03-15123. Union of Concerned Scientists and Mothers for Peace; Receipt of Petition for Rulemaking

AGENCY:

Nuclear Regulatory Commission.

ACTION:

Petition for rulemaking; notice of receipt.

SUMMARY:

The Nuclear Regulatory Commission has received and requests comments on a petition for rulemaking filed by the Union of Concerned Scientists and the San Luis Obispo Mothers for Peace (MFP). The petition was docketed on May 2, 2003, and has been assigned Docket No. PRM-50-80. The petitioners request that the NRC amend its regulations to require nuclear power plant owners to formally evaluate whether proposed changes, tests, and experiments cause protection against radiological sabotage to be decreased, and to require licensees to formally evaluate specified intentional or accidental aerial hazards and make necessary changes to ensure that the plant can reach and maintain safe shutdown.

DATES:

Submit comments by September 2, 2003. Comments received after this date will be considered if it is practical to do so, but the Commission is able to assure consideration only for comments received on or before this date.

ADDRESSES:

You may submit comments by any one of the following methods. Please include “PRM-50-80” in the subject line of your comments. Comments submitted in writing or in electronic form will be made available to the public in their entirety on the NRC rulemaking web site. Personal information will not be removed from your comments.

Mail comments to: Secretary, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, ATTN: Rulemakings and Adjudications Staff.

E-mail comments to: [e-mail]. If you do not receive a reply e-mail confirming that we have received your comments, contact us directly at [phone]. You may also submit comments via the NRC's rulemaking web site at http://ruleforum.llnl.gov. Address questions about our rulemaking web site to Carol Gallagher [phone]; email [e-mail].

Hand deliver comments to: 11555 Rockville Pike, Rockville, Maryland 20852, between 7:30 a.m. and 4:15 p.m. Federal workdays. (Telephone [phone]).

Fax comments to: Secretary, U.S. Nuclear Regulatory Commission at [phone].

Publicly available documents related to this petition may be examined and copied for a fee at the NRC's Public Document Room (PDR), Public File Area O1 F21, One White Flint North, 11555 Rockville Pike, Rockville, Maryland. Selected documents, including comments, can be viewed and downloaded electronically via the NRC rulemaking web site at http://ruleforum.llnl.gov.

Publicly available documents created or received at the NRC after November 1, 1999, are available electronically at the NRC's Electronic Reading Room at http://www.nrc.gov/​NRC/​ADAMS/​index.html. From this site, the public can gain entry into the NRC's Agencywide Document Access and Management System (ADAMS), which provides text and image files of NRC's public documents. If you do not have access to ADAMS or if there are problems in accessing the documents located in ADAMS, contact the NRC's PDR Reference staff at 1-800-397-4209, 301-415-4737 or by email to [e-mail].

FOR FURTHER INFORMATION CONTACT:

Michael T. Lesar, Office of Administration, U.S. Nuclear Regulatory Commission, Washington, DC 20555. Telephone: [phone] or Toll-Free: 1-800-368-5642 or E-mail: [e-mail].

SUPPLEMENTARY INFORMATION:

The Petitioners

The Union of Concerned Scientists (UCS) describes itself as a nonprofit partnership of scientists and citizens who combine rigorous scientific analysis, innovative policy development, and effective citizen advocacy to achieve practical environmental solutions. Before September 11, 2001, UCS states that it was an active participant in a series of public meetings conducted by the NRC with its external stakeholders regarding security regulations and implementing procedures for nuclear power plant reactors and their spent fuel. UCS states that although NRC closed its doors to them and other non-industry, public stakeholders regarding security matters after September 11, 2001, it continues to articulate potential problems and recommend solutions in other public arenas.

San Luis Obispo Mothers for Peace (MFP) states that it advocates safety and protection of the environment against the dangers of the Diablo Canyon Nuclear Power Plant (DCNPP). MFP states that it has been the foremost DCNPP watchdog group, and is a nationally respected voice on nuclear safety issues. MFP requests that the Commission suspend the licensing proceedings for an Independent Spent Fuel Storage Installation at the DCNPP while it is considering this petition. MFP believes suspension is necessary because consideration of the petition has the potential to bring about a significant redefinition of the fundamental design requirements that are considered adequate to protect independent spent fuel facilities against radiological sabotage.

Background

Discussion of the Petition

The petitioners state that 10 CFR 50.59, changes, tests, and experiments, first promulgated in 1962 and last amended in 2001, contains requirements for the process through which plant owners can modify their facilities and procedures without prior NRC approval. The petitioners characterize the objective of 10 CFR 50.59 as ensuring that plant owners evaluate proposed changes to facilities and procedures for their effects on the licensing basis of the plant and obtain prior NRC approval for changes having a potential impact (as defined in § 50.59 (c)(2)(i)-(viii)) on the basis for issuing the plant's operating license.

In practice, the petitioners note that § 50.59 typically involves a three-tiered review of proposed changes to a nuclear power plant or its procedures. The first tier screens the proposed changes against the criteria in § 50.59 (c)(2)(i)-(viii). If at least one criterion might be invoked by the proposed changes, the second tier provides for a more rigorous evaluation. However, if the proposed changes do not invoke any of the criteria at tier one and if the evaluation determines that none of the criteria are invoked at tier two, the change can be made at the owner's discretion. Otherwise, the third tier requires that NRC approve the change in advance, the change be revised so that none of the criteria are invoked, or the change must be abandoned.

The petitioners state that 10 CFR 73.55, requires plant owners to establish and maintain an onsite physical protection system and security organization which will have as its objective to provide high assurance that activities involving special nuclear material are not inimical to the common defense and security and do not constitute an unreasonable risk to public health and safety. The petitioners state that the physical protection system shall be designed to protect against the design basis threat (DBT) of radiological sabotage as stated in § 73.1(a)(1)(i)-(iii). The petitioners note that the DBT is being revised in light of the events on September 11, 2001, but currently specifies protection against a determined violent external assault, attack by stealth, or deceptive actions, of several persons with the following attributes, assistance and equipment that include: (A) Well-trained (including military training and skills) dedicated individuals, (B) inside threat and assistance from a knowledgeable individual (an employee) who may provide information, facilitate entrance and exit, disable alarms and communications, or participate in a violent attack, (C) suitable weapons, including hand-held automatic weapons with silencers and long range capability, (D) hand-carried equipment and explosives to be used for destroying reactor, facility, transporter, or container integrity features of the safeguards system, and (E) a four wheel drive land vehicle used as a bomb, or for transporting personnel, and their equipment to the proximity of vital areas.

The physical protection system features elements such as perimeter fences, locked doors, access controls, intrusion detection systems, and armed responders. The petitioners note that 10 CFR 50.54(p) compared to 10 CFR 50.59 permits plant owners to change their physical protection equipment and procedures without prior NRC approval as long as the changes do not decrease their effectiveness. The petitioners state that in practice, a security evaluation process determines if a proposed change to physical protection equipment or procedures can be made with NRC's approval, or cannot be made.

The petitioners state that U.S. nuclear power plants were designed and licensed to provide reasonable assurance that an accidental aircraft crash would not adversely harm public health and safety. The petitioners state that the process involved a mathematical exercise to determine the likelihood that an errant aircraft could damage vital part(s) of the plant by impact. The petitioners state further that the inputs to the number-crunching were the proximity of the nuclear power plant to aircraft flight paths, the amenity of the site to aircraft crashes, and any spatial parameters (e.g. vital plant areas being shielded by non-vital areas that the aircraft could destroy without consequence).

The petitioners state that nuclear power plants were also designed and licensed to provide reasonable assurance that an accidental fire within the facility would not adversely harm public health and safety, but note that a very serious fire at the Browns Ferry nuclear plant showed that the original regulation and associated implementing procedures were insufficient. The petitioners have included a detailed history of the fire at the Browns Ferry nuclear plant and a presentation of the formal structured approach by the owner of the plant. The petitioners state that while the initial regulations attempted to provide adequate protection, the Browns Ferry fire demonstrated regulatory deficiencies and caused a more formal, structured approach. The petitioners assert that U.S. nuclear power plants are protected from aerial hazards by pre-September 11 and pre-Browns Ferry fire regulations that rely in large part on the low probability of an aircraft impacting the site.

The petitioners state that the requested changes to 10 CFR part 50 for aerial hazards are analogous to the regulations promulgated by the NRC to rectify the fire protection regulation shortcomings exposed by the Browns Ferry fire (i.e., the addition of 10 CFR 50.48 and Appendix R to 10 CFR part 50).

The MFP also requests that the NRC suspend licensing proceedings on the Diablo Canyon Independent Spent Fuel Storage Installation until the issues presented in the petition are resolved. The petitioners believe the proposed amendments would provide better protection to Independent Spent Fuel Facilities (ISFSIs) against radiological sabotage. In an order dated May 16, 2003, the Commission denied the petitioner's request. Pacific Gas and Electric Company (Diablo Canyon Power Plant Independent Spent Fuel Storage Installation), CLI-03-04.

Proposed Amendments

The petitioners request the following amendment:

Revise 10 CFR 50.54(p) and 10 CFR 50.59 to require plant owners to formally evaluate whether proposed changes, tests, and experiments cause protection against radiological sabotage to be decreased and, if so, that such actions only be conducted with prior NRC approval.

Revise 10 CFR part 50 to require that plant owners formally evaluate their facilities against specified aerial hazards and make changes as necessary to provide reasonable assurance that the ability of the facility to reach and maintain safe shutdown would not be compromised by an aerial assault, whether accidental or intentional.

Rationale for the Changes

Safety and Security Evaluation Integration

The petitioners state that 10 CFR 50.59 requires plant owners to evaluate proposed changes, tests, and experiments and to obtain prior NRC approval for those having more than minimal adverse impact on the licensing basis, and that 10 CFR 50.54(p) requires plant owners to evaluate proposed changes to their physical protection equipment and procedures and to obtain prior NRC approval for those that decrease effectiveness.

The petitioners believe that the current safety and security change control regulations have minimal overlap, and note that a proposed modification to the decay heat removal system typically does not involve a formal evaluation of whether it makes radiological sabotage easier unless it directly affects a piece of physical protection equipment or the response capability of an armed guard. The petitioners state that many changes, tests, and experiments have no effect, direct or indirect, on nuclear plant security, but some may, particularly those involving short-term and temporary applications.

According to the petitioners, degraded conditions and off-normal configurations are often deemed acceptable from a safety evaluation perspective because of the low probability that an initiating event occurs during the brief period of the impairment. The petitioners state that initiating events like pipe breaks, earthquakes, etc. are low probability events assumed to occur randomly such that the chances of the initiating event happening during any short time period are a mere fraction of an already small number.

The petitioners state further that the same impairment, judged from a radiological sabotage perspective, may be unacceptable because the initiating event for sabotage is not random. According to the petitioners, saboteurs can cause actions to happen precisely at the time of the impairment. Thus, the chances of an initiating event occurring, instead of being reduced to a mere fraction of a small number, increase towards 100 percent. The petitioners state that the NRC's design basis threat is supposed to consider both an act of malice perpetuated by an insider acting alone and an act by an insider aided by several outsiders. The petitioners believe that, as long as one or more insiders remain part of the design basis threat, it is reasonable to assume that sabotage will be timed to coincide with the plant configuration being most, or at least more, vulnerable.

Therefore, the petitioners believe it is imperative to evaluate proposed changes, tests, and experiments from both a safety and a security perspective. They note that a security perspective will not necessarily prevent proposed actions from being performed; but in the case of short-term or temporary applications, the security perspective review might flag a heightened vulnerability to radiological sabotage but accept it based on having compensatory measures put in place. The petitioners offer that compensatory measures might entail posting armed guards around the in-service safety widget while the redundant safety widget is removed from service for extended maintenance.

The petitioners believe without the regulatory change sought by this petition to integrate the safety evaluations performed under 10 CFR 50.59 with the security evaluation performed under 10 CFR 50.54(p), changes, tests, and experiments may continue to occur at U.S. nuclear power plants with proper consideration of safety implications, but with insufficient consideration of their security implications. The petitioners believe the regulatory changes sought by this petition would not necessarily prevent the changes, tests, and experiments from happening. The petitioners assert the requested regulatory changes would, in all likelihood—

(1) Allow many changes, tests, and experiments to proceed as planned;

(2) Require some changes, tests, and experiments to proceed with compensatory measures in place to offset the radiological sabotage risk;

(3) Require very few changes, tests, and experiments to be approved by the NRC because they decrease the effectiveness of physical protection equipment and/or procedures; and

(4) Prevent a very small number of changes, tests, and experiments on the grounds of undue risk from radiological sabotage.

Aerial Hazards

The petitioners state that none of the 103 nuclear power plants operating in the United States at the time were designed to withstand suicide attacks from the air as we tragically experienced on September 11, 2001. This vulnerability prompted the Federal Aviation Agency (FAA) to establish no-fly zones around nuclear plants in the Fall of 2001. The petitioners assert this response was largely symbolic since FAA sanctions would probably not deter a suicide bomber, but it marked an implicit concession by the Federal Government that nuclear plants were vulnerable to air assault. The petitioners state further that nuclear plant owners would like the public to believe their facilities are hardened structures virtually immune to attack from the air due to the thick reinforced concrete walls of plant structures.^[1]

Petitioners do not agree with this rationale, asserting that the thick reinforced walls do not surround all vital parts of a nuclear power plant. They note that one study of aircraft hazards, jointly prepared by the owners of two similar nuclear power plants more than 20 years ago, concluded “The control building is the only single building which, if hit, could lead to core melt.” ^[2] The petitioners state the control buildings at every nuclear plant in the U.S. are located outside the robust structures described by the industry, and therefore offers that the nuclear industry's proclamations about the robustness of thick, reinforced walls may be accurate, but they fail to tell the entire story. The petitioners state that the incompleteness of industry's position is further evidenced by the fire hazards analyses required by NRC's regulations. The petitioners state that NRC did not restrict the scope of the fire hazards analyses to only those areas within the reactor containment structure, but that the regulations recognize the reality that reactor core damage can result from fires outside the reactor containment structure. The petitioners state that security tests conducted since 1991 under the NRC's Operational Safeguards Readiness Evaluation (OSRE) program also detail why the nuclear industry's current assurances are incomplete. Each OSRE, according to the petitioners involved force-on-force exercises with a small group of mock intruders going up against the facility's armed responders. The petitioners included the following quote from the testimony presented to Congress last year by the NRC individual responsible for the OSRE program.

Eighty-one OSREs have been conducted to date. At 37 of them, the expert NRC team identified a significant weakness; significant being defined as the adversary team simulating sabotaging a target set, which would lead to core damage and in many cases, to a probable radioactive release.^[3]

The petitioners state that the “target set,” attacked and defended by the adversary team and the security force respectively during the force-on-force exercises is defined by the NRC as follows:

A target set is a minimum combination of equipment or operator actions which, if prevented from performing its intended safety function or prevented from being accomplished, would result in core damage.^[4]

The petitioners state that target sets vary from plant to plant and generally involve more than a single pump, a single valve, or a single wall (however thick and reinforced). The petitioners note that the Nuclear Energy Institute (NEI) issued guidance to assist plant owners in developing their target sets. NEI described the process for determining target sets as follows:

Analysis identifies target sets that, if all targets within a target set are destroyed, could lead to significant core damage. Using these target sets provides a basis for evaluating the protective strategy and assessing the significance of issues based on the risk involved.^[5]

The petitioners included a table provided by NEI that illustrates ten (10) sample target sets. See Table A-1, Sample Target Sets (reproduced below). The table shows that reactor core damage can be prevented if cooling water is supplied from any one of four possible sources listed: Normal (high pressure supply), safety backup (emergency high pressure supply), another safety back-up (low pressure supply), and an additional back-up (alternate low pressure supply). In these sample target sets, each cooling water supply can be disabled by any one of five ways: (1) Power from the pump motor can be interrupted;

(2) Control for the pump and/or valves upstream and downstream of the pump can be lost;

(3) The pathway from a water source to the pump can be eliminated;

(4) The pathway from the pump to the reactor vessel can be eliminated; and

(5) The location of the pump itself can be rendered unusable such as by fire.

The petitioners state that NEI reported only one of the four ways of cooling the reactor need to survive the attack:

Each target set is developed to provide assurance that, if any element is protected, public health and safety will not be endangered by a significant radiological release.^[6]

The petitioners state that in 37 of the 81 OSREs conducted, the security forces were unable to successfully defend even one element of the target set from simulated ground assaults. The petitioners included names and details of several power plants that had failures.

The petitioners state that sample target sets illustrate the conclusions reached more than 20 years ago about the control building being an Achilles heel. The petitioners note that Target Set 6 in the table shows that knocking out the control element for all four water supplies can result in core damage.

Table A-1.—Sample Target Sets

Structures, sys, & comps.	1	2	3	4	5	6	7	8	9	10
High Pressure Supply:
Power					X			X
Control	X	X				X
Suction				X						X
Discharge			X						X
Location							X
Emergency HP supply:
Power	X				X			X
Control		X				X
Suction				X						X
Discharge			X						X
Location							X
Low Pressure supply:
Power	X
Control				X		X
Suction		X			X			X		X
Discharge			X
Location							X		X
Alternate LP supply:
Power	X				X
Control				X		X
Suction		X						X		X
Discharge			X
Location							X		X

The petitioners state that an aircraft hitting the control building may destroy the control elements for all four water supplies, and much more.

The petitioners believe these target sets should be used to evaluate nuclear power plants for destruction caused by postulated aircraft impact and subsequent fire. According to the petitioners, this aircraft hazard evaluation approach mirrors the approach taken for in-plant fire hazards. The petitioners believe the fire hazards analyses conducted by plant owners are ‘living documents’ in that proposed changes to plant procedures and proposed modifications to plant structures must be formally reviewed against to verify that protection against fires will not be lessened.

The petitioners assert the way to ensure adequate protection of nuclear plants from aerial threats would be to replicate the fire hazards analysis process.^[7] The petitioners believe the NRC should define, as part of its design basis threat, the size and nature of an aerial threat that the plant must be protected against. As a minimum, according to the petitioners, it would seem to include general aviation aircraft since the post-September 11, airport security measures generally overlook general aviation. The petitioners state the aerial threat may also entail explosives delivered via mortars and other means (e.g., rocket propelled grenades) as deemed appropriate by the NRC. The petitioners assert that if the aerial hazards evaluation determines that all targets within a target set are likely to be disabled, at least three options are available to the plant's owner to remedy the vulnerability:

(1) Other equipment outside of and not affected by the impact zone could be added to the target set. Using the sample target sets, a fifth makeup water supply system could be added if it were outside the impact zone and could adequately cool the reactor core.

(2) Protection in place for at least one of the targets within the existing target set could be provided. Using Target Set 9 from the sample target sets, if an aircraft impact at the location of the low pressure supply system and the alternate low pressure supply system potentially caused collateral damage to the discharge pathway for the emergency high pressure supply system, it might be possible to install a shield wall or screen to protect the exposed pathway.

(3) Affected portions of a system could be relocated to a safe place outside the impact zone. Using Target Set 5 from the sample target sets, if the only part of the Emergency High Pressure Supply System within the impact zone was the power cable for the pump, that power cable could be rerouted.

The petitioners believe that while an aerial hazards analysis established adequate protection, for those that may not be at nuclear power plants, it would also provide the means to ensure that future changes to plant structures and procedures do not compromise that protection.

Conclusion

The petitioners believe that the proposed changes to 10 CFR 50.59 and 10 CFR 50.54(p) integrate the safety and security evaluations performed for proposed changes to plant safety equipment and procedures, thereby providing better protection against radiological sabotage. Also, the petitioners believe the proposed changes to part 50 provide a formal, structured approach for managing the risk from aerial hazards comparable to the regulatory approach already adopted for managing the risk from fire hazards. The petitioners state that if September 11, 2001, featured one of the hijacked aircraft hitting a U.S. nuclear power plant, the formal, structured approach being sought by this petition would have been undertaken as a necessary step to prevent another event. The petitioners state that if these changes are good measures to prevent recurrence, they represent even better measures to prevent occurrence in the first place.

Dated at Rockville, Maryland, this 10th day of June, 2003.

For the Nuclear Regulatory Commission.

Annette Vietti-Cook,

Secretary for the Commission.

Footnotes

1.  NEI Report dated December 2002, “Deterring Terrorism: Aircraft Crash Impact Analyses Demonstrated Nuclear Power Plant's Structural Strength.”

2.  Report from Spring 1982 by the Power Authority of the State of New York and the Consolidated Edison Company of New York, “Indian Point Probabilistic Safety Study,” Section 7.6.2, “Aircraft Hazards Analysis.”

3.  Testimony on April 11, 2002, by David N. Orrik, Reactor Security Specialist, Office of Nuclear Security and Incident Response, Nuclear Regulatory Commission, before the U.S. House Subcommittee on Oversight and Investigations, “A Review of Enhanced Security Requirements at NRC Licensed Facilities.”

4.  NRC memo dated November 17, 2000, from Glenn M. Tracy, Chief, Operator Licensing, Human Factors and Plant Support Branch, to John R. White, Chief, Radiation Safety and Safeguards Branch, Region I; Kenneth P. Barr, Chief, Plant Support Branch, Region II, James R. Creed, Team Leader, Safeguards Staff, Region III; and Gail M. Good, Chief, Plant Support Branch, Region IV, “Conduct, Agenda, and Rules of Engagement for Operational Safeguards Response Evaluations,” page 4.

5.  Nuclear Energy Institute draft report dated October 2000, “Safeguards Performance Assessment Program.”

6.  Nuclear Energy Institute draft report dated October 2000, “Safeguards Performance Assessment Program.”

7.  While the existing fire hazards analyses will be useful input to the aircraft hazards analyses, they do not eliminate the need for further study for two reasons: (1) The fire hazards analyses assumed that the postulated fire would be confined to a single room, whereas the aircraft impact and resulting fire(s) may affect multiple rooms, and (2) many rooms were summarily accepted as-is by the fire hazards analyses due to insufficient combustibles being present to sustain a fire—assumptions invalidated by the large amount of fuel carried by aircraft. The fire hazards analyses will expedite the aircraft hazards analyses by defining the equipment needed to cool the reactor if the room is hit. If that equipment could also be disabled by an aircraft impacting the room, action will be required to eliminate that vulnerability.