ML18054A042

From kanterella
Jump to navigation Jump to search

Audit Plan (Start Date No Later than 4/15/18) Related to License Amendment Request to Incorporate Tornado Missile Risk Evaluator Methodology Into Licensing Basis
ML18054A042
Person / Time
Site: Vogtle  Southern Nuclear icon.png
Issue date: 03/16/2018
From: Geoffrey Miller
Special Projects and Process Branch
To: Hutto J
Southern Nuclear Operating Co
Brown E, NRR/DORL/LSPB, 415-2315
References
EPID L-2017-LLA-0350
Download: ML18054A042 (21)
v • d • e


Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 March 16, 2018 Mr. James J. Hutto Regulatory Affairs Director Vogtle Electric Generating Plant Southern Nuclear Operating Company, Inc.

40 Inverness Center Parkway, Bin 38 Birmingham, AL 35201-1295

SUBJECT:

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 -AUDIT PLAN RE: LICENSE AMENDMENT REQUEST FOR APPROVAL TO UTILIZE THE TORNADO MISSILE RISK EVALUATOR TO ANALYZE TORNADO MISSILE PROTECTION NON-CONFORMANCES (EPID L-2017-LLA-0350)

Dear Mr. Hutto:

By letter dated October 11, 2017, Southern Nuclear Operating Company, Inc. (SNC), submitted a license amendment request regarding the Vogtle Electric Generating Plant, Units 1 and 2 (VEGP). The proposed amendments would modify the licensing and design bases as described in the Updated Final Safety Analysis Report (UFSAR) to include a new methodology for determining the structures, systems, and components that require protection from tornado-generated missiles.

The U.S. Nuclear Regulatory Commission (NRC) staff will conduct a regulatory audit to support its review of the proposed license amendments. The audit will be conducted at locations in the greater Washington, D.C. area, SNC HQ, near the VEGP site, or other locations agreed upon by the licensee and NRC staff that facilitates access to the licensee's computer models, documentation, and technical experts implementing the Tornado Missile Risk Evaluator methodology. The NRC staff intends to start the audit no later than April 15, 2018, and a detailed audit plan is enclosed. The logistics and scope of the audit was discussed with your staff on February 21, 2018.

J. Hutto If you have any questions, please contact me by telephone at (301) 415-2481 or by e-mail at ed.miller@nrc.gov.

Si/Y

{3t:,t/ 111}

G. Edward Miller, Projec~ager Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-424 and 50-425

Enclosure:

Audit Plan

AUDIT PLAN UTILIZING THE TORNADO MISSILE RISK EVALUATOR TO ANALYZE TORNADO MISSILE PROTECTION NON-CONFORMANCES SOUTHERN NUCLEAR OPERATING COMPANY, INC.

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 DOCKET NOS. 50-424 AND 50-425 I. BACKGROUND By letter dated October 11, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17284A348), Southern Nuclear Operating Company, Inc. (SNC, the licensee), submitted a license amendment request (LAR) regarding the Vogtle Electric Generating Plant, Units 1 and 2 (VEGP). The proposed amendments would modify the licensing and design bases as described in the Updated Final Safety Analysis Report (UFSAR) to include a new methodology for determining the structures, systems, and components (SSCs) that require protection from tornado-generated missiles.

11. REGULATORY AUDIT BASES The purpose of the audit is to obtain a more detailed understanding of the licensee's implementation of Nuclear Energy Institute (NEI) 17-02, Revision 1, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," September 2017 (ADAMS Accession No. ML17268A036), and acceptability of the probabilistic risk assessment (PRA) model used to support this LAR. The U.S. Nuclear Regulatory Commission (NRC) staff has determined that an audit is the most efficient approach toward a timely resolution of issues associated with this review. The use of an audit is intended to gain understanding, to verify information, and to identify information that will require docketing to support the basis of the licensing or regulatory decision.

At the end of the audit, the audit team expects to have a complete understanding of the implementation of NEI 17-02, Revision 1, and the PRA model to support the TMRE methodology. Additionally, upon completion of this audit, the NRC staff expects to issue requests for additional information (RAls) to ensure that the licensee-provided information is sufficient to complete the LAR review.

Ill. REGULATORY AUDIT SCOPE AND METHODOLOGY The scope of the audit includes:

  • Determining of the acceptability of the licensee's PRA, the TMRE PRA model developed to support the LAR, and the PRA sensitivity analyses;
  • Gaining a better understanding of the licensee's implementation of TMRE methodology such as implementation of TMRE walkdowns and detailed calculations and bases that support the LAR; Enclosure
  • Reviewing the licensee's PRA maintenance and configuration control program in the context of the TMRE PRA basis, inputs, and assumptions and TMRE documentation;
  • Reviewing the key assumptions and sources of uncertainty; and
  • Identifying further information that is needed for the NRC staff to complete its review.

To accomplish these objectives, the NRC staff:

  • Requests the licensee to provide an overview presentation containing walkdown activities, the base internal events PRA model, and PRA conversion to the TMRE PRA model.
  • Requests the licensee to demonstrate the implementation of various aspects of TMRE methodology (e.g., identification of targets by walkdowns, development of the high-wind equipment list, area calculation, incorporation in PRA model, documentation, etc.) for a set of identified non-conforming and vulnerable targets.
  • Requests the information listed in the section entitled "Documentation to be Available for NRC Staff Review," of the Attachment, "Audit Information Needs," to gain a better understanding of assumptions and technical approaches used in the TMRE PRA model and consideration of key assumptions and sources of uncertainty.
  • Requests a discussion of the information needs listed in the Attachment with the licensee.

The audit will be performed consistent with NRC's Office of Nuclear Reactor Regulation (NRR)

Office Instruction LIC-111, "Regulatory Audits," dated December 29, 2008 (ADAMS Accession No. ML082900195).

IV. INFORMATION AND OTHER MATERIAL NECESSARY FOR THE REGULA TORY AUDIT The information needed for the regulatory audit is listed in the Attachment. The audit team will not remove non-docketed information from the audit site.

V. AUDIT TEAM ASSIGNMENTS The members of the audit team will be:

  • Greg Casto, Branch Chief, NRC
  • C. J. Fong, Team Leader, NRC
  • Mehdi Reisi-Fard, Reliability and Risk Analyst, NRC
  • Gordon Curran, Reactor System Engineer, NRC VI. LOGISTICS The NRC staff will conduct the audit no later than April 15, 2018, in the greater Washington, D.C.

area, SNC headquarters, near the VEGP site, or other locations agreed upon by the licensee and NRC staff that facilitates access to the licensee's computer models, documentation, and technical experts implementing the TMRE methodology. The NRC Project Manager will coordinate any changes to the audit schedule and location with the licensee.

VII. SPECIAL REQUESTS The NRC staff would like access to the following equipment and services:

  • Escorted access within the protected area where the licensee performed TMRE walkdowns;
  • Telephone with a speaker or speaker phone;
  • Enclosed conference room (or comparable space) with a table, chairs, and white board;
  • A projector and screen;
  • Wireless internet access (if available in the work space); and
  • Computer access to any onsite electronic portal applicable for this audit.

VIII. DELIVERABLES An audit summary will be prepared within 90 days of the completion of the audit. If information evaluated during the audit is needed to support a regulatory decision, the NRC staff will identify it in a formal RAI. The NRC staff will provide the RAls to the licensee in separate docketed correspondence.

IX. REFERENCES

1. Hutto, J. J., Southern Nuclear Operating Company, Inc., letter to U.S. Nuclear Regulatory Commission, "License Amendment Request for Approval to Utilize the Tornado Missile Risk Evaluator (TMRE) to Analyze Tornado Missile Protection Non-Conformances," dated October 11, 2017 (ADAMS Accession No. ML17284A348).
2. U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation (NRR) Office Instruction LIC-111, "Regulatory Audits," December 29, 2008 (ADAMS Accession No. ML082900195).
3. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," March 2009 (ADAMS Accession No. ML090410014).
4. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-informed Decisions on Plant Specific Changes to the Licensing Basis," May 2011 (ADAMS Accession No. ML100910006).
5. U.S. Nuclear Regulatory Commission, RG 1.76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," Revision 1, March 2007 (ADAMS Accession No. ML070360253).
6. Nuclear Energy Institute 17-02, Revision 1, "Tornado Missile Risk Evaluator (TMRE)

Industry Guidance Document," September 2017 (ADAMS Accession No. ML17268A036).

7. U.S. Nuclear Regulatory Commission, Pressurized Water Reactor Owners Group, PWROG-14001-P, Revision 1, "Final Safety Evaluation for PRA Model for the Generation Ill Westinghouse Shut-Down Seal," dated August 23, 2017 (ADAMS Accession No. ML17200C876).
8. Electric Power Research Institute NP-768, Tornado Missile Risk Analysis, May 1978, Palo Alto, California.

Attachment:

Audit Information Needs

AUDIT INFORMATION NEEDS SOUTHERN NUCLEAR OPERATING COMPANY INC.

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 DOCKET NOS. 50-424 AND 50-425 Documentation to be Available for NRC Staff Review

  • Documentation of the acceptability of the base internal events probabilistic risk assessment (PRA) model including peer-review report(s) to support the U.S. Nuclear Regulatory Commission (NRC) staff's review of key assumptions and key sources of uncertainty.
  • Documentation of changes made to PRA models in support of change analysis.
  • High-wind equipment list.
  • Documentation of TMRE PRA quantifications.
  • Documentation about PRA configuration control and procedures to support future implementation of the TMRE methodology.
  • Other documents, which the licensee deems as necessary to support the NRC staff's audit, outlined under audit scope.

Information Needs Evaluation of Target and Missile Characteristics Regulatory Position 2.3.3 of Regulatory Guide (RG) 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," May 2011 (Agencywide Documents Access and Management System (ADAMS Accession No. ML100910006), states that in the context of RG 1.174, technical adequacy will be understood as being determined by the adequacy of the actual modeling and the reasonableness of the assumptions and approximations. Regulatory Position 2.5.5 of RG 1.174, Revision 2, states that the licensee should pay particular attention to those assumptions that impact the parts of the model being exercised by the change. Finally, Regulatory Position 6.3.1 of RG 1.174, Revision 2, states that, among other items, a discussion as to why the PRA is of sufficient technical adequacy to support the application and the key modeling assumptions that are necessary to support the analysis or that impact the application should be submitted as part of a license amendment request (LAR). This information is intended to illustrate that the scope, level of detail, and technical acceptability of the engineering analyses conducted to justify the proposed licensing basis change are appropriate to the nature and scope of the change.

Attachment

1. (DRA/DSS) Section 8.2, "Using EPRI NP-768 Data to Determine Missile Impact Parameter (MIP)," of Nuclear Energy Institute (NEI) 17-02, Revision 1, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," September 2017 (ADAMS Accession No. ML17268A036), states, in part:

... choosing the most conservative target [missile impact parameter (MIP)]

from NP-768 (Target 4) would lead to overly conservative results for many targets at a [nuclear power plant (NPP)]. Therefore, the normalized tornado missile impact probability from "All Targets" in NP-768 (from Table 3-15) is proposed for use in the TM RE. This results in a MI P that is based on the combined hits on all modeled surfaces in NP-768, Plant A.

The derivation of the MIP includes the containment building (Target 1). As stated in NEI 17-02, Revision 1, Section 8.2, in part:

[t]he containment building is surrounded by other buildings ... so only the upper part of the containment is exposed to tornado missiles.

Additionally, the elevation of the exposed upper part of the containment is different from the elevation of other targets included in the calculation of near-ground missiles.

Due to the overall height and the large surface area of containment building, many missiles may be unable to reach upper portions of the containment building, which reduces the overall density of missile strikes and could become unrepresentative of other shorter plant buildings.

Section 3.2.3.2, "Missile Impact and Damage Probability Estimates," of the Electric Power Research Institute (EPRI) topical report NP-768, "Tornado Missile Risk Analysis," May 1978, states, in part:

[t]he individual target contributions to the total hit probability is generally greater for the larger targets but least for the containment structure (7.65 x 10- 10 , Table 3-8) which is shielded from impact for the first 60 ft above ground elevation.

Justify including Target 1 (containment building) of Plant A in EPRI NP-768 in computation of the average MIP for targets less than 30 feet (ft) above grade, given that the containment building is shielded by other buildings and is not impacted by near-ground missiles.

2. (DRA/DSS) Section 8.4, "MIP Values for Use in the TMRE," of NEI 17-02, Revision 1, provides two sets of MIP values, one for elevated targets and one for near ground targets.

The demarcation between near ground and elevated targets is 30 ft above the primary missile source for a target. For targets near the ground, the MIP appears to be derived using the target areas listed in Table 8-2 of NEI 17-02, Revision 1, which generally excludes the area of the roof (with an exception for Target 6, which includes the area of the roof). For the elevated MIP value, the area used to derive the MIP includes all the areas listed in Table 8-1 of NEI 17-02, Revision 1, which includes roof areas.

The EPRI topical report NP-768 Plant A targets vary in height from 20 to 230 ft. With the exception of the Target 1 (containment building), the buildings range in height from 20 to

80 ft. The weighted average (weighted by the wall area) height of all targets is 94 ft. The weighted average (weighted by the wall area) height of the targets is 56 ft if Target 1 is excluded.

Provide the basis for the 30 ft demarcation between near ground and elevated targets, given that EPRI NP-768 Plant A buildings range in height from 20 to 230 ft.

3. (DRA/DSS) Section 5, Evaluate Target and Missile Characteristics," of NEI 17-02, Revision 1, states, in part, that:

[t]he <30 ft MIP value can be used in cases where it is difficult to determine if the target is >30 ft above all missile sources.

Table 5-1 in NEI 17-02, Revision 1, refers to targets that are 30 ft above or below "grade,"

and Note 2 to the table explains:

[t]he term grade here is meant to refer to the elevation at which a majority of the missiles that can affect the target is located. Typically, this is plant grade, although for some targets it may be different.

The above discussions in Sections 5.0 and 5.1 of NEI 17-02, Revision 1, seem to provide different guidance regarding how to determine elevated targets (for which the MIP values are different). The NRC staff notes that missiles may exist at elevations above some nominal plant grade or that targets exist at elevations that are above and below the nominal plant grade.

a. Describe the process that Southern Nuclear Operating Company, Inc. (SNC, the licensee), has used for determining near ground and elevated targets considering various elevations of targets and missiles. The description should include how this process ensures proper consideration of missile source applicability for each target relative to the demarcation height.
b. The hit frequency in EPRI NP-768 is a function of the insertion height of the missiles. In EPRI NP-768, the missiles were assumed inserted from heights ranging from 5 to 50 ft, except for cars, which were assumed inserted from 5 to 10 ft.

Justify that the range of insertion heights would not underestimate hit probabilities.

4. (DRA) Appendix E, 'TMRE Methodology Sensitivity Studies," of NEI 17-02, Revision 1, examines the sensitivity of MIP values to target size, target elevation, and the distribution of missiles inventory around the plant. The appendix states that the results of these sensitivity analyses are used to support the derivation of MIP values. Section A.5, "Benchmark Results," of NEI 17-02, Revision 1, also discusses benchmark studies performed for two plants, to compare results using the TMRE methodology against the results associated with a peer reviewed TORMIS-based High Winds PRA.
a. There are no MIP values reported from the sensitivity analyses in Appendix E or benchmark studies in Appendix A, "Technical Basis to, TMRE Methodology."

Discuss how MIP values computed using the sensitivity analyses in Appendices A and E compare to average MIP values in Table 7-1 of NEI 17-02, Revision 1.

b. The MIPs calculated for elevated targets in Section 8.4 are about 54 percent of the MIPs calculated for near ground targets. This ratio reflects the assumptions with respect to areas included in calculation of MIPs for elevated and near ground targets. The difference in areas appears to be the only factor that determined in the difference between MIPs for elevated and near ground targets. One of the sensitivity analyses in Appendix E of NEI 17-02, Revision 1, examines the impact of target elevation on targets hit probabilities. NEI 17-02, Revision 1 states that the results of this sensitivity analysis show that in general as target elevation increases, hit probability decreases.

Describe the relationship between the numerical results shown in Appendix E and address whether the Appendix E results are generally consistent with the ratio of elevated to near ground MIPs calculated in Appendix B, "Bases for MIP and Missile Inventories." If Appendix E numerical results are not consistent with the ratio calculated in Appendix B, provide a justification.

5. (ORA) Section 3.3.1, "High Winds Equipment List," of Enclosure 1 to the LAR dated October 11, 2017 (ADAMS Accession No. ML17284A348), states, in part, that "PRA components and associated logic, that do not support mitigating a [loss of offsite power (LOOP)], were screened," since the TMRE model uses non-recoverable LOOP sequences. Section 6.1, "Event Tree/Fault Tree Selection," of NEI 17-02, Revision 1, states that, in addition to LOOP event trees, other internal initiating events should also be reviewed to ensure that either (1) a tornado event cannot cause another initiating event or (2) the impact of the initiating event can be represented in the logic selected to represent the tornado-initiating event. It is not clear whether the review discussed in Section 6.1 of NEI 17-02 was performed by the licensee to support this submittal. For example, nuclear service cooling water (NSCW) tower fans do not appear to have been reviewed as initiators or as support system losses that need to be included in the sequences. The walkdowns also appear to have been performed with a focus on the LOOP mitigation and other initiators or support system failures do not appear to have been considered during the walkdowns.

Describe the review performed to ensure that a tornado event cannot cause another initiating event or the impact of the initiating event can be represented in the logic selected to represent the tornado-initiating event. Provide the results of this review including a discussion of any potential impact on walkdowns.

6. (ORA) Section 3.3.3, "Missile Walkdowns," of Enclosure 1 to the LAR states that the TMRE generic number of missiles are not bounding at VEGP, Units 1 and 2. The LAR further states that for the portion of the area within the VEGP, Units 3 and 4 construction area, the number of missiles was estimated as bounded by the number of missiles within the VEGP, Units 1 and 2 site. Additionally, the missile count was increased by a factor of two to consider temporary missiles from construction of VEGP, Units 3 and 4.

Section 3.4.3, "Temporary Missiles," of NEI 17-02, Revision 1, states that the expected missile inventory for the post-construction site should be estimated, using walkdown results for the non-construction areas, information in Sections 3.4.2, "Non-Structural Missile Inventory," and 3.4.4, "Structural Missiles," along with design and construction information. The basis and assumptions used for the estimated number of

post-construction missiles will be documented. The LAR does not provide a basis for the adequacy of missile counts for post-construction site.

Section 3.4.3 of NEI 17-02, Revision 1 states the total missile count for the sensitivity analysis should include the non-construction related missile inventory determined in accordance with Sections 3.4.2 and 3.4.4, and a conservative estimate of the number of all construction-related missiles. The NEI guidance further states that the basis and assumptions used to determine the conservative construction missile estimate should be documented. The LAR does not provide a basis for the adequacy of construction-related missile counts.

a. Justify why the total number of 820,000 missiles bounds the number of construction-related and permanent missiles at the site. Describe the basis and assumptions used for estimating number of post-construction and construction-related missiles.
b. Justify the classification of the construction-related missiles as temporary missiles in VEGP's current and future implementation of the TMRE methodology.
c. Section 3.4.3 of NEI 17-02, Revision 1, states that it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory.

The guidance further states that outages are of relatively short duration compared to the operational time at a nuclear power plant. The NRC staff notes that duration of outages or other temporary activities that involve bringing additional equipment to the sites may be not be relatively short, specifically for a multi-unit site.

Clarify whether VEGP outage-related missiles were considered in total number of missiles used in VEGP TMRE implementation. Provide a justification if those missiles are not considered in estimating the total number of missiles at the site.

7. (ORA) Table 3.3.6-1 in Enclosure 1 to the LAR states that robustness of targets with respect to certain missile types is not considered anywhere in quantification and that any missile is considered to fail any target completely. Although the licensee has not considered robustness of targets in the October 11, 2017, submittal, it is not clear whether this part of TMRE methodology (i.e., adjusting number of missiles for robust targets) will be used in future implementations of the TMRE methodology.

Sections 5.2, "Missile Inventories," and 5.2.1, "Missile Inventory Example," of NEI 17-02, Revision 1, explain that a bounding inventory of missiles were developed from a survey of five plants along with a generic distribution of missile types. These sections explain that the missile types and target robustness categories are used to determine if a target fails.

Section 5.2 explains that in using the TMRE approach the missiles at a specific plant should be counted to ensure that the missile inventory at the plant is bounded by the inventory used in the TMRE method based on the survey. Finally, Section 8.6, "Missiles Affecting Robust Targets," of NEI 17-01, Revision 1, states that the number of missiles used in the Exposed Equipment Failure Probability (EEFP) calculation can be adjusted to account for the population of missiles that can damage an SSC and provides the percentage of the total missile inventory for each type of robust target. These percentages appear to depend on specific missile type counts taken from two plant missile inventories as shown in Table 8-15, 8-16, and 8-17.

The sections of NEI 17-02, Revision 1, cited above do not appear to provide guidance for adjusting the relative contribution of each missile type based on plant specific information.

A skewed distribution of missile types at a specific plant site could have an impact on the risk results of the TMRE PRA, because certain missiles (from certain missile robustness categories) can fail a greater number of SSCs than missiles from lesser robustness categories. As such, address the intended use of the TMRE guidance for adjusting the number of missiles for robust targets will be used in future implementations of the TMRE methodology. Describe how the VEGP evaluation will ensure that the contribution of each.

missile type to the overall missile population in NEI 17-02, Revision 1, is representative of the contribution of each missile type to the overall missile population in VEGP.

8. (ORA) Section 3.1, "Vulnerable SSC Walkdown Preparation," of NEI 17-02, Revision 1, states that SSCs that are potentially exposed to tornado missiles through a "De Minimis" penetration can be screened. Section 1.5, "Definitions," of NEI 17-02, Revision 1, defines a "De Minimis" penetration to be:

[a]ny penetration in a tornado-generated missile resistant reinforced concrete wall or other tornado-generated missile resistant structure that is less than 10 square feet.

For any exposed penetrations found during TMRE walkdowns meeting the above criteria, address whether any penetration was screened consistent with guidance in NEI 17-02, Revision 1, in the analyses that support this submittal. For any current or future penetrations screened, provide justification for using the selected area as the screening criterion, for the application of the screening criterion (e.g. single penetration area and/or combined penetration area), and for excluding "De Minimis" penetrations from the risk analysis.

9. (DRA/DSS) Section 5.3, "Target Exposed Area," of NEI 17-02, Revision 1, provides the method for calculating the target exposed area, the area of an SSC that is exposed to being struck by a tornado missile, which can result in the failure of the SSC. This section provides details on various types of SSCs and how their Target Exposed Area should be calculated for the EEFP. When calculating surface area, some components (e.g., tanks, ultimate heat sink fans, etc.) are susceptible to potential missiles in the vertical direction that could result in additional exposed area. As specified in RG 1. 76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," Revision 1, the NRC considers the missiles capable of striking in all directions with horizontal velocities and vertical velocities. The VEGP licensing basis defines parameters for missile velocities in both horizontal and vertical directions in the VEGP Updated Final Safety Analysis Report (UFSAR), Table 3.5.1-6, "Tornado Missiles Considered in the VEGP Design."

Section 3.3.2, 'Target Walkdowns," of Enclosure 1 to the LAR provides the scope of TMRE walkdowns. Item 3 of Section 3.3.2 includes identifications of "directions from which tornado missiles could strike the target" in the scope of walkdowns.

a. Address whether and how vertical missiles are incorporated in the analyses that supported the submittal.
b. Considering that tornado missiles could strike in all direction, describe how Item 3 in Section 3.3.2 of Enclosure 1 to the submittal was performed and how directional aspects are included in the VEGP TMRE.

Principles of Risk-Informed Decision Making

10. (ORA) One of the key principles in RG 1.174, Revision 2, states that the proposed change meets the current regulations unless it is explicitly related to a requested exemption.

Section 2.2, "Current Licensing Basis Requirements," of Enclosure 1 to the LAR states that VEGP was designed to meet General Design Criterion (GDC) 2, "Design bases for protection against natural phenomena," and GDC 4, "Environmental and dynamic effects design bases," in Appendix A to Title 10 of the Code of Federal Regulations (1 O CFR)

Part 50. GDC 2 states that SSCs important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions. GDC 4 states that SSCs important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes.

In Section 2.4, "Description of the Proposed Change," of Enclosure 1 to the LAR, the licensee indicates that conditions with a risk significance meeting the criteria of the methodology are insufficiently important to safety such that an accept-as-is disposition is acceptable to meet the guidance of GDC 2 and GDC 4, as incorporated into the VEGP UFSAR (Section 3).

Section 4.1, "Applicable Regulatory Requirements/Criteria," of Enclosure 1 to the LAR states that Section 3.5.1.4, "Missiles Generated by Tornadoes and Extreme Winds," of NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants" (SRP) allows for a probabilistic basis for "relaxation of deterministic criteria" for tornado missile protection of SSCs. The submittal further states

RG 1.174 establishes criteria ... to quantify the 'sufficiently small' frequency of damage" discussed in the SRP. However, the cited SRP sections discuss the probability of occurrence of events and not the change in core damage frequency (CDF) and large early release frequency (LERF).

Address how the proposed change will continue to meet the corresponding design basis as described in the VEGP UFSAR.

11. (ORA) Regulatory Position 2.1.1 in RG 1.174, Revision 2, discusses defense-in-depth as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states that the engineering evaluation should evaluate whether the impact of the proposed licensing basis change (individually and cumulatively) is consistent with the defense-in-depth philosophy. Section 3.2.1, "Defense-in-Depth," of Enclosure 1 to the LAR discusses the licensee's assessment of defense-in-depth considerations for this application.

Provide an evaluation of the impact of the proposed changes, individually and cumulatively, on the following defense-in-depth considerations:

  • System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).
  • Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.
  • The intent of the plant's design criteria is maintained.
12. (ORA) Regulatory Position 2.1.2 in RG 1.174, Revision 2, discusses safety margin as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states, in part, that with sufficient safety margin the safety analysis acceptance criteria in the licensing basis (e.g., final safety analysis report (FSAR), supporting analyses) are met or proposed revisions provide sufficient margin to account for analysis and data uncertainty. Section 7.5, "Defense-in-Depth and Safety Margin," of NEI 17-02, Revision 1 explains that engineering evaluation should be performed to assess whether the proposed licensing basis change maintains safety margin and identify conservatisms in the risk assessment to show that safety margin is maintained.

Section 3.2.2, "Safety Margin," of Enclosure 1 to the LAR discusses safety margin and states, in part, that "safety analysis acceptance criteria in the UFSAR are not impacted by this change," but provides no basis for that statement.

Section 2.3, "Evaluate Target and Missile Characteristics," of NEI 17-02, Revision 1, states that tornado missile failures do not need to be considered for SSCs protected by 18-inch reinforced concrete walls, 12-inch reinforced concrete roofs, and/or 1-inch steel plate. The guidance requires no analysis for evaluating the risk of non-conforming conditions that are protected as described in Section 2.3 of NEI 17-02, Revision 1 and implies that no protection against the tornado-generated missiles is needed for those SSCs. Revision 1 of NEI 17-02 provides similar guidance in Sections 5 and 6.5.

a. Describe how the identified non-conforming conditions are credited in the licensee's safety analysis (e.g., boundary conditions, availability assumptions, etc.) and justify their validity based on the TMRE analysis.
b. Discuss any non-conforming conditions that were (or if identified in the future, will be) screened from VEGP TMRE analysis using the criteria in Section 2.3 of NEI 17-02, Revision 1. For those non-conforming conditions, demonstrate that the safety analysis acceptance criteria in the licensing basis are met or proposed revisions provide sufficient margin to account for analysis and data uncertainty.
13. (ORA) Regulatory Position 2.4 in RG 1.174, Revision 2, discusses the risk acceptance guidelines. Section 7.3, "Comparison to Risk Metric Thresholds," of NEI 17-02, Revision 1, indicates that the delta risk between the compliant case and the degraded case PRA results should be evaluated against the "very small" change in risk acceptance

guidelines given in RG 1.174, Revision 2 (change in CDF of smaller than 1 o- 6 per year and change in LERF of smaller than 10-7 per year), and states, in part, that:

[i]t is possible that some licensees will exceed these thresholds, in which case, additional discussion on defense-in-depth and safety margins may be warranted in the LAR.

Section 2.5, Quantify Risk, Perform Sensitivity Analyses, and Compare to Thresholds," of NEI 17-02, Revision 1, states, in part, that:

[i]f LiCDF or LiLERF are close to or exceed the thresholds of RG 1.174, refinements to the Compliant and/or Degraded Case PRAs may be appropriate.

And

[i]f further reductions to LiCDF and LiLERF are not possible [by refining the analysis], the licensee will need to decide whether physical modifications should be made and to which SSCs.

Section 7.3 of NEI 17-02, Revision 1, appears to allow providing more information about defense-in-depth if the change-in-risk thresholds of RG 1.174 are exceeded, whereas Section 2.5 appears allow analysis refinement and plant modification if necessary.

Describe the licensee's approach if performance-monitoring programs indicate that the risk acceptance guidelines for "very small" change-in-risk in RG 1.174, Revision 2, are exceeded. Clarify whether any additional refinements beyond the guidance in NEI 17-02, Revision 1, will be made if acceptance guidelines are exceeded.

14. (ORA) Regulatory Position 3 in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. Section 8.1, "Plant Configuration Changes," of NEI 17-02, Revision 1, states that design control programs meeting 10 CFR 50 Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," will ensure subsequent plant configuration changes are evaluated for their impact on non-conforming SSC risk using TMRE. Section 8.1 also states, in part, that:

[l]icensees should ensure that they have sufficient mechanisms to assure that any significant changes to site missile sources, such as a new building, warehouse, or laydown area are evaluated for impact to the TMRE basis, even if not in the purview of the site Design Control program.

Section 4.1, "Applicable Regulatory Requirements/Criteria," of Enclosure 1 to the LAR states that the licensee has confirmed that sufficient mechanisms to assure that any significant permanent changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site design control program. Permanent changes that increase the site

missile burden within the 2500 feet missile radius established for TMRE shall be reviewed for impact on the TMRE analysis.

a. Describe the mechanism(s) and approach(es) that will be followed by the licensee to determine whether a particular change to the facility is "significant" for evaluation of the impact to the TMRE basis.
b. Describe the licensee's mechanisms that assure temporary and permanent changes to site missile sources will be evaluated.
c. Describe the processes that ensure other changes (e.g., procedure changes and new information about the tornado hazard at the plant) that could affect the results of VEGP TMRE PRA will be evaluated.
d. Describe the process(es) that ensure that changes made to the licensee's base internal events PRA model are reviewed for their impact on the licensee's TMRE PRA model and any identified changes are included in the TMRE PRA model.
e. Describe, with justification, the treatment of the currently identified non-conforming conditions in future uses of the licensee's TMRE PRA model.
f. Describe, with justification, how the cumulative risk from current and future non-conforming conditions will be used for comparison against 10 CFR 50.59 criteria as well as for future risk-informed submittals.

TMRE PRA Model and Results

15. (ORA) Regulatory Position 2.3.2 in RG 1.174, Revision 2, states that the level of detail required of the PRA is that which is sufficient to model the impact of the proposed change. This Regulatory Position further states that the characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated.

Section 6.5, "Target Impact Probability Basic Events," of NEI 17-02, Revision 1, states, in part, that:

SSC failures from tornado missiles may need to be considered for failure modes not previously included in the internal events system models ...

Section 6.5 then provides four relevant examples (i.e., flow diversion and/or leaks, tank vent failures, valve position transfer - spurious actuations, and ventilation damper failures). The section does not provide guidance about when and to what extent such failure modes should be considered.

a. Discuss the approach that was followed to identify the failure modes stated in Section 6.5 of NEI 17-02. Justify how the approach can comprehensively identify and include all credible failure modes.
b. Discuss whether the licensee's assessment or NEI 17-02, Revision 1, guidance considers any spurious actuation of the equipment because of mechanical or electrical malfunction due to a tornado strike.
c. Describe the above failure modes that were identified and included in licensee's TMRE PRA model used to support this application. Address how spurious actuation due to tornados are modeled.
16. (ORA) Section 3.3, "Ex-Control Room Action Feasibility," of NEI 17-02, Revision 1, states that no credit for operator action should be taken for actions performed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of a tornado event outside a Category I structure (in a location for which the operator must travel outside a Category I structure), but can be considered after the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Guidance in this section states that operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> could be impacted by such environmental conditions as debris that blocks access paths and should be considered by taking into account whether equipment will be accessible and whether the time required to perform the action will be impacted.

Discuss the assessments performed to ensure that environmental conditions will not affect operator actions that are credited after one hour in licensee's TMRE PRA.

17. (DRNDSS) Section 4.6, "Calculate Exceedance Probabilities," of NEI 17-02, Revision 1, states that exceedance probabilities should be generated for "the upper ranges for each F' category," F'2 through F'6, using the trendline equation. The figure provided in Section 4.6 suggests that the largest exceedance probability for each F' category, which corresponds to the lowest tornado speed for each F' category, is used.

Demonstrate how the initiating event frequencies were determined for use in the TMRE methodology.

18. (ORA) Section 6.6, "Non-Category I Structures and Other NSR SSCs," of NEI 17-02, Revision 1, states that failures of SSCs within a turbine building should follow the guidance for active and passive non-safety related (NSR) SSCs provided in items 3 and 4 of Section 6.6, for tornado categories the turbine building structure can withstand.

Section 3.3.5, "Target Evaluation," of Enclosure 1 to the LAR stated that for the turbine and associated support equipment to enable turbine trip, the turbine trip basic event was set to always be successful in the compliant case and to always fail in the degraded case.

Therefore, an EEFP was not calculated for this target.

Describe how the licensee exercised the guidance in Section 6.6 of NEI 17-02, Revision 1, for changing the failures of SSCs within the turbine building and justify any deviation from the cited guidance.

19. (ORA) Section 4.3, "2015 Internal Events Update," of Enclosure 3 to the LAR discusses the 2015 internal events update and states that the major change during the update was the addition of Westinghouse Owners Group (WOG) shutdown seal modeling. The discussion proceeds to state that a peer review was not required for these revisions. Per Section 4.1, "2010 Internal Events Update," of Enclosure 3 to the LAR, the most recent peer review of the licensee's internal events PRA model was performed in 2009.

Therefore, it appears that the addition of the WOG shutdown seal model to the licensee's internal events PRA was never peer reviewed.

a. Describe any peer reviews performed on the Generation Ill Westinghouse shutdown seal model and discuss whether it qualifies as an upgrade. Provide the

results from any related focused-scope peer review including the associated F&Os and their resolutions.

b. Demonstrate how the limitations and conditions in the NRC safety evaluation for PWROG-14001-P, Revision 1, are being met.

Uncertainties and Sensitivity Analyses

20. (ORA) Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings.

Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

Regulatory Position 3 in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. This Regulatory Position further states that an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This will ensure that the conclusions that have been drawn from the evaluation remain valid.

a. Describe the VEGP process if change-in-risk estimates from sensitivity analyses exceed the RG 1.174 acceptance guidelines for "very small" change in risk in response to other parts of this request or in future implementation of TMRE methodology.

The licensee evaluated the impact of considering construction-related missiles by performing a sensitivity analysis in Section 3.3.9.2, "Temporary Construction Missile Sensitivity," of Enclosure 1 to the LAR. Construction-related missiles have been at the site for an extended period, the basis for considering construction-related missiles only as a sensitivity analysis and not including them in evaluations to represent the as-built as-operated condition was not discussed.

b. Address the criteria used to determine when construction-related missiles on site for an extended period are considered an as-built, as-operated, condition.
c. For TMRE sensitivity analyses applicable in response to part b of this request or in future implementation of the TMRE methodology, describe how the importance measures are determined from the TMRE PRA model in the context of the

'binning' approach employed in the model. Describe whether and how the same basic events, which were discretized by binning during the development of the TMRE PRA model, are combined to develop representative importance measures.

For same basic events that are not combined, provide a justification that includes discussion of any impact on the results.

d. Identify the non-conforming conditions and vulnerabilities that met all the characteristics of a "highly exposed" SSC per Section 7.2.1, "TMRE Sensitivities,"

of NEI 17-02, Revision 1.

The discussions in Section 7.2 of NEI 17-02, Revision 1, do not address whether sensitivity analyses will be aggregated in future implementations of the TMRE methodology.

e. Describe, with justification, whether sensitivity analyses in Section 7.2 of NEI 17-02, Revision 1, will be aggregated in future implementation of the TMRE methodology.

Discussion in Section 7.2.3, "Compliant Case Conservatisms," and Section A.2.1.3, "Non-Category I Structures and Exposed Non-Safety Related SSCs," of NEI 17-02, Revision 1, recognizes that the TMRE PRA could produce non-conservative change-in-risk results if conservatively assumed failures in the Compliant Case mask change-in-risk. Accordingly, Section 7.2.3 of NEI 17-02, Revision 1, states, in part, that:

[t]he licensee should review cutsets in the top 90% of the TMRE compliant case to identify conservatisms related to equipment failure (opposed to offsite power recovery or operator actions) that could impact results ...

Section 7.2.3 of NEI 17-02, Revision 1, also explains that the licensee should perform sensitivity studies associated with these conservatisms as directed in Appendix D of the TMRE guideline for PRA standard supporting requirements (SRs) AS-A 10, LE-C3, and SY-B7 to address equipment failures in the compliant case that may be masking change-in-risk but does not provide guidance on how such a sensitivity can be performed.

Section 3.3.9.1, "Conservative Risk Treatments Masking Sensitivity," of Enclosure 1 to the LAR describes a sensitivity assessment performed to ensure conservative modeling treatments in the compliant case do not affect the risk assessment conclusions.

f. Describe any future sensitivity analysis that will be performed to assess the impact of conservatisms associated with modeling the equipment failures in the compliant case of the TMRE PRA model.

Modelling operator actions, could contribute to underestimating the change-in-risk calculation associated with non-conforming SSCs. Appendix D, "Technical Basis for TMRE Methodology," of NEI 17-02, Revision 1, does not highlight the fact that the concern described above could also apply to conservative human reliability analysis modeling (e.g., SR HR-G3 and HR-G7).

g. Describe how VEGP will address the potential impact of TMRE assumptions related to certain HEPs within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the accident on the compliant case.
21. (ORA) Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings.

Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

The discussion in Section A.7, "Zonal vs. Uniform (Z vs U) Sensitivity," of Appendix A, "Technical Basis for TMRE Methodology," to NEI 17-02, Revision 1, recognizes differences between zonal and uniform missile distributions. Targets were categorized in

Appendix A to separate intuitive from non-intuitive trends and an adjustment factor is proposed to account for zonal distribution of missiles.

Address how uncertainties associated with the impact of the missile distribution at the licensee's target hit probability are handled in the TMRE methodology.

22. (ORA) Section 3.3.2, Assessment of Assumptions and Approximations," of RG 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," March 2009 (ADAMS Accession No. ML090410014), states, in part, that

[f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application.

Further, Section 4.2, "Licensee Submittal Documentation," of RG 1.200, Revision 2, states, in part, that:

[t]hese assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate.

RG 1.200, Revision 2, defines the terms "key assumption" and "key source of uncertainty" in Section 3.3.2, "Assessment of Assumptions and Approximations."

Section 5.0, "Key Assumptions and Approximations," of Enclosure 3 to the LAR states that assumptions and approximations "are reviewed and assessed during the risk assessment to determine the impact on the TMRE risk assessment as required by the NEI 17-02 guidance." The guidance does not address the key assumptions and key sources of uncertainties were identified in VEGP internal events PRA model and how those assumptions and uncertainties were addressed.

a. Describe the key assumptions and key sources of uncertainties in VEGP internal events PRA that may impact this application.
b. Describe how each key assumption and key source of uncertainty was dispositioned for this application.

ML18054A042 *Via E-mail OFFICE NRR/DORL/LSPB/PM NRR/DORL/LSPB/LA NRR/DRA/APLB/BC NAME GEMiller JBurkhardt GCasto*

DATE 3/14/18 3/13/18 3/6/18 OFFICE NRR/DSS/SCPB/BC NRR/DORL/LSPB/BC NRR/DORL/LSPB/PM NAME RDennig* DBroaddus GEMiller DATE 3/8/18 3/16/18 3/16/18

Retrieved from "https://kanterella.com/w/index.php?title=ML18054A042&oldid=2415042"