|
Publication Date: 8/1/94
Pages: 7 Date Entered: 8/11/94 Title: Protection Against Malevolent Use of Vehicles at Nuclear Power Plants U.S. NUCLEAR REGULATORY COMMISSION August 1994 REGULATORY GUIDE OFFICE OF NUCLEAR REGULATORY RESEARCH REGULATORY GUIDE 5.68 (Draft was issued as DG-5006) PROTECTION AGAINST MALEVOLENT USE PROTECTION AGAINST MALEVOLENT USE OF VEHICLES AT NUCLEAR POWER PLANTS A. INTRODUCTION In the amended 10 CFR Part 73, Physical Protection of Plants and Materials, the new Section 73.1(a)(1) requires a licensee to protect against a determined violent external assault, attack by stealth, or deceptive actions by several persons using a four-wheel drive land vehicle for the transport of personnel and their hand-carried equipment to the proximity of vital areas. The new 10 CFR 73.1(a)(1)(iii) requires licensees to protect against a four-wheel drive land vehicle bomb. In 10 CFR 73.55, "Requirements for Physical Protection of Licensed Activities in Nuclear Power Reactors Against Radiological Sabotage, the new 10 CFR 73.55(c)(7) requires a licensee to establish vehicle control measures, including vehicle barriers, to protect against the use of a land vehicle, as specified by the Commission, as a means of transportation to gain unauthorized proximity to vital areas. The new 10 CFR 73.55(c)(8) requires a licensee to compare the vehicle control measures established in accordance with 10 CFR 73.55(c) (7) to the Commission's design goals and criteria for protection against a land vehicle bomb. Also, 10 CFR 73.55(c) (8) provides for a process to use alternative measures for protection against a land vehicle bomb, for example, for those licensees with a particularly difficult site configuration. These alternative measures must provide substantial protection against a land vehicle bomb and must be supported by a licensee analysis, using the essential elements of the criteria in 10 CFR 50.109, demonstrating that the costs of fully meeting the design goals and criteria are not justified by the added protection that would be provided. The alternative measures must be submitted to the Commission for approval. The rule does not apply to licensees who are in the process of decommissioning and have amended their operating licenses to possession-only status. The rule would apply to licensees who plan to decommission in the near future but do not have a possession-only license. The Commission would need to evaluate each of these licensees individually to determine whether an exemption from the rule is appropriate. The new 10 CFR 73.55(c) (9) requires licensees to submit to the Commission summary descriptions of their proposed control measures as required by 10 CFR 73.55(c) (7) and the results of their vehicle bomb comparison. The new 10 CFR 73.55(c)(10) pertains to applicants for a license to operate a nuclear power reactor. This regulatory guide is being developed to provide guidance acceptable to the NRC staff by which the licensee can meet the requirements of the amended 10 CFR 73.1(a)(1) and 73.55(c)(7), (8), (9). and (10). This regulatory guide will be used by licensees in conjunction with separate Safeguards Information that has already been provided to affected licensees, but this Safeguards Information is not available to the general public. Also available is NUREG/CR-6190, "Protection Against Malevolent Use of Vehicles at Nuclear Power Plants," Volumes 1 and 2, which provides acceptable measures to satisfy the requirements of this rule. Any information collection activities mentioned in this regulatory guide are contained as requirements in 10 CFR Part 73. which provides the regulatory basis for this guide. The information collection requirements in 10 CFR Pan 73 have been approved by the Office of Management and Budget, Approval No. 3150-0002. The public reporting burden for this collection of information is estimated to average 500 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Information and Records Management Branch (T6 F33), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001; and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-30 19 (3150-0002), Office of Management and Budget, Washington, DC 20503. B. DISCUSSION MEASURES TO PROTECT AGAINST UNAUTHORIZED USE OF A LAND VEHICLE AS A MEANS OF PERSONNEL TRANSPORT Protection against use of a land vehicle as a means to gain unauthorized proximity to vital areas can be provided by establishing a continuous barrier system that encompasses vital areas of the facility. The features and structures that form the barrier system would need to be sufficient to stop the forward motion of a land vehicle with the design characteristics established by the Commission. These design characteristics have been provided to affected NRC licensees in a separate document that is Safeguards Information, and therefore is not available to the public. Since the protected area perimeter serves as an outer barrier to vital areas, one approach would be to establish the vehicle barrier contiguous with or in close proximity to the protected area perimeter. At many facilities, natural terrain features such as water barriers, steep cliffs, large rocks, or existing structures such as buildings or cooling towers located adjacent to the protected area would be well suited and may be linked with barriers to serve as part of the continuous barrier. As a matter of economy and convenience, the barrier system would likely include the present vehicle access points to the protected area. At these locations, active barriers that would allow controlled vehicle entry would need to be installed. Passive vehicle barriers are appropriate for these portions of the barrier system that are not needed for vehicle access. The passive barriers may make use of natural topographic features and structures provided these features, along with other segments of the barrier, provide a continuous vehicle barrier against land access to the facility's vital areas. In considering a barrier, natural features or devices that limit vehicle direction and speed also may be appropriate to simplify or reduce the performance required of the vehicle barrier system. Active vehicle barriers are appropriate for those portions of the barrier system that need to provide for vehicle access. Active vehicle barriers have two positions: one position that denies passage of a vehicle and a second position that allows passage. Barriers remain in the denial position to prevent entry and are moved to allow entry only after authorization for the vehicle has been confirmed. The energy-absorbing capability of various vehicle barriers and the speed-reducing capability of natural and man-made obstacles can be based on presently available test data developed for other Federal agencies or by national laboratories or barrier manufacturers. Much of the available data is included in the Safeguards Information that has already been provided to affected licensees. For vehicle barriers and obstacles for which test data are not available, licensees can perform engineering analyses to determine their effectiveness in stopping or slowing a vehicle. Access control measures for vehicles crossing the boundary of the established vehicle barrier system need to be sufficient to provide assurance that the vehicle is appropriately authorized and not transporting an explosive device. In addition to barriers, access control measures include required vehicle searches, personnel searches, and escorts (if necessary). It would be expected that, at most facilities, one active vehicle barrier would be established for at least one of the present protected area vehicle access points. Searches of vehicles for explosives, and other personnel access control measures that remain in effect for protected area entry, are rigorous and provide assurance against unauthorized vehicle entries. Vehicle searches may be conducted inside the vehicle barrier system (VBS) at previously established search points after proper authorization of the vehicle has been obtained. For barrier system layouts that have vehicle denial barriers located outside the protected area boundary, vehicle access control measures, including searching for explosives, would have to be provided for vehicles permitted access inside the barrier, even if the vehicle did not enter the protected area. Portions of the VBS located outside the protected areas should be periodically observed to identify damage, deterioration, or indications of tampering that impact the effectiveness of the barrier. These observations may be performed as part of routine security patrols. The NRC anticipates that vehicle barriers, particularly passive barriers, will normally remain functional once installed. For those infrequent cases of failure, any compensatory measures should take into consideration the type and cause of the problem and the time the barrier will be nonfunctional. For example, for short-term problems with active or passive barriers, compensatory measures would not be expected to be extensive. When barriers are nonfunctional for longer periods, appropriate compensatory measures may include placement of heavy vehicular equipment, placement of concrete highway median bounces in a serpentine fashion, installation of strands of airplane arresting wires, or positioning an officer armed with a high-power contingency weapon. MEASURES TO PROTECT AGAINST USE OF A VEHICLE AS A MEANS OF TRANSPORT OF AN EXPLOSIVE DEVICE The design goal for protection against explosive devices transported by a vehicle is to protect equipment, systems, devices, or material if its failure, destruction, or release of which could directly or indirectly endanger the public health and safety by exposure to radiation. Such equipment, systems, devices, or material are designated by licensees as vital equipment and are required by 10 CFR 73.55(c)(1) to be located within vital areas. Vital areas in turn are required to be located inside protected areas. At many facilities the vital area barrier, which separates vital equipment from the protected area, is located at a considerable distance from the protected area barrier. Further, vital area barriers generally are quite substantial. These features, assuming the vehicle barrier system is located along or adjacent to the protected area barrier, provide substantial protection for vital equipment from an explosive blast. Many of the issues discussed in the previous section related to active and passive barriers apply to the protection against explosives. The effects of an explosive device diminish rapidly with distance. The distance of the structure or equipment from the explosive blast is referred to as "stand-off distance." If a vehicle is transporting an explosive device and the device is detonated at the vehicle barrier, the standoff distance would be that distance between vital equipment and the closest exterior point of the vehicle barrier system. Different vital areas have different standoff distances depending on the postulated locations of the vehicle barriers. Considering typical plant layouts and the placement of vehicle barriers at or adjacent to the protected area, vital area barriers at many facilities would be afforded sufficient protection against a relatively large explosive device. In addition to the protection afforded by distance from the blast, vital equipment at most sites is provided substantial protection by structures containing the equipment. Vital equipment is frequently located within seismic structures (often reinforced concrete walls) "Safe standoff" distance is the distance between vital equipment or a structure housing vital equipment and the point of detonation of the design basis threat bomb that would protect the equipment or equipment within the structure to a medium level of protection. Safe standoff distances can be determined by blast effect analyses that take into account the size of the explosive, the distance between the explosive and the affected structure, and the characteristics of the structure. These analysis techniques are described in the separate Safeguards Information document that has been sent to licensees. When the blast analysis shows that a vital area barrier structure would be damaged, further analysis may be able to demonstrate that vital equipment within the structure is not damaged. For example, the vital equipment may be located in a separate cubicle within the main structure that is unaffected by the analyzed blast damage to an outer wall or a roof. If the blast effect analysis indicates that the explosion could damage vital equipment, the ability to shut down and maintain the facility in a safe shutdown condition may be demonstrated by identifying alternative plant equipment that could serve the same safety function as the equipment analyzed as being damaged by the explosion. Also, it may be demonstrated that damage control measures can be taken that could support plant shutdown and maintain the plant in a safe shutdown condition. If the blast effects analysis demonstrates that vital equipment would be damaged, that alternative equipment is not available, and that damage control measures can not adequately support plant shutdown and maintaining shutdown conditions, other measures (in addition to those required to protect against the use of a land vehicle as a means of transportation to gain proximity to vital areas) may be needed. To fully meet the Commission's design goals and criteria for protection against a land vehicle bomb, additional measures that can be taken include (1) extending the vehicle barrier location out from those positions shown by the analysis that the barrier does not provide sufficient safe standoff distance for vital area structures from the explosive, (2) constructing structures that shield the vital area barrier from blast effects, (3) installing equipment to back up that equipment assumed to be damaged, or (4) interconnecting other systems to the damaged equipment. Certain security-related electric power supplies and the central alarm station are required by 10 CFR Part 73 to be protected within vital areas; however, in the absence of safety-related equipment necessary for plant shutdown, these vital areas need not be considered as areas needing protection in the licensee's analysis. ALTERNATIVE MEASURES TO PROTECTION AGAINST A VEHICLE BOMB As provided in 10 CFR 73.55(c) (8), under certain circumstances a licensee may propose measures other than those needed to meet the design goals and criteria specified for protection against a land vehicle bomb. This does not relieve the licensee of the requirement to protect against use of a vehicle to gain proximity to vital areas. Alternative measures developed by a licensee will be acceptable to the NRC staff if it can be demonstrated that they, along with measures that protect against vehicle intrusions, provide substantial protection against a land vehicle bomb and if the licensee demonstrates by an analysis, using the essential elements of 10 CFR 50.109, that the costs of fully meeting the design goals and criteria are not justified by the protection added by these additional measures. These alternative measures must be approved by the NRC staff. Factors to be considered in assessing proposed alternative measures to protect against a vehicle bomb include: 0 The characteristics (e.g., size, location, and mobility) of the vehicle bomb that the alternative measure would protect against. 0 The percent of the perimeter that would be vulnerable to a design basis vehicle explosion. 0 The amount of time that the reactor could be maintained in a safe condition if subjected to a design basis vehicle explosion at the most vulnerable portion of the barrier system. 0 The licensee's severe accident management program. 0 The off-site consequences of a design basis vehicle explosion at the most vulnerable portion of the barrier system. 0 The cost difference between the proposed alternative measures and measures that would fully meet the design goals and criteria for protection against a vehicle bomb. The NRC's approval of the licensee's proposal for alternative measures will be based on the extent that the vehicle barrier system, including alternative measures added to enhance protection against a vehicle bomb, provides protection against a vehicle transporting an explosive device. Definitions The following are definitions of terms used in this guide. 'Design Basis Threat Bomb': An explosive device with the TNT- equivalent force that is described to licensees in the separate Safeguards In formation. 'Design Basis Threat Land Vehicle': A vehicle with design characteristics described to licensees in the separate Safeguards Information. 'Design Goals and Criteria for Protection Against a Land Vehicle Bomb': The design goal is to protect equipment, systems, devices, or material, the failure, destruction, or release of which could directly or indirectly endanger the public health and safety by exposure to radiation. The criteria are the protection needed to protect against the design basis threat land vehicle and the design basis threat bomb. 'Level of Protection': The degree of protection from a bomb blast that a structure provides to equipment housed inside the structure. 'Safe Standoff Distance': The distance between vital equipment or a structure housing vital equipment and the point of detonation of the design basis threat bomb that would protect the equipment or equipment within the structure to a medium level of protection. A medium level of protection is afforded vital equipment when there is a low probability of damage to the equipment from an explosion occurring at the vehicle barrier. 'Standoff Distance': The distance between vital equipment or a structure housing vital equipment and the closest exterior point of the vehicle barrier system. 'Vehicle Barrier System (VBS)': A continuous barrier, which may include buildings, natural barriers, commercially available barriers, and any combination of these items, utilized to stop a land vehicle used as transportation to gain proximity to vital areas or used to transport a bomb. C. REGULATORY POSITION 1. MEASURES TO PROTECT AGAINST UNAUTHORIZED VEHICLE INTRUSION A vehicle barrier system (VBS) that is capable of preventing forced access of a land vehicle to gain proximity to vital areas should be established at each nuclear power reactor site. The VBS should provide a perimeter around vital areas of the facility such that no location along the perimeter would permit forced entry of a land vehicle. The VBS, regardless of the type of barriers used, should be of a design capable of stopping the forward motion of the design basis land vehicle (DBV). The VBS may be incorporated as part of the protected area perimeter system but should not diminish or remove any requirements established for the protected area. 1.1 Passive Barriers The passive barrier portion of the VBS may include natural terrain features such as steep cliffs and large rocks, alone or in combination with man-made structures or barriers, provided the overall effectiveness of the barrier at any point is capable of stopping the forward motion of the DBV. Man-made or natural features that limit the direction and speed of the DBV may be used in conjunction with a barrier design. The separate Safeguards Information, which has already been sent to affected licensees, provides design guidance that is acceptable to the NRC on the performance capabilities of barriers and specifications for measures that reduce vehicle speed. 1.2 Active Barriers Access by vehicles to locations inside the VBS should be through active vehicle denial barriers that, in the denial position, are capable of stopping the forward motion of the DBV. Operational design features of the active barrier or barrier system, when allowing access for authorized vehicles, should be capable of preventing being bypassed and allowing access of unauthorized vehicles. A single active barrier may be used in conjunction with other vehicle control measures to ensure denial of an unauthorized vehicle. The separate Safeguards Information that was sent to affected licensees provides design guidance that is acceptable to the NRC on the performance capabilities of barriers and specifications for measures that reduce vehicle speed. 1.3 Vehicle and Personnel Access Authorization Measures Vehicles and their operators should be authorized for entry prior to being permitted access inside the VBS. Vehicle authorization should also include confirmation that the vehicle has a legitimate purpose for entering the VBS. Authorization for the vehicle operator should include confirmation that the individual has a legitimate purpose for operating the vehicle inside the VBS. For VBS designs that are adjacent to the protected area boundary and whose active vehicle barrier access points are the same as the protected area vehicle access points, vehicle and personnel authorization measures for entering the protected area provide adequate authorization controls. 1.4 VBS Description The security plan should contain an attachment that describes the VBS. The description should include site drawings that identify the VBS, the various components and combinations of components that compose the VBS, and access authorization measures for vehicle and personnel within the VBS. 2. MEASURES TO PROTECT VITAL AREAS AGAINST A LAND VEHICLE BOMB The new 10 CFR 73.55(c)(8) requires a licensee to compare the vehicle control measures established in accordance with 10 CFR 73.55(c)(7) with the design goals and criteria for protection against a land vehicle bomb specified by the Commission. The design basis bomb size is specified in the separate Safeguards Information that has already been provided to affected licensees. 2. 1 Blast Effect Analysis The comparison of vehicle control measures with the design goals and criteria for protection against a land vehicle bomb should consist of an analysis that establishes that the capability of vital equipment to maintain the plant in a safe condition is not lost as a result of a detonation of a design basis bomb at the VBS boundary. Depending on the VBS design and site-specific considerations, this comparison could result in a determination that the design goals and criteria for protection against a land vehicle bomb are satisfied at the conclusion of any one of the following measures. 2.1.1 Screening Analysis This screening process determines whether a more detailed analysis of the effects of an explosive blast of the size of the design basis bomb is required. For each location along the VBS perimeter the standoff distance (distance between vital equipment or a structure housing vital equipment and the closest exterior point of the VBS) should be determined. Certain security-related electric power supplies and the central alarm station are required by 10 CFR Part 73 to be protected within vital areas; however, in the absence of safety-related equipment necessary for plant shutdown, these vital areas need not be considered as areas needing protection in the licensee's analysis. Licensees should determine whether the standoff distances for each location along the VBS provide a safe standoff distance. This determination should be made by an analysis that takes into account the size of the explosive; both reflective and side-on blast loads on walls, roofs, and supporting members; the distance between the explosive and the affected structure; and the characteristics of the structure. Vital equipment can be assumed to remain operational if the structure containing the equipment provides such a level of protection that there is a low probability of damage to the equipment from an explosion occurring at the vehicle barrier. The separate Safeguards Information that has already been provided to affected licensees specifies approaches acceptable for determining safe standoff distances. If vital area structures and equipment are found to be located at distances equal to or greater than the safe standoff distance, the design goals and criteria for protection against a land vehicle bomb are considered fully met and no further analysis is necessary. 2.1.2 Detailed Analysis If the screening analysis described in Section 2.1.1 of this guide cannot establish that vital equipment would be protected from damage by detonation of the design basis bomb at any location along the VBS boundary, the analysis should then consider: (1) Whether any obstructions in the blast path would affect the level of protection provided to vital equipment. The analysis may incorporate the effects of natural typography that diminish the effects of the bomb blast effect. The analysis may also include an assessment of interior building designs (e.g., interior walls, supports) that may protect vital equipment even if the outer wall or structure is significantly damaged. The analysis should show whether or not the blast damage impacts the functional operability of the vital equipment. (2) Whether the plant can be shut down and maintained in a shutdown condition with equipment not damaged by the explosion. The evaluation may allow for damage control actions to mitigate the consequences of the explosion. These damage control actions should be included in applicable station operating procedures and referenced in the safeguards contingency procedures. In addition, the analysis should consider loss of off-site power, an assumption that is compatible with the basic premise that equipment not designated and protected as vital is vulnerable to damage and is not available. If the detailed analysis determines that all vital equipment remains functional or that the ability to shut down the facility and maintain it in a shutdown condition can be provided even with the loss of vital equipment identified in the screening analysis, the design goals and criteria for protection against a land vehicle bomb are considered fully met and no further analysis is necessary. 2.1.3 Additional Protection Measures If the screening and detailed analyses determine that the design goals and criteria for protection against a land vehicle bomb cannot be fully met, a determination should be made concerning additional measures needed to fully achieve the design goals and criteria. Additional measures may include installing blast shields, changing planned vehicle barriers to extend standoff distances, strengthening current structures, or installing or relocating plant equipment or systems. If analysis of the effects of additional measures finds that vital equipment remains functional or that the ability to shut down and maintain the facility in a safe condition can be provided, the design goals and criteria for protection against a land vehicle bomb are considered fully met and no further analysis is necessary. As provided in 10 CFR 73.55(c)(8), the licensee may propose to the NRC additional measures other than ones needed to fully meet the design goals and criteria, provided this approach provides substantial protection against a vehicle bomb and it can be demonstrated that the costs of measures to fully meet the design goals and criteria are not justified by the added protection that would be provided. if so, the actions in Regulatory Position 2.2 should be taken. 2.2 Alternative Measures To Protect Against Explosives As provided in 10 CFR 73.55(c)(8), a licensee may propose to the NRC additional measures other than the ones needed to meet the design goals and criteria, provided this approach provides substantial protection against a vehicle bomb and provided it can be demonstrated that the costs of measures to fully meet the design goals and criteria are not justified by the added protection that would be provided. This submittal should include: (1) The findings regarding the extent of the protection against a vehicle bomb provided by the vehicle control measures designed to meet the requirements of 10 CFR 73.55(c)(7). These findings should be expressed in explicit terms such as the size of explosive for which the measures provide protection and the locations along the barrier system perimeter where the design goals for protection against a vehicle bomb cannot be fully met. (2) A description and analysis of additional measures needed to fully meet the design goals and criteria for protection against a vehicle bomb. The description should include an estimate of the cost of the measures. (3) A description and analysis of additional measures, alternative to those needed to fully meet the design goals and criteria, that are proposed to be taken. The analysis should address the enhanced protection provided by the additional measures. The description should include an estimate of the costs of the measures. (4) A comparison of the costs of the measures described in (2) and (3) above and an assessment supporting a finding that additional costs of fully meeting the design goals and criteria are not justified by the added protection that would be provided. 3. DOCUMENTATION in accordance with 10 CFR 73.55(c)(9), each licensee authorized to operate a nuclear power reactor is required to submit to the Commission a summary description of the proposed vehicle control measures and the results of the vehicle bomb comparative analysis. The summary description should include identification of active and passive components of the VBS and any natural terrain features or man- made obstructions that complete the VBS. A site drawing or diagram that outlines the VBS should be included with the description. The results of the vehicle bomb comparative analysis should identify the basis for determining that the Commission's design goals and criteria for protection against a land vehicle bomb are fully met. When applicable, the results of the comparison should include damage control actions that must be taken and additional security measures taken to protect against the design basis bomb. Licensees whose comparative analysis determines that they do not fully meet the design goals and criteria for protection against a vehicle bomb and who propose alternative measures should submit the analysis and justification for the alternatives as specified in Regulatory Position 2.2. Details of the "as built" VBS and of the land vehicle bomb analysis should be maintained on site. 4. CONTINGENCY PLANNING FOR SURFACE VEHICLE BOMBS Once implemented, the control measures required to meet these amendments to Part 73 supersede contingency requirements initiated in response to Generic Letter 89-07, "Power Reactor Safeguards Contingency Planning for Surface Vehicle Bombs," of April 28, 1989. However, licensees whose vehicle control measures do not fully meet the NRC's design goals and measures may choose to maintain vehicle bomb contingency planning as one element of proposed alternative measures. D. IMPLEMENTATION The purpose of this section is to provide information to licensees and applicants regarding the NRC staff's plans for using this regulatory guide. Except in those cases in which an applicant proposes an acceptable alternative method for complying with specified portions of the Commission's regulations, the methods described in this guide will be used in the evaluation of submittals in response to the amendments to 10 CFR Part 73. REGULATORY ANALYSIS A separate regulatory analysis has not been provided for this regulatory guide. The regulatory analysis that was prepared for the rule provides the basis for this regulatory guide and examines the costs and benefits of the rule as implemented by this guide. A copy of Regulatory Analysis for Malevolent Use of Vehicles at Nuclear Power Plants" is available for inspection and copying for a fee at the Commission's Public Document Room, 2120 L Street NW., Washington, DC, under Regulatory Guide 5.68. |