ~ w- MC s"( 

b~~~~~ - 0-

. . . .......

12Jft O 'IV", MOP"

I I.

000I 1

Figure 1 "sPreliminary unit average emergency diesel generator unreliability

compared to the unreliability estimates using the probabilistic risk assessmentl

Individual plant examination emergency diesel generator performance assumptions."

12
Summarv of EDG Performance Bases

A review of EDG performance bases revealed that the SBO rule, the resolution of GSI B-56 in

conjunction with the SBO rule and the maintenance rule, and inspection procedures, resulted in

multiple EDG performance bases. These are summarized below. Appendix A provides

background information on the regulatory documents discussed below.

1) RG 1.155, Section C.1.2, expects licensees to establish a reliability program to maintain a

minimum individual EDG target reliability of 0.95 or 0.975. RG 1.155, Section B, assumes

that as long as MOOS (regardless of the reactor power status) is not excessive, the

maximum EDG failure rates for each EDG could result in an acceptable overall reliability

for the emergency power system configuration. RG 1.155, Section C.1.1, expects EDG

reliability to be determined using the NSAC-108 definition of reliability as the product of

the starts and load-run reliabilities excluding MOOS, and the NSAC-108 definitions of

valid start and load-runs. RG 1.155, Section C, endorses NUMARC 87-00, November

1987, as acceptable alternative guidance. NUMARC 87-00, Section 6.0, also requires the

monitoring of the unit average individual EDG unavailability in comparison to an industry

average.

(2) Under RG 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants,'

Rev. 2, March 1997 [Ref. 24], licensees can select the RG 1.155 0.95 or 0.975 individual

EDG target reliability as either a goal or a performance criterion (Section B, "Emergency

Diesel Generators); or they can select IPE unavailability values compared to the industry

values as a goal or performance criterion (Section B), or maintenance preventable

functional failures as the sole performance criterion (Section 1.4). RG 1.160, Section B

also discusses the balancing of reliability and unavailability under (a)(3) of the

maintenance rule. In addition, RG 1.160, Rev. 2, endorses NUMARC 93-01, "Nuclear

Energy Institute Industry Guideline for Monitoring the Effectiveness of Maintenance at

Nuclear Power Plant," April 1996 [Ref. 25], that allows licensees to use PRANIPE

numerical assumptions about EDG reliability performance as goals or performance

criteria under the maintenance rule (NUMARC 93-01, paragraph 9.3.2.).

(3) RG 1.9, Rev. 3, provides that onsite emergency power supplies be selected with sufficient

capacity, be qualified, and have the necessary reliability and availability for SBO and

design basis accidents. RG 1.9, Rev. 3, Section 2.2, gives definitions of valid EDG starts

and load-runs and delineates the ac onsite emergency power equipment and system

boundary used to count failures.

(4) SBO rule and maintenance rule inspection documents provide EDG performance bases.

Inspection documents Temporary Instruction 2515/120, Section 2515/120-040, and

Inspection Procedure 62706, Section 3.05, December 31, 1997, use the

NUMARC 87-00, Rev. 1, Appendix D, trigger values (NUMARC trigger values) for

assessing compliance with the RG 1.155 minimum individual EDG target reliabilities of

0.95 and 0.975. Appendix D, "EDG Trigger Values," provides background information.

13
EDG Performance Bases Not Always Clear

Because licensees appear to be having difficulty maintaining the 0.975 minimum target reliability

and because there are multiple EDG performance bases, the SBO related regulatory documents

on EDG reliability were compared to the SBO technical basis (NUREG-1032), and to each other,

to assure they could be readily understood and easily applied to achieving high EDG reliability.

The comparison revealed inconsistent use of EDG performance terms, criteria, and

measurements:

(1) The NUREG-1 032 EDG equipment and system boundary used to count failures included

the load sequencer and the bus between the EDG and the loads. RG 1.155 does not

specify the EDG boundary. The RG 1.9 Rev. 3, Section 2.2, EDG system boundary does

not include the load sequencer and the bus between the EDG and the loads. The

INEL-95/0035 and INEL-95/0035 DRAFT update data indicate that load sequencer

failures have caused EDGs to fail after unplanned demands; plant calculations of EDG

reliability may be inflated if these failures are not considered.

(2) The NUREG-1 032 and RG 1.155 criteria for determining valid start and load-run demands

to use in the EDG reliability calculations apply only to actual test or unplanned demands.

The corresponding criteria in RG 1.9, Rev. 3, Section 2.2, differ, counting "conditional

failures' identified in the course of maintenance that could have caused start or load-run

failures.

(3) RG 1.160, Rev. 2, guidance gives licensees the option of monitoring EDG performance

using different criteria than the RG 1.155 EDG target reliabilities. Under RG 1.160,

Rev. 2, licensees may chose PRANIPE unavailability, PRAIIPE reliability, or maintenance

preventable functional failures. Licensees must balance reliability and unavailability,

however it is not clear that licensees should balance the improvement in EDG reliability

against the resulting increase in EDG unavailability (MOOS); otherwise the balanced

reliabilities could be non-conservative with respect to the RG 1.155 minimum individual

EDG target reliabilities. In addition, PRA/IPE reliability and unavailability are represented

by a range of values, and some of the values are nonconservative with respect to the RG

1.155 minimum individual EDG target reliabilities. As already shown, a 0.025 decrease in

EDG reliability or a 0.04 increase in EDG unavailability results in increases in the SBO

CDF that offset the risk reductions obtained from implementing the SBO rule.

(4) TI 25151120, IP 62706, and some licensees are using the NUMARC EDG trigger values

for demonstrating achievement of the 0.95 and 0.975 minimum individual target reliability.

However, the NRC intended that the NUMARC trigger values not be used for this

purpose. The Advisory Committee on Reactor Safeguards (ACRS) convinced the staff

that the NUMARC trigger values provided low statistical confidence that high levels of

EDG reliability would be achieved. Others expressed the view that allowing EDG

reliability performance to degrade to these levels provides high statistical confidence that

the EDG target reliability is not being met however, waiting to attain these levels delays

potentially needed corrective actions. Statistics similar to those used by these two

perspectives are shown In Appendix D. In a letter to the ACRS dated October 29, 1993

[Ref. 26], the Executive Director of Operations informed the ACRS that the staff agreed

that conformance of individual EDGs with trigger values cannot be taken, in any statistical

fashion, to mean that the EDG has demonstrated achievement of the licensee's

commitments to 0.95 or 0.975. The letter stated that Note 3 was added to RG 1.160,

14
June 1993 to emphasize this fact. In addition, the staff has not endorsed NUMARC

87-00, Rev. 1. Past and present revisions of RG 1.160, Section C, state that NUMARC

93-01 (which references NUMARC 87-00, Rev. 1, and uses the trigger values in Section

12.2.4) references other documents, but NRC's endorsement of NUMARC 93-01 should

not be considered an endorsement of the referenced documents. The NRC staff

intended that this be interpreted to mean NUMARC 87-0, Rev. 1, was not endorsed.

However, wording in past revisions of RG 1.160 could lead to the conclusion that the

NUMARC reference documents do not apply to the EDGs and may explain how licensees

and the NRC inspection documents adopted the NUMARC trigger values. For example,

RG 1.160, June 1993, Section C, also states that the example in NUMARC 93-01,

Section 12.2.4, describes an acceptable method to establish EDG performance criteria

and/or goals and subsequently monitor EDG performance. As another example

RG 1.160, "Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," Rev.

1, January 1995 [Ref. 27], Section B, states that the EDGs are required to be handled

under (a)(1) and (a)(2) of the maintenance rule as described in NUMARC 93-01.

Assessment

Before implementation of the SBO rule, only 11 of 78 plants surveyed had formal EDG reliability

programs; 11 of 78 plants had a unit average EDG reliability less than 0.95; and 2 of 78 plants

had a unit average EDG reliability of less that 0.90. Since implementing the SBO rule, all plants

have established an EDG reliability program and an improved EDG reliability. Considering actual

safety performance and MOOS with the reactor at power, only 3 of 102 operating plants have a

unit average EDG reliability below 0.95 and above 0.90. However, analysis indicates MOOS with

the reactor at power significantly affects the reliability calculation based on safety performance

and explains why licensees are having difficulty meeting the 0.975 EDG target reliability.

Decreases in reliability and/or increases in MOOS unavailability erode the risk benefits of

implementing of the SBO rule.

There are opportunities to revise the RG 1.155, RG 1.9, and RG 1.160 which inconsistently use

EDG reliability terms, criteria, and measurements. These RGs may need to be revised to:

(a) clarify that MOOS with the reactor at power should be included in the reliability calculation to

ensure high levels of EDG reliability (b) clarify that licensees should balance increased EDG

reliability against the increased EDG unavailability to maintain the RG 1.155 minimum individual

EDG target reliabilities and the risk levels achieved from implementing the SBO rule, (c) clarify

that the EDG system boundary used in the reliability calculation should include the load

sequencer and the bus between the EDG and the loads to be consistent with the SBO technical

basis (NUREG-1032), and (d) establish common EDG start and load-run criteria.

Inspection documents Temporary Instruction 2515/125 (no date) and IP 62706 may need

revision to delete use the NUMARC trigger values to assess compliance with the 0.95 and

0.975 EDG target reliability. Statistically the NUMARC trigger values do not provide high levels

of confidence that the EDG target reliability is being met; this inconsistent with ensuring high

EDG reliability, delays corrective action, and erodes the risk benefits obtained from implementing

the SBO rule.

Follow-up at two plants in the 0.975 EDG reliability group that had less than 0.95 unit average

EDG reliability based on load-run tests and unplanned demonstrations of its safety mission

revealed the unit average EDG reliability based on the last 100 valid start and load-run tests and

15
unplanned demands was 0.05-0.07 higher; this confirms a previous finding in INEL-95/0035 that

the current testing and inspection activities may be missing the dominant contributors to EDG

unreliability during actual demands and may need to be modified to better consider the conditions

and experience gained from actual system demands.

3.2.3 Minimum Acceptable Coping Capability, Plant Procedures, Training, and Modifications

In NUREG-1 109, the staff expected that 100 plants would (1) be able to show a minimum

acceptable coping capability of 2, 4, 8, or 16 hours based on plant-specific characteristics;

(2) complete an analysis of the plant's ability to cope with an SBO for the selected duration;

(3) develop SBO-related procedures; (4) complete training on these procedures; and

(5) complete modifications necessary to cope. The SBO rule was flexible allowing for a wide

range of coping capabilities, so plants with an already low risk from SBO could select short

coping times and would need few, if any, modifications. Plants with higher risk could select

longer coping times and would possibly need modifications to cope. Thirty-nine plants were

expected to complete hardware modifications.

Appendix E, "Station Blackout Rule Activity and Modification Summary,* was prepared to show

the expected number of plants completing analyses, procedure development and training,

various types of modifications in the licensee's response to the SBO rule, the estimated costs of

the modifications, and the outcomes. The costs are discussed in Section 3.2.4, "Value-impact

Analysis."

The outcome was that 108 plants selected a minimum SBO coping capability of 4 or 8 hours,

completed the coping analysis, developed procedures, completed training, and 72 plants

completed modifications. Not credited was the fact that some plants may have developed

adequate procedures and completed training before the SBO rule in response to Generic

Letter 81-04, "Emergency Procedures and Training for Station Blackout Events," February 25,

1981.

Assessment

The SBO rule expectations were met in the areas of coping analysis, procedure development

and training, and modifications. The scope and number of modifications to achieve specified

coping durations exceeded the expectations and may explain why risk reductions were greater

than expected.

3.2.4 Value-impact Analysis

A comparison of value-impact expectations and outcomes was derived from NUREG-1 109. The

value-impact analysis in NUREG-1109 estimated the expected value based on the public dose

reduction associated with the SBO rule. The impacts were based on estimates of industry and

NRC costs to implement the SBO rule. As explained in Appendix A under "Public and Industry

Comment," the industry costs were provided by the industry. The ratio of the value to the impact

was also derived as an indication of the cost effectiveness of the SBO rule. Each of these

matters is discussed below.

Table 6, "Station blackout rule value-impact summary," was prepared from Appendix E to

compare the expected impact, value, and value-impact ratio to the corresponding outcomes.

Appendix E used the expected values and impacts from NUREG-1 109. The outcomes were

16
estimated using either the values and impacts from NUREG-1 109 or from information submitted

to the NRC by the licensees. The cost of an additional EDG at Davis Besse was $9.07M. This

value was taken as a representative amount for the addition of power supplies and used in the

cost estimates shown below.

Table 6 Station blackout rule value-Impact summary

Value Impact Factors Expected($) Outcome($)

Impact-NRC and Industry Implementation Cost

Best estimate

Miscellaneous SBO modifications 60M 63M

NRC implementation 1.5 2.OM

19 additional power supplies 0 174M

TOTAL 61.5M 237M

Monetary savings attributed to adding additional

power supplies for operating flexibility -50M

TOTAL 1 87M

Estimated range

Total 43M-95M

Plant-specific 35OK-4M 35OK-20M

Estimated Value

Public dose reduction in person-rem 145,000 178,000

Value-impact Ratio (person-rem avertedl$million)

Best estimate 2400 954

Range 700-5000 _

In NUREG-1 109, the staff used information supplied by the industry to estimate that the industry

would spend approximately $60 million (M). NUREG-1 109 estimated that the NRC would spend

approximately $1.5M to implement the SBO rule. The total estimated SBO rule implementation

cost of $61.5M was a best estimate with a low of $43M and a high of $95M. In NUREG-1 109,

the staff recognized that there would be wide variation in plant-specific costs, ranging from

$0.35M for plants that needed only procedural changes to $4M if all the anticipated modifications

were completed. The outcome in terms of actual SBO rule costs was approximately $237M,

which exceeded expectations by approximately a factor of 4. The discrepancy is attributable to

the addition of 19 power supplies at an estimated cost of approximately $174M. These additions,

although consistent with the SBO rule, were also motivated by monetary benefits from operating

flexibility from these power supplies. So the NRC also underestimated the value and it may be

conservative to ascribe all these costs to the SBO rule.

The NRC estimated that the added power supplies added an estimated $50M in value from more

operating flexibility from increased allowed outage times (AOTs). For example, Davis-Besse

obtained NRC approval to change its technical specifications to increase the AOT for its EDGs

from 3 to 7 days to gain flexibility in performing EDG maintenance while the reactor is at power.

In submitting this change to the NRC, Davis-Besse noted that its SBO diesel generator

17
installation would save $5.25M over the remaining plant life, including $3.15M for increased

flexibility in performing maintenance on its safety EDGs and $2.1M in replacement power costs.

North Anna increased its EDG AOT from 3 to 14 days by crediting the non-Class 1 E SBO EDGs.

Other licensees increased their EDG AOT by documenting excess EDG redundancy or Aac

power supply connections from their SBO analyses. RES estimated that 10 reactor units besides

Davis-Besse benefitted $50M from increased EDG AOT to gain operating flexibility.

It also appears that the addition of a power supply resulted in significant plant-specific risk

reductions. Turkey Point added two EDGs and cross-ties reducing the risk of an SBO following a

LOOP from 7.6E-04 to 2.9E-06 per RG. Table 3 indicates that adding power supplies to the

Calvert Cliffs, Diablo Canyon, and Arkansas Nuclear One PRA/IPEs resulted in risk reductions

ranging from 14 to 47 percent.

In NUREG-1 109, the staff expected that the SBO rule would add value by averting

145,000 person-rem from an accident; the estimates ranged from 216,500 person-rem to 65,000

person-rem. The expected reduction in person-rem was calculated by multiplying the reduction

in CDF per RG from an SBO by the remaining life of the plant (assumed to be 25 years) and the

estimated public dose based on the highest source term at a site from an accident. The total

reduction in person-rem for each plant was summed and divided by 10 to consider the smaller

source term for an SBO at a 50-mile radius. The 145,000 person-rem derived in NUREG-1 109

appears to be realistic, and may be low because the weighted population dose factor for the five

NUREG-1 150 power reactors ranges from 166,000 to 2,000,000 person-rem within 50 miles of

the plant (NUREG/BR-0184, "Regulatory Analysis Technical Evaluation Handbook," February

1997).

In NUREG-1 109, the staff calculated a value-impact ratio of 2,400 person-rem per $M based on

averting 145,000 person-rem at a cost of $61.5M with a range of 700 person-rem per $M to

5,000 person-rem per $M. The outcome was a value-impact ratio of 954 person-rem per $M

based on an estimated impact of $187M, which is within the expected range. The outcome

recognizes that received approximately $50M in monetary benefit from increased EDG AOT,

reducing the impact from $237M to $187M.

Previous Assessment of the Cost Effectiveness of the SBO Rule

The staff also evaluated the industry's average cost per person-rem averted in satisfying the

SBO requirements in SECY-97-180, "Response to Staff Requirements Memorandum of May 28,

1997, Concerning Briefing on IPE Insight Report," August 6, 1997. The staff used a different

methodology and concluded that, on average, the SBO rule averted a person rem at a cost of

$4,750 (211 person-rem per $M); and that this cost is likely too high because it does not give full

credit for other sizable economic benefits and it is skewed by a few plants whose SBO cost

exceeded $1 OM. Most reactors incurred SBO costs of less than $1 M. A supporting calculation

suggested that approximately 70 percent of the reactors incurred costs of less than $1000 per

person-rem averted (1000 person-rem per $M), and 75 percent incurred costs of less than $2000

per person-rem averted (500 person-rem per $M).

Assessment

Comparing of the expected value-impact to the actual value-impact indicates that the actual

value impact was within the expected range of reduction in public dose-per-dollar of cost.

However, the NRC staff did not anticipate that so many licensees would install additional

18
safety-related and nonsafety-related power sources which accounted for 75 percent of the

estimated industry cost. So the staff underestimated the expected ("best estimate") cost by a

factor of approximately 4. However, it appears licensees justified the cost of the added power

supplies based on offsetting monetary benefits, such as more operating flexibility from increased

EDG AOT. So the NRC also underestimated the value. Disregarding the costs of the power

supplies, the costs of meeting the SBO rule requirements were reasonable because plants have

added SBO coping and recovery procedures, and have established EDG reliability programs to

maintain EDG target reliability levels. Further, the SBO rule focused NRC and industry resources

on an area known to be important to the overall risk of an operating nuclear power plant, and the

SBO rule analysis helps to maintain an acceptable level of safety at operating nuclear power

plants.

The industry and NRC costs to implement the SBO rule were reasonable, considering the

outcomes. As expected there was wide variation in plant-specific values and impacts because

the SBO rule provided flexibility; plants with higher risk needed longer coping times and possibly

more modifications, and plants with an already low risk from SBO needed shorter times to cope

and fewer modifications.

3.2.5 Insights From Operating Experience Reviews

Performance during operating events provides a additional means to assess the effectiveness of

regulatory requirements and guidance. The following are some operating experience insights.

Modifications Due to the Station Blackout Rule

Plant modifications and procedures due to the SBO rule have been relied upon to provide

protection during operating events. For example, in the original emergency power system design

for Turkey Point Units 3 and 4, the two units shared two 2850-kW safety-related EDGs and five

onsite nonsafety-related EDGs that could be connected to the reactor unit emergency power

system through a nonsafety-related switchgear. As a result of the SBO rule, the licensee added

two 3095-kW safety-related EDGs. A March 1993 report, "Effect of Hurricane Andrew on the

Turkey Point Nuclear Generating Sation from August 20-30, 1992," indicates that the five onsite

nonsafety-related EDGs were unavailable because of water damage to the nonsafety-related

switchgear; the total load on the four safety-related EDGs was approximately 3400 kW, and

approximately 3.5 days into the storm, one of the two original 2850-kW EDGs tripped and was

restarted in 2.5 hours. Had the two safety-related 3095-kW EDGs not been added as a result of

the SBO rule, the load on the only remaining 2850-kW EDG would have exceeded the EDG

rating by 19 percent and most likely the EDG would have failed unless unloaded quickly by the

operators, leaving no ac power for 2.5 hours.

Offsite Power System Deregulation

As stated in 53 FR 23203, it was expected that the SBO rule would provide additional defense in

depth by requiring plants to cope with an SBO for a specified duration. The increment of

defense-in-depth is provided by the preventative effect of reducing the likelihood of core damage

by implementing the SBO rule. In addition to increased coping capability, the SBO rule has

resulted in plants gaining increased tolerance to an SBO from reduced risk as previously

explained, which addresses the mitigative aspect of defense-in-depth. These SBO rule

outcomes provide additional defense-in-depth to compensate for increased risks because of

potential degradation of the ac offsite power system that may result from deregulation of the

19
electric power industry as explained in SECY-99-129, "Effects Of Electric Power Industry

Deregulation on Electric Grid Reliability and Reactor Safety," May 11, 1999 [Ref. 28], a publicly

available NRC technical report, "The Effects of Deregulation of the Electric Power Industry on the

Nuclear Plant Offsite Power System: An Evaluation, dated June 30, 1999 [Ref. 29], a recent

Information Notice (IN) 2000-06, "Offsite Power Voltage Inadequacies," March 27, 2000

[Ref. 30], and IN 98-07, "Offsite Power Reliability Challenges From Industry Deregulation,"

February 27, 1998 [Ref. 311.

Dominant SBO Risk Factor Trends

The main factors affecting the likelihood of SBO accidents at nuclear plants are (1) EDG

reliability and redundancy, (2) the LOOP frequency, and (3) the time to restore offsite power

following its loss.

Neither INEL-95/0035 (with data from 1987-1993) nor INEEL DRAFT update (with data from

1987-1998) revealed any trend in EDG train performance by year.

Table 7, "Dominant station blackout risk factor trends - offsite power system," was prepared to

compare the offsite power trends in NUREG-1032 (based on 1968-1985 operating experience)

to the corresponding offsite power values in NUREG/CR-5496 (based on 1980-1996 operating

experience). The results show overall reduction in LOOP frequency and duration. An exception

is the increasing duration of grid-related LOOP events. This is being addressed by SECY-99-

129.

Table 7 Dominant station blackout risk factor trends - offsite power system

Source of LOOP Data NUREG-1032 NUREGICR-5496

(1968-1985 LOOP (1980-1996 LOOP

operating experience) operating experience)

Plant-related LOOP

Mean frequency 0.087 0.04

Median time to restore 18 minutes 20 minutes

LOOPs > 4 hours 0 4

Grid-related LOOP

Mean frequency (occurrence per year) 0.018 0.0019

Median time to restore 36 minutes 140 minutes

LOOPs > 4 hours 1 (due to severe weather) 0

Weather-related LOOP

Mean frequency 0.009 0.0066

Median time to restore 4.5 hours 1.2-2.4hours

LOOPs > 4 hours 4 5

Appendix F, 'Operating Events," Table F-1, "Losses of offsite power since 1990 having recovery

times of 4 hours or longer," summarizes six plant-centered and three weather-related LOOP from

1990 (when the SBO rule was implemented) to 1998. The LOOPs occurred while the reactor unit

was running and it took 4 or more hours to recover offsite power. Three of the events closely

followed an SBO resulting in a LOOP and the unavailability or technical inoperability of one EDG.

Analysis of the plant events revealed communication and procedural weaknesses in that delayed

20
recovery. These weaknesses were subsequently corrected and recovery from future losses of

offsite power should significantly improve. Analysis of weather events shows that it could take up

to 4.5 days to recover offsite power in a hurricane, 28 hours after a tomado, and approximately 8

hours after ice accumulation or contamination from salt sprays. Provisions for these types of

events are addressed in NUMARC 87-00, Rev. 1, that requires actions for achieving enhanced

coping capability under hurricane and tornado conditions. Key features of NUMARC 87-00, Rev.

1, are (1) actions to be taken in the 24-hour period before anticipated arrival of the hurricane and

(2) a commitment to be in a safe shutdown condition 2 hours before the hurricane arrives.

Another key feature to mitigate hurricanes and tornados was the addition of Aac power supplies

at the plants that have the most vulnerability to extremely severe weather conditions.

Potential Station Blackout Alternate ac Power Source Unavailability

Appendix F, Table F-2, "Station blackout challenges," was prepared from a review of the

199D-1998 operating experience. The review revealed one event (LER 335/98-007) that

identified inadequate SBO recovery procedures during a simulator exercise in 1998 that could

have complicated recovery from an SBO. Four events (LER 346/98-006, 247/98-007 and two

events in IN 97-21, Availability of Altemate AC Power Source Designed for Station Blackout,"

April 18, 1997 [Ref. 32]), identified the potential unavailability during an SBO event of an Aac

power source (added as a result of the SBO rule). The latter is a concern because the

unavailability of the Aac power supply during an SBO could lead to core damage. IN 97-21

described the dependencies of the Aac support system batteries and ac auxiliary power.

LER 247/98-007 reported that the SBO Aac power source output circuit breakers were incapable

of being closed onto a de-energized bus during an SBO. The licensee reported that the cause of

the problem was insufficient comprehensive testing. LER 346/98-006 reported that a tornado

resulted in a LOOP and the technical inoperability of one EDG; and offsite power was restored in

28 hours. An NRC analysis of the tomado event noted that a nonessential bus supplies power to

the auxiliaries of the Aac, and If not powered, the batteries would deplete in approximately 28

hours. If the EDGs failed to start or run in the first 8 hours of the 28-hour event, the SBO-DG

might have been unavailable likely leading to core damage.

Assessment

Implementation of the SBO rule has strengthened additional defense in depth. As demonstrated

at Turkey Point, the SBO rule modifications and procedures have been relied upon to mitigate

the consequences of, and provide protection during LOOP events. The SBO rule provides

defense in depth if deregulation of the electric utility industry or changing offsite power system

trends effect the SBO risk.

There is a lower probability of recovering within the SBO coping time for extremely severe

weather LOOP events than from other types of LOOPs. The SBO rule has resulted in industry

requirements (that have been endorsed by the NRC) that can be taken before extremely severe

21
weather conditions to mitigate the potential consequences of such an event and the addition of

Aac power supplies at the plants that have the most vulnerability to extremely severe weather

conditions.

After issuing IN 97-21, an event revealed that the availability of an Aac power supply system was

limited by dependencies on offsite or onsite power supplies and that this situation could lead to

core melt.

4 CONCLUSIONS

The report's conclusion is that the SBO rule was effective considering that the risk expectations

were achieved, and that industry and NRC costs to implement the SBO rule were reasonable. In

implementing the SBO rule, some plants made hardware modifications (e.g., the addition of

diesel generator or gas turbine generator power supplies); and all plants generally maintained

EDG reliability at 0.95 or better, and established SBO coping and recovery procedures.

Consequently, the plants have gained SBO coping capability, reduced risk, increased the

tolerance to a loss of ac offsite or onsite power, and many plants benefitted economically from

the addition of power supplies. To elaborate:

The reduction in the estimated mean SBO CDF was approximately 3.2E-05 per RG,

slightly better than the 2.6E-05 per RG expected after implementation of the SBO rule.

As a result of the improvements made under the SBO rule, more plants achieved a lower

SBO CDF than expected, and the plants with the greatest numbers of LOOP from plant

events and extremely severe weather conditions made the most improvement by

providing access to an Aac power supply. In addition, maintaining high EDG target

reliability levels provides assurance that PRANIPE EDG performance assumptions are

valid. With some exceptions, the observed EDG reliability performance generally

exceeds the mean reliability EDG performance assumptions in the PRANIPEs, indicating

that SBO CDFs are smaller and better than stated in many PRANIPEs. As the SBO rule

risk reduction objectives have been exceeded, further investigation of strategies for

reducing SBO frequencies (as suggested in NUREG-1560) may not be needed.

* As a result of the SBO rule all plants have (1) established SBO coping and recovery

procedures; (2) completed training for these procedures; (3) implemented modifications

as necessary to cope with an SBO; and (4) ensured a 4- or 8-hour coping capability.

* Before the SBO rule was issued, only 11 of 78 plants surveyed had a formal EDG

reliability program, 11 of 78 plants had a unit average EDG reliability less that 0.95, and

2 of 78 had a unit average EDG reliability of less that 0.90. Since the SBO rule was

issued, all plants have established an EDG reliability program that has improved EDG

reliability. A report shows that only 3 of 102 operating plants have a unit average EDG

reliability less than 0.95 and above 0.90 considering actual performance on demand, and

MOOS with the reactor at power. However, the analysis of EDG performance on demand

indicates MOOS with the reactor at power is more than expected and can have a

significant effect on the EDG reliability calculations. Increased MOOS explains why

licensees appear to be having difficulty meeting a 0.975 EDG target reliability. Decreased

EDG reliabilities and/or increased MOOS unavailabilities erode the risk benefits obtained

from implementing the SBO rule.

22
* The operating experience indicates that the SBO rule has increased defense-in-depth.

The SBO related hardware and procedures have been used in response to unplanned

events and provided additional protection. The SBO rule provides additional defense-indepth to compensate for potential degradation of the ac offsite power system that may

result from deregulation of the electric power industry or longer than expected recovery of

offsite power following extremely severe weather conditions.

* A comparison of the value-impact expectations to the outcomes indicates that the

value-impact was within the expected range of reductions in public dose-per-dollar of

cost. As expected, there was wide variation in plant-specific values and impacts because

the SBO rule allowed flexibility. Not expected was the addition of costly power supplies,

which accounted for 75 percent of the estimated industry cost impact and explains why

the NRC value-impact analysis underestimated the cost by a factor of 4. However, it

appears licensees justified the cost of the power supplies by counting on offsetting

monetary benefits, such as more operating flexibility from increased EDG AOTs. Thus

the value was also underestimated. The remaining 25 percent of the estimated industry

cost impact appears reasonable, considering the outcomes: known coping capabilities,

industry risk reduction from plant-specific procedural and hardware enhancements, and

additional defense-in-depth.

A comparison of the SBO rule expectations to the corresponding outcomes indicates that

resolution of the generic issue of SBO was effective as no additional generic actions are

warranted and no new GSls have been identified.

Although the SBO rule was effective for the reasons stated above, consistent with adhering to

Principles of Good Regulation that include clarity (coherent and practical regulations) and

reliability (regulations based on operating experience) there are opportunities to revise the

regulatory guidance and inspection documents. The proposed revisions are not intended to

impose any new regulatory requirements, are consistent with the SBO technical basis

(NUREG-1032); ensure high levels of EDG reliability; maintain present levels of safety by

ensuring the risk benefits obtained from implementing the SBO rule do not erode; provide

practical guidance for reactor shutdowns with limited offsite or onsite power sources; and use

operating experience to improve the predictability and consistency of NRC decisions in the area

of EDG reliability. The opportunities are as follows:

(1) Regulatory Guides 1.155,1.9, Rev. 3, and 1.160, Rev. 2, which address use of the

existing EDG reliability terms, criteria, and measurements may need to be revised in a

coherent manner to: (a) clarify that EDG unavailability due to MOOS with the reactor at

power should be included in the reliability calculation, (b) clarify that licensees should

balance increased EDG reliability against the increased EDG unavailability to maintain the

RG 1.155 minimum individual EDG target reliabilities, (c) clarify that the EDG system

boundary used in the reliability calculation should include the load sequencer and the bus

between the EDG and the loads, and (d) establish common EDG start and load-run

criteria for the guidance.

Inspection documents Temporary Instruction 2515/125, and Inspection Procedure 62706,

may need revision to delete use of the NUMARC (now NEI) trigger values to assess

compliance with the 0.95 and 0.975 EDG target reliability. The NUMARC trigger values,

which are not endorsed by the regulatory guidance, do not provide high levels of

confidence that the EDG target reliability is being met; this is inconsistent with ensuring

23
high EDG reliability, delays corrective action, and erodes the risk benefits obtained from

implementing the SBO rule.

(2) Operating events indicate that the availability of some Aac power supplies is dependent

on offsite or onsite power supplies. SBO-related inspection documents may need

inspection attributes to verify that the Aac sources meet NUMARC 87-00, Rev. 1,

Appendix B, B.8.

(3) Regulatory Guide 1.93, the basis for technical specifications in the area of ac onsite and

offsite power supply availability, provides for shutdown of the reactor following extended

ac power supply unavailability. Plant shutdown with one or more offsite or onsite power

supplies unavailable could exacerbate the grid condition or remove redundant sources to

operate decay heat removal systems, increasing the likelihood of an SBO. Additional

practical guidance may minimize the likelihood of an SBO.

(4) Follow-up at 2 plants revealed a large difference between the unit average EDG reliability

based on load-run tests and unplanned demands and the reliability calculated by the

licensee based on the last 100 start and load-run tests and unplanned demands. This

difference confirms a previous finding in INEL-95/0035, that the current testing and

inspection activities (as prescribed by the NRC) may not be focusing on the dominant

contributors to unreliability during actual demands. Accordingly, NRC inspection

documents may need to be modified to better factor in the conditions and experiences

gained from actual system demands to facilitate inspection of EDG compliance.

As lessons learned: (a) to the extent that the NRC staff revises existing regulatory documents to

be more risk-informed and performance-based, they may need to be modified to ensure

consistent interpretation and use of terms, goals, criteria, and measurements; and (b) new

regulations or the accompanying regulatory documents should include quantitative objectives to

facilitate evaluation of its regulatory effectiveness.

5 REFERENCES

1. U.S. Code of Federal Regulations, Title 10, Part 50, "Station Blackout," (Federal

Register, Vol. 53, No. 119, Page 23203, June 21, 1988).

2. U.S. Nuclear Regulatory Commission, NUREG-1560, "Individual Plant Examination

Program: Perspectives on Reactor Safety and Plant Performance," December 1997.

3. U.S. Nuclear Regulatory Commission, Staff Requirements Memorandum, "Briefing on

IPE Insight Report," May 28, 1997.

4. U.S. Nuclear Regulatory Commission, SECY-97-180, "Response to Staff Requirements

Memorandum of May 28, 1997, Conceming Briefing on IPE Insight Report," August 6,

1997.

5. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.93, "Availability of Electric

Power Sources," December 1974.

24
6. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.108, "Periodic Testing of

Diesel Generator Units Used as Onsite Electric Power Systems at Nuclear Power

Plants," Rev. 1, August 1977.

7. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.9, "Selection, Design,

Qualification of Diesel-Generator Units Used as Standby (Onsite) Electric Power

Systems at Nuclear Power Plants," Rev. 2, December 1979

8. U.S. Nuclear Regulatory Commission, NUREGICR-4557, "A Review of Issues Related

to Improving Nuclear Power Plant Diesel Generator Reliability," March 1986.

9. U.S. Nuclear Regulatory Commission, NUREG-1032, "Evaluation of Station Blackout

Accidents at Nuclear Power Plants," June 1988.

10. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.155, "Station Blackout,"

August 1988.

11. U.S. Nuclear Regulatory Commission, NUREG-1 109, "RegulatorylBackfit Analysis for

the Resolution of Unresolved Safety Issue A-44, 'Station Blackout,'" June 1988.

12. Nuclear Energy Institute, NUMARC 87-00, "Guidelines and Technical Bases for

NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Rev. 0,

November 1987.

13. U.S. Nuclear Regulatory Commission, SECY-93-044, "Resolution of Generic Safety

Issue B-56, Diesel Generator Reliability," February 22, 1993

14. Nuclear Energy Institute, NUMARC 87-00, "Guidelines and Technical Bases for

NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Rev. 1,

August 1991.

15. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.160, "Monitoring the

Effectiveness of Maintenance at Nuclear Power Plants," June 1993.

16. Nuclear Energy Institute, NUMARC 93-01, "Nuclear Energy Institute Industry Guideline

for Monitoring the Effectiveness of Maintenance at Nuclear Power Plant," May 1993.

17. U.S. Nuclear Regulatory Commission, Temporary Instruction 2515/120, "Inspection of

Implementation of Station Blackout Rule," no date.

18. U.S. Nuclear Regulatory Commission, Inspection Procedure 62706, "Maintenance

Rule," December 31, 1997.

19. U.S. Nuclear Regulatory Commission, INEL-95/0035, "Emergency Diesel Generator

Power System Reliability 1987-1993," February 1996.

20. Idaho National Engineering and Environmental Laboratory, INEEUEXT-99-01312,

"Reliability Study Update: Emergency Diesel Generator (EDG) Power System,

1987-1998 (Draft), December 1999.

25
21. U.S. Nuclear Regulatory Commission, NUREG/CR-5496, 'Evaluation of Loss of Offsite

Power Events at Nuclear Power Plants: 1980-1996," November 1998.

22. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.93, "Availability of Electric

Power Sources," December 1974.

23. U.S. Nuclear Regulatory Commission, NUREG/CR-5994, 'Emergency Diesel Generator:

Maintenance and Failure Unavailability, and Their Risk Impacts," October 1994.

24. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.160, "Monitoring the

Effectiveness of Maintenance at Nuclear Power Plants," Rev. 2, March 1997.

25. Nuclear Energy Institute, NUMARC 93-01, uNuclear Energy Institute Industry Guideline

for Monitoring the Effectiveness of Maintenance at Nuclear Power Plant," April 1996.

26. U.S. Nuclear Regulatory Commission, letter from James E. Taylor, Executive Director

for Operations to J. Emest Wilkins, Chairman, Advisory Committee on Reactor

Safeguards, October 29, 1993.

27. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.160, uMonitoring the

Effectiveness of Maintenance at Nuclear Power Plants," Rev. 1, January 1995.

28. U.S. Nuclear Regulatory Commission, SECY-99-129, "Effects Of Electric Power Industry

Deregulation on Electric Grid Reliability and Reactor Safety," May 11, 1999.

29. U.S. Nuclear Regulatory Commission, "The Effects of Deregulation of the Electric Power

Industry on the Nuclear Plant Offsite Power System: An Evaluation," dated June 30,

1999.

30. U.S. Nuclear Regulatory Commission, Information Notice 2000-06, "Offsite Power

Voltage Inadequacies," March 27, 2000.

31. U.S. Nuclear Regulatory Commission, Information Notice 98-07, "Offsite Power

Reliability Challenges From Industry Deregulation," February 27, 1998.

32. U.S. Nuclear Regulatory Commission, Information Notice 97-21, "Availability of Alternate

AC Power Source Designed for Station Blackout," Page 21, April 18, 1997.

26
APPENDIX A

TECHNICAL BASIS OF THE STATION BLACKOUT RULE

AND ADDITIONAL BACKGROUND
Technical Bases of the Station Blackout Rule

The SBO rule evolved from the results of several plant-specific probabilistic safety studies,

operating experience, and reliability, accident sequence, and consequence analyses completed

between 1975 and 1988. WASH-1 400, "Reactor Safety Study," 1975, indicated that SBO could

be an important contributor to the total risk from nuclear power plant accidents. This study

concluded that if an SBO persists for a time beyond the capability of the ac-independent systems

to remove decay heat, core melt and containment failure could follow. In 1980, the Commission

designated the issue of SBO as Unresolved Safety Issue (USI) A-44, "Station Blackout," and the

staff completed several technical studies to determine if any additional safety requirements were

needed.

NUREG-1 032, "Evaluation of Station Blackout at Nuclear Power Plants," June 1988 [Ref. 1],

integrated the findings of the technical studies completed for USI A-44. NUREG-1032 presented

the staffs major technical findings for the resolution of USI A-44, and provided the basis for the

SBO rule and the accompanying RG 1.155, "Station Blackout," August 1988 [Ref. 2].

The NUREG-1 032 evaluation of EDG train reliability used results and data from NUREG/

CR-2989, "Reliability of Emergency AC Power Systems at Nuclear Power Plants," July 1983

[Ref. 33. NUREGICR-2989 used the fault trees from 18 site PRAs/IPEs to find the EDG failure

boundary and classify failures. The boundary of the EDG train for the purposes of analyzing

failures included a single engine, a generator, an output circuit breaker, and support subsystems

necessary to power and sequence electrical loads to the vital bus. Consistent with the licensee

PRAs/IPEs, the NUREG-1032 analyses of EDG unreliability considered planned and unplanned

EDG demands and failures to start and load-run, EDG unavailability due to test and MOOS while

the reactor was in power and non-power status, EDG failure recovery, and EDG common-cause

failures. PRAVIPE reliability fault trees models included an unavailability contribution from MOOS

because the EDG cannot perform its safety function upon demand if it is out of service. EDG

MOOS while the reactor is at power can be an important consideration because the plant risk is

potentially higher because of the possibility of a demand while the EDG is unavailable. EDG

unavailability measurement can be based on the hours the EDG is unavailable or on the number

of failures per demand. Both measures are unbiased estimates of EDG unavailability and are

comparable so long as both measures are based on the same considerations (i.e., both consider

MOOS).

The EDG analyses characterized the safety function of the EDGs as ability to start and load on

demand, and used actual test and unplanned demands and failures (in excess of 10,000

demands and 100 failures) to measure reliability. NUREG-1 032 revealed EDG reliability to be

0.98 or better and MOOS to be an average of 0.006 with range of 0-0.037. The NUREG-1032

data indicates the number of EDG failures on demand with an EDG in MOOS was 0.0056, that is

approximately the same as 0.006 based on the time the EDGs were unavailable.

In March 1986, the NRC issued draft RG 1.155, which presented an acceptable method to

comply with the SBO rule based on plant-specific characteristics and the dominant risk factors

from NUREG-1032. The RG 1.155 was issued August 1988 and provided for selection of the

SBO coping duration based on plant-specific characteristics including past unit average EDG

train performance criteria and emergency ac power system configuration. The past unit average

EDG train performance criteria were based on a reliability of greater than 0.90, 0.94, and 0.95 in

the last 20, 50, and 100 demands. In general, the plants could select the 0.975 EDG target

reliability level to achieve shorter coping durations. Plants with the lowest level of independence

A-1
and redundancy in onsite emergency power supplies for safe shutdown equipment had to select

the 0.975 minimum EDG target reliability level.

RG 1.155 contains guidance on (1) maintaining an individual EDG target reliability of 0.95 per

demand or 0.975 per demand and assumes that as long as the MOOS unavailability is not

excessive, the maximum EDG failure rate would result in overall reliability for the emergency

power system), (2) establishing an EDG reliability program with test, maintenance, data

collection, and management oversight elements to maintain the selected EDG target reliability

level, (3) developing procedures and training to cope with an SBO, (4) selecting a plant-specific

minimum acceptable SBO duration capability of either 2, 4, 8, or 16 hours based on plant-specific

considerations, (5) evaluating SBO capability based on the selected duration capability, and

(6) completing modifications to cope with an SBO. RG 1.155 expected that the individual EDG

reliability would be calculated per NSAC-108, "The Reliability of Emergency Diesel at

U.S. Nuclear Power Plants," September 1986 [Ref. 4], as the product of start reliability and the

load-run reliability and did not consider MOOS. The calculation would use data that met the

NSAC-1 08 definition for valid EDG start and load-runs.

Public and Industry Comment

In March 1986, a Notice of Proposed Rulemaking on SBO was published in the Federal Register

(51 FR 9829), "Station Blackout.' That notice invited public comments on a proposed SBO rule,

draft RG 1.155, and NUREG-1 109, "Regulatory/Backfit Analysis for the Resolution of Unresolved

Safety Issue A-44, 'Station Blackout,'" June 1988 [Ref. 5]. Among the 53 letters that were

received commenting on the SBO rule was a critique of the backfit analysis that pointed out

numerous errors, omissions, and inaccuracies. In addition, an industry comment stated that the

costs would be much higher than those calculated by the NRC. The NRC addressed the cost

concerns in a report, "Response To Industry Comments on Station Blackout Cost Analysis

(NUREG/CR-3840)," November 1986 [Ref. 6], by increasing most of the cost items by 20 to

140 percent. Consequently the NUREG-1 109 industry costs are those provided by the industry.

The other comments were addressed in the final proposed resolution to USI A-44 that was

reviewed and approved by the Committee to Review Generic Requirements in May 1987 and

ACRS in June 1987.

In November 1987, NUMARC (subsequently renamed NEI) submitted NUMARC 87-00,

"Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light

Water Reactors," November 1987 [Ref. 7], as an alternative to comply with the SBO rule.

NUMARC 87-00 content followed RG 1.155 and added very prescriptive, practical guidance to

help the industry implement RG 1.155. NUMARC 87-00 addressed risk reduction by requiring

the following: (1) taking action to reduce the risk if the licensees fell into the 8- or 1 6-hour coping

category, (2) establishing procedures to cope with an SBO, restore ac power following an SBO,

and to prepare for severe weather, (3) reducing EDG cold fast starts for testing, and

(4) monitoring AC power unavailability by providing data to the Institute of Nuclear Power

Operations on a regular basis. By reference in RG 1.155, the staff concluded that

NUMARC 87-00 (November 1987) contains guidance acceptable to the staff for meeting the

SBO rule. Since 1989, the industry has used the EPS unavailability as an industry safety system

performance indicator.

The staff issued SECY-88-22, "Final Station Blackout Rule, USI A-44,0 January 21, 1988 [Ref. 8],

to obtain Commission approval for publishing the Notice of Final Rulemaking on the subject of

SBO. In SECY-88-22, the staff recommended that the Commission issue the SBO Rule,

A-2
NUREG-1 032, RG 1.155, and NUREG-1 109 which documented the evaluation of five

alternatives to close USI A-44 and the value-impact analysis of the proposed SBO rule. In

SECY-88-22, the staff stated that USI A-44 was related to such other GSIs as GSI B-56, "Diesel

Generator Reliability," USI A-45, "Shutdown Decay Heat Removal Requirements," GSI 23,

"Reactor Coolant Pump Seal Failures," and GSI 128, "Electric Power Reliability." In SECY-88-22,

the staff states that any additional requirements or guidance contained in the resolutions of these

GSls must be consistent with the requirements of the SBO rule and were not expected to cause

licensees to revise analyses, procedures, or equipment that were changed to comply with the

SBO rule.

Resolution of Generic Safety Issue B-56

The NRC SBO initiatives planned that the resolution of GSI B-56 would detail an EDG reliability

program consistent with RG 1.155. SECY-93-044, "Resolution of Generic Safety Issue B-56,

Diesel Generator Reliability," February 22, 1993 [Ref. 9], discussed several options and

implementation of the recommendations as follows:

(1) Incorporate (by reference or example) EDG maintenance unavailability operating

experience and the NUMARC EDG reliability program (Appendix D of NUMARC 87-00,

Rev. 1, Guidelines and Technical Bases for NUMARC Initiatives Addressing Station

Blackout at Light Water Reactors," August 1991 [Ref. 10]), into the regulatory guide and

NUMARC guideline being developed for the maintenance rule, "NUMARC 93-01 Industry

Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," May

1993 [Ref. 11]. Appendix D of NUMARC 87-00, Rev. 1, Section D.2.3., employs trigger

values to indicate when EDGs do not meet the selected target reliabilities. This

recommendation was implemented by RG 1.160, "Requirements for Monitoring the

Effectiveness of Maintenance at Nuclear Power Plants," June 1993 [Ref. 12]. However,

Note 3 of RG 1.160 indicated that the triggers are intended to indicate when EDG

performance problems exist such that additional monitoring is necessary and that it is not

practical to demonstrate by statistical analysis that conformance to the trigger values will

ensure the attainment of high reliability with reasonable confidence, of individual EDG

units. By 1993 many licensees adopted the NUMARC trigger values as a means to meet

the 0.95 and 0.975 EDG target reliability.

The maintenance rule (10 CFR 50.65) and the accompany regulatory guide RG 1.160

provide for the maintenance of safety-related structures, systems, and components

(SSCs). Paragraph (a)(1) of 10 CFR 50.65 requires that power reactor licensees monitor

the performance or condition of SSCs against licensee-established goals in a manner

sufficient to provide reasonable assurance that such SSCs are capable of fulfilling their

intended functions. Paragraph (a)(2) of 10 CFR 50.65 states that monitoring as specified

in paragraph (a)(1) is not required where it has been demonstrated that the performance

or condition of an SSC is being effectively controlled through preventive maintenance, so

that the SSC remains capable of performing its intended function. Paragraph (a)(3) of

10 CFR 50.65 requires that performance and condition monitoring activities and

associated goals and preventive maintenance activities be evaluated at least every

refueling cycle provided the interval between evaluations does not exceed 24 months.

RG 1.160 is the regulatory guide that accompanied the maintenance rule which is used in

part to evaluate the effectiveness of EDG maintenance activities associated with

compliance with the SBO rule.

A-3
(2) Issue a generic letter to allow licensees to voluntarily adopt the accelerated testing

provisions in the improved standard technical specifications. The generic letter would

further explain that, upon determination that the maintenance program conforms to the

applicable approved guidance for diesel testing, the accelerated testing requirements in

the technical specifications may be relocated to the maintenance program. This

recommendation was implemented by the issue of GL-94-01, "Removal of Accelerated

Testing and Special Reporting Requirements for Emergency Diesel Generators," May 31,

1994, that allowed licensees to eliminate accelerated testing requirements provided the

licensee committed to early implementation of the maintenance rule consistent with the

guidance of RG 1.160 with the exception of the reference to NUMARC 87-00, Rev, 1,

trigger values. To date, approximately 16 of the 64 nuclear power plants with accelerated

test requirements have licensing amendments to delete accelerated testing requirements;

however, the amendments were dated after the implementation of the maintenance rule,

so it appears there was no need to consider the trigger values exception.

(3) Revise RG 1.9, Rev. 2, to incorporate elements of RG 1.108, Rev. 2, and GL 84-15,

"Proposed Staff Actions to Improve and Maintain Diesel Generator Reliability," dated July

1984. This recommendation was implemented with the issue of RG 1.9, Rev. 3, dated

July 1993.

Regulatory Follow-uR

The SBO rule requires that the NRC staff complete a regulatory assessment and notify the

licensees of the staff's conclusions regarding the licensees' response to the SBO rule. The NRC

completed safety evaluations for each plant that can be found in the NRC Public Document

Room under each plant's docket number.

To assess the industry's compliance in implementing the SBO rule, the NRC completed eight

pilot inspections by October 1994 using Temporary Instruction 2515/120, Inspection of

Implementation of Station Blackout Rule," (no date) [Ref. 13]. The objective of Temporary

Instruction 2515/120 was to verify the adequacy of licensee programs, procedures, training,

equipment and systems, and supporting documentation for implementing the SBO rule. The

inspectors revealed that, overall, the licensees for the eight sites had satisfactorily implemented

their commitments for conforming to the SBO rule. The inspections uncovered minor

weaknesses in plant SBO documentation, primarily in the areas of electrical calculations and

procedures that were considered to have no effect on SBO mitigation and to be insignificant. On

the basis of these inspections, the staff concluded that it need not conduct additional team

inspections to verify licensee implementation of the SBO rule. However, additional discretionary

SBO inspections could be conducted to verify that the licensees have taken appropriate actions

to comply with the SBO rule.

Inspection Procedure 62706, "Maintenance Rule," December 31, 1997, Section 3.05,

"Effectiveness of Emergency Diesel Generator (EDG) Maintenance Activities" [Ref. 14]," provides

additional specific guidance that NRC inspectors should verify.

SBO rule assessments have been completed under other NRC programs and these were used in

this report. For example, the NRC staff evaluated the impact of the SBO rule on CDFs in 1560.

In SECY-97-180 the staff also evaluated the industry's average cost per person-rem averted in

satisfying the SBO requirements.

A-4
REFERENCES

1. U.S. Nuclear Regulatory Commission, NUREG-1032, "Evaluation of Station Blackout at

Nuclear Power Plants," June 1988.

2. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.155, "Station Blackout,"

August 1988.

3. U.S. Nuclear Regulatory Commission, NUREGICR-2989, "Reliability of Emergency AC

Power Systems at Nuclear Power Plants," July 1983.

4. Electric Power Research Institute, NSAC-108, "The Reliability of Emergency Diesel at

U.S. Nuclear Power Plants," September 1986.

5. U.S. Nuclear Regulatory Commission, NUREG-1 109, "RegulatorylBackfit Analysis for

the Resolution of Unresolved Safety Issue A-44, 'Station Blackout,'" June 1988.

6. Science and Engineering Associates, Inc., and Mathtech, Inc., "Response To Industry

Comments on Station Blackout Cost Analysis (NUREG/CR-3840)," November 1986.

7. Nuclear Energy Institute, NUMARC 87-00, "Guidelines and Technical Bases for

NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Rev. 0,

November 1987.

8. U.S. Nuclear Regulatory Commission, SECY-88-22, "Final Station Blackout Rule,

USI A-44, January 21, 1988.

9. U.S. Nuclear Regulatory Commission, SECY-93-044, "Resolution of Generic Safety

Issue B-56, Diesel Generator Reliability," February 22,1993.

10. Nuclear Energy Institute, NUMARC 87-00, "Guidelines and Technical Bases for

NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Rev. 1,

August 1991.

11. Nuclear Managment and Resources Council, NUMARC 93-01, "Industry Guideline for

Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," May 1993.

12. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.160, "Requirements for

Monitoring the Effectiveness of Maintenance at Nuclear Power Plants,' June 1993.

13. U.S. Nuclear Regulatory Commission, Temporary Instruction 2515/120, "Inspection of

Implementation of Station Blackout Rule," no date.

14. U.S. Nuclear Regulatory Commission, Inspection Procedure 62706, "Maintenance

Rule," December 31, 1997.

A-5
APPENDIX B

PLANT-SPECIFIC STATION BLACKOUT INFORMATION

BY REACTOR TYPE AND OPERATING STATUS
Plant-Speciflc Station Blackout Information by Reactor Type and Operating Status

Table B-1 Operating pressurized-water reactors

Plant Plant CDF SBO Percent Coping time in Modification SBO factors

CDF SBO CDF hours/EDG summary

Of rellability/Aac including dcI PRA LOOP Number of LOOP events LOOP event

Plant CDF access time in load shed Initiating at power since recovery times 2

menutes/ procedural event commercial operation 240 minutes extremely modifications frequency -- -

severe weather Plant Weather Grid Power Shutdow

n

Arkansas Nuclear 4.67E-05 1.58E-05 33.8 41.95/10/1 Added 1 DG 3.58E-02 2 1

One Unit 1 and crosstbe

Arkansas Nuclear 3.40E-05 1.23E-06 3.6 41.95/10/1 Added crosstle 5.84E-02 1 1

One Unit 2

Beaver Valley 2.14E-04 6.51 E-05 30.4 4/.975/60/1 Added crosstle 6.64E-02 2

Unit 1

Beaver Valley 1.92E-04 4.86E-05 25.3 4/.975/60/1 Added crosstie 7.44E-02 1

Unit 2

Braidwood 2.74E-05 6.20E-06 22.6 4/.95/10/1 4.53E-02 2

Units 1&2

Bryon Units 1 &2 3.09E-05 4.30E-06 13.9 41.95/10/1 4.43E-02

Callaway 5.85E-05 1.80E-05 30.8 4/.975-/11 4.60E-02 . -

Calvert Cliffs 2.40E-04 8.32E-06 3.4 4/.975/6014 Added 1 EDG 1.36E-01 3

Units 1 &2 and one 1 DG

Catawba Units 1&2 5.80E-05 6.OE-07 10.3 4/.95110/1 2.OE-03 1 330

Comanche Peak 5.72E-05 1.5E-05 26.2 41.95/-1

Units 1&2

B-1
Plant-Specific Station Blackout Information by Reactor Type and Operating Status

Table B-1 Operating pressurized-water reactors (Cont.)

Plant Plant CDF SBO Percent Coping time in Modification SBO factors

CDF SBO CDF hours/EDG summary

of reliability/Aac including d PRA LOOP Number of LOOP events LOOP event

Plant CDF access time in load shed Initiating at power since recovery times 2

minutes/ procedural event commercial operation 240 minutes

extremely modifications frequency Pat Wahr Gi oe hto

severe weather Plant Weather Grid Power Shutdow

n

Crystal River 1.53E-05 3.28E-06 21.5 41.9751-14 dc load shed. 4.35E-01 3

Unit 3 Added

nonclass 1 E

battery

Davis-Besse 6.6E-05 3.50E-05 53 4/.95/10/2 Added 1 DG 3.50E-02 2 1 1680

DC Cook Units 6.2E-05 1.1 3E-05 18.1 41.9751/12 dc load shed 4.0E-02 1

1&2

Diablo Canyon 8.8E-05 5.0E-06 5.68 41.951-41 Added 1 DG 9.1 E-02 1 261

Units 1&2 917

Farley Units 1&2 1.3E-04 1.22E-05 9.4 41.95110/3 Service water 4.70E-02 2

to Aac, auto

load shedding

Fort Calhoun 1.36E-05 NA - 41.951-12 DC load shed 2.17E-01 2

Ginna 8.74E-05 1.OE-06 1.14 41.975/-1l 3.50E-03 4

Harris 7.0E-05 1.71 E-05 24.4 4/.95/-/3 Lighting In

several areas,

ladder to

isolation valve

Indian Point Unit 2 3.13E-05 4.47E-06 14.3 81.95160/2 Added a DG for 6.91 E-02 2 3 390

gas turbine

auxiliaries

B-2
Plant-Specific Station Blackout Information by Reactor Type and Operating Status

Table B-1 Operating pressurized-water reactors (Cont.)

Plant Plant CDF SBO Percent Coping time in Modification SBO factors

CDF SBO CDF hours/EDG summary

of reliability/Aac including d PRA LOOP Number of LOOP events LOOP event

Plant CDF access time In load shed Initiating at power since recovery times 2

minutes/ procedural event commercial operation 240 minutes

extremely modifications frequency

severe weather Plant Weather Grid Power Shutdow

n

Indian Point Unit 3 4.40E-05 4.80E-06 10.9 81.9516012 6.80E-02 1

Kewaunee 6.6E-05 2.64E-05 40 41.9516012 Cross-tie to 4.4E-02

nonsafety

power source

McGuire Units 1 &2 4.OE-05 9.26E-06 23.3 4/.95/10/1 7.OE-02 3

Millstone Unit 2 3.42E-05 1.0E-10 NMN 8/.975/60/5 Upgraded unit 9.10E-02 1 1 330

1-2 crosstle

Millstone Unit 3 5.61 E-05 5.10E-06 6 8/.975160/5 Added DG 1.12E-01 = _=_=

North Anna 7.16E-05 8.OE-06 11.2 4/.95/60/4 Added DG, 1.14E-02

Unhs 1&2 switchgear,

crosstie

Oconee 2.3E-05 2.57E-06 11.2 4/.975/10/1 9.OE-02 2

Units 1, 2&3

Palisades 5.07E-05 9.10E-06 17.9 4/.95/-/l DC load shed, 3.0E-02 3 388

compressed air

for ADVs

Palo Verde 9.OE-05 1.91 E-05 21.2 41.95/10/2 Added 2 gas 7.83E-02 3 1138

Units 1, 2&3 turbines

Point Beach 1.15E-04 1.51 E-05 13.1 4/.975/6012 Gas turbine 6.1OE-02 4

Units 1&2 modifications

B-3
Plant-Specific Station Blackout Information by Reactor Type and Operating Status

Table B-1 Operating pressurized-water reactors (Cont.)

Plant Plant CDF SBO Percent Coping time in Modification SBO factors

CDF SBO CDF hours/EDG summary

of rellability/Aac including dc PRA LOOP Number of LOOP events LOOP event

Plant CDF access time in load shad initiating at power since recovery times 2

extremely procedural event commercial operation 240 minutes

severe weather frequency Plant Weather Grid Power Shutdow

n

Prairie Island 5.05E-05 3.1 E-06 6.14 41.975110/3 Added 2 EDGs _ 1 2 296

Units 1&2 296

Robinson Unit 2 3.20E-04 2.6E-05 8.13 81.95160/4 Modified 6.1 E-02 2 454

conduit

supports in

switchgear

room

Salem Unit 1 5.20E-05 2.10E-05 40.4 41.9751-12 EDG 6.0E-02 1

compressed air

mod

Salem Unit 2 5.5E-05 1.70E-05 30.9 4/.975/-/2 EDG 6.OE-02 2 655 1675

compressed air

mod

San Onofre 3.OE-05 2.0E-06 6.67 41.951-1l DC load shed 1.11E-01 2

Units 2&3 and crosstie

St. Lucie Unit 1 2.30E-05 2.65E-06 11.5 41.975/10/5 Added crosstie 1.5E-01 1 3

St. Lucie Unit 2 2.62E-05 2.64E-06 10.1 41.975/10/5 Added crosstie 1.5E-01

Seabrook 6.86E-05 1.53E-05 22.3 41.9751-/3 DC load shed 4.93E-02

Sequoyah 1.70E-04 5.32E-06 3.2 41.9751-12 DC load shed, 5.16E-03 2

Units 1&2 added air

supply

B-4
Plant-Specific Station Blackout Information by Reactor Type and Operating Status

Table B-1 Operating pressurized-water reactors (Cont.)

Plant Plant CDF SBO Percent Coping time in Modification SBO factors

CDF SBO CDF hours/EDG summary

of reliabilitytAac Including de PRA LOOP Number of LOOP events LOOP event

Plant CDF access time in load shed initiating at power since recovery times 2

minutes/ procedural event commercial operation 240 minutes

extremely modifications frequency - -

severe weather Plant Weather Grid Power Shutdow

n

Summer 2.OE-04 4.9E-05 24.5 4/.95/-13 DC load shed, 7.3E-02 1

battery mod

South Texas 4.3E-05 1.46E-05 34.9 4/.975/10/5 Procedural

Units 1&2 cross-tie

Surry Units 1 &2 1.25E-04 8.09E-06 6.47 4/.975/10/4 Added DG 7.69E-02

Three Mile 4.49E-04 1.57E-05 3.5 4/.975110/3 Modifications to 5.68E-02

Island Unit 1 existing DGs

Turkey Point 3.73E-04 4.70E-06 1.2 8/.95/10/5 Added 2 EDGs 1.7E-01 4 2 7 7950 335

Units 3&4 and cross-tie 7908

Vogtle Units 1 &2 4.9E-05 4.4E-07 11 41.951-12 Added 5 circuit 6.6E-04

breakers and lighting

Waterford Unit 3 1.80E-05 6.24E-06 34.7 4/.975/-/4 DC load shed. 3.6E-02

Added

portable air

compressors

for EDGs

Watts Bar Unit 1 8.OE-05 1.73E-05 21.6 41.975/-?11 3.64E-02

Wolf Creek 4.2E-05 1.88E-05 44.8 41.95/-1l 5.12E-02

B-5
Plant-Specific Station Blackout Information by Reactor Type and Operating Status

Table B-2 Operating boiling-water reactors

Plant Plant CDF SBO Percent Coping time in Modification SBO factors

CDF SBO CDF hours/EDG summary

of reliability/Aac including dc PRA LOOP Number of LOOP events LOOP event

Plant CDF access time in load shed initiabng at power since LOvent

rmnutes/ proceduicats event commercial operation 240 minutes

extremely modifications frequency --

severe weather Plant Weather Grid Power Shutdown

Browns Ferry 4.80E-05 1.30E-05 27 41.95/-1l dc load shed 1.12E-01

Units 2&3

Brunswick 2.70E-05 1.80E-05 66.7 41.97516015 Modified 7.40E-02 3 1508

Units 1&2 controls for 814

existing

crosstie

Clinton 2.66E-05 9.8E-06 36.8 41.95/10/1 Added gas fans 8.40E-02

for selected

room cooling

Cooper 7.97E-05 2.77E-05 34.8 4/.95/-/2 3.50E-02

Dresden 1.8E-05 9.30E-07 5.03 4/.95160/2 Added 2 DGs 1.12E-01 3 1 240

Units 2&3

Duane Amold 7.84E-06 1.90E-06 24.2 41.9751-12 dc load shed, 1.17E-01 1

RCIC insulation

& main control

room lighting

Fermi 5.70E-06 1.3E-07 NMN 41.95/60/1 1.88E-01

FitzPatrick 1.92E-06 1.75E-06 NMN 41.951-11 dc load shed, 5.70E-02

instrumentation

and power

supply mods _

Grand Gulf 1.77E-05 7.46E-06 36.8 41.951-12 dc load shed 6.80E-02

B-6
Plant-Specific Station Blackout Information by Reactor Type and Operating Status

Table B-2 Operating boiling-water reactors (Cont.)

Plant Plant CDF SBO Percent Coping time in Modification SBO factors

CDF SBO CDF hoursIEDG summary

P f reliability/A c including dc PRA LOOP Number of LOOP events LOOP event P access C time In load shed initiating at power since recovery times 2

minutes/ procedural event commercial operation 240 minutes

extremely modifications frequency - -

severe weather Plant Weather Grid Power Shutdown

Hatch 2.23E-05 3.30E-06 14.8 41.95/6012 Replaced 2.20E-02

Unit 1 battery

chargers

Hatch 2.36E-05 3.23E-06 13.7 4/.95/6012 Replaced 2.20E-02

Unit 2 battery _________ __________ chargers

Hope Creek 4.63E-05 3.38E-05 73 41.951-/2 Valve 3.4E-02

modifications

LaSalle 4.74E-05 3.82E-05 80.6 41.975/-/l dc load shed, 9.60E-02 1

Units 1&2 New batteries

Limerick 4.30E-06 1.OE-07 NMN 4/.95/60/3 Upgraded 5.9E-02

Units 1&2 cross-ties

Monticello 2.60E-05 1.20E-05 46.2 41.95/-Il dc load shed 7.90E-02

Nine Mile Point 5.50E-06 3.50E-06 NMN 44.9751-1 dc load shed, 5.OOE-02 4 595

Unit 1 added two

safety related

batteries

Nine Mile Point 3.10E-05 5.50E-06 17.7 41.975/-1l dc load shed 1.20E-01

Unit 2

B-7
Plant-Specific Station Blackout Information by Reactor Type and Operating Status

Table B-2 Operating boiling-water reactors (Cont.)

Plant Plant CDF SBO Percent Coping time In Modification SBO factors

CDF SBO CDF hours/EDG summary

of reliability/Aac including d PRA LOOP Number of LOOP events LOOP event

Plant CDF access time In load shed initiating at power since recovery times 2

minutes/ procedural event commercial operation 240 minutes extremely modifications frequency Pln Wetr Gid owr Suon

severe weather Plant Weather Grid Power Shutdown

Oyster Creek 3.90E-06 2.30E-06 NMN 4/.975/60/1 Added crosetie 3.26E-02 3 240

& reactor

pressure

indication

Peach Bottom 5.53E-06 4.81 E-07 8.7 8/.975/60/3 Cross-tie to 5.9E-02

Units 2 & 3 hydro unit

Perry 1.30E-05 2.25E-06 43.4 4/.95/10/1 Replaced 6.09E-02

selected cables

Pilgrim 5.80E-05 1.OE-10 NMN 8/.975/10/4 Alarms to line- 6.17E-01 1 5 1263

up Aac 534

Quad Cities 1.2E-06 5.72E-07 NMN 4/.95/60/1 Added 2 DGs 4.81 E-02 2

Units 1&2

River Bend 1.55E-05 1.35E-05 87.5 41.951-12 Minor structural 3.50E-02 1

mod

Susquehanna 1.7E-05 4.2E-1 1 NMN 41.9751-12 dc load shed I 1

Units 1&2

Vermont Yankee 4.30E-06 9.17E-07 21.3 8/.975/10/4 Modified 1.OE-01 2 277

incoming line

and controls

Washington 1.73E-05 1.07E-05 61.1 41.951-1 dc load shed, 2.46E-02

Nuclear Plant replaced

Unit 2 inverters_

B-8
Plant-Specific Station Blackout Information By Reactor Type and Operating Status

Table B-3 Reactors no longer operating

Plant Plant CDF SBO CDF Percent Coping time In Modification SBO factors

SBO CDF hours/EDG summary

of reliability/Aac including dc PRA LOOP Number of LOOP events at LOOP event

Plant CDF access time in load shed Initiating power since commercial recovery times 2

minutes/ procedural event operation 240 minutes

extremely modifications frqunc

severe weather frequency Plant Weather Grid Power Shutdown

Big Rock 5.40E-05 5.1 OE-07 NMN 41.951-1l DC load shed, 2.8E-01

Point added crosatie

Browns Ferry 4.80E-05 1.30E-05 27 41.95/-1l 1.12E-01

UnIt 1

Haddam 1.90E-04 8.70E-06 4.46 41.95/-/2 Fuel system for 9.0E-02 5

Neck gas water pump

Maine 7.40E-05 1.11 E-05 15 41.975/60/3 5.OE-02 1

Yankee

Millstone 1.133E-05 7.OOE-06 62 81.975/60/5 Upgraded 1 2 300

Unit 1 crosstie

Zion 4.OE-06 4.4E-07 NMN 4/.95/10/1 4.60E-02 1

Units 1&2

B-9
APPENDIX C

COMPARISON OF SELECTED

STATION BLACKOUT CHARACTERISTICS
Table C-1 Comparison of selected station blackout characteristics

PLANT LOOP Initiating Frequency Extreme Severe Selected SBO

Weather Group characteristics

PRAAPE Actual Approximate SBO-CDF/Coping time

frequencyinumber of factor PRAIIPE In minuteslAac access

LOOP events at underestimated in time in minutes

power since comparison to

commercial operation operating

experience

Pilgrim 6.17E-01 1.48E-01/4 E-1018/10

Crystal River 4.35E-01 1.36E-01/3 E'06t41-

Fort Calhoun 2.17E-01 0.76E-0112 _ E-06/4JFermi 2 1.88E-01 0/0 E-07/4/60

Turkey Point 3 1.7E-01 5.18E-01/14 3 X E-0618/10

Turkey Point 4 1.7E-01 0.76E-0112 X E-06/8110

St Lucie 1 1.5E-01 1.73E-0114 X E-W4/10

St Luce 2 1.5E-01 0/0 X E-0614/10

Calvert Cliffs 1 1.36E-01 0.4E-01/1 E-0614/60

Calvert Cliffs 2 1.36E-01 0.43E-01/1 E-0614160

South Texas 1&2 1.32E-01 0/0 X E-05/810

Nine Mile 2 1.2E-01 0/0 E-E064/-

Duane Arnold 1.17E-01 0.4E-01/1 E-06/4/-

Browns Ferry 2 1.12E-01 0/0 E-0514/-

Dresden 2 1.12E-01 1.07E-0113 E-0714/60

Dresden 3 1.12E-01 0.35E-01/1

Millstone 3 1.12E-01 0/0 X E-06860

San Ontre 2&3 1.1E-01 010 E-06/4/-

Vermont Yankee 1.OE-01 0.38E-01/1 E-07/8J10

Millstone 2 9.1E-02 12.5E-02/3 2 X E-10/8/60

Palo Verde I 7.83E-02 15.3E-02/2 E-0514/10

Bnrnswick 1 7.4E-02 9.1 E-02/2 2 X E-05/8/60

BrunswIck 2 7.4E-02 010 X E-05/8/60

Indian Point 2 6.91 E-02 20E- 02153 E-06J8160

Indian Point 3 6.80E-02 4.3E-02/1 E-06/8160

Robinson 6.1 E-02 7.1E-02/2 E-05/8/60

Point Beach 1 6.OE-02 10.3E-02/3 E-05/8/60

Point Beach 2 6.OE-02 3.7E-0211 E-0518160

Salem 2 6.OE-02 11.1E-022 2 E-0514/-

Oyster Creek 3.26E-02 10E-02t3 3 E-0614160

Ginna 3.50E-03 137E-03J4 39 E-064/-

Palisades 3.OE-03 71 E-03/2 23 E-06/4/-

C-1
APPENDIX D

EMERGENCY DIESEL GENERATOR TRIGGER VALUES
1 History of Emergency Diesel Generator Trigger Failure Rates

Regulatory Guide (RG) 1.155, "Station Blackout," August 1988, (paragraph 1.1) [Ref. 1],

expected that the individual EDG reliability would be calculated in accordance with NSAC-108,

"The Reliability of Emergency Diesel at U.S. Nuclear Power Plants," September 1986 [Ref. 2],

as the product of start reliability and the load-run reliability using data that met the NSAC-108

definition for valid EDG start and load-runs. The method provides for the calculation of

individual EDG reliability as shown in NSAC-108 and "A Review of Issues Related to Improving

Nuclear Power Plant Diesel Generator Reliability," NUREG/CR-4557, March 1986 [Ref. 3],

which calculated the reliability for each nuclear plant EDG using 3 years of plant EDG data.

RG 1.155 (paragraph 1.2) provides that licensees calculate a unit average EDG reliability for

20,50, and 100 demands. RG 1.155 (paragraphs 1.1.3,1.1.4, and 1.1.5) provides for

licensees to compare the unit average EDG reliability against reliability criteria for determining

the station blackout (SBO) coping duration and the individual EDG target reliability based upon

the emergency ac power system configuration (EAC) group and whether any, or none, of the

reliability criteria are met.

Subsequently, the notion of calculating EDG reliability based on 20, 50, and 100 demands

emerged. Failures were associated with 20, 50, and 100 demands and statistical analyses

completed, resulting in various combinations and use of trigger values as summarized below.

- NUREG/CR-5078, "A Reliability Program for Emergency Diesel Generators at Nuclear

Power Plants," February 1988 [Ref. 4], evaluated failure criteria for EDGs having a

target reliability of 0.95 or 0.975, based on the number of failures recorded in the last

20,50, and 100 demands using a Monte Carlo simulation. NUREG/CR-5078 analyzed

eight failure progressions, considering the false alarm rate (a percentage of the time the

true EDG reliability is observed), and provided interpretations of the failure progressions.

For example, the first failure progression for the 0.95 target reliability group is an

unacceptable, requires-immediate-attention condition when the observed performance is

2 failures in 20 demands, 5 failures in 50 demands, and 10 failures in 100 demands.

- NUREG/CR-561 1, "Issues and Approaches for Using Equipment Reliability Alert

Levels," June 1991 [Ref. 5], determined the false-alarm rate and the detection response

of seven candidate alert systems provided by the industry to a specified reliability

degradation from .98 to 0.92 for different criteria supplied by the industry.

- The Commission endorsed an approach to the resolution of GSI B-56 in SECY-90-340,

"Diesel Generator Reliability B-56, Resolution of Generic Safety Issue B-56,

(COMJC-91-001/001-AO)," June 28,1991 [Ref. 6], that had the following elements:

(1) target reliability levels would be established for each licensee's EDGs (consistent

with the approach in the maintenance rule) and (2) trigger values would be used to

provide an "early warning' of EDG degradation and to provide a basis for taking

regulatory action and a reporting regime would be established in accordance with the

approach specified above. SECY-90-340 also specifies that the trigger values would be

used to (1) report diesel failures to the NRC when such failures reach 3 failures out of

20 starts and (2) undertake accelerated testing and report to the NRC when the failures

reach 4 out of 20 failures. "Double trigger" values of 5 failures out of 50 starts (5 in 50)

D-1
and 8 in 100 for a 0.95 target reliability, and 4 in 50 and 8 in 100 for a 0.975 target

reliability would provide clear indication that the specified underlying reliability has not

been met.

An NRC white paper, "A Sequential Trigger Procedure for Use in Monitoring Nuclear

Power Plant Emergency Diesel Generator Reliability," October 1992 [Ref. 7], used a

Monte Carlo simulation to evaluate the following triggers: 3 in 20 as an early warning for

individual and all EDGS, 4 in 25 as a problem EDG, and double triggers of 5 in 50 and

8 in 100 for a 0.95 target reliability or 4 in 50 and 5 in 100 for an 0.975 EDG target

reliability.

NUMARC (now NEI) developed an EDG reliability program in Appendix D of

NUMARC 87-00, Rev. 1, "Guidelines and Technical Bases for NUMARC Initiatives

Addressing Station Blackout at Light-Water Reactors," August 1991 [Ref. 8], for the

maintenance rule. Appendix D of NUMARC 87-00, Rev.1 (paragraph D.2.3.1), employs

the use of trigger values shown in Table E-1, "Industry emergency diesel generator

trigger failure rates," to indicate when EDGs do not meet the selected target reliabilities.

The trigger values represent the point at which additional actions should be taken to

restore the selected EDG reliability. NUMARC 87-00, Rev. 1, prescribes actions for

reaching one trigger value and another set of actions for reaching the triggers

corresponding to 50 and 100 demands.

Table D-1 Industry emergency diesel generator trigger failure rates

Selected Failures In Failures in Failures In

Target 20 Demands 50 Demands 100 Demands

Reliability

NUMARC 87-00, Rev. 1, 0.95 3 5 8

Appendix D 1 0.975 3 4 5

In a letter to the ACRS dated October 29, 1993, the Executive Director for Operations

advised that the staff agreed with the ACRS that conformance of individual EDGs with

trigger values cannot be taken in any statistical fashion and that the EDG has

demonstrated achievement of licensee high reliability value commitments of 0.95 or

0.975. The October letter states that Note 3 was added to RG 1.160, dated June 1993,

to emphasize this fact. Note 3 states that the triggers are intended to indicate when

EDG performance problems exist such that additional monitoring or corrective action is

necessary and that it is not practical to demonstrate by statistical analysis that

conformance to the trigger values will ensure the attainment of high reliability, with a

reasonable degree of confidence, of individual EDG units.

The staff has not endorsed NUMARC 87-00, Rev. 1. Past and present revisions of

RG 1.160, Section C, state that NUMARC 93-01, "Industry Guideline for Monitoring the

Effectiveness of Maintenance at Nuclear Power Plants," May 1993 [Ref. 9], (which

references NUMARC 87-00, Rev. 1, and uses the triggers in an example in

Section 12.2.4) references other documents, but NRC's endorsement of

D-2
NUMARC 93-01 should not be considered an endorsement of the referenced

documents. The NRC staff intended that this statement be interpreted to mean

NUMARC 87-0, Rev. 1, was not endorsed. However, as explained in Appendix E, the

wording in past revisions of RG 1.160 from 1993 and 1997 could lead to the conclusion

that the trigger values could be used to demonstrate compliance with the EDG reliability

commitments.

- The wording in past revisions of RG 1.160 could lead to the conclusion that the

NUMARC reference documents does not apply to the EDGs. For example, RG 1.160,

"Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power

Plants," Regulatory Guide 1.160, June 1993, Section C [Ref. 10], also states that the

example in NUMARC 93-01, Section 12.2.4, describes an acceptable method for

establishing EDG performance criteria and/or goals and subsequently monitor EDG

performance. As another example RG 1.160, Rev. 1, January 1995, Section B

[Ref. 11], states that the EDGs are required to be handled under paragraphs (a)(1) and

(a)(2) of the maintenance rule as described in NUMARC 93-01.

- Inspection documents Temporary Instruction 2515/120, "Inspection of Implementation of

Station Blackout Rule," Section 2515/120-040 [Ref. 12], and Inspection

Procedure 62706, "Maintenance Rule," December 31,1997, Section 3.05 [Ref. 13], use

the NUMARC 87-00, Rev. 1, Appendix D, trigger values for assessing compliance with

the RG 1.155 minimum individual EDG target reliabilities of 0.95 and 0.975.

- A search of licensing correspondence indicates that several licensees may be using the

NUMARC trigger values to demonstrate compliance to the RG 1.155 EDG target

reliabilities.

2 Technical Basis of the Trigger Values From Different Points of View

The ACRS challenged the trigger statistic using confidence intervals developed from the

binomial distribution and from the point of view that trigger values do not provide sufficient

statistical confidence that the target reliabilities are met. INEEL was requested to develop

statistics, consistent with the ACRS point of view, uses the binomial distribution to indicate the

confidence in meeting or exceeding a reliability given failure data. In addition, INEEL was

asked to develop statistics using Bayesian methods to provide the probability that the reliability

is greater than the target reliability, given the failure data. INEEL provided the following results

and Table D-2, "Statistical confidence that emergency diesel generator reliability is met," below.

INEEL was asked to investigate the statistical significance of industry emergency

diesel generator (EDG) trigger failure rates in ensuring that EDG reliability

remains above target reliability levels (0.95 for some plants and 0.975 for

others). Table E-2, "Statistical Confidence That EDG Reliability Is Met," shows

the results of the INEEL investigation. The result of this investigation is that

when EDG failure rates reach the trigger levels represented by the bold data in

the table below, the probability that their reliability meets or exceeds the

associated target reliabilities is, at best, less than 6 percent. The discussion

below provides more detail about this finding.

D-3
Table D-2 Statistical confidence that emergency diesel generator reliability is met

Estimated Binomial distribution lower confidence bounds on Probability that reliability > target

Failure Data reliability estimated reliability reliabi RV

Target reliability Target

Failures Demands 2.5% 5% 50% 95% 0.95 rebability 0.975

2 20 0.90 0.968 0.958 0.89 0.717 0.029 0.021

3 ___________ 0.85 0.943 0.929 0.819 0.656 0.055 0.044

4 0.80 0.913 0.896 0.770 0.599 0.087 0.072

3 50 0.94 0.978 0.972 0.927 0852 0.022 0.017

4 ___________ 0.92 0.967 0.960 0.907 0.826 0.034 0.028

5 ___________ 0.90 0.955 0.946 0.887 0.801 0.047 0.039

6 0.88 0.942 0.932 0.867 0.777 0.061 0.052

4 100 0.96 0.984 0.980 0.953 0.911 0.017 0.014

5 0.95 0.978 0.974 0.943 0.898 0.023 0.019

6 0.94 0.971 0.967 0.934 0.885 0.030 0.025

7 0.93 0.965 0.960 0.924 0.873 0.037 0.032

3 0.92 0.958 0.952 0.914 0.860 0.044 0.039

-9 - 0.91 0.951 0.945 0.904 0.848 0.051 0.045

10 _ 0.90 0.944 0.937 0.894 0.836 0.059 0.053

Notes:

Bold entries correspond to the trigger failure rate levels.

Estimated rellabillty Suocesses/Demands.

Lower confidence bounds: Based on data from a binomial distribution. The reliability is greater than the values cited, with the confidences stated

In the column headings.

Probability of exceeding specified targets: Computed as probability that a beta random variable with parameters (Successes+0.5, Falkires.0.5)

equals or exceeds the specified tarqet.

In the Table D-2 results for various sets of failure, demand combinations

surrounding the Trigger Failure Rates (in bold) are provided. The confidence

bound section of the table gives examples of the level of information available

from each set of data about the probability of success, (i.e., the reliability, using

a binomial distribution). For example within 20 demands and 2 failures, the

confidence in exceeding a 0.958 reliability (between the two target reliabilities)

is only 5 percent. The confidence section shows that with three failures in

20 demands, the confidence in meeting or exceeding a reliability of 0.95 is less

than 2.5 percent. In the right-most lower bound column where a relatively high

(95 percent) exceedance confidence exists, the reliabilities are considerably

less than the target reliabilities.

The last two columns in the table contain results for the probability of meeting

or exceeding the specific target reliabilities given each set of data. The

calculations are based on a probability distribution for the success probability

for each set of data, developed using the "simple Bayes" method (see G. Box

and G Tiao, Bayesian Inference in Statistical Analysis, Reading, MA: Addison

Wesley, 1973, Sections 1.3.4-1.3.5). This method is widely used in risk

assessment; for example, it is described in NUREG/CR-2300 (the 1983 PRA

Procedures Guide published by the NRC). A beta distribution is a conjugate

prior distribution for binomially-distributed data. In the simple Bayes method, a

noninformative prior beta distribution (called the Jeffreys prior) is updated with

observed data, resulting in a posterior beta distribution that describes the

reliability for each set of data (each row in the table). The probabilities given in

the table are tail probabilities for the resulting distributions. The probabilities

highlighted correspond to the trigger failure data. All of these probabilities are

less than 0.06.

D-4
From this perspective, the trigger failure rates do not ensure the RG 1.155

reliability levels with a reasonable degree of confidence.

From an NRC inspection point of view, action should only be taken if there is

high confidence that the reliability is NOT maintained. INEEL was also asked

to develop statistics using the binomial distribution to indicate the confidence

that the reliability is NOT as indicated given given failure data. INEEL provided

the following results and Table D-3, "Statistical confidence that emergency

diesel generator reliability is NOT met," below.

INEEL was also asked to provide the same type of information from the point

of view that action should be taken only if there is high confidence that the

reliability is NOT maintained [which] is provided below. The results are shown

in Table E-3, 'Statistical Confidence That EDG Reliability Is NOT Met," to

demonstrate use and interpretation of the information, an example follows:

after 2 failures in 20 demands, we are 95 percent confident that the reliability is

less than 98 percent; but when this behavior continues and we see 10 failures

in 100 demands, we are 95 percent confident that the reliability is less than

94.5 percent. We are more confident that the reliability is inadequate, and that

changes are needed, after more failures are seen.

Table D-3 Statistical confidence that emergency diesel

generator reliability Is NOT met

Estirated Binomial distribution upper confidence bounds on Probability that reliability - Failure Data relbblity estimated reliabilitv taroet reliabilltv

Target

Target reliability

Failures Demands 50% 90% 95% 97.5% reliability 0.95 0.975

2 20 0.90 0.917 0.973 0.982 0.988 0.853 0.965

3 0.85 0.869 0.944 0.958 0.968 0.964 0.996

4 0.80 0.819 0.910 0.929 0.943 0.993 1.000

3 50 0.94 0.947 0.978 0.983 0.987 0.660 0.929

4 0.92 0.927 0.965 0.972 0.978 0.839 0982

5 0.90 0.907 0.951 0.960 0.967 0.936 0.996

6 0.88 0.887 0.936 0.946 0.955 0.979 0.999

4 100 0.96 0.963 0.982 0.986 0.989 0.344 0.837

5 0.95 0.953 0.975 0.980 0.984 0.528 0.934

6 0.94 0.943 0.968 0.974 0.978 0.696 0.977

7 0.93 0.934 0.961 0.967 0.971 0.825 0.993

a 0.92 0.924 0.953 0.960 0.965 0.909 0.998

9 0.91 0.914 0.945 0.952 0.958 0.957 1.000

10 0.90 0.904 0.937 0.945 0.951 0.982 1.000

Notes:

Bold entries correspond to the trigger failure rate levels.

Estimated reliability: SuccesseslDemands.

Upper confidence bounds: Based on data from a binomial distribution. The reliability is less than the

values cited, with the confidences stated in the column headings.

Probability of being below specified targets: Computed as probability that a beta random variable with

parameters (Successes+0.5, Failures+0.5) is less than the specified target.

From this perspective, the conclusion is the trigger values ensure, with a high

degree of confidence, that the EDG is NOT being met. On one hand these

failure rates can be used to ensure that licensees or NRC inspectors do not

take action when no fault exists. On the other hand, the time between the

D-5
onset of degradation of EDG performance and the sure detection can be long.

During this time, the plant could be in a vulnerable position, in which the

underlying risk of an SBO could have risen to an unacceptable level; an

effective EDG reliability program should anticipate this condition.

REFERENCES

1. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.155, "Station Blackout,"

August 1988.

2. Electric Power Research Institute, NSAC-108, "The Reliability of Emergency Diesel at

U.S. Nuclear Power Plants," September 1986.

3. U.S. Nuclear Regulatory Commission, NUREG/CR-4557, "A Review of Issues Related

to Improving Nuclear Power Plant Diesel Generator Reliability," March 1986.

4. U.S. Nuclear Regulatory Commission, NUREG/CR-5078, "A Reliability Program for

Emergency Diesel Generators at Nuclear Power Plants,' February 1988.

5. U.S. Nuclear Regulatory Commission, NUREG/CR-561 1, "Issues and Approaches for

Using Equipment Reliability Alert Levels," June 1991.

6. U.S. Nuclear Regulatory Commission, SECY-90-340, "Diesel Generator Reliability B-56,

Resolution of Generic Safety Issue B-56, (COMJC-91 -001/001 -AO)," June 28, 1991.

7. Los Alamos National Laboratory, "A Sequential Trigger Procedure For Use In Monitoring

Nuclear Power Plant Emergency Diesel Generator Reliability," October 1992.

8. Nuclear Energy Institute, NUMARC 87-00, "Guidelines and Technical Bases for

NUMARC Initiatives Addressing Station Blackout at Light Water Reactors," Rev. 1,

August 1991.

9. Nuclear Management and Resources Council, NUMARC 93-01, "Industry Guideline for

Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," May 1993

10. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.160, "Requirements for

Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," June 1993.

11. U.S. Nuclear Regulatory Commission, RG 1.160, "Requirements for Monitoring the

Effectiveness of Maintenance at Nuclear Power Plants," Rev. 1, January 1995.

12. U.S. Nuclear Regulatory Commission, Temporary Instruction 2515/120, "Inspection of

Implementation of Station Blackout Rule," no date.

13. U.S. Nuclear Regulatory Commission, Inspection Procedure 62706, "Maintenance

Rule," December 31, 1997.

D-6
APPENDIX E

STATION BLACKOUT RULE

ACTIVITY AND MODIFICATION SUMMARY
Table E-1 Station blackout rule activity and modification summary

Modifications credited in the Expected Estimated Cost Outcomes

safety analysis Impact Plant Name Estimated Cost Impact To

Implement

Coping analysis, $35M $37.8M

procedures, and training (100 plants at $350K each) (108 plants at $350K each)

Excess capacity EDG

-From existing EDG Braidwood 1 & 2, Browns Ferry 1, 2&3, 0

Byron 1 &2

-From existing EDG but Beaver Valley 1 &2, Brunswick 1 &2, Limerick $1.OM

added or upgraded cross-tie 1 &2, Millstone 1 &2, St. Lucie 1 &2 (5 modifications at $200K each)

-Added one EDG Calvert Cliffs 1 &2 (not excess capacity), $20M

Diablo Canyon 1 &2 (2 modifications at $1 OM each)

-Added two EDG Prairie Island 1 &2, Turkey Point 3&4 $40M

(2 modifications at $20M each)

Existing excess redundancy Farley 1 &2, Hatch 1 &2, South Texas 1 &2, 0

EDG Zion 1&2

Existing HPCS EDG Clinton, Perry 0

Non-Class 1 E DG ANO 1 &2, Calvert Cliffs 1 &2, Davis-Besse, $54M

Added 1 DG North Anna 1 &2, Millstone 3, Surry 1 &2 (6 modifications at $9M each)

Added 2 DGs Dresden 2 & 3, Quad Cities 1 &2 $30M

(2 modifications at $15M each)

Modified existing DG Kewaunee, Pilgrim, Three Mile Island 1 $600K

.___________________________________ (3 modifications at $200K each)

E-1
Table E-1 Station blackout rule activity and modification summary (Cont.)

Modifications credited in the Expected Estimated Cost Outcomes

safety analysis Impact Plant Name Estimated Cost Impact To

Implement

Non-Class 1 E combustion

turbine

Existing cross-tie Fermi 2 0

Added cross-tie Oyster Creek $500K

Non-Class 1 E gas turbine

Modified existing Indian Point 2 $400K

Improve reliability Point Beach 1&2 $500K

Added two Palo Verde 1, 2&3 $30M

Use hydro generator

Existing Vermont Yankee 0

Added cross-tie Peach Bottom 2&3 $500K

Appendix R DG Catawba 1 &2, Indian Point 3 Maine Yankee, 0

McGuire 1&2, Oconee 1, 2&3; Robinson 2

Battery load shedding Big Rock Point, Browns Ferry 1, 2&3, $2.8M

required Crystal River, DC Cook 1&2, Duane Arnold, (28 procedure modifications at

FitzPatrick, Fort Calhoun, Grand Gulf,, $1 00K each)

LaSalle 1 &2, Nine Mile Point 1 &2,

Monticello, Palisades, Salem 1&2, San

Onfre 2&3, Seabrook 1, Sequoyah 1 &2,

Summer, Susquehanna 1&2, Washington

Nuclear Power 2, Waterford 3

Improve EDG reliability $2.5M

(10 modifications)

E-2
Table E-1 Station blackout rule activity and modification summary (Cont.)

Modifications credited in the Expected Estimated Cost Outcomes

safety analysis Impact Plant Name Estimated Cost Impact To

Implement

Requalify an EDG $5.6M

(2 modifications)

Minor mods to cope $11.9M Brunswick 1&2, Clinton, Duane Amold, $12M

(17 minor modifications) FitzPatrick, Haddam Neck, Harris, Farley

1&2, Hope Creek, Monticello, Oyster Creek,

Palisades, Palo Verde 1, 2&3; Perry,

Pilgrim, River Bend, Robinson 2,

Salem 1 &2, South Texas, Vogtle 1 &2

DC system modifications to $5M $5M

cope (10 modifications at $500K (10 modifications at $500K

each) each)

Added batteries LaSalle 1&2, Nine Mile Point 1

Added non-Class IE Crystal River

battery

Add/replace battery Hatch 1&2, Summer

chargers

Added cross-tie San Onfre 2&3

Replace inverters WNP-2

TOTAL $60M $235M

E-3
APPENDIX F

OPERATING EVENTS
Operating Events

Table F-1 Losses of offsite power since 1990 having recovery times greater than 4 hours

Plant

Reference Document

Event Date

Summary of LOOP Event

and Reactor Status

Description of the Event

4

Davis-Besse

LER 346/98-006

June 24,1998

Tomado and near SBO

event

ASP Report for

LER 346/98-006

February 1999

A tornado damaged the Davis-Besse switchyard and caused a LOOP for approximately 28 hours (1690 minutes).

The EDGs were both manually started upon report of a tomado; however, one EDG failed to start from the control

room and was successfully started locally. During the event, one EDG was technically inoperable because the

tornado damaged a roof mounted room cooling and resulted in slightly elevated room temperatures. The tornado

caused significant damage to the Ottawa County electrical distribution system, making 40 percent of the sirens

Inoperable. There were several equipment malfunctions that were either successfully addressed by operations or

negligible.

Post-event analysis as part of the ASP Program Identified that when the SBO-DG is in standby, a nonessential

bus supplies power to the SBO-DG. If the nonessential bus Is not powered, then the batteries will deplete in

approximately 20 hours. Had the EDGs failed to start or run for the first 8 hours of the 28-hour event, the SBO-DG

may have been unavailable and this could have led to core damage.

Prairie Island 1 & 2

LER 282/96-012

June 29, 1996

Weather-related LOOP

while at power

High winds caused a unit trip and LOOP on both units, lasting 296 minutes.

Catawba 2 Failed insulators In the isolated phase bus duct caused a LOOP for 330 minutes. One of two EDGs was

LER 414/96-001 Inoperable due to battery charger repairs. The effort to restore power was delayed due to procedural inadequacy.

February 6, 1996

Plant centered LOOP

while at power. Near SBO

event

F-1
Operating Events

Table F-1 Losses of offslte power since 1990 having recovery times greater than 4 hours (Cont.)

Plant

Reference Document

Event Date

Summary of LOOP Event

and Reactor Status

Description of the Event

Salem 2 A technician's error during testing resulted in a LOOP lasting 385 minutes. No detail was provided about the

LER 311/94-007 recovery; however, it appears that extensive trouble shooting to permit adequate assessment delayed power

April 11, 1994 restoration.

Plant-centered LOOP

while at power

Turkey Point 3 &4 A hurricane, with winds up to 145 mph, passed directly over the site causing a LOOP lasting approximately

LER 250/92-009 6.5 days. The 5 on-site black-start DGs were unavailablebecause of moisture that caused loss of switchgear

August 24, 1992 between the black-start DGs and the plant safety buses.

Weather-related LOOP

while at power, near SBO

event.

Supplemental Report The plant modifications completed for SBO rule were heavily relied upon to recover from the event. As a result of

March 1993 the SBO rule, the licensee added two safety EDGs and completed extensive modifications to the Unit 3 and 4

electrical distribution system. A supplemental report, "Effect of Hurricane Andrew on the Turkey Point Nuclear

Generating Station from August 20-30, 1992," shows that during the event one of the two original 2850 kW EDGs

failed to run for approximately 2.5 hours and the remaining 3 EDGs carried a load of approximately 3400 kW.

Had the SBO rule modifications not been completed, the 3400 kW load would have been in excess of the 2850

kW rating of the remaining EDG.

H.B. Robinson A LOOP lasting 454 minutes was caused by the failure of a transformer that caused a loss of voltage to one bus

LER 261/92-017 and the failure of another transformer to transfer its load that caused a loss of voltage to the remaining bus. The

August 22,1992 transformer test and repairs account for the duration of the LOOP.

Plant-centered LOOP

while at power

F-2
Operating Events

Table F-I Losses of offslte power since 1990 having recovery times greater than 4 hours (Cont.)

Plant

Reference Document

Event Date

Summary of LOOP Event

and Reactor Status

Description of the Event

Vermont Yankee

LER 271/91-009

April 23, 1991

Plant-centered LOOP

while at power

A fault in the switchyard caused a LOOP for 277 minutes. Power restoration was delayed as a result of the length

of time required for New England Power Service relay technicians to travel to Vermont Yankee from Providence,

Rhode Island, and communication problems between Vermont Yankee and the New England Switching Authority

concerning priorities over circuit breaker testing.

Zion 2

LER 304/91-002

March 21, 1991

Plant-centered LOOP

while at power. Near SBO

event.

During a surveillance test of the firewater system with the unit at power, the deluge valves were inadvertently

opened and sprayed water on the main and auxiliary station transformers. This resulted in a generator trip and a

LOOP. An EDG was out of service for maintenance. Offsite power was restored In 60 minutes.

Nine Mile Point 1

LER 220/90-023

November 12, 1990

Plant-centered LOOP

while at power

The 115 kV cable drop to the reserve transformer that supplies power to the emergency buses broke because of

metal fatigue. A phase imbalance resulted in loss of both reserve transformers, a LOOP lasting 595 minutes.

Power was restored through one reserve transformer following inspections to assure there was no damage.

'a.

F-3
Operating Events

Table F-2 Station blackout challenges

Plant Description of the Event

Reference Document

Event Date

Summary of Event

St. Lucie 1 & 2 While investigating an anomaly with a Unit 2 sumulator SBO recovery exercise, the licensee discovered that one of

LER 335/98-007 the methods to restore electrical power could not be performed as the procedure was written and led to an

June 30, 1998 unanticipated action that could complicate recovery from SBO condition. The cause of the conditions was

SBO challenge inadequate SBO recovery procedures that were not verified as part of the modification that installed the SBO

cross-tie between the units.

Davis-Besse See Table D-1 for a description

LER 346/98-006

June 24, 1998

Tornado and near SBO

event

Indian Point 2 On 5/22/98, during testing of the Aac system, the licensee determined that the gas turbine No. 3 output circuit

LER 247/98-007 breaker was incapable of being closed onto a de-energized bus. On 6/16/98, a similar test determined that the

May 22,1998 Gas Turbine No. 2 was also incapable of being closed onto a de-energized bus. The cause was an insufficiently

SBO MC unavailability comprehensive test for detecting anomalies in the gas turbine control system; previous testing only provided for

synchronizing the gas turbine output circuit breaker to an energized bus. The failure of the circuit breakers to

close to a de-energized bus was associated with the Woodward governor control system. In one case, the control

logic was configured for a dead bus closure, and in the other case, the software configuration would not permit

dead bus closure.

F-4
Operating Events

Table F-2 Station Blackout Challenges (Cont.)

Plant Description of the Event

Reference Document

Event Date

Summary of Event

Millstone 3 & Pilgrim IN 97-21, 'Availability of Alternate AC Power Source Designed For Station Blackout Event," was issued to alert

IN 97-21 addresses to the potential unavailability of an Aac power source during an SBO event at Millstone and Pilgrim as

April 18, 1997 described below. IN 97-21 required the recipients to review the Information for applicability to their facilities and

SBO Aac unavailability consider actions, as appropriate, to avoid similar problems. However, no specific action or response Is required.

During Inspection activity in 1996, the NRC discovered a potential design deficiency affecting Millstone 3 Aac

power source. The Aac power source includes batteries for (1) a computer that controls and monitors the Aac and

(2) Aac dc field flash, oil pump, and breaker control power. The battery chargers for these batteries are fed from

offsite power when the MC power supply Is not operating. If Aac power Is needed more than 1 hour after the

LOOP, the batteries will be so depleted that the Aac cannot be started, and therefore will not be available If EDGs

are lost.

On March 7, 1997, the Pilgrim operators attempted to start the SBO-DG 6 hours into a partial LOOP. The SBO DG

failed to start because the DG support systems were powered by a nonsafety-related power supply that had been

without auxiliary power for an extended period during the LOOP.

F-5
APPENDIX G

RESOLUTION OF EXTERNAL COMMENTS
An April 14, 2000, memorandum, "Draft Report, 'Regulatory Effectiveness of the Station

Blackout Rule,' was sent to David Modeen, Director of Engineering, Nuclear Energy Institute

from Charles E. Rossi, Director, Division of Systems Analysis and Regulatory Effectiveness,

Office of Nuclear Regulatory Research [Ref. 1]. Identical letters were sent to other members of

the industry and made publically available. The purpose of the April 14, 2000, memorandum

was to obtain "peer review" comments before finalizing the report regarding (1) the

reasonableness of the approach, (2) the appropriateness of the conclusions, (3) and other

regulations, accompanying regulatory guides, and inspection documents that should be

assessed to make U.S. Nuclear Regulatory Commission activities (NRC) more effective,

efficient and realistic. Letters with comments were received from the Union of Concerned

Scientists (UCS), the Nuclear Energy Institute (NEI), the Institute of Nuclear Power Operations

(INPO), the Advisory Committee on Reactor Safeguards (ACRS), and the Electric Power

Research Institute (EPRI).

Each organization providing comments is listed below, in order of the date received, followed by

a restatement of their comments verbatim and the resolution of each comment. None of the

peers reviewers provided comments to suggest other regulatory documents that should be

assessed. Further, some comments were outside the scope of the report but were addressed

for completeness. Italics were used to distinguish report revisions from the original text.

Conforming changes were made throughout the report but are not listed below.

G-1
UNION OF CONCERNED SCIENTISTS (UCS) provided the following comments in a letter to

the NRC dated April 20, 2000 [Ref. 2].

COMMENT 1: I fully agree with the general conclusion of this report that the station blackout

rule and all of the attendant activities undertaken by the NRC and the industry have resulted in

a significant, positive contribution to nuclear plant safety.

RESOLUTION: No response required

COMMENT 2: Having deep skepticism for probabilistic risk assessment as practiced by the

NRC and the industry, I disagree with the stated numerical core damage frequency reductions

resulting the SBO rule. For example, the ease with which PRA inputs and assumptions can be

altered makes numerical comparisons like those reported in Table 3 on page 7 of the draft

report absolutely meaningless. I agree that the SBO rule had the net effect of reducing core

damage frequency.

RESOLUTION: Section 3.2.1 of the report was revised to clarify that the PRAs were

altered by the licensees with a sound basis as follows: "Table 3, 'Probabilistic Risk

Assessment/Individual Plant Examination Sensitivity Analyses,'" was prepared from

information in plant-specific PRANIPE sensitivity analyses to show the effect of typical

SBO rule modifications on the overall risk. Licensees modified PRA/IPEs based on

plant specific hardware and procedural modifications related to SBO rule

implementation. The modified PRA/1PEs consistently showed a reduction in the plant

CDF, thus providing strong evidence for the risk reduction gained from promulgation of

the SBO rule .........

COMMENT 3: I cannot understand the information presented in Table 8. Some additional text

explaining what the numbers in the rows and columns represents would be exceedingly helpful.

RESOLUTION: The comment is correct. Table 8 and its supporting paragraph were

deleted from the report as they were deemed to be (a) too complex as a result of the

use of uncommon terms and (b) unnecessary as the problem has been addressed. The

information in Table 8 and the supporting paragraph called attention to severe weather

related LOOPS having long recovery times. The same section of the report uses events

to better illustrate that severe weather related LOOPs have had long recovery times;

however, the industry has provided guidance for actions to be taken before the onset of

severe weather.

COMMENT 4: The first bulleted paragraph on page x states that all plants have established

SBO coping and recovery procedures that ensure a 4- or 8-hour coping duration. My

experience in the industry before joining UCS strongly suggests that this conclusion is incorrect.

In 1996, I worked as a consultant at the Haddam Neck nuclear plant on that licensee's

response to an NRC 50.54(f) letter relating to design and licensing bases configuration control.

My specific assignment was to evaluate the design and licensing bases for station blackout.

The licensee's decision in late 1996 not to restart the plant terminated my assignment before

the final report was issued. However, in my work before that time, I determined that the plant's

procedures and training complied with the NRC's regulatory guidance on SBO, but they did not

comply with the rule itself. For example, all of the procedures used by the operations

G-2
department at Haddam Neck In responding to a station blackout event assumed that the event

began with the reactor at 100 percent power. If the plant was not at power, many of the

procedural steps either could not be performed or would have made conditions worse. The

exclusive focus of the procedures and training was on a SBO event from full power. If the SBO

event occurred when the reactor was shut down for refueling with the entire reactor core

offloaded into the spent fuel pool or shut down in mid-loop operation, the procedures and

training were completely silent on what to do. Haddam Neck was not the only plant with this

programmatic deficiency. The SBO rule does not limit the licensees' responsibilities to events at

full power. The SBO rule requires licensees to be able to cope with an event lasting 4 or

8 hours. Until such time that the NRC staff verifies that all plants can indeed cope with a SBO

event occurring at any time, not just when the reactor is at full power, the cited conclusion in the

draft report is invalid.

I realize that Comment (4) may be outside the scope of your report. The report seems focused

on what the SBO rule, not what it may not have done. In addition, the issues I raise in Comment

(4) may be viewed as allegations. I am sending a copy of this letter to Mr. Ed Baker of the NRC

staff for possible treatment as an allegation.

RESOLUTION: The UCS question will be addressed within the NRC's allegation

process as Allegation No. NRR-2000-A-0020.

G-3
NUCLEAR ENERGY INSTITUTE (NEI) provided the following comments in a letter to the NRC

dated June 14, 2000 [Ref. 3].

Comment 1: The approach used to assess the effectiveness of this rule appears to be

reasonable. We suggest that the assessment focus on regulatory requirements as opposed to

"expectations.' The requirements of 10 CFR 50.63, Loss of All Alternating Current Power,

should be the primary consideration.

RESOLUTION: Section 3.1 of the report was revised to address the comment as

follows:

"For the purposes of this assessment, the regulatory documents present the

expectations (desired outcomes) in terms of specific objectives, requirements, and

guidance. Hence, the requirements are an integral part of the set of 'expectations'

which are collectively used as the basis for conducting an effectiveness review.

The regulatory documents are considered effective if the expectations are being

achieved .... The expectations were established from objective measures stated in the

SBO rule, RG 1.155, 53 FR 23203, and NUREG- 1109 in the areas of coping capability,

risk reduction, EDG reliability, and value-impact. The use of multiple regulatory

documents provided an examination of the regulatory process."

Comment 2: The conclusion that this rule provides 'additional defense-in-depth to compensate

for potential degradation of the ac offsite power system that may result from deregulation of the

electric power industry" is not substantiated. Such statements are speculative at best and

should not be included in the report. We believe the rule supports the conclusion in the report

that the licensees have demonstrated a coping capability to deal with loss of offsite power

consistent with the requirements of the station blackout rule.

RESOLUTION: Section 3.2.5 under Offsite Power System Deregulation was revised to

be more robust as follows:

"As stated in 53 FR 23203, it was expected that the SBO rule would provide additional

defense in depth by requiring plants to cope with an SBO for a specified duration. The

increment of of defense-in-depth is provided by the preventative effect of reducing the

likelihood of core damage by implementing the SBO rule. In addition to increased

coping capability, the SBO rule has resulted in plants gaining increased tolerance to an

SBO from reduced risk as previously explained, which addresses the mitigative aspect

of defense-in-depth. These SBO rule outcomes provide additional defense-in-depth to

compensate for increased risks due to potential degradation of the ac offsite power

system that may result from deregulation of the electric power industry, as explained in

SECY-99-129, 'Effects Of Electric Power Industry Deregulation on Electric Grid

Reliability and Reactor Safety,' May 11, 1999, a publicly available NRC technical report,

'The Effects of Deregulation of the Electric Power Industry on the Nuclear Plant Offsite

Power System: An Evaluation,'dated June 30, 1999; a recent Information Notice

2000-06, 'Offsite Power Voltage Inadequacies,' March 27,2000, and Information Notice

98-07, 'Offsite Power Reliability Challenges From Industry Deregulation,' February 27,

1998."

G-4
Comment 3: The development of the trigger value concept for monitoring EDG target reliability

involved extensive interactions between industry, NRC staff and ACRS. The NRC Office of

Research contracted Dr. E. Lofgren, Science Applications International Corporation (SAIC), to

conduct an independent review. His review confirmed the appropriateness of this trigger value

concept as a mechanism for EDG target reliability. The trigger value concept was never

intended to represent a robust statistical basis for individual EDG reliability.

The Commission issued a Staff Requirements Memorandum on SECY-90-340 dated June 28,

1991, that provided acceptance of the trigger value concept within the framework of the

reliability levels assumed in the station blackout rule coping analysis.

RESOLUTION: That the trigger value concept was never intended to represent a

robust statistical basis for individual EDG reliability is consistent with deleting these from

the inspection procedures for the purposes of demonstrating achievement of the

licensee's commitments to 0.95 or 0.975.

Appendix D, Emergency Diesel Generator Trigger Values," of the report provides a

history of the trigger values and includes the SAIC reports (NUREG-5078 and

NUREG-561 1), SRM, and SECY-90-340 stated in the comment. The SAIC reports

provide statistical insights on multiple trigger values and trigger value combinations, and

do not appear to be independent reviews.

Appendix D also indicates several other statistical studies, that applied multiple

statistical methods, that were completed by several consultants. Some of these studies

support use of the trigger value concept and some of these studies challenge the

appropriateness of the trigger value concept. In addition, the main report and

Appendix D explain that in a letter to the ACRS dated October 29, 1993, the Executive

Director of Operations informed the ACRS that the staff agreed that conformance of

individual EDGs with trigger values cannot be taken, in any statistical fashion, to mean

that the EDG has demonstrated achievement of the licensee's commitments to 0.95 or

0.975. The letter stated that Note 3 was added to RG 1.160, June 1993 to emphasize

this fact. The main report also states that industry documents that use the EDG trigger

values have not been endorsed and that wording in earlier and now outdated NRC

regulatory guides may have caused confusion about use of the trigger values.

Also see ACRS comment 3 and ERPI comments 2 and 4.

COMMENT 4: We support the concept of ensuring the regulatory documents are coherent and

consistent with regulation. New issues that may arise during implementation should be

addressed within the appropriate guidance documents. However, proposed modifications to

regulatory documents should not impose new requirements beyond what is stated in the

regulations. If NRC concludes that new requirements or clarifications to existing requirements

are necessary, then rulemaking would be warranted.

RESOLUTION: Rulemaking would used be for new requirements or clarifications that

add new requirements, however the proposed clarifications are not intended to impose

any new regulatory requirements. The report conclusions were revised to state that,

G-5
"Although the SBO rule was effective for the reasons stated above, consistent with

adhering to Principles of Good Regulation that include clarity (coherent and practical

regulations) and reliability (regulations based on operating experience) there are

opportunities to revise the regulatory guidance and inspection documents. These

revisions are not intended to impose any new regulatory requirements, are consistent

with the SBO technical basis (NUREG-1032); ensure high levels of EDG reliability;

maintain present levels of safety by ensuring the risk benefits obtained from

implementing the SBO rule do not erode; provide practical guidance for reactor

shutdowns with limited offsite or onsite power sources; and use operating experience to

improve the predictability and consistency of NRC decisions in the area of EDG

reliability. The opportunities are as follows as stated in the report recommendations:

'(1) Regulatory Guides 1.155.... which address use of existing EDG reliability terms,

criteria, and measurements may need to be revised in a coherent manner to:...';

'Inspection documents....The NUMARC trigger values, which are not endorsed by the

regulatory guidance, do not provide high levels of confidence that the EDG target

reliability is being met, ...'

'(4) Follow-up at 2 plants....Accordingly, NRC inspection documents may need to be

modified to better factor in the conditions and experiences gained from actual system

demands to facilitate inspection of EDG reliability compliance."

In addition, the report was planned to be consistent with the strategies for implementing

NRC strategic performance goals in the areas of (1) maintaining safety; (2) reducing the

unnecessary regulatory burden; (3) making NRC activities effective, efficient, and

realistic; and (4) increasing public confidence. The report was revised where appropriate

demonstrate its consistency with the strategic performance goals.

G-6
ADVISORY COMMITTEE ON REACTOR SAFETY GUARDS (ACRS) provided comments in a

letter dated June 22, 2000 [Ref. 4], following a June 7, 2000, presentation by RES to the ACRS

in a public forum. At this meeting, RES committed (1) to revise Table 6 outcomes for the public

does reduction and the value impact ratio and (2) revise the conclusions of the report to add a

lesson learned that 'in addition, new regulations or the accompanying regulatory documents

should include quantitative regulatory objectives to facilitate evaluation of its regulatory

effectiveness."

The ACRS letter comments and their resolution are as follows:

COMMENT 1: The initiative undertaken by the staff to evaluate selected regulations to

determine whether they have been effective in achieving their objectives is valuable and should

be continued.

RESOLUTION: RES plans to issue its review of the anticipated transient without scram

(ATWS) rule for internal and external peer review in FY 2000; and in FY 2001 finalize

reports on ATWS, Appendix J, and one other topic to be named upon completion of

discussions with other offices. Two reviews are presently planned through FY 2002.

COMMENT 2: Regulatory documents related to the Station Blackout (SBO) rule should be

reviewed to eliminate identified inconsistencies in the definition of reliability. Due to these

inconsistencies, the intended reliability targets for emergency diesel generators (EDGs) are not

being met in some cases.

RESOLUTION: We agree with this comment. RES plans to: (a) clarify that EDG

unavailability during maintenance or test with the reactor at power should be included in

the reliability calculation, (b) clarify that licensees should balance increased EDG

reliability against the increased EDG unavailability to maintain the RG 1.155 minimum

individual EDG target reliabilities, (c) clarify that the EDG system boundary used in the

reliability calculation should include the load sequencer and the bus between the EDG

and the loads, and (d) establish common EDG start and load-run criteria for the

guidance.

It should be noted that the SBO report focused on the SBO rule and related SBO

regulatory documents and did not address plant-specific issues. A sampling of plants

that have not met EDG reliability targets have been identified in NUREGlCR-5500,

Volume 5, INEL-95/0035, "Emergency Diesel Generator Power System Reliability,"

February 1996. This report is being updated by RES to include more plants and current

operating experience. Upon completion of the above activities, RES will determine the

course of action to be taken to address the findings of the updated NUREGICR-5500.

G-7
COMMENT 3: Acceptance of the use of trigger values in inspection documents should be

discontinued.

RESOLUTION: Comment 3 is consistent with the conclusions of the report. The Office

of Nuclear Reactor Regulation will revise the relevant inspection procedure guidance to

discontinue acceptance of licensee use of EDG trigger values.

COMMENT 4: The evaluation of the regulatory effectiveness of the SBO rule provides

significant lessons that should be beneficial in preparing a template for the evaluation of other

regulations and in the development of future regulations.

RESOLUTION: The ACRS suggested preparation of a template for future regulatory

effectiveness evaluations using the lessons learned from the SBO rule evaluation. This

suggestion has been implemented as the methods and lessons learned from the SBO

evaluation are being used as a template for other regulatory effectiveness evaluations.

The ACRS also observed that the report shows the importance of establishing a riskreduction expectation before development of a new regulation. We agree that

development of the risk-reduction expectation early in the development of the rule is a

good approach and is consistent with our activities in risk-informing Part 50. As you are

aware, the current regulatory process still ensures that a substantial improvement in

safety is demonstrated as outlined in NUREG/BR-0058, "Regulatory Analysis Guidelines

of the U.S. Nuclear Regulatory Commission," Rev. 2, dated November 1995.

G-8
INSTITUTE OF NUCLEAR POWER OPERATIONS (INPO) provided comments in a letter to

the NRC dated July 14, 2000 [Ref. 5].

GENERAL COMMENT: The approach and conclusion of the report appear reasonable.

RESOLUTION: No response required

COMMENT 1: We recommend that the specific core damage frequency (CDF) numbers

contained in the report be removed because they are characterized as approximations. It would

be sufficient to say reductions in CDF are supported by CDF calculations.

RESOLUTION: Section 3.1 of the report was revised as follows: "When using the

above PRA/IPEs it should be recognized that their data are estimates and do not always

reflect the current design or operating performance of safety systems."

COMMENT 2: The conclusion that the value impact was within the expected range of

reductions in public dose-per-dollar of cost is not well supported. The justifying statement,

uHowever, it appears licensees justified the cost of the power supplies by counting on offsetting

monetary benefits from increased EDG allowed outage times," is not supported by any

monetary costtvalue data.

RESOLUTION: Section 3.2.4 of the report states the cost as follows: "The cost of an

additional EDG at Davis Besse was $9.07M. This value was taken as a representative

amount for the addition of power supplies and used in the cost estimates shown below."

Section 3.2.4 also states the value as follows: "in submitting this change to the NRC,

Davis Besse noted that its SBO diesel generator installation would save $5.25M over the

remaining life of the plant, including $3.15M for increased flexibility in performing

maintenance on its safety EDGs and $2.1M in replacement power costs."

COMMENT 3: The opportunities identified to improve regulatory documents do not support the

main conclusion of the report. For example, the report concludes that emergency diesel

generator (EDG) reliability has improved. However, the report also suggests that NRC test and

inspection documents have not focused sufficiently on dominant contributors to EDG

unreliability during actual demands. Justification should be provided on why the identified

opportunities do not affect the main conclusions of the report.

RESOLUTION: See response to NEI comment 4.

G-9
ELECTRIC POWER RESEARCH INSTITUTE (EPRI) provided comments in a letter to the NRC

dated July 24, 2000 [Ref. 6].

Comment 1: Regarding the NRC draft report, we agree that the SBO rule, along with other

industry programs (e.g. INPO's trip reduction program, installation of risk meters) has

contributed to improving safety at nuclear units, including greater tolerance of loss of

offsite/onsite ac power. We also agree that the SBO reduction objectives have been exceeded,

and as a consequence that major new programs are not needed. We do not feel, however that

some of the revisions to the associated regulatory guides, as proposed in the report, would

necessarily improve the safety of nuclear plants. At the current time, revisions probably could

not be shown to be cost/beneficial, and the current direction of the NRC and industry toward

Risk Informed Regulation, it may be better to maintain the current technical approach as is for

the time being. The implementation of Configuration Risk Management Programs at many

plants, which can help deal with degraded ac offsitelonsite power situations, further

underscores this conclusion.

RESOLUTION: See the response to NEI comment 4.

Comment 2: One particular reservation we have in reviewing the draft report concerns

changing the failure rate triggers used in the SBO Rule. At the time of their adoption, extensive

technical analyses, including Monte Carlo studies, were performed to justify their basis. These

analyses recognized that, when dealing with small statistical samples involving highly reliable

machines, high levels of confidence are impossible to achieve, without creating large numbers

of 'false negatives." These would inadvertently involve utilities in costly an unnecessary

remediation programs. When the current failure rate triggers were established, the technical

people (including EPRI, the NRC staff, and contractors involved) took into account the difficult

problem of balancing the need for high confidence with the very large number of events needed

to obtain this confidence. The report proposes to delete the NUMARC triggers but does not

present an alternative. We encourage NRC to review this section of the report and re-examine

its technical basis in light of the amount of information necessary to make important regulatory

decisions when data will be sparse. Further details are provided in Attachment A.

RESOLUTION: See NEI comment 3 and ACRS Comment 3. Attachment A was

treated as a EPRI comment 4, below.

Review of the operating experience, the inspection reports, and INEL-95/0035 revealed

only two indications of repetitive EDG failures within a site over a 12 year period of time.

The real situation appears to be that licensee complete root cause investigations and

take actions to prevent recurrence of problems (per 10 CFR Part 50, Appendix B, XVI,

"Corrective Action"); deferring these activities based on statistically-variation-induced

false alarms, consideration of a false alarm rate (percentage of the time the true EDG

reliability is observed) does not appear to be a realistic concern because of the strength

of the root cause/corrective action process. In addition, this is not consistent with

maintaining high levels of EDG reliability, or common industry practice to take timely

corrective action as well as action to prevent recurrence of a problem.

G-10
Comment 3: In conclusion, let me once again emphasize our point of agreement: the SBO

rule has been effective in helping improve safety, and that major changes are not appropriate at

this point in time.

RESOLUTION: See response to NEI comment 4.

Comment 4: This was presented as Attachment A, "EPRI Comments on Target Reliability and

Trigger Values," as restated verbatim below.

Between 1988 and 1991, EPRI carried out the analytical work underlying the failure trigger rate

methodology. NUMARC, NUGSBO and NRC subsequently adopted this methodology. Both

industry and NRC would like a way of knowing that an EDG whose target reliability is 95% has

a 95% confidence of being above the target value. Manifestly, if one had a sample of 1000

demands to evaluate, such assurance could be approached.

However the real situation is that EDG demands are accrued relatively slowly - as little as one

per month. It may take almost two years to experience 20 demands, 4 years for 50 demands,

and 8 years for 100 demands. Unfortunately, one cannot wait for 100 demands to determine

whether an EDG's reliability is acceptable. Thus it was decided to also assess EDG

acceptability based on much smaller samples, namely 50 and 20 demands.

When the sample size is small, and when one is dealing with target reliabilities at the very high

end of the reliability range, it is statistically impossible (even with no observed failures) to

provide high confidence that the actual reliability equals or exceeds the target reliability. For

example, using binomial distribution for a 20-demand sample illustrates the dilemma. Even if

zero failures were permitted, one would know with 95% confidence that the underlying reliability

is only greater than 83%. If one failure were permitted, one would only know with

95% confidence that the underlying reliability is greater that 75%. One would need close to

75 demands with zero failures in order to be able to be 95% confident that 95% reliability had

been achieved.

Unfortunately, the above-described statistical limitations are not the most troublesome problem

that derives from the need to use small samples to estimate reliability. The creation of

statistical-variation-induced false alarms that accompanies high confidence that target

reliabilities are met is real world and expensive. Each false alarm requires that an EDG enter a

corrective action remedial program. For example, if in order to achieve high confidence that

target reliability is met, zero (or even one) failure in 20 demands is allowed, an EDG may end

up in a perpetual reliability program - as a result of perpetual false alarms. Large sample

sizes would be of reduced importance because the EDGs would be "false-alarmed-out. There

would be no value to these EDG remedial programs.

RESOLUTION: Appendix D, 'Emergency Diesel Generator Trigger Values," of the

report was revised to use the information provided Attachment A of this comment as

follows:

....In practice, many licensees monitor EDG reliability in the short term (20 demands)

and long term (50, 100 demands) as well as a unit average EDG reliability based on the

same number of demands.......

G-11
..... The individual EDG target reliabilities of 0.95 or 0.975 are statistically reasonable and

practical so long as there is sufficient data to determine EDG reliability with confidence

(typically 50 to 95 percent). However individual EDG demands accrue relatively slowly,

typically approximately 20-25 per fuel cycle, limiting the amount of data that can be

collected in one fuel cycle. Obviously but one failure of an EDG with a 0.975 target

reliability with less than 40 demands results in an unfavorable statistic for a typical fuel

cycle. When failures occur with small amounts of data, statistical methods are generally

used to help interpret the data. The NRC has completed the following statistical that

resulted in a trigger value concept to help interpret EDG failure data and make decisions

as summarized below.....

.The NRC, the industry, and their consultants have applied the above statistical

methods to facilitate the interpretation of the EDG reliability data. Some of these

methods resulted in trigger values based on statistically-variation-induced false alarms

to account for the chance that the failure may be the result of a non-valid demand or to

account for otherpossibilities for not observing the true reliability. The concern is that

one would not want to enter a costly corrective action program based on a false statistic.

In practice, the acceptability of an EDG's reliability is based on analysis. Following a

failure licensees complete root cause investigations and take corrective actions and

actions to prevent recurrence of a problem consistent with 10 CFR 50, Appendix B, XVI,

"Corrective Action. 3 Consequently licensees would enter a corrective action upon

determination of a real problem. In addition, should this investigation find that there was

no valid demand or failure, it would not be reflected in the statistics. It appears

statistically-variation-induced false alarms or concerns about entering a costly corrective

program unnecessarily are not practical considerations.

G-12
REFERENCES

1. Memorandum from Charles E. Rossi, Director, Division of Systems Analysis and

Regulatory Effectiveness, Office of Nuclear Regulatory Research, U.S. Nuclear

Regulatory Commission, to David Modeen, Director of Engineering, Nuclear Energy

Institute, "Draft Report, Regulatory Effectiveness of the Station Blackout Rule," April 14,

2000.

2. Memorandum from David A. Lochbaum, Union of Concerned Scientists to

Charles E. Rossi, Director, Division of Systems Analysis and Regulatory Effectiveness,

U.S. Nuclear Regulatory Commission, "Comments on Draft Report on Station Blackout

Rule," April 20, 2000.

3. Memorandum from Alex Marion, Nuclear Energy Institute to Charles E. Rossi, Director,

Division of Systems Analysis and Regulatory Effectiveness, U.S. Nuclear Regulatory

Commission, "Draft Report, 'Regulatory Effectiveness of the Station Blackout Rule,'"

June 14, 2000.

4. U.S. Nuclear Regulatory Commission memorandum from Dana Powers, Chiarman,

Advisory Committee on Reactor Safeguards, to Dr. William D. Travers, Executive

Director for Operatons, 'Draft Report, 'Regulatory Effectiveness of the Station Blackout

Rule,'"June 22, 2000.

5. Memorandum from Mark A Peifer, Institute of Nuclear Power Operations to

Dr. Farouk Eltawila, Acting Division Director, Division of Systems Analysis and

Regulatory Effectiveness, U.S. Nuclear Regulatory Commission, "Draft Report,

'Regulatory Effectiveness of the Station Blackout Rule,' "July 14, 2000.

6. Memorandum from J.J. Haugh, Electric Power Research Institute, to Charles E. Rossi,

Director, Division of Systems Analysis and Regulatory Effectiveness, U.S. Nuclear

Regulatory Commission, "NRC's DRAFT Station Blackout Report," July 24, 2000.

G-13
NRC FORM 335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER

(2249) (AAsigned by NRC, Add Vol.. Supp, Rev.,

3201 3202 BIBLIOGRAPHIC DATA SHEET

(See Ihsrnctln on me reverse)

2. TITLE AND SUBTITLE NUREG-1776

Regulatory Effectiveness of the Station Blackout Rule

3. DATE REPORT PUBLISHED

_ONTH YEAR

08 2003

4. FIN OR GRANT NUMBER

5. AUTHOR(S) 6. TYPE OF REPORT

William S. Raughley

7. PERIOD COVERED (inclusive Dates)

05/01/1988 - - 12/31/1998

8. PERFORMING ORGANIZATION -NAME AND ADDRESS (fNRC poi Division OfreorRepion U.S NudearRegulatoy Commissin, andmnaiingaddress;lIcornrador provie nafme and mafn address)

Division of Systems Analysis and Regulatory Effectiveness

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

S. SPONSORING ORGANIZATION -NAME AND ADDRESS pfNRC. "Somre asabove', ;onractonprvieNRCI)son, OfieorRegios U.s. NucsrReguaorycmkson,

Saman abores.)

Same as above.

10. SUPPLEMENTARY NOTES

W.S. Raughley, NRC Project Manager

11. ABSTRACT 20 wcrde cfss)

The Nuclear Regulatory Commission's Office of Nuclear Regulatory Research is revewing selected regulations, starting with the

station blackout (SBO) rule, to determine if the requirements are achieving the desired outcomes. This initiative is part of an

evolving program to make NRC activities and decisions more effective, efficient, and realistic. This report evaluates the

effectiveness of the SBO rule by comparing regulatory expectations to outcomes. A set of baseline expectations was

established from the SBO rule and related regulatory documents in the areas of coping capability, risk reduction, emergency

diesel generator reliability, and value-impact. The report concludes that although there are opportunities to improve the clarity

of SBO related regulatory documents, the SBO rule is effective and the industry and the NRC costs to implement the SBO rule

were reasonable considering the outcome.

12. KEY WORDS/DESCRIPTORS (Ust wards orphrases hat wifl assistr resa-ers in oatng themott) 13. AVAILABILITY STATEMENT

station blackout unlimited

regulatory effectiveness 14. SECURITY CLASSIFICATION

emergency diesel generator (hsh Pae)

operating experience unclassified

(This Reporf)

unclassified

15. NUMBER OF PAGES

16. PRICE

NRC FORM 335 (2-49) This form was electranically produced by Elite Fedeml Farris, Irr-
JPrinte

on recycled

pape r

Federal Recycling Program
NUREG-1776 REGULATORY EFFECTIVENESS OF THE STATION BLACKOUT RULE AUGUST 2003

UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, DC 20555-0001

OFFICIAL BUSINESS