Text

Updated Audit Questions License Amendment Request for Approval to Utilize the Tornado Missile Risk Evaluator to Analyze Tornado Missile Protection Non-Conformances
	ML18114A230
Person / Time
Site:	Vogtle
Issue date:	05/03/2018
From:	Geoffrey Miller; Special Projects and Process Branch
To:	Hutto J; Southern Nuclear Operating Co
	Miller G
References
	EPID L-2017-LLA-0350
	Download: ML18114A230 (17)
	v • d • e

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 May 3, 2018 Mr. James J. Hutto Regulatory Affairs Director Vogtle Electric Generating Plant Southern Nuclear Operating Company, Inc.

40 Inverness Center Parkway, Bin 38 Birmingham, AL 35201-1295

SUBJECT:

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 - UPDATED AUDIT QUESTIONS RE: LICENSE AMENDMENT REQUEST FOR APPROVAL TO UTILIZE THE TORNADO MISSILE RISK EVALUATOR TO ANALYZE TORNADO MISSILE PROTECTION NON-CONFORMANCES (EPID L-2017-LLA-0350)

Dear Mr. Hutto:

By letter dated October 11, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17284A348), Southern Nuclear Operating Company, Inc. (SNC),

submitted a license amendment request regarding Vogtle Electric Generating Plant, Units 1 and 2. The proposed amendments would modify the licensing and design bases as described in the Updated Final Safety Analysis Report to include a new methodology for determining the structures, systems, and components that require protection from tornado-generated missiles.

On March 16, 2018 (ADAMS Accession No. ML18054A042), the U.S. Nuclear Regulatory Commission (NRC) staff issued an audit plan that conveyed intent to conduct a regulatory audit to support its review of the subject license amendment. On April 4, 2018, the NRC staff conducted the first phase of the audit. As a result of those interactions, the NRC staff has made edits and additions to the audit questions in the Information Needs section of the enclosure that were initially issued with the audit plan. In addition to clarifying edits to the wording, additional discussion on questions 4 and 5 from the original list are not needed and these have been removed. Question 4 has been replaced with a new question regarding consequential equipment failures and subsequent questions have been renumbered. In addition, renumbered question 5 now has an additional part on estimating missile contribution from building contents.

In support of additional audit interactions at a future date, the current version of the audit questions are enclosed with this letter.

J. Hutto If you have any questions, please contact me by telephone at (301) 415-2481 or by e-mail at ed.miller@nrc.gov.

Since.rs J

/,)_,,,r,J / /"~

~ Miller, Project Manager Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-424 and 50-425

Enclosure:

Updated Audit Questions

AUDIT INFORMATION NEEDS SOUTHERN NUCLEAR OPERATING COMPANY, INC.

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 DOCKET NOS. 50-424 AND 50-425 Documentation to be Available for NRC Staff Review

Documentation of the acceptability of the base internal events probabilistic risk assessment (PRA) model including peer review report(s) to support the U.S. Nuclear Regulatory Commission (NRC) staff's review of key assumptions and key sources of uncertainty.

Documentation of changes made to PRA models in support of change analysis.

Documentation of tornado missile risk evaluator (TMRE) walkdown activities.

High-wind equipment list.

Documentation of TMRE PRA quantifications.

Documentation about PRA configuration control and procedures to support future implementation of the TMRE methodology.

Other documents, which the licensee deems as necessary to support the NRC staff's audit, outlined under audit scope.

Information Needs Evaluation of Target and Missile Characteristics Regulatory Position 2.3.3 of Regulatory Guide (RG) 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," May 2011 (Agencywide Documents Access and Management System (ADAMS Accession No. ML100910006), states that in the context of RG 1.174, technical adequacy will be understood as being determined by the adequacy of the actual modeling and the reasonableness of the assumptions and approximations. Regulatory Position 2.5.5 of RG 1.174, Revision 2, states that the licensee should pay particular attention to those assumptions that impact the parts of the model being exercised by the change. Finally, Regulatory Position 6.3.1 of RG 1.174, Revision 2, states that, among other items, a discussion as to why the PRA is of sufficient technical adequacy to support the application and the key modeling assumptions that are necessary to support the analysis or that impact the application should be submitted as part of a license amendment request (LAR). This information is intended to illustrate that the scope, level of detail, and technical acceptability of the engineering analyses conducted to justify the proposed licensing basis change are appropriate to the nature and scope of the change.

Enclosure

1. (DRA/DSS) Section B.2, "Using EPRI NP-768 Data to Determine Missile Impact Parameter (MIP)," of Nuclear Energy Institute (NEI) 17-02, Revision 1, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," September 2017 (ADAMS Accession No. ML17268A036), states, in part:

... choosing the most conservative target [missile impact parameter (MIP)]

from NP-768 (Target 4) would lead to overly conservative results for many targets at a [nuclear power plant (NPP)]. Therefore, the normalized tornado missile impact probability from "All Targets" in NP-768 (from Table 3-15) is proposed for use in the TMRE. This results in a MIP that is based on the combined hits on all modeled surfaces in NP-768, Plant A.

The derivation of the MIP includes the containment building (Target 1). As stated in NEI 17-02, Revision 1, Section B.2, in part:

[t]he containment building is surrounded by other buildings ... so only the upper part of the containment is exposed to tornado missiles.

Additionally, the elevation of the exposed upper part of the containment is different from the elevation of other targets included in the calculation of near ground missiles.

Due to the overall height and the large surface area of containment building, many missiles may be unable to reach upper portions of the containment building, which reduces the overall density of missile strikes and could become unrepresentative of other shorter plant buildings.

Section 3.2.3.2, "Missile Impact and Damage Probability Estimates," of the Electric Power Research Institute (EPRI) topical report NP-768, "Tornado Missile Risk Analysis,"

May 1978, states, in part:

[t]he individual target contributions to the total hit probability is generally greater for the larger targets but least for the containment structure (7.65 x 10-10 , Table 3-8) which is shielded from impact for the first 60 ft above ground elevation.

Justify including Target 1 (containment building) of Plant A in EPRI NP-768 in computation of the average MIP for targets less than 30 feet (ft) above grade, given that the containment building is shielded by other buildings and is not impacted by near ground missiles. Discuss how inclusion of Plant A containment building in computation of the average MIP for targets less than 30 ft above grade impacts this application.

2. (DRA/DSS) Section B.4, "MIP Values for Use in the TMRE," of NEI 17-02, Revision 1, provides two sets of MIP values, one for elevated targets and one for near ground targets.

The demarcation between near ground and elevated targets is 30 ft above the primary missile source for a target. For targets near the ground, the MIP appears to be derived using the target areas listed in Table B-2 of NEI 17-02, Revision 1, which generally excludes the area of the roof (with an exception for Target 6, which includes the area of

the roof). For the elevated MIP value, the area used to derive the MIP includes all the areas listed in Table B-1 of NEI 17-02, Revision 1, which includes roof areas.

a. The EPRI topical report NP-768 Plant A targets vary in height from 20 to 230 ft.

With the exception of the Target 1 (containment building), the buildings range in height from 20 to 80 ft. The weighted average (weighted by the wall area) height of all targets is 94 ft. The weighted average (weighted by the wall area) height of the targets is 56 ft if Target 1 is excluded.

Provide the basis for the 30 ft demarcation between near ground and elevated targets, given that EPRI NP-768 Plant A buildings range in height from 20 to 230 ft.

b. The MIPs calculated for elevated targets in Section 8.4 are about 54 percent of the MIPs calculated for near ground targets. This percentage seems to reflect the assumptions with respect to areas included in calculation of MIPs for elevated and near ground targets. The difference in area appears to be the only factor that determined the difference between MIPs for elevated and near ground targets.

One of the sensitivity analyses in Appendix E of NEI 17-02, Revision 1, examines the impact of target elevation ori targets hit probabilities. Revision 1 of NEI 17-02 states that the results of this sensitivity analysis show that in general as target elevation increases, hit probability decreases.

Describe the relationship between the numerical results shown in Appendix E and address whether the Appendix E results are generally consistent with the ratio of elevated to near ground MIPs calculated in Appendix B, "Bases for MIP and Missile Inventories." If Appendix E numerical results are not consistent with the ratio calculated in Appendix B, provide a justification.

3. (DRA/DSS) Section 5, Evaluate Target and Missile Characteristics," of NEI 17-02, Revision 1, states, in part, that:

[t]he <30 ft MIP value can be used in cases where it is difficult to determine if the target is >30 ft above all missile sources.

Table 5-1 in NEI 17-02, Revision 1, refers to targets that are 30 ft above or below "grade,"

and Note 2 to the table explains:

[t]he term grade here is meant to refer to the elevation at which a majority of the missiles that can affect the target is located. Typically, this is plant grade, although for some targets it may be different.

The above discussions in Sections 5.0 and 5.1 of NEI 17-02, Revision 1, seem to provide different guidance regarding how to determine elevated targets (for which the MIP values are different). The NRC staff notes that missiles may exist at elevations above some nominal plant grade or that targets exist at elevations that are above and below the nominal plant grade.

a. Describe the process that Southern Nuclear Operating Company, Inc. (SNC, the licensee), has used for determining near ground and elevated targets considering various elevations of targets and missiles. The description should include how this

process ensures proper consideration of missile source applicability for each target relative to the demarcation height.

b. The hit frequency in EPRI NP-768 is a function of the insertion height of the missiles. In EPRI NP-768, the missiles were assumed inserted from heights ranging from 5 to 50 ft, except for cars, which were assumed inserted from 5 to 10 ft.

Justify that the range of cited insertion heights would not underestimate hit probabilities.

4. NEI 17-02, Revision 1, Section 3.2.3, references consequential failures and describes treatment of identified and documented cases to be addressed in Section 6 (of NEI 17-02, Revision 1). Specifically, the first bullet in Section 3.2.3 characterizes tanks and piping as "passive" components. The NRC staff, citing discussion in public meetings 1 and a detailed discussion that was removed from NEI 17-01, Revision 0, understands that consequential failures to be the same as secondary effects.

Section 3.2.3 (Revision 1) does not appear to include guidance on consideration of secondary effects. Such effects include consideration for fluid-filled tanks and pipes, combustion motor intake effects (loss of oxygen from inert gas tank rupture or exhaust re-direction scenarios), and other potential secondary effects to the structures, systems, and components (SSCs) function.

Describe how secondary effects that may result from failure of non-conforming conditions were considered for identification of the initiating events and failure modes in the licensee's TMRE development.

5. (ORA) Section 3.3.3, "Missile Walkdowns," of Enclosure 1 to the LAR states that the TMRE generic number of missiles are not bounding at VEGP, Units 1 and 2. The LAR further states that for the portion of the area within the VEGP, Units 3 and 4 construction area, the number of missiles was estimated as bounded by the number of missiles within the VEGP, Units 1 and 2 site. Additionally, the missile count was increased by a factor of two to consider temporary missiles from construction of VEGP, Units 3 and 4.

Section 3.4.3, "Temporary Missiles," of NEI 17-02, Revision 1, states that the expected missile inventory for the post-construction site should be estimated, using walkdown results for the non-construction areas, information in Sections 3.4.2, "Non-Structural Missile Inventory," and 3.4.4, "Structural Missiles," along with design and construction information. The basis and assumptions used for the estimated number of post-construction missiles will be documented. The LAR does not provide a basis for the adequacy of missile counts for post-construction site.

Section 3.4.3 of NEI 17-02, Revision 1 states the total missile count for the sensitivity analysis should include the non-construction related missile inventory determined in accordance with Sections 3.4.2 and 3.4.4, and a conservative estimate of the number of all construction-related missiles. The NEI guidance further states that the basis and assumptions used to determine the conservative construction missile estimate should be 1 Meeting summaries for September 26, and November 22, 2017, public meetings ae available under ADAMS Accession Nos.

ML17257A009 and ML173108510, respectively.

documented. The LAR does not provide a basis for the adequacy of construction-related missile counts.

a. Justify the classification of the construction-related missiles as temporary missiles in VEG P's current and future implementation of the TMRE methodology.

b. Section 3.4.3 of NEI 17-02, Revision 1, states that it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory.

The guidance further states that outages are of relatively short duration compared to the operational time at a nuclear power plant. The NRC staff notes that duration of outages or other temporary activities that involve bringing additional equipment to the sites may be relatively long, specifically for a multi-unit site. It is not clear whether VEGP has adequately considered additional equipment (such as outage conditions) in estimating the number of missiles.

Clarify whether VEGP outage-related missiles were considered in total number of missiles used in VEGP TMRE implementation. Provide a justification if those missiles are not considered in estimating the total number of missiles at the site.

c. Section 3.4 of NEI 17-02, Revision 1, provides guidance for verifying the number of missiles resulting from the deconstruction of various types of buildings through the TMRE walkdown.

The guidance does not appear to involve walkdowns to count the potential missiles a non-Category I building contents inside the structure or to count missiles that would be generated by the deconstruction of the structure itself. It is unclear how the approach described in the guidance ensures that the missile inventories from building deconstruction are not underpredicted for a specific plant.

i. For each type of building addressed in NEI 17-02, Revision 1, explain how VEGP missile count considers building contents (i.e., materials that are not part of the building itself but available to become missiles if the building is hit).

ii. For those types of buildings where the NEI 17-02, Revision 1 methodology was applied, verify that the overall estimate of non-structural missiles within buildings is representative or bounding.

6. (ORA) Table 3.3.6-1 in Enclosure 1 to the LAR states that robustness of targets with respect to certain missile types is not considered anywhere in quantification and that any missile is considered to fail any target completely. Although the licensee has not considered robustness of targets in the October 11, 2017, submittal, it is not clear whether this part of TMRE methodology (i.e., adjusting number of missiles for robust targets) will be used in future implementations of the TMRE methodology.

Sections 5.2, "Missile Inventories," and 5.2.1, "Missile Inventory Example," of NEI 17-02, Revision 1, explain that a bounding inventory of missiles was developed from a survey of five plants along with a generic distribution of missile types. These sections explain that the missile types and target robustness categories are used to determine if a target fails.

Section 5.2 explains that in using the TMRE approach the missiles at a specific plant should be counted to ensure that the missile inventory at the plant is bounded by the

inventory used in the TMRE method based on the survey. Finally, Section B.6, "Missiles Affecting Robust Targets," of NEI 17-01, Revision 1, states that the number of missiles used in the Exposed Equipment Failure Probability (EEFP) calculation can be adjusted to account for the population of missiles that can damage an SSC and provides the percentage of the total missile inventory for each type of robust target. These percentages appear to depend on specific missile type counts taken from two plant missile inventories as shown in Tables B-15, B-16, and B-17.

The sections of NEI 17-02, Revision 1, cited above do not appear to provide guidance for adjusting the relative contribution of each missile type based on plant specific information.

A skewed distribution of missile types at a specific plant site could have an impact on the risk results of the TMRE PRA, because certain missiles (from certain missile robustness categories) can fail a greater number of SSCs than missiles from lesser robustness categories. As such, clarify whether the TMRE guidance for adjusting the number of missiles for robust targets will be used in future implementations of the TMRE methodology by the licensee. If that guidance will be used, describe how the VEGP evaluation will ensure that the contribution of each missile type to the overall missile population in NEI 17-02, Revision 1, is representative of the contribution of each missile type to the overall missile population in VEGP.

7. (DRA) Section 3.1, "Vulnerable SSC Walkdown Preparation," of NEI 17-02, Revision 1, states that SSCs that are potentially exposed to tornado missiles through a "De Minimis" penetration can be screened. Section 1.5, "Definitions," of NEI 17-02, Revision 1, defines a "De Minimis" penetration to be:

[a]ny penetration in a tornado-generated missile resistant reinforced concrete wall or other tornado-generated missile resistant structure that is less than 10 square feet.

For any exposed penetrations found during TMRE walkdowns meeting the above criteria, clarify whether any penetration was screened consistent with guidance in NEI 17-02, Revision 1, in the analyses that support this submittal. For any current or future penetrations screened, provide justification for using the selected area as the screening criterion, for the application of the screening criterion (e.g. single penetration area and/or combined penetration area), and for excluding "De Minimis" penetrations from the risk analysis.

8. (DRA/DSS) Section 5.3, "Target Exposed Area," of NEI 17-02, Revision 1, provides the method for calculating the target exposed area, the area of an SSC that is exposed to being struck by a tornado missile, which can result in the failure of the SSC. This section provides details on various types of SSCs and how their Target Exposed Area should be calculated for the EEFP. When calculating surface area, some components (e.g., tanks, ultimate heat sink fans, etc.) are susceptible to potential missiles in the vertical direction that could result in additional exposed area. As specified in RG 1. 76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," Revision 1, the NRC considers the missiles capable of striking in all directions with horizontal velocities and vertical velocities. The VEGP licensing basis defines parameters for missile velocities in both horizontal and vertical directions in the VEGP Updated Final Safety Analysis Report (UFSAR), Table 3.5.1-6, "Tornado Missiles Considered in the VEGP Design."

Section 3.3.2, "Target Walkdowns," of Enclosure 1 to the LAR provides the scope of TMRE walkdowns. Item 3 of Section 3.3.2 includes identifications of "directions from which tornado missiles could strike the target" in the scope of walkdowns.

a. Address whether and how vertical missiles are incorporated in the analyses that supported the submittal.

b. Considering that tornado missiles could strike from all directions, describe how Item 3 in Section 3.3.2 of Enclosure 1 to the submittal was performed and how directional aspects are included in the VEGP TMRE.

Principles of Risk-Informed Decision Making

9. (DRA) One of the key principles in RG 1.174, Revision 2, states that the proposed change meets the current regulations unless it is explicitly related to a requested exemption.

Section 2.2, "Current Licensing Basis Requirements," of Enclosure 1 to the LAR states that VEGP was designed to meet General Design Criterion (GDC) 2, "Design bases for protection against natural phenomena," and GDC 4, "Environmental and dynamic effects design bases," in Appendix A to Title 10 of the Code of Federal Regulations (10 CFR)

Part 50. GDC 2 states that SSCs important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions. GDC 4 states that SSCs important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes.

In Section 2.4, "Description of the Proposed Change," of Enclosure 1 to the LAR, the licensee requests, in part, the NRC approval of the conclusion that conditions with a risk significance meeting the criteria of the methodology are insufficiently important to safety such that an accept-as-is disposition is acceptable to meet the guidance of GDC 2 and GDC 4, as incorporated into the VEGP UFSAR (Section 3).

Section 4.1, "Applicable Regulatory Requirements/Criteria," of Enclosure 1 to the LAR states that Section 3.5.1.4, "Missiles Generated by Tornadoes and Extreme Winds," of NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants" (SRP) allows for a probabilistic basis for "relaxation of deterministic criteria" for tornado missile protection of SSCs. The submittal further states "RG 1.174 establishes criteria ... to quantify the 'sufficiently small' frequency of damage" discussed in the SRP. However, the cited SRP sections discuss the probability of occurrence of events and not the change in core damage frequency (CDF) and large early release frequency (LERF). The probabilistic criteria in SRP 3.5.1.4 (i.e., the probability of damage to unprotected safety-related features) is not directly comparable to RG 1.174 acceptance guidelines.

Address how the proposed methodology will continue to provide reasonable assurance that the SSCs important to safety will continue to withstand the effects of missiles from tornados or other external events without loss of capability to perform their safety function.

1O. (DRA) Regulatory Position 2.1.1 in RG 1.174, Revision 2, discusses defense-in-depth as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states that the engineering evaluation should evaluate whether the impact of the

proposed licensing basis change (individually and cumulatively) is consistent with the defense-in-depth philosophy. Section 3.2.1, "Defense-in-Depth," of Enclosure 1 to the LAR discusses the licensee's assessment of defense-in-depth considerations for this application. The licensee's assessment does not adequately address some defense-in-depth considerations.

Provide an evaluation of the impact of the proposed changes, individually and cumulatively, on the following defense-in-depth considerations:

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

The intent of the plant's design criteria is maintained.

11. (ORA) Regulatory Position 2.1.2 in RG 1.174, Revision 2, discusses safety margin as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states, in part, that with sufficient safety margin the safety analysis acceptance criteria in the licensing basis (e.g., final safety analysis report (FSAR), supporting analyses) are met or proposed revisions provide sufficient margin to account for analysis and data uncertainty. Section 7.5, "Defense-in-Depth and Safety Margin," of NEI 17-02, Revision 1 explains that engineering evaluation should be performed to assess whether the proposed licensing basis change maintains safety margin and identify conservatisms in the risk assessment to show that safety margin is maintained.

Section 3.2.2, "Safety Margin," of Enclosure 1 to the LAR discusses safety margin and states, in part, that "safety analysis acceptance criteria in the UFSAR are not impacted by this change," but provides no basis for that statement.

Section 2.3, "Evaluate Target and Missile Characteristics," of NEI 17-02, Revision 1, states that tornado missile failures do not need to be considered for SSCs protected by 18-inch reinforced concrete walls, 12-inch reinforced concrete roofs, and/or 1-inch steel plate. The guidance requires no analysis for evaluating the risk of non-conforming conditions that are protected as described in Section 2.3 of NEI 17-02, Revision 1 and implies that no protection against the tornado-generated missiles is needed for those SSCs. Revision 1 of NEI 17-02 provides similar guidance in Sections 5 and 6.5.

a. Describe why the safety analysis acceptance criteria in the licensee's safety analysis are not impacted by the proposed change.

b. Discuss any non-conforming conditions that were (or if identified in the future, will be) screened from VEGP TMRE analysis using the criteria in Section 2.3 of NEI 17-02, Revision 1. For those non-conforming conditions, demonstrate that the safety analysis acceptance criteria in the licensing basis are met or proposed revisions provide sufficient margin to account for analysis and data uncertainty.

12. (ORA) Regulatory Position 2.4 in RG 1.174, Revision 2, discusses the risk acceptance guidelines. Section 7.3, "Comparison to Risk Metric Thresholds," of NEI 17-02,

Revision 1, indicates that the delta risk between the compliant case and the degraded case PRA results should be evaluated against the "very small" change in risk acceptance guidelines given in RG 1.174, Revision 2 (change in CDF of smaller than 10-5 per year and change in LERF of smaller than 10-7 per year), and states, in part, that:

[i]t is possible that some licensees will exceed these thresholds, in which case, additional discussion on defense-in-depth and safety margins may be warranted in the LAR.

Section 2.5, Quantify Risk, Perform Sensitivity Analyses, and Compare to Thresholds," of NEI 17-02, Revision 1, states, in part, that:

[i]f ~CDF or ~LERF are close to or exceed the thresholds of RG 1.174, refinements to the Compliant and/or Degraded Case PRAs may be appropriate.

And

[i]f further reductions to ~CDF and ~LERF are not possible [by refining the analysis], the licensee will need to decide whether physical modifications should be made and to which SSCs.

Section 7.3 of NEI 17-02, Revision 1, appears to allow providing more information about defense-in-depth if the change-in-risk thresholds of RG 1.174 are exceeded, whereas Section 2.5 appears allow analysis refinement and plant modification if necessary.

Describe the licensee's approach if performance-monitoring programs indicate that the risk acceptance guidelines for "very small" change-in-risk in RG 1.174, Revision 2, are exceeded. Clarify whether any additional refinements beyond the guidance in NEI 17-02, Revision 1, will be made if acceptance guidelines are exceeded.

13. (ORA) Regulatory Position 3 in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. Section 8.1, "Plant Configuration Changes," of NEI 17-02, Revision 1, states that design control programs meeting 10 CFR 50 Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," will ensure subsequent plant configuration changes are evaluated for their impact on non-conforming SSC risk using TMRE. Section 8.1 also states, in part, that:

[l]icensees should ensure that they have sufficient mechanisms to assure that any significant changes to site missile sources, such as a new building, warehouse, or laydown area are evaluated for impact to the TMRE basis, even if not in the purview of the site Design Control program.

Section 4.1, "Applicable Regulatory Requirements/Criteria," of Enclosure 1 to the LAR states that the licensee has confirmed that sufficient mechanisms to assure that any significant permanent changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site design control program. Permanent changes that increase the site

missile burden within the 2500 feet missile radius established for TMRE shall be reviewed for impact on the TMRE analysis.

a. Describe the mechanism(s) and approach(es) that will be followed by the licensee to determine whether a particular change to the facility is "significant" for evaluation of the impact to the TMRE basis.

b. Describe the licensee's mechanisms that assure temporary and permanent changes to site missile sources will be evaluated.

c. Describe the process(es) that ensure changes that could affect VEGP TMRE results (e.g., plant design changes, changes made to the licensee's base internal events PRA model and new information about the tornado hazard at the plant) are considered in future implementation of the licensee's TMRE.

d. Describe, with justification, the treatment of the currently identified non-conforming conditions in future uses of the licensee's TMRE PRA model.

e. Describe, with justification, how the cumulative risk associated with unprotected SSCs evaluated under TMRE will be considered in comparison against 10 CFR 50.59 criteria as well as in future risk-informed submittals.

TMRE PRA Model and Results

14. (ORA) Regulatory Position 2.3.2 in RG 1.174, Revision 2, states that the level of detail required of the PRA is that which is sufficient to model the impact of the proposed change. This Regulatory Position further states that the characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated.

Section 6.5, "Target Impact Probability Basic Events," of NEI 17-02, Revision 1, states, in part, that:

SSC failures from tornado missiles may need to be considered for failure modes not previously included in the internal events system models ...

Section 6.5 then provides four relevant examples (i.e., flow diversion and/or leaks, tank vent failures, valve position transfer - spurious actuations, and ventilation damper failures). The section does not provide guidance about when and to what extent such failure modes should be considered.

Describe how the potential failure modes stated in Section 6.5 of NEI 17-02, Revision 1, were considered by the licensee during the TMRE walkdown, identified, and included in the licensee's TMRE PRA model used to support this application.

15. (ORA) Section 3.3, "Ex-Control Room Action Feasibility," of NEI 17-02, Revision 1, states that no credit for operator action shol!ld be taken for actions performed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of a tornado event outside a Category I structure (in a location for which the operator must travel outside a Category I structure), but can be considered after the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Guidance in this section states that operator actions after 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months could be impacted by such environmental conditions as debris that blocks access paths and should be considered by

taking into account whether equipment will be accessible and whether the time required to perform the action will be impacted.

Discuss, with justification, the assessments performed to ensure that environmental conditions will not affect operator actions that are credited after one hour in licensee's TMRE PRA.

16. (DRA/DSS) Section 4.6, "Calculate Exceedance Probabilities," of NEI 17-02, Revision 1, states that exceedance probabilities should be generated for "the upper ranges for each F' category," F'2 through F'6, using the trendline equation. The figure provided in Section 4.6 suggests that the largest exceedance probability for each F' category, which corresponds to the lowest tornado speed for each F' category, is used.

Clarify how the initiating event frequencies were determined for use in the TMRE methodology.

17. (ORA) Section 6.6, "Non-Category I Structures and Other NSR SSCs," of NEI 17-02, Revision 1, states that failures of SSCs within a turbine building should follow the guidance for active and passive non-safety related (NSR) SSCs provided in items 3 and 4 of Section 6.6, for tornado categories the turbine building structure can withstand.

Table 6-1 of NEI 17-02, Revision 1, also refers to Section 6.6 of that document for the treatment of "SSCs in [non]-Category I Buildings."

Section 3.3.5, "Target Evaluation," of Enclosure 1 to the LAR stated that for the turbine and associated support equipment to enable turbine trip, the turbine trip basic event was set to always be successful in the compliant case and to always fail in the degraded case.

Therefore, an EEFP was not calculated for this target. It is unclear how the licensee implemented the guidance in Table 6-1 and Section 6.6 of NEI 17-02, Revision 1, for calculating failures of SSCs within a turbine building.

Describe how the licensee exercised the guidance in Table 6-1 and Section 6.6 of NEI 17-02, Revision 1, for determining the failures of SSCs within the turbine building for the compliant and degraded cases and justify any deviation from the cited guidance.

18. (ORA) Section 4.3, "2015 Internal Events Update," of Enclosure 3 to the LAR discusses the 2015 internal events update and states that the major change during the update was the addition of Westinghouse Owners Group (WOG) shutdown seal modeling. The discussion proceeds to state that a peer review was not required for these revisions. Per Section 4.1, "2010 Internal Events Update," of Enclosure 3 to the LAR, the most recent peer review of the licensee's internal events PRA model was performed in 2009.

Therefore, it appears that the addition of the WOG shutdown seal model to the licensee's internal events PRA was never peer reviewed.

a. Describe any peer reviews performed on the Generation Ill Westinghouse shutdown seal model in the PRA model that is the basis for VEGP TMRE model.

Discuss whether the incorporation of Generation Ill Westinghouse shutdown seal model in that model qualifies as a PRA upgrade. Provide the results from any related focused-scope peer review including the associated F&Os and their resolutions.

b. Demonstrate how the limitations and conditions in the NRC safety evaluation for PWROG-14001-P, Revision 1, are being met. If any of the limitations and conditions are not met, describe the impact on the VEGP TMRE results.

Uncertainties and Sensitivity Analyses

19. (DRA) Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings.

Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

Regulatory Position 3 in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. This Regulatory Position further states that an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This will ensure that the conclusions that have been drawn from the evaluation remain valid.

It is not clear from discussions in Section 7.2, "Sensitivity Analysis," of NEI 17-02, Revision 1, what steps will be taken if the change in CDF and LERF from the sensitivity o-analyses exceed 1 6 per year and 10-7 per year, respectively.

a. Describe the VEGP process if change-in-risk estimates from sensitivity analyses exceed the RG 1.174 acceptance guidelines for "very small" change in risk in response to other parts of this request or in future implementation of TMRE methodology.

The licensee evaluated the impact of considering construction-related missiles by performing a sensitivity analysis in Section 3.3.9.2, "Temporary Construction Missile Sensitivity," of Enclosure 1 to the LAR. Construction-related missiles have been at the site for an extended period. The basis for considering construction-related missiles only as a sensitivity analysis and not including them in evaluations to represent the as-built as-operated condition was not discussed.

b. Based on the response to audit question 5.a, if necessary, update the results in Section 3.3. 7 by including construction-related missiles in the analysis. If construction-related missiles are included, update, if necessary, the analyses in Section 3.3.9, "Sensitivities," of Enclosure 1 to the LAR and perform applicable sensitivity analyses in Section 7.2 of NEI 17-02, Revision 1.

c. For TMRE sensitivity analyses applicable in response to part b of this request or in future implementation of the TMRE methodology, describe how the importance measures are determined from the TMRE PRA model in the context of the

'binning' approach for the tornado categories employed in the model. Describe whether and how the same basic events, which were discretized by binning during the development of the TMRE PRA model, are combined to develop representative importance measures. For same basic events that are not combined, provide a justification that includes discussion of any impact on the

results.

d. Identify the non-conforming conditions and vulnerabilities that met all the characteristics of a "highly exposed" SSC per Section 7.2.1, "TMRE Sensitivities,"

of NEI 17-02, Revision 1.

The discussions in Section 7 .2 of NEI 17-02, Revision 1, do not address whether sensitivity analyses will be aggregated in future implementations of the TMRE methodology. For example, it is unclear whether the licensee will combine the sensitivity analyses related to any future open PRA Facts and Observations (F&Os), sensitivities that address compliant case conservatism and TMRE sensitivity analyses.

e. Describe, with justification, whether sensitivity analyses in Section 7.2 of NEI 17-02, Revision 1, will be aggregated in future implementation of the TMRE methodology.

Discussion in Section 7.2.3, "Compliant Case Conservatisms," and Section A.2.1.3, "Non-Category I Structures and Exposed Non-Safety Related SSCs," of NEI 17-02, Revision 1, recognizes that the TMRE PRA could produce non-conservative change-in-risk results if conservatively assumed failures in the Compliant Case mask change-in-risk. Accordingly, Section 7.2.3 of NEI 17-02, Revision 1, states, in part, that:

[the] licensee should review cutsets in the top 90% of the TMRE compliant case to identify conservatisms related to equipment failure (opposed to offsite power recovery or operator actions) that could impact results ...

Section 7 .2.3 of NEI 17-02, Revision 1, also explains that the licensee should perform sensitivity studies associated with these conservatisms as directed in Appendix D of the TMRE guideline for PRA standard supporting requirements (SRs) AS-A 10, LE-C3, and SY-87 to address equipment failures in the compliant case that may be masking change-in-risk but does not provide guidance on how such a sensitivity can be performed.

Section 3.3.9.1, "Conservative Risk Treatments Masking Sensitivity," of Enclosure 1 to the LAR describes a sensitivity assessment performed to ensure conservative modeling treatments in the compliant case do not affect the risk assessment conclusions.

f. Describe any future sensitivity analysis that will be performed to assess the impact of conservatisms associated with modeling the equipment failures in the compliant case of the TMRE PRA model.

Modeling operator actions, could contribute to underestimating the change-in-risk calculation associated with non-conforming SSCs. Appendix D, "Technical Basis for TMRE Methodology," of NEI 17-02, Revision 1, does not highlight the fact that the concern described above could also apply to conservative human reliability analysis modeling (e.g., SR HR-G3 and HR-G7).

g. Describe how VEGP will address the potential impact of TMRE assumptions related to certain HEPs within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the accident on the compliant case.

20. (ORA) Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings.

Regulatory Position 3 states that decisions concerning the implementation of licensing

basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

The discussion in Section A.7, "Zonal vs. Uniform (Z vs U) Sensitivity," of Appendix A, "Technical Basis for TMRE Methodology," to NEI 17-02, Revision 1, recognizes differences between zonal and uniform missile distributions without justification. Targets were categorized in Appendix A to separate intuitive from non-intuitive trends and an adjustment factor is proposed to account for zonal distribution of missiles. As there is no justification for the validity of the results in Appendix E, "TMRE Methodology Sensitivity Studies," to NEI 17-02, Revision 1, the basis for addressing the uncertainty associated with missile distribution is unclear.

Describe, with justification, how uncertainties associated with the impact of the missile distribution on the licensee's target hit probability are handled in the VEGP TMRE methodology.

21. (ORA) Section 3.3.2, Assessment of Assumptions and Approximations," of RG 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," March 2009 (ADAMS Accession No. ML090410014}, states, in part, that

[f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application.

Further, Section 4.2, "Licensee Submittal Documentation," of RG 1.200, Revision 2, states, in part, that:

[t]hese assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate.

RG 1.200, Revision 2, defines the terms "key assumption" and "key source of uncertainty" in Section 3.3.2, "Assessment of Assumptions and Approximations."

Section 5.0, "Key Assumptions and Approximations," of Enclosure 3 to the LAR states that assumptions and approximations "are reviewed and assessed during the risk assessment to determine the impact on the TMRE risk assessment as required by the NEI 17-02 guidance." The submittal does not describe the key assumptions and key sources of uncertainties were identified in VEGP internal events PRA model and how those assumptions and uncertainties were addressed.

a. Describe the key assumptions and key sources of uncertainties in VEGP internal events PRA that may impact this application.

b. Describe how each key assumption and key source of uncertainty was dispositioned for this application.

ML18114A230 *Via E-mail OFFICE NRR/DORL/LSPB/PM NRR/DORL/LSPB/LA NRR/DRA/APLB/BC*

NAME GEMiller JBurkhardt GCasto DATE 04/30/18 04/27/18 04/24/18 OFFICE NRR/DSS/SCPB/BC* NRR/DORL/LSPB/BC NRR/DORL/LSPB/PM NAME RDennig DBroaddus GEMiller DATE 04/25/18 05/03/18 05/03/18 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 May 3, 2018 Mr. James J. Hutto Regulatory Affairs Director Vogtle Electric Generating Plant Southern Nuclear Operating Company, Inc.

40 Inverness Center Parkway, Bin 38 Birmingham, AL 35201-1295

SUBJECT:

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 - UPDATED AUDIT QUESTIONS RE: LICENSE AMENDMENT REQUEST FOR APPROVAL TO UTILIZE THE TORNADO MISSILE RISK EVALUATOR TO ANALYZE TORNADO MISSILE PROTECTION NON-CONFORMANCES (EPID L-2017-LLA-0350)

Dear Mr. Hutto:

By letter dated October 11, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17284A348), Southern Nuclear Operating Company, Inc. (SNC),

submitted a license amendment request regarding Vogtle Electric Generating Plant, Units 1 and 2. The proposed amendments would modify the licensing and design bases as described in the Updated Final Safety Analysis Report to include a new methodology for determining the structures, systems, and components that require protection from tornado-generated missiles.

On March 16, 2018 (ADAMS Accession No. ML18054A042), the U.S. Nuclear Regulatory Commission (NRC) staff issued an audit plan that conveyed intent to conduct a regulatory audit to support its review of the subject license amendment. On April 4, 2018, the NRC staff conducted the first phase of the audit. As a result of those interactions, the NRC staff has made edits and additions to the audit questions in the Information Needs section of the enclosure that were initially issued with the audit plan. In addition to clarifying edits to the wording, additional discussion on questions 4 and 5 from the original list are not needed and these have been removed. Question 4 has been replaced with a new question regarding consequential equipment failures and subsequent questions have been renumbered. In addition, renumbered question 5 now has an additional part on estimating missile contribution from building contents.

In support of additional audit interactions at a future date, the current version of the audit questions are enclosed with this letter.

J. Hutto If you have any questions, please contact me by telephone at (301) 415-2481 or by e-mail at ed.miller@nrc.gov.

Since.rs J

/,)_,,,r,J / /"~

~ Miller, Project Manager Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-424 and 50-425

Enclosure:

Updated Audit Questions

AUDIT INFORMATION NEEDS SOUTHERN NUCLEAR OPERATING COMPANY, INC.

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 DOCKET NOS. 50-424 AND 50-425 Documentation to be Available for NRC Staff Review

Documentation of the acceptability of the base internal events probabilistic risk assessment (PRA) model including peer review report(s) to support the U.S. Nuclear Regulatory Commission (NRC) staff's review of key assumptions and key sources of uncertainty.

Documentation of changes made to PRA models in support of change analysis.

Documentation of tornado missile risk evaluator (TMRE) walkdown activities.

High-wind equipment list.

Documentation of TMRE PRA quantifications.

Documentation about PRA configuration control and procedures to support future implementation of the TMRE methodology.

Other documents, which the licensee deems as necessary to support the NRC staff's audit, outlined under audit scope.