The federal Nuclear Regulatory Commission raised safety questions Thursday about the design of a proposed next-generation reactor to be built by Westinghouse, saying a crucial part of the reactor may not be able to withstand a tornado, earthquake or even high winds.

The NRC staff directed Westinghouse to change the reactor design so that its outer shell, which is supposed to protect the reactor's concrete containment structure, is strengthened. The staff concluded the outer steel and composite structure does not meet design requirements for safety.

The reactor, called the AP1000, is one of three next-generation reactor designs under NRC review. The others are being proposed by Areva Inc., the French nuclear company, and GE Hitachi Corp.

But the AP1000 is one of the more popular of the new reactors and has been viewed widely as likely to be the first one to be built in the United States. At least seven utilities have selected the reactor design in preliminary applications filed with the NRC, anticipating the potential construction of 14 units.

Westinghouse spokesman Vaughn Gilbert said the company already has begun reviewing what changes might be needed.

"We're comfortable we will be able to make the modifications to meet the (NRC) requirements," said Gilbert in a telephone interview. He said he does not expect the issue to delay certification of the AP1000 and still expects to have the first of the plants operating by 2016.

The NRC had scheduled its safety review to be completed by 2011, followed by formal certification rule making.

David Matthews, the NRC's director for new reactor licensing, would not say whether that schedule might be delayed, saying the timetable depends on how Westinghouse choses to resolve the problems raised by the agency.

If the issues are not resolved, "the certification process couldn't be concluded," said Matthews in a conference call with reporters.

The NRC's problem involved the cylindrical 10-story high so-called "shield" building that surrounds the reactor's concrete containment dome. Inside the dome is the reactor pressure vessel that contains the highly radioactive fuel rods. The outer structure also is critical to AP1000's passive emergency cooling system. Atop the structure is a huge tank of water that would be released, relying on gravity, into the reactor in case of an emergency.

The passive cooling system is cited as a major safety improvement since it requires no pumps or other mechanical devices for cooling water to be released.

The NRC questioned whether the shield building, with its modular construction, would be able to withstand extreme weather conditions such as high winds, a tornado or an earthquake, as required by NRC design standards.

Matthews said the concerns raised over the AP1000 are separate from issues related to new requirements aimed at increasing protection from the impact of an aircraft if it were flown into a reactor. The NRC last spring required any new reactors to be designed to protect from such an airborne attack better.

Gilbert said that Westinghouse, in fact, had changed the design of the shield building to a modular construction "to make the structure even more able to withstand an airplane crash."

"We want to emphasize that the AP1000 is the safest nuclear poser plant available on the market," said Gilbert.