HNP-17-072, License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into Licensing Basis

License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into Licensing Basis

ML17292B648
Person / Time
Site:	Harris
Issue date:	10/19/2017
From:	Bradley Jones Duke Energy Progress
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
HNP-17-072
Download: ML17292B648 (78)

Text

Bentley K. Jones Director, Organizational Effectiveness Harris Nuclear Plant 5413 Shearon Harris Road New Hill, NC 27562-9300 10 CFR 50.90 October 19, 2017 Serial: HNP-17-072 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400/Renewed License No. NPF-63

Subject:

License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Ladies and Gentlemen:

Pursuant to 10 CFR 50.90, Duke Energy Progress, LLC (Duke Energy), hereby requests a license amendment for the Shearon Harris Nuclear Power Plant, Unit 1 (HNP), to incorporate the Tornado Missile Risk Evaluator (TMRE) Methodology into the HNP Updated Final Safety Analysis Report. The TMRE Methodology was transmitted to the NRC by the Nuclear Energy Institute as NEI 17-02, Revision 1 (ADAMS Accession No. ML17268A036), and is incorporated by reference into this license amendment request (LAR). This LAR was discussed with the NRC staff in a presubmittal public meeting on August 30, 2017. TMRE is proposed as a methodology for determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where tornado missile protection is not currently provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

This LAR is one of three pilot LARs supporting NRC approval of the TMRE Methodology.

Approval of the proposed amendment is requested within six months of NRC staff acceptance to support utilization of the methodology by other licensees. Duke Energy will implement the amendment within 90 days of the NRC approval date.

This LAR contains no regulatory commitments.

In accordance with 10 CFR 50.91, Duke Energy is notifying the State of North Carolina of this LAR by transmitting a copy of this letter and enclosure to the designated State Official.

U.S. Nuclear Regulatory Commission Page2 Serial HNP-17-072 If there are any questions or if additional information is needed, please contact John Caves at (919) 362-2406.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on October 19, 2017.

Sincerely,

Enclosure:

Evaluation of the Proposed Change cc: Mr. J. Zeiler, NRC Sr. Resident Inspector, HNP Mr. W. L. Cox, Ill, Section Chief, N.C. DHSR Ms. M. Barillas, NRC Project Manager, HNP Ms. E. Brown, NRC Project Manager, DORL TMRE Mr. E. Miller, NRC Project Manager, HNP TMRE LAR Mr. A. Schwab, NRC DPR Ms. C. Haney, NRC Regional Administrator, Region II

U.S. Nuclear Regulatory Commission Page 2 Serial HNP-17-072 If there are any questions or if additional information is needed, please contact John Caves at (919) 362-2406.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on October 19, 2017.

Sincerely, Bentley K. Jones

Enclosure:

Evaluation of the Proposed Change cc: Mr. J. Zeiler, NRC Sr. Resident Inspector, HNP Mr. W. L. Cox, III, Section Chief, N.C. DHSR Ms. M. Barillas, NRC Project Manager, HNP Ms. E. Brown, NRC Project Manager, DORL TMRE Mr. E. Miller, NRC Project Manager, HNP TMRE LAR Mr. A. Schwab, NRC DPR Ms. C. Haney, NRC Regional Administrator, Region II

Serial: HNP-17-072 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400/Renewed License No. NPF-63 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Enclosure Evaluation of the Proposed Change

1. Summary Description

2. Detailed Description 2.1 Background Information 2.2 Current Licensing Basis Requirements 2.3 Reason for the Proposed Change 2.4 Description of the Proposed Change

3. Technical Evaluation 3.1 Tornado Missile Risk Evaluator Methodology 3.2 Traditional Engineering Considerations 3.3 Risk Assessment 3.4 Technical Evaluation Conclusions

4. Regulatory Evaluation 4.1 Applicable Regulatory Requirements/Criteria 4.2 No Significant Hazards Consideration Analysis 4.3 Regulatory Evaluation Conclusions

5. Environmental Consideration

6. References ATTACHMENTS:

1. Detailed Risk Assessment Information

2. Probabilistic Risk Assessment Technical Adequacy Documentation

3. Updated Final Safety Analysis Report Markups

U.S. Nuclear Regulatory Commission Page 2 of 28 Serial HNP-17-072 Enclosure

1. Summary Description The proposed change will incorporate the Tornado Missile Risk Evaluator (TMRE) Methodology into the Shearon Harris Nuclear Power Plant, Unit 1 (HNP) Updated Final Safety Analysis Report (UFSAR). The TMRE Methodology was transmitted to the NRC by the Nuclear Energy Institute (NEI) as NEI 17-02, Revision 1 (ADAMS Accession No. ML17268A036), and is incorporated by reference into this license amendment request (LAR). TMRE is proposed as a methodology for determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where tornado missile protection is not currently provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

2. Detailed Description 2.1 Background Information The NRC issued Regulatory Issue Summary (RIS) 2015-06, Tornado Missile Protection, on June 10, 2015 (ADAMS Accession No. ML15020A419). The RIS documented the following:

Systems, structures, and components (SSCs) of nuclear power plants are designed to withstand natural phenomena such as earthquakes, tornadoes, hurricanes, and floods without the loss of capability to safely maintain the plant. In general, the design bases for these structures, systems, and components reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed. The specific criteria for each nuclear power plant are contained in the individual plants specific licensing basis.

In the late 1970s and early 1980s several licensees identified components that did not conform to their plant specific licensing basis for tornado-generated missile protection.

Examples of nonconforming items included components not located inside structures designed to protect against tornados and tornado-generated missiles, components not provided with tornado missile barriers, and components not designed to withstand tornados and tornado missiles. Topical reports were submitted by the Electric Power Research Institute (EPRI) for NRC review of the probability-based TORMIS methodology. The TORMIS methodology determines the probability of components being struck and disabled by a tornado-generated missile, and was accepted for use by the NRC. In cases where some components were not in conformance with a plants licensing basis, licensees used the TORMIS methodology as a means for demonstrating that the probability of these components being struck by a tornado-generated missile was low enough to justify that protection from tornado-generated missiles was not required. Several licensees have incorporated the TORMIS methodology, or other probabilistic methodologies, into their plant specific licensing basis.

U.S. Nuclear Regulatory Commission Page 3 of 28 Serial HNP-17-072 Enclosure The industry and NEI developed an alternative risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles. TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

2.2 Current Licensing Basis (CLB)

General Design Criteria General Design Criteria (GDC) in existence in 1987 at the time when HNP was licensed for operation were contained in Appendix A to 10 CFR 50, GDC for Nuclear Power Plants, effective May 21, 1971, and subsequently amended July 7, 1971, and October 23, 1978. The two GDCs that relate to tornado missiles and high winds and that are applicable to HNP are GDC 2 and 4 and are stated as follows:

GDC 2 stated that structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these structures, systems, and components shall reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena and, (3) the importance of the safety functions to be performed.

GDC 4 stated that structures, systems, and components important to safety shall be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents including loss-of-coolant accidents. These structures, systems, and components shall be appropriately protected against dynamic effects, including the effects of missiles, pipe whipping, and discharging effects, that may result from equipment failures and from events and conditions outside the nuclear power unit.

However, dynamic effects associated with postulated pipe ruptures in nuclear power units may be excluded from the design basis when analyses reviewed and approved by the Commission demonstrate that the probability of fluid system piping rupture is extremely low under conditions consistent with the design basis for the piping.

Shearon Harris Safety Evaluation Report NRC staff issued NUREG-1038, Shearon Harris Safety Evaluation Report, to document the scope of their review during the initial licensing process. Excerpts relevant to tornado missile protection from NUREG-1038 include:

U.S. Nuclear Regulatory Commission Page 4 of 28 Serial HNP-17-072 Enclosure Section 3.5.1

• The tornado missile spectrum was reviewed in accordance with Standard Review Plan (SRP) 3.5.1.4 (NUREG-0800). Conformance with the acceptance criteria formed the basis for the staff evaluation of the tornado-missile spectrum with respect to the applicable regulations of 10 CFR 50. The portions of the SRP review procedures concerning the probability per year of damage to safety-related systems as a result of missiles were not used in the staff review.

• GDC 2 requires that structures, systems, and components essential to safety be designed to withstand the effects of natural phenomena, and GDC 4 requires that these same plant features be protected against missiles generated by natural phenomena. The missiles generated by natural phenomena of concern are those resulting from tornadoes. The applicant has identified a spectrum of missiles for a tornado Region I site as identified in RG 1.76, Position C.l, and has utilized missile Spectrum A of SRP 3.5.1.4 as the basis for the design of tornado-missile protection.

Section 3.5.2

• The structures, systems, and components to be protected from externally tornado-generated missiles were reviewed in accordance with SRP 3.5.2 (NUREG-0800)

• The applicant has identified all safety-related structures, systems, and components requiring protection from externally generated missiles. All safety-related structures are designed to withstand postulated tornado-generated missiles without damage to the safety-related equipment they contain. All safety-related systems and components and stored fuel are located within tornado-missile-protected structures or are provided with tornado-missile barriers.

• Based on the above, the staff concludes that the applicant's list of safety-related structures, systems, and components to be protected from externally generated missiles and the provisions in the plant design providing this protection are in accordance with the requirements of GDC 2 and 4 with respect to missile and environmental effects and the guidelines of RG 1.13, Position C.2; RG 1.27, Positions C.2 and C.3; and RG 1.117, Positions C.1 through C.3, concerning protection of safety-related plant features, including stored fuel and the ultimate heat sink, from tornado missiles.

Updated Final Safety Analysis Report Section 1.8, Conformance to NRC Regulatory Guides

• RG 1.76, Design Basis Tornado for Nuclear Power Plants

- HNP complies with RG 1.76, Rev. 0.

- HNP adopts the guidance provided in Regulatory Guide 1.76 Revision 1 as an optional design basis for new system modifications occurring after March 2007.

U.S. Nuclear Regulatory Commission Page 5 of 28 Serial HNP-17-072 Enclosure

• RG 1.117, Tornado Design Classification, Rev. 1

- The SHNPP project complies with this guide.

Section 2.3, Meteorology

• The SHNPP site lies within Region I for determining the Design Basis Tornado. The Region I associated Design Basis Tornado parameters are as follows:

Maximum wind speed 360 mph Rotational wind speed 290 mph Translational speed 70 mph maximum; 5 mph minimum Radius of maximum rotational speed 150 ft.

Pressure drop 3.0 psi Rate of pressure drop 2.0 psi/sec.

• Calculation of the tornado strike probability: Consequently, one would expect a tornado strike every 944 years.

Section 3.1, Compliance with NRC General Design Criteria 3.1.2 Criterion 2 - Design Bases for Protection Against Natural Phenomena

• The structures, systems and components important to safety are protected from or designed to withstand the effects of natural phenomena without loss of capability to perform their safety functions.

• The most severe natural phenomena considered in the design in terms of induced stresses are the safe shutdown earthquake (SSE) and the design basis tornado. Structures, systems, and components essential to the safe shutdown of the plant are designed to withstand the effects of the most severe natural phenomena, including floods, hurricanes, tornadoes or the SSE, as appropriate.

3.1.4 Criterion 4 - Environmental and Dynamic Effects Design Bases

• Structures, systems, and components are designed, arranged or protected such that the external missiles will not cause an accident which could result in the release of significant amounts of radioactivity or prevent safe plant shutdown.

• Failure of high pressure lines external to the Containment will not cause a LOCA (loss of coolant accident), or prevent safe shutdown of the Unit.

U.S. Nuclear Regulatory Commission Page 6 of 28 Serial HNP-17-072 Enclosure Section 3.3 Wind and Tornado Loadings Structures, systems, or components whose failure, due to design wind loading, tornado wind loading, or associated missiles, could prevent safe shutdown of the reactor, or result in significant uncontrolled release of radioactivity from the unit, are protected from such failure by one of the following methods:

a) the structure or component is designed to withstand design wind, tornado wind and tornado generated missiles, or b) the system or components are housed within a structure which is designed to withstand the design wind, tornado wind and tornado generated missiles.

Table 3.3.0-1 lists all safety related structures and the method of wind/tornado protection as applicable. The Ta or Tb designation in the table refers to item a or b above.

Section 3.5, Missile Protection Section 3.5.0 Missile Selection and Description The following criteria were adopted for assessing the plant's capability to withstand the missiles postulated in Sections 3.5.1.1 and 3.5.1.2:

a) No perforation of the Containment Building (i.e., no loss of leak tightness) b) Assurance that the plant can be maintained in a safe shutdown condition c) Offsite exposure within 10 CFR 100 guidelines for missile damage resulting in radioactivity release.

Sources considered capable of generating potential missiles are as follows:

a) Tornadoes All Seismic Category I structures are designed to withstand the tornado generated missiles specified in the "Missile Spectrum" of the Standard Review Plan 3.5.1.4 (Rev. 0) and listed in Table 3.5.1-3. All Seismic Category I structures are designed with f'c=4000 psi concrete and a minimum thickness of 24 inches in roofs and walls.

U.S. Nuclear Regulatory Commission Page 7 of 28 Serial HNP-17-072 Enclosure UFSAR Table 3.5.1-3, Tornado-generated Missile Spectrum Missile Weight Area (ft2) Velocity (fps)

Wood Plank

1. 200 .333 422 4 in. x 12 in. x 12 ft.

Steel Pipe 3 in. x 10 ft.

2. 78 .0155 211 schedule 40

3. Steel Rod 1 in. x 3 ft 8 .00545 317 Steel Pipe 6 in. x 15 ft.

4. 285 .0388 211 schedule 40 Steel Pipe 12 in. x 15 ft.

5. 743 .1014 211 schedule 40

6. Utility Pole 131/2 in. x 35 ft 1490 .994 211

7. Automobile 4000 20 106 These missiles are considered to be capable of striking in all directions. Missiles 1, 2, 3, 4 and 5 are considered at all elevations and Missiles 6 and 7 for elevations up to 30 feet above the highest grade level within 1/2 mile of the facility structures.

Section 3.5.1.4, Missiles Generated by Natural Phenomena

• The worst credible missiles generated by natural phenomena to be considered in SHNPP are those generated by the design basis tornado. All structures that house systems and components to be protected against tornado generated missiles and the types of protection have been presented in Table 3.5.1-2.

• The postulated tornado missiles include representative objects in the plant area which could be picked up or injected into the tornado wind field. The characteristics of the tornado generated missiles considered in the plant design are given in Table 3.5.1-3.

The missiles listed in this table are considered as striking in all directions.

• Structures, systems, and components whose failure could prevent safe shutdown of the reactor or result in significant uncontrolled release of radioactivity from the Unit are protected from such failure due to design tornado and wind loading of missiles by the following methods:

a) Structure or component is designed to withstand tornado loading or tornado missile.

b) Component is housed within a structure which is designed to withstand the tornado loading and tornado missile.

U.S. Nuclear Regulatory Commission Page 8 of 28 Serial HNP-17-072 Enclosure Section 3.5.2, SSCs to be Protected from Externally Generated Missiles

• Structures, systems, and components whose failure could prevent safe shutdown of the reactor or result in significant uncontrolled release of radioactivity from the Unit are protected against externally generated missiles; they are listed in Table 3.5.1-2.

• Most safety-related systems are located within structures that are specifically designed and constructed to withstand external missiles; therefore they are adequately protected.

The penetrations, access openings, and HVAC air intake and exhaust openings in these safety-related structures are protected by steel doors and/or concrete barriers designed to withstand external missiles.

2.3 Reason for the Proposed Change In response to RIS 2015-06, Duke Energy performed walkdowns at HNP to identify potential discrepancies with the HNP CLB related to tornado missile protection. Those walkdowns identified conditions where the plant configuration did not conform to the design and licensing bases. The non-conforming conditions were entered into the corrective action program and are summarized in Table 2.3 below.

Conditions that rendered the affected SSCs inoperable were processed in accordance with Enforcement Guidance Memorandum (EGM) 15-002 and DSS-ISG-2016-01, with short-term and long-term compensatory actions taken. That action resulted in those SSCs being restored to operable but nonconforming status. The conditions that satisfied reporting criteria of 10 CFR 50.72 and/or 10 CFR 50.73 were reported to the NRC in event notification 52072 and Licensee Event Report 2016-001 (ADAMS Accession No. ML16245A804).

As documented by the NRC in EGM 15-002, Enforcement Discretion for Tornado-generated Missile Protection Non-Compliance, tornado missile scenarios do not generally represent an immediate safety concern because their risk is bounded by the initiating event frequency and safety-related SSCs are typically designed to withstand the effects of tornados. The staffs study established that the core damage frequency (CDF) associated with tornado missile related non-compliances is well below a CDF requiring immediate regulatory action.

Table 2.3 Discovered Non-conforming Conditions System Component Turbine Driven Auxiliary Feedwater Pump exhaust pipe (3MS16-Auxiliary Feedwater 185SAB-1) is exposed to potential tornado missiles.

6.9 kV Standby AC A train Diesel Fuel Oil supply line (3FO2-42SA-1) to the Day Tank Power, Emergency in the Diesel Generator Building is exposed to potential tornado Diesel Generators missiles through Security door 1FP-D1133.

U.S. Nuclear Regulatory Commission Page 9 of 28 Serial HNP-17-072 Enclosure Table 2.3 Discovered Non-conforming Conditions System Component (EDG) Electrical conduits (17179Q SA and 16255V SA) in the Diesel Generator Building, EL 261 common corridor, are exposed to potential tornado missiles through multiple openings in the corridor exterior wall (two HVAC vent openings with personnel barriers installed, Unit 1 Security door 1FP-D1133, and Unit 2 Security door 1FP-D1134).

Inverted neck vent lines 7LO6-34-1, 7LO6-36-1, 7EA8-11-1, and 7EA8-13-1 located on the Diesel Generator Building roof are exposed to potential tornado missiles.

Conduits 17199K SA in the A EDG room and 17196X SB in the B EDG room are exposed to potential tornado missiles through the east exterior wall air intake louvers for each room.

A & B train EDG Fuel Oil Return lines are exposed to potential tornado missiles through the east exterior wall air intake louvers.

A train electrical conduits in the ESW Intake Screening Structure are exposed to potential tornado missiles through Security door 1FP-D1336. Affected conduits are 17049M SA, 12295C SA, 12219M SA, 12312D SA, 16091H SA, 16091ESA, 16091D SA, 16091C SA, 16091G SA, 16091A SA, 16149J SA, 12296J SA, and 12219J SA.

Conduits 12293E-SA and 13292C-SA, A Traveling Screen Wash supply line, A Traveling Screen motor, and Cabinet Y21-C7-ESF-A Emergency Service inside the A ESW pump room are exposed to potential tornado Water (ESW) missiles through penetration seals E2264, P4042, and E2266 in the A ESW Intake Structure east exterior wall.

The A or B ESW Traveling Screens are exposed to potential tornado missiles through a steel checkered plate covering the coarse screen and stop log guides.

The A or B ESW Traveling Screens are exposed to potential tornado missiles above the water if the Main Reservoir is at the lowest level allowed by Technical Specifications The EL 305 HVAC exhaust plenums for both the 1A-SA and 1B-SB Battery Rooms within the Main Steam Penthouse on the RAB EL Battery Room 305 roof are susceptible to missiles. The EL 305 HVAC exhaust Ventilation duct and motor operator for A and B RAB SWGR RM (1AV-11:002 and 1AV-13:002) are exposed to potential tornado missiles.

1MS-81, 1MS-83, and 1MS-85 are exposed to potential tornado missiles through two Main Steam pipe openings in the Main Steam Penthouse on the RAB EL 305 roof in the east penthouse wall Main Steam The Main Steam Safety Relief Valve vent pipes/stacks and the Main Steam Power Operated Relief Valve vent pipes/stacks on the RAB EL 305 roof are exposed to potential tornado missiles.

U.S. Nuclear Regulatory Commission Page 10 of 28 Serial HNP-17-072 Enclosure Table 2.3 Discovered Non-conforming Conditions System Component Electrical conduits 112751R SA and 12751A SA and supply fan S64 S3 SA located in the Main Steam EL 305 HVAC A Train Supply Air Intake pillbox are exposed to potential tornado missiles through Security door 1FP-D0515 and through louvered HVAC air Intakes Main Steam Tunnel with steel personnel barriers.

Ventilation Electrical conduits 12753A SB & 12753J SB and supply fan S65 S3 SB located in the Main Steam EL 305 HVAC B Train Supply Air Intake pillbox are exposed to potential tornado missiles through Security door 1FP-D0516 and through louvered HVAC air Intakes with steel personnel barriers.

The A and B train Essential Services Chilled Water System Expansion Tanks 1CH-E085 and 1CH-E086 and the 2 connecting Essential Services pipe at RAB EL 324 are exposed to potential tornado missiles Chilled Water through outside air intake openings in the Reactor Auxiliary Building EL 324 exterior walls. There are 3 large openings through 41 line wall and 3 through 45 line wall.

The Reactor Auxiliary Building roof HVAC Exhaust Stack 1AV-ERABVS is exposed to potential tornado missiles.

Reactor Auxiliary Reactor Auxiliary Building EL 305 Outdoor Ambient Air Pressure Building Sensing Instrument Tubing PDT-1AV-4834-A1SAHP-T378 (A Train) and PDT1AV4834B1SBHP-T379 (B Train) are exposed to potential tornado missiles.

Outdoor air temperature elements TE-01EV-6589ASA, TE-01EV-6589BSB, TE-01EV-6591ASA, and TE-01EV-6591BSB are ESW Intake Structure vulnerable to potential tornado missiles.

Ventilation Electrical conduit 17072F-SB inside the B ESW electrical room is exposed to potential tornado missiles through Security door 1FP-D1173 opening.

Outdoor Ambient Air Pressure Sensing Instrument Tubing PDT-Fuel Handling Building

• 1FL-5027ASA-T368 and PDT-*1FL-5027BSB-T370 are exposed to Ventilation potential tornado missiles.

Diesel Generator Outdoor air temperature elements TE-6902A-SA and TE-6902B-SB Building Ventilation are vulnerable to potential tornado missiles.

Plant modifications to restore compliance with the CLB would have very limited safety benefit but would require extensive resources, and would divert those resources from more safety significant activities. NRC approval of the TMRE Methodology and this license amendment request would revise the HNP CLB to restore the non-conforming conditions to full qualification.

Utilization of risk insights in the allocation of NRC staff and industry resources is consistent with the NRC policy.

U.S. Nuclear Regulatory Commission Page 11 of 28 Serial HNP-17-072 Enclosure 2.4 Description of the Proposed Change Duke Energy requests NRC approval to incorporate the Tornado Missile Risk Evaluator (TMRE)

Methodology into the HNP UFSAR. TMRE is proposed as a methodology for determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where tornado missile protection is not currently provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE Methodology was transmitted to the NRC by NEI as NEI 17-02, Revision 1 (ADAMS Accession No. ML17268A036) and is hereby incorporated by reference into this LAR.

The proposed change:

• revises the HNP UFSAR Section 1.8, Conformance to NRC Regulatory Guides (RG) related to RG 1.117, Tornado Design Classification. RG 1.117 describes a method acceptable to the NRC staff for identifying those SSCs of light-water-cooled reactors that should be protected from the effects of the Design Basis Tornado. This LAR proposes to add an alternative methodology to the HNP UFSAR, TMRE, to describe a method to determine whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process;

• revises the HNP UFSAR section 3.5.1.4 to include the TMRE Methodology;

• added Note 2 to Table 3.5.1-2, Outdoor Safety-Related Structures, Systems, and Components Protected Against Tornado Generated Missiles, to reference exceptions using the TMRE Methodology; and

• revises the HNP UFSAR to add Table 3.5.1-2a, Safety-Related Structures, Systems And Components That Do Not Require Protection from Tornado Generated Missiles Based on Tornado Missile Risk Evaluator Methodology.

The HNP UFSAR markups are in Attachment 3.

3. Technical Evaluation The NRCs policy statement on probabilistic risk assessment (PRA) encourages greater use of PRA techniques to improve safety decision-making and improve regulatory efficiency. One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis, provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants LB, as in requests for license amendments and technical specification changes under 10 CFR 50.90. TMRE is proposed as a risk-informed methodology for evaluating the impact of existing conditions where tornado missile protection is required in a licensees CLB, but the required protection was not provided. For conditions that meet the acceptance criteria of the methodology, the HNP licensing basis would be revised.

U.S. Nuclear Regulatory Commission Page 12 of 28 Serial HNP-17-072 Enclosure GDC 2 requires that SSCs important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions. GDC 4 requires that SSCs important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes. Regulatory Guide (RG) 1.117, Tornado Design Classification, Revision 1, describes a method acceptable to the NRC staff for identifying those SSCs of light-water-cooled reactors that should be protected from the effects of the Design Basis Tornado, including tornado missiles, and remain functional. TMRE is proposed as an alternative methodology for identifying whether certain SSCs must be protected from the effects of tornado missiles. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

3.1 Tornado Missile Risk Evaluator Methodology The TMRE Methodology employs a simplified, conservative assessment of risks to core damage and large early release posed by tornado-generated missiles at nuclear plants. The guidance for use of the methodology is found in NEI 17-02, Tornado Missile Risk Evaluator Industry Guidance Document, Revision 1, which is incorporated by reference into this LAR. The guidance document provides a detailed approach to gathering the necessary information and translating the information into a PRA model. The risk assessment methods, acceptance criteria, and five principles of risk-informed decision-making found in NRC RG 1.174 are used to determine whether risks posed by potential tornado missiles at a site warrant protective measures.

3.2 Traditional Engineering Considerations Two of the five key principles of risk-informed decision making address the traditional engineering considerations of defense-in-depth and maintaining sufficient safety margins. Those two considerations are discussed below with respect to the proposed change to the HNP licensing basis. The remaining principles will be discussed in section 4 of this LAR.

The proposed change is consistent with a defense-in-depth philosophy.

Defense-in-depth is an approach to designing and operating nuclear facilities to prevent and mitigate accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. No individual failure, including one caused by the impact of a tornado missile, would prevent the fulfillment of a safety function.

• A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o No new accidents or transients are introduced with the proposed change, and the facility is still well protected from tornado missiles.

o The proposed change does not significantly impact the availability and reliability of SSCs that provide safety functions that prevent challenges from progressing to

U.S. Nuclear Regulatory Commission Page 13 of 28 Serial HNP-17-072 Enclosure core damage. The magnitude of the change is consistent with the guidance of Regulatory Guide 1.174.

o None of the non-conforming conditions in the TMRE model only affect LERF, which is an indication that there was no significant impact on prevention of containment failure.

o The change does not significantly reduce the effectiveness of the emergency preparedness program including the ability to detect and measure releases of radioactivity, notify offsite agencies and the public, and shelter or evacuate the public as necessary.

• Over-reliance on programmatic activities as compensatory measures associated with the change in the LB is avoided.

o Implementation of the proposed change does not require compensatory measures. The risk assessment associated with this LAR gave no credit to compensatory measures implemented in response to the non-conforming conditions.

o No plant operating procedures will be changed to implement the proposed change.

o The proposed change does not rely upon proceduralized operator actions within an hour of a tornado passing that would require operators to travel into areas that are not protected from the effects of the tornado or tornado missiles.

• System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

o The proposed change does not modify the redundancy, independence, or diversity described in the HNP UFSAR. The proposed change does not result in a disproportionate increase in risk.

o The HNP UFSAR documents a tornado strike frequency of 944 years, which is an infrequent event and which is unchanged by this LAR.

o The proposed change has no impact on the assumptions in the HNP safety analyses presented in the UFSAR, chapters 6 or 15.

o The proposed change has no impact on the availability or reliability of SSCs that could either initiate or mitigate events, with the exception of tornado missile protection, which is thoroughly evaluated in this LAR.

o Equipment available both onsite and offsite supporting Diverse and Flexible Coping Strategies (FLEX) could be utilized if needed to mitigate the impact of a tornado missile. Critical equipment is stored in structures that would prevent it from being impacted by a tornado or tornado missile.

• Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

U.S. Nuclear Regulatory Commission Page 14 of 28 Serial HNP-17-072 Enclosure o The non-conforming conditions are physically distributed about the HNP site, so there is a low likelihood of multiple SSCs being impacted.

o The missiles affecting emergency diesel generator or emergency service water systems would not affect the alternate seal injection diesel, which is independent of those two systems. Although the alternate seal injection diesel is not protected from tornado missiles, it is in a location with limited exposure to tornado missiles due to it being located below grade in a hole with reinforced concrete walls. It is not in the near proximity to either the emergency diesel generators or the emergency service water systems. As a result, the critical safety function of providing reactor coolant pump seal flow and DC battery charging would be preserved unless multiple missiles affected both the primary and backup functions, a very low likelihood condition.

• Independence of barriers is not degraded.

o Of the three fission product barriers, neither the fuel clad nor reactor coolant system piping is directly exposed to tornado missiles, and the containment remains a robust tornado missile barrier.

o The proposed change does not significantly increase the likelihood or consequence of an event that challenges multiple barriers, and does not introduce a new event.

o Although the proposed change does slightly increase the frequency of core damage, that increase is very small and has no significant impact on the fission product barriers.

• Defenses against human errors are preserved.

o HNP has symptom-based abnormal operating procedures and emergency operating procedures that would be utilized in the event of a tornado adversely impacting safety-related equipment. The procedures provide guidance to operators for preservation of critical safety functions. The procedures include guidance in the event response not obtained, which provide alternative actions if equipment was damaged by tornadoes or other reasons.

o Implementation of the proposed change will not create new human actions that are important to preserving the layers of defense, or significantly increase mental or physical demand on individuals responding to a tornado.

o HNP has a procedure that prescribes actions to be taken by plant staff in the event of a tornado watch, tornado warning, and after a tornado has passed. This includes post-tornado walkdowns for tornado missile vulnerable SSCs. It includes a table of plant vulnerabilities to tornado-generated missiles and recovery actions that reduce the impact of a tornado missile affecting the identified SSCs.

o Proceduralization of safety-significant operator actions, coupled with training and standards for procedure compliance, preserve the defense against human errors.

• The intent of the plants design criteria is maintained.

U.S. Nuclear Regulatory Commission Page 15 of 28 Serial HNP-17-072 Enclosure o This LAR only affects plant design criteria related to tornado missile protection, and a very small fraction of the overall system areas would remain not protected from tornado missilies. All other aspects of the plant design criteria are unaffected.

o This LAR maintains the intent of the plant design criteria for tornado missile protection, which is to provide reasonable assurance of achieving and maintaining safe shutdown in the event of a tornado. The evaluation performed and documented in this LAR demonstrates that the risk associated with the proposed change is very small and within accepted guidance for protection of public health and safety.

o The methodology cannot be used in the modification process for a future plant change to avoid providing tornado missile protection. Therefore, the intent of the plants design criteria is maintained.

o Protection of the identified SSCs would have assured they would not be damaged by design basis tornado missiles. In lieu of protection for the identified nonconforming SSCs, HNP has analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequent effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact is known, and it is negligible. Therefore, the intent of the plants design criteria is maintained.

The proposed change maintains sufficient safety margins.

There are few non-conforming conditions. The vast majority of each system important to safety remains protected from tornado missiles, consistent with the CLB. The identified vulnerabilities represent a small fraction of the potential target area of the system. The likelihood of redundant trains both being impacted by tornado missiles is much lower than the likelihood of a single train being impacted. The TMRE Methodology includes a conservative treatment of conditions where a single tornado missile could impact more than one component through physical correlation.

The number of potential missiles identified at HNP is approximately 40% less than the number of missiles assumed by the TMRE Methodology.

HNP has diverse and flexible coping strategies to restore critical safety functions in the event of a hypothetical loss of the primary functions. In some cases, non-safety-related equipment could function to mitigate the impact of a hypothetical tornado missile strike to safety-related equipment. For example, the alternate seal injection diesel and two FLEX diesel generators could mitigate the impact of loss of one or both emergency diesel generators. FLEX portable pumps could mitigate the impact of loss of either Auxiliary Feedwater pumps or Emergency Service Water pumps. Important FLEX equipment is stored in a building designed to protect from the effects of a tornado, including tornado missiles. Written procedures provide guidance for implementing those actions.

Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved by the NRC) continue to be met. The proposed change is not in conflict with approved codes and standards relevant to the SSCs.

U.S. Nuclear Regulatory Commission Page 16 of 28 Serial HNP-17-072 Enclosure The safety analysis acceptance criteria in the licensing basis are unaffected by the proposed change. The requirements credited in the accident analyses will remain the same.

Therefore, the proposed change maintains sufficient safety margins and continues to protect public health and safety.

3.3 Risk Assessment The TMRE Methodology is used to estimate the quantitative risk associated with tornado-generated missiles for discrepancies with the HNP CLB related to tornado missile protection. It makes use of the HNP internal events PRA model, which was used to estimate the risk associated with the passage of a tornado over the HNP site.

The TMRE is a hybrid methodology comprised of two key elements: (1) a deterministic element to establish the likelihood that a specific SSC (target) will be struck by tornado-generated missile; and (2) a probabilistic element to assess the impact of the missile strike on the core damage and large early release frequencies.

The output of the deterministic element is a calculated Exposed Equipment Failure Probability (EEFP) that is based largely on a simplified generic relationship between tornado strength and the population of materials at a typical nuclear power plant that may become airborne during a tornado. Site-specific inputs to the EEFP include the frequency of a tornado striking the site and the size and location of the target SSCs being evaluated. The output of the probabilistic element is an estimation of an increase in core damage frequency and large early release frequency.

3.3.1 High Winds Equipment List (HWEL)

The TMRE HWEL was developed using the current HNP high winds analysis. The HWEL was re-evaluated with the TMRE Methodology. The HWEL identifies potential vulnerable components that needed to be walked down. The following was considered in the update of the HWEL.

• The non-conformance items were added to the list.

• Items screened based on being in Category I structures were reviewed for the presence of potential missile paths

• The TMRE model uses the loss of offsite power (LOSP) sequences with no offsite power recovery, therefore PRA logic and components that do not support mitigating a LOSP can be screened.

• Operator actions were assessed based on the TMRE Methodology. Internal events PRA data were used to perform the assessment of the operator actions. An operator review was performed for the TMRE operator action assessment. An individual with HNP Auxiliary Operating experience was provided the list of credited and not credited operator actions to verify exposed operator actions were not being credited in the TMRE PRA.

U.S. Nuclear Regulatory Commission Page 17 of 28 Serial HNP-17-072 Enclosure 3.3.2 Target Walkdowns The walkdowns considered the following:

1. Locate and identify the SSC; verify that the SSC is located where it is documented to be.

Note any support systems or subcomponents, such as electrical cabling, instrument air lines, and controllers.

2. Document and describe barriers that could prevent or limit exposure of the SSC to tornado missiles; Photograph any barriers that could prevent tornado missiles from impacting the SSC. This may include barriers or shielding designed to protect an SSC from tornado missiles, as well as other SSCs that may preclude or limit the exposure of the target SSC to missiles (e.g., buildings, large sturdy components).

3. Identify directions from which tornado missiles could strike the target.

4. Determine and/or verify the dimensions of the target SSCs, including any subcomponents or support systems. Missile exposure area can be limited when missiles are blocked by barriers.

5. Determine the proximity and potential correlation to other target SSCs. For the purpose of the TMRE, correlated targets are SSCs that can be struck by the same tornado missile.

6. Note any nearby large inventories of potential tornado missiles.

7. Proximity of non-Category I structures to exposed target SSCs should be documented. A non-Category I structure may collapse or tip-over and cause damage to an SSC.

8. Identify vent paths for tanks that may be exposed to atmospheric pressure changes.

3.3.3 Missile Walkdowns Missiles were counted in a 2500-foot radius around the center of the containment building.

Structural and non-structural missiles are considered. HNP has existing missile counts, but these counts only cover 600 feet from PRA targets. Additional missile counts were required to address the gaps.

The estimated missiles based within the 2500 ft radius is summarized in Table 3.3.3 with a total missile estimate of 139,411. This missile count is bounded by and justifies the use of the generic missile count from the TMRE guidance which is 240,000.

Table 3.3.3 TMRE Missile Counts Source Non-Structural Structural Totals Within 600 feet 13,106 68,918 82,024 Greater than 600 feet but 19,000 57,387 38,387 less than 2500 feet Total of all missiles 139,411

U.S. Nuclear Regulatory Commission Page 18 of 28 Serial HNP-17-072 Enclosure 3.3.4 Tornado Hazard Frequency The guidance in NEI 17-02, Revision 1, and data in NUREG/CR-4461, Revision 2, were used to determine the tornado initiating event frequencies for the HNP TMRE PRA model. Site-specific tornado frequencies for applicable tornadoes were developed as a result of this effort.

NUREG/CR-4461 provides tornado strike data for HNP with wind speeds associated with varying frequencies per year. For the purposes of the TMRE, the Fujita prime scale (F) is used to classify tornadoes; this scale is somewhat different from the original Fujita Scale and the Enhanced Fujita Scale. Using this data, a site-specific tornado hazard curve was developed, and the frequency of all tornadoes considered in the TMRE (F2 through F6) was calculated.

Since F probabilities are not directly available, they are derived from site specific Fujita scale data available in Table 6-1 of NUREG/CR-4461.

In accordance with the guidance the TMRE Methodology, plotting the HNP points in a XY scatter chart with a logarithmic trend line the following HNP specific hazard curve is created.

Miles per Hour (mph) = -22.8

• ln(Frequency) - 98.333 R-squared = 0.9985 Using the trend line equation, exceedance frequencies for the upper ranges of each F category, F2 through F6 were calculated and are tabulated in Table 3.3.4.

Table 3.3.4 TMRE Tornado Hazard Frequencies Fujita prime Frequency per year F2 1.10E-4 F3 2.75E-5 F4 7.05E-6 F5 1.33E-6 F6 7.09E-8 3.3.5 Target Evaluation The list of potentially vulnerable targets to tornado missile that are modeled in the PRA and support LOSP mitigation are identified and characterized. These targets have been added to the TMRE model. The failure probability of the targets is calculated using the Exposed Equipment Failure Probability (EEFP). The EEFP is the conditional probability that an exposed target is hit and failed by a tornado missile, given a tornado of a certain magnitude. For a single target, five EEFP values will be calculated, one each for tornado categories F2 through F6.

U.S. Nuclear Regulatory Commission Page 19 of 28 Serial HNP-17-072 Enclosure The EEFP is defined as:

EEFP = (MIP) x (# of Missiles) x (Target Exposed Area) x Fragility

• The Missile Impact Parameters (MIP) is the probability of a tornado missile hit on a target, per target square area, per missile, per tornado. Generic MIP values are provided in Table 5-1 of NEI 17-02, Revision 1.

• # of Missiles is the number of damaging missiles; the generic values recommended in Section 5 of NEI 17-02, Revision 1 are applied. The robust percentage applied to the missiles may be larger than recommended in the TMRE Methodology, which is conservative.

• Target Exposed Area is determined for each specific target.

• Fragility is the conditional probability of the target failing to perform its function given that it is hit by a tornado missile. For the purposes of the TMRE, it is assumed to be 1.0.

• If the EEFP calculated is greater than 1.0, a 1.0 failure probability is applied in the model.

The TMRE EEFP Evaluation Results are in Table 3.3.5, located in Attachment 1.

3.3.6 Model Development The TMRE model is developed using the current internal events model. The HNP general transient tree addresses steam loss in the turbine building, loss of service water, Loss of primary makeup, LOSP, and transient induced LOCAs (i.e. seal failure or primary relief valve failure). The transients sequence applied to the LOSP initiating events address the tornado damage states expected based on a review of the vulnerable equipment and the LOSP. The tornado initiating events for TMRE are added to the model at the LOSP initiating event location in the fault tree. The equipment vulnerable to tornado missiles were added to the model using the EEFP events with values from Table 3.3.5.

Some of the non-conformances were screened as having negligible impact on risk, and were therefore not explicitly modeled. Three penetrations at the A ESW Intake Structure had a combined effective area of approximately nine square feet, which met the De Minimis definition of the TMRE Methodology, and were therefore screened out assuming a negligible impact on risk. For the purpose of this pilot LAR for TMRE, a sensitivity analysis was performed to justify the approach, which is documented in Section 3.3.9.2.

Several of the non-conforming conditions were safety-related features that had previously been evaluated to have a negligible impact on the Regulatory Guide 1.200 compliant HNP Internal Events PRA and therefore are not explicitly modeled. Because the TMRE Methodology uses the Internal Events PRA, the hypothetical impact of a tornado missile on those features also has a negligible impact on the risk associated with tornado missile protection. Non-conforming features in this category are listed below.

U.S. Nuclear Regulatory Commission Page 20 of 28 Serial HNP-17-072 Enclosure

• ESWIS Cover Plate protecting ESW Main Intake Suction

• ESW Intake Bay Traveling Screens

• 1A-SA & 1B-SB Battery Room exhaust

• RAB EL 305 Safety Related Conduit Supply Fan S64 Main Steam Tunnel HVAC

• RAB EL 305 Safety Related Conduit Supply Fan S65 Main Steam Tunnel HVAC

• ESW Intake Structure Temp elements fed from Safety Related Conduits 13292B- SB, 13292C SA, 13292F SB & 13292G SB

• FHB EL 286 Roof Exposed instrument tubing sensing outside air pressure. PDT-*1FL-5027ASA at 39 line wall PDT-*1FL-5027BSB at 45 line wall. A and B Fuel Handling Building Emergency Exhaust System (FHBEES) 3.3.7 Model Quantification and Results The TMRE model was quantified with tornado hazard frequencies identified in Table 3.3.4. A truncation study was performed to ensure adequate model convergence. The CDF was truncated at 1E-11/year and the LERF was truncated at 1E-12/year. The core damage frequency (CDF) and larger early release frequency (LERF) for the degraded and compliant plant are in Table 3.3.7.-1 Per Regulatory Guide 1.174, a risk-informed License Amendment Request (LAR) includes an evaluation of the change in risk (e.g., CDF). For the purposes of the TMRE, a licensee needs to calculate this change in risk by comparing two different configurations: the Compliant Case (configuration with the plant built per the required design/licensing bases), and the Degraded Case (current plant configuration, including potential non-conformances for tornado missile protection).

The CDF and LERF are simply calculated as follows:

CDF = CDFDegraded - CDFCompliant LERF = LERFDegraded - LERFCompliant The TMRE results for HNP are 2.2E-8 per year CDF and 2.2E-9 per year LERF.

Table 3.3.7-1 Quantification Results CDF LERF Result Type per Year per Year Degraded 5.44E-7 5.77E-8 Compliant 5.22E-7 5.55E-8 Delta 2.2E-8 2.2E-9 Targets were reviewed for CDF contribution in both the degraded and compliant cases. The only target contributing to CDF in the compliant model was the Refueling Water Storage Tank (RWST). The RWST contributes slightly less CDF contribution in the compliant case versus the degraded case due to the additional equipment availability from assuming the non-conformances are protected. The EDGs and RWST are the most important targets in the degraded case, which is expected due to the assumption of non-recovered LOSP in the model.

U.S. Nuclear Regulatory Commission Page 21 of 28 Serial HNP-17-072 Enclosure LERF results are in general agreement with CDF results and there are not targets in the TMRE model that only affect LERF. A summary of the risk impact of non-conformances is in Table 3.3.7-2, located in Attachment 1.

3.3.8 Tornado Intensity Contribution The tornado initiating event contribution is provided in Table 3.3.8 for the degraded and compliant model results. The non-conformances slightly increase the high wind class contribution in the degraded cases, but the trend of decreasing contribution with increasing tornado intensity is consistent between the compliant and degraded models.

Table 3.3.8 Initiating Event Contribution Event Name Frequency  % CDF  % CDF Description Contribution Contribution Degraded Compliant

%TMRE_F2 1.10E-04 73.8% 75.3% TMRE Tornado Event F2

%TMRE_F3 2.75E-05 19.4% 18.9% TMRE Tornado Event F3

%TMRE_F4 7.05E-06 5.4% 4.8% TMRE Tornado Event F4

%TMRE_F5 1.33E-06 1.3% 0.9% TMRE Tornado Event F5

%TMRE_F6 7.09E-08 0.04% 0.02% TMRE Tornado Event F6 3.3.9 Sensitivities The TMRE Methodology identifies sensitivity studies that should be performed and documented if the if the CDF or LERF between the compliant and the degraded case exceed 1E-7/year or 1E-8/year, respectively. The HNP results are below this threshold therefore these sensitivity studies are not performed.

The PRA model and results were reviewed for significant conservative, non-conservative, and uncertainty impacts that could impact the delta risk assessment. The following tornado model impacts were identified for additional review.

1. There has been some general concern that various high winds risk methods may be conservative such as the assumed failure of offsite power for category 2 and greater tornados. These conservative treatments have potential to impact the delta risk calculations non-conservatively. A bounding sensitivity assessment was performed to ensure conservative modeling treatments do not impact the risk assessment conclusions.

2. The De Minimis penetration risk was evaluated to ensure it has a negligible impact on the assessment conclusions.

U.S. Nuclear Regulatory Commission Page 22 of 28 Serial HNP-17-072 Enclosure 3.3.9.1 Conservative Risk Treatments Masking Sensitivity There is a concern that conservative assumptions in the compliant case can mask delta risk estimates. A potential example of this occurring is where a system that supports equipment with identified non-conformance is assumed to fail. The assumed failure of this support system can result in the non-conformance being assumed failed in both the compliant and degraded case.

Although the conservative assumption increases both the degraded model risk and the compliant model risk, there is potential to have a larger impact on the compliant model resulting in underestimating delta risk by over estimating the compliant model risk.

Some identified areas of concern are the assumed failure of offsite power without recovery, failure of exposed operator actions, conservative EEFP treatment of targets, and assumed failure of active exposed components. This is not intended to be a complete list, but examples of identified concerns.

Because the non-conservatism is related to the compliant model resulting in higher estimated risk results, an assessment of these potential conservative assumptions can be bounded by performing a single sensitivity where the compliant risk model results are set to zero. Thus, the delta risk will be equal to the degraded case risk. The results of this sensitivity are shown in Table 3.3.9.

Table 3.3.9 Conservative Risk Masking Sensitivity Result Type CDF (per Year) LERF (per Year)

Degraded 5.4E-7 5.8E-8 Compliant 0 0 Delta Risk 5.4E-7 5.8E-8 The sensitivity results are 5.4E-7 per year CDF and 5.8E-8 per year LERF. This demonstrates that the potential of conservative assumptions in the delta-risk calculations masking a risk significant result had, at most, a small and acceptable impact.

3.3.9.2 De Minimis Penetration Sensitivity One target set in the HNP TMRE model was determined to be less than 10 square feet and meets the De Minimis screening criteria in the TMRE Methodology. Several penetration seals through the A ESW east exterior wall were found. Several safety related components inside the A ESW pump room are exposed through these penetrations to a tornado missile strike, which could render the A train ESW inoperable. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles and was therefore screened out, consistent with the TMRE Methodology, Section 3.1. This sensitivity will add this target back into the model and determine the actual impact on results.

The combined area of the three penetrations result in approximately 9 square feet of exposure.

The penetrations are sealed fire barriers, but the fire sealant or the pipes are not credited for shielding tornado missiles in this sensitivity. The model was re-quantified. The delta CDF increases by 2E-9 per year and the delta LERF increases by 3E-10 per year. The delta risk

U.S. Nuclear Regulatory Commission Page 23 of 28 Serial HNP-17-072 Enclosure increases due to De Minimis penetration are small and have a negligible impact on the TMRE conclusions.

3.3.10 Risk Assessment Conclusions The TMRE guidance provided in NEI 17-02, Revision 1 was followed without exception and no deviations were applied.

The total change in risk associated with tornado missile damage to non-conforming conditions identified in Table 2.3 results in a CDF of 2.2E-8 per year and LERF of 2.2E-9 per year. The tornado risk change for accepting HNP non-conforming conditions results in a very small risk increase (Region III) per RG 1.174.

3.4 Technical Evaluation Conclusions Utilization of TMRE, which employs a probabilistic approach permitted in regulatory guidance, is a sound and reasonable method of addressing tornado missile protection at HNP for certain SSCs that are not fully protected from the effects of tornado missiles. The proposed change would revise the UFSAR to make TMRE part of the HNP licensing basis for conformance to 10 CFR 50 General Design Criteria 2 and 4. Future discovery of existing tornado missile protection non-conforming conditions will continue to be evaluated using the corrective action program.

The TMRE Methodology could be used to resolve those non-conforming conditions by revising the CLB under 50.59, provided the acceptance criteria are satisfied and conditions stipulated by the staff in the safety evaluation approving the requested amendment are met. Future modifications to the facility requiring tornado missile protection would not be evaluated using the TMRE Methodology. The TMRE Guidance, provided in NEI 17-02, Revision 1, was followed without exception and no deviations were applied.

4. Regulatory Evaluation 4.1 Applicable Regulatory Requirements/Criteria The NRC requires that nuclear power plants be designed to withstand the effects of natural phenomena, including tornado and high-wind-generated missiles, so as not to adversely impact the health and safety of the public in accordance with the requirements of 10 CFR 50, Appendix A, General Design Criterion (GDC) 2, "Design Bases for Protection against Natural Phenomena," and GDC 4, "Environmental and Dynamic Effects Design Bases." Methods acceptable to the NRC to comply with the aforementioned regulations are described in Regulatory Guides (RG) 1.117, Tornado Design Classification, and NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants" (SRP),

Section 3.5.1.4, Missiles Generated by Natural Phenomena, and Section 3.5.2, Structures, Systems, and Components to be Protected from Externally- Generated Missiles.

SRP Sections 3.5.1.4 and 3.5.2, contain the current acceptance criteria governing tornado missile protection. These criteria generally specify that SSCs that are important to safety be provided with sufficient, positive tornado missile protection (i.e., barriers) to withstand the maximum credible tornado threat. The appendix to RG 1.117, lists the types of SSCs that should be protected from design basis tornadoes. However, SRP Section 3.5.1.4 permits

U.S. Nuclear Regulatory Commission Page 24 of 28 Serial HNP-17-072 Enclosure relaxation of the above deterministic criteria if it can be demonstrated that the frequency of damage to unprotected essential safety-related features is sufficiently small.

To use this probabilistic criterion, NEI developed the TMRE Methodology, NEI 17-02, Revision 1, transmitted to the NRC staff in September 2017, which is incorporated by reference into this LAR. NEI 17-02, Revision 1, contains guidance for application of the methodology and the technical basis for its acceptability. This LAR requests NRC approval for use of the TMRE Methodology in lieu of the deterministic methodology when assessing the need for positive tornado missile protection for specific safety-related plant features in accordance with the criteria of SRP Section 3.5.1.4.

This LAR utilizes a risk-informed change process consistent with the guidelines of Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk Informed Decision on Plant-Specific Changes to the Licensing Basis. As discussed in RG 1.174, in implementing risk-informed decision-making, licensing basis changes are expected to meet a set of key principles. Some of these principles are written in terms typically used in traditional engineering decisions (e.g., defense-in-depth). While written in these terms, it should be understood that risk analysis techniques can be, and are encouraged to be, used to help ensure and show that these principles are met. These principles include the following:

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption.

The proposed change continues to meet current regulations including 10 CFR 50, Appendix A, GDC 2 and GDC 4. No exemptions are requested or required to implement this LAR upon approval by the NRC. Standard Review Plan section 3.5.1.4 permits relaxation of deterministic criteria if it can be demonstrated that the frequency of damage to unprotected safety-related features is sufficiently small. Regulatory Guide 1.174 establishes criteria, approved by the NRC, to quantify the sufficiently small frequency of damage. Application of the TMRE Methodology to the unprotected features at HNP demonstrates that the RG 1.174 criteria are met.

2. The proposed change is consistent with a defense-in-depth philosophy. This is discussed in Section 3.2 of this enclosure.

3. The proposed change maintains sufficient safety margins. This is discussed in Section 3.2 of this enclosure.

4. When proposed changes result in an increase in CDF or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement.

The NRCs policy statement on probabilistic risk assessment encourages greater use of this analysis technique to improve safety decision making and improve regulatory efficiency. One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis.

RG 1.174 provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants licensing basis, as in requests for license amendments under 10 CFR 50.90, Application for Amendment of License, Construction

U.S. Nuclear Regulatory Commission Page 25 of 28 Serial HNP-17-072 Enclosure Permit, or Early Site Permit, RG 1.174 describes an acceptable method for the licensee and NRC staff to use in assessing the nature and impact of licensing basis changes when the licensee chooses to support the changes with risk information.

RG 1.174 also makes use of the NRCs Safety Goal Policy Statement. One key principle in risk-informed regulation is that proposed increases in CDF and risk are small and are consistent with the intent of the Commissions Safety Goal Policy Statement. The safety goals and associated quantitative health objectives define an acceptable level of risk that is a small fraction of other risks to which the public is exposed. The acceptance guidelines defined in Section 2.4 of RG 1.174 are based on subsidiary objectives derived from the safety goals and their quantitative health objectives.

Application of the TMRE Methodology to the unprotected features at HNP demonstrates that the RG 1.174, section 2.4, criteria are met, and therefore, the change is small and consistent with the intent of the Commissions Safety Goal Policy Statement.

5. The impact of the proposed change should be monitored using performance measurement strategies.

The TMRE Methodology, Section 8, describes post license amendment configuration change control. Duke Energy programs and processes will ensure that subsequent configuration changes are evaluated for their impact on the TMRE evaluation. Changes, whether permanent or temporary due to construction, that increase the site missile burden within the 2500' missile radius above the 240,000 missiles assumed in the methodology will be evaluated for impact on the TMRE analysis.

The risk evaluation supporting this change was performed using the HNP Internal Events model. RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors. Attachment 2 to this Enclosure provides documentation that the PRA evaluation is of sufficient quality to support the proposed change.

The proposed change does not affect compliance with these regulations or guidance and will ensure that the lowest functional capabilities or performance levels of equipment required for safe operation are met.

4.2 No Significant Hazards Consideration Analysis The proposed change will incorporate the Tornado Missile Risk Evaluator (TMRE) Methodology into the Shearon Harris Nuclear Power Plant, Unit 1 (HNP) Updated Final Safety Analysis Report (UFSAR). The TMRE Methodology was transmitted to the NRC by the Nuclear Energy Institute as NEI 17-02, Revision 1 (ADAMS Accession Number ML17268A036), and is incorporated by reference into this license amendment request. TMRE is proposed as a methodology for determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where tornado

U.S. Nuclear Regulatory Commission Page 26 of 28 Serial HNP-17-072 Enclosure missile protection is not currently provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

Duke Energy has evaluated whether a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1) Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed amendment does not involve an increase in the probability of an accident previously evaluated. The relevant accident previously evaluated is a Design Basis Tornado impacting the HNP site. The probability of a Design Basis Tornado is driven by external factors and is not affected by the proposed amendment. There are no changes required to any of the previously evaluated accidents in the UFSAR.

The proposed amendment does not involve a significant increase in the consequences of a Design Basis Tornado. TMRE is a risk-informed methodology for determining whether certain safety-related features, that are currently not protected from tornado-generated missiles, require such protection. The criteria for significant increase in consequences was established in the NRC Policy Statement on probabilistic risk assessment, which were incorporated into Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis. The TMRE calculations performed by Duke Energy meet the acceptance criteria of RG 1.174, which confirms that the proposed amendment does not involve a significant increase in the consequences of an accident previously evaluated. In the event additional non-conforming conditions are discovered in the future, the methodology acceptance criteria for an acceptable risk outcome will ensure that future evaluations also would not result in a significant increase in the probability or consequences of an accident previously evaluated.

Therefore, the proposed amendment, for both the conditions described herein and any future application of the methodology, does not involve a significant increase in the probability or consequences of an accident previously evaluated

2) Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed amendment, including any future use of the methodology, will involve no physical changes to the existing plant, so no new malfunctions could create the possibility of a new or different kind of accident. The proposed amendment makes no changes to conditions external to the plant that could create the possibility of a new or different kind of accident. The proposed change will not create the possibility of a new or different kind of accident due to new accident precursors, failure mechanisms, malfunctions, or accident initiators not considered in the design and licensing bases. The

U.S. Nuclear Regulatory Commission Page 27 of 28 Serial HNP-17-072 Enclosure existing UFSAR accident analysis will continue to meet requirements for the scope and type of accidents that require analysis.

Therefore, the proposed amendment, for both the conditions described herein and any future application of the methodology, does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3) Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The proposed amendment does not exceed or alter any controlling numerical value for a parameter established in the UFSAR or elsewhere in the HNP licensing basis related to design basis or safety limits. The change does not impact any UFSAR Chapter 6 or 15 Safety Analyses, and those analyses remain valid. The change maintains diversity and redundancy as required by regulation or credited in the UFSAR. The change does not reduce defense-in-depth as described in the UFSAR.

Therefore, the proposed amendment, for both the conditions described herein and any future application of the methodology, does not involve a significant reduction in a margin of safety.

Based on the above, Duke Energy concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 Regulatory Evaluation Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5. Environmental Consideration A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

U.S. Nuclear Regulatory Commission Page 28 of 28 Serial HNP-17-072 Enclosure

6. References 6.1 NEI 17-02, Tornado Missile Risk Evaluator Industry Guidance Document, Revision 1, September 2017 (ADAMS Accession No. ML17268A036).

6.2 Regulatory Issue Summary 2015-06, Tornado Missile Protection (RIS), on June 10, 2015 (ADAMS Accession No. ML15020A419).

6.3 Enforcement Guidance Memorandum 15-002, Enforcement Discretion for Tornado Missile Protection Noncompliance (ADAMS Accession No. ML15111A269).

6.4 Shearon Harris Nuclear Power Plant, Unit No. 1, Updated Final Safety Analysis Report, Amendment 61.

6.5 NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, Revision 2, July 1981.

6.6 NUREG-1038, "Safety Evaluation Report Related to the Operation of the Shearon Harris Nuclear Power Plant, Units 1 and 2," November 1983.

6.7 NUREG/CR-4461, Tornado Climatology of the Contiguous United States, Revision 2, February 2007.

6.8 Regulatory Guide 1.117, Tornado Design Classification, Revision 1, April 1978.

6.9 Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis, Revision 2, May 2011.

Serial: HNP-17-072 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400/Renewed License No. NPF-63 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Enclosure Evaluation of the Proposed Change Attachment 1 Detailed Risk Assessment Information

U.S. Nuclear Regulatory Commission Page 2 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Robust Target Area Elev Robust Missile F-Robust Desc Missiles MIP EEFP Description (ft2) > 30 Type Count Scale 100% 155000 2 1.1E-10 2.7E-04 TDAFW None of the above 100% 155000 3 3.6E-10 8.9E-04 Pump 16 N J (i.e., not a robust 100% 205000 4 6.3E-10 2.1E-03 Exhaust target) 100% 240000 5 1.6E-09 6.1E-03 100% 240000 6 2.4E-09 9.2E-03 45% 69750 2 1.1E-10 1.5E-05 45% 69750 3 3.6E-10 5.0E-05 EDG Fuel Oil 2 N G Steel Door 45% 92250 4 6.3E-10 1.2E-04 Line 45% 108000 5 1.6E-09 3.5E-04 45% 108000 6 2.4E-09 5.2E-04 Train A EDG 100% 155000 2 1.1E-10 3.8E-04 Conduits None of the above 100% 155000 3 3.6E-10 1.2E-03 (17179Q SA 22 N J (i.e., not a robust 100% 205000 4 6.3E-10 2.8E-03 and 16255V target) 100% 240000 5 1.6E-09 8.5E-03 SA) 100% 240000 6 2.4E-09 1.3E-02 45% 69750 2 1.1E-10 2.2E-04 Train A 45% 69750 3 3.6E-10 7.0E-04 ESWSS 28 N G Steel Door 45% 92250 4 6.3E-10 1.6E-03 Conduits 45% 108000 5 1.6E-09 4.8E-03 45% 108000 6 2.4E-09 7.3E-03 70% 108500 2 5.8E-11 4.2E-04 EDG Roof Steel Pipe - Less 70% 108500 3 2.0E-10 1.4E-03 Vents Train 66 Y F than 10 diameter or 70% 143500 4 3.4E-10 3.2E-03 A 3/8 thickness 70% 168000 5 8.7E-10 9.7E-03 70% 168000 6 1.3E-09 1.4E-02 70% 108500 2 5.8E-11 4.2E-04 EDG Roof Steel Pipe - Less 70% 108500 3 2.0E-10 1.4E-03 Vents Train 66 Y F than 10 diameter or 70% 143500 4 3.4E-10 3.2E-03 B 3/8 thickness 70% 168000 5 8.7E-10 9.7E-03

U.S. Nuclear Regulatory Commission Page 3 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Robust Target Area Elev Robust Missile F-Robust Desc Missiles MIP EEFP Description (ft2) > 30 Type Count Scale 70% 168000 6 1.3E-09 1.4E-02 100% 155000 2 1.1E-10 1.5E-04 ESW Intake None of the above 100% 155000 3 3.6E-10 5.0E-04 Train A 9 N J (i.e., not a robust 100% 205000 4 6.3E-10 1.2E-03 Penatration target) 100% 240000 5 1.6E-09 3.5E-03 100% 240000 6 2.4E-09 5.2E-03 70% 108500 2 1.1E-10 1.2E-05 EDG Fuel Oil Steel Pipe - Less 70% 108500 3 3.6E-10 3.9E-05 Return Lines 1 N F than 10 diameter or 70% 143500 4 6.3E-10 9.0E-05 Train A 3/8 thickness 70% 168000 5 1.6E-09 2.7E-04 70% 168000 6 2.4E-09 4.0E-04 70% 108500 2 1.1E-10 1.2E-05 EDG Fuel Oil Steel Pipe - Less 70% 108500 3 3.6E-10 3.9E-05 Return Lines 1 N F than 10 diameter or 70% 143500 4 6.3E-10 9.0E-05 Train B 3/8 thickness 70% 168000 5 1.6E-09 2.7E-04 70% 168000 6 2.4E-09 4.0E-04 Safety 100% 155000 2 1.1E-10 8.5E-05 related DGB None of the above 100% 155000 3 3.6E-10 2.8E-04 Governor 5 N J (i.e., not a robust 100% 205000 4 6.3E-10 6.5E-04 Conduits target) 100% 240000 5 1.6E-09 1.9E-03 Train A 100% 240000 6 2.4E-09 2.9E-03 Safety 100% 155000 2 1.1E-10 8.5E-05 related DGB None of the above 100% 155000 3 3.6E-10 2.8E-04 Governor 5 N J (i.e., not a robust 100% 205000 4 6.3E-10 6.5E-04 Conduits target) 100% 240000 5 1.6E-09 1.9E-03 Train B 100% 240000 6 2.4E-09 2.9E-03 70% 108500 2 5.8E-11 2.6E-04 SG A MSIV Steel Pipe - Less 70% 108500 3 2.0E-10 8.9E-04 BYPASS 41 Y F than 10 diameter or 70% 143500 4 3.4E-10 2.0E-03 (1MS-81) 3/8 thickness 70% 168000 5 8.7E-10 6.0E-03

U.S. Nuclear Regulatory Commission Page 4 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Robust Target Area Elev Robust Missile F-Robust Desc Missiles MIP EEFP Description (ft2) > 30 Type Count Scale 70% 168000 6 1.3E-09 9.0E-03 70% 108500 2 5.8E-11 2.6E-04 SG B MSIV Steel Pipe - Less 70% 108500 3 2.0E-10 8.9E-04 BYPASS 41 Y F than 10 diameter or 70% 143500 4 3.4E-10 2.0E-03 VALVE 3/8 thickness 70% 168000 5 8.7E-10 6.0E-03 (1MS-83) 70% 168000 6 1.3E-09 9.0E-03 70% 108500 2 5.8E-11 2.6E-04 SG C MSIV Steel Pipe - Less 70% 108500 3 2.0E-10 8.9E-04 BYPASS 41 Y F than 10 diameter or 70% 143500 4 3.4E-10 2.0E-03 VALVE 3/8 thickness 70% 168000 5 8.7E-10 6.0E-03 (1MS-85) 70% 168000 6 1.3E-09 9.0E-03 20% 31000 2 5.8E-11 3.3E-04 SG PORV Steel Pipe - at least 20% 31000 3 2.0E-10 1.2E-03 and MSSV 186 Y A 16 diameter and 20% 41000 4 3.4E-10 2.6E-03 for Train A 3/8 thickness 20% 48000 5 8.7E-10 7.8E-03 and B 20% 48000 6 1.3E-09 1.2E-02 20% 31000 2 5.8E-11 5.6E-04 SG PORV Steel Pipe - at least 20% 31000 3 2.0E-10 1.9E-03 and MSSV 310 Y A 16 diameter and 20% 41000 4 3.4E-10 4.3E-03 for Train B 3/8 thickness 20% 48000 5 8.7E-10 1.3E-02 and C 20% 48000 6 1.3E-09 1.9E-02 40% 62000 2 5.8E-11 8.3E-05 ESCW 40% 62000 3 2.0E-10 2.9E-04 Steel Tank - at least Expansion 23 Y C 40% 82000 4 3.4E-10 6.4E-04 0.25 thickness Tank Train A 40% 96000 5 8.7E-10 1.9E-03 40% 96000 6 1.3E-09 2.9E-03 40% 62000 2 5.8E-11 8.3E-05 ESCW Steel Tank - at least 40% 62000 3 2.0E-10 2.9E-04 Expansion 23 Y C 0.25 thickness 40% 82000 4 3.4E-10 6.4E-04 Tank Train B 40% 96000 5 8.7E-10 1.9E-03

U.S. Nuclear Regulatory Commission Page 5 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Robust Target Area Elev Robust Missile F-Robust Desc Missiles MIP EEFP Description (ft2) > 30 Type Count Scale 40% 96000 6 1.3E-09 2.9E-03 100% 155000 2 5.8E-11 1.2E-03 RAB Roof None of the above 100% 155000 3 2.0E-10 4.2E-03 HVAC Vent 134 Y J (i.e., not a robust 100% 205000 4 3.4E-10 9.3E-03 Stack 1AV-target) 100% 240000 5 8.7E-10 2.8E-02 ERABVS 100% 240000 6 1.3E-09 4.2E-02 B Train 45% 69750 2 1.1E-10 2.3E-05 ESW Intake 45% 69750 3 3.6E-10 7.5E-05 Structure 45% 92250 4 6.3E-10 1.7E-04 3 N G Steel Door Electrical 45% 108000 5 1.6E-09 5.2E-04 Conduit 17072F-SB 45% 108000 6 2.4E-09 7.8E-04 RAB El. 305 100% 155000 2 5.8E-11 1.8E-04 None of the above Roof 100% 155000 3 2.0E-10 6.2E-04 20 Y J (i.e., not a robust Exposed 100% 205000 4 3.4E-10 1.4E-03 target) instrument 100% 240000 5 8.7E-10 4.2E-03

U.S. Nuclear Regulatory Commission Page 6 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Robust Target Area Elev Robust Missile F-Robust Desc Missiles MIP EEFP Description (ft2) > 30 Type Count Scale tubing sensing outside air pressure.

PDT-1AV-4834-A1SAHP-T378 (A Train) and PDT-1AV-100% 240000 6 1.3E-09 6.2E-03 4834-B1SBHP-T379 (B Train). A and B RABEES and A and B Containment Vacuum Relief System DGB east 100% 155000 2 1.1E-10 1.2E-04 exterior wall - 100% 155000 3 3.6E-10 3.9E-04 exposed 100% 205000 4 6.3E-10 9.0E-04 outdoor air 100% 240000 5 1.6E-09 2.7E-03 temperature None of the above elements TE- 7 N J (i.e., not a robust 6902A-SA target) fed from 100% 240000 6 2.4E-09 4.0E-03 conduit:

13262F SA

U.S. Nuclear Regulatory Commission Page 7 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Robust Target Area Elev Robust Missile F-Robust Desc Missiles MIP EEFP Description (ft2) > 30 Type Count Scale DGB east 100% 155000 2 1.1E-10 1.2E-04 exterior wall - 100% 155000 3 3.6E-10 3.9E-04 exposed 100% 205000 4 6.3E-10 9.0E-04 outdoor air 100% 240000 5 1.6E-09 2.7E-03 None of the above temperature 7 N J (i.e., not a robust element TE-target) 6902B-SB fed from 100% 240000 6 2.4E-09 4.0E-03 conduit:

13273F SB REFUELING 40% 62000 2 1.1E-10 6.0E-02 WATER 40% 62000 3 3.6E-10 2.0E-01 Steel Tank - at least STORAGE 8796 N C 40% 82000 4 6.3E-10 4.5E-01 0.25 thickness TANK 40% 96000 5 1.6E-09 1.0E+00 FAILURE 40% 96000 6 2.4E-09 1.0E+00 RWST 100% 155000 2 1.1E-10 1.5E-04 LEVEL None of the above 100% 155000 3 3.6E-10 5.0E-04 TRANSMITT 9 N J (i.e., not a robust 100% 205000 4 6.3E-10 1.2E-03 ER LT-990 target) 100% 240000 5 1.6E-09 3.5E-03 FAILS HIGH 100% 240000 6 2.4E-09 5.2E-03 RWST 100% 155000 2 1.1E-10 1.5E-04 LEVEL None of the above 100% 155000 3 3.6E-10 5.0E-04 TRANSMITT 9 N J (i.e., not a robust 100% 205000 4 6.3E-10 1.2E-03 ER LT-991 target) 100% 240000 5 1.6E-09 3.5E-03 FAILS HIGH 100% 240000 6 2.4E-09 5.2E-03 RWST 100% 155000 2 1.1E-10 1.5E-04 LEVEL None of the above 100% 155000 3 3.6E-10 5.0E-04 TRANSMITT 9 N J (i.e., not a robust 100% 205000 4 6.3E-10 1.2E-03 ER LT-992 target) 100% 240000 5 1.6E-09 3.5E-03 FAILS HIGH 100% 240000 6 2.4E-09 5.2E-03

U.S. Nuclear Regulatory Commission Page 8 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Robust Target Area Elev Robust Missile F-Robust Desc Missiles MIP EEFP Description (ft2) > 30 Type Count Scale RWST 100% 155000 2 1.1E-10 1.5E-04 LEVEL None of the above 100% 155000 3 3.6E-10 5.0E-04 TRANSMITT 9 N J (i.e., not a robust 100% 205000 4 6.3E-10 1.2E-03 ER LT-993 target) 100% 240000 5 1.6E-09 3.5E-03 FAILS HIGH 100% 240000 6 2.4E-09 5.2E-03 ATMOSPHE 40% 62000 2 5.8E-11 2.4E-02 RIC STEAM 40% 62000 3 2.0E-10 8.4E-02 DUMP OR Steel Pipe - at least 40% 82000 4 3.4E-10 1.9E-01 Main Steam 6750 Y E 10 diameter and 40% 96000 5 8.7E-10 5.6E-01 pipe failure 3/8 thickness after MSIV 40% 96000 6 1.3E-09 8.4E-01 isolation

U.S. Nuclear Regulatory Commission Page 9 of 12 Serial HNP-17-072 Enclosure Non-Conformance risk results The delta risk results for each identified non-conformance is proved in Table 3.3.7-2. Non-conformances that were determined to have a negligible impact on PRA results have notes providing the basis.

Table 3.3.7-2 PRA Results for Non-Conformance Estimated Non-Conforming Delta Delta PRA Modeling Notes Exposure Target CDF LERF Area TDAFW Pump < 1E-11 < 1E-12 16 Exhaust (Note 2) (Note 2)

A Train EDG Fuel 2 1.1E-10 1.1E-11 Oil Supply Line A Train EDG 22 5.8E-09 6.0E-10 Conduits A Train ESWSS < 1E-11 < 1E-12 28 Conduits (Note 2) (Note 2)

EDG Roof Vents Non-conformance was separated by 66 6.6E-09 6.8E-10 Train A trains for assessment EDG Roof Vents Non-conformance was separated by 66 6.8E-09 7.1E-10 Train B trains for assessment This penetration was determined to be less than 10 sq feet and meets the De Minimis screening criteria in the NEI 17-

"A" ESW Intake 9 Negligible Negligible 02 guidance. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles.

ESW Main intake suction not modeled in the internal events PRA. This non-Not ESWIS Cover Plate conformance is evaluated as having a Negligible Negligible Estimated negligible impact on risk from tornado missiles.

This non-conformance is evaluated as Not ESW Intake Bay having a negligible impact on risk from Negligible Negligible Estimated tornado missiles.

EDG Fuel Oil Return Non-conformance was separated by 1 8.8E-11 8.8E-12 Lines Train A trains for assessment

U.S. Nuclear Regulatory Commission Page 10 of 12 Serial HNP-17-072 Enclosure Table 3.3.7-2 PRA Results for Non-Conformance Estimated Non-Conforming Delta Delta PRA Modeling Notes Exposure Target CDF LERF Area EDG Fuel Oil Return Non-conformance was separated by 1 8.8E-11 8.8E-12 Lines Train B trains for assessment Safety related DGB Non-conformance was separated by Governor Conduits 5 1.1E-09 1.2E-10 trains for assessment Train A Safety related DGB Non-conformance was separated by Governor Conduits 5 1.2E-09 1.2E-10 trains for assessment Train B PRA room heat up analysis shows the battery room ventilation is not needed 1A-SA & 1B-SB for success in the PRA model. This Not Battery Room Negligible Negligible non-conformance is evaluated as Estimated exhaust having a negligible impact on risk from tornado missiles.

SG A MSIV BYPASS Non-conformance was separated by 41 1.3E-10 6.0E-12 Valve (1MS-81) trains for assessment SG B MSIV BYPASS Non-conformance was separated by < 1E-11 < 1E-12 41 VALVE (1MS-83) trains for assessment (Note 2) (Note 2)

SG C MSIV BYPASS Non-conformance was separated by 41 7.0E-11 2.8E-12 VALVE (1MS-85) trains for assessment SG PORV Vents and SG PORV and MSSV for train A and B MS Safety Relief are correlated as one target in the PRA 186 2.4E-10 1.1E-11 Valve (MSSV) Vents model for Train A and B SG PORV Vents and SG PORV and MSSV for train B and C MS Safety Relief are correlated as one target in the PRA 310 3.5E-10 1.5E-11 Valve (MSSV) Vents model for Train B and C PRA analysis shows the Steam Tunnel RAB EL 305 Safety ventilation is not needed for success in Related Conduit Not the PRA model. This non-conformance Negligible Negligible Supply Fan S64 Main Estimated is evaluated as having a negligible Steam Tunnel HVAC impact on risk from tornado missiles.

U.S. Nuclear Regulatory Commission Page 11 of 12 Serial HNP-17-072 Enclosure Table 3.3.7-2 PRA Results for Non-Conformance Estimated Non-Conforming Delta Delta PRA Modeling Notes Exposure Target CDF LERF Area PRA analysis shows the Steam Tunnel RAB EL 305 Safety ventilation is not needed for success in Related Conduit Not the PRA model. This non-conformance Negligible Negligible Supply Fan S65 Main Estimated is evaluated as having a negligible Steam Tunnel HVAC impact on risk from tornado missiles.

ESCW Expansion Non-conformance was separated by < 1E-11 < 1E-12 23 Tank Train A trains for assessment (Note 2) (Note 2)

ESCW Expansion Non-conformance was separated by < 1E-11 < 1E-12 23 Tank Train B trains for assessment (Note 2) (Note 2)

RAB Roof HVAC Vent < 1E-11 < 1E-12 134 Stack 1AV-ERABVS (Note 2) (Note 2)

ESW Intake Structure These TE are not modeled in the PRA, Temp elements fed they were determined not needed for from Safety Related the success of the system in the PRA Not Conduits 13292B- Negligible Negligible model. This non-conformance is Estimated SB, 13292C SA, evaluated as having a negligible impact 13292F SB & 13292G on risk from tornado missiles.

SB B Train ESW Intake Structure Electrical 3 2.2E-10 2.2E-11 Conduits RAB El. 305 Roof Exposed instrument tubing sensing outside air pressure.

PDT-1AV-4834-A1SAHP-T378 (A Train) and PDT-1AV-4834-B1SBHP-T379 < 1E-11 < 1E-12 20 (B Train). A and B (Note 2) (Note 2)

Reactor Auxiliary Building Emergency Exhaust System (RABEES) and A and B Containment Vacuum Relief System

U.S. Nuclear Regulatory Commission Page 12 of 12 Serial HNP-17-072 Enclosure Table 3.3.7-2 PRA Results for Non-Conformance Estimated Non-Conforming Delta Delta PRA Modeling Notes Exposure Target CDF LERF Area FHB EL 286 Roof Exposed instrument tubing sensing outside air pressure.

FHB ventilation is not modeled in the PDT-*1FL-5027ASA PRA and does not support core at 39 line wall damage mitigating equipment. This Not PDT-*1FL-5027BSB Negligible Negligible non-conformance is evaluated as Estimated at 45 line wall having a negligible impact on risk from tornado missiles.

A and B Fuel Handling Building Emergency Exhaust System (FHBEES)

DGB east exterior wall - exposed outdoor air Non-conformance was separated by < 1E-11 < 1E-12 temperature elements 7 trains for assessment (Note 2) (Note 2)

TE-6902A-SA fed from conduit: 13262F SA DGB east exterior wall - exposed outdoor air Non-conformance was separated by < 1E-11 < 1E-12 temperature element 7 trains for assessment (Note 2) (Note 2)

TE-6902B-SB fed from conduit: 13273F SB Note 1 - The Delta risk results for individual non-conformances add to a number slightly larger than the total delta risk for CDF and LERF due to multiple non-conformances impacting individual damage sequences.

Note 2 - No CDF or LERF contribution generated with a CDF truncation of 1E-11/year and a LERF truncation of 1E-12/year.

Serial: HNP-17-072 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400/Renewed License No. NPF-63 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Enclosure Evaluation of the Proposed Change Attachment 2 Probabilistic Risk Assessment Technical Adequacy Documentation

U.S. Nuclear Regulatory Commission Page 2 of 27 Serial HNP-17-072 Enclosure TABLE OF CONTENTS 1.0 OVERVIEW .......................................................................................................... 3 2.0 BASIS TO CONCLUDE THAT THE PRA MODEL REPRESENTS THE AS-BUILT, AS-OPERATED PLANT .......................................................................... 3 3.0 IDENTIFICATION OF PERMANENT PLANT CHANGES NOT INCORPORATED IN THE PRA MODEL ........................................................................................... 4 4.0 CONFORMANCE WITH ASME/ANS PRA STANDARD ..................................... 5 4.1 2007 Internal Events Update. ......................................................................... 5 4.2 2010 Internal Events Update. ......................................................................... 5 4.3 Internal Events PRA Peer Reviews................................................................ 5 5.0 KEY ASSUMPTIONS AND APPROXIMATIONS................................................. 6 5.1 Reactor Coolant Pump (RCP) Seal Failure ................................................... 7 5.2 Loss of Off-Site Power (LOSP) Frequencies ................................................ 7 6.0 UNIQUE TMRE CONSIDERATIONS ................................................................... 7

7.0 CONCLUSION

S ON PRA TECHNICAL ADEQUACY ......................................... 7

8.0 REFERENCES

..................................................................................................... 7

U.S. Nuclear Regulatory Commission Page 3 of 27 Serial HNP-17-072 Enclosure Documentation of HNP Internal Events Probabilistic Risk Assessment (PRA)

Technical Adequacy for the Tornado Missile Risk Evaluator (TMRE)

1. OVERVIEW This attachment documents the necessary information to demonstrate that the internal events Probabilistic Risk Assessment (PRA) for the Shearon Harris Nuclear Power Plant, Unit No. 1, (HNP) meets the requirements of the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA standard (Reference 1) as endorsed by Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," (Reference 2) at an appropriate capability category to support the HNP Tornado Missile Risk Evaluator (TMRE) program. This attachment provides documentation that is consistent with the requirements of Section 3.3 and Section 4.2 of RG 1.200, Revision 2:

• Section 2.0 addresses the need for the PRA model to represent the as-built, as-operated plant,

• Section 3.0 discusses permanent plant changes that have an impact on those SSCs modeled in the PRA but have not been incorporated in the baseline PRA model.

• Section 4.0 demonstrates that the HNP PRA has been performed consistently with the ASME/ANS PRA Standard requirements as endorsed in RG 1.200, Revision 2. The peer reviews that have been conducted and the resolution of findings from those reviews are discussed in this section.

• Section 5.0 identifies the key assumptions and approximations relevant to the results used in the decision-making process. This section provides assurance that the assumptions and approximations used in development of the PRA are appropriate.

• Section 6.0 discusses the unique TMRE considerations for certain supporting requirements (SRs) with NRC clarifications from the TMRE guidance document, Appendix D (Reference 7).

Other technical elements of the PRA, including but not limited to internal flooding, fire, and other external events, are not required for the TMRE and are not discussed in this document.

2.0 BASIS TO CONCLUDE THAT THE PRA MODEL REPRESENTS THE AS-BUILT, AS-OPERATED PLANT The HNP PRA Model of Record (MOR) is maintained as a controlled document and is updated on a periodic basis to represent the as-built, as-operated plant. Duke Energy procedures provide the guidance, requirements, and processes for the maintenance, update, and upgrade of the PRA:

U.S. Nuclear Regulatory Commission Page 4 of 27 Serial HNP-17-072 Enclosure

a. The process includes a review of plant changes, relevant plant procedures, and plant operating data, as required, through a chosen freeze date to assess the effect on the PRA model.

b. The PRA model and controlling documents are revised as necessary to incorporate those changes determined to impact the model.

c. The determination of the extent of model changes includes the following:

• Accepted industry PRA practices, ground rules, and assumptions consistent with those employed in the ASME/ANS PRA Standard (Reference 1),

• Current industry practices,

• NRC guidance (e.g., References 2-3),

• Advances in PRA technology and methodology, and

• Changes in external hazard conditions.

For plant changes of small or negligible impact, the model changes can be accumulated and a single revision performed at an interval consistent with major PRA revisions. The results of each evaluation determine the necessity and timing of incorporation of a particular change into the PRA model. An electronic tracking database is utilized to document pending model changes and updates.

3.0 IDENTIFICATION OF PERMANENT PLANT CHANGES NOT INCORPORATED IN THE PRA MODEL The current HNP Internal Events Model of Record (MOR2010) is based on the plant configuration as of May 31, 2010, including Refueling Outage 16 modifications and plant-specific data through May 2006. It is an evolution of the original PRA analysis that was submitted to the Nuclear Regulatory Commission (NRC) on August 20, 1993, to meet the requirements of Generic Letter 88-20 for an individual plant examination (IPE). Periodic updates to the model have been incorporated since the IPE was submitted in order to maintain a model that represents the as-built, as-operated plant.

Since 2010, the HNP PRA model has been used to support PRA applications, and to assist in decision making with regard to the design, licensing, operation, and maintenance of the plant.

Engineering changes, including equipment modifications, procedure changes, and plant performance (data), have been assessed and incorporated (per Duke Energy procedures) into the HNP model, as appropriate. These PRA maintenance activities do not qualify as PRA upgrades that would require an additional focused review. There have been no methodology changes or significant changes in scope or capability (other than development of the Fire and Internal Flood models not discussed herein) that impact the significant accident progression sequences.

The current HNP PRA Model has incorporated changes made in data since the MOR was issued. Review of the PRA electronic tracking database as of the May 2017 indicates that there are currently no identified permanent plant modifications that have a significant impact on the PRA that have not been incorporated.

U.S. Nuclear Regulatory Commission Page 5 of 27 Serial HNP-17-072 Enclosure 4.0 CONFORMANCE WITH ASME/ANS PRA STANDARD The following sections describe the conformance and capability of the HNP PRA against the ASME/ANS PRA Standard (Reference 1). There have been two formal internal events MOR revisions since 2007.

4.1 2007 Internal Events Update.

The 2007 revision to the internal events model of record (MOR) incorporated facts and observations (F&O) resolutions for the April 2006 HNP PRA Self-Assessment in order to meet ASME/ANS Internal Events Standard (Revision 1) for capability category II compliance. The update was performed to support development of a fire PRA and in preparation for the NFPA 805 License Amendment Request (LAR). A peer review was performed to support the NFPA 805 license submittal. Major revisions included expansion of plant-specific data, Human Reliability Analysis (HRA) updates, and addition of new or more detailed heating, ventilation and air conditioning (HVAC) models for CSIP rooms, Switchgear rooms, and Emergency Service Water (ESW) pump rooms. The model revision also included addition of logic to address fire induced multiple spurious failures, developed in conjunction with HNP adoption of the NFPA 805 program for fire induced vulnerabilities. Other general updates to the model included an update to the initiating event frequencies, revision of the station blackout (SBO) induced seal LOCA, and Loss of offsite power (LOSP) recovery. Motor Control center modeling was improved to support the NFPA 805 LAR with the required level of detail. These updates were peer reviewed in the 2007 Industry Peer Review, and the twelve (12) resolved but open findings were documented in a PRA calculation and tracked in the PRA electronic tracking system.

4.2 2010 Internal Events Update.

The 2010 revision was to incorporate plant equipment updates and model changes from the NFPA 805 LAR process. The major change for the 2010 update was the addition of the Alternate Seal Injection - Dedicated Shutdown Diesel Generator (ASI-DSDG) to the MOR. The installation of the ASI-DSDG modification provided a diverse and redundant power source for alternate seal injection and also to the emergency DC battery chargers, as described in HNP's NFPA 805 LAR. This reduced the effect of the 4-hour coping duration of the batteries by providing a means to supply DC power to the DC busses during SBO. The LOSP initiator was separated into plant, grid, switchyard and weather induced LOSPs, which allowed the model to apply recovery actions to the higher frequency events (plant and switchyard). Other changes are related to de-energizing charging pump discharge header cross-connect valves, adding temporary air compressors, and incorporating updates from fire model. This was not considered an internal events upgrade, so a peer review was not required for these revisions.

4.3 Internal Events PRA Peer Reviews The following peer reviews have been conducted to ensure the internal events PRA meets the requirements of ASME/ANS PRA Standard:

• In 2002, a peer review was performed by Westinghouse Owners Group (WOG) in accordance with guidance in NEI-00-02, Industry PRA Peer Review Process. All of the F&Os were resolved.

• In 2006, a self-assessment was conducted to identify supporting requirements that did not meet Category II of the ASME Standard RA-Sb-2005 and RG 1.200, Revision 1.

U.S. Nuclear Regulatory Commission Page 6 of 27 Serial HNP-17-072 Enclosure The significance of the F&Os was determined with regard to whether the issue may adversely impact the effective use of the PRA in risk-informed applications. All significant technical findings were reviewed and resolved.

• In 2007, a focused industry peer review was conducted as a follow up to the self-assessment against AMSE Standard RA-Sb-2005 and RG 1.200, Revision 1. All findings recorded from that review have been resolved and documented in a PRA calculation and tracked in the PRA electronic tracking system. Twelve of the finding level F&Os were considered resolved but open, and were submitted with previous risk-informed applications.

• In 2008, two internal events F&Os were identified during an NRC staff review of the HNP fire PRA model. These findings were reviewed and resolved with the NRC staff.

In reviewing the HNP risk informed LAR for implementation of NFPA 805, the NRC staff evaluated the quality of the internal events PRA model used to support development of the Fire PRA. The objective of the quality review was, to determine whether the plant-specific PRA used in evaluating the proposed LAR is of sufficient scope, level of detail, and technical adequacy for the application. The results of the NRC staff quality review are documented in the HNP NFPA 805 Safety Evaluation for transition to a risk-informed, performance-based fire protection program, ADAMS Accession Numbers ML101750602 and ML101750604 (References 4-5).

• In 2017, the HNP PRA was selected for a Pilot Demonstration of an NEI and NRC process for close out of F&Os by independent assessment (Reference 6). The NRC gave interim acceptance of the process in a letter on May 3, 2017 (Reference 8). An independent assessment is conducted using the nearly final guidance document in a manner similar to a peer review, but with a scope limited to evaluating the closure of F&Os identified by the host utility, and without intention of issuance of new F&Os. All twelve of the internal events findings that were considered resolved but open following the 2007 peer review were reviewed and assessed by the independent assessment team to be closed at CCII or greater. All findings for the HNP Internal Events model have now been resolved and closed (Reference 9). There are no upgrades to the internal events PRA that have not been peer reviewed.

Table 1 lists the SRs with unique TMRE considerations that have been identified in the TMRE Guidance Document (Reference 7) as being applicable to the TMRE PRA, with any relevant comments regarding this application.

Based on these reviews, the HNP internal events PRA meets the requirements of the ASME/ANS PRA Standard at an appropriate quality level to support the HNP TMRE PRA.

5.0 KEY ASSUMPTIONS AND APPROXIMATIONS A list of potential contributors to the uncertainty in the PRA was compiled. Items discussed in sections 5.1 and 5.2 below represents the modeling assumptions and uncertainty that are considered to have the greatest impact on the HNP PRA results if different reasonable alternative assumptions were utilized. The approaches taken for the assumptions below represent industry best practices and therefore the need for sensitivity analyses will be

U.S. Nuclear Regulatory Commission Page 7 of 27 Serial HNP-17-072 Enclosure determined separately if applicable to the TMRE guidance. TMRE sensitivities are documented in section 3.3.10 of the main body of the enclosure.

5.1 Reactor Coolant Pump (RCP) Seal Failure The HNP PRA model uses the WOG 2000 RCP seal failure model, and it assumes RCP seal leakage every time both Seal Injection and Thermal Barrier cooling are lost. This is an Industry consensus model. For risk applications this is one of the most important areas of uncertainty.

5.2 Loss of Off-Site Power (LOSP) Frequencies Loss of off-site power initiating events have been shown to be important contributors to plant core damage due to the potential for station blackout and the reliance of many frontline systems on AC power. The LOSP initiator was separated into plant, grid, switchyard and weather induced LOSPs, which allowed the model to apply recovery actions to the higher frequency events (plant and switchyard). HNP used generic industry data to calculate LOSP frequencies.

The LOSP frequency has a significant impact on CDF and Emergency Diesel Generator importance. Because the TMRE model only considers tornado initiating events this key assumption does not impact the TMRE results.

6.0 UNIQUE TMRE CONSIDERATIONS The NEI TMRE guidance document (Reference 7) lays out a roadmap of certain SRs and which particular sections in the guidance document provides the information to meet those SRs. A systematic review was performed of the SRs relative to the TMRE model development, and is shown in Table 1 with notes on the HNP TMRE model regarding those certain SRs.

7.0 CONCLUSION

S ON PRA TECHNICAL ADEQUACY The Harris Nuclear Plant (HNP) PRA model is sufficiently robust and suitable for use in risk informed processes such as the TMRE Methodology. The peer reviews that have been conducted and the closure of findings from those reviews demonstrate that the underlying internal events PRA has been performed in a technically acceptable manner. There are no open finding-level F&Os for the HNP Internal Events PRA. The assumptions and approximations used in development of the PRA have also been reviewed and are appropriate for their application. Duke Energy procedures are in place for controlling and updating the models, and for assuring that the model represents the as-built, as-operated plant. The conclusion, therefore, is that the HNP PRA model is acceptable to be used as the basis for risk-informed applications including the Tornado Missile Risk Evaluator (TMRE).

8.0 REFERENCES

1. ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

2. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, U.S.

Nuclear Regulatory Commission, March 2009.

U.S. Nuclear Regulatory Commission Page 8 of 27 Serial HNP-17-072 Enclosure

3. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, U.S.

Nuclear Regulatory Commission, March 2011.

4. Letter from the NRC to C. Burton, Shearon Harris Nuclear Power Plant, Unit 1 - Issuance of Amendment Regarding Adoption of National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, June 28, 2010. (ADAMS Accession No. ML101750602)

5. Safety Evaluation By The Office Of Nuclear Reactor Regulation Related To Amendment No. 133 To Renewed Facility Operating License No. NPF-63, Transition To A Risk-Informed, Performance-Based Fire Protection Program In Accordance with 10 CFR 50.48(c), Shearon Harris Nuclear Power Plant, Unit 1, Docket No. 50-400, U.S.

Nuclear Regulatory Commission, Washington, D.C., June 28, 2010. (ADAMS Accession No. ML101750604)

6. Appendix X: Close Out of Facts and Observations (F&Os), NEI 05-04/07-12/12-06, Nuclear Energy Institute, 2017.

7. Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document, NEI 17-02, Revision 1, Nuclear Energy Institute, September 2017.

8. U.S. Nuclear Regulatory Commission Acceptance On Nuclear Energy Institute Appendix X To Guidance 05-04, 07-12, And 12-13, Close-Out Of Facts And Observations (F&Os), May 2017.

U.S. Nuclear Regulatory Commission Page 9 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

The initiating event analysis shall provide a reasonably IE-A complete identification of initiating events.

Tornado initiating TMRE process events will be should ensure that consistent with the the initiating events The only initiating intervals defined in caused by extreme events caused by the TMRE process. winds that give rise extreme winds that TMRE considers all to significant are considered in tornadoes will result accident sequences TMRE were in a LOSP. Tornado and accurately IE-A1 4.3, 6.2 tornados. Only initiating event capture the tornados will produce frequencies will be additional risk of the tornado missiles.

based on a hazard unprotected SSCs The TMRE process curve that uses site (that should be was followed as specific data protected per the described.

provided in Table 6.1 CLB) are identified of NUREG 4461 [IE- and used for this C1]. application.

For multi-unit sites with shared systems, INCLUDE multi-unit site initiators (e.g.,

N/A. HNP is a single IE-A10 multi-unit LOSP 6.2 unit site.

events or total loss of service water) that may impact the model.

The initiating event analysis shall group the initiating events so that events in the same group have similar mitigation requirements (i.e.,

the requirements for IE-B most events in the group are less restrictive than the limiting mitigation requirements for the group) to facilitate an efficient but realistic estimation of CDF

U.S. Nuclear Regulatory Commission Page 10 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

DO NOT SUBSUME multi-unit initiating events if they impact mitigation capability.

Two unit sites should consider proximity of N/A. HNP is a single IE-B5 6.2 each unit to each unit site.

other, the footprint of potential tornadoes for the region, and the systems shared between each unit.

The initiating event The tornado IEFs analysis shall should be based on estimate the annual a hazard curve that IE-C frequency of each uses site-specific initiating event or data, such as found initiating event in NUREG-4461.

group.

Tornado initiating event frequencies will be based on a The TMRE process hazard curve that IE-C1 4.1 was followed as uses site specific described.

data provided in Table 6.1 of NUREG 4461 The TMRE process Do not credit was followed as Same comment as IE-C3 recovery of offsite 6.1, Appendix A described. Offsite AS-A10 power. power recovery was not credited.

The TMRE process was followed as described. As CHARACTERIZE the mentioned, NUREG uncertainty in the 4461, Tornado tornado initiating Climatology, data event frequencies includes uncertainty.

and PROVIDE mean Additionally, the R-IE-C15 values for use in the 4.3 squared value is quantification of the provided to help PRA results. NUREG characterize the 4461, Tornado uncertainty of the Climatology, data HNP initiating event includes uncertainty.

best fit interpolated/

extrapolated frequencies.

U.S. Nuclear Regulatory Commission Page 11 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

Utilize the accident sequences (typically LOSP) provided in the internal events AS-A model and adjust as necessary to consider the consequences of a tornado event.

The TMRE process was followed as described. The transient LOSP accident sequence event tree from the internal events model that was utilized considers the consequences of a Modify the internal tornado event.

events accident Certain exposed AS-A1 sequences in 6.1, 6.3, 6.4, 6.5 SSCs are not compliance with this credited in SR accordance with the TMRE process, such as the shutdown diesel and the air compressors.

Operator actions are adjusted as necessary according to the TMRE process.

The TMRE process Review the FPIE was followed as success criteria and described. Certain modify the exposed SSCs are associated system not credited in AS-A3 6.1, 6.3, 6.4, 6.5 models as necessary accordance with the to account for the TMRE process, such tornado event and its as the shutdown consequences. diesel and the air compressors.

U.S. Nuclear Regulatory Commission Page 12 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

Review the FPIE The TMRE process success criteria and was followed as modify the described. Operator associated operator AS-A4 6.4 actions are adjusted actions as necessary as necessary to account for the according to the tornado event and its TMRE process.

consequences.

The TMRE process was followed as Modify the FPIE described. The accident sequence transient LOSP model in a manner accident sequence that is consistent event tree from the with the plant- internal events model specific: system that was utilized design, EOPs, considers the abnormal consequences of a procedures, and tornado event.

plant transient Certain exposed AS-A5 6.1, 6.3, 6.4, 6.5 response. Account SSCs are not for system functions credited in that, as a accordance with the consequence of the TMRE process, such tornado event, will as the shutdown not be operable or diesel and the air potentially degraded, compressors.

and operator actions Operator actions are that will not be adjusted as possible or impeded. necessary according to the TMRE process.

U.S. Nuclear Regulatory Commission Page 13 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

In constructing the accident sequence models, support system modeling, etc. realistic criteria or assumptions should be used, Capability Category unless a The TMRE process I. In modifying the conservative was followed as accident sequence approach can be described. Active models, INCLUDE, justified. Use of components not in for each tornado conservative Cat I structures are initiating event, assumptions in the not credited in INDIVIDUAL base model can accordance with the EVENTS IN THE distort the results TMRE process, such ACCIDENT and may not be 6.3, 7.2.3, as the shutdown AS-A10 SEQUENCE conservative for Appendix A diesel and the air SUFFICIENT TO delta CDF/LERF compressors. This BOUND SYSTEM calculation. While conservative OPERATION, use of conservative assumption could TIMING, AND or bounding lead to a non-OPERATOR assumptions in PRA conservative delta ACTIONS models is CDF/LERF. A NECESSARY FOR acceptable, a specific sensitivity KEY SAFETY qualitative or was performed.

FUNCTIONS.

quantitative assessment may be needed to show that those assumptions do not underestimate delta CDF/LERF estimates.

Dependencies that can impact the ability of the mitigating AS-B systems to operate and function shall be addressed.

U.S. Nuclear Regulatory Commission Page 14 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

For each tornado event, IDENTIFY mitigating systems impacted by the occurrence of the The TMRE process initiator and the was followed as extent of the impact. described. Impacts INCLUDE the impact on mitigating AS-B1 6.1, 6.3, 6.5, 6.6 of initiating events on systems were mitigating systems in included for all the accident modeled tornado progression either in initiating events.

the accident sequence models or in the system models.

IDENTIFY the The TMRE process phenomenological was followed as conditions created by described. Unique the accident weather phenomena progression. such as intense rain Consider concurrent could be an issue impacts related to during tornado tornado missiles initiating events for (e.g., the possibility structures that are of multiple missile not designed to AS-B3 strikes in a given 5.6, 6.3, 6.4, 6.6 withstand the winds.

sequence. Also high Active components in winds and rains after non-Cat I structures the tornado event were not credited in could result in accordance with the hazardous conditions TMRE process.

(e.g. debris and Operator actions that structural require travel through instabilities) for non-Cat I structures actions outside the or areas are not control room. credited.

U.S. Nuclear Regulatory Commission Page 15 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

Review FPIE time phased dependencies to The TMRE process identify model was followed as changes needed to described. Time address all the phased concurrent system AS-B7 6.1 dependencies were functions failed by reviewed and no the tornado event; model changes were e.g. LOSP, identified for the instrument air, fire TMRE model.

protectionetc.

Do not model offsite recovery.

The overall success criteria for the PRA and the system, structure, component, and human action success criteria used SC-A in the PRA shall be defined and referenced, and shall be consistent with the features, procedures, and operating philosophy of the plant.

Consider impact on both units for the same tornado N/A. HNP is s single SC-A4 6.1 including the unit site.

mitigating systems that are shared.

The systems analysis shall provide a reasonably complete treatment of the causes of SY-A system failure and unavailability modes represented in the initiating events analysis and sequence definition

U.S. Nuclear Regulatory Commission Page 16 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

The TMRE process was followed as described.

Walkdowns were Capability Category performed focusing II. Walkdowns on targets vulnerable focusing on targets to tornado missiles.

vulnerable to tornado The walkdowns also missiles will be surveyed the plant performed. for the missile SY-A4 Walkdown will Section 3 inventory. Pathways include a missile for operator actions inventory and a outside the control review of pathways room were discussed available to the with the site operators for ex- personnel; however control room actions. operator actions that require travel through non-Cat I structures or outside areas are not credited.

New basic events The TMRE process will be added to was followed as address all the described. New basic failure modes of the events and flags system targets were added to exposed to tornado address all the failure SY-A11 missiles; safety 6.3, 6.5, 6.6 modes of the safety related and non- related and non-safety related. safety related system The exclusions of targets exposed to SY-A15 do not apply tornado missiles in for SSCs impacted accordance with the by tornado missiles. TMRE process.

U.S. Nuclear Regulatory Commission Page 17 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

DO NOT INCLUDE in a system model component failures that would be beneficial to system operation, unless omission would distort the results.

For example, do not assume a vent pipe will be sheered by a high energy missile verses crimped unless it can be The TMRE process SY-A12 shown this is true for 5.2 was followed as all missiles at all described.

speeds. Exceptions would be components that are intentionally designed to "fail" favorably when struck by a missile; e.g. a frangible plastic pipe used as a vent is designed to break off and not crimp when struck by a missile.

The TMRE process was followed as described. Targets with the potential to cause a flow Consider the targets diversion when potential to cause a struck by a tornado SY-A13 flow diversion when 6.5 missile were struck by a tornado considered. Beyond missile. steam breaks around main steam lines, no additional flow diversions were required to be modeled.

U.S. Nuclear Regulatory Commission Page 18 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

Missile targets will be assessed for all failure modes - some new failure modes The TMRE process may be identified was followed as SY-A14 that are not in the 6.5 described. SSCs FPIE model. were assessed for all The exclusions of failure modes.

SY-A15 do not apply for SSCs impacted by tornado missiles .

The failure by tornado missiles should be included in the model for all unprotected targets that are supposed to be protected The TMRE process according to the CLB was followed as and any unprotected described. The targets that are not failure by tornado in the CLB but are in missiles was The failure of SSCs the PRA model. This included in the model due to tornado is to facilitate for all unprotected SY-A15 missiles shall not use sensitivity studies 6.5 targets that are the exclusions of SY- regarding possible supposed to be A15. correlation of protected according tornado missile to the CLB and any damage across unprotected targets systems. It is not that are not in the expected that the CLB but are in the number of basic PRA model.

events added to the model for this analysis will be so large that this screening is necessary.

Certain post initiator HFEs will be The TMRE process SY-A17 modified to account 6.4 was followed as for the tornado described.

event.

U.S. Nuclear Regulatory Commission Page 19 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

The thermal/hydraulic, structural, and other supporting engineering bases shall be capable of providing success criteria and event timing sufficient for SY-B quantification of CDF and LERF, determination of the relative impact of success criteria on SSC and human actions, and the impact of uncertainty on this determination.

Capability Category I. BASE support The TMRE process system modeling on was followed as the use of described. The CONSERVATIVE systems analysis SUCCESS from the internal CRITERIA AND Same comment as events was the SY-B7 7.2.3 TIMING. Sensitivity AS-A10 foundation for the studies will be TMRE model. Credit performed to identify given to available where conservative PRA SSCs was in assumptions may be accordance with the distorting risk and TMRE process.

adjusted accordingly.

Consider spatial The TMRE process relationships was followed as between described.

components to Correlation was identify correlated SY-B8 5.6 considered where the failures. Where the same missile can same missile can impact targets that impact targets that are in close proximity are in close proximity to each other.

to each other.

U.S. Nuclear Regulatory Commission Page 20 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

The industry indicated in earlier discussions that information is available to show that statistical correlation of tornado missile Statistical correlation damage for specially of tornado missile separated There are no damage between components is deviations taken from SY-B14 redundant and Appendix B.4.4 insignificant. Until the TMRE guidance spatially separated that information is document.

components is NOT reviewed and required.

accepted by the staff, this SR should be met (spans all capability categories) and dependent failures of multiple SSCs should be considered.

The TMRE process was followed as INCLUDE new described. No new operator interface operator interface dependencies across SY-B15 6.4 dependencies across systems or trains systems or trains related to the were identified in the tornado event.

TMRE model development.

A systematic review of the relevant procedures shall be used to identify the HR-E set of operator responses required for each of the tornado accident sequences

U.S. Nuclear Regulatory Commission Page 21 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

The TMRE process was followed as described. Operator interviews for the credited actions were Operators will be performed during the interviewed (if development of the necessary) to assess internal events model HR-E3 the need for changes 6.4 that the TMRE model to operator actions is based on.

for the tornado Furthermore, during initiating events. the TMRE development a HNP former equipment operator was consulted for further considerations.

Operators talk-throughs or simulator The TMRE process observations will be was followed as conducted (if described. Operator necessary) to assess interviews/ talk the need for changes throughs for the to operator actions credited actions were for the tornado performed during the initiating events. development of the

[Note: this applies to internal events model HR-E4 6.4 new sequences or that the TMRE model failure combinations is based on.

not accounted for in Furthermore, during the internal events the TMRE model. It is not development a HNP intended that former equipment operator action operator was timing needs be consulted for further changed due to the considerations.

tornado event alone]

U.S. Nuclear Regulatory Commission Page 22 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

The assessment of the probabilities of the post-initiator HFEs shall be performed using a well-defined and self-consistent process that addresses the plant-specific and HR-G scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence.

Operators will be interviewed and simulator The TMRE process observations was followed as conducted (if described. Operator necessary) to assess interviews/ talk the need for changes throughs for the to operator action credited actions were timing as a result of performed during the the tornado event. development of the internal events model HR-G5 [Note: this applies to 6.4 that the TMRE model new sequences or is based on.

failure combinations Furthermore, during not accounted for in the TMRE the internal events development a HNP model. It is not former equipment intended that operator was operator action consulted for further timing needs be considerations.

changed due to the tornado event alone]

Dependencies will be The TMRE process recalculated when was followed as the model is HR-G7 6.4 described. No new quantified or combinations were modified by created or credited.

inspecting cutsets.

U.S. Nuclear Regulatory Commission Page 23 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

Recovery actions (at the cutset or scenario level) shall be modeled only if it has been demonstrated that the action is plausible and HR-H feasible for those scenarios to which they are applied.

Estimates of probabilities of failure shall address dependency on prior human failures in the scenario.

Do not credit recovery actions to restore functions, The TMRE process systems, or was followed as components unless described. Recovery HR-an explicit basis 6.4 actions to restore H1/H2 accounting for functions, systems, tornado impacts on or components were the site and the not credited.

SSCs of concern is provided.

Each parameter shall be clearly defined in terms of the logic model, basic event DA-A boundary, and the model used to evaluate event probability.

The TMRE process was followed as described. New basic events and flags Develop new basic were added to events for tornado address all the failure missile targets (all DA-A1 6.3, 6.5, 6.6 modes of the safety failure modes) in related and non-accordance with this safety related system SR.

targets exposed to tornado missiles in accordance with the TMRE process.

U.S. Nuclear Regulatory Commission Page 24 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

The level 1 quantification shall quantify core QU-A damage frequency and shall support the quantification of LERF.

Do not credit recovery actions to restore functions, The TMRE process systems, or was followed as components unless described. Recovery QU-A5 an explicit basis 6.4 actions to restore accounting for functions, systems, tornado impacts on or components were the site and the not credited.

SSCs of concern is provided.

Model quantification shall determine that all identified QU-C dependencies are addressed appropriately.

Identify new operator action dependencies The TMRE process created as a result of was followed as the changes to the described. No new QU-C1 6.4 internal events PRA operator actions or model or failures combinations were associated with created or credited.

tornado events.

U.S. Nuclear Regulatory Commission Page 25 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

The quantification results shall be reviewed, and significant contributors to CDF (and LERF), such as initiating events, accident sequences, and basic events QU-D (equipment unavailabilities and human failure events), shall be identified. The results shall be traceable to the inputs and assumptions made in the PRA.

The TMRE process was followed as Review described. Cutsets nonsignificant cutset were reviewed QU-D5 or sequences to 7.3 including significant determine the and non-significant sequences are valid cutsets to ensure the sequences are valid.

The TMRE process was followed as Review BE described. BE importance to make QU-D7 7.3 importances were sure they make reviewed to ensure logical sense.

they make logical sense.

Uncertainties in the PRA results shall be characterized.

Sources of model uncertainty and QU-E related assumptions shall be identified, and their potential impact on the results understood.

Identify sources of 7.1 The TMRE process QU-E1 uncertainty related to Also see Appendices was followed as MIP and missiles A and B for bases. described.

U.S. Nuclear Regulatory Commission Page 26 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

Identify assumptions made that are The TMRE process QU-E2 different than those Section 6 was followed as in the internal events described. .

model Identify how the model uncertainty is The TMRE process QU-E4 affected by 7.1, Appendix A was followed as assumptions related described.

to MIP and missiles The accident progression analysis shall include The TMRE process LE-C identification of those 7.1, 7.3 was followed as sequences that described.

would result in a large early release.

Do not credit recovery of offsite power. Do not credit recovery actions to restore functions, systems, or The TMRE process Same comment as 6.3, 7.2.3 ,

LE-C3 components unless was followed as AS-A10 Appendix A an explicit basis described.

accounting for tornado impacts on the site and the SSCs of concern is provided.

U.S. Nuclear Regulatory Commission Page 27 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard NRC Comments NEI 17-02 Section Additional HNP Supporting Requirements (No comments if Addressing SR TMRE comments Requiring Self-Assessment blank)

Changes made for application of the PRA to tornado missile impact risk determination such as those to initiating event analysis, accident sequences, systems analysis, human reliability analysis, and parameter estimation should be documented, as described in various documentation SRs for each HLR. The The TMRE process Multiple documentation Section 8 was followed as SRs should be sufficient described.

to understand basis and facilitate review.

Examples of such SRs include IE-D1 through IE-D3, SY-C1 through SY-C3, and DA-E1 through DA-E3. It is recognized that the documentation of changes to the PRA and their basis will be captured in the template of the license amendment request.

Serial: HNP-17-072 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400/Renewed License No. NPF-63 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Enclosure Evaluation of the Proposed Change Attachment 3 Updated Final Safety Analysis Report Page Markups (7 pages plus cover)

Shearon Harris Nuclear Power Plant UFSAR Chapter: 1 Regulatory Guide 1.74 QUALITY ASSURANCE TERMS AND DEFINITIONS Conformance with Regulatory Guide 1.74 is addressed in the description of the Quality Assurance Program that is incorporated by reference into the FSAR Chapter 17 (see Section 17.3) No change this page. For info only Regulatory Guide 1.76 DESIGN BASIS TORNADO FOR NUCLEAR POWER PLANTS (REV.0)

The SHNPP project complies with this guide (with the exception described below).

Regulatory Guide 1.76 Revision 1 was issued for use in March 2007. This regulatory guide provides licensees and applicants with new guidance that the staff of the NRC considers acceptable for use in selecting the design-basis tornado and design-basis tornado-generated missiles that a nuclear plant should be designed to withstand. This guidance divides the United States into three regions: the Harris Nuclear Plant is located in Region 1. The NRC staff accepts the methods described in Regulatory Guide 1.76 Revision 1 to evaluate submittals from operating reactor licensees after March 2007 who voluntarily propose to initiate system modifications that have a clear nexus with the guidance provided. No backfitting is intended or approved in conjunction with its issuance. The Harris Nuclear Plant adopts the guidance provided in Regulatory Guide 1.76 Revision 1 as an optional design basis for new system modifications occurring after March 2007.

FSAR

Reference:

Section 3.3.2.1.

Regulatory Guide 1.77 ASSUMPTIONS USED FOR EVALUATING A CONTROL ROD EJECTION ACCIDENT FOR PRESSURE AND WATER REACTORS (REV. 0)

The SHNPP project complies with the guide with the exception described below:

Westinghouse methods and criteria are documented in Reference 1.8-8 which has been reviewed and accepted by the NRC.

The results of the Westinghouse analyses show agreement with Regulatory Positions C.1 and C.3. In addition, Westinghouse utilizes the assumptions given in Appendices A and B of the Regulatory Guide. However, Westinghouse takes exception to Regulatory Position C.2 which implies that the rod ejection accident should be considered as an emergency condition.

Westinghouse considers this a faulted condition as stated in ANSI N18.2. Faulted condition stress limits will be applied for this accident.

FSAR

Reference:

Section 15.4.8.

Regulatory Guide 1.78 EVALUATING THE HABITABILITY OF A NUCLEAR POWER PLANT CONTROL ROOM DURING A POSTULATED HAZARDOUS CHEMICAL RELEASE (REV 1)

The SHNPP project complies with this guide.

FSAR

Reference:

Section 6.4 and Section 2.2.3.3.

Amendment 61 Page 47 of 71

Shearon Harris Nuclear Power Plant UFSAR Chapter: 1 The SHNPP project complies with this guide.

FSAR

Reference:

Chapters 13 and 14.

Regulatory Guide 1.115 PROTECTION AGAINST LOW-TRAJECTORY TURBINE MISSILES (REV 1)

The SHNPP project complies with the intent of this guide in that due to the limited exposure of vital equipment and the high degree of barrier protection provided, and as stated in the NRC SER Supplement No. 3, dated July 1977, low trajectory turbine missiles will not be a significant threat to the plant.

FSAR

Reference:

Section 3.5.1 Regulatory Guide 1.116 QUALITY ASSURANCE REQUIREMENTS FOR INSTALLATION, INSPECTION, AND TESTING OF MECHANICAL EQUIPMENT AND SYSTEMS Conformance with Regulatory Guide 1.116 is addressed in the description of the Quality Assurance Program that is incorporated by reference into the FSAR Chapter 17 (see Section 17.3)

Regulatory Guide 1.117 TORNADO DESIGN CLASSIFICATION (REV. 1)

The SHNPP project complies with this guide.

FSAR

Reference:

Sections 3.3 and 3.5.1.4.

Regulatory Guide 1.118 PERIODIC TESTING OF ELECTRIC POWER AND PROTECTION SYSTEMS (REV 2)

Except as noted below, SHNPP complies with IEEE Standard 338-1977, Reg. Guide 1.118.

With these exceptions, the project still meets IEEE 338-1971 as discussed in Section 7.1.2.18 and IEEE except 338-1975 as for conditions discussed deemed in Sectionusing acceptable 8.3.1.2.27.

TMRE methodology that was approved by the NRC in [Document Name, ADAMS number]. TMRE is an alternative methodology NSSS for determining whether protection from tornado-generated missiles is required. The methodology Westinghouse can willonly makebeclear applied to discovered distinction conditions whereand between recommendations tornado missile when requirements addressing criteria. Detailed positions on the Regulatory Positions are presented missile protection was not provided, and cannot be used to avoid providing tornado below:

protection in the plant modification process.

a) Regulatory Position C.1 - Westinghouse will provide a means to facilitate response time testing from the sensor input at the protection rack to and including the input to the actuation device. Examples of actuation devices are the protection system relay or bistable.

Westinghouse defines "Protective Action Systems" to mean the electric, instrumentation and controls portions of those protection systems and equipment actuated and controlled by the protection system.

Amendment 61 Page 57 of 71

Shearon Harris Nuclear Power Plant UFSAR Chapter: 3 3.5.1.4 Missiles Generated by Natural Phenomena The worst credible missiles generated by natural phenomena to be considered in SHNPP are those generated by the design basis tornado. All structures that house systems and components to be protected against tornado generated missiles and the types of protection have been presented in Table 3.5.1-2.

The postulated tornado missiles include representative objects in the plant area which could be picked up or injected into the tornado wind field. The characteristics of the tornado generated missiles considered in the plant design are given in Table 3.5.1-3. The missiles listed in this table are considered as striking in all directions.

Structures, systems, and components whose failure could prevent safe shutdown of the reactor or result in significant uncontrolled release of radioactivity from the Unit are protected from such failure due to design tornado and wind loading of missiles by the following methods:

a) Structure or component is designed to withstand tornado loading or tornado missile.

b) Component is housed within a structure which is designed to withstand the tornado loading and tornado missile.

Although Regulatory Guide 1.117 (Revision 1) is not applicable to SHNPP, the design of SHNPP is such that the structures, systems, and components specified in the appendix to the guide are protected against tornadoes and tornado missiles. As a result, SHNPP is in compliance with Regulatory Guide 1.117.

All Seismic Category I structures are capable of resisting penetration of tornado driven missiles as explained in Section 3.5.1.1.2. The tornado generated missile spectrum used in the design of Seismic Category I structures are listed in Table 3.5.1-3.

Table 3.5.1-2 identifies the structures used for protection. All Seismic Category I structures are designed with a minimum f'c of 4000 psi concrete and a minimum thickness of 24 inches in roofs and walls. Design requirements are specified in Section 3.8.

3.5.1.5 Missiles Generated by Events Near the Site The missiles generated by events near the site are discussed in Section 2.2.3.

3.5.1.6 Aircraft Hazards Insert:The TheSHNPP NRC approved a license is remote from amendment federal in [Document airways, airports, Name, ADAMS airport approaches, militarynumber, add installation orspecific reference] for SHNPP that authorized use of the Tornado Missile Risk Evaluator (TMRE) airspace usage and, therefore, an aircraft hazard analysis is not required. Specific reasons are detailed below:

methodology. TMRE is an NRC approved methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions1.whereNo federal tornadoairways or protection missile airport approaches was notpass within two provided, andmiles of SHNPP.

cannot be used See Section to avoid providing 2.2.2.5 and Figure 2.2.2-1.

tornado missile protection in the plant modification process.

Except for SSCs listed in Table 3.5.1-2a, which were demonstrated to be acceptable using TMRE

2. No airports are located within five miles of SHNPP. See Section 2.2.2.5 and Figure methodology,2.2.2-1.

Amendment 61 Page 78 of 512

Shearon Harris Nuclear Power Plant UFSAR Chapter: 3 TABLE 3.5.1-2 OUTDOOR SAFETY-RELATED STRUCTURES, SYSTEMS, AND COMPONENTS PROTECTED AGAINST TORNADO GENERATED MISSILES STRUCTURE, SYSTEM COMPONENT MISSILE PROTECTION AFFORDED

1) Containment Buildings Exterior walls and domes are designed in accordance with Section 3.5.1.

2) Reactor Auxiliary Building Exterior walls and roofs are designed in accordance with Section 3.5.1.

3) Waste Processing Building Exterior walls up to EL 261 and roofs at El 261 are designed in accordance with Section 3.5.1.

4) Fuel Handling Building Exterior walls and roofs are designed in accordance with Section 3.5.1.

5) Emergency Service Water and Cooling Exterior walls and roofs are designed in Tower Makeup Water Intake Structure accordance with Section 3.5.1.

6) Emergency Service Water Screening Exterior walls and roofs are designed in Structure accordance with Section 3.5.1.

7) Condensate Storage Tank Enclosure Exterior walls and roofs are designed in accordance with Section 3.5.1.

8) Reactor Make-up Water Storage Tank Exterior walls are designed in accordance with Enclosure(1) Section 3.5.1.

9) Diesel Fuel Oil Storage Tank Structure Exterior walls and roofs are designed in accordance with Section 3.5.1.

10) Diesel Generator Building Exterior walls and roofs are designed in accordance with Section 3.5.1.

11) Seismic Category I Electrical Manholes Exterior walls and roofs are designed in accordance with Section 3.5.1.

12) Refueling Water Storage Tank Enclosure Exterior walls are designed in accordance with Section 3.5.1.

13) All HVAC Air Intakes and Exhausts for Are provided with missile protective concrete Safety-Related Systems wall barriers

14) Diesel Generator Combustion Air Intake Are provided with missile protective concrete and Exhaust wall barriers Amendment 61 Page 1 of 2

Shearon Harris Nuclear Power Plant UFSAR Chapter: 3 TABLE 3.5.1-2 OUTDOOR SAFETY-RELATED STRUCTURES, SYSTEMS, AND COMPONENTS PROTECTED AGAINST TORNADO GENERATED MISSILES STRUCTURE, SYSTEM COMPONENT MISSILE PROTECTION AFFORDED

15) Underground Class IE Cabling Are separated to the greatest extent possible according to the criteria set forth in Section 3.5.1; provided with an adequate depth of earth cover and/or a concrete slab covering, and in areas where redundant lines must cross paths, a concrete slab is placed between the redundant lines.

16) Underground Safety-Related Piping Are separated to the greatest extent possible according to the criteria set forth in Section 3.5.1; are provided with an adequate depth of earth cover and/or a concrete slab covering, and in areas where redundant lines must cross paths, a concrete slab is placed between the redundant lines.

17) Containment Equipment Hatch Exterior walls and roofs are designed in accordance with Section 3.5.1.

18) Above Ground Exterior Piping Are provided with missile protective concrete barriers. Barriers encase the piping and extend from exterior concrete walls designed in accordance with Section 3.5.1 to below grade where an adequate depth of earth cover is provided.

Note: (1) The refueling water storage tank and the reactor make-up water storage enclosures are not provided with a roof. In the unlikely event that a postulated tornado missile strike causes complete loss of a tank and its contents, ample time is available to bring the plant to a shutdown, as required by Technical Specifications.

Note (2) As discussed in Section 3.5.1.4, TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. Table 3.5.1-2a lists conditions where the TMRE methodology has demonstrated that tornado missile protection is not required.

Amendment 61 Page 2 of 2

TABLE 3.5.1-2a SAFETY-RELATED STRUCTURES, SYSTEMS AND COMPONENTS THAT DO NOT REQUIRE PROTECTION FROM TORNADO GENERATED MISSILES BASED ON TORNADO MISSILE RISK EVALUATOR METHODOLOGY System Component Auxiliary Feedwater Turbine Driven Auxiliary Feedwater Pump exhaust pipe (3MS16-185SAB-1) is exposed to potential tornado missiles.

6.9 kV Standby AC A train Diesel Fuel Oil supply line (3FO2-42SA-1) to the Day Tank Power, Emergency in the Diesel Generator Building is exposed to potential tornado Diesel Generators missiles through Security door 1FP-D1133.

(EDG) Electrical conduits (17179Q SA and 16255V SA) in the Diesel Generator Building, EL 261 common corridor, are exposed to potential tornado missiles through multiple openings in the corridor exterior wall (two HVAC vent openings with manbarriers installed, Unit 1 Security door 1FP-D1133, and Unit 2 Security door 1FP-D1134).

Inverted neck vent lines 7LO6-34-1, 7LO6-36-1, 7EA8-11-1, and 7EA8-13-1 located on the Diesel Generator Building roof are exposed to potential tornado missiles.

Conduits 17199K SA in the A EDG room and 17196X SB in the B EDG room are exposed to potential tornado missiles through the east exterior wall air intake louvers for each room.

A & B train EDG Fuel Oil Return lines are exposed to potential tornado missiles through the east exterior wall air intake louvers.

Emergency Service A train electrical conduits in the ESW Intake Screening Structure Water (ESW) are exposed to potential tornado missiles through Security door 1FP-D1336. Affected conduits are 17049M SA, 12295C SA, 12219M SA, 12312D SA, 16091H SA, 16091ESA, 16091D SA, 16091C SA, 16091G SA, 16091A SA, 16149J SA, 12296J SA, and 12219J SA.

Conduits 12293E-SA and 13292C-SA, A Traveling Screen Wash supply line, A Traveling Screen motor, and Cabinet Y21-C7-ESF-A inside the A ESW pump room are exposed to potential tornado missiles through penetration seals E2264, P4042, and E2266 in the A ESW Intake Structure east exterior wall.

The A or B ESW Traveling Screens are exposed to potential tornado missiles through a steel checkered plate covering the coarse screen and stop log guides.

The A or B ESW Traveling Screens are exposed to potential tornado missiles above the water if the Main Reservoir is at the lowest level allowed by Technical Specifications Battery Room The EL 305 HVAC exhaust plenums for both the 1A-SA and 1B-SB Ventilation Battery Rooms within the Main Steam Penthouse on the RAB EL 305 roof are susceptible to missiles. The EL 305 HVAC exhaust duct and motor operator for A and B RAB SWGR RM (1AV-11:002 and 1AV-13:002) are exposed to potential tornado missiles.

Main Steam 1MS-81, 1MS-83, and 1MS-85 are exposed to potential tornado missiles through two Main Steam pipe openings in the Main Steam Penthouse on the RAB EL 305 roof in the east penthouse wall

System Component The Main Steam Safety Relief Valve vent pipes/stacks and the Main Steam Power Operated Relief Valve vent pipes/stacks on the RAB EL 305 roof are exposed to potential tornado missiles.

Main Steam Tunnel Electrical conduits 112751R SA and 12751A SA and supply fan S64 Ventilation S3 SA located in the Main Steam EL 305 HVAC A Train Supply Air Intake pillbox are exposed to potential tornado missiles through Security door 1FP-D0515 and through louvered HVAC air Intakes with steel manbarriers.

Electrical conduits 12753A SB & 12753J SB and supply fan S65 S3 SB located in the Main Steam EL 305 HVAC B Train Supply Air Intake pillbox are exposed to potential tornado missiles through Security door 1FP-D0516 and through louvered HVAC air Intakes with steel manbarriers.

Essential Services The A and B train Essential Services Chilled Water System Chilled Water Expansion Tanks 1CH-E085 and 1CH-E086 and the 2 connecting pipe at RAB EL 324 are exposed to potential missile pipe through outside air intake openings in the Reactor Auxiliary Building EL 324 exterior walls. There are 3 large openings through 41 line wall and 3 through 45 line wall.

Reactor Auxiliary The Reactor Auxiliary Building roof HVAC Exhaust Stack 1AV-Building ERABVS is exposed to potential tornado missiles.

Reactor Auxiliary Building EL 305 Outdoor Ambient Air Pressure Sensing Instrument Tubing PDT-1AV-4834-A1SAHP-T378 (A Train) and PDT1AV4834B1SBHP-T379 (B Train) are exposed to potential tornado missiles.

ESW Intake Structure Outdoor air temperature elements TE-01EV-6589ASA, TE-01EV-Ventilation 6589BSB, TE-01EV-6591ASA, and TE-01EV-6591BSB are vulnerable to potential tornado missiles.

Electrical conduit 17072F-SB inside the B ESW electrical room is exposed to potential tornado missiles through Security door 1FP-D1173 opening.

Fuel Handling Building Outdoor Ambient Air Pressure Sensing Instrument Tubing PDT-Ventilation *1FL-5027ASA-T368 and PDT-*1FL-5027BSB-T370 are exposed to potential tornado missiles.

Diesel Generator Outdoor air temperature elements TE-6902A-SA and TE-6902B-SB Building Ventilation are vulnerable to potential tornado missiles.