ML19123A014
| ML19123A014 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  (NPF-029) |
| Issue date: | 06/18/2019 |
| From: | Ellen Brown Special Projects and Process Branch |
| To: | Entergy Operations |
| Brown E, NRR/DORL/LSPB, 415-2315 | |
| References | |
| EPID L-2017-LLA-0371, EPID L-2019-LLA-0017 | |
| Download: ML19123A014 (45) | |
Text
Vice President, Operations Entergy Operations, Inc.
Grand Gulf Nuclear Station P.O. Box 756 Port Gibson, MS 39150 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 June 18, 2019
SUBJECT:
GRAND GULF NUCLEAR STATION, UNIT 1 - ISSUANCE OF AMENDMENT NO. 220 RELATED TO REQUEST TO INCORPORATE THE TORNADO MISSILE RISK EVALUATOR INTO LICENSING BASIS (EPID L-2019-LLA-0017)
Dear Sir or Madam:
The U.S. Nuclear Regulatory Commission (NRC or the Commission) has issued the enclosed Amendment No. 220 to Renewed Facility Operating License No. NPF-29 for the Grand Gulf Nuclear Station, Unit 1 (Grand Gulf). This amendment consists of changes to the Updated Final Safety Analysis Report (UFSAR) in response to your application by letter dated November 3, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17307A440), as supplemented by letters dated December 6, 2017, January 22, 2018, October 24, 2018, and January 23, 2019 (ADAMS Accession Nos. ML173408025, ML18022A598, ML18297A381, and ML19023A328, respectively).
The amendment incorporates the Tornado Missile Risk Evaluator methodology into the Grand Gulf UFSAR. The approved methodology may be used to demonstrate whether an identified structure, system, and component is required to conform to the current licensing basis requirements for protection against tornado missiles at Grand Gulf. The NRC staff notes that the Tornado Missile Risk Evaluator methodology may only be applied to discovered conditions where tornado-missile protection was required by the plant's current licensing basis but not provided. Further, the NRC's approval of this license amendment is based, in part, on the NRC staff's review of specific items included in your application. Accordingly, the methodology approved for this amendment must not be used either to remove existing tornado-missile protection, or to avoid providing tornado-missile protection during reviews done in support of the plant modification process at Grand Gulf.
The methodology provided as Enclosure 3 to the Shearon Harris Nuclear Power Plant pilot submittal supplement letter (Nuclear Energy Institute (NEI) 17-02, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," Revision (Rev.) 18) dated September 19, 2018 (ADAMS Accession No. ML18262A328), was incorporated by reference into the licensee's submittal, serves as an update to NEI 17-02, Rev. 1, and reflects updates and revisions to the methodology. This final methodology document is intended to support future application of the Tornado Missile Risk Evaluator methodology at Grand Gulf for future identified nonconformances within the constraints identified in Sections 3.9 and 3.10 of enclosed safety evaluation.
Additionally, it should be noted that the NRC staff's review of the Grand Gulf methodology is reflected in NEI 17-02, Rev. 1 B, as modified by the deviations to the methodology in Section 3. 9 and the scope and limitations identified in Section 3.10 of the enclosed safety evaluation. The NRC staff's plant-specific approval of the use of this methodology at Grand Gulf does not generically approve NEI 17-02, Rev. 1 or Rev. 18.
A copy of our related safety evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.
Docket No. 50-416
Enclosures:
- 1. Amendment No. 220 to NPF-29
- 2. Safety Evaluation cc: Listserv Sincerely, IRA/
Eva A. Brown, Senior Project Manager Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ENTERGY OPERATIONS, INC.
SYSTEM ENERGY RESOURCES, INC.
COOPERATIVE ENERGY, A MISSISSIPPI ELECTRIC COOPERATIVE ENTERGY MISSISSIPPI, LLC DOCKET NO. 50-416 GRAND GULF NUCLEAR STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 220 Renewed License No. NPF-29
- 1.
The Nuclear Regulatory Commission (NRC, the Commission) has found that:
A.
The application for amendment by Entergy Operations, Inc. (the licensee), dated November 3, 2017, as supplemented by letters dated December 6, 2017, January 22, 2018, October 24, 2018, and January 23, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.
The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.
There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.
The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.
The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.
- 2.
Accordingly, by Amendment No. 220, the license is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR), as set forth in the application dated November 3, 2017, as supplemented by letters dated December 6, 2017, January 22, 2018, October 24, 2018, and January 23, 2019. The licensee shall update the UFSAR to incorporate the changes as described in the licensee's application dated November 3, 2017, as supplemented by letters dated December 6, 2017, January 22, 2018, October 24, 2018, and January 23, 2019, consistent with the changes approved in the NRC staff's safety evaluation associated with this amendment, and shall submit the revised description authorized by this amendment with the next update of the UFSAR.
- 3.
This license amendment is effective as of its date of issuance and shall be implemented within 90 days from the date of issuance. The UFSAR changes shall be implemented in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e).
FOR THE NUCLEAR REGULATORY COMMISSION
~,-z.~
Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: June 18, 2019
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 220 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-29 ENTERGY OPERATIONS, INC., ET AL.
GRAND GULF NUCLEAR STATION, UNIT 1 DOCKET NO. 50-416
1.0 INTRODUCTION
By letter dated November 3, 2017 (the submittal) (Reference 1 ), as supplemented by letters dated December 6, 2017, January 22, 2018, October 24, 2018, and January 23, 2019 (References 2, 3, 4, and.5, respectively), Entergy Operations, Inc. (Entergy or the licensee) submitted a pilot license amendment request for Grand Gulf Nuclear Station, Unit 1 (Grand Gulf). The amendment request pilots the Nuclear Energy Institute (NEI) 17-02, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," Revision (Rev.) 1, dated September 21, 2017 (TMRE) (Reference 6). The amendment request assesses external hazard frequencies, system responses, and mitigating actions to determine whether physical protection of certain structures, systems, and components (SSCs) from tornado-generated missiles is warranted.
The methodology would only be applicable to discovered conditions where tornado-missile protection should be present but is not currently provided. Future modifications to the facility, which need to be reviewed for tornado-missile protection, will not be evaluated using the TMRE methodology.
The supplemental letters dated October 24, 2018, and January 23, 2019, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the U.S. Nuclear Regulatory Commission (NRC or the Commission) staff's original proposed no significant hazards consideration determination as published in the Federal Register on February 27, 2018 (83 FR 8516).
1.1 Purpose of Proposed Change The NRC issued Regulatory Issue Summary (RIS) 2015-06, Tornado Missile Protection," on June 10, 2015 (Reference 7), to (1) remind licensees of the need to conform their facility to the current, site-specific licensing basis for tornado-generated missile protection; (2) provide examples of failure to conform with a plant's tornado-generated missile licensing basis; and (3) remind licensees of the NRG staffs position that the licensee's systematic evaluation program or individual plant examination of external events results do not constitute regulatory requirements, and are not part of the plant-specific tornado-generated missile licensing basis, unless the NRG or licensee took action to specifically amend the operating license.
In response to RIS 2015-06, the licensee performed walkdowns at Grand Gulf to identify potential vulnerabilities with the current licensing basis for tornado missile protection. Specifically, the licensee identified plant configurations in which SSCs should have been protected from tornado-generated missiles based on the current licensing basis but were not resulting in noncompliance with design and licensing bases.
2.0
2.1 REGULATORY EVALUATION
Description of Proposed License Change In Section 2.4, "Description of the Proposed Change," of the enclosure to the submittal, as supplemented by Attachment 1 to the letter dated December 6, 2017, the licensee stated that it was requesting NRC approval of the revision to UFSAR Table 3.5.8 as well as the addition of Table 3.5.1-4a, to reflect those SSCs that do not require physical tornado-missile protection.
These nonconforming conditions were identified in Table 2-2 in the enclosure to the submittal and are as follows:
Diesel Generator (DG) Fuel Oil Storage Tank Vents; Standby Service Water (SSW) Vertical Piping between Basins and Lines SSW Superstructures; DG Fuel Oil Day Tank Vents; SSW Supply and Return Headers; and Various cables in Cable Chase Room.
On September 21, 2017, NEI submitted NEI 17-02, Rev. 1, also known as TMRE, in support of three proposed pilot implementations of their proposed methodology. NEI 17-02, Rev. 1 was intended to provide guidance for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles, and for assessing the risk posed by tornado missiles to determine whether physical protection of the noncom pliant SSCs was warranted. The TMRE is a risk-informed methodology, which is intended for application by Grand Gulf to resolve conditions that do not conform to requirements for protection against tornado missiles in the current licensing basis. The licensee is the third of three pilot submittals intended to exercise the generic TMRE found in NEI 17-02, Rev. 1. As such, significant portions of the information necessary to supplement the application are reflective of or referenced responses to the responses provided for the earlier pilots.
In the supplement dated January 22, 2018, the licensee withdrew the "de minimis" screening approach from its methodology and future implementation. The licensee updated and clarified its NEI 17-02, Rev. 1 based methodology in supplements dated October 24, 2018, and January 23, 2019. Several aspects of the licensee's TMRE methodology are adopted from the methodology in NEI 17-02, Rev. 1 A, which was also used by the two other pilot plants. The licensee's amendment request incorporates by reference the following submittals made by these other pilots:
supplements dated July 26 and September 14, 2018 (Reference 8 and 9, respectively),
by Southern Nuclear Operating Company, Inc. (SNC), for its Vogtle Electric Generating Station, Units 1 and 2 in its version; or the methodology used by Duke Energy for its Shearon Harris Nuclear Power Plant, Unit 1 in, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," to the September 19, 2018, supplement (Reference 10) (NEI 17-02, Rev. 1 B).
In its supplement dated October 24, 2018, the licensee further clarified that it was also requesting the addition of Section 3.5.3.3 to the UFSAR and that new section would incorporate the TMRE methodology. These proposed changes to the licensing basis will incorporate the TMRE methodology into the UFSAR to address identified inconsistencies related to tornado-missile protection. The licensee's final methodology is intended to support application of the TMRE methodology, which is reflected in NEI 17-02, Rev. 1 Bas implemented using the constraints identified in Sections 3.9 and 3.10 of this safety evaluation, at Grand Gulf for future identified nonconformances.
Section 3.4, "Technical Evaluation Conclusions," of the enclosure to the submittal states that the TMRE methodology could be used to resolve those issues that do not conform to deterministic design and licens'ing requirements for protection against tornado missiles by revising the design basis under Section 50.59, "Changes, tests and experiments," to Title 10 of the Code of Federal Regulations ( 10 CFR), provided the acceptance criteria are satisfied and conditions stipulated by the NRC staff in the safety evaluation approving the requested amendment are met. The methodology may only be applied when legacy conditions are discovered where tornado-missile protection was not provided. The methodology cannot be used to avoid providing tornado-missile protection in the plant modification process. Therefore, future changes to the facility requiring physical tornado-missile protection would not be evaluated using the TMRE methodology, unless prior NRC approval is sought for that use. The NRC staff notes that all proposed changes not within the scope of this plant-specific approved methodology as described in this safety evaluation are expected to be reviewed consistent with the criteria in 10 CFR 50.59 and the Grand Gulf licensing basis.
2.2 Tornado-Missile Protection Licensing Basis Grand Gulf was designed to meet the General Design Criteria (GDC) in Appendix A, "General Design Criteria for Nuclear Power Plants," to 10 CFR Part 50, including GDC 2 ("Design bases for protection against natural phenomena") and GDC 4 ("Environmental and dynamic effects design bases"). The current licensing basis for tornado-missile protection is contained in Sections 3.5.1, "Missile Selection and Description," and 3.5.2, "Structures, Systems and Components to be Protected from Missiles," of the Grand Gulf UFSAR.
The credible missiles created by natural phenomena at Grand Gulf are those generated by tornadoes. The design parameters applicable to the design basis tornado are for NRC tornado Region I and found in UFSAR Section 2.3, "Meteorology." Appendix 3A, "Conformance to NRC Regulatory Guides," of UFSAR Chapter 3 discusses the licensee's conformance to the relevant regulatory guides related to tornado protection.
The typical method used to meet the guidelines in the GDC provides positive (i.e., physical) protection features such as locating required equipment in structures designed for tornado missiles and providing barriers designed for tornado missiles.
2.3 Applicable Requirements Criterion 2, "Design bases for protection against natural phenomena," in Appendix A to 10 CFR 50 establishes requirements regarding the ability of SSCs important to safety to withstand the effects of natural phenomena without the loss of capability to perform their safety functions. Protection from the missile spectrum set forth in Regulatory Guide (RG) 1. 76, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," Rev. 1, issued March 2007 (Reference 11 ), provides assurance that necessary SSCs will be available to perform their safety functions during and following a tornado.
Criterion 4, "Environmental and dynamic effects design bases," in Appendix A to 10 CFR 50 establishes requirements regarding the ability of SSCs important to safety to be protected from dynamic effects, including the effects of missiles, from events and conditions outside the nuclear unit. Protection from a spectrum of missiles with the critical characteristics set forth in RG 1. 76 provides assurance that the necessary SSCs will be available to mitigate the potential effects of extreme winds and missiles associated with such winds on plant SSCs important to safety.
2.4 Applicable Regulatory Guidance and Review Plans The guidance in this section was used by the NRC staff to determine whether the methodology proposed in NEI 17-02, Rev. 1 is acceptable. As the licensee has submitted the methodology to evaluate changes to the protection of SSCs from externally generated tornado missiles, the guidance applies to the acceptability of the application of that methodology at Grand Gulf, within the constraints identified in this SE.
Sections 3.5.1.4, "Missiles Generated by Tornadoes and Extreme Winds," and 3.5.2, "Structures, Systems, and Components to be Protected from Externally-Generated Missiles," of NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants" (SRP) (References 12 and 13, respectively), contain the current acceptance criteria governing tornado-missile protection. These criteria generally specify that SSCs that are important to safety be provided with sufficient, positive tornado-missile protection (i.e., barriers) to withstand the maximum credible tornado threat. The appendix to RG 1.117, Rev. 2, "Protection Against Extreme Wind Events and Missiles for Nuclear Power Plants," issued July 2016 (Reference 14), lists the types of SSCs that should be protected from design-basis tornadoes. The NRC staff notes that this list is unchanged from the previous revision of the RG.
In addition to physical design methods, the NRC allows the use of probabilistic analysis to demonstrate that the probability of a tornado-generated missile striking safety-related equipment is sufficiently low such that no additional protective measures are required.
RG 1.17 4, Rev. 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," issued May 2011 (Reference 15),
describes an acceptable approach for developing risk-informed applications for a licensing basis change that considers engineering issues and applies risk insights. It provides general guidance concerning analysis of the risk associated with proposed changes in plant design and operation.
RG 1.200, Rev. 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," issued March 2009 (Reference 16), describes an acceptable approach for determining whether the probabilistic risk assessment (PRA), in total or the parts that are used to support an application, is acceptable for use in regulatory decisionmaking for light-water reactors.
RG 1.76, Rev. 1, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants,"
issued March 2007, provides a method to define design-basis tornado and design-basis tornado-generated missiles that a nuclear power plant should be designed to withstand to prevent undue risk to the health and safety of the public.
RG 1.117, Rev. 2, provides an approach for identifying those SSCs of light-water-cooled reactors that should be protected from the effects of the worst case extreme winds (tornadoes and hurricanes) and wind-generated missiles, such that they remain functional.
Section 19.1, Rev. 3, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load," of NUREG-0800, issued September 2012 (Reference 17), provides the NRC staff with guidance for evaluating the acceptability of a licensee's PRA results when used to request risk-informed changes to the licensing basis.
Section 19.2, Rev. 0, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance," of NUREG 0800, issued June 2007 (Reference 18), provides the NRC staff with guidance for evaluating the risk information used by a licensee to support permanent risk-informed changes to the licensing basis.
The American Society for Mechanical Engineers/American Nuclear Society ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,"
February 2009 (Reference 19), is referenced and endorsed for use in support of RG 1.200.
This industry standard sets forth requirements for PRAs used to support risk-informed decision for commercial nuclear power plants.
The guidance in NUREG/CR-4461, Rev. 2, "Tornado Climatology of the Contiguous United States," February 2007 (Reference 20), examines the implications of switching from the Fujita Scale (F-scale) to the Enhanced Fujita Scale (EF-scale) on design wind speed estimates for tornadoes. Existing current NRC guidance on tornado characteristics for consideration in the design of nuclear power plants is found in RG 1. 76 (AEC 197 4 ). This guidance is based on a summary of information from a variety of sources called WASH-1300, "Technical Basis for Interim Regional Tornado Criteria," May 1974. The initial version of NUREG/CR-4461 summarized data on tornadoes that occurred from January 1954 through December 1983 and were listed in a tornado database maintained by the National Severe Storms Forecast Center.
Rev. 1 of NUREG/CR-4461 updates the 1986 report using tornado data collected from January 1, 1950, through August 2003. It contains statistics on tornado dimensions and wind speeds by region of the country and estimates of strike probabilities and design wind speeds by boxes with sides of 1 degree, 2 degrees, and 4 degrees of latitude and longitude.
The TMRE methodology uses data and examples from the Electric Power Research Institute (EPRI) topical report EPRI NP-768, "Tornado Missile Risk Analysis," May 1978 (Reference 21),
to determine the number of hits per targets. These values are used in support of determining the missile impact parameter. In a memorandum dated November 29, 1983 (Reference 22), the NRC concluded that the EPRI methodology contained in EPRI NP-768 and EPRI NP-769, "Tornado Missile Risk Analysis Appendixes," May 1978 (Reference 23), can be utilized when assessing the need for positive tornado protection for specific safety-related plant features.
3.0 TECHNICAL REVIEW Consistent with the design criteria above, this review is intended to demonstrate that the licensee has properly established the capability of SSCs to withstand design wind loadings so that the design reflects appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena. As discussed in Section 3.5, "Missile Protection," of the licensee's UFSAR, the SSCs for the bounding safety functions are those that support the following:
No loss of containment function; No loss of function to systems required to shut down the reactor and maintain it in a safe shutdown condition, or mitigate the consequences of the missile damage; No offsite exposure exceeding the guidelines of 10 CFR 100; and No loss of integrity of the spent fuel pool.
In RG 1.117, the NRC staff determined that the likelihood of a design bases tornado occurring concurrent with a loss-of-coolant-accident (LOCA) is sufficiently small. Therefore, the bounding safety functions are considered to be those in support of a loss of offsite power (LOOP), with protection afforded for long-term core cooling. These criteria are used by the NRC staff to assess those SSCs that are necessary to be protected from externally generated tornado missiles. In Appendix A to the TMRE methodology, a non-recoverable LOOP is assumed. The NRC staff notes that, per RG 1.200, a safe and stable condition is required for a technically acceptable PRA. As such, it is assumed that long-term cooling is achieved and assured in that condition.
The NRC staff's review focused on (1) evaluating the acceptability of the NEI guidance process, as used by the licensee, for assessing the risk of SSCs that do not conform to the plant-specific licensing basis related to tornado-missile protection; (2) validating the acceptability of the licensee's PRA for use in the pilot implementation of the methodology; (3) confirming that the risk associated with not physically protecting the identified nonconforming SSCs according to the tornado-missile protection licensing basis is sufficiently small; and (4) confirming that the proposed change ensures that SSCs important to safety are designed to withstand the effects of tornadoes without loss of capability to perform their safety functions, and that their design reflects the importance of the safety functions to be performed.
3.1 Tornado Missile Protection Methodology The TMRE methodology (NEl-17-02, Rev. 1) uses plant walkdowns to identify and quantify potential externally generated tornado missiles and evaluate the availability of protection for onsite SSCs necessary to support withstanding the effects of normal and accident conditions related to a tornado. This information is used to calculate a failure probability for onsite SSCs necessary to support safe shutdown that are not protected, which are referred to as nonconforming SSCs. The exposed equipment failure probability (EEFP) is a conditional probability that associates the failure of an exposed SSC due to an externally generated missile assuming a tornado of a given category. The failures probabilities are then incorporated into the PRA model for the facility.
The TMRE methodology outlines those aspects that are conservative in Appendix A to NEI 17-02, Rev. 1. It indicates that the methodology is based on information derived from EPRI NP-768. Two areas were identified to be potentially non-conservative. The methodology instructs the use of sensitivity studies for these two areas. One of the non-conservatisms exist with calculations in the compliant case and the other in derivation of the missile impact parameter or MIP. The MIP is used to develop the EEFP and represents the probability of a damaging hit on a target per unit surface area, per missile, per tornado; and is sensitive to tornado intensity and the elevation of the target.
Then the methodology looks at two cases and uses the difference or delta to determine whether the risk from not providing physical protection to the nonconforming SSCs is acceptably small according to the RG 1.17 4 acceptance guidelines. The first case assumes that all nonconforming SSCs are protected. This is known as the compliant case. The second case is known as the degraded case and assumes that the nonconforming SSCs are considered failed as a result of the tornado and/or related conditions, such as tornado wind pressure.
3.1.1 Selection of SSCs As discussed in Section 2, "Overview of Tornado Missile Risk Evaluator Methodology," of NEI 17-02, Rev. 1, the methodology is composed of three major steps. The first step is the performance of walkdowns to gather information associated with those SSCs that are required to be protected. The walkdowns are used to confirm the identified nonconformances and identify any additional vulnerabilities. The concept of vulnerabilities reflects SSCs credited in the PRA that are not protected from tornadoes. The information is used to support the development of a High Winds Equipment List (HWEL). The HWEL list is refined to ensure that the SSCs remaining are those SSCs needed to withstand design wind loadings to support safe shutdown of the facility.
In Section 3, "Perform Plant TMRE Walkdown," of NEI 17-02, Rev. 1, the process for preparing, conducting, assessing, and documenting the performance of a walkdown of a site to gather sufficient information about the number and types of missiles on.site as well as confirmation and identification of SSCs that should be protected from externally generated missiles. The licensee used walkdowns to gather physical data associated with known vulnerable and nonconforming SSCs and to identify other SSCs modeled in the internal events PRA that are not protected from tornadoes and tornado missiles, using the threshold provided in NEI 17-02, Rev. 1 to develop a HWEL.
Conduct of the Walkdowns In Section 3.3.3, "Missile Walkdowns," of the enclosure to the submittal, the licensee indicated that the guidance in NEI 17-02, Rev. 1, was followed. Section 3.4, "Tornado Missile Identification and Classification," of NEI 17-02, Rev. 1, provides guidance on the expertise needed to perform tornado missile walkdown, verifying total number of missiles through TMRE walkdown for nonstructural, structural missiles, and considering nonpermanent missiles. The personnel recommendations for the tornado missile walkdown are discussed in Section 3.4.1 of NEI 17-02. Section 3.4.1, "Tornado MissileWalkdown Personnel," ofNEI 17-02, Rev.1 (and Rev. 1 B), states:
Personnel performing the Tornado Missile Walkdown do not require PRA expertise or knowledge, and structural engineering experience is not required.
The personnel only need to be trained on the methods for identifying and counting potential missiles. This section and Section 4.3 of EPRI 3002008092
["Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants"] provide adequate information to support training Tornado Missile Walkdown personnel.
The NRC staff reviewed the approval of another risk-informed tornado protection methodology known as TORMIS (Reference 24). Given that no specific expectations are required in the conduct of walkdowns for that methodology and the expectation for the personnel to be familiar with plant layout and drawings allowing personnel to properly define the missiles and classify/group missiles accordingly, the NRC staff finds the means used by the licensee to qualify walkdown personnel acceptable.
Determination of Applicable Missiles As discussed above, RG 1. 76 provides a method to define design-basis tornado and design-basis tornado-generated missiles. It defines tornado-generated missiles as objects moving under the action of the aerodynamic forces induced by the tornado wind. Wind velocities in excess of 75 miles per hour (mph) are capable of generating missiles from objects lying within the path of the tornado wind and from the debris of nearby damaged structures.
Section 3.5.1.4, "Missiles Generated by Natural Phenomena," of the FSAR, as updated, indicates that the Grand Gulf design-bases missiles consist of wood plank, steel pipe, utility pole, steel rod, and automobile.
Section 3.4.4, "Structural Missiles," and Section C.4, "Debris from Damaged Structures," of Appendix C, "Bases for Target Robustness and Missile Characteristics," of NEI 17-02, Rev. 1 contain guidance, including lists showing the type and size of a few structures, for determining the number of missiles generated by building deconstruction. The guidance for building deconstruction was based on typical construction practices and an assumption of a moderately stacked warehouse, which was confirmed as part of the guidance via a walkdown of a warehouse at a nuclear power plant.
The NRC staff finds the approach for determining the missile inventory from building deconstruction in NEI 17-02, Rev. 1, to be acceptable because ( 1) it considers different building types, (2) it is based on typical construction practices and representative warehouse inventory, and (3) the approach conservatively assumes that the entire building deconstructs resulting in its construction constituents as well as the inventory within being available as missiles.
Section C.4, "Debris from Damaged Structures," of NEI 17-02, Rev. 1, also includes an example evaluation of the guidance to determine the number of missiles from building deconstruction.
Because of the availability of guidance as well as an example for the implementation of the guidance to determine missile inventory from building deconstruction, the NRC staff finds that extensive structural engineering experience is not deemed necessary for personnel performing the tornado-missile inventory walkdown.
Section 3.4.2, "Non-Structural Missile Inventory," of NEI 17-02, Rev. 1, provides guidance on the process for counting nonstructural missile inventory to verify bounding values of plant nonstructural missiles. Due to the large diversity of objects to consider in the missile count, the TMRE methodology recommends grouping missiles of similar size and type into various zones around plant. While not all-inclusive, Table 3-2, "Potential Tornado Missile Type," of NEI 17-02, Rev. 1, provides examples of missiles to consider while performing a walkdown. Missile inventory was counted from the missile survey out to 2,500 feet (ft.) from the reference point.
The NRC staff noted that the 2,500 ft. missile source distance is a typical value used to support site-specific tornado missile count for applications and was derived from a case study discussed in Section 2.3.3, "Off Site Missile Assessment," of EPRI NP-769, "Tornado Missile Risk Analysis Appendixes." For nonstructural missile count, the NRC staff finds counting missiles to a distance of approximately 2,500 ft. is acceptable, because it is consistent with typical counting practice and the EPRI studies used as the basis for the TMRE methodology. The TMRE guidance also states that in the case of targets greater than 1,500 ft. from the reference point, a qualitative evaluation of the missile inventory within 2,500 ft. of the outlying targets should be performed. The NRC staff finds the licensee's approach for considering missiles around targets that are farther from the reference point acceptable because the insights from EPRI NP-768 data, which is used to support the TMRE methodology, suggest that majority of the hits would occur from tornado missiles within 600 ft. of the target.
Section 3.4.3, "Non-Permanent Missiles," of NEI 17-02, Rev. 1, provides guidance on the consideration of non-permanent missiles, such as those present during outages and construction periods. This section of NEI guidance states that it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory. The guidance further states that outages are of relatively short duration compared to the operational time at a nuclear power plant. The NRC staff notes that duration of outages or other temporary activities that involve bringing additional equipment to the sites may be relatively long, specifically for a multi-unit site.
For Grand Gulf, the NRC staff notes that the generic missile count from NEI 17-02, Rev. 1, of 240,000 was used for its TMRE analysis. The NRC staff requested that the licensee clarify whether outage-related missiles were considered in the total number of missiles used for TMRE implementation or address whether those missiles were considered in estimating the total number of missiles. In Attachment 1 to the October 24, 2018,* supplement, the licensee stated that Section 3.4.3 of NEI 17-02, Rev. 1, was revised in NEI 17-02, Rev. 18. Section 3.4.3 of NEI 17-02, Rev. 1 B, states that many outage-related missiles, if not staged during the walkdowns, would be counted as part of laydown areas or included in warehouse inventory, because most equipment used during outages was stored elsewhere onsite during non-outage times. Further, the revised section states that sites that develop a missile count less than 240,000 have margin in their missile count that can account for potential increases in missile counts during outage preparation and staging. The licensee further stated that it did not estimate the impact of outages on the missile inventory, but in the future, the missile inventory will be monitored to ensure that changes. due to outages will be managed in accordance with NEI 17-02, Rev. 1.
The NRC staff concludes that the licensee's approach for considering outage-related missiles is acceptable for this application because many outage-related missiles were included in the licensee's missile inventory estimate as part of warehouse inventory. In addition, the licensee's actual missile count was lower than the generic missile count in NEI 17-02, Rev. 1, which provides indirect consideration of outage related missiles. The NRC staff also finds that many outage-related missiles are generally included in the warehouse inventory during missile inventory walkdowns. Given that the licensee has margin in the missile count to account for potential increases in missile counts during outage preparation and staging, the NRC staff finds the NEI guidance for considering missiles associated with outages acceptable and additional consideration of those missiles during walkdowns is not necessary for future implementation of the TMRE methodology at Grand Gulf.
In the supplement dated January 23, 2019, the licensee stated that its approach was consistent with NEI 17-02, Rev. 1 B, for non-permanent construction-related missiles and any associated sensitivities. The licensee explained that (1) it would perform sensitivity analysis to evaluate impact of non-permanent construction-related missiles above the generic missile count used in the licensee's TMRE PRA, and (2) it would consider non-permanent construction-related missiles during plant changes that trigger a TMRE evaluation and if additional nonconforming SSCs are identified as part of the primary analysis or a sensitivity study. The NRC staff finds that the licensee's approach for considering outage-related non-permanent missiles in the submittal and supplement to be acceptable for this application because ( 1) the licensee's missile count is bounded by the generic assumptions in NEI 17-02, Rev. 1, and (2) the licensee will consider impact of non-permanent construction..:related missiles in future either in the primary analysis or through a sensitivity study. In the future, should the result of a proposed change exceed those assumptions and the risk metric thresholds in NEI 17-02, Rev. 1 B, are exceeded, prior NRC approval would be required.
In summary, the NRC staff finds the licensee's approach for characterizing tornado missiles in TMRE acceptable because (1) the licensee's process for performing missile counts considered structural and nonstructural missiles, (2) the licensee process is based on the relevant industry guidance, and (3) the methodology includes the design-bases externally generated missiles identified in the Grand Gulf FSAR, as updated, which is reflective of the guidance in RG 1.76, Rev. 0.
Section 2.3, "Evaluate Target and Missile Characteristics," Section 5, "Evaluate Target and Missile Characteristics," and Section 6.5, "Target Failures and Secondary Effects," of NEI 17-02, Rev. 1 B, states that tornado missile failures did not need to be considered for SSCs protected by 18-inch reinforced concrete walls, 12-inch reinforced concrete roofs, or 1-inch steel plate.
The guidance does not require analysis for evaluating the risk of nonconforming conditions that are protected as described in Section 2.3 of NEI 17-02, Rev. 1. The NRC staff questioned whether the safety analysis acceptance criteria in the licensing basis would continue to be met if nonconforming conditions were (or if identified in the future, would be) screened from Grand Gulf TMRE analysis using the criteria in Section 2.3 of NEI 17-02, Rev. 1. As discussed in the licensee's supplement October 28, 2018, screening of SSCs from the list of nonconforming conditions using the criteria in Section 2.3 of NEI 17-02, Rev. 1, was not performed for the proposed change in the licensee's application. Accordingly, the NRC staff finds that the licensee has not performed any screening of nonconforming SSCs that are protected consistent with Section 2.3 of NEI 17-02, Rev. 1. The NRC staff finds this approach acceptable.
High Winds Equipment List The guidance in Sections 3.1 and 3.2, of NEI 17-02, Rev. 1, was used to review previously identified nonconforming SSCs, collect and verify any data needed for the TMRE model via the development of HWEL, and locate and evaluate unprotected SSCs included in the TMRE PRA model via walkdowns. Sections 3.3.1, "High Winds Equipment List," and 3.3.2, Target Walkdowns," of the enclosure to the submittal describe the licensee's process for SSC (target) identification. Consistent with NEI 17-02, Rev. 1, specific configurations of interest observed during the walkdowns include:
Active (e.g., pumps or compressors) or passive (e.g., tanks, piping) components that were directly exposed to tornado winds whether inside or outside, Components inside non-Category I structures, Components adjacent to non-Category structures, and Components subject to failure, due to secondary effects.
The enclosure to the submittal further provides details about the development of its site-specific HWEL. The NEI guidance recommends refinement of the HWEL using certain screening criteria including:
Screening out SSCs that were located inside Category I structures and that were located away from vulnerable openings or features such as ventilation louvers and roll-up doors, and Screening SSCs that were dependent on offsite power, because the TMRE methodology assumed there would be a nonrecoverable LOOP due to the tornado event.
The licensee stated in Section 3.3.1 of the enclosure to the submittal that the items screened from inclusion in the HWEL based on their being in Category I structures were reviewed for the presence of potential missile paths. The NRC staff expressed concern that sufficient justification for using the selected area as the screening criterion for the application of the screening criterion (e.g., single penetration area and/or combined penetration area), and for excluding "de minimis" penetrations from the risk analysis had not been justified sufficiently.
Subsequently, in the supplement dated January 22, 2018, the licensee withdrew the screening criterion from its application of the TMRE methodology and indicated that Grand Gulf would not be applying the screening criteria for future implementation of the licensee's TMRE methodology. The NRC staff notes that the penetration area-based screening approach is no longer included in the TMRE methodology now described in NEI 17-02, Rev. 1B.
Given that ( 1) the licensee has not nor will it in the future use any criterion to screen out SSCs for its TMRE PRA model based on the area of penetrations, (2) the licensee's TMRE PRA and corresponding results do not screen out any SSCs based on the area of the penetrations, and (3) Category I structures were required to be designed to withstand the effects of tornado missiles, the NRC staff finds that the licensee's approach for screening SSCs in Category I structures acceptable.
3.1.1.1 Missile Impact Parameter The NRC's evaluation of the MIP values in NEI 17-02, Rev. 1, examined the dependencies of MIP values and the appropriateness of the area scaling approach in the methodology. The dependencies that were examined included the tornado region (tornado frequency), building configurations in EPRI NP-768, tornado intensity, and missile location, as well as height.
As discussed in Section 2.4 of this safety evaluation, the TMRE methodology uses the NRC approved data in EPRI NP-768 to derive the generic MIP values. Multiple scenarios of tornadoes striking a site were considered as part of the NRC reviewed and approved information provided in EPRI NP-768. Tornadoes were considered to take multiple alternative paths and be of different intensity. To explore the effect on missile-hit frequencies of sites located in different places in the country, average tornado frequency of three NRC tornado regions (Regions I, II, and Ill, numbered in decreasing order of tornado occurrence frequencies) were used as input to the calculations in EPRI NP-768. The calculations also explored effects of different missile types, different initial missile insertion heights, different initial locations of missiles through the site, and different configurations of buildings in the nuclear power plant. To study the different alternatives, the EPRI NP-768 analysis uses a Monte Carlo approach that sampled and addressed uncertainties of parameters such as wind speeds, initial missile locations, and insertion heights. The EPRI NP-768 report examined statistical convergence on target hit frequencies, to select a sufficiently large sample of tornado paths and intensities (measured in the F'-scale) and missile trajectories.
Targets The EPRI report analyzed effects of different configurations of buildings and missiles at nuclear power plants, by considering two hypothetical nuclear power plants, referred to as Plants A and B. The targets selected for the computation of hit frequencies were the buildings of Plants A and B. Plant A was a single-unit plant with seven buildings. Plant B was a two-unit plant with 16 buildings. Plant B was analyzed in two configurations: configuration B 1 postulated that all Unit 2 buildings were under construction when the tornado struck (with construction material providing a source of missiles); configuration B2 postulated both units as being operational at the time of the tornado strike. The types of missiles considered included wood beams, pipes, steel rods, utility poles, plates, and automobile vehicles (cars and trucks).
At Plant A, the missiles were assumed to be distributed uniformly over an enclosing area, while for Plant B, the distribution of missiles was non-uniform in the B1 and B2 configurations, which included different assumptions on insertion heights and the initial location of missile types (e.g.,
vehicles were predominantly located in parking lots).
Missile trajectories were simulated and the characteristics of the hits on the different buildings or targets were recorded (such as impact speeds and scabbing damage) using the EPRI methodology. The EPRI methodology employs Monte Carlo techniques in order to propagate the transport of tornado-generated missiles and to assess the probability of missile strikes causing damage to unprotected SSCs. Statistics were derived to quantify the number of hits per target, the number of hits per missile, the number of hits with specific features (including whether a threshold velocity was exceeded or whether a given amount of damage was caused by the hit) and associated hit frequencies.
The TMRE methodology notes that the majority of the tornado-generated missile hits in the EPRI NP-768 analysis affected the vertical walls, with few hits on the building roofs. Based on that observation, the guidance selected the vertical wall exposed area only to define the MIP for near-ground targets for use in the TMRE methodology. The exception in the selection of areas was for the target referred to as Target 6 (service water intake structure), which was 20 ft. in height. For Target 6, the total building area (walls and roof) was selected for estimating MIP values for both near-ground and elevated targets, on the basis that it was a short building with expected missile hits to the roof. Table B-3, "Plant 'A' Tornado Missile Impact Parameters for Near Ground Targets," in NEI 17-02, Rev. 1 B, revised average values of the MIP values over all building targets for the three NRC tornado regions are provided. The average value for each tornado intensity interval was computed as a weighted average using the target areas (building wall areas, with the previously stated exception of Target 6) as the weights. This area-weighted average is equivalent to adding missile-hit frequencies for all targets, and then dividing by the total reference area as well as the tornado frequency for the F' tornado intensity category under consideration.
Section B.3.2, "Selection of Conservative Tornado Region MIP," of the TMRE methodology asserts that differences in MIP values between the NRC tornado regions were unexpected and that no specific discussion is provided in EPRI NP-768 to explain those differences. To address the possible uncertainty, the maximum average of the three NRC tornado regions for each F' tornado intensity category was selected to define reference MIP values. The TMRE methodology further states that lack of convergence might have caused the numerical differences in the NRC torn~do regions and postulates a transition height between near-ground and elevated targets as 30 ft. above the reference. Depending on the location of the target (the location was measured with respect to the target center), the guidance provides different MIP values.
The NRC staff examined the NEI 17-02, Rev. 1, approach for computing the MIP values from EPRI NP-768 data. The NRC staff determined that the licensee appropriately calculated MIP values for the seven targets in Plant A studied in EPRI NP-768 and that the MIP average values in Tables B-3 and B-5 of NEI 17-02, Rev. 1 B, were acceptable. The NRC staff also compared the MIP values for each target in EPRI NP-768 to the average MIP values in NEI 17-02, Rev. 1 B, which would be used generically as part of the TMRE methodology. The targets in the EPRI NP-768 analysis were buildings that shielded each other against tornado-generated missiles. The reference MIP values in NEI 17-02, Rev. 1, were averages from multiple targets (each target had a different level of exposure to tornado missiles). In an as-built, as-operated nuclear power plant, specific targets may be more exposed and have higher MIP values than the generic MIP values proposed in NEI 17-02, Rev. 1. Section A.5, "Benchmark Results," of NEI 17-02, Rev. 1, presented results of a benchmark analysis, comparing results from using the average MIP values to site-specific high winds PRA results, and concluded that the average MIP values and the associated EEFP tended to overestimate (in several cases, depending on the F' tornado category, by orders of magnitude) SSC failure probabilities. The NEI guidance states that the technical acceptability of high winds PRA models used to benchmark the TMRE methodology were consistent with the guidance in RG 1.200. As the NRC staff used the results of those high winds PRA models to provide an order of magnitude estimation of SSC failure probabilities for this application, primarily for benchmarking purposes, there was no need to review the technical acceptability of the high winds PRA models.
The tables in Section A.5, "Benchmark Results," of Appendix A, "Technical Basis for TMRE Methodology," of NEI 17-02, Rev. 1, identified only few exceptions to the overestimation. The order of magnitude of the TMRE probabilities was similar to that for the probabilities calculated using the high winds PRA models for the exceptions. Although the number of examples in the benchmark in Section A.5 was limited, the benchmark supported the use of average MIP values as a defensible approach to estimate the EEFP for use in the TMRE PR.A model. The information in Appendix A of NEI 17-02, Rev. 1, demonstrated that the average MIP values would in general, not result in an underestimation of the failure probability of SSCs due to tornado missiles. The NRC staff noted unexpected variation of MIP values among the NRC tornado regions using the EPRI NP-768 data. The differences in MIP values between Regions I and II occurred mostly at the F'5 intensity and at the F'4 intensity between Regions I and Ill.
Although the reasons for those differences are unclear, occurrence of those differences at the high F' intensities may be caused by the lack of convergence in some simulations, as asserted by the NEI 17-02, Rev. 1. In the EPRI NP-768 simulations, the containment building experienced few hits on average and had the least contribution to the total hit probability compared to other targets. The NRC staff examined the possibility of underestimation of MIP values due to the consideration of the licensee's containment building (Target 1, Plant A) in deriving the average MIP values in NEI 17-02, Rev. 1. The containment building in EPRI NP-768 analysis was 230 ft. in height and was shielded in the lower part by other buildings. The missile hits to the Plant A containment building occurred at least 60 ft. above the ground.
The NRC staff questioned the inclusion of the containment building of Plant A in EPRI NP-768 in computation of the average MIP values for targets less than 30 ft. above a reference level, given that the containment building was shielded by other buildings and was not impacted by near-ground missiles. In the January 23, 2019, supplement, the licensee addressed the computation of MIP to remove the containment building from the near-ground MIP calculation.
The licensee also referred to several sections of NEI 17-02, Rev. 1 B that removed the containment building from the near-ground MIP calculations. Therefore, NEI 17-02, Rev. 1 B does not include the containment building for the near-ground MIP calculations. The licensee also applied the robust missile fractions from the TMRE methodology (discussed in Section 3.3 of this safety evaluation). The net result of these changes was insignificant (less than 5 percent), and it did not affect the licensee's previous conclusions.
The NRC staff concludes that the licensee's approach of excluding the containment building in the computation of the reference MIP values for near-ground structures in its TMRE methodology is acceptable, because it eliminates the impact of the containment building on the near-ground MIP values.
Section B.4, "MIP Values for Use in the TMRE," of NEI 17-02, Rev. 18, provides two sets of MIP values: one for elevated targets and one for near-ground targets. As previously noted, the demarcation between near-ground and elevated targets was 30 ft. above the primary missile source for a target. The EPRI NP-768 data supported the assumption of decrease in hit frequency with target height. For example, the MIP value of Target 1, which was only impacted at heights above 60 ft., was one order of magnitude less than the MIP value of other targets. As noted in Table B-2a, "Elevated and Near Ground Missile Impact Parameter Comparisons," of NEI 17-02, Rev. 18, the guidance proposed a MIP (elevated round)= 0.43 x MIP (near-ground).
Conservatism in MIP Calculation The NRC staff questioned the relationship between the numerical results shown in Appendix E, "TMRE Methodology Sensitivity Studies," of NEI 17-02, Rev. 1, and whether the Appendix E results are generally consistent with the ratio or elevated to near-ground MIPs calculated in Appendix B, "Bases for MIP and Missile Inventories." As discussed in the October 24, 2018, supplement, the licensee adopted the position taken by SNC in response to a similar question.
Consequently, based on information in the sensitivity analysis in Appendix E of NEI 17-02, Rev. 1, the licensee supported the selection of the 0.43 factor as a reasonable decrease factor to adjust the MIP values for elevated targets. Figure 12, "Plant A North Wall Hit Probability for all EFs," in Appendix E showed a marginal change in MIP values as the target elevation increased; however, the licensee explained this to be an artifact of the target location in high ground and protected by near-ground buildings. In general, the majority of the target elevation sensitivity results in Appendix E supported the assumption that the MIP decreased with increasing target elevation and that a decrease by a factor of 0.43, when the elevation changes by 30 ft., was reasonable.
The NRC staff notes that Target 1 (containment building) in the Plant A EPRI NP-768 configuration was only impacted by missiles above 60 ft. As noted previously, the containment building was shielded in the lower part by other buildings and the missile hits to the containment building occurred at least 60 ft. above the ground. The MIP value for Target 1 was more than one order of magnitude less than the average MIP values at all F' tornado intensity categories.
Thus, a reduction factor on the order of 0.1 or less could be justifiable for very elevated targets.
Using Figures 9-11 and 13-15, the NRC staff reviewed selected relative changes in MIP values associated with changes in target elevation from Appendix E. The NRC staff's review suggests that an average decrease by a factor 0.43 when the change in target elevation is 30 ft. would be a reasonable assumption for this application. As previously stated, the NEI guidance explained the anomaly (no or minimal change in the MIP values with increasing elevation) to be due to the relative ground elevation (affecting the target absolute elevation). Therefore, the NRC staff concludes that implementing a decrease factor for the MIP values of elevated targets (as shown in MIP for elevated targets provided in Table 5-1 of NEI 17-02, Rev. 1) is *reasonable for this application.
The NRC staff questioned the technical basis for the 30 ft. demarcation between near-ground and elevated targets. As discussed in the supplement dated October 24, 2018, the licensee adopted the position taken by SNC in response to a similar question. The licensee added Section 8.3.4, "Basis for Targ~t Elevation Demarcation," to NEI 17-02, Rev. 1, to provide the bases for the 30 ft. demarcation. Section 8.3.4 of NEI 17-02, Rev. 1 B, states that the demarcation elevation of 30 ft. was decoupled from the EPRI NP-768 data, because the EPRI NP-768 data did not provide quantifiable insights into missile hit probability at different elevations. The licensee further stated that an assumed demarcation elevation was qualitatively justified based on regulatory documents associated with tornado missiles (i.e., RG 1. 76, Rev. 1, and SRP Section 3.5.1.4). Those regulatory documents included the 30 ft. demarcation for heavier missiles, such as automobiles.
The NRC staff considered insights from target elevation sensitivity study in Appendix E, to examine the appropriateness of the change in MIP values for elevated targets and the transition elevation of 30 ft. The NRC staff concludes that assuming 30 ft. as a transition distance to consider a lower value of the MIP is acceptable for this application, because it is generally consistent with insights obtained from the EPRI NP-768 data and the Appendix E sensitivity analyses. The NRC staff emphasizes that any use of such transition distances or reduction factors outside the scope of the TMRE methodology is not approved through the granting of this amendment request.
The NRC staff concludes that selection of only the exposed vertical wall area to calculate MIP values for near-ground targets is justified because the majority of the missile hits in EPRI NP-768 analysis occurred near the ground and on the vertical walls. The EPRI NP-768 data and the NEI 17-02, Rev. 1 sensitivity analyses consistently showed that elevated targets have fewer hits and, therefore, using smaller MIP values for elevated targets is acceptable.
Using different MIP values for each tornado intensity is acceptable and supported by EPRI NP-768 data. The airborne missile paths are longer and cause more target hits for more intense tornadoes and, therefore, the average MIP values monotonically increase with increasing tornado intensity.
The reference MIP values derived in NEI 17-02, Rev. 18, were averaged over all examined targets (weighted by the exposed vertical wall area) with the exception of containment building.
The NRC staff concludes that computing the MIP values as an average of the examined targets is reasonable. The average value takes credit for mutual shielding of the buildings (i.e., the average MIP values correspond to a target that is neither the most exposed nor the least exposed) and mutual shielding is a more realistic representation of actual nuclear power plant configurations. The NEI 17-02, Rev. 1, guidance includes a benchmark comparison supporting the conclusion that use of average MIP values do not underestimate, in general, the EEFP with respect to site-specific failure probability of SSCs calculated using high winds PRA models. In summary, the NRC staff concludes that the use of average MIP values in NEI 17-02, Rev. 1 B, that do not include the containment building of the EPRI NP-768 Plant A are acceptable for this application.
3.2 Determination of Site Tornado Frequency The licensee developed site-specific tornado frequencies for each category of tornadoes, which it classified using the Fujita-prime scale (F'-scale). Section 4, "Determine Site Tornado Hazard Frequency," of NEI 17-02, Rev. 1, provides guidance on the development of site-specific tornado initiator frequencies.
The TMRE methodology uses the tornado data found in NUREG/CR-4461 to develop the site-specific tornado frequencies to be used in the TMRE PRA model. NUREG/CR-4461 provides, for each U.S. nuclear plant site, tornado wind speeds associated with 10*5/year, 10--6/year, and 10-7/year occurrence frequencies for a tornado strike. Additionally, the total tornado strike frequency is provided for all locations in the continental United States. Using data from NUREG/CR-4461, Rev. 2, and the approach detailed in Section 4 of NEI 17-02, Rev. 1, the licensee developed a site-specific tornado frequency curve (hazard curve) for the licensee's site. The site-specific hazard curve was then used to derive the frequency of all tornadoes considered in the TMRE methodology (F'2 through F'6).
For the purposes of the TMRE methodology, NEI used the F'-scale to classify tornado wind speed. This scale is different from the original Fujita Scale (F-scale) and the Enhanced Fujita Scale (EF-scale) that is typically ~sed. Section 4.2 of NEI 17-02, Rev. 1, stated that for the TMRE application, the F'-scale was chosen because the MIP values were derived based on simulations that used the F'-scale to categorize the tornadoes. Because F'-scale occurrence frequencies were not directly available from NUREG/CR-4461, Rev. 2, those frequencies were derived from the site-specific Fujita scale data. As noted in Section 4.2 of NEI 17-02, Rev. 1, using the Fujita scale data instead of the Enhanced Fujita Scale data resulted in higher and, therefore, more conservative strike frequencies. Although the TMRE methodology uses F'-scale for consistency in MIP derivation, RG 1.76, Rev. 1, uses EF-scale and, therefore, the use of the F'-scale is limited to this application.
The licensee described its process for determining tornado-initiating event frequencies in Section 3.3.4, "Tornado Hazard Frequency," of the enclosure to the submittal dated November 3, 2017. As stated in that section, the TMRE methodology and NUREG/CR-4461,
Rev. 2, data were used to determine the tornado-initiating event frequencies for the Grand Gulf TMRE PRA model. Site-specific tornado frequencies for applicable tornadoes were developed as a result of this effort. Using guidance in the TMRE methodology and plotting the Grand Gulf data points in an XY scatter chart with a logarithmic trend line, the licensee derived the hazard curve used to calculate tornado-initiating event frequencies for each tornado intensity.
The NRC staff questioned how the exceedance probabilities' influence on the initiating event frequencies were determined. In its supplement dated October 24, 2018, the licensee determined the F-scale wind speed estimates for the licensee's site for tornadoes of frequency 10-5/year, 10-6/year, and 10-1/year, consistent with NUREG/CR-4461, Rev. 2. A trendline was established and the resulting equation was used to calculate a frequency for all tornado wind speeds from 40 mph to 300 mph. Using the F'-scale tornado intensity wind speed ranges, exceedance frequencies were determined for each tornado intensity F'2 through F'6. Then, interval frequencies were developed for each range by subtracting the exceedance value of the next higher intensity from the previous intensity exceedance value. These interval frequencies were then used as the initiating event frequencies for each tornado category in the licensee's TMRE PRA model.
The NRC staff finds that the licensee's process for generating tornado initiator frequency is consistent with guidance in NEI 17-02, Rev. 1 and is technically acceptable for this application.
The NRC staff's finding is based on the licensee's (1) use of the most recent data from NUREG/CR-4461, Rev. 2, which has been endorsed by the staff and includes tornadoes reported in the contiguous United States from January 1950 through August 2003, (2) demonstration of acceptable results in the derivation of a site-specific tornado frequency curve (hazard curve), and (3) use of a technically sound approach to determine the frequency of each tornado category for use in the TMRE PRA model.
3.3 Failure Probability The second part of the methodology is the calculation of the failure probability of the SSCs due to externally generated tornado missiles. The failure probability of all SSCs impacted by tornado missiles that are part of the TMRE model (i.e., nonconformances and vulnerabilities) is determined through the EEFP. As described in Section 5, "Evaluate Target and Missile Characteristics," of the TMRE methodology, the EEFP represents "conditional probability that an exposed SSC is hit and failed by a tornado missile, given a tornado of a certain magnitude." An EEFP is calculated for each nonconformance and vulnerability at each of the tornado categories from F'2 through F'6. For buildings above 30 ft., a summation of EEFPs are used due to the MIP component of the EEFP being driven in part by elevation.
The EEFP is fundamental to the TMRE, because it provides the likelihood of an SSC being failed by a tornado missile. The NRC staff reviewed the probability and reviewed the derivation of the term and sensitivities. The TMRE methodology indicates that the EEFP was developed to be a conservative estimate. As such, deviations from the methodology can result in nonconservative probabilities and are not permitted by the methodology.
Robustness The fragility factor used in the EEFP determination is the conditional probability of the SSC failing to perform its function given that it is hit by a tornado missile. For the purposes of the TMRE methodology, the SSCs were assumed always failed if hit by a tornado missile (i.e., the factor is assumed to be 1 ). However, as discussed previously, the TMRE methodology defines adjustment factors on the missile inventory to account for levels of target robustness to withstand missile impacts. Section 5 of NEI 17-02, Rev. 1, includes guidance for the consideration of robust targets. Robust targets are those (e.g., steel pipes and tanks) that can be damaged by only certain types of missiles. Robust targets are subdivided into categories based on their characteristics such as the thickness of the steel or concrete used for the construction of the specific SSCs. To account for target robustness, NEI 17-02, Rev. 1, depending on the target's category of robustness, provides a certain fraction of the total missile inventory to be used in calculation of the EEFP for that target.
Nine categories of robust targets are defined in Table 5-2, "Missile Inventories for EEFP Calculations," to adjust missile counts from 1 percent (very robust target, such as a reinforced-concrete roof of at least 8 inches in thickness) to 55 percent {less robust target, such as a steel pipe of at least 16 inches in diameter and less than 3/8-inch thickness). Other targets not belonging to any of those nine categories were considered to be not robust, and any missile hit was assumed to fail the target (i.e., the missile count is 100 percent for these targets). An example of missile inventory adjustments to account for target robustness is presented in Table 5-3, "Example Missile Inventories for Different Targets (For F'6 Tornado EEFP Calculations)," of NEI 17-02, Rev. 1. The basis for the identification of certain SSCs as robust and the determination of the fraction of missile inventory that can damage each such SSC was provided in Section C.3, "Approach," of Appendix C of NEI 17-02, Rev. 1. The NRC staff finds the approach for the identification of certain SSCs as robust to be acceptable for this application because the characterization appropriately captures the varying level of damage that may be caused by a tornado missile hit.
Section B.6, "Missiles Affecting Robust Targets," of NEI 17-02, Rev. 1 stated that the number of missiles used in the EEFP calculation could be adjusted to account for the population of missiles that could damage an SSC and provided the percentage of the total missile inventory for each type of robust target. These percentages depended on specific missile type counts taken from two plant missile inventories as shown in Tables B-15, "Unrestrained Missile Inventories," B-16, "Restrained Missile Inventories," and B-17, "Average Missile Type Inventory,"
of NEI 17-02, Rev. 1. In accordance with NEI 17-02, Rev. 1 {Table 5-2), Grand Gulf has incorporated robustness values in EEFP calculations. As discussed in the October 24, 2018, supplement, the robustness values in NEI 17-02, Rev. 1, which were consistent with those in NEI 17-02, Rev. 1 B, were used. The NRC staff questioned how the licensee intended to adjust the number of missiles for robust targets to ensure that the contribution of each missile type to the overall missile population is representative of the contribution of each missile type to the overall missile population during future use. In the October 24, 2018, supplement, the licensee stated that for future use Grand Gulf will follow NEI 17-02, Rev. 1 B for adjusting the number of missiles for robust targets, using the generic values provided in Table 5-2.
The NRC staff concludes that the licensee's approach for adjusting the number of missiles for robust targets in the future by using the robust missile data in Table 5-2 of NEI 17-02, Rev. 1 B is acceptable for this application. It has been reviewed and determined to develop conservative robust missile adjustment factors. The NRC staff further concludes that additional comparison of site-specific missile type inventories is not necessary for this application.
Failure Modes As discussed above, Section 6.5, "Target Failures and Secondary Effects," of NEI 17-02, Rev. 1 B, was added to provide guidance on the consideration and treatment of additional tornado and tornado-missile-induced failure modes for all nonconforming SSCs in the TMRE PRA model. Guidance was provided on functional failures of SSCs as well as the impact of secondary effects. The NRC staff finds that the guidance in Section 6.5 of NEI 17-02, Rev. 1B, adequately captures the important tornado and tornado-missile-induced failure modes for SSCs as well as their treatment in the TMRE PRA model. The NRC staff further finds that the direct impact on exposed SSCs is the dominant failure mode for this application compared to more complex failure modes (e.g., spurious closure or opening).
The NRC staff questioned when and to what extent failure modes not previously included in the internal events system models should be considered. In its January 23, 2019, supplement, the licensee referred to an SNC response to a similar question to describe the failure modes of SSCs and how those failure modes were implemented in the licensee's TMRE PRA model. The licensee stated that new basic events and flags were added to the model to address all the failure modes of the safety-related and nonsafety-related system targets exposed to tornado missiles. The NRC staff finds that the licensee's approach for treating various failure modes of the SSCs in its TMRE PRA model is acceptable because it adequately identifies and considers failure modes for this application. The NRC staff notes that because of conservatisms in the TMRE methodology and the margin to acceptance guidelines, the failure modes could be limited to functional failures and secondary effects occurring from the direct impact of tornadoes and tornado missiles on exposed SSCs.
The TMRE guidance includes consideration of secondary failure modes in Section 3.2.3, "SSC Failure Modes." It states that flooding and combustion motor intake effects caused by tornado-missile failures of fluid-filled tanks and pipes should be considered as viable secondary failure modes considered in the development of the TMRE PRA. The NRC staff noted that the submittal did not sufficiently describe how secondary effects that may result from failure of nonconforming conditions were considered for.identification of the initiating events and failure modes in the licensee's TMRE development. As discussed in the licensee's supplement dated January 23, 2019, the licensee identified a secondary failure mode not previously considered (i.e., internal flooding event that could aUow water to enter the diesel generator rooms and ultimately fail the diesels) and included it in the TMRE PRA. The licensee also reviewed flow diversions not included in the internal events PRA and did not identify any for inclusion in TMRE PRA and determined, based on its review of secondary failure modes for tanks, that the emergency diesel generator fuel oil tank need not be included in the TMRE PRA. The results for the TMRE model with the inclusion of the secondary failure mode remained within the acceptance criteria of RG 1.17 4. The NRC staff's review of the licensee's approach for considering primary and secondary failure modes in the submittal and supplements finds it to be acceptable for this application because (1) it captures the most important secondary failure modes, (2) the licensee considered these secondary failure modes for SSCs in its TMRE PRA development, and (3) the licensee either included identified secondary failure modes in the TMRE PRA or dispositioned them appropriately.
The NRC staff also finds that the licensee's process for determination of the impact of tornado missiles on targets by determining EEFPs is acceptable (i.e., evaluating the risk associated with the lack of tornado-missile protection for nonconforming SSCs) because (1) the approach is consistent with the derivation of the MIP values and, therefore, uses the MIP values appropriately; (2) the approach to defining missile inventories based on a reference radius (2,500 ft.) or target area is consistent with the original analysis in EPRI NP 768; (3) adjusting inventories to account for robustness levels is adequately justified and an acceptable first order approximation in lieu of detailed fragility analyses for this application, as targets are expected to have different levels of resilience to missile hits; and (4) the approach to estimating exposed areas, in general, tends to overestimate the area in the path of missiles, therefore, it is appropriate for risk evaluations performed to support this application. The NRC staff's conclusion on acceptability of the using EEFPs in risk evaluations is limited only to address the tornado-missile protection nonconforming conditions within the scope of the TMRE methodology as described in other sections of this safety evaluation.
3.4 Risk Results Review 3.4.1 Key Principle 1: Compliance with Current Regulations As a key principle of risk-informed integrated decisionmaking, Regulatory Position 1 in RG 1.17 4, Rev. 2, states that the licensee should affirm that the proposed licensing basis change meets the current regulations unless the proposed change is explicitly related to a requested exemption (i.e., a specific exemption under 10 CFR 50.12).
The licensee stated in Section 4.1, "Applicable Regulatory Requirements/Criteria," of the enclosure to the submittal that RG 1.17 4 establishes criteria to quantify the "sufficiently small" frequency of damage discussed in SRP Section 3.5.1.4 that allows for a probabilistic basis for relaxation of deterministic criteria for tornado-missile protection of SSCs. However, the cited SRP sections discuss the probability of occurrence of events and not the change in core damage frequency (CDF) and large early release frequency (LERF). The probabilistic criteria in SRP Section 3.5.1.4 (i.e., the probability-of damage to unprotected safety-related features) is not directly comparable to RG 1.17 4 acceptance guidelines. Therefore, the NRC staff questioned how the proposed methodology will continue to provide reasonable assurance that the SSCs important to safety will continue to withstand the effects of missiles from tornadoes or other external events without loss of capability to perform their safety function. In the October 24, 2018, supplement, the licensee stated that the use of the TMRE methodology would not alter any input assumptions or the results of the accident analysis. The licensee further stated that the types of accidents, accident precursors, failure mechanisms, and accident initiators already evaluated in the UFSAR remained unaltered. The controlling numerical values for parameters in the UFSAR also remain unaltered. The licensee explained that the use of the methodology did not result or require any physical changes to the facility and, therefore, new types of malfunctions or accidents were not created. No change to the safety analysis acceptance criteria were proposed.
Based on its review of the submittals and supplements, the NRC staff finds that the proposed change continues to meet the regulations because the design basis for the SSCs impacted by the proposed change will reflect the importance of the safety functions to be performed by those SSCs in accordance with the GDC, and, therefore, there is reasonable assurance that, subsequent to the proposed change, necessary safety-related SSCs will continue to be available to perform their safety functions, as reflected in UFSAR Section 3.5, during and following a tornado event at Grand Gulf.
The NRC staff notes that exemption from the applicable regulations was neither requested by the licensee in the application, nor is*granted by the NRC staff. All applicable design requirements remain. Therefore, key principle 1 in risk-informed decisionmaking is satisfied.
3.4.2 Key Principle 2: Evaluation of Defense-in-Depth Defense-in-depth is an approach to designing and operating nuclear facilities involving multiple independent and redundant layers of defense to compensate for human and system failures.
Regulatory Position 2.1.1 in RG 1.17 4, Rev. 2, states that defense-in-depth consists of a number of elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:
A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation; Over-reliance on programmatic activities as compensatory measures associated with the change in the license basis is avoided; System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties; Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed; Independence of barriers is not degraded; Defenses against human errors are preserved; and The intent of the plant's design criteria is maintained.
In Section 3.2, "Traditional Engineering Considerations," of the enclosure to the submittal and the October 24, 2018, supplement, the licensee provided a discussion of how its risk-informed assessment was consistent with the philosophy of defense-in-depth. The following sections provide an evaluation of each of the seven considerations.
A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.
The proposed change does not introduce new accidents or transients as compared to those present in the licensee's internal events PRA and those analyzed during the safety analyses. In Section 3.2 the enclosure to the submittal, the licensee stated that there are five nonconforming conditions. Moreover, most of each system that is important to safety is protected from tornado missiles. The licensee also explained that no conditions were discovered within the scope of the proposed change that would affect containment integrity during a tornado event and that the containment would continue to provide its function as a key fission product barrier.
The NRC staff notes that none of the identified nonconforming conditions impacted by the proposed change only affects LERF, which is an indication that there was no significant impact on prevention of containment failure. As the proposed change does not significantly affect the availability and reliability of SSCs that mitigate accident conditions nor significantly reduce the effectiveness of the licensee's emergency preparedness program. Therefore, the NRG staff finds that the proposed change continues to preserve a reasonable balance between prevention of core damage, prevention of containment failure, and consequence mitigation.
Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.
The implementation of the proposed change does not require compensatory measures and does not change the licensee's existing operating procedures. The proposed change does not rely upon proceduralized operator actions within an hour of a tornado passing that would require operators to travel into areas that are not protected from the effects of the tornado or tornado missiles. In the January 23, 2019, supplement, the licensee stated that only one operator action was credited outside Category I structures and that action is not required in the first hour after the occurrence of the tornado event. The NRC staff notes that no new operator actions developed specifically in response to the proposed change were included in the licensee's risk assessment supporting the proposed change. Therefore, the NRC staff finds that the proposed change avoids an over-reliance on programmatic activities because the proposed change does not result in human actions or compensatory measures.
System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.
In Section 3.2 of the enclosure of the submittal, the licensee explained that the redundancy, independence, and diversity associated with the functions of the nonconforming SSCs are unchanged. The licensee further stated that the proposed change had no impact on the availability and reliability of SSCs that could either initiate or mitigate events, except for the tornado-missile protection of the identified nonconforming SSCs, which was evaluated in the application. The licensee further stated that the expected frequency of tornado strikes remains low. Additional equipment is available to mitigate the effect of tornado-missile impact, stored in protective structures. Based on the review of the submittal as well as the supplemental information, the NRC staff finds that system redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.
Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.
Tornado events and missiles generated by such events represent a common-cause initiating event, which can impact multiple SSCs. The licensee's risk assessment supporting the proposed change captures such impacts. In the submittal, the licensee explained that the nonconforming conditions included in the proposed change were spatially distributed about the licensee's site. Missiles affecting emergency diesel generators or emergency service water systems should not affect the alternate seal injection diesel, which is independent of the other two systems. Therefore, the NRC staff concludes that the licensee has adequately assessed the potential for the introduction of new common-cause failure mechanisms because the proposed change does not degrade defenses against potential common-cause failures and directly considers the impact of the common-cause initiator.
Independence of barriers is not degraded.
In Section 3.2 of the enclosure to the submittal, the licensee stated that neither the reactor fuel cladding nor the reactor coolant system pressure boundary is directly exposed to tornado missiles, and the containment structure is a robust tornado missile barrier. The NRC staff notes that the proposed change does not significantly increase the likelihood or consequence of an event that challenges multiple barriers, and does not introduce a new event, which would challenge multiple barriers. The NRC staff finds that the proposed change does not affect the independence of the fission product barriers and therefore, the independence of those barriers is not degraded.
Defenses against human errors are preserved.
In Section 3.2 of the enclosure to the submittal, the licensee stated that Grand Gulf has procedures that prescribe actions to be taken in the event of a tornado watch or tornado warning and after a tornado has passed. Abnormal and emergency procedures include alternative actions if equipment is damaged by tornadoes. The proposed changes do not appear to create new human actions that are important to preserving the layers of defense or significantly increase mental or physical demand on individuals responding to a tornado.
Therefore, the NRC staff concludes that the proposed change preserves defenses against human error and does not introduce new human error mechanisms.
The intent of the plant's design criteria is maintained.
In the enclosure to the submittal dated November 3, 2017, the licensee stated that the proposed change only affected a very small fraction of the potential target area of the system. The licensee explained that in lieu of protection for the identified nonconforming SSCs, it had analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequent effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact is known, and it was determined by the licensee to be negligible. The licensee concluded that the intent of the plant's design criteria is maintained. The licensee also stated that the methodology utilized to support the proposed change could not be used in the modification process for a future plant change to avoid providing tornado-missile protection. Therefore, the NRC staff finds that the intent of the plant's design criteria is maintained by the proposed change.
In summary, the NRC staff finds that the proposed change does not significantly affect the seven considerations for defense-in-depth and the proposed change preserves defense-in-depth commensurate with the expected frequency and consequence of challenges to the system resulting from the proposed change.
3.4.3 Key Principle 3: Evaluation of Safety Margins Regulatory Position 2.1.2 in RG 1.17 4, Rev. 2, discusses two specific criteria that should be addressed when considering the impact of the proposed changes on safety margin:
Codes and standards or their alternatives accepted for use by the NRC are met, and Safety analyses acceptance criteria in the [licensing basis] (e.g., [final safety analysis report] supporting analyses) are met, or the changes provides sufficient margin to account for analysis and data uncertainty.
Section 3.2 of the enclosure to the submittal dated November 3, 2017, discussed the impact of the proposed change on the safety margin. The licensee stated that consensus codes and standards (e.g., ASME, Institute of Electrical and Electronic Engineers (IEEE), or alternatives approved by the NRC) continue to be met and that the proposed change was not in conflict with approved codes and standards relevant to the SSCs impacted by the change. The NRC staff questioned how the licensee can conclude that the safety analysis acceptance criteria in the licensee's safety analysis were not impacted by the proposed change. In the enclosure to the submittal, the licensee stated that the safety analysis acceptance criteria were not impacted by the proposed change. The licensee stated that special considerations such as single-failure criteria were not considered. The submittal documents that only a very small fraction of available SSCs that could be used to accomplish the objective are not protected from the effects of tornado missiles, and the remaining unaffected components provide reasonable assurance the objective would be achieved. In the event exposed components of one train of safety-related equipment is affected by a tornado missile, there is reasonable assurance that opposite train equipment would be available to provide the safety function. Finally, the licensee stated that in addition to the equipment credited in the safety analysis described in the UFSAR, onsite and near-site FLEX equipment is expected to be available, which the licensee asserts should provide further assurance that the objective would be achieved.
The NRC staff concludes that the proposed change maintains sufficient safety margin because codes and standards or their alternatives accepted for use by the NRC will continue to be met and the safety analysis acceptance criteria remain unaffected by the proposed change.
3.4.4 Key Principle 4: Change in Risk Consistent with the Commission's Safety Goal Policy Statement 3.4.4.1 PRA Acceptability The objective of the PRA acceptability review is to determine whether the plant-specific PRA used in evaluating the submittal, as supplemented is of sufficient scope, level of detail, and technical elements for the application. The NRC staff evaluated the PRA acceptability information provided by the licensee in its tornado-missile risk evaluation submittal and supplements, including industry peer-review results against the criteria discussed in RG 1.200, Rev. 2.
3.4.4.2 Internal Events PRA Model For each supporting requirement (SR) in the ASME/ANS RA-Sa-2009 (2009 ASME/ANS Standard), there are three possible degrees of "satisfaction" referred to as capability categories (CC) (i.e., CC-I, CC-II, and CC-Ill), with CC-I being the minimum, CC-II considered widely acceptable, and CC-Ill indicating the maximum achievable level of detail, plant-specificity, and realism. For many SRs, the CCs are combined (e.g., the requirement for meeting CC-I is combined with CC-II) or the requirement is the same across all CCs so that the requirement is simply met or not met. For each SR, the peer review team designates one of the CCs or indicates that the SR is met or not met. According to Section 2.1, "Consensus PRA Standards,"
of RG 1.200, Rev. 2, CC-II is the level of detail that is adequate for the majority of risk-informed applications. Therefore, in general, a fact and observation (F&O) is written for any SR that is determined not to be met or does not fully satisfy CC-II of the ASME standard, consistent with RG 1.200, Rev. 2.
The NRC staff reviewed the results of the peer review process for the internal events PRA presented in the enclosure to the submittal. The licensee indicated that there are no upgrades to the internal events PRA that have not been peer reviewed and that a systematic review was performed of the SRs relative to the TMRE model development. The NRC staff finds that the internal events finding-level F&Os have been satisfactorily dispositioned in the context of this application or the F&Os do not significantly impact this application. Therefore, the NRC staff concludes that the disposition of the finding-level F&Os by the licensee either support the determination that the quantitative results are adequate for this application or have no significant impact on the TMRE PRA, and the changes made as part of the interim update do not impact the TMRE PRA. Based on its review of the submittal and supplemental information, the NRC staff also concludes that that the licensee has demonstrated that the internal events PRA meets the guidance in RG 1.200, Rev. 2, that it is reviewed against the applicable SRs in ASME/ANS-RA-Sa-2009. Therefore, the staff concludes that the internal events PRA model is technically acceptable for this application and, accordingly, the NRC staff finds that the licensee's internal events PRA model provides an adequate basis for the development of its TMRE PRA model.
3.4.4.3 Tornado-Missile PRA Model In addition to the internal events technical elements, the details of the conversion process from the internal events PRA to the TMRE PRA was reviewed to determine that it followed industry guidance in NEI 17-02, Rev. 1, and to determine whether the conversion process was acceptable for this application.
Appendix D, "Technical Bases for TMRE Methodology," to NEI 17-02, Rev. 1, includes SRs at CC-II from Part 2 (internal events PRA) of the 2009 AS ME/ANS Standard that have been selected specifically by the NRC staff for the application of the TMRE PRA model in assessing tornado-missile protection nonconformance risk. The selected SRs required specific consideration during the development of the TMRE model from the internal events model. The licensee listed its conformance with the SRs in Appendix D of NEI 17-02, Rev. 1, in Table 1 of
- Attachment 2 of the enclosure to the submittal. The NRC staff finds that the licensee has conformed to the above-mentioned SRs, because it has adequately considered them in the development of the TMRE PRA model from the internal events model.
The licensee, in Section 3.3.6, "Model Development," in the enclosure to the submittal indicates that the Grand Gulf internal events model reflects a LOOP, station blackout, consequential steam line break, and a consequential LOCA. The licensee used the LOOP portion of its internal events PRA as the basis for its TMRE PRA. The tornado-initiating events were added by modifying the initiating event frequency and the equipment vulnerable to tornado missiles were added to reflect the EEFPs. In the October 24, 2018, supplement, the licensee provided the results of a review of each initiating event in its internal events PRA to determine which could be caused by a tornado or susceptible to tornado induced initiation. The review determined that the LOOP and station blackout accident sequences adequately represented the plant response to a tornado. The licensee also provided details of its identification or disposition of vulnerabilities to tornado-generated missiles from reviews of relevant procedures. Identified vulnerabilities were captured in the TMRE PRA. The NRC staff's reviewed the licensee's approach for developing the TMRE PRA model and finds that the approach is acceptable for this application because it ( 1) appropriately considers the most likely impact of a tornado event on the plant via the assumption of LOOP, (2) appropriately does not credit recovery of off-site power, which is supported by insights from operating experience related to LOOP events after a tornado event, and (3) ensures that initiating events caused by a tornado event other than LOOP are considered and, as applicable, represented in the TMRE PRA model. Consequently, the staff finds screening SSCs that are dependent on the offsite power to be acceptable for this application.
Section 3.3.2, "Assessment of Assumptions and Approximations," of RG 1.200, Rev. 2, states that for each application that calls upon the guide, the applicant identifies the key assumptions and approximations relevant to that application. Those assumptions and approximation were used to identify sensitivity studies as input to the decisionmaking associated with the application. RG 1.200, Rev. 2, defines the terms "key assumption" and "key source of uncertainty" in the same section of the guidance. In the January 23, 2019, supplement, the licensee described the key assumptions and approximations for this application and provided a disposition for each in the context of this application. The NRC staff concludes the licensee has identified key assumptions and sources of uncertainty consistent with the guidance in RG 1.200, Rev. 2, and has adequately addressed them for this application demonstrating that those assumptions either do not impact the decision or are addressed via the sensitivity analyses in the TMRE methodology.
As a result of its review of the submittal, as supplemented, the NRC staff concludes that the Grand Gulf TMRE PRA is acceptable for this application because (1) the internal events model which is the base for the TMRE PRA is technically acceptable, (2) the licensee has appropriately considered specific SRs that were identified as being important to the TMRE PRA development, and (3) the licensee has appropriately identified key assumptions and sources of uncertainty and has adequately dispositioned them for this application. Therefore, quantitative results obtained from the Grand Gulf TMRE PRA model along with appropriate sensitivity studies can be used to demonstrate that the incremental risk due to the SSCs that are unprotected from tornado-generated missiles per the licensee's current licensing basis meets the acceptance guidelines in RG 1.17 4, Rev. 2.
3.4.4.4 Comparison Against Acceptance Guidelines Including Uncertainty and Sensitivity Analyses Compliant and Degraded Cases Section 6.3, "Compliant Case and Degraded Case," in NEI 17-02, Rev. 1 provides the guidance for creating two configurations, referred to as compliant and degraded cases, which were to be used to evaluate the change in risk associated with not providing tornado-missile protection for the nonconforming SSCs. As described in Section 6.3 of NEI 17-02, Rev. 1:
The compliant case represented the plant in full compliance with its tornado-missile protection current licensing basis. Therefore, all nonconforming SSCs that were required to be protected against missiles were assumed to be so protected, even when reality determined the SSCs were not protected. In the compliant case, nonconforming
- SSCs were assumed to have no additional failure modes beyond those normally considered in the internal events PRA; and The degraded case represented the current configuration of the plant (i.e., configuration
- with nonconforming conditions with respect to the tornado-missile protection current licensing basis). As such, the TMRE PRA model would include additional tornado-induced failure modes for all nonconforming SSCs. The failure probabilities for those additional tornado-induced failure modes were based on EEFP calculations.
Therefore, the primary difference between the compliant and degraded cases is the treatment of the nonconforming SSCs. The NRC staff finds that the licensee's approach as discussed in NEI 17-02, Rev. 1 for creating compliant and degraded cases is acceptable because this approach appropriately modifies the failure probabilities of affected SSCs for estimating the risk associated with the proposed change.
Section 3.3.5, "Target Evaluation," and Table 3.3.5 1, "EEFP Calculation," of the enclosure to the submittal described the EEFP determined and used for vulnerable SSCs for both compliant and degraded cases. These EEFP values are listed in Table 3.3.5 of Attachment 1 to the enclosure. The submittal identified SSCs for which EEFPs were not calculated individually, but the components were included as a portion of a larger correlated target. The NRC staff finds the licensee's approach for developing compliant and degraded cases acceptable, because it appropriately modifies the failure probabilities of affected SSCs associated with the proposed change and captures the residual risk from the nonconforming conditions and vulnerabilities as well as the change in risk from the identified nonconforming conditions.
Furthermore, in response to additional NRC staff concerns related to ensuring conservative modeling treatments in the complaint case do not affect the risk assessment conclusions, the licensee explained that any future sensitivity analysis would address the conservativism associated with modeling equipment failures in the compliant case. The licensee stated that the evaluation of compliant-case conservatisms was limited to the assumption that failure probabilities of certain SSCs (e.g., exposed nonsafety-related components) were set to 1.0.
Similarly, the licensee considered the assumption that offsite power was lost and not recovered following a tornado event to be reasonable, which was consistent with current high wind PRA practices. In addition, the assumption that certain operator actions within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the event were assumed to fail was considered to be a reasonable assumption for tornado events and therefore, not a compliant-case conservatism. The NRC staff concludes that sensitivity analyses related to potential conservatisms by assuming failure of operator actions within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of tornado events nonrecovery of offsite power are not needed because those assumptions are reasonable for this application.
Section 7.2.3, "Compliant Case Conservatisms," of NEI 17-02, Rev. 1, provides guidance for performing sensitivities to address the impact of potential compliant-case conservatisms. This section states that the licensee would identify conservatisms related to equipment failures only.
The guidance further states that sensitivity analyses will be performed to address supporting requirements (SRs) identified in Appendix D, "Technical Basis for TMRE Methodology," of NEI 17-02, Rev. 1. The licensee stated that it would follow NEI 17-02, Rev. 1 for addressing compliant-case conservatisms. Because the licensee's approach addresses relevant SRs in the NRG-endorsed PRA Standard for performing this sensitivity analysis, the NRC staff concludes that the licensee's approach for considering conservatism associated with modeling equipment failures in future implementation of the TMRE methodology acceptable.
Comparison of PRA Results with Acceptance Guidelines The. licensee presented the change in risk between the degraded case (i.e., current plant) in which nonconforming SSCs are modeled as vulnerable to a tornado missile and the compliant plant case in which the plant is in full compliance with its design-basis tornado generated missile protection requirements. The approach for calculation of the change in risk captures the incremental risk from leaving the nonconforming SSCs unprotected (i.e. in the current as is condition). The licensee presented revised quantification results from its TMRE PRA in the October 24, 2018, supplement. Based on the information iri that supplement, the compliant case CDF and LERF were 5.67 x 10-7/year and 7.54 x 10-9/year, respectively. The corresponding metrics for the degraded case were 7.02 x 10-1/year and 8.79 x 10-8/year, respectively. Consequently, the licensee reported the change in risk from the tornado missile nonconformances as 1.35 x 10-1/year for CDF and 1.25 x 1 o-9/year for LERF. Those results meet the guidelines for "very small" change in risk in RG 1.17 4, Rev. 2 (i.e., Region Ill). Per the guidance in RG 1.17 4, Rev. 2, the total base CDF and LERF need not be reported for "very small" increases in risk.
Uncertainty and Sensitivity Analyses Regulatory Position 2 in RG 1.17 4, Rev. 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings. Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations. The NRC staff had a variety of concerns regarding uncertainty and the conservatism of some parts of the methodology. Those concerns and the licensee's resolution were reviewed by the NRC staff.
Section 7.2, "Sensitivity Analysis," of NEI 17-02, Rev. 1, identifies certain sensitivity studies and provided guidance on their performance. In Section 3.3.10, "Sensitivities and Uncertainties," of the enclosure to the submittal, the licensee evaluated the impact of conservatism in the assumptions in the compliant case on the change in risk quantification. The sensitivity to address the impact of conservatism in the compliant case used a bounding approach that set the results of the compliant case to zero, which resulted in the change in risk being equal to the quantified risk of the degraded case. The licensee demonstrated that the change in risk between the degraded case and the compliant plant case for that sensitivity case was within the thresholds for "very small" change per the acceptance guidelines in RG 1.17 4, Rev. 2.
The NRC staff questioned how uncertainties associated with the impact of the missile distribution on the licensee's target hit probability are handled. In the January 23, 2019, supplement, the licensee stated that the sensitivity to address the uncertainties associated with the impact of missile distribution on the MIP values was updated. In the updated approach, the basic event failure probabilities of SSCs with a tornado.missile failure basic event Risk Achievement Worth (RAW) importance measure greater than 2 would be multiplied by 2. 75 for tornado categories F'4, F'S, and F'6. In addition, an MIP multiplier, to determine a target-specific MIP, would also be calculated if a large number of missiles were close to such targets.
The licensee revised the definition of a large number of missiles as greater than 1,100 missiles within 100 ft. of the target in NEI 17-02, Rev. 1 B. According to Section A 7.6, "Target Specific MIP Calculations," of NEI 17-02, Rev. 1 B, the ~election of 100 ft. as the region of consideration is based on judgement and choice of 1,100 missiles was based on an approximate missile density of 2. 75 times the average missile density based on 240,000 missiles, the generic total number of missiles used in TMRE, within a 2,500 ft. radius. Section 7.2.1, "TMRE Missile Distribution Sensitivity," of NEI 17-02, Rev. 1 B, provides the method for calculating the target-specific MIP. The licensee stated that the reason for introducing the consideration of nearby missiles was that the risk associated with a highly exposed and risk-significant target with a large concentration of nearby missiles may be underestimated using the multiplier of 2.75. The sensitivity would be performed by applying either the generic MIP multiplier of 2.75 or the target-specific MIP multiplier to the appropriate basic events, recalculating the delta-CDF and delta-LE RF, and comparing the results to the RG 1.17 4 acceptance criteria.
The NRC staff finds that the approach to calculating the thresholds for the large number of missiles and the proximity to SSCs to be acceptable for this application, because an assessment of EPRI NP-768 data by the NRC staff shows that the most missile impacts comes from missiles that are within 100 ft. of a target. Therefore, the NRC staff concludes that the licensee's revised approach to perform the sensitivity to address the uncertainties associated with the impact of missile distribution on the MIP values is acceptable because it accounts for plant-specific variations in missile populations in the vicinity of SSCs..
In the January 23, 2019, supplement, the licensee stated that in the future, uncertainties associated with the missile distribution will be captured in accordance with the licensee's approved TMRE methodology consistent with any terms and conditions established in the NRC's safety evaluation. The NRC staff finds that the licensee's approach is acceptable for this application because it should ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This should ensure that the conclusions that have been drawn from the evaluation remain valid and the need for prior NRC approval is properly assessed.
The NRC staff notes that Section 7.2.1 of NEI 17-02, Rev. 1 B, includes "considerations" that could be used to justify not applying a higher target-specific MIP and provides two specific examples. The licensee has not used such considerations, including the examples in Section 7.2.1 of NEI 17-02, Rev. 1 Band, therefore, the NRC staff has not reviewed the acceptability of the "considerations" for application in the TMRE methodology for Grand Gulf.
The NRC staff questioned how the importance measures are determined from the TMRE PRA model in the context of the 'binning' approach for the tornado categories employed in the model.
In the January 23, 2019, supplement, the licensee's approach, described in Section 7.2.1 of NEI 17-02, Rev. 1 B, determines the cumulative RAW of an SSC for the F'4 through F'6 tornado intensities, but does not consider the RAW importance of that SSC from the F'2 and F'3 intensities.
Section 7.2.1 of NEI 17-02, Rev. 1 B excludes the RAW importance of SSCs from the F'2 and F'3 intensities in the determination of risk-significant SSCs for the sensitivity analyses. The licensee's responses did not address the NRC staff's concern on the impact of the exclusion of RAW importance of SSCs from the F'2 and F'3 intensities. The NRC staff's concern was that excluding the RAW importance of SSCs from the F'2 and F'3 intensities could result in potentially overlooking some risk-significant SSCs from consideration in the sensitivity analyses.
In the January 23, 2019, supplement, the licensee stated that the.F'2 and F'3 tornado intensities were unaffected by the sensitivity calculation. The NRC staff finds the aggregation approach used in NEI 17-02, Rev. 1 B to combine the RAW importance from F'4 to F'6 is conservative because it accounts for cumulative importance of SSCs from those intensities. In addition, NEI 17-02, Rev. 1 B states that sensitivity analyses are performed for any of the SSC with RAW greater than or equal 2 for F'4 to F'6. Therefore, excluding the RAW importance of SSCs from the F'2 and F'3 intensities is not expected to potentially overlook risk significant SSCs from consideration in the sensitivity analyses. The NRC staff finds that performing the sensitivity for the F'4 through F'6 tornado categories is appropriate because of the higher likelihood of failure of SSCs at those categories.
Since the Grand Gulf TMRE results exceeded the screening criteria of NEI 17-02, Rev. 1, sensitivity analyses from NEI 17-02, Rev. 18 were performed. In the January 23, 2019, supplement, the licensee provided the results from the missile distribution sensitivity and demonstrated that the change in risk for that sensitivity case was within the thresholds for "very small" change per the acceptance guidelines in RG 1.17 4, Rev. 2. The NRC staff finds that the licensee performed the TMRE missile distribution sensitivity b.ased on the guidance in Section 7.2.1 of NEI 17-02, Rev. 1 Band identified the SSCs included in that sensitivity consistent with the guidance in NEI 17-02. Rev. 1 B. The guidance on performing the sensitivity was found to be acceptable as discussed in the previous paragraph.
The NRC staff questioned the key difference between the two TMRE sensitivities to be performed per Section 7.2.1.A, "Zonal vs. Uniform Missile Distribution," and Section 7.2.1.B, "Missile Impact Parameter," in NEI 17-02, Rev. 1. In the January 23, 2019, supplement, the licensee indicated that the key difference between the two TMRE sensitivities to be performed per NEI 17-02, Rev. 1, Sections 7.2.1.A and 7.2.1.B, the "Zonal versus Uniform Missile Distribution" and the "Missile Impact Parameter sensitivity is that the "Missile Impact Parameter sensitivity focused on SSCs that are "highly exposed." The revised sensitivity approach for the "Zonal vs. Uniform Missile Distribution," in Section 7.2.1 of NEI 17-02, Rev. 1 B, included the criteria for the "highly exposed" SSCs thereby obviating the need for aggregating the two sensitivities. The NRC staff concludes that the licensee's approach for the "Zonal versus Uniform Missile Distribution," captures the uncertainty associated with the MIP values for "highly exposed" SSCs and, therefore, a separate sensitivity for that parameter is not required for this application.
The NRC staff questioned the licensee about its process if change-in-risk estimates from sensitivity analyses exceed the RG 1.17 4 acceptance guidelines for "very small" change in risk in future implementation of its TMRE methodology. In the January 23, 2019, supplement, the licensee stated that NEI 17-02, Rev. 1 was revised in NEI 17-02, Rev. 1B. If results of a sensitivity study exceed the acceptance guidelines of RG 1.17 4, Rev. 2, for "very small" change in risk, prior NRC approval would be required if the licensee could not reduce the change in risk with refinements to the supporting analysis. According to Section 7.3, "Comparison to Risk Metric Thresholds," of NEI 17-02, Rev. 1 B, the TMRE analysis inputs may be refined within the scope of the TMRE methodology in cases where the "very small" change acceptance guidelines in RG 1.174, Rev. 2, were exceeded. The NRC staff questioned the approach Grand Gulf would take if performance-monitoring programs indicate that the risk acceptance guidelines for "very small" change-in-risk in RG 1.174, Rev. 2, are exceeded. In the October 24, 2018, supplement, the changes to Section 8 of the NEI guidance reflect that if the thresholds of delta-GDF of 10-6/year or delta-LERF of 10-1/year are exceeded based on an updated TMRE analysis, then the planned plant modification cannot be made without pursuing additional actions (e.g., design change reducing delta-CDF/LERF below the risk acceptance guidelines, NRC prior approval through a license amendment request). The NRC staff finds the licensee's approach acceptable because (1) it relies on refinements that are within the scope of the TMRE methodology as well as the licensee's PRA model configuration control process, and (2) the revised guidance that will be followed by the licensee will require prior NRC staff approval for cases where the refinements are not sufficient to meet the acceptance guidelines of RG 1.17 4.
In Section 3.3.6, "Model Development", of the enclosure to the submittal, the licensee indicated that the current base model was used to determine the compliant and degraded cases.
Section 6.1, "Event Tree/Fault Tree Selection," of the TMRE methodology assumes that the tornado-induced LOOP cannot be recovered. This assumption indicates that offsite power remains unavailable following the event for the duration of the PRA mission time considered for this application. Furthermore, Section 3.1, "Vulnerable SSC Walkdown Preparation," of the TMRE methodology states that SSCs that were dependent on offsite power were screened from HWEL, because of the nonrecoverable LOOP assumption in the TMRE methodology. The NRC staff determined that assumption of a nonrecoverable LOOP may result in nonconservative change-in-risk evaluation. In the January 23, 2019, supplement, the licensee provided the results of a bounding sensitivity assessment that was performed to ensure conservative modeling treatments in the compliant case did not affect the risk assessment conclusions. The licensee's bounding sensitivity was performed by setting the risk from the compliant case to zero. The results of the sensitivity demonstrated that the change in risk for that sensitivity case was within the thresholds for "very small" change per the acceptance guidelines in RG 1.17 4, Revision 2. The NRC staff finds that the sensitivity analysis performed by the licensee in the January 23, 2019, supplement, bounds the potential nonconservatisms associated with the assumption of nonrecoverable LOOP. Furthermore, Section A.2.1.1, "Non-recoverable Loss of Offsite Power (LOOP) Assumption," in NEI 17-02, Rev. 1, discusses the basis for the assumption of nonrecovery. This section states that the assumption is consistent with current high winds PRA models. The NRC staff finds the assumption of non recovery of the offsite power acceptable for this application because of insights from operating experience related to LOOP events caused by tornadoes and high winds. Therefore, screening SSCs that are dependent on the offsite power is acceptable for the licensee's TMRE methodology.
Sections 3.3, "Ex-Control Room Action Feasibility," and 6.4, "Impacts on Operator Action Human Error Probabilities," of NEI 17-02, Rev. 1B, provides guidance on modeling human error probabilities (HEPs) in the TMRE PRA model. The guidance stated that no credit for operator action should be taken for actions performed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of a tornado event outside a Category I structure or which required the operator to transit outside a Category I structure to get to the location to perform the action. The guidance further states that operator actiqns after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> could be impacted by such environmental conditions as debris that blocks access paths and should be considered by taking into account whether equipment will be accessible and whether the time required to perform the action will be impacted. Section 3.3 of the guidance states that the results of the operator interviews and the walkdown notes should be reviewed by a human reliability analyst. Finally, Section 6.4 of the guidance states that the feasibility of actions involving transit or operation outside Category I structures more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the tornado event should be assessed and documented. The NRC staff finds that the operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> outside Category I structures should be evaluated to consider the effect of timing and environmental impacts on HEPs consistent with the relevant SRs in the NRG-endorsed PRA Standard. Section A.2.1.2, "Impact on Operator Actions," of NEI 17-02, Rev. 1 B, provides considerations for not changing the HEP of actions involving transit or operation outside Category I structures more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the tornado event. Those consideration appear to negate the need to consider the effect of timing and environmental impacts on HEPs. The NRC staff finds that actions involving transit or operation outside Category I structures more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the tornado event should be evaluated to consider the effect timing and environmental impacts on the HEPs consistent with RG 1.200.
Section 3.3.1, "High Winds Equipment List," of the enclosure to the submittal states that the operator actions were assessed based on the TMRE methodology and that the internal events PRA were used to perform the assessment of operator actions. The NRC staff was concerned with those measure needed to ensure that environmental conditions would not affect operator action that are credited after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. In the January 23, 2019, supplement, the licensee stated only one operator action performed outside Category I structures was credited. The credited operator action was related to aligning the firewater pathway. As the licensee assumes this action fails in the analysis, the NRC staff finds the licensee's approach for assessing the effect of environmental factors after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of a tornado on operator actions involving transit or operation outside Category I structures acceptable for this application, because the licensee did not take credit for such actions in this application.
The sensitivities performed by the licensee demonstrate that the incremental risk from not protecting the nonconforming SSCs against tornado-missile damage continues to remain "very small" per the acceptance guidelines in RG 1.174, Rev. 2. Therefore, the NRC staff finds that the results are robust relative to the uncertainties involved because sensitivity studies have demonstrated that the NRC staff's decision would not be changed due to the uncertainties.
Based on the results from the base and sensitivity cases using the TMRE PRA, principle 4 of risk-informed decisionmaking is met.
3.4.5 Key Principle 5: Performance Measurement Strategies - Implementation and Monitoring Program Regulatory Position 3 in RG 1.17 4, Rev. 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies.
This regulatory position further states that an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This will ensure that the conclusions that have been drawn from the evaluation remain valid.
In Attachment 2, "Probabilistic Risk Assessment Technical Adequacy Documentation," of the enclosure to the submittal, the licensee stated that it had administrative controls in place to ensure that the PRA models support the application and reflect the as-built, as-operated plant over time. The process includes provisions for monitoring issues affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience), for assessing the risk effect of unincorporated changes, and for controlling the model and associated computer files.
The NRC staff finds that changes over time to the plant and to the PRA can potentially affect the
. conclusions of risk-informed applications even though the PRA quality and level of detail has been shown to be adequate. As described in the submittal, the licensee has administrative controls in place to ensure that the PRA models support the application and reflect the as-built, as-operated plant over time. The process includes provisions for monitoring issues affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience), for assessing the risk effect of unincorporated changes, and for controlling the model and associated computer files. The process also includes reevaluating the tornado-missile risk of nonconforming SSCs previously calculated to ensure the continued validity of the results.
Section 8.1, "Plant Configuration Changes," of NEI 17-02, Rev. 1 B, states that design control programs meeting 10 CFR Part 50 Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," will ensure subsequent plant configuration changes were evaluated for their impact on nonconforming SSC risk using TMRE. Section 8.1 also states that licensees should ensure that they have sufficient mechanisms to assure that plant changes that increase the site missile "burden" are evaluated for impact to the TMRE analysis results.
Section 4.1, "Applicable Regulatory Requirements/Criteria," of the enclosure to the submittal states that the licensee has confirmed that the risk-informed change process assures that any significant permanent changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site design control program.
The NRC staff questioned the mechanism(s) and approach(es) that would be followed by the licensee to determine whether a particular change to the facility is "significant" for evaluation of the impact to the TMRE basis. In the October 24, 2018, supplement, the licensee stated that changes that have the potential to increase the missile count above that considered in the current TMRE analysis are considered significant. The licensee also stated that such changes would be managed consistent with Section 8, "Performance Monitoring," in NEI 17-02, Rev. 1 B, which included clarifications to NEI 17-02, Rev. 1, in several parts of that section. The clarifications to Section 8 in NEI 17-02, Rev. 1 B, state that the licensee will ensure, via applicable station procedures and processes, that plant changes that result in an increase to the site missile burden are evaluated for impact on the TMRE analysis results. Further, permanent changes within the 2500 ft. missile radius that increase the site missile burden beyond that used for the TMRE analysis shall be incorporated into the TMRE analysis prior to making the permanent change. In addition, Section 8.1, "Plant Configuration Changes," clarified that changes to previous nonconforming SSCs that would increase the target EEFP (e.g., affect the target exposed area by increasing the exposed exhaust pipe height, affect a robust missile percentage by changing the pipe material or thickness) were not allowed under TMRE.
The NRC staff questioned the mechanisms in place to ensure temporary and permanent changes to site missile sources will be evaluated. In the October 24, 2018, supplement, the licensee explained that its engineering procedures contain screening criteria to notify its PRA organization if a proposed change has the potential to affect any tornado-generated missile protection feature or create a source of tornado-generated missiles not bounded by existing analysis. The licensee indicated that upon notification of a change that may introduce the possibility of a new source of tornado-generated missiles that are not bounded by the existing analyses, the licensee's PRA organization will manage the change in accordance with licensee's approved TMRE methodology, which requires prior NRC approval to be sought should certain thresholds be exceeded. The NRC staff finds the licensee's procedures for determining significant changes and assuring temporary as well as permanent changes are evaluated to be acceptable because the licensee's relevant procedures and its TMRE methodology will be able to identify such changes and evaluate their impact.
Section 8.1, "Plant Configuration Changes," in NEI 17-02, Rev. 1 B, states that in case the TMRE analysis needs to be updated the most recent internal events model would be used for the analysis and the most recent revision of NUREG/CR-4461 would be used for the tornado-initiating event frequencies. The NRC staff questioned the process(s) intended to ensure changes that could affect Grand Gulf TMRE results (e.g., plant design changes, changes made to the licensee's base internal events PRA model, and new information about the tornado hazard at the plant) were considered in future implementation of the licensee's TMRE. In the October 24, 2018, supplement, the licensee stated that changes that could affect its TMRE results (e.g., plant design changes, changes made to the licensee's base internal events PRA model, and new information about the tornado hazard at the plant) would be considered in future implementation of the licensee's TMRE in accordance with the guidance in NEI 17-02, Rev. 1 B. The NRC staff finds that the relevant guidance found in Section 8.1 of NEI 17-02, Rev. 1 B is acceptable because it results in the most recent internal events PRA model and site-specific tornado hazard information being used for future TMRE analysis updates. The NRC staff also finds the licensee's approach to be acceptable because it follows the guidance for considering the changes to the internal events PRA model and the site-specific tornado hazard.
The NRC staff questioned the licensee about the treatment of the currently identified nonconforming conditions in future uses of the licensee's TMRE PRA model. In the October 24, 2018, supplement, the licensee indicated that targets treated as nonconforming in the initial application of the TMRE would continue to be considered nonconforming in future revisions of the TMRE model by the licensee. Exceptions to this approach may be taken where the targets:
Have been physically protected in such a way that they would no longer be considered nonconforming at the time of the revision and can be removed from the TMRE analysis; or Would not otherwise be considered nonconforming at the time of the revision because engineering calculations have demonstrated that they are conforming.
Section 8.1 of NEI 17-02, Rev. 1 B, includes the above-mentioned approaches for possible exceptions from considering targets that were treated as nonconforming in the initial application of the TMRE as nonconforming in future revisions of the TMRE model. The NRC staff finds the licensee's treatment of nonconforming SSCs in the initial application of the TMRE as nonconforming in future revisions of the TMRE model to be acceptable because it continues to capture the incremental risk from those SSCs, which will be non protected due to the use of the TMRE methodology. The NRC also staff finds the exceptions in Section 8.1 of NEI 17-02, Rev. 1 B, to be acceptable because they represent appropriate approaches to negate the previously identified nonconformance of an SSC. The NRC staff notes that the engineering calculations to demonstrate conformance of a previously nonconforming SSC must be consistent with the licensee's current licensing basis and regulations governing the extent of changes to the licensing bases independent of NRC staff approval (e.g., 10 CFR 50.59 or other applicable 10 CFR change processes).
Additionally, the NRC staff questioned how the cumulative risk associated with unprotected SSCs evaluated under TMRE will be considered in future decisionmaking (e.g., 10 CFR 50.59 criteria as well as in future risk-informed submittals ). In the October 24, 2018, supplement, the licensee indicated that Section 8.3 of NEI 17-02, Rev. 1 was revised to clarify how the risk associated with unprotected SSCs evaluated under TMRE would be considered in future decisionmaking (e.g., 10 CFR 50.59 criteria as well as in future risk-informed submittals). The revised version of Section 8.3 in NEI 17-02, Rev. 1 B, includes a statement that licensees may need to consider, as appropriate, the risk associated with previous nonconforming conditions that remain unprotected against tornado missile impacts in future risk-informed decisionmaking activities. The NRC staff concludes that the licensee's approach for considering the risk from previous nonconforming conditions in future decisionmaking to be acceptable because it allows NRC staff review of the impact of the risk from previous nonconforming conditions on the cumulative plant risk in the context of individual applications.
The licensee described its approach if performance-monitoring programs indicated that the risk acceptance guidelines for "very small" change in risk in RG 1.17 4, Rev. 2, were exceeded in the October 24, 2018, supplement. The licensee's response and the corresponding NRC staff findings are discussed above.
The NRC staff concludes that the cumulative risk associated with previous nonconforming conditions that remain unprotected against tornado missile need to be considered in future decisionmaking based on an application-specific review and decision by the NRC staff. Further, the NRC staff concludes that the licensee's PRA maintenance program and monitoring program is sufficient to track the as-built, as-operated condition of the plant and the performance of equipment that when degraded can affect the conclusions of the licensee's risk evaluation and integrated decisionmaking that support the change to the licensing basis. The NRC staff notes that the TMRE must not be used for nonconforming conditions created as a result of future modifications without separate review and approval by NRC.
3.5 Methodology Conclusion The NRC staff has reviewed the licensee's evaluation of the risk from tornado missiles to identified nonconforming SSCs. The licensee's process is consistent with the guidance in NEI 17-02, Rev. 1, as updated in NEI 17-02, Rev. 18. The licensee's results for tornado-missile risk from nonconforming SSCs meets the risk acceptance guidelines of RG 1.17 4. The NRC staff finds the SSCs that do not conform to the tornado-missile protection licensing can remain in as-built conditions. Specifically, the NRC staff has found that the licensee's risk evaluation -
Is based on an acceptable internal events PRA which has been subjected to a peer review process assessed against the PRA standard and is based on a TMRE PRA that has been acceptably developed; Determines tornado-missile risk of nonconforming SSCs that results in an integrated, systematic process that reasonably reflects the current plant configuration and operating practices, and applicable plant and industry operational experience; Maintains defense-in-depth and safety margin; Includes evaluations that provide reasonable confidence that the risk of nonconforming tornado-missile protection is maintained and that any potential increases in CDF and LERF resulting from uncertainty in treatment are small; and Includes provisions for future sensitivity studies and the periodic reviews of the tornado-missile risk of nonconforming SSCs to ensure the risk remains acceptably low.
Therefore, the NRC staff concludes that the licensee's process and evaluation demonstrate that the tornado-missile risk from nonconforming SSCs is acceptably low as it meets the risk acceptance guidelines of RG 1.17 4. The licensee's results for tornado-missile risk comes from nonconforming SSCs.
3.6 Deviations from the TMRE Methodology The NRC staff found that the licensee's implementation of the methodology presented in NEI 17-02, Rev. 1, as updated in supplements dated October 24, 2018, and January 23, 2019, was acceptable for use to support the determination of the risk from not providing physical tornado-missile protection to legacy nonconforming SSCs (i.e., SSCs that should have such protection according to the plant-specific licensing basis but, in reality, do not). Several issues were raised, which were addressed acceptably by the licensee for this application but resulted in deviations from the guidance cited by the licensee as its methodology. The NRC staff notes that the licensee's approaches in addressing the following issues, which constitute deviations from the corresponding approaches in the TMRE methodology guidance, were important to the NRC staff's safety decision for this application and apply to the future use of the TMRE methodology at Grand Gulf. Specifically, NEI 17-02, Rev. 18, Section 7.2.1, provided qualitative "considerations" and two examples of situations where qualitative factors could preclude the need to apply a higher target-specific MIP. As the licensee did not use those "considerations," the NRC staff did not review the acceptability of those factors as part of this application. Therefore, use of the qualitative "considerations" and examples is not considered as part of the TMRE approval for Grand Gulf.
In addition, the licensee did not take any credit for operator actions outside Category I structures after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of a tornado event. The NRC staff notes that the licensee's use of the guidance in Section 3.3 of NEI 17-02, Rev. 1 B for crediting operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in non-Category I structures in its TMRE, those actions should be evaluated to consider the effect of timing and environmental impacts on HEPs consistent with the relevant SRs in the NRG-endorsed PRA standard.
3.7 Scope and Limitations of Application of the TMRE Methodology The methodology can only be applied to discovered conditions where tornado-missile protection was not provided. The methodology cannot be used either to remove existing tornado-missile protection or to avoid providing tornado-missile protection in the plant modification process.
Section 3.4, "Technical Evaluation Conclusions," of the enclosure to the November 3, 2017 submittal states that the TMRE methodology could be used to resolve those nonconforming conditions by revising the current licensing basis under 10 CFR 50.59, "Changes, tests and experiments," provided the acceptance criteria are satisfied and conditions stipulated by the NRC staff in the safety evaluation approving the requested amendment are met. The methodology would only be applied when legacy conditions are discovered where tornado-missile protection was required and not provided. It cannot be used to avoid providing tornado-missile protection in the plant modification process. Therefore, future changes to the facility requiring physical tornado-missile protection must not be evaluated using the TMRE methodology.
The licensee will need prior NRC approval should the delta-GDF or delta-LERF values during subsequent implementation by the licensee for legacy nonconforming SSCs, or any of the required sensitivity studies in NEI 17-02, Rev. 1 B exceed the acceptance guidelines for Region Ill ("very small change") of RG 1.17 4, if the apparent change in risk cannot be reduced with refinements within the scope of the licensee's approved TMRE methodology.
The NRC staff notes that all proposed changes not within the scope of this plant-specific approved methodology as described in this safety evaluation are expected to be reviewed consistent with the criteria in 10 CFR 50.59, another governing change process identified in 1 O CFR or the licensee's licensing basis. Legacy nonconforming conditions within the scope of this approval are allowed to be evaluated using the licensee's TMRE methodology and should the results meet the defined TMRE acceptance criteria, additional prior NRC approval is not required to be sought. However, such changes are still required to be reported under the appropriate reporting requirements in accordance with the applicable sections of 10 CFR 50.
Additionally, it should be noted that the review of NEI 17-02, Rev. 1, reflects a review by the NRC staff of the applicability to and implementation of TMRE methodology for Grand Gulf, Unit 1, only.
3.8 Technical Conclusion Based on its review summarized in this safety evaluation, the NRC staff finds the SSCs identified in the submittal, which do not currently conform to the tornado-missile protection licensing basis, can remain in as-built conditions. The licensee has demonstrated that these nonconforming conditions should not prevent the availability of necessary SSCs to mitigate the potential effects of extreme winds and missiles associated with such winds on plant SSCs.
Further, the licensee has demonstrated that the proposed change ensures SSCs important to safety are designed to perform their safety func.tions during and following a tornado at Grand Gulf, where their design reflects the importance of the safety functions to be performed.
4.0 STATE CONSULTATION
In accordance with the Commission's regulations, the Mississippi State official was notified of the proposed issuance of the amendment on May 15, 2019. The State official had no comments.
5.0 ENVIRONMENTAL CONSIDERATION
The amendment changes a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendment involves no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment on such finding published in the Federal Register on February 27, 2018 (83 FR 8516). Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).
Pursuant to 10 CFR 51.22(b ), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.
6.0 CONCLUSION
The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.
7.0 REFERENCES
- 1.
Larson, Eric A., Entergy Operations, Inc., letter to U.S. Nuclear Regulatory Commission, "License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis," dated November 3, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17307A440).
- 2.
Larson, Eric A., Entergy Operations, Inc., letter to U.S. Nuclear Regulatory Commission, "Supplemental Letter to License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis," dated December 6, 2017 (ADAMS Accession No. ML173408025).
- 3.
Larson, Eric A., Entergy Operations, Inc., letter to U.S. Nuclear Regulatory Commission, "Supplemental Letter to License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis Supplement regarding De Minimis Penetrations" dated January 22, 2018 (ADAMS Accession No. ML18022A598).
- 4.
Larson, Eric A., Entergy Operations, Inc., letter to U.S. Nuclear Regulatory Commission, "License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis - Partial Response to Request for Additional Information and Extension of Response to Request for Additional Information for Remaining Questions" dated October 24, 2018 (ADAMS Accession No. ML18297A381 ).
- 5.
Larson, Eric A., Entergy Operations, Inc., letter to U.S. Nuclear Regulatory Commission, "Response to Request for Additional Information Regarding License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis -
Supplement" dated January 23, 2019 (ADAMS Accession No. ML19023A328).
- 6.
Nuclear Energy Institute, NEI 17-02, Rev. 1, "Tornado Missile Risk Evaluator (TMRE)
Industry Guidance Document," dated September 21, 2017 (ADAMS Accession No. ML17268A036).
- 7.
U.S. Nuclear Regulatory Commission, Regulatory Issue Summary 2015-06, "Tornado Missile Protection," dated June 10, 2015 (ADAMS Accession No. ML15020A419).
- 8.
Gayheart, Cheryl A., Southern Nuclear Operating Company, Inc., letter to U.S. Nuclear Regulatory Commission, "Vogtle Electric Generating Plant - Unit 1 and 2, Tornado Missile Risk Evaluator, SNC Response to NRC Request for Additional Information,"
dated July 26, 2018; includes NEI 17-02, Rev. 1A, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," July 2018 (ADAMS Accession No. ML18207A876).
- 9.
Gayheart, Cheryl A., Southern Nuclear Operating Company, Inc., letter to U.S. Nuclear Regulatory Commission, "Vogtle Electric Generating Plant - Unit 1 and 2, Tornado Missile Risk Evaluator, SNC Response to NRC Request for Additional Information,"
dated September 14, 2018 (ADAMS Accession No. ML18260A053).
- 10.
Jones, Bentley K., Duke Energy, letter to U.S. Nuclear Regulatory Commission, "License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis - Supplement and Request for Additional Information Response (EPID L-2017-LLA-0355)," dated September 19, 2018; includes NEI 17-02, Rev. 18, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document,"
September 2018 (ADAMS Accession No. ML18262A328). *
- 11.
U.S. Nuclear Regulatory Commission, Regulatory Guide 1.76, Revision 1, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," March 2007 (ADAMS Accession No. ML070360253).
- 12.
NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants:.LWR Edition," Section 3.5.1.4, Revision 4, "Mis*siles Generated by Extreme Winds," March 2015 (ADAMS Accession No. ML14190A180).
- 13.
NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," Section 3.5.2, Revision 3, "Structures, Systems, and Components to be Protected from Externally-Generated Missiles," March 2007 (ADAMS Accession No. ML070460362).
- 14.
U.S. Nuclear Regulatory Commission, Regulatory Guide 1.117, Revision 2, "Protection Against Extreme Wind Events and Missiles for Nuclear Power Plants," July 2016 (ADAMS Accession No. ML15356A213).
- 15.
U.S. Nuclear Regulatory Commission, Regulatory Guide 1.17 4, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," May 2011 (ADAMS Accession No. ML100910006).
- 16.
U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," March 2009 (ADAMS Accession No. ML090410014).
- 17.
NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for
- Nuclear Power Plants: LWR Edition," Section 19.1, Revision 3, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load," September 2012 (ADAMS Accession No. ML12193A107).
- 18.
NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," Section 19.2, Revision 0, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis:
General Guidance," June 2007 (ADAMS Accession No. ML071700658).
- 19.
American Society for Mechanical Engineers/American Nuclear Society, ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.
- 20.
U.S. Nuclear Regulatory Commission, NUREG/CR-4461, Revision 2, "Tornado Climatology of the Contiguous United States," February 2007 (ADAMS Accession No. ML070810400).
- 21.
Electric Power Research Institute, EPRI NP-768, "Tornado Missile Risk Analysis,"
May 1978.
- 22.
Wermiel, J. S., memorandum to Public Document Room, U.S. Nuclear Regulatory Commission, "Electric Power Research Institute (EPRI Reports (EPRI N--768, 769 and 2005, Volumes 1 and 2) Concerning Tornado Missile Probabilistic Risk Assessment (PRA) Methodology and Corresponding Safety Evaluation Report," dated November 29, 1983 (ADAMS Legacy Accession No. 8312140192).
- 23.
Electric Power Research Institute, EPRI NP-769, "Tornado Missile Risk Analysis Appendixes," May 1978.
- 24.
Rubenstein, L. S., memorandum to Frank J. Miraglia, U.S. Nuclear Regulatory Commission, "Safety Evaluation Report - Electric Power Research Institute (EPRI)
Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRA)
Methodology," dated October 26, 1983 (ADAMS Accession No. ML080870291 ).
Principal Contributors: E. Brown, NRR S. Vasavada, NRR M. Reisi-Fard, NRR G. Curran, NRR Date: June 18, 2 0 1 9
- via email OFFICE NRR/DORL/LSPB/PM N RR/DORL/LSPB/LA NRR/DRA/APLB/BC NAME EBrown JBurkhardt GCasto w/comments as corrected DATE 6/13/19 5/10/19 5/15/19 OFFICE OGC (NLO)*
NRR/DORL/LPL2-1 /BC NAME JScro MMarkley DATE 6/7/19 6/18/19