HNP-17-072, License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into Licensing Basis

License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into Licensing Basis

ML17292B648
Person / Time
Site:	Harris
Issue date:	10/19/2017
From:	Bradley Jones Duke Energy Progress
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
HNP-17-072
Download: ML17292B648 (78)

Text

Bentley K. Jones Director, Organizational Effectiveness Harris Nuclear Plant 5413 Shearon Harris Road New Hill, NC 27562-9300 10 CFR 50.90 October 19, 2017 Serial: HNP-17-072 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Shearon Harris Nuclear Power Plant, Unit 1 Docket No. 50-400/Renewed License No. NPF-63

Subject:

License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Ladies and Gentlemen:

Pursuant to 10 CFR 50.90, Duke Energy Progress, LLC (Duke Energy), hereby requests a license amendment for the Shearon Harris Nuclear Power Plant, Unit 1 (HNP), to incorporate the Tornado Missile Risk Evaluator (TMRE) Methodology into the HNP Updated Final Safety Analysis Report. The TMRE Methodology was transmitted to the NRC by the Nuclear Energy Institute as NEI 17-02, Revision 1 (ADAMS Accession No. ML17268A036), and is incorporated by reference into this license amendment request (LAR). This LAR was discussed with the NRC staff in a presubmittal public meeting on August 30, 2017. TMRE is proposed as a methodology for determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where tornado missile protection is not currently provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

This LAR is one of three pilot LARs supporting NRC approval of the TMRE Methodology.

Approval of the proposed amendment is requested within six months of NRC staff acceptance to support utilization of the methodology by other licensees. Duke Energy will implement the amendment within 90 days of the NRC approval date.

This LAR contains no regulatory commitments.

In accordance with 10 CFR 50.91, Duke Energy is notifying the State of North Carolina of this LAR by transmitting a copy of this letter and enclosure to the designated State Official.

U.S. Nuclear Regulatory Commission Serial HNP-17-072 Page2 If there are any questions or if additional information is needed, please contact John Caves at (919) 362-2406.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on October 19, 2017.

Sincerely,

Enclosure:

Evaluation of the Proposed Change cc:

Mr. J. Zeiler, NRC Sr. Resident Inspector, HNP Mr. W. L. Cox, Ill, Section Chief, N.C. DHSR Ms. M. Barillas, NRC Project Manager, HNP Ms. E. Brown, NRC Project Manager, DORL TMRE Mr. E. Miller, NRC Project Manager, HNP TMRE LAR Mr. A. Schwab, NRC DPR Ms. C. Haney, NRC Regional Administrator, Region II

U.S. Nuclear Regulatory Commission Page 2 Serial HNP-17-072 If there are any questions or if additional information is needed, please contact John Caves at (919) 362-2406.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on October 19, 2017.

Sincerely, Bentley K. Jones

Enclosure:

Evaluation of the Proposed Change cc:

Mr. J. Zeiler, NRC Sr. Resident Inspector, HNP Mr. W. L. Cox, III, Section Chief, N.C. DHSR Ms. M. Barillas, NRC Project Manager, HNP Ms. E. Brown, NRC Project Manager, DORL TMRE Mr. E. Miller, NRC Project Manager, HNP TMRE LAR Mr. A. Schwab, NRC DPR Ms. C. Haney, NRC Regional Administrator, Region II

Serial: HNP-17-072 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400/Renewed License No. NPF-63 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Enclosure Evaluation of the Proposed Change

1.

Summary Description

2.

Detailed Description 2.1 Background Information 2.2 Current Licensing Basis Requirements 2.3 Reason for the Proposed Change 2.4 Description of the Proposed Change

3.

Technical Evaluation 3.1 Tornado Missile Risk Evaluator Methodology 3.2 Traditional Engineering Considerations 3.3 Risk Assessment 3.4 Technical Evaluation Conclusions

4.

Regulatory Evaluation 4.1 Applicable Regulatory Requirements/Criteria 4.2 No Significant Hazards Consideration Analysis 4.3 Regulatory Evaluation Conclusions

5.

Environmental Consideration

6.

References ATTACHMENTS:

1. Detailed Risk Assessment Information

2. Probabilistic Risk Assessment Technical Adequacy Documentation

3. Updated Final Safety Analysis Report Markups

U.S. Nuclear Regulatory Commission Page 2 of 28 Serial HNP-17-072 Enclosure

1.

Summary Description The proposed change will incorporate the Tornado Missile Risk Evaluator (TMRE) Methodology into the Shearon Harris Nuclear Power Plant, Unit 1 (HNP) Updated Final Safety Analysis Report (UFSAR). The TMRE Methodology was transmitted to the NRC by the Nuclear Energy Institute (NEI) as NEI 17-02, Revision 1 (ADAMS Accession No. ML17268A036), and is incorporated by reference into this license amendment request (LAR). TMRE is proposed as a methodology for determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where tornado missile protection is not currently provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

2.

Detailed Description 2.1 Background Information The NRC issued Regulatory Issue Summary (RIS) 2015-06, Tornado Missile Protection, on June 10, 2015 (ADAMS Accession No. ML15020A419). The RIS documented the following:

Systems, structures, and components (SSCs) of nuclear power plants are designed to withstand natural phenomena such as earthquakes, tornadoes, hurricanes, and floods without the loss of capability to safely maintain the plant. In general, the design bases for these structures, systems, and components reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed. The specific criteria for each nuclear power plant are contained in the individual plants specific licensing basis.

In the late 1970s and early 1980s several licensees identified components that did not conform to their plant specific licensing basis for tornado-generated missile protection.

Examples of nonconforming items included components not located inside structures designed to protect against tornados and tornado-generated missiles, components not provided with tornado missile barriers, and components not designed to withstand tornados and tornado missiles. Topical reports were submitted by the Electric Power Research Institute (EPRI) for NRC review of the probability-based TORMIS methodology. The TORMIS methodology determines the probability of components being struck and disabled by a tornado-generated missile, and was accepted for use by the NRC. In cases where some components were not in conformance with a plants licensing basis, licensees used the TORMIS methodology as a means for demonstrating that the probability of these components being struck by a tornado-generated missile was low enough to justify that protection from tornado-generated missiles was not required. Several licensees have incorporated the TORMIS methodology, or other probabilistic methodologies, into their plant specific licensing basis.

U.S. Nuclear Regulatory Commission Page 3 of 28 Serial HNP-17-072 Enclosure The industry and NEI developed an alternative risk-informed methodology for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles. TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

2.2 Current Licensing Basis (CLB)

General Design Criteria General Design Criteria (GDC) in existence in 1987 at the time when HNP was licensed for operation were contained in Appendix A to 10 CFR 50, GDC for Nuclear Power Plants, effective May 21, 1971, and subsequently amended July 7, 1971, and October 23, 1978. The two GDCs that relate to tornado missiles and high winds and that are applicable to HNP are GDC 2 and 4 and are stated as follows:

GDC 2 stated that structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these structures, systems, and components shall reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena and, (3) the importance of the safety functions to be performed.

GDC 4 stated that structures, systems, and components important to safety shall be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents including loss-of-coolant accidents. These structures, systems, and components shall be appropriately protected against dynamic effects, including the effects of missiles, pipe whipping, and discharging effects, that may result from equipment failures and from events and conditions outside the nuclear power unit.

However, dynamic effects associated with postulated pipe ruptures in nuclear power units may be excluded from the design basis when analyses reviewed and approved by the Commission demonstrate that the probability of fluid system piping rupture is extremely low under conditions consistent with the design basis for the piping.

Shearon Harris Safety Evaluation Report NRC staff issued NUREG-1038, Shearon Harris Safety Evaluation Report, to document the scope of their review during the initial licensing process. Excerpts relevant to tornado missile protection from NUREG-1038 include:

U.S. Nuclear Regulatory Commission Page 4 of 28 Serial HNP-17-072 Enclosure Section 3.5.1 The tornado missile spectrum was reviewed in accordance with Standard Review Plan (SRP) 3.5.1.4 (NUREG-0800). Conformance with the acceptance criteria formed the basis for the staff evaluation of the tornado-missile spectrum with respect to the applicable regulations of 10 CFR 50. The portions of the SRP review procedures concerning the probability per year of damage to safety-related systems as a result of missiles were not used in the staff review.

GDC 2 requires that structures, systems, and components essential to safety be designed to withstand the effects of natural phenomena, and GDC 4 requires that these same plant features be protected against missiles generated by natural phenomena. The missiles generated by natural phenomena of concern are those resulting from tornadoes. The applicant has identified a spectrum of missiles for a tornado Region I site as identified in RG 1.76, Position C.l, and has utilized missile Spectrum A of SRP 3.5.1.4 as the basis for the design of tornado-missile protection.

Section 3.5.2 The structures, systems, and components to be protected from externally tornado-generated missiles were reviewed in accordance with SRP 3.5.2 (NUREG-0800)

The applicant has identified all safety-related structures, systems, and components requiring protection from externally generated missiles. All safety-related structures are designed to withstand postulated tornado-generated missiles without damage to the safety-related equipment they contain. All safety-related systems and components and stored fuel are located within tornado-missile-protected structures or are provided with tornado-missile barriers.

Based on the above, the staff concludes that the applicant's list of safety-related structures, systems, and components to be protected from externally generated missiles and the provisions in the plant design providing this protection are in accordance with the requirements of GDC 2 and 4 with respect to missile and environmental effects and the guidelines of RG 1.13, Position C.2; RG 1.27, Positions C.2 and C.3; and RG 1.117, Positions C.1 through C.3, concerning protection of safety-related plant features, including stored fuel and the ultimate heat sink, from tornado missiles.

Updated Final Safety Analysis Report Section 1.8, Conformance to NRC Regulatory Guides RG 1.76, Design Basis Tornado for Nuclear Power Plants HNP complies with RG 1.76, Rev. 0.

HNP adopts the guidance provided in Regulatory Guide 1.76 Revision 1 as an optional design basis for new system modifications occurring after March 2007.

U.S. Nuclear Regulatory Commission Page 5 of 28 Serial HNP-17-072 Enclosure RG 1.117, Tornado Design Classification, Rev. 1 The SHNPP project complies with this guide.

Section 2.3, Meteorology The SHNPP site lies within Region I for determining the Design Basis Tornado. The Region I associated Design Basis Tornado parameters are as follows:

Maximum wind speed 360 mph Rotational wind speed 290 mph Translational speed 70 mph maximum; 5 mph minimum Radius of maximum rotational speed 150 ft.

Pressure drop 3.0 psi Rate of pressure drop 2.0 psi/sec.

Calculation of the tornado strike probability: Consequently, one would expect a tornado strike every 944 years.

Section 3.1, Compliance with NRC General Design Criteria 3.1.2 Criterion 2 - Design Bases for Protection Against Natural Phenomena The structures, systems and components important to safety are protected from or designed to withstand the effects of natural phenomena without loss of capability to perform their safety functions.

The most severe natural phenomena considered in the design in terms of induced stresses are the safe shutdown earthquake (SSE) and the design basis tornado. Structures, systems, and components essential to the safe shutdown of the plant are designed to withstand the effects of the most severe natural phenomena, including floods, hurricanes, tornadoes or the SSE, as appropriate.

3.1.4 Criterion 4 - Environmental and Dynamic Effects Design Bases Structures, systems, and components are designed, arranged or protected such that the external missiles will not cause an accident which could result in the release of significant amounts of radioactivity or prevent safe plant shutdown.

Failure of high pressure lines external to the Containment will not cause a LOCA (loss of coolant accident), or prevent safe shutdown of the Unit.

U.S. Nuclear Regulatory Commission Page 6 of 28 Serial HNP-17-072 Enclosure Section 3.3 Wind and Tornado Loadings Structures, systems, or components whose failure, due to design wind loading, tornado wind loading, or associated missiles, could prevent safe shutdown of the reactor, or result in significant uncontrolled release of radioactivity from the unit, are protected from such failure by one of the following methods:

a) the structure or component is designed to withstand design wind, tornado wind and tornado generated missiles, or b) the system or components are housed within a structure which is designed to withstand the design wind, tornado wind and tornado generated missiles.

Table 3.3.0-1 lists all safety related structures and the method of wind/tornado protection as applicable. The Ta or Tb designation in the table refers to item a or b above.

Section 3.5, Missile Protection Section 3.5.0 Missile Selection and Description The following criteria were adopted for assessing the plant's capability to withstand the missiles postulated in Sections 3.5.1.1 and 3.5.1.2:

a) No perforation of the Containment Building (i.e., no loss of leak tightness) b) Assurance that the plant can be maintained in a safe shutdown condition c) Offsite exposure within 10 CFR 100 guidelines for missile damage resulting in radioactivity release.

Sources considered capable of generating potential missiles are as follows:

a) Tornadoes All Seismic Category I structures are designed to withstand the tornado generated missiles specified in the "Missile Spectrum" of the Standard Review Plan 3.5.1.4 (Rev. 0) and listed in Table 3.5.1-3. All Seismic Category I structures are designed with f'c=4000 psi concrete and a minimum thickness of 24 inches in roofs and walls.

U.S. Nuclear Regulatory Commission Page 7 of 28 Serial HNP-17-072 Enclosure UFSAR Table 3.5.1-3, Tornado-generated Missile Spectrum Missile Weight Area (ft2)

Velocity (fps)

1.

Wood Plank 4 in. x 12 in. x 12 ft.

200

.333 422

2.

Steel Pipe 3 in. x 10 ft.

schedule 40 78

.0155 211

3.

Steel Rod 1 in. x 3 ft 8

.00545 317

4.

Steel Pipe 6 in. x 15 ft.

schedule 40 285

.0388 211

5.

Steel Pipe 12 in. x 15 ft.

schedule 40 743

.1014 211

6.

Utility Pole 131/2 in. x 35 ft 1490

.994 211

7.

Automobile 4000 20 106 These missiles are considered to be capable of striking in all directions. Missiles 1, 2, 3, 4 and 5 are considered at all elevations and Missiles 6 and 7 for elevations up to 30 feet above the highest grade level within 1/2 mile of the facility structures.

Section 3.5.1.4, Missiles Generated by Natural Phenomena The worst credible missiles generated by natural phenomena to be considered in SHNPP are those generated by the design basis tornado. All structures that house systems and components to be protected against tornado generated missiles and the types of protection have been presented in Table 3.5.1-2.

The postulated tornado missiles include representative objects in the plant area which could be picked up or injected into the tornado wind field. The characteristics of the tornado generated missiles considered in the plant design are given in Table 3.5.1-3.

The missiles listed in this table are considered as striking in all directions.

Structures, systems, and components whose failure could prevent safe shutdown of the reactor or result in significant uncontrolled release of radioactivity from the Unit are protected from such failure due to design tornado and wind loading of missiles by the following methods:

a) Structure or component is designed to withstand tornado loading or tornado missile.

b) Component is housed within a structure which is designed to withstand the tornado loading and tornado missile.

U.S. Nuclear Regulatory Commission Page 8 of 28 Serial HNP-17-072 Enclosure Section 3.5.2, SSCs to be Protected from Externally Generated Missiles Structures, systems, and components whose failure could prevent safe shutdown of the reactor or result in significant uncontrolled release of radioactivity from the Unit are protected against externally generated missiles; they are listed in Table 3.5.1-2.

Most safety-related systems are located within structures that are specifically designed and constructed to withstand external missiles; therefore they are adequately protected.

The penetrations, access openings, and HVAC air intake and exhaust openings in these safety-related structures are protected by steel doors and/or concrete barriers designed to withstand external missiles.

2.3 Reason for the Proposed Change In response to RIS 2015-06, Duke Energy performed walkdowns at HNP to identify potential discrepancies with the HNP CLB related to tornado missile protection. Those walkdowns identified conditions where the plant configuration did not conform to the design and licensing bases. The non-conforming conditions were entered into the corrective action program and are summarized in Table 2.3 below.

Conditions that rendered the affected SSCs inoperable were processed in accordance with Enforcement Guidance Memorandum (EGM) 15-002 and DSS-ISG-2016-01, with short-term and long-term compensatory actions taken. That action resulted in those SSCs being restored to operable but nonconforming status. The conditions that satisfied reporting criteria of 10 CFR 50.72 and/or 10 CFR 50.73 were reported to the NRC in event notification 52072 and Licensee Event Report 2016-001 (ADAMS Accession No. ML16245A804).

As documented by the NRC in EGM 15-002, Enforcement Discretion for Tornado-generated Missile Protection Non-Compliance, tornado missile scenarios do not generally represent an immediate safety concern because their risk is bounded by the initiating event frequency and safety-related SSCs are typically designed to withstand the effects of tornados. The staffs study established that the core damage frequency (CDF) associated with tornado missile related non-compliances is well below a CDF requiring immediate regulatory action.

Table 2.3 Discovered Non-conforming Conditions System Component Auxiliary Feedwater Turbine Driven Auxiliary Feedwater Pump exhaust pipe (3MS16-185SAB-1) is exposed to potential tornado missiles.

6.9 kV Standby AC Power, Emergency Diesel Generators A train Diesel Fuel Oil supply line (3FO2-42SA-1) to the Day Tank in the Diesel Generator Building is exposed to potential tornado missiles through Security door 1FP-D1133.

U.S. Nuclear Regulatory Commission Page 9 of 28 Serial HNP-17-072 Enclosure Table 2.3 Discovered Non-conforming Conditions System Component (EDG)

Electrical conduits (17179Q SA and 16255V SA) in the Diesel Generator Building, EL 261 common corridor, are exposed to potential tornado missiles through multiple openings in the corridor exterior wall (two HVAC vent openings with personnel barriers installed, Unit 1 Security door 1FP-D1133, and Unit 2 Security door 1FP-D1134).

Inverted neck vent lines 7LO6-34-1, 7LO6-36-1, 7EA8-11-1, and 7EA8-13-1 located on the Diesel Generator Building roof are exposed to potential tornado missiles.

Conduits 17199K SA in the A EDG room and 17196X SB in the B EDG room are exposed to potential tornado missiles through the east exterior wall air intake louvers for each room.

A & B train EDG Fuel Oil Return lines are exposed to potential tornado missiles through the east exterior wall air intake louvers.

Emergency Service Water (ESW)

A train electrical conduits in the ESW Intake Screening Structure are exposed to potential tornado missiles through Security door 1FP-D1336. Affected conduits are 17049M SA, 12295C SA, 12219M SA, 12312D SA, 16091H SA, 16091ESA, 16091D SA, 16091C SA, 16091G SA, 16091A SA, 16149J SA, 12296J SA, and 12219J SA.

Conduits 12293E-SA and 13292C-SA, A Traveling Screen Wash supply line, A Traveling Screen motor, and Cabinet Y21-C7-ESF-A inside the A ESW pump room are exposed to potential tornado missiles through penetration seals E2264, P4042, and E2266 in the A ESW Intake Structure east exterior wall.

The A or B ESW Traveling Screens are exposed to potential tornado missiles through a steel checkered plate covering the coarse screen and stop log guides.

The A or B ESW Traveling Screens are exposed to potential tornado missiles above the water if the Main Reservoir is at the lowest level allowed by Technical Specifications Battery Room Ventilation The EL 305 HVAC exhaust plenums for both the 1A-SA and 1B-SB Battery Rooms within the Main Steam Penthouse on the RAB EL 305 roof are susceptible to missiles. The EL 305 HVAC exhaust duct and motor operator for A and B RAB SWGR RM (1AV-11:002 and 1AV-13:002) are exposed to potential tornado missiles.

Main Steam 1MS-81, 1MS-83, and 1MS-85 are exposed to potential tornado missiles through two Main Steam pipe openings in the Main Steam Penthouse on the RAB EL 305 roof in the east penthouse wall The Main Steam Safety Relief Valve vent pipes/stacks and the Main Steam Power Operated Relief Valve vent pipes/stacks on the RAB EL 305 roof are exposed to potential tornado missiles.

U.S. Nuclear Regulatory Commission Page 10 of 28 Serial HNP-17-072 Enclosure Table 2.3 Discovered Non-conforming Conditions System Component Main Steam Tunnel Ventilation Electrical conduits 112751R SA and 12751A SA and supply fan S64 S3 SA located in the Main Steam EL 305 HVAC A Train Supply Air Intake pillbox are exposed to potential tornado missiles through Security door 1FP-D0515 and through louvered HVAC air Intakes with steel personnel barriers.

Electrical conduits 12753A SB & 12753J SB and supply fan S65 S3 SB located in the Main Steam EL 305 HVAC B Train Supply Air Intake pillbox are exposed to potential tornado missiles through Security door 1FP-D0516 and through louvered HVAC air Intakes with steel personnel barriers.

Essential Services Chilled Water The A and B train Essential Services Chilled Water System Expansion Tanks 1CH-E085 and 1CH-E086 and the 2 connecting pipe at RAB EL 324 are exposed to potential tornado missiles through outside air intake openings in the Reactor Auxiliary Building EL 324 exterior walls. There are 3 large openings through 41 line wall and 3 through 45 line wall.

Reactor Auxiliary Building The Reactor Auxiliary Building roof HVAC Exhaust Stack 1AV-ERABVS is exposed to potential tornado missiles.

Reactor Auxiliary Building EL 305 Outdoor Ambient Air Pressure Sensing Instrument Tubing PDT-1AV-4834-A1SAHP-T378 (A Train) and PDT1AV4834B1SBHP-T379 (B Train) are exposed to potential tornado missiles.

ESW Intake Structure Ventilation Outdoor air temperature elements TE-01EV-6589ASA, TE-01EV-6589BSB, TE-01EV-6591ASA, and TE-01EV-6591BSB are vulnerable to potential tornado missiles.

Electrical conduit 17072F-SB inside the B ESW electrical room is exposed to potential tornado missiles through Security door 1FP-D1173 opening.

Fuel Handling Building Ventilation Outdoor Ambient Air Pressure Sensing Instrument Tubing PDT-

• 1FL-5027ASA-T368 and PDT-*1FL-5027BSB-T370 are exposed to potential tornado missiles.

Diesel Generator Building Ventilation Outdoor air temperature elements TE-6902A-SA and TE-6902B-SB are vulnerable to potential tornado missiles.

Plant modifications to restore compliance with the CLB would have very limited safety benefit but would require extensive resources, and would divert those resources from more safety significant activities. NRC approval of the TMRE Methodology and this license amendment request would revise the HNP CLB to restore the non-conforming conditions to full qualification.

Utilization of risk insights in the allocation of NRC staff and industry resources is consistent with the NRC policy.

U.S. Nuclear Regulatory Commission Page 11 of 28 Serial HNP-17-072 Enclosure 2.4 Description of the Proposed Change Duke Energy requests NRC approval to incorporate the Tornado Missile Risk Evaluator (TMRE)

Methodology into the HNP UFSAR. TMRE is proposed as a methodology for determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where tornado missile protection is not currently provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE Methodology was transmitted to the NRC by NEI as NEI 17-02, Revision 1 (ADAMS Accession No. ML17268A036) and is hereby incorporated by reference into this LAR.

The proposed change:

revises the HNP UFSAR Section 1.8, Conformance to NRC Regulatory Guides (RG) related to RG 1.117, Tornado Design Classification. RG 1.117 describes a method acceptable to the NRC staff for identifying those SSCs of light-water-cooled reactors that should be protected from the effects of the Design Basis Tornado. This LAR proposes to add an alternative methodology to the HNP UFSAR, TMRE, to describe a method to determine whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process; revises the HNP UFSAR section 3.5.1.4 to include the TMRE Methodology; added Note 2 to Table 3.5.1-2, Outdoor Safety-Related Structures, Systems, and Components Protected Against Tornado Generated Missiles, to reference exceptions using the TMRE Methodology; and revises the HNP UFSAR to add Table 3.5.1-2a, Safety-Related Structures, Systems And Components That Do Not Require Protection from Tornado Generated Missiles Based on Tornado Missile Risk Evaluator Methodology.

The HNP UFSAR markups are in Attachment 3.

3.

Technical Evaluation The NRCs policy statement on probabilistic risk assessment (PRA) encourages greater use of PRA techniques to improve safety decision-making and improve regulatory efficiency. One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis, provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants LB, as in requests for license amendments and technical specification changes under 10 CFR 50.90. TMRE is proposed as a risk-informed methodology for evaluating the impact of existing conditions where tornado missile protection is required in a licensees CLB, but the required protection was not provided. For conditions that meet the acceptance criteria of the methodology, the HNP licensing basis would be revised.

U.S. Nuclear Regulatory Commission Page 12 of 28 Serial HNP-17-072 Enclosure GDC 2 requires that SSCs important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions. GDC 4 requires that SSCs important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes. Regulatory Guide (RG) 1.117, Tornado Design Classification, Revision 1, describes a method acceptable to the NRC staff for identifying those SSCs of light-water-cooled reactors that should be protected from the effects of the Design Basis Tornado, including tornado missiles, and remain functional. TMRE is proposed as an alternative methodology for identifying whether certain SSCs must be protected from the effects of tornado missiles. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

3.1 Tornado Missile Risk Evaluator Methodology The TMRE Methodology employs a simplified, conservative assessment of risks to core damage and large early release posed by tornado-generated missiles at nuclear plants. The guidance for use of the methodology is found in NEI 17-02, Tornado Missile Risk Evaluator Industry Guidance Document, Revision 1, which is incorporated by reference into this LAR. The guidance document provides a detailed approach to gathering the necessary information and translating the information into a PRA model. The risk assessment methods, acceptance criteria, and five principles of risk-informed decision-making found in NRC RG 1.174 are used to determine whether risks posed by potential tornado missiles at a site warrant protective measures.

3.2 Traditional Engineering Considerations Two of the five key principles of risk-informed decision making address the traditional engineering considerations of defense-in-depth and maintaining sufficient safety margins. Those two considerations are discussed below with respect to the proposed change to the HNP licensing basis. The remaining principles will be discussed in section 4 of this LAR.

The proposed change is consistent with a defense-in-depth philosophy.

Defense-in-depth is an approach to designing and operating nuclear facilities to prevent and mitigate accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. No individual failure, including one caused by the impact of a tornado missile, would prevent the fulfillment of a safety function.

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o No new accidents or transients are introduced with the proposed change, and the facility is still well protected from tornado missiles.

o The proposed change does not significantly impact the availability and reliability of SSCs that provide safety functions that prevent challenges from progressing to

U.S. Nuclear Regulatory Commission Page 13 of 28 Serial HNP-17-072 Enclosure core damage. The magnitude of the change is consistent with the guidance of Regulatory Guide 1.174.

o None of the non-conforming conditions in the TMRE model only affect LERF, which is an indication that there was no significant impact on prevention of containment failure.

o The change does not significantly reduce the effectiveness of the emergency preparedness program including the ability to detect and measure releases of radioactivity, notify offsite agencies and the public, and shelter or evacuate the public as necessary.

Over-reliance on programmatic activities as compensatory measures associated with the change in the LB is avoided.

o Implementation of the proposed change does not require compensatory measures. The risk assessment associated with this LAR gave no credit to compensatory measures implemented in response to the non-conforming conditions.

o No plant operating procedures will be changed to implement the proposed change.

o The proposed change does not rely upon proceduralized operator actions within an hour of a tornado passing that would require operators to travel into areas that are not protected from the effects of the tornado or tornado missiles.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

o The proposed change does not modify the redundancy, independence, or diversity described in the HNP UFSAR. The proposed change does not result in a disproportionate increase in risk.

o The HNP UFSAR documents a tornado strike frequency of 944 years, which is an infrequent event and which is unchanged by this LAR.

o The proposed change has no impact on the assumptions in the HNP safety analyses presented in the UFSAR, chapters 6 or 15.

o The proposed change has no impact on the availability or reliability of SSCs that could either initiate or mitigate events, with the exception of tornado missile protection, which is thoroughly evaluated in this LAR.

o Equipment available both onsite and offsite supporting Diverse and Flexible Coping Strategies (FLEX) could be utilized if needed to mitigate the impact of a tornado missile. Critical equipment is stored in structures that would prevent it from being impacted by a tornado or tornado missile.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

U.S. Nuclear Regulatory Commission Page 14 of 28 Serial HNP-17-072 Enclosure o The non-conforming conditions are physically distributed about the HNP site, so there is a low likelihood of multiple SSCs being impacted.

o The missiles affecting emergency diesel generator or emergency service water systems would not affect the alternate seal injection diesel, which is independent of those two systems. Although the alternate seal injection diesel is not protected from tornado missiles, it is in a location with limited exposure to tornado missiles due to it being located below grade in a hole with reinforced concrete walls. It is not in the near proximity to either the emergency diesel generators or the emergency service water systems. As a result, the critical safety function of providing reactor coolant pump seal flow and DC battery charging would be preserved unless multiple missiles affected both the primary and backup functions, a very low likelihood condition.

Independence of barriers is not degraded.

o Of the three fission product barriers, neither the fuel clad nor reactor coolant system piping is directly exposed to tornado missiles, and the containment remains a robust tornado missile barrier.

o The proposed change does not significantly increase the likelihood or consequence of an event that challenges multiple barriers, and does not introduce a new event.

o Although the proposed change does slightly increase the frequency of core damage, that increase is very small and has no significant impact on the fission product barriers.

Defenses against human errors are preserved.

o HNP has symptom-based abnormal operating procedures and emergency operating procedures that would be utilized in the event of a tornado adversely impacting safety-related equipment. The procedures provide guidance to operators for preservation of critical safety functions. The procedures include guidance in the event response not obtained, which provide alternative actions if equipment was damaged by tornadoes or other reasons.

o Implementation of the proposed change will not create new human actions that are important to preserving the layers of defense, or significantly increase mental or physical demand on individuals responding to a tornado.

o HNP has a procedure that prescribes actions to be taken by plant staff in the event of a tornado watch, tornado warning, and after a tornado has passed. This includes post-tornado walkdowns for tornado missile vulnerable SSCs. It includes a table of plant vulnerabilities to tornado-generated missiles and recovery actions that reduce the impact of a tornado missile affecting the identified SSCs.

o Proceduralization of safety-significant operator actions, coupled with training and standards for procedure compliance, preserve the defense against human errors.

The intent of the plants design criteria is maintained.

U.S. Nuclear Regulatory Commission Page 15 of 28 Serial HNP-17-072 Enclosure o This LAR only affects plant design criteria related to tornado missile protection, and a very small fraction of the overall system areas would remain not protected from tornado missilies. All other aspects of the plant design criteria are unaffected.

o This LAR maintains the intent of the plant design criteria for tornado missile protection, which is to provide reasonable assurance of achieving and maintaining safe shutdown in the event of a tornado. The evaluation performed and documented in this LAR demonstrates that the risk associated with the proposed change is very small and within accepted guidance for protection of public health and safety.

o The methodology cannot be used in the modification process for a future plant change to avoid providing tornado missile protection. Therefore, the intent of the plants design criteria is maintained.

o Protection of the identified SSCs would have assured they would not be damaged by design basis tornado missiles. In lieu of protection for the identified nonconforming SSCs, HNP has analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequent effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact is known, and it is negligible. Therefore, the intent of the plants design criteria is maintained.

The proposed change maintains sufficient safety margins.

There are few non-conforming conditions. The vast majority of each system important to safety remains protected from tornado missiles, consistent with the CLB. The identified vulnerabilities represent a small fraction of the potential target area of the system. The likelihood of redundant trains both being impacted by tornado missiles is much lower than the likelihood of a single train being impacted. The TMRE Methodology includes a conservative treatment of conditions where a single tornado missile could impact more than one component through physical correlation.

The number of potential missiles identified at HNP is approximately 40% less than the number of missiles assumed by the TMRE Methodology.

HNP has diverse and flexible coping strategies to restore critical safety functions in the event of a hypothetical loss of the primary functions. In some cases, non-safety-related equipment could function to mitigate the impact of a hypothetical tornado missile strike to safety-related equipment. For example, the alternate seal injection diesel and two FLEX diesel generators could mitigate the impact of loss of one or both emergency diesel generators. FLEX portable pumps could mitigate the impact of loss of either Auxiliary Feedwater pumps or Emergency Service Water pumps. Important FLEX equipment is stored in a building designed to protect from the effects of a tornado, including tornado missiles. Written procedures provide guidance for implementing those actions.

Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved by the NRC) continue to be met. The proposed change is not in conflict with approved codes and standards relevant to the SSCs.

U.S. Nuclear Regulatory Commission Page 16 of 28 Serial HNP-17-072 Enclosure The safety analysis acceptance criteria in the licensing basis are unaffected by the proposed change. The requirements credited in the accident analyses will remain the same.

Therefore, the proposed change maintains sufficient safety margins and continues to protect public health and safety.

3.3 Risk Assessment The TMRE Methodology is used to estimate the quantitative risk associated with tornado-generated missiles for discrepancies with the HNP CLB related to tornado missile protection. It makes use of the HNP internal events PRA model, which was used to estimate the risk associated with the passage of a tornado over the HNP site.

The TMRE is a hybrid methodology comprised of two key elements: (1) a deterministic element to establish the likelihood that a specific SSC (target) will be struck by tornado-generated missile; and (2) a probabilistic element to assess the impact of the missile strike on the core damage and large early release frequencies.

The output of the deterministic element is a calculated Exposed Equipment Failure Probability (EEFP) that is based largely on a simplified generic relationship between tornado strength and the population of materials at a typical nuclear power plant that may become airborne during a tornado. Site-specific inputs to the EEFP include the frequency of a tornado striking the site and the size and location of the target SSCs being evaluated. The output of the probabilistic element is an estimation of an increase in core damage frequency and large early release frequency.

3.3.1 High Winds Equipment List (HWEL)

The TMRE HWEL was developed using the current HNP high winds analysis. The HWEL was re-evaluated with the TMRE Methodology. The HWEL identifies potential vulnerable components that needed to be walked down. The following was considered in the update of the HWEL.

The non-conformance items were added to the list.

Items screened based on being in Category I structures were reviewed for the presence of potential missile paths The TMRE model uses the loss of offsite power (LOSP) sequences with no offsite power recovery, therefore PRA logic and components that do not support mitigating a LOSP can be screened.

Operator actions were assessed based on the TMRE Methodology. Internal events PRA data were used to perform the assessment of the operator actions. An operator review was performed for the TMRE operator action assessment. An individual with HNP Auxiliary Operating experience was provided the list of credited and not credited operator actions to verify exposed operator actions were not being credited in the TMRE PRA.

U.S. Nuclear Regulatory Commission Page 17 of 28 Serial HNP-17-072 Enclosure 3.3.2 Target Walkdowns The walkdowns considered the following:

1. Locate and identify the SSC; verify that the SSC is located where it is documented to be.

Note any support systems or subcomponents, such as electrical cabling, instrument air lines, and controllers.

2. Document and describe barriers that could prevent or limit exposure of the SSC to tornado missiles; Photograph any barriers that could prevent tornado missiles from impacting the SSC. This may include barriers or shielding designed to protect an SSC from tornado missiles, as well as other SSCs that may preclude or limit the exposure of the target SSC to missiles (e.g., buildings, large sturdy components).

3. Identify directions from which tornado missiles could strike the target.

4. Determine and/or verify the dimensions of the target SSCs, including any subcomponents or support systems. Missile exposure area can be limited when missiles are blocked by barriers.

5. Determine the proximity and potential correlation to other target SSCs. For the purpose of the TMRE, correlated targets are SSCs that can be struck by the same tornado missile.

6. Note any nearby large inventories of potential tornado missiles.

7. Proximity of non-Category I structures to exposed target SSCs should be documented. A non-Category I structure may collapse or tip-over and cause damage to an SSC.

8. Identify vent paths for tanks that may be exposed to atmospheric pressure changes.

3.3.3 Missile Walkdowns Missiles were counted in a 2500-foot radius around the center of the containment building.

Structural and non-structural missiles are considered. HNP has existing missile counts, but these counts only cover 600 feet from PRA targets. Additional missile counts were required to address the gaps.

The estimated missiles based within the 2500 ft radius is summarized in Table 3.3.3 with a total missile estimate of 139,411. This missile count is bounded by and justifies the use of the generic missile count from the TMRE guidance which is 240,000.

Table 3.3.3 TMRE Missile Counts Source Non-Structural Structural Totals Within 600 feet 13,106 68,918 82,024 Greater than 600 feet but less than 2500 feet 38,387 19,000 57,387 Total of all missiles 139,411

U.S. Nuclear Regulatory Commission Page 18 of 28 Serial HNP-17-072 Enclosure 3.3.4 Tornado Hazard Frequency The guidance in NEI 17-02, Revision 1, and data in NUREG/CR-4461, Revision 2, were used to determine the tornado initiating event frequencies for the HNP TMRE PRA model. Site-specific tornado frequencies for applicable tornadoes were developed as a result of this effort.

NUREG/CR-4461 provides tornado strike data for HNP with wind speeds associated with varying frequencies per year. For the purposes of the TMRE, the Fujita prime scale (F) is used to classify tornadoes; this scale is somewhat different from the original Fujita Scale and the Enhanced Fujita Scale. Using this data, a site-specific tornado hazard curve was developed, and the frequency of all tornadoes considered in the TMRE (F2 through F6) was calculated.

Since F probabilities are not directly available, they are derived from site specific Fujita scale data available in Table 6-1 of NUREG/CR-4461.

In accordance with the guidance the TMRE Methodology, plotting the HNP points in a XY scatter chart with a logarithmic trend line the following HNP specific hazard curve is created.

Miles per Hour (mph) = -22.8

• ln(Frequency) - 98.333 R-squared = 0.9985 Using the trend line equation, exceedance frequencies for the upper ranges of each F category, F2 through F6 were calculated and are tabulated in Table 3.3.4.

Table 3.3.4 TMRE Tornado Hazard Frequencies Fujita prime Frequency per year F2 1.10E-4 F3 2.75E-5 F4 7.05E-6 F5 1.33E-6 F6 7.09E-8 3.3.5 Target Evaluation The list of potentially vulnerable targets to tornado missile that are modeled in the PRA and support LOSP mitigation are identified and characterized. These targets have been added to the TMRE model. The failure probability of the targets is calculated using the Exposed Equipment Failure Probability (EEFP). The EEFP is the conditional probability that an exposed target is hit and failed by a tornado missile, given a tornado of a certain magnitude. For a single target, five EEFP values will be calculated, one each for tornado categories F2 through F6.

U.S. Nuclear Regulatory Commission Page 19 of 28 Serial HNP-17-072 Enclosure The EEFP is defined as:

EEFP = (MIP) x (# of Missiles) x (Target Exposed Area) x Fragility The Missile Impact Parameters (MIP) is the probability of a tornado missile hit on a target, per target square area, per missile, per tornado. Generic MIP values are provided in Table 5-1 of NEI 17-02, Revision 1.

1. of Missiles is the number of damaging missiles; the generic values recommended in Section 5 of NEI 17-02, Revision 1 are applied. The robust percentage applied to the missiles may be larger than recommended in the TMRE Methodology, which is conservative.

Target Exposed Area is determined for each specific target.

Fragility is the conditional probability of the target failing to perform its function given that it is hit by a tornado missile. For the purposes of the TMRE, it is assumed to be 1.0.

If the EEFP calculated is greater than 1.0, a 1.0 failure probability is applied in the model.

The TMRE EEFP Evaluation Results are in Table 3.3.5, located in Attachment 1.

3.3.6 Model Development The TMRE model is developed using the current internal events model. The HNP general transient tree addresses steam loss in the turbine building, loss of service water, Loss of primary makeup, LOSP, and transient induced LOCAs (i.e. seal failure or primary relief valve failure). The transients sequence applied to the LOSP initiating events address the tornado damage states expected based on a review of the vulnerable equipment and the LOSP. The tornado initiating events for TMRE are added to the model at the LOSP initiating event location in the fault tree. The equipment vulnerable to tornado missiles were added to the model using the EEFP events with values from Table 3.3.5.

Some of the non-conformances were screened as having negligible impact on risk, and were therefore not explicitly modeled. Three penetrations at the A ESW Intake Structure had a combined effective area of approximately nine square feet, which met the De Minimis definition of the TMRE Methodology, and were therefore screened out assuming a negligible impact on risk. For the purpose of this pilot LAR for TMRE, a sensitivity analysis was performed to justify the approach, which is documented in Section 3.3.9.2.

Several of the non-conforming conditions were safety-related features that had previously been evaluated to have a negligible impact on the Regulatory Guide 1.200 compliant HNP Internal Events PRA and therefore are not explicitly modeled. Because the TMRE Methodology uses the Internal Events PRA, the hypothetical impact of a tornado missile on those features also has a negligible impact on the risk associated with tornado missile protection. Non-conforming features in this category are listed below.

U.S. Nuclear Regulatory Commission Page 20 of 28 Serial HNP-17-072 Enclosure ESWIS Cover Plate protecting ESW Main Intake Suction ESW Intake Bay Traveling Screens 1A-SA & 1B-SB Battery Room exhaust RAB EL 305 Safety Related Conduit Supply Fan S64 Main Steam Tunnel HVAC RAB EL 305 Safety Related Conduit Supply Fan S65 Main Steam Tunnel HVAC ESW Intake Structure Temp elements fed from Safety Related Conduits 13292B-SB, 13292C SA, 13292F SB & 13292G SB FHB EL 286 Roof Exposed instrument tubing sensing outside air pressure. PDT-*1FL-5027ASA at 39 line wall PDT-*1FL-5027BSB at 45 line wall. A and B Fuel Handling Building Emergency Exhaust System (FHBEES) 3.3.7 Model Quantification and Results The TMRE model was quantified with tornado hazard frequencies identified in Table 3.3.4. A truncation study was performed to ensure adequate model convergence. The CDF was truncated at 1E-11/year and the LERF was truncated at 1E-12/year. The core damage frequency (CDF) and larger early release frequency (LERF) for the degraded and compliant plant are in Table 3.3.7.-1 Per Regulatory Guide 1.174, a risk-informed License Amendment Request (LAR) includes an evaluation of the change in risk (e.g., CDF). For the purposes of the TMRE, a licensee needs to calculate this change in risk by comparing two different configurations: the Compliant Case (configuration with the plant built per the required design/licensing bases), and the Degraded Case (current plant configuration, including potential non-conformances for tornado missile protection).

The CDF and LERF are simply calculated as follows:

CDF = CDFDegraded - CDFCompliant LERF = LERFDegraded - LERFCompliant The TMRE results for HNP are 2.2E-8 per year CDF and 2.2E-9 per year LERF.

Table 3.3.7-1 Quantification Results Result Type CDF per Year LERF per Year Degraded 5.44E-7 5.77E-8 Compliant 5.22E-7 5.55E-8 Delta 2.2E-8 2.2E-9 Targets were reviewed for CDF contribution in both the degraded and compliant cases. The only target contributing to CDF in the compliant model was the Refueling Water Storage Tank (RWST). The RWST contributes slightly less CDF contribution in the compliant case versus the degraded case due to the additional equipment availability from assuming the non-conformances are protected. The EDGs and RWST are the most important targets in the degraded case, which is expected due to the assumption of non-recovered LOSP in the model.

U.S. Nuclear Regulatory Commission Page 21 of 28 Serial HNP-17-072 Enclosure LERF results are in general agreement with CDF results and there are not targets in the TMRE model that only affect LERF. A summary of the risk impact of non-conformances is in Table 3.3.7-2, located in Attachment 1.

3.3.8 Tornado Intensity Contribution The tornado initiating event contribution is provided in Table 3.3.8 for the degraded and compliant model results. The non-conformances slightly increase the high wind class contribution in the degraded cases, but the trend of decreasing contribution with increasing tornado intensity is consistent between the compliant and degraded models.

Table 3.3.8 Initiating Event Contribution Event Name Frequency

% CDF Contribution Degraded

% CDF Contribution Compliant Description

%TMRE_F2 1.10E-04 73.8%

75.3%

TMRE Tornado Event F2

%TMRE_F3 2.75E-05 19.4%

18.9%

TMRE Tornado Event F3

%TMRE_F4 7.05E-06 5.4%

4.8%

TMRE Tornado Event F4

%TMRE_F5 1.33E-06 1.3%

0.9%

TMRE Tornado Event F5

%TMRE_F6 7.09E-08 0.04%

0.02%

TMRE Tornado Event F6 3.3.9 Sensitivities The TMRE Methodology identifies sensitivity studies that should be performed and documented if the if the CDF or LERF between the compliant and the degraded case exceed 1E-7/year or 1E-8/year, respectively. The HNP results are below this threshold therefore these sensitivity studies are not performed.

The PRA model and results were reviewed for significant conservative, non-conservative, and uncertainty impacts that could impact the delta risk assessment. The following tornado model impacts were identified for additional review.

1. There has been some general concern that various high winds risk methods may be conservative such as the assumed failure of offsite power for category 2 and greater tornados. These conservative treatments have potential to impact the delta risk calculations non-conservatively. A bounding sensitivity assessment was performed to ensure conservative modeling treatments do not impact the risk assessment conclusions.

2. The De Minimis penetration risk was evaluated to ensure it has a negligible impact on the assessment conclusions.

U.S. Nuclear Regulatory Commission Page 22 of 28 Serial HNP-17-072 Enclosure 3.3.9.1 Conservative Risk Treatments Masking Sensitivity There is a concern that conservative assumptions in the compliant case can mask delta risk estimates. A potential example of this occurring is where a system that supports equipment with identified non-conformance is assumed to fail. The assumed failure of this support system can result in the non-conformance being assumed failed in both the compliant and degraded case.

Although the conservative assumption increases both the degraded model risk and the compliant model risk, there is potential to have a larger impact on the compliant model resulting in underestimating delta risk by over estimating the compliant model risk.

Some identified areas of concern are the assumed failure of offsite power without recovery, failure of exposed operator actions, conservative EEFP treatment of targets, and assumed failure of active exposed components. This is not intended to be a complete list, but examples of identified concerns.

Because the non-conservatism is related to the compliant model resulting in higher estimated risk results, an assessment of these potential conservative assumptions can be bounded by performing a single sensitivity where the compliant risk model results are set to zero. Thus, the delta risk will be equal to the degraded case risk. The results of this sensitivity are shown in Table 3.3.9.

Table 3.3.9 Conservative Risk Masking Sensitivity Result Type CDF (per Year)

LERF (per Year)

Degraded 5.4E-7 5.8E-8 Compliant 0

0 Delta Risk 5.4E-7 5.8E-8 The sensitivity results are 5.4E-7 per year CDF and 5.8E-8 per year LERF. This demonstrates that the potential of conservative assumptions in the delta-risk calculations masking a risk significant result had, at most, a small and acceptable impact.

3.3.9.2 De Minimis Penetration Sensitivity One target set in the HNP TMRE model was determined to be less than 10 square feet and meets the De Minimis screening criteria in the TMRE Methodology. Several penetration seals through the A ESW east exterior wall were found. Several safety related components inside the A ESW pump room are exposed through these penetrations to a tornado missile strike, which could render the A train ESW inoperable. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles and was therefore screened out, consistent with the TMRE Methodology, Section 3.1. This sensitivity will add this target back into the model and determine the actual impact on results.

The combined area of the three penetrations result in approximately 9 square feet of exposure.

The penetrations are sealed fire barriers, but the fire sealant or the pipes are not credited for shielding tornado missiles in this sensitivity. The model was re-quantified. The delta CDF increases by 2E-9 per year and the delta LERF increases by 3E-10 per year. The delta risk

U.S. Nuclear Regulatory Commission Page 23 of 28 Serial HNP-17-072 Enclosure increases due to De Minimis penetration are small and have a negligible impact on the TMRE conclusions.

3.3.10 Risk Assessment Conclusions The TMRE guidance provided in NEI 17-02, Revision 1 was followed without exception and no deviations were applied.

The total change in risk associated with tornado missile damage to non-conforming conditions identified in Table 2.3 results in a CDF of 2.2E-8 per year and LERF of 2.2E-9 per year. The tornado risk change for accepting HNP non-conforming conditions results in a very small risk increase (Region III) per RG 1.174.

3.4 Technical Evaluation Conclusions Utilization of TMRE, which employs a probabilistic approach permitted in regulatory guidance, is a sound and reasonable method of addressing tornado missile protection at HNP for certain SSCs that are not fully protected from the effects of tornado missiles. The proposed change would revise the UFSAR to make TMRE part of the HNP licensing basis for conformance to 10 CFR 50 General Design Criteria 2 and 4. Future discovery of existing tornado missile protection non-conforming conditions will continue to be evaluated using the corrective action program.

The TMRE Methodology could be used to resolve those non-conforming conditions by revising the CLB under 50.59, provided the acceptance criteria are satisfied and conditions stipulated by the staff in the safety evaluation approving the requested amendment are met. Future modifications to the facility requiring tornado missile protection would not be evaluated using the TMRE Methodology. The TMRE Guidance, provided in NEI 17-02, Revision 1, was followed without exception and no deviations were applied.

4.

Regulatory Evaluation 4.1 Applicable Regulatory Requirements/Criteria The NRC requires that nuclear power plants be designed to withstand the effects of natural phenomena, including tornado and high-wind-generated missiles, so as not to adversely impact the health and safety of the public in accordance with the requirements of 10 CFR 50, Appendix A, General Design Criterion (GDC) 2, "Design Bases for Protection against Natural Phenomena," and GDC 4, "Environmental and Dynamic Effects Design Bases." Methods acceptable to the NRC to comply with the aforementioned regulations are described in Regulatory Guides (RG) 1.117, Tornado Design Classification, and NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants" (SRP),

Section 3.5.1.4, Missiles Generated by Natural Phenomena, and Section 3.5.2, Structures, Systems, and Components to be Protected from Externally-Generated Missiles.

SRP Sections 3.5.1.4 and 3.5.2, contain the current acceptance criteria governing tornado missile protection. These criteria generally specify that SSCs that are important to safety be provided with sufficient, positive tornado missile protection (i.e., barriers) to withstand the maximum credible tornado threat. The appendix to RG 1.117, lists the types of SSCs that should be protected from design basis tornadoes. However, SRP Section 3.5.1.4 permits

U.S. Nuclear Regulatory Commission Page 24 of 28 Serial HNP-17-072 Enclosure relaxation of the above deterministic criteria if it can be demonstrated that the frequency of damage to unprotected essential safety-related features is sufficiently small.

To use this probabilistic criterion, NEI developed the TMRE Methodology, NEI 17-02, Revision 1, transmitted to the NRC staff in September 2017, which is incorporated by reference into this LAR. NEI 17-02, Revision 1, contains guidance for application of the methodology and the technical basis for its acceptability. This LAR requests NRC approval for use of the TMRE Methodology in lieu of the deterministic methodology when assessing the need for positive tornado missile protection for specific safety-related plant features in accordance with the criteria of SRP Section 3.5.1.4.

This LAR utilizes a risk-informed change process consistent with the guidelines of Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk Informed Decision on Plant-Specific Changes to the Licensing Basis. As discussed in RG 1.174, in implementing risk-informed decision-making, licensing basis changes are expected to meet a set of key principles. Some of these principles are written in terms typically used in traditional engineering decisions (e.g., defense-in-depth). While written in these terms, it should be understood that risk analysis techniques can be, and are encouraged to be, used to help ensure and show that these principles are met. These principles include the following:

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption.

The proposed change continues to meet current regulations including 10 CFR 50, Appendix A, GDC 2 and GDC 4. No exemptions are requested or required to implement this LAR upon approval by the NRC. Standard Review Plan section 3.5.1.4 permits relaxation of deterministic criteria if it can be demonstrated that the frequency of damage to unprotected safety-related features is sufficiently small. Regulatory Guide 1.174 establishes criteria, approved by the NRC, to quantify the sufficiently small frequency of damage. Application of the TMRE Methodology to the unprotected features at HNP demonstrates that the RG 1.174 criteria are met.

2. The proposed change is consistent with a defense-in-depth philosophy. This is discussed in Section 3.2 of this enclosure.

3. The proposed change maintains sufficient safety margins. This is discussed in Section 3.2 of this enclosure.

4. When proposed changes result in an increase in CDF or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement.

The NRCs policy statement on probabilistic risk assessment encourages greater use of this analysis technique to improve safety decision making and improve regulatory efficiency. One significant activity undertaken in response to the policy statement is the use of PRA to support decisions to modify an individual plants licensing basis.

RG 1.174 provides guidance on the use of PRA findings and risk insights to support licensee requests for changes to a plants licensing basis, as in requests for license amendments under 10 CFR 50.90, Application for Amendment of License, Construction

U.S. Nuclear Regulatory Commission Page 25 of 28 Serial HNP-17-072 Enclosure Permit, or Early Site Permit, RG 1.174 describes an acceptable method for the licensee and NRC staff to use in assessing the nature and impact of licensing basis changes when the licensee chooses to support the changes with risk information.

RG 1.174 also makes use of the NRCs Safety Goal Policy Statement. One key principle in risk-informed regulation is that proposed increases in CDF and risk are small and are consistent with the intent of the Commissions Safety Goal Policy Statement. The safety goals and associated quantitative health objectives define an acceptable level of risk that is a small fraction of other risks to which the public is exposed. The acceptance guidelines defined in Section 2.4 of RG 1.174 are based on subsidiary objectives derived from the safety goals and their quantitative health objectives.

Application of the TMRE Methodology to the unprotected features at HNP demonstrates that the RG 1.174, section 2.4, criteria are met, and therefore, the change is small and consistent with the intent of the Commissions Safety Goal Policy Statement.

5. The impact of the proposed change should be monitored using performance measurement strategies.

The TMRE Methodology, Section 8, describes post license amendment configuration change control. Duke Energy programs and processes will ensure that subsequent configuration changes are evaluated for their impact on the TMRE evaluation. Changes, whether permanent or temporary due to construction, that increase the site missile burden within the 2500' missile radius above the 240,000 missiles assumed in the methodology will be evaluated for impact on the TMRE analysis.

The risk evaluation supporting this change was performed using the HNP Internal Events model. RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors. Attachment 2 to this Enclosure provides documentation that the PRA evaluation is of sufficient quality to support the proposed change.

The proposed change does not affect compliance with these regulations or guidance and will ensure that the lowest functional capabilities or performance levels of equipment required for safe operation are met.

4.2 No Significant Hazards Consideration Analysis The proposed change will incorporate the Tornado Missile Risk Evaluator (TMRE) Methodology into the Shearon Harris Nuclear Power Plant, Unit 1 (HNP) Updated Final Safety Analysis Report (UFSAR). The TMRE Methodology was transmitted to the NRC by the Nuclear Energy Institute as NEI 17-02, Revision 1 (ADAMS Accession Number ML17268A036), and is incorporated by reference into this license amendment request. TMRE is proposed as a methodology for determining whether physical protection from tornado-generated missiles is warranted. The methodology can only be applied to discovered conditions where tornado

U.S. Nuclear Regulatory Commission Page 26 of 28 Serial HNP-17-072 Enclosure missile protection is not currently provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

Duke Energy has evaluated whether a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1) Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed amendment does not involve an increase in the probability of an accident previously evaluated. The relevant accident previously evaluated is a Design Basis Tornado impacting the HNP site. The probability of a Design Basis Tornado is driven by external factors and is not affected by the proposed amendment. There are no changes required to any of the previously evaluated accidents in the UFSAR.

The proposed amendment does not involve a significant increase in the consequences of a Design Basis Tornado. TMRE is a risk-informed methodology for determining whether certain safety-related features, that are currently not protected from tornado-generated missiles, require such protection. The criteria for significant increase in consequences was established in the NRC Policy Statement on probabilistic risk assessment, which were incorporated into Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis. The TMRE calculations performed by Duke Energy meet the acceptance criteria of RG 1.174, which confirms that the proposed amendment does not involve a significant increase in the consequences of an accident previously evaluated. In the event additional non-conforming conditions are discovered in the future, the methodology acceptance criteria for an acceptable risk outcome will ensure that future evaluations also would not result in a significant increase in the probability or consequences of an accident previously evaluated.

Therefore, the proposed amendment, for both the conditions described herein and any future application of the methodology, does not involve a significant increase in the probability or consequences of an accident previously evaluated

2) Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed amendment, including any future use of the methodology, will involve no physical changes to the existing plant, so no new malfunctions could create the possibility of a new or different kind of accident. The proposed amendment makes no changes to conditions external to the plant that could create the possibility of a new or different kind of accident. The proposed change will not create the possibility of a new or different kind of accident due to new accident precursors, failure mechanisms, malfunctions, or accident initiators not considered in the design and licensing bases. The

U.S. Nuclear Regulatory Commission Page 27 of 28 Serial HNP-17-072 Enclosure existing UFSAR accident analysis will continue to meet requirements for the scope and type of accidents that require analysis.

Therefore, the proposed amendment, for both the conditions described herein and any future application of the methodology, does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3) Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The proposed amendment does not exceed or alter any controlling numerical value for a parameter established in the UFSAR or elsewhere in the HNP licensing basis related to design basis or safety limits. The change does not impact any UFSAR Chapter 6 or 15 Safety Analyses, and those analyses remain valid. The change maintains diversity and redundancy as required by regulation or credited in the UFSAR. The change does not reduce defense-in-depth as described in the UFSAR.

Therefore, the proposed amendment, for both the conditions described herein and any future application of the methodology, does not involve a significant reduction in a margin of safety.

Based on the above, Duke Energy concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 Regulatory Evaluation Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.

Environmental Consideration A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

U.S. Nuclear Regulatory Commission Page 28 of 28 Serial HNP-17-072 Enclosure

6.

References 6.1 NEI 17-02, Tornado Missile Risk Evaluator Industry Guidance Document, Revision 1, September 2017 (ADAMS Accession No. ML17268A036).

6.2 Regulatory Issue Summary 2015-06, Tornado Missile Protection (RIS), on June 10, 2015 (ADAMS Accession No. ML15020A419).

6.3 Enforcement Guidance Memorandum 15-002, Enforcement Discretion for Tornado Missile Protection Noncompliance (ADAMS Accession No. ML15111A269).

6.4 Shearon Harris Nuclear Power Plant, Unit No. 1, Updated Final Safety Analysis Report, Amendment 61.

6.5 NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, Revision 2, July 1981.

6.6 NUREG-1038, "Safety Evaluation Report Related to the Operation of the Shearon Harris Nuclear Power Plant, Units 1 and 2," November 1983.

6.7 NUREG/CR-4461, Tornado Climatology of the Contiguous United States, Revision 2, February 2007.

6.8 Regulatory Guide 1.117, Tornado Design Classification, Revision 1, April 1978.

6.9 Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis, Revision 2, May 2011.

Serial: HNP-17-072 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400/Renewed License No. NPF-63 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Enclosure Evaluation of the Proposed Change Detailed Risk Assessment Information

U.S. Nuclear Regulatory Commission Page 2 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Target Description Area (ft2)

Elev

> 30 Robust Type Robust Desc Robust Missiles Missile Count F-Scale MIP EEFP TDAFW Pump Exhaust 16 N

J None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 2.7E-04 100%

155000 3

3.6E-10 8.9E-04 100%

205000 4

6.3E-10 2.1E-03 100%

240000 5

1.6E-09 6.1E-03 100%

240000 6

2.4E-09 9.2E-03 EDG Fuel Oil Line 2

N G

Steel Door 45%

69750 2

1.1E-10 1.5E-05 45%

69750 3

3.6E-10 5.0E-05 45%

92250 4

6.3E-10 1.2E-04 45%

108000 5

1.6E-09 3.5E-04 45%

108000 6

2.4E-09 5.2E-04 Train A EDG Conduits (17179Q SA and 16255V SA) 22 N

J None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 3.8E-04 100%

155000 3

3.6E-10 1.2E-03 100%

205000 4

6.3E-10 2.8E-03 100%

240000 5

1.6E-09 8.5E-03 100%

240000 6

2.4E-09 1.3E-02 Train A ESWSS Conduits 28 N

G Steel Door 45%

69750 2

1.1E-10 2.2E-04 45%

69750 3

3.6E-10 7.0E-04 45%

92250 4

6.3E-10 1.6E-03 45%

108000 5

1.6E-09 4.8E-03 45%

108000 6

2.4E-09 7.3E-03 EDG Roof Vents Train A

66 Y

F Steel Pipe - Less than 10 diameter or 3/8 thickness 70%

108500 2

5.8E-11 4.2E-04 70%

108500 3

2.0E-10 1.4E-03 70%

143500 4

3.4E-10 3.2E-03 70%

168000 5

8.7E-10 9.7E-03 70%

168000 6

1.3E-09 1.4E-02 EDG Roof Vents Train B

66 Y

F Steel Pipe - Less than 10 diameter or 3/8 thickness 70%

108500 2

5.8E-11 4.2E-04 70%

108500 3

2.0E-10 1.4E-03 70%

143500 4

3.4E-10 3.2E-03 70%

168000 5

8.7E-10 9.7E-03

U.S. Nuclear Regulatory Commission Page 3 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Target Description Area (ft2)

Elev

> 30 Robust Type Robust Desc Robust Missiles Missile Count F-Scale MIP EEFP 70%

168000 6

1.3E-09 1.4E-02 ESW Intake Train A Penatration 9

N J

None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 1.5E-04 100%

155000 3

3.6E-10 5.0E-04 100%

205000 4

6.3E-10 1.2E-03 100%

240000 5

1.6E-09 3.5E-03 100%

240000 6

2.4E-09 5.2E-03 EDG Fuel Oil Return Lines Train A 1

N F

Steel Pipe - Less than 10 diameter or 3/8 thickness 70%

108500 2

1.1E-10 1.2E-05 70%

108500 3

3.6E-10 3.9E-05 70%

143500 4

6.3E-10 9.0E-05 70%

168000 5

1.6E-09 2.7E-04 70%

168000 6

2.4E-09 4.0E-04 EDG Fuel Oil Return Lines Train B 1

N F

Steel Pipe - Less than 10 diameter or 3/8 thickness 70%

108500 2

1.1E-10 1.2E-05 70%

108500 3

3.6E-10 3.9E-05 70%

143500 4

6.3E-10 9.0E-05 70%

168000 5

1.6E-09 2.7E-04 70%

168000 6

2.4E-09 4.0E-04 Safety related DGB Governor Conduits Train A 5

N J

None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 8.5E-05 100%

155000 3

3.6E-10 2.8E-04 100%

205000 4

6.3E-10 6.5E-04 100%

240000 5

1.6E-09 1.9E-03 100%

240000 6

2.4E-09 2.9E-03 Safety related DGB Governor Conduits Train B 5

N J

None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 8.5E-05 100%

155000 3

3.6E-10 2.8E-04 100%

205000 4

6.3E-10 6.5E-04 100%

240000 5

1.6E-09 1.9E-03 100%

240000 6

2.4E-09 2.9E-03 SG A MSIV BYPASS (1MS-81) 41 Y

F Steel Pipe - Less than 10 diameter or 3/8 thickness 70%

108500 2

5.8E-11 2.6E-04 70%

108500 3

2.0E-10 8.9E-04 70%

143500 4

3.4E-10 2.0E-03 70%

168000 5

8.7E-10 6.0E-03

U.S. Nuclear Regulatory Commission Page 4 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Target Description Area (ft2)

Elev

> 30 Robust Type Robust Desc Robust Missiles Missile Count F-Scale MIP EEFP 70%

168000 6

1.3E-09 9.0E-03 SG B MSIV BYPASS VALVE (1MS-83) 41 Y

F Steel Pipe - Less than 10 diameter or 3/8 thickness 70%

108500 2

5.8E-11 2.6E-04 70%

108500 3

2.0E-10 8.9E-04 70%

143500 4

3.4E-10 2.0E-03 70%

168000 5

8.7E-10 6.0E-03 70%

168000 6

1.3E-09 9.0E-03 SG C MSIV BYPASS VALVE (1MS-85) 41 Y

F Steel Pipe - Less than 10 diameter or 3/8 thickness 70%

108500 2

5.8E-11 2.6E-04 70%

108500 3

2.0E-10 8.9E-04 70%

143500 4

3.4E-10 2.0E-03 70%

168000 5

8.7E-10 6.0E-03 70%

168000 6

1.3E-09 9.0E-03 SG PORV and MSSV for Train A and B 186 Y

A Steel Pipe - at least 16 diameter and 3/8 thickness 20%

31000 2

5.8E-11 3.3E-04 20%

31000 3

2.0E-10 1.2E-03 20%

41000 4

3.4E-10 2.6E-03 20%

48000 5

8.7E-10 7.8E-03 20%

48000 6

1.3E-09 1.2E-02 SG PORV and MSSV for Train B and C 310 Y

A Steel Pipe - at least 16 diameter and 3/8 thickness 20%

31000 2

5.8E-11 5.6E-04 20%

31000 3

2.0E-10 1.9E-03 20%

41000 4

3.4E-10 4.3E-03 20%

48000 5

8.7E-10 1.3E-02 20%

48000 6

1.3E-09 1.9E-02 ESCW Expansion Tank Train A 23 Y

C Steel Tank - at least 0.25 thickness 40%

62000 2

5.8E-11 8.3E-05 40%

62000 3

2.0E-10 2.9E-04 40%

82000 4

3.4E-10 6.4E-04 40%

96000 5

8.7E-10 1.9E-03 40%

96000 6

1.3E-09 2.9E-03 ESCW Expansion Tank Train B 23 Y

C Steel Tank - at least 0.25 thickness 40%

62000 2

5.8E-11 8.3E-05 40%

62000 3

2.0E-10 2.9E-04 40%

82000 4

3.4E-10 6.4E-04 40%

96000 5

8.7E-10 1.9E-03

U.S. Nuclear Regulatory Commission Page 5 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Target Description Area (ft2)

Elev

> 30 Robust Type Robust Desc Robust Missiles Missile Count F-Scale MIP EEFP 40%

96000 6

1.3E-09 2.9E-03 RAB Roof HVAC Vent Stack 1AV-ERABVS 134 Y

J None of the above (i.e., not a robust target) 100%

155000 2

5.8E-11 1.2E-03 100%

155000 3

2.0E-10 4.2E-03 100%

205000 4

3.4E-10 9.3E-03 100%

240000 5

8.7E-10 2.8E-02 100%

240000 6

1.3E-09 4.2E-02 B Train ESW Intake Structure Electrical Conduit 17072F-SB 3

N G

Steel Door 45%

69750 2

1.1E-10 2.3E-05 45%

69750 3

3.6E-10 7.5E-05 45%

92250 4

6.3E-10 1.7E-04 45%

108000 5

1.6E-09 5.2E-04 45%

108000 6

2.4E-09 7.8E-04 RAB El. 305 Roof Exposed instrument 20 Y

J None of the above (i.e., not a robust target) 100%

155000 2

5.8E-11 1.8E-04 100%

155000 3

2.0E-10 6.2E-04 100%

205000 4

3.4E-10 1.4E-03 100%

240000 5

8.7E-10 4.2E-03

U.S. Nuclear Regulatory Commission Page 6 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Target Description Area (ft2)

Elev

> 30 Robust Type Robust Desc Robust Missiles Missile Count F-Scale MIP EEFP tubing sensing outside air pressure.

PDT-1AV-4834-A1SAHP-T378 (A Train) and PDT-1AV-4834-B1SBHP-T379 (B Train). A and B RABEES and A and B Containment Vacuum Relief System 100%

240000 6

1.3E-09 6.2E-03 DGB east exterior wall -

exposed outdoor air temperature elements TE-6902A-SA fed from conduit:

13262F SA 7

N J

None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 1.2E-04 100%

155000 3

3.6E-10 3.9E-04 100%

205000 4

6.3E-10 9.0E-04 100%

240000 5

1.6E-09 2.7E-03 100%

240000 6

2.4E-09 4.0E-03

U.S. Nuclear Regulatory Commission Page 7 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Target Description Area (ft2)

Elev

> 30 Robust Type Robust Desc Robust Missiles Missile Count F-Scale MIP EEFP DGB east exterior wall -

exposed outdoor air temperature element TE-6902B-SB fed from conduit:

13273F SB 7

N J

None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 1.2E-04 100%

155000 3

3.6E-10 3.9E-04 100%

205000 4

6.3E-10 9.0E-04 100%

240000 5

1.6E-09 2.7E-03 100%

240000 6

2.4E-09 4.0E-03 REFUELING WATER STORAGE TANK FAILURE 8796 N

C Steel Tank - at least 0.25 thickness 40%

62000 2

1.1E-10 6.0E-02 40%

62000 3

3.6E-10 2.0E-01 40%

82000 4

6.3E-10 4.5E-01 40%

96000 5

1.6E-09 1.0E+00 40%

96000 6

2.4E-09 1.0E+00 RWST LEVEL TRANSMITT ER LT-990 FAILS HIGH 9

N J

None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 1.5E-04 100%

155000 3

3.6E-10 5.0E-04 100%

205000 4

6.3E-10 1.2E-03 100%

240000 5

1.6E-09 3.5E-03 100%

240000 6

2.4E-09 5.2E-03 RWST LEVEL TRANSMITT ER LT-991 FAILS HIGH 9

N J

None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 1.5E-04 100%

155000 3

3.6E-10 5.0E-04 100%

205000 4

6.3E-10 1.2E-03 100%

240000 5

1.6E-09 3.5E-03 100%

240000 6

2.4E-09 5.2E-03 RWST LEVEL TRANSMITT ER LT-992 FAILS HIGH 9

N J

None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 1.5E-04 100%

155000 3

3.6E-10 5.0E-04 100%

205000 4

6.3E-10 1.2E-03 100%

240000 5

1.6E-09 3.5E-03 100%

240000 6

2.4E-09 5.2E-03

U.S. Nuclear Regulatory Commission Page 8 of 12 Serial HNP-17-072 Enclosure Table 3.3.5 EEFP Evaluation Target Description Area (ft2)

Elev

> 30 Robust Type Robust Desc Robust Missiles Missile Count F-Scale MIP EEFP RWST LEVEL TRANSMITT ER LT-993 FAILS HIGH 9

N J

None of the above (i.e., not a robust target) 100%

155000 2

1.1E-10 1.5E-04 100%

155000 3

3.6E-10 5.0E-04 100%

205000 4

6.3E-10 1.2E-03 100%

240000 5

1.6E-09 3.5E-03 100%

240000 6

2.4E-09 5.2E-03 ATMOSPHE RIC STEAM DUMP OR Main Steam pipe failure after MSIV isolation 6750 Y

E Steel Pipe - at least 10 diameter and 3/8 thickness 40%

62000 2

5.8E-11 2.4E-02 40%

62000 3

2.0E-10 8.4E-02 40%

82000 4

3.4E-10 1.9E-01 40%

96000 5

8.7E-10 5.6E-01 40%

96000 6

1.3E-09 8.4E-01

U.S. Nuclear Regulatory Commission Page 9 of 12 Serial HNP-17-072 Enclosure Non-Conformance risk results The delta risk results for each identified non-conformance is proved in Table 3.3.7-2. Non-conformances that were determined to have a negligible impact on PRA results have notes providing the basis.

Table 3.3.7-2 PRA Results for Non-Conformance Non-Conforming Target PRA Modeling Notes Estimated Exposure Area Delta CDF Delta LERF TDAFW Pump Exhaust 16

< 1E-11 (Note 2)

< 1E-12 (Note 2)

A Train EDG Fuel Oil Supply Line 2

1.1E-10 1.1E-11 A Train EDG Conduits 22 5.8E-09 6.0E-10 A Train ESWSS Conduits 28

< 1E-11 (Note 2)

< 1E-12 (Note 2)

EDG Roof Vents Train A Non-conformance was separated by trains for assessment 66 6.6E-09 6.8E-10 EDG Roof Vents Train B Non-conformance was separated by trains for assessment 66 6.8E-09 7.1E-10 "A" ESW Intake This penetration was determined to be less than 10 sq feet and meets the De Minimis screening criteria in the NEI 17-02 guidance. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles.

9 Negligible Negligible ESWIS Cover Plate ESW Main intake suction not modeled in the internal events PRA. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles.

Not Estimated Negligible Negligible ESW Intake Bay This non-conformance is evaluated as having a negligible impact on risk from tornado missiles.

Not Estimated Negligible Negligible EDG Fuel Oil Return Lines Train A Non-conformance was separated by trains for assessment 1

8.8E-11 8.8E-12

U.S. Nuclear Regulatory Commission Page 10 of 12 Serial HNP-17-072 Enclosure Table 3.3.7-2 PRA Results for Non-Conformance Non-Conforming Target PRA Modeling Notes Estimated Exposure Area Delta CDF Delta LERF EDG Fuel Oil Return Lines Train B Non-conformance was separated by trains for assessment 1

8.8E-11 8.8E-12 Safety related DGB Governor Conduits Train A Non-conformance was separated by trains for assessment 5

1.1E-09 1.2E-10 Safety related DGB Governor Conduits Train B Non-conformance was separated by trains for assessment 5

1.2E-09 1.2E-10 1A-SA & 1B-SB Battery Room exhaust PRA room heat up analysis shows the battery room ventilation is not needed for success in the PRA model. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles.

Not Estimated Negligible Negligible SG A MSIV BYPASS Valve (1MS-81)

Non-conformance was separated by trains for assessment 41 1.3E-10 6.0E-12 SG B MSIV BYPASS VALVE (1MS-83)

Non-conformance was separated by trains for assessment 41

< 1E-11 (Note 2)

< 1E-12 (Note 2)

SG C MSIV BYPASS VALVE (1MS-85)

Non-conformance was separated by trains for assessment 41 7.0E-11 2.8E-12 SG PORV Vents and MS Safety Relief Valve (MSSV) Vents for Train A and B SG PORV and MSSV for train A and B are correlated as one target in the PRA model 186 2.4E-10 1.1E-11 SG PORV Vents and MS Safety Relief Valve (MSSV) Vents for Train B and C SG PORV and MSSV for train B and C are correlated as one target in the PRA model 310 3.5E-10 1.5E-11 RAB EL 305 Safety Related Conduit Supply Fan S64 Main Steam Tunnel HVAC PRA analysis shows the Steam Tunnel ventilation is not needed for success in the PRA model. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles.

Not Estimated Negligible Negligible

U.S. Nuclear Regulatory Commission Page 11 of 12 Serial HNP-17-072 Enclosure Table 3.3.7-2 PRA Results for Non-Conformance Non-Conforming Target PRA Modeling Notes Estimated Exposure Area Delta CDF Delta LERF RAB EL 305 Safety Related Conduit Supply Fan S65 Main Steam Tunnel HVAC PRA analysis shows the Steam Tunnel ventilation is not needed for success in the PRA model. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles.

Not Estimated Negligible Negligible ESCW Expansion Tank Train A Non-conformance was separated by trains for assessment 23

< 1E-11 (Note 2)

< 1E-12 (Note 2)

ESCW Expansion Tank Train B Non-conformance was separated by trains for assessment 23

< 1E-11 (Note 2)

< 1E-12 (Note 2)

RAB Roof HVAC Vent Stack 1AV-ERABVS 134

< 1E-11 (Note 2)

< 1E-12 (Note 2)

ESW Intake Structure Temp elements fed from Safety Related Conduits 13292B-SB, 13292C SA, 13292F SB & 13292G SB These TE are not modeled in the PRA, they were determined not needed for the success of the system in the PRA model. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles.

Not Estimated Negligible Negligible B Train ESW Intake Structure Electrical Conduits 3

2.2E-10 2.2E-11 RAB El. 305 Roof Exposed instrument tubing sensing outside air pressure.

PDT-1AV-4834-A1SAHP-T378 (A Train) and PDT-1AV-4834-B1SBHP-T379 (B Train). A and B Reactor Auxiliary Building Emergency Exhaust System (RABEES) and A and B Containment Vacuum Relief System 20

< 1E-11 (Note 2)

< 1E-12 (Note 2)

U.S. Nuclear Regulatory Commission Page 12 of 12 Serial HNP-17-072 Enclosure Table 3.3.7-2 PRA Results for Non-Conformance Non-Conforming Target PRA Modeling Notes Estimated Exposure Area Delta CDF Delta LERF FHB EL 286 Roof Exposed instrument tubing sensing outside air pressure.

PDT-*1FL-5027ASA at 39 line wall PDT-*1FL-5027BSB at 45 line wall A and B Fuel Handling Building Emergency Exhaust System (FHBEES)

FHB ventilation is not modeled in the PRA and does not support core damage mitigating equipment. This non-conformance is evaluated as having a negligible impact on risk from tornado missiles.

Not Estimated Negligible Negligible DGB east exterior wall - exposed outdoor air temperature elements TE-6902A-SA fed from conduit: 13262F SA Non-conformance was separated by trains for assessment 7

< 1E-11 (Note 2)

< 1E-12 (Note 2)

DGB east exterior wall - exposed outdoor air temperature element TE-6902B-SB fed from conduit: 13273F SB Non-conformance was separated by trains for assessment 7

< 1E-11 (Note 2)

< 1E-12 (Note 2)

Note 1 - The Delta risk results for individual non-conformances add to a number slightly larger than the total delta risk for CDF and LERF due to multiple non-conformances impacting individual damage sequences.

Note 2 - No CDF or LERF contribution generated with a CDF truncation of 1E-11/year and a LERF truncation of 1E-12/year.

Serial: HNP-17-072 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400/Renewed License No. NPF-63 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Enclosure Evaluation of the Proposed Change Probabilistic Risk Assessment Technical Adequacy Documentation

U.S. Nuclear Regulatory Commission Page 2 of 27 Serial HNP-17-072 Enclosure TABLE OF CONTENTS 1.0 OVERVIEW.......................................................................................................... 3 2.0 BASIS TO CONCLUDE THAT THE PRA MODEL REPRESENTS THE AS-BUILT, AS-OPERATED PLANT.......................................................................... 3 3.0 IDENTIFICATION OF PERMANENT PLANT CHANGES NOT INCORPORATED IN THE PRA MODEL........................................................................................... 4 4.0 CONFORMANCE WITH ASME/ANS PRA STANDARD..................................... 5 4.1 2007 Internal Events Update.......................................................................... 5 4.2 2010 Internal Events Update.......................................................................... 5 4.3 Internal Events PRA Peer Reviews................................................................ 5 5.0 KEY ASSUMPTIONS AND APPROXIMATIONS................................................. 6 5.1 Reactor Coolant Pump (RCP) Seal Failure................................................... 7 5.2 Loss of Off-Site Power (LOSP) Frequencies................................................ 7 6.0 UNIQUE TMRE CONSIDERATIONS................................................................... 7

7.0 CONCLUSION

S ON PRA TECHNICAL ADEQUACY......................................... 7

8.0 REFERENCES

..................................................................................................... 7

U.S. Nuclear Regulatory Commission Page 3 of 27 Serial HNP-17-072 Enclosure Documentation of HNP Internal Events Probabilistic Risk Assessment (PRA)

Technical Adequacy for the Tornado Missile Risk Evaluator (TMRE)

1.

OVERVIEW This attachment documents the necessary information to demonstrate that the internal events Probabilistic Risk Assessment (PRA) for the Shearon Harris Nuclear Power Plant, Unit No. 1, (HNP) meets the requirements of the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA standard (Reference 1) as endorsed by Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," (Reference 2) at an appropriate capability category to support the HNP Tornado Missile Risk Evaluator (TMRE) program. This attachment provides documentation that is consistent with the requirements of Section 3.3 and Section 4.2 of RG 1.200, Revision 2:

Section 2.0 addresses the need for the PRA model to represent the as-built, as-operated

plant, Section 3.0 discusses permanent plant changes that have an impact on those SSCs modeled in the PRA but have not been incorporated in the baseline PRA model.

Section 4.0 demonstrates that the HNP PRA has been performed consistently with the ASME/ANS PRA Standard requirements as endorsed in RG 1.200, Revision 2. The peer reviews that have been conducted and the resolution of findings from those reviews are discussed in this section.

Section 5.0 identifies the key assumptions and approximations relevant to the results used in the decision-making process. This section provides assurance that the assumptions and approximations used in development of the PRA are appropriate.

Section 6.0 discusses the unique TMRE considerations for certain supporting requirements (SRs) with NRC clarifications from the TMRE guidance document, Appendix D (Reference 7).

Other technical elements of the PRA, including but not limited to internal flooding, fire, and other external events, are not required for the TMRE and are not discussed in this document.

2.0 BASIS TO CONCLUDE THAT THE PRA MODEL REPRESENTS THE AS-BUILT, AS-OPERATED PLANT The HNP PRA Model of Record (MOR) is maintained as a controlled document and is updated on a periodic basis to represent the as-built, as-operated plant. Duke Energy procedures provide the guidance, requirements, and processes for the maintenance, update, and upgrade of the PRA:

U.S. Nuclear Regulatory Commission Page 4 of 27 Serial HNP-17-072 Enclosure

a. The process includes a review of plant changes, relevant plant procedures, and plant operating data, as required, through a chosen freeze date to assess the effect on the PRA model.

b. The PRA model and controlling documents are revised as necessary to incorporate those changes determined to impact the model.

c. The determination of the extent of model changes includes the following:

Accepted industry PRA practices, ground rules, and assumptions consistent with those employed in the ASME/ANS PRA Standard (Reference 1),

Current industry practices, NRC guidance (e.g., References 2-3),

Advances in PRA technology and methodology, and Changes in external hazard conditions.

For plant changes of small or negligible impact, the model changes can be accumulated and a single revision performed at an interval consistent with major PRA revisions. The results of each evaluation determine the necessity and timing of incorporation of a particular change into the PRA model. An electronic tracking database is utilized to document pending model changes and updates.

3.0 IDENTIFICATION OF PERMANENT PLANT CHANGES NOT INCORPORATED IN THE PRA MODEL The current HNP Internal Events Model of Record (MOR2010) is based on the plant configuration as of May 31, 2010, including Refueling Outage 16 modifications and plant-specific data through May 2006. It is an evolution of the original PRA analysis that was submitted to the Nuclear Regulatory Commission (NRC) on August 20, 1993, to meet the requirements of Generic Letter 88-20 for an individual plant examination (IPE). Periodic updates to the model have been incorporated since the IPE was submitted in order to maintain a model that represents the as-built, as-operated plant.

Since 2010, the HNP PRA model has been used to support PRA applications, and to assist in decision making with regard to the design, licensing, operation, and maintenance of the plant.

Engineering changes, including equipment modifications, procedure changes, and plant performance (data), have been assessed and incorporated (per Duke Energy procedures) into the HNP model, as appropriate. These PRA maintenance activities do not qualify as PRA upgrades that would require an additional focused review. There have been no methodology changes or significant changes in scope or capability (other than development of the Fire and Internal Flood models not discussed herein) that impact the significant accident progression sequences.

The current HNP PRA Model has incorporated changes made in data since the MOR was issued. Review of the PRA electronic tracking database as of the May 2017 indicates that there are currently no identified permanent plant modifications that have a significant impact on the PRA that have not been incorporated.

U.S. Nuclear Regulatory Commission Page 5 of 27 Serial HNP-17-072 Enclosure 4.0 CONFORMANCE WITH ASME/ANS PRA STANDARD The following sections describe the conformance and capability of the HNP PRA against the ASME/ANS PRA Standard (Reference 1). There have been two formal internal events MOR revisions since 2007.

4.1 2007 Internal Events Update.

The 2007 revision to the internal events model of record (MOR) incorporated facts and observations (F&O) resolutions for the April 2006 HNP PRA Self-Assessment in order to meet ASME/ANS Internal Events Standard (Revision 1) for capability category II compliance. The update was performed to support development of a fire PRA and in preparation for the NFPA 805 License Amendment Request (LAR). A peer review was performed to support the NFPA 805 license submittal. Major revisions included expansion of plant-specific data, Human Reliability Analysis (HRA) updates, and addition of new or more detailed heating, ventilation and air conditioning (HVAC) models for CSIP rooms, Switchgear rooms, and Emergency Service Water (ESW) pump rooms. The model revision also included addition of logic to address fire induced multiple spurious failures, developed in conjunction with HNP adoption of the NFPA 805 program for fire induced vulnerabilities. Other general updates to the model included an update to the initiating event frequencies, revision of the station blackout (SBO) induced seal LOCA, and Loss of offsite power (LOSP) recovery. Motor Control center modeling was improved to support the NFPA 805 LAR with the required level of detail. These updates were peer reviewed in the 2007 Industry Peer Review, and the twelve (12) resolved but open findings were documented in a PRA calculation and tracked in the PRA electronic tracking system.

4.2 2010 Internal Events Update.

The 2010 revision was to incorporate plant equipment updates and model changes from the NFPA 805 LAR process. The major change for the 2010 update was the addition of the Alternate Seal Injection - Dedicated Shutdown Diesel Generator (ASI-DSDG) to the MOR. The installation of the ASI-DSDG modification provided a diverse and redundant power source for alternate seal injection and also to the emergency DC battery chargers, as described in HNP's NFPA 805 LAR. This reduced the effect of the 4-hour coping duration of the batteries by providing a means to supply DC power to the DC busses during SBO. The LOSP initiator was separated into plant, grid, switchyard and weather induced LOSPs, which allowed the model to apply recovery actions to the higher frequency events (plant and switchyard). Other changes are related to de-energizing charging pump discharge header cross-connect valves, adding temporary air compressors, and incorporating updates from fire model. This was not considered an internal events upgrade, so a peer review was not required for these revisions.

4.3 Internal Events PRA Peer Reviews The following peer reviews have been conducted to ensure the internal events PRA meets the requirements of ASME/ANS PRA Standard:

In 2002, a peer review was performed by Westinghouse Owners Group (WOG) in accordance with guidance in NEI-00-02, Industry PRA Peer Review Process. All of the F&Os were resolved.

In 2006, a self-assessment was conducted to identify supporting requirements that did not meet Category II of the ASME Standard RA-Sb-2005 and RG 1.200, Revision 1.

U.S. Nuclear Regulatory Commission Page 6 of 27 Serial HNP-17-072 Enclosure The significance of the F&Os was determined with regard to whether the issue may adversely impact the effective use of the PRA in risk-informed applications. All significant technical findings were reviewed and resolved.

In 2007, a focused industry peer review was conducted as a follow up to the self-assessment against AMSE Standard RA-Sb-2005 and RG 1.200, Revision 1. All findings recorded from that review have been resolved and documented in a PRA calculation and tracked in the PRA electronic tracking system. Twelve of the finding level F&Os were considered resolved but open, and were submitted with previous risk-informed applications.

In 2008, two internal events F&Os were identified during an NRC staff review of the HNP fire PRA model. These findings were reviewed and resolved with the NRC staff.

In reviewing the HNP risk informed LAR for implementation of NFPA 805, the NRC staff evaluated the quality of the internal events PRA model used to support development of the Fire PRA. The objective of the quality review was, to determine whether the plant-specific PRA used in evaluating the proposed LAR is of sufficient scope, level of detail, and technical adequacy for the application. The results of the NRC staff quality review are documented in the HNP NFPA 805 Safety Evaluation for transition to a risk-informed, performance-based fire protection program, ADAMS Accession Numbers ML101750602 and ML101750604 (References 4-5).

In 2017, the HNP PRA was selected for a Pilot Demonstration of an NEI and NRC process for close out of F&Os by independent assessment (Reference 6). The NRC gave interim acceptance of the process in a letter on May 3, 2017 (Reference 8). An independent assessment is conducted using the nearly final guidance document in a manner similar to a peer review, but with a scope limited to evaluating the closure of F&Os identified by the host utility, and without intention of issuance of new F&Os. All twelve of the internal events findings that were considered resolved but open following the 2007 peer review were reviewed and assessed by the independent assessment team to be closed at CCII or greater. All findings for the HNP Internal Events model have now been resolved and closed (Reference 9). There are no upgrades to the internal events PRA that have not been peer reviewed.

Table 1 lists the SRs with unique TMRE considerations that have been identified in the TMRE Guidance Document (Reference 7) as being applicable to the TMRE PRA, with any relevant comments regarding this application.

Based on these reviews, the HNP internal events PRA meets the requirements of the ASME/ANS PRA Standard at an appropriate quality level to support the HNP TMRE PRA.

5.0 KEY ASSUMPTIONS AND APPROXIMATIONS A list of potential contributors to the uncertainty in the PRA was compiled. Items discussed in sections 5.1 and 5.2 below represents the modeling assumptions and uncertainty that are considered to have the greatest impact on the HNP PRA results if different reasonable alternative assumptions were utilized. The approaches taken for the assumptions below represent industry best practices and therefore the need for sensitivity analyses will be

U.S. Nuclear Regulatory Commission Page 7 of 27 Serial HNP-17-072 Enclosure determined separately if applicable to the TMRE guidance. TMRE sensitivities are documented in section 3.3.10 of the main body of the enclosure.

5.1 Reactor Coolant Pump (RCP) Seal Failure The HNP PRA model uses the WOG 2000 RCP seal failure model, and it assumes RCP seal leakage every time both Seal Injection and Thermal Barrier cooling are lost. This is an Industry consensus model. For risk applications this is one of the most important areas of uncertainty.

5.2 Loss of Off-Site Power (LOSP) Frequencies Loss of off-site power initiating events have been shown to be important contributors to plant core damage due to the potential for station blackout and the reliance of many frontline systems on AC power. The LOSP initiator was separated into plant, grid, switchyard and weather induced LOSPs, which allowed the model to apply recovery actions to the higher frequency events (plant and switchyard). HNP used generic industry data to calculate LOSP frequencies.

The LOSP frequency has a significant impact on CDF and Emergency Diesel Generator importance. Because the TMRE model only considers tornado initiating events this key assumption does not impact the TMRE results.

6.0 UNIQUE TMRE CONSIDERATIONS The NEI TMRE guidance document (Reference 7) lays out a roadmap of certain SRs and which particular sections in the guidance document provides the information to meet those SRs. A systematic review was performed of the SRs relative to the TMRE model development, and is shown in Table 1 with notes on the HNP TMRE model regarding those certain SRs.

7.0 CONCLUSION

S ON PRA TECHNICAL ADEQUACY The Harris Nuclear Plant (HNP) PRA model is sufficiently robust and suitable for use in risk informed processes such as the TMRE Methodology. The peer reviews that have been conducted and the closure of findings from those reviews demonstrate that the underlying internal events PRA has been performed in a technically acceptable manner. There are no open finding-level F&Os for the HNP Internal Events PRA. The assumptions and approximations used in development of the PRA have also been reviewed and are appropriate for their application. Duke Energy procedures are in place for controlling and updating the models, and for assuring that the model represents the as-built, as-operated plant. The conclusion, therefore, is that the HNP PRA model is acceptable to be used as the basis for risk-informed applications including the Tornado Missile Risk Evaluator (TMRE).

8.0 REFERENCES

1.

ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

2.

Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, U.S.

Nuclear Regulatory Commission, March 2009.

U.S. Nuclear Regulatory Commission Page 8 of 27 Serial HNP-17-072 Enclosure

3.

Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 2, U.S.

Nuclear Regulatory Commission, March 2011.

4.

Letter from the NRC to C. Burton, Shearon Harris Nuclear Power Plant, Unit 1 - Issuance of Amendment Regarding Adoption of National Fire Protection Association Standard 805, Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants, June 28, 2010. (ADAMS Accession No. ML101750602)

5.

Safety Evaluation By The Office Of Nuclear Reactor Regulation Related To Amendment No. 133 To Renewed Facility Operating License No. NPF-63, Transition To A Risk-Informed, Performance-Based Fire Protection Program In Accordance with 10 CFR 50.48(c), Shearon Harris Nuclear Power Plant, Unit 1, Docket No. 50-400, U.S.

Nuclear Regulatory Commission, Washington, D.C., June 28, 2010. (ADAMS Accession No. ML101750604)

6.

Appendix X: Close Out of Facts and Observations (F&Os), NEI 05-04/07-12/12-06, Nuclear Energy Institute, 2017.

7.

Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document, NEI 17-02, Revision 1, Nuclear Energy Institute, September 2017.

8.

U.S. Nuclear Regulatory Commission Acceptance On Nuclear Energy Institute Appendix X To Guidance 05-04, 07-12, And 12-13, Close-Out Of Facts And Observations (F&Os), May 2017.

U.S. Nuclear Regulatory Commission Page 9 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

IE-A The initiating event analysis shall provide a reasonably complete identification of initiating events.

IE-A1 Tornado initiating events will be consistent with the intervals defined in the TMRE process.

TMRE considers all tornadoes will result in a LOSP. Tornado initiating event frequencies will be based on a hazard curve that uses site specific data provided in Table 6.1 of NUREG 4461 [IE-C1].

TMRE process should ensure that the initiating events caused by extreme winds that give rise to significant accident sequences and accurately capture the additional risk of the unprotected SSCs (that should be protected per the CLB) are identified and used for this application.

4.3, 6.2 The only initiating events caused by extreme winds that are considered in TMRE were tornados. Only tornados will produce tornado missiles.

The TMRE process was followed as described.

IE-A10 For multi-unit sites with shared systems, INCLUDE multi-unit site initiators (e.g.,

multi-unit LOSP events or total loss of service water) that may impact the model.

6.2 N/A. HNP is a single unit site.

IE-B The initiating event analysis shall group the initiating events so that events in the same group have similar mitigation requirements (i.e.,

the requirements for most events in the group are less restrictive than the limiting mitigation requirements for the group) to facilitate an efficient but realistic estimation of CDF

U.S. Nuclear Regulatory Commission Page 10 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

IE-B5 DO NOT SUBSUME multi-unit initiating events if they impact mitigation capability.

Two unit sites should consider proximity of each unit to each other, the footprint of potential tornadoes for the region, and the systems shared between each unit.

6.2 N/A. HNP is a single unit site.

IE-C The initiating event analysis shall estimate the annual frequency of each initiating event or initiating event group.

The tornado IEFs should be based on a hazard curve that uses site-specific data, such as found in NUREG-4461.

IE-C1 Tornado initiating event frequencies will be based on a hazard curve that uses site specific data provided in Table 6.1 of NUREG 4461 4.1 The TMRE process was followed as described.

IE-C3 Do not credit recovery of offsite power.

Same comment as AS-A10 6.1, Appendix A The TMRE process was followed as described. Offsite power recovery was not credited.

IE-C15 CHARACTERIZE the uncertainty in the tornado initiating event frequencies and PROVIDE mean values for use in the quantification of the PRA results. NUREG 4461, Tornado Climatology, data includes uncertainty.

4.3 The TMRE process was followed as described. As mentioned, NUREG 4461, Tornado Climatology, data includes uncertainty.

Additionally, the R-squared value is provided to help characterize the uncertainty of the HNP initiating event best fit interpolated/

extrapolated frequencies.

U.S. Nuclear Regulatory Commission Page 11 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

AS-A Utilize the accident sequences (typically LOSP) provided in the internal events model and adjust as necessary to consider the consequences of a tornado event.

AS-A1 Modify the internal events accident sequences in compliance with this SR 6.1, 6.3, 6.4, 6.5 The TMRE process was followed as described. The transient LOSP accident sequence event tree from the internal events model that was utilized considers the consequences of a tornado event.

Certain exposed SSCs are not credited in accordance with the TMRE process, such as the shutdown diesel and the air compressors.

Operator actions are adjusted as necessary according to the TMRE process.

AS-A3 Review the FPIE success criteria and modify the associated system models as necessary to account for the tornado event and its consequences.

6.1, 6.3, 6.4, 6.5 The TMRE process was followed as described. Certain exposed SSCs are not credited in accordance with the TMRE process, such as the shutdown diesel and the air compressors.

U.S. Nuclear Regulatory Commission Page 12 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

AS-A4 Review the FPIE success criteria and modify the associated operator actions as necessary to account for the tornado event and its consequences.

6.4 The TMRE process was followed as described. Operator actions are adjusted as necessary according to the TMRE process.

AS-A5 Modify the FPIE accident sequence model in a manner that is consistent with the plant-specific: system design, EOPs, abnormal procedures, and plant transient response. Account for system functions that, as a consequence of the tornado event, will not be operable or potentially degraded, and operator actions that will not be possible or impeded.

6.1, 6.3, 6.4, 6.5 The TMRE process was followed as described. The transient LOSP accident sequence event tree from the internal events model that was utilized considers the consequences of a tornado event.

Certain exposed SSCs are not credited in accordance with the TMRE process, such as the shutdown diesel and the air compressors.

Operator actions are adjusted as necessary according to the TMRE process.

U.S. Nuclear Regulatory Commission Page 13 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

AS-A10 Capability Category I. In modifying the accident sequence models, INCLUDE, for each tornado initiating event, INDIVIDUAL EVENTS IN THE ACCIDENT SEQUENCE SUFFICIENT TO BOUND SYSTEM OPERATION, TIMING, AND OPERATOR ACTIONS NECESSARY FOR KEY SAFETY FUNCTIONS.

In constructing the accident sequence models, support system modeling, etc. realistic criteria or assumptions should be used, unless a conservative approach can be justified. Use of conservative assumptions in the base model can distort the results and may not be conservative for delta CDF/LERF calculation. While use of conservative or bounding assumptions in PRA models is acceptable, a qualitative or quantitative assessment may be needed to show that those assumptions do not underestimate delta CDF/LERF estimates.

6.3, 7.2.3, Appendix A The TMRE process was followed as described. Active components not in Cat I structures are not credited in accordance with the TMRE process, such as the shutdown diesel and the air compressors. This conservative assumption could lead to a non-conservative delta CDF/LERF. A specific sensitivity was performed.

AS-B Dependencies that can impact the ability of the mitigating systems to operate and function shall be addressed.

U.S. Nuclear Regulatory Commission Page 14 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

AS-B1 For each tornado event, IDENTIFY mitigating systems impacted by the occurrence of the initiator and the extent of the impact.

INCLUDE the impact of initiating events on mitigating systems in the accident progression either in the accident sequence models or in the system models.

6.1, 6.3, 6.5, 6.6 The TMRE process was followed as described. Impacts on mitigating systems were included for all modeled tornado initiating events.

AS-B3 IDENTIFY the phenomenological conditions created by the accident progression.

Consider concurrent impacts related to tornado missiles (e.g., the possibility of multiple missile strikes in a given sequence. Also high winds and rains after the tornado event could result in hazardous conditions (e.g. debris and structural instabilities) for actions outside the control room.

5.6, 6.3, 6.4, 6.6 The TMRE process was followed as described. Unique weather phenomena such as intense rain could be an issue during tornado initiating events for structures that are not designed to withstand the winds.

Active components in non-Cat I structures were not credited in accordance with the TMRE process.

Operator actions that require travel through non-Cat I structures or areas are not credited.

U.S. Nuclear Regulatory Commission Page 15 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

AS-B7 Review FPIE time phased dependencies to identify model changes needed to address all the concurrent system functions failed by the tornado event; e.g. LOSP, instrument air, fire protectionetc.

Do not model offsite recovery.

6.1 The TMRE process was followed as described. Time phased dependencies were reviewed and no model changes were identified for the TMRE model.

SC-A The overall success criteria for the PRA and the system, structure, component, and human action success criteria used in the PRA shall be defined and referenced, and shall be consistent with the features, procedures, and operating philosophy of the plant.

SC-A4 Consider impact on both units for the same tornado including the mitigating systems that are shared.

6.1 N/A. HNP is s single unit site.

SY-A The systems analysis shall provide a reasonably complete treatment of the causes of system failure and unavailability modes represented in the initiating events analysis and sequence definition

U.S. Nuclear Regulatory Commission Page 16 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

SY-A4 Capability Category II. Walkdowns focusing on targets vulnerable to tornado missiles will be performed.

Walkdown will include a missile inventory and a review of pathways available to the operators for ex-control room actions.

Section 3 The TMRE process was followed as described.

Walkdowns were performed focusing on targets vulnerable to tornado missiles.

The walkdowns also surveyed the plant for the missile inventory. Pathways for operator actions outside the control room were discussed with the site personnel; however operator actions that require travel through non-Cat I structures or outside areas are not credited.

SY-A11 New basic events will be added to address all the failure modes of the system targets exposed to tornado missiles; safety related and non-safety related.

6.3, 6.5, 6.6 The TMRE process was followed as described. New basic events and flags were added to address all the failure modes of the safety related and non-safety related system targets exposed to tornado missiles in accordance with the TMRE process.

The exclusions of SY-A15 do not apply for SSCs impacted by tornado missiles.

U.S. Nuclear Regulatory Commission Page 17 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

SY-A12 DO NOT INCLUDE in a system model component failures that would be beneficial to system operation, unless omission would distort the results.

For example, do not assume a vent pipe will be sheered by a high energy missile verses crimped unless it can be shown this is true for all missiles at all speeds. Exceptions would be components that are intentionally designed to "fail" favorably when struck by a missile; e.g. a frangible plastic pipe used as a vent is designed to break off and not crimp when struck by a missile.

5.2 The TMRE process was followed as described.

SY-A13 Consider the targets potential to cause a flow diversion when struck by a tornado missile.

6.5 The TMRE process was followed as described. Targets with the potential to cause a flow diversion when struck by a tornado missile were considered. Beyond steam breaks around main steam lines, no additional flow diversions were required to be modeled.

U.S. Nuclear Regulatory Commission Page 18 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

SY-A14 Missile targets will be assessed for all failure modes - some new failure modes may be identified that are not in the FPIE model.

6.5 The TMRE process was followed as described. SSCs were assessed for all failure modes.

The exclusions of SY-A15 do not apply for SSCs impacted by tornado missiles.

SY-A15 The failure of SSCs due to tornado missiles shall not use the exclusions of SY-A15.

The failure by tornado missiles should be included in the model for all unprotected targets that are supposed to be protected according to the CLB and any unprotected targets that are not in the CLB but are in the PRA model. This is to facilitate sensitivity studies regarding possible correlation of tornado missile damage across systems. It is not expected that the number of basic events added to the model for this analysis will be so large that this screening is necessary.

6.5 The TMRE process was followed as described. The failure by tornado missiles was included in the model for all unprotected targets that are supposed to be protected according to the CLB and any unprotected targets that are not in the CLB but are in the PRA model.

SY-A17 Certain post initiator HFEs will be modified to account for the tornado event.

6.4 The TMRE process was followed as described.

U.S. Nuclear Regulatory Commission Page 19 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

SY-B The thermal/hydraulic, structural, and other supporting engineering bases shall be capable of providing success criteria and event timing sufficient for quantification of CDF and LERF, determination of the relative impact of success criteria on SSC and human actions, and the impact of uncertainty on this determination.

SY-B7 Capability Category I. BASE support system modeling on the use of CONSERVATIVE SUCCESS CRITERIA AND TIMING. Sensitivity studies will be performed to identify where conservative assumptions may be distorting risk and adjusted accordingly.

Same comment as AS-A10 7.2.3 The TMRE process was followed as described. The systems analysis from the internal events was the foundation for the TMRE model. Credit given to available PRA SSCs was in accordance with the TMRE process.

SY-B8 Consider spatial relationships between components to identify correlated failures. Where the same missile can impact targets that are in close proximity to each other.

5.6 The TMRE process was followed as described.

Correlation was considered where the same missile can impact targets that are in close proximity to each other.

U.S. Nuclear Regulatory Commission Page 20 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

SY-B14 Statistical correlation of tornado missile damage between redundant and spatially separated components is NOT required.

The industry indicated in earlier discussions that information is available to show that statistical correlation of tornado missile damage for specially separated components is insignificant. Until that information is reviewed and accepted by the staff, this SR should be met (spans all capability categories) and dependent failures of multiple SSCs should be considered.

Appendix B.4.4 There are no deviations taken from the TMRE guidance document.

SY-B15 INCLUDE new operator interface dependencies across systems or trains related to the tornado event.

6.4 The TMRE process was followed as described. No new operator interface dependencies across systems or trains were identified in the TMRE model development.

HR-E A systematic review of the relevant procedures shall be used to identify the set of operator responses required for each of the tornado accident sequences

U.S. Nuclear Regulatory Commission Page 21 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

HR-E3 Operators will be interviewed (if necessary) to assess the need for changes to operator actions for the tornado initiating events.

6.4 The TMRE process was followed as described. Operator interviews for the credited actions were performed during the development of the internal events model that the TMRE model is based on.

Furthermore, during the TMRE development a HNP former equipment operator was consulted for further considerations.

HR-E4 Operators talk-throughs or simulator observations will be conducted (if necessary) to assess the need for changes to operator actions for the tornado initiating events.

6.4 The TMRE process was followed as described. Operator interviews/ talk throughs for the credited actions were performed during the development of the internal events model that the TMRE model is based on.

Furthermore, during the TMRE development a HNP former equipment operator was consulted for further considerations.

[Note: this applies to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone]

U.S. Nuclear Regulatory Commission Page 22 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

HR-G The assessment of the probabilities of the post-initiator HFEs shall be performed using a well-defined and self-consistent process that addresses the plant-specific and scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence.

HR-G5 Operators will be interviewed and simulator observations conducted (if necessary) to assess the need for changes to operator action timing as a result of the tornado event.

6.4 The TMRE process was followed as described. Operator interviews/ talk throughs for the credited actions were performed during the development of the internal events model that the TMRE model is based on.

Furthermore, during the TMRE development a HNP former equipment operator was consulted for further considerations.

[Note: this applies to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone]

HR-G7 Dependencies will be recalculated when the model is quantified or modified by inspecting cutsets.

6.4 The TMRE process was followed as described. No new combinations were created or credited.

U.S. Nuclear Regulatory Commission Page 23 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

HR-H Recovery actions (at the cutset or scenario level) shall be modeled only if it has been demonstrated that the action is plausible and feasible for those scenarios to which they are applied.

Estimates of probabilities of failure shall address dependency on prior human failures in the scenario.

HR-H1/H2 Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

6.4 The TMRE process was followed as described. Recovery actions to restore functions, systems, or components were not credited.

DA-A Each parameter shall be clearly defined in terms of the logic model, basic event boundary, and the model used to evaluate event probability.

DA-A1 Develop new basic events for tornado missile targets (all failure modes) in accordance with this SR.

6.3, 6.5, 6.6 The TMRE process was followed as described. New basic events and flags were added to address all the failure modes of the safety related and non-safety related system targets exposed to tornado missiles in accordance with the TMRE process.

U.S. Nuclear Regulatory Commission Page 24 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

QU-A The level 1 quantification shall quantify core damage frequency and shall support the quantification of LERF.

QU-A5 Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

6.4 The TMRE process was followed as described. Recovery actions to restore functions, systems, or components were not credited.

QU-C Model quantification shall determine that all identified dependencies are addressed appropriately.

QU-C1 Identify new operator action dependencies created as a result of the changes to the internal events PRA model or failures associated with tornado events.

6.4 The TMRE process was followed as described. No new operator actions or combinations were created or credited.

U.S. Nuclear Regulatory Commission Page 25 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

QU-D The quantification results shall be reviewed, and significant contributors to CDF (and LERF), such as initiating events, accident sequences, and basic events (equipment unavailabilities and human failure events), shall be identified. The results shall be traceable to the inputs and assumptions made in the PRA.

QU-D5 Review nonsignificant cutset or sequences to determine the sequences are valid 7.3 The TMRE process was followed as described. Cutsets were reviewed including significant and non-significant cutsets to ensure the sequences are valid.

QU-D7 Review BE importance to make sure they make logical sense.

7.3 The TMRE process was followed as described. BE importances were reviewed to ensure they make logical sense.

QU-E Uncertainties in the PRA results shall be characterized.

Sources of model uncertainty and related assumptions shall be identified, and their potential impact on the results understood.

QU-E1 Identify sources of uncertainty related to MIP and missiles 7.1 The TMRE process was followed as described.

Also see Appendices A and B for bases.

U.S. Nuclear Regulatory Commission Page 26 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

QU-E2 Identify assumptions made that are different than those in the internal events model Section 6 The TMRE process was followed as described..

QU-E4 Identify how the model uncertainty is affected by assumptions related to MIP and missiles 7.1, Appendix A The TMRE process was followed as described.

LE-C The accident progression analysis shall include identification of those sequences that would result in a large early release.

7.1, 7.3 The TMRE process was followed as described.

LE-C3 Do not credit recovery of offsite power. Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

Same comment as AS-A10 6.3, 7.2.3,

Appendix A The TMRE process was followed as described.

U.S. Nuclear Regulatory Commission Page 27 of 27 Serial HNP-17-072 Enclosure Table 1: SRs with Unique TMRE Considerations TMRE - ASME PRA Standard Supporting Requirements Requiring Self-Assessment NRC Comments NEI 17-02 Section Addressing SR Additional HNP TMRE comments (No comments if blank)

Multiple SRs Changes made for application of the PRA to tornado missile impact risk determination such as those to initiating event analysis, accident sequences, systems analysis, human reliability analysis, and parameter estimation should be documented, as described in various documentation SRs for each HLR. The documentation should be sufficient to understand basis and facilitate review.

Examples of such SRs include IE-D1 through IE-D3, SY-C1 through SY-C3, and DA-E1 through DA-E3. It is recognized that the documentation of changes to the PRA and their basis will be captured in the template of the license amendment request.

Section 8 The TMRE process was followed as described.

Serial: HNP-17-072 Shearon Harris Nuclear Power Plant, Unit No. 1 Docket No. 50-400/Renewed License No. NPF-63 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Enclosure Evaluation of the Proposed Change Updated Final Safety Analysis Report Page Markups (7 pages plus cover)

Shearon Harris Nuclear Power Plant UFSAR Chapter: 1 Amendment 61 Page 47 of 71 Regulatory Guide 1.74 QUALITY ASSURANCE TERMS AND DEFINITIONS Conformance with Regulatory Guide 1.74 is addressed in the description of the Quality Assurance Program that is incorporated by reference into the FSAR Chapter 17 (see Section 17.3)

Regulatory Guide 1.76 DESIGN BASIS TORNADO FOR NUCLEAR POWER PLANTS (REV.0)

The SHNPP project complies with this guide (with the exception described below).

Regulatory Guide 1.76 Revision 1 was issued for use in March 2007. This regulatory guide provides licensees and applicants with new guidance that the staff of the NRC considers acceptable for use in selecting the design-basis tornado and design-basis tornado-generated missiles that a nuclear plant should be designed to withstand. This guidance divides the United States into three regions: the Harris Nuclear Plant is located in Region 1. The NRC staff accepts the methods described in Regulatory Guide 1.76 Revision 1 to evaluate submittals from operating reactor licensees after March 2007 who voluntarily propose to initiate system modifications that have a clear nexus with the guidance provided. No backfitting is intended or approved in conjunction with its issuance. The Harris Nuclear Plant adopts the guidance provided in Regulatory Guide 1.76 Revision 1 as an optional design basis for new system modifications occurring after March 2007.

FSAR

Reference:

Section 3.3.2.1.

Regulatory Guide 1.77 ASSUMPTIONS USED FOR EVALUATING A CONTROL ROD EJECTION ACCIDENT FOR PRESSURE AND WATER REACTORS (REV. 0)

The SHNPP project complies with the guide with the exception described below:

Westinghouse methods and criteria are documented in Reference 1.8-8 which has been reviewed and accepted by the NRC.

The results of the Westinghouse analyses show agreement with Regulatory Positions C.1 and C.3. In addition, Westinghouse utilizes the assumptions given in Appendices A and B of the Regulatory Guide. However, Westinghouse takes exception to Regulatory Position C.2 which implies that the rod ejection accident should be considered as an emergency condition.

Westinghouse considers this a faulted condition as stated in ANSI N18.2. Faulted condition stress limits will be applied for this accident.

FSAR

Reference:

Section 15.4.8.

Regulatory Guide 1.78 EVALUATING THE HABITABILITY OF A NUCLEAR POWER PLANT CONTROL ROOM DURING A POSTULATED HAZARDOUS CHEMICAL RELEASE (REV 1)

The SHNPP project complies with this guide.

FSAR

Reference:

Section 6.4 and Section 2.2.3.3.

No change this page. For info only

Shearon Harris Nuclear Power Plant UFSAR Chapter: 1 Amendment 61 Page 57 of 71 The SHNPP project complies with this guide.

FSAR

Reference:

Chapters 13 and 14.

Regulatory Guide 1.115 PROTECTION AGAINST LOW-TRAJECTORY TURBINE MISSILES (REV 1)

The SHNPP project complies with the intent of this guide in that due to the limited exposure of vital equipment and the high degree of barrier protection provided, and as stated in the NRC SER Supplement No. 3, dated July 1977, low trajectory turbine missiles will not be a significant threat to the plant.

FSAR

Reference:

Section 3.5.1 Regulatory Guide 1.116 QUALITY ASSURANCE REQUIREMENTS FOR INSTALLATION, INSPECTION, AND TESTING OF MECHANICAL EQUIPMENT AND SYSTEMS Conformance with Regulatory Guide 1.116 is addressed in the description of the Quality Assurance Program that is incorporated by reference into the FSAR Chapter 17 (see Section 17.3)

Regulatory Guide 1.117 TORNADO DESIGN CLASSIFICATION (REV. 1)

The SHNPP project complies with this guide.

FSAR

Reference:

Sections 3.3 and 3.5.1.4.

Regulatory Guide 1.118 PERIODIC TESTING OF ELECTRIC POWER AND PROTECTION SYSTEMS (REV 2)

Except as noted below, SHNPP complies with IEEE Standard 338-1977, Reg. Guide 1.118.

With these exceptions, the project still meets IEEE 338-1971 as discussed in Section 7.1.2.18 and IEEE 338-1975 as discussed in Section 8.3.1.2.27.

NSSS Westinghouse will make clear distinction between recommendations and requirements when addressing criteria. Detailed positions on the Regulatory Positions are presented below:

a) Regulatory Position C.1 - Westinghouse will provide a means to facilitate response time testing from the sensor input at the protection rack to and including the input to the actuation device. Examples of actuation devices are the protection system relay or bistable.

Westinghouse defines "Protective Action Systems" to mean the electric, instrumentation and controls portions of those protection systems and equipment actuated and controlled by the protection system.

except for conditions deemed acceptable using TMRE methodology that was approved by the NRC in [Document Name, ADAMS number]. TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

Shearon Harris Nuclear Power Plant UFSAR Chapter: 3 Amendment 61 Page 78 of 512 3.5.1.4 Missiles Generated by Natural Phenomena The worst credible missiles generated by natural phenomena to be considered in SHNPP are those generated by the design basis tornado. All structures that house systems and components to be protected against tornado generated missiles and the types of protection have been presented in Table 3.5.1-2.

The postulated tornado missiles include representative objects in the plant area which could be picked up or injected into the tornado wind field. The characteristics of the tornado generated missiles considered in the plant design are given in Table 3.5.1-3. The missiles listed in this table are considered as striking in all directions.

Structures, systems, and components whose failure could prevent safe shutdown of the reactor or result in significant uncontrolled release of radioactivity from the Unit are protected from such failure due to design tornado and wind loading of missiles by the following methods:

a) Structure or component is designed to withstand tornado loading or tornado missile.

b) Component is housed within a structure which is designed to withstand the tornado loading and tornado missile.

Although Regulatory Guide 1.117 (Revision 1) is not applicable to SHNPP, the design of SHNPP is such that the structures, systems, and components specified in the appendix to the guide are protected against tornadoes and tornado missiles. As a result, SHNPP is in compliance with Regulatory Guide 1.117.

All Seismic Category I structures are capable of resisting penetration of tornado driven missiles as explained in Section 3.5.1.1.2. The tornado generated missile spectrum used in the design of Seismic Category I structures are listed in Table 3.5.1-3.

Table 3.5.1-2 identifies the structures used for protection. All Seismic Category I structures are designed with a minimum f'c of 4000 psi concrete and a minimum thickness of 24 inches in roofs and walls. Design requirements are specified in Section 3.8.

3.5.1.5 Missiles Generated by Events Near the Site The missiles generated by events near the site are discussed in Section 2.2.3.

3.5.1.6 Aircraft Hazards The SHNPP is remote from federal airways, airports, airport approaches, military installation or airspace usage and, therefore, an aircraft hazard analysis is not required. Specific reasons are detailed below:

1.

No federal airways or airport approaches pass within two miles of SHNPP. See Section 2.2.2.5 and Figure 2.2.2-1.

2.

No airports are located within five miles of SHNPP. See Section 2.2.2.5 and Figure 2.2.2-1.

Insert: The NRC approved a license amendment in [Document Name, ADAMS number, add specific reference] for SHNPP that authorized use of the Tornado Missile Risk Evaluator (TMRE) methodology. TMRE is an NRC approved methodology for determining whether protection from tornado-generated missiles is required. The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process.

Except for SSCs listed in Table 3.5.1-2a, which were demonstrated to be acceptable using TMRE methodology,

Shearon Harris Nuclear Power Plant UFSAR Chapter: 3 Amendment 61 Page 1 of 2 TABLE 3.5.1-2 OUTDOOR SAFETY-RELATED STRUCTURES, SYSTEMS, AND COMPONENTS PROTECTED AGAINST TORNADO GENERATED MISSILES STRUCTURE, SYSTEM COMPONENT MISSILE PROTECTION AFFORDED

1)

Containment Buildings Exterior walls and domes are designed in accordance with Section 3.5.1.

2)

Reactor Auxiliary Building Exterior walls and roofs are designed in accordance with Section 3.5.1.

3)

Waste Processing Building Exterior walls up to EL 261 and roofs at El 261 are designed in accordance with Section 3.5.1.

4)

Fuel Handling Building Exterior walls and roofs are designed in accordance with Section 3.5.1.

5)

Emergency Service Water and Cooling Tower Makeup Water Intake Structure Exterior walls and roofs are designed in accordance with Section 3.5.1.

6)

Emergency Service Water Screening Structure Exterior walls and roofs are designed in accordance with Section 3.5.1.

7)

Condensate Storage Tank Enclosure Exterior walls and roofs are designed in accordance with Section 3.5.1.

8)

Reactor Make-up Water Storage Tank Enclosure(1)

Exterior walls are designed in accordance with Section 3.5.1.

9)

Diesel Fuel Oil Storage Tank Structure Exterior walls and roofs are designed in accordance with Section 3.5.1.

10) Diesel Generator Building Exterior walls and roofs are designed in accordance with Section 3.5.1.

11) Seismic Category I Electrical Manholes Exterior walls and roofs are designed in accordance with Section 3.5.1.

12) Refueling Water Storage Tank Enclosure Exterior walls are designed in accordance with Section 3.5.1.

13) All HVAC Air Intakes and Exhausts for Safety-Related Systems Are provided with missile protective concrete wall barriers

14) Diesel Generator Combustion Air Intake and Exhaust Are provided with missile protective concrete wall barriers

Shearon Harris Nuclear Power Plant UFSAR Chapter: 3 Amendment 61 Page 2 of 2 TABLE 3.5.1-2 OUTDOOR SAFETY-RELATED STRUCTURES, SYSTEMS, AND COMPONENTS PROTECTED AGAINST TORNADO GENERATED MISSILES STRUCTURE, SYSTEM COMPONENT MISSILE PROTECTION AFFORDED

15) Underground Class IE Cabling Are separated to the greatest extent possible according to the criteria set forth in Section 3.5.1; provided with an adequate depth of earth cover and/or a concrete slab covering, and in areas where redundant lines must cross paths, a concrete slab is placed between the redundant lines.

16) Underground Safety-Related Piping Are separated to the greatest extent possible according to the criteria set forth in Section 3.5.1; are provided with an adequate depth of earth cover and/or a concrete slab covering, and in areas where redundant lines must cross paths, a concrete slab is placed between the redundant lines.

17) Containment Equipment Hatch Exterior walls and roofs are designed in accordance with Section 3.5.1.

18) Above Ground Exterior Piping Are provided with missile protective concrete barriers. Barriers encase the piping and extend from exterior concrete walls designed in accordance with Section 3.5.1 to below grade where an adequate depth of earth cover is provided.

Note: (1) The refueling water storage tank and the reactor make-up water storage enclosures are not provided with a roof. In the unlikely event that a postulated tornado missile strike causes complete loss of a tank and its contents, ample time is available to bring the plant to a shutdown, as required by Technical Specifications.

Note (2) As discussed in Section 3.5.1.4, TMRE is an alternative methodology for determining whether protection from tornado-generated missiles is required. Table 3.5.1-2a lists conditions where the TMRE methodology has demonstrated that tornado missile protection is not required.

TABLE 3.5.1-2a SAFETY-RELATED STRUCTURES, SYSTEMS AND COMPONENTS THAT DO NOT REQUIRE PROTECTION FROM TORNADO GENERATED MISSILES BASED ON TORNADO MISSILE RISK EVALUATOR METHODOLOGY System Component Auxiliary Feedwater Turbine Driven Auxiliary Feedwater Pump exhaust pipe (3MS16-185SAB-1) is exposed to potential tornado missiles.

6.9 kV Standby AC Power, Emergency Diesel Generators (EDG)

A train Diesel Fuel Oil supply line (3FO2-42SA-1) to the Day Tank in the Diesel Generator Building is exposed to potential tornado missiles through Security door 1FP-D1133.

Electrical conduits (17179Q SA and 16255V SA) in the Diesel Generator Building, EL 261 common corridor, are exposed to potential tornado missiles through multiple openings in the corridor exterior wall (two HVAC vent openings with manbarriers installed, Unit 1 Security door 1FP-D1133, and Unit 2 Security door 1FP-D1134).

Inverted neck vent lines 7LO6-34-1, 7LO6-36-1, 7EA8-11-1, and 7EA8-13-1 located on the Diesel Generator Building roof are exposed to potential tornado missiles.

Conduits 17199K SA in the A EDG room and 17196X SB in the B EDG room are exposed to potential tornado missiles through the east exterior wall air intake louvers for each room.

A & B train EDG Fuel Oil Return lines are exposed to potential tornado missiles through the east exterior wall air intake louvers.

Emergency Service Water (ESW)

A train electrical conduits in the ESW Intake Screening Structure are exposed to potential tornado missiles through Security door 1FP-D1336. Affected conduits are 17049M SA, 12295C SA, 12219M SA, 12312D SA, 16091H SA, 16091ESA, 16091D SA, 16091C SA, 16091G SA, 16091A SA, 16149J SA, 12296J SA, and 12219J SA.

Conduits 12293E-SA and 13292C-SA, A Traveling Screen Wash supply line, A Traveling Screen motor, and Cabinet Y21-C7-ESF-A inside the A ESW pump room are exposed to potential tornado missiles through penetration seals E2264, P4042, and E2266 in the A ESW Intake Structure east exterior wall.

The A or B ESW Traveling Screens are exposed to potential tornado missiles through a steel checkered plate covering the coarse screen and stop log guides.

The A or B ESW Traveling Screens are exposed to potential tornado missiles above the water if the Main Reservoir is at the lowest level allowed by Technical Specifications Battery Room Ventilation The EL 305 HVAC exhaust plenums for both the 1A-SA and 1B-SB Battery Rooms within the Main Steam Penthouse on the RAB EL 305 roof are susceptible to missiles. The EL 305 HVAC exhaust duct and motor operator for A and B RAB SWGR RM (1AV-11:002 and 1AV-13:002) are exposed to potential tornado missiles.

Main Steam 1MS-81, 1MS-83, and 1MS-85 are exposed to potential tornado missiles through two Main Steam pipe openings in the Main Steam Penthouse on the RAB EL 305 roof in the east penthouse wall

System Component The Main Steam Safety Relief Valve vent pipes/stacks and the Main Steam Power Operated Relief Valve vent pipes/stacks on the RAB EL 305 roof are exposed to potential tornado missiles.

Main Steam Tunnel Ventilation Electrical conduits 112751R SA and 12751A SA and supply fan S64 S3 SA located in the Main Steam EL 305 HVAC A Train Supply Air Intake pillbox are exposed to potential tornado missiles through Security door 1FP-D0515 and through louvered HVAC air Intakes with steel manbarriers.

Electrical conduits 12753A SB & 12753J SB and supply fan S65 S3 SB located in the Main Steam EL 305 HVAC B Train Supply Air Intake pillbox are exposed to potential tornado missiles through Security door 1FP-D0516 and through louvered HVAC air Intakes with steel manbarriers.

Essential Services Chilled Water The A and B train Essential Services Chilled Water System Expansion Tanks 1CH-E085 and 1CH-E086 and the 2 connecting pipe at RAB EL 324 are exposed to potential missile pipe through outside air intake openings in the Reactor Auxiliary Building EL 324 exterior walls. There are 3 large openings through 41 line wall and 3 through 45 line wall.

Reactor Auxiliary Building The Reactor Auxiliary Building roof HVAC Exhaust Stack 1AV-ERABVS is exposed to potential tornado missiles.

Reactor Auxiliary Building EL 305 Outdoor Ambient Air Pressure Sensing Instrument Tubing PDT-1AV-4834-A1SAHP-T378 (A Train) and PDT1AV4834B1SBHP-T379 (B Train) are exposed to potential tornado missiles.

ESW Intake Structure Ventilation Outdoor air temperature elements TE-01EV-6589ASA, TE-01EV-6589BSB, TE-01EV-6591ASA, and TE-01EV-6591BSB are vulnerable to potential tornado missiles.

Electrical conduit 17072F-SB inside the B ESW electrical room is exposed to potential tornado missiles through Security door 1FP-D1173 opening.

Fuel Handling Building Ventilation Outdoor Ambient Air Pressure Sensing Instrument Tubing PDT-

• 1FL-5027ASA-T368 and PDT-*1FL-5027BSB-T370 are exposed to potential tornado missiles.

Diesel Generator Building Ventilation Outdoor air temperature elements TE-6902A-SA and TE-6902B-SB are vulnerable to potential tornado missiles.