ML21075A076

Issuance of Amendment Nos. 316, 339, and 299 Regarding the Incorporation of the Tornado Missile Risk Evaluator Into the Licensing Basis

ML21075A076
Person / Time
Site:	Browns Ferry
Issue date:	04/30/2021
From:	Michael Wentzel Plant Licensing Branch II
To:	Jim Barstow Tennessee Valley Authority
Wentzel M
References
EPID L-2020-LLA-0099
Download: ML21075A076 (39)

Text

April 30, 2021 Mr. James Barstow Vice President, Nuclear Regulatory Affairs and Support Services Tennessee Valley Authority 1101 Market Street, LP 4A-C Chattanooga, TN 37402-2801

SUBJECT:

BROWNS FERRY NUCLEAR PLANT, UNITS 1, 2 AND 3 ISSUANCE OF AMENDMENT NOS. 316, 339, AND 299 REGARDING THE INCORPORATION OF THE TORNADO MISSILE RISK EVALUATOR INTO THE LICENSING BASIS (EPID L-2020-LLA-0099)

Dear Mr. Barstow:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment Nos. 316, 339, and 299 to Renewed Facility Operating Licenses Nos. DPR-33, DPR-52, and DPR-68 for the Browns Ferry Nuclear Plant, Units 1, 2, and 3, respectively. These amendments are in response to your application dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021.

The amendments incorporate the Tornado Missile Risk Evaluator methodology into the Browns Ferry Nuclear Plant, Units 1, 2, and 3, Updated Final Safety Analysis Report.

A copy of the Safety Evaluation is also enclosed. A Notice of Issuance will be included in the Commissions monthly Federal Register notice.

Sincerely,

/RA/

Michael J. Wentzel, Project Manager Plant Licensing Branch II-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos.: 50-259, 50-260, and 50-296

Enclosures:

1. Amendment No. 316 to DPR-33

2. Amendment No. 339 to DPR-52

3. Amendment No. 299 to DPR-68

4. Safety Evaluation cc: Listserv

TENNESSEE VALLEY AUTHORITY DOCKET NO. 50-259 BROWNS FERRY NUCLEAR PLANT UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 316 Renewed License No. DPR-33

1. The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Tennessee Valley Authority (the licensee) dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in Title 10 of the Code of Federal Regulations (10 CFR)

Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

2. Accordingly, by Amendment No. 316, the license is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR), as set forth in the application dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021.

The licensee shall update the UFSAR to incorporate the changes described in the licensees application dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021 and the NRC staffs safety evaluation attached to this amendment, and shall submit the revised description authorized by this amendment with the next update of the UFSAR.

3. This license amendment is effective as of its date of issuance and shall be implemented within 60 days from the date of issuance. The UFSAR changes shall be implemented in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e).

FOR THE NUCLEAR REGULATORY COMMISSION Digitally signed by David J. David J. Wrona Date: 2021.04.30 Wrona 10:13:21 -04'00' David J. Wrona, Chief Plant Licensing Branch II-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: April 30, 2021

TENNESSEE VALLEY AUTHORITY DOCKET NO. 50-260 BROWNS FERRY NUCLEAR PLANT, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 339 Renewed License No. DPR-52

1. The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by Tennessee Valley Authority (the licensee) dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in Title 10 of the Code of Federal Regulations (10 CFR)

Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

2. Accordingly, by Amendment No. 339, the license is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR), as set forth in the application dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021.

The licensee shall update the UFSAR to incorporate the changes described in the licensees application dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021 and the NRC staffs safety evaluation attached to this amendment, and shall submit the revised description authorized by this amendment with the next update of the UFSAR.

3. This license amendment is effective as of its date of issuance and shall be implemented within 60 days from the date of issuance. The UFSAR changes shall be implemented in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e).

FOR THE NUCLEAR REGULATORY COMMISSION Digitally signed by David J. David J. Wrona Date: 2021.04.30 Wrona 10:13:44 -04'00' David J. Wrona, Chief Plant Licensing Branch II-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: April 30, 2021

TENNESSEE VALLEY AUTHORITY DOCKET NO. 50-296 BROWNS FERRY NUCLEAR PLANT, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 299 Renewed License No. DPR-68

1. The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by Tennessee Valley Authority (the licensee) dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in Title 10 of the Code of Federal Regulations (10 CFR)

Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

2. Accordingly, by Amendment No. 299, the license is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR), as set forth in the application dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021.

The licensee shall update the UFSAR to incorporate the changes described in the licensees application dated May 6, 2020, as supplemented by letters dated July 31, 2020, and January 29, 2021 and the NRC staffs safety evaluation attached to this amendment, and shall submit the revised description authorized by this amendment with the next update of the UFSAR.

3. This license amendment is effective as of its date of issuance and shall be implemented within 60 days from the date of issuance. The UFSAR changes shall be implemented in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e).

FOR THE NUCLEAR REGULATORY COMMISSION Digitally signed by David David J. J. Wrona Date: 2021.04.30 Wrona 10:14:07 -04'00' David J. Wrona, Chief Plant Licensing Branch II-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: April 30, 2021

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 316, 399, AND 299 TO RENEWED FACILITY OPERATING LICENSE NOS. DPR-33, DPR-52, AND DPR-68 TENNESSEE VALLEY AUTHORITY BROWNS FERRY NUCLEAR PLANT, UNITS 1, 2, AND 3 DOCKET NOS. 50-259, 50-260, AND 50-296

1.0 INTRODUCTION

By letter dated May 6, 2020 (Reference 1), as supplemented by letters dated July 31, 2020 and January 29, 2021 (References 2 and 3, respectively), Tennessee Valley Authority (TVA, the licensee), submitted a license amendment request (LAR) to the U.S Nuclear Regulatory Commission (NRC) for Browns Ferry Nuclear Plant (Browns Ferry), Units 1, 2, and 3. The licensee requested a change to the licensing basis of each unit to use a new tornado-missile risk evaluation methodology to qualify several components that have been identified as not conforming to the existing, unit-specific licensing basis. The methodology proposed by the licensee is described in a document prepared by the Nuclear Energy Institute (NEI): NEI 17-02, Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document, Revision 1B (the TMRE methodology, included in Reference 6).

The LAR assesses tornado occurrence frequencies, system responses, and mitigating actions to determine whether physical protection from tornado-generated missiles is warranted for certain structures, systems, and components (SSCs). The methodology would only be applicable to discovered conditions where tornado-missile protection should be present but is not currently provided. Future modifications to the facility, which need to be reviewed for tornado-missile protection, will not be evaluated using the TMRE methodology.

The supplements dated July 31, 2020, and January 29, 2021, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staffs original proposed no significant hazards consideration determination as published in the Federal Register on July 14, 2020 (85 FR 42442).

1.1 Purpose of Proposed Change The NRC issued Regulatory Issue Summary (RIS) 2015-06, Tornado Missile Protection, on June 10, 2015 (Reference 7). RIS 2015-06 served to remind licensees of the need to conform Enclosure 4

to the current, site-specific licensing basis for tornado-generated missile protection at their facilities; to report examples of failure to conform with a plants tornado-generated missile licensing basis; and to reiterate the NRC staffs position that the licensees systematic evaluation program or individual plant examination of external events results do not constitute regulatory requirements. These are not part of the plant-specific tornado-generated missile licensing basis unless the NRC or licensee acted to amend the operating license.

In response to RIS 2015-06, the licensee performed walkdowns at Browns Ferry, Units 1, 2, and 3 to identify potential nonconformances with the current licensing basis for tornado-missile protection. Specifically, the licensee identified plant configurations in which SSCs should have been protected from tornado-generated missiles based on the current licensing basis but were not, resulting in nonconformances with the design and licensing bases.

2.0 REGULATORY EVALUATION

2.1 Description of Proposed License Change In the enclosure to the LAR dated May 6, 2020, the licensee provided an evaluation of the proposed change. In Section 2.4, Description of the Proposed Change, the licensee states that it was requesting NRC approval of a revision to the updated final safety analysis report (UFSAR) for Browns Ferry. The revision is to reflect those SSCs that do not require physical protection from tornado missiles. The following nonconforming conditions were identified in Section 2.3:

D emergency diesel generator (EDG) fuel oil vent stack Unit 3 EDGs 3A, 3B, 3C, and 3D fuel oil vent stacks Unit 3 Control Building 593 elevation 1C hallway door 484 Furthermore, the licensee proposed to modify Browns Ferry UFSAR Section 12.2.8, Diesel Generator Building Units 1 and 2 (Class I), and Section F.7.2, Control Bay (Reference 8).

On September 21, 2017, NEI submitted NEI 17-02, Revision 1, in support of three proposed pilot implementations of their proposed methodology. NEI 17-02 was intended to provide guidance for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles, and for assessing the risk posed by tornado missiles to determine whether physical protection of the noncompliant SSCs was warranted.

During the pilot program, the industry guidance was updated twice. The version used to support the Browns Ferrys proposed change is Revision 1B, which the licensee confirmed in its first response to requests for additional information (RAIs) (Reference 2). All references in this evaluation to NEI 17 02 refer to this version, unless a different version is explicitly cited. The NRC staff uses TMRE methodology throughout this document to refer to the guidance in NEI 17-02 Revision 1B, which includes options that may or may not be used in the LAR.

The TMRE is a risk-informed methodology, which TVA intends to apply at Browns Ferry to resolve conditions that do not conform to requirements for protection against tornado missiles in the current licensing basis.

In Section 3.4, Technical Evaluation Conclusions, of the enclosure to the LAR, the licensee states that the TMRE methodology could be used to resolve those issues that do not conform to deterministic design and licensing requirements for protection against tornado missiles. This would be accomplished by revising the design basis under Title 10 of the Code of Federal

Regulations (10 CFR), Section 50.59, Changes, tests and experiments. To make such a change without prior approval, the acceptance criteria of the TMRE must be satisfied. In addition, TVA must continue to meet the conditions stated in the LAR.

The NRC staff notes that the methodology may only be applied when legacy conditions are discovered where tornado-missile protection was not provided. The methodology cannot be used to avoid providing tornado-missile protection in the plant modification process. Therefore, future changes to the facility requiring physical tornado-missile protection would not be evaluated using the TMRE methodology. The NRC staff also notes that proposed changes that are not within the scope of the plant-specific approval described in this safety evaluation are to be reviewed consistent with the criteria in 10 CFR 50.59 and the Browns Ferry licensing basis.

2.2 Tornado-Missile Protection Licensing Basis All three Browns Ferry units were designed and constructed to meet the intent of the general design criteria (GDC) of the Atomic Energy Commission (AEC), as originally proposed in July 1967. Thus, the design and construction of Browns Ferry was initiated and proceeded to a significant extent based upon the criteria proposed in 1967.

Appendix A Section A.1, Summary Description, of the Browns Ferry UFSAR describes the manner in which the three Browns Ferry units meet the intent of the corresponding GDC published in 1971 as Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities.

Appendix A Section A.2.1, Group I - Overall Plant Requirements (Criteria 1-5), of the Browns Ferry UFSAR describes the manner in which the Browns Ferry GDC meet the intent of the corresponding GDC, referred to as Criteria 2, published in 1971 as Appendix A to 10 CFR Part 50.

Accordingly, the design of Browns Ferry, Units 1, 2, and 3 meets the intent of the GDC in 10 CFR Part 50, Appendix A, including GDC 2, Design bases for protection against natural phenomena and GDC 4, Environmental and dynamic effects design bases. The current GDC are repeated in Section 2.3, below. The current licensing basis for tornado-missile protection for the Browns Ferry units is contained in Appendix C, Section C.6.4 of the Browns Ferry UFSAR.

The most challenging credible missiles created by natural phenomena at Browns Ferry are those generated by tornadoes. The incidence of tornadoes at the site is described in the Browns Ferry UFSAR, Section 2.3, Meteorology; tornadoes are consistent in frequency and magnitude with NRC tornado Region 1 (discussed below). Browns Ferry UFSAR Section 1.6.1.1.10 describes the basis for tornado loading of Class 1 buildings and tornado-driven missiles at Browns Ferry.

The typical method used to meet the guidelines in the GDC is physical protection by locating required equipment in structures designed to protect against damage from tornado missiles or by providing barriers designed to withstand tornado missiles.

2.3 Related Criteria in Appendix A to 10 CFR Part 50 GDC 2, Design bases for protection against natural phenomena, establishes requirements regarding the ability of SSCs important to safety to withstand the effects of natural phenomena without the loss of capability to perform their safety functions. Protection from the missile

spectrum set forth in the Browns Ferry UFSARs provides assurance that necessary SSCs will be available to perform their safety functions during and following a tornado.

GDC 4, Environmental and dynamic effects design bases, establishes requirements regarding the ability of SSCs important to safety to be protected from dynamic effects, including the effects of missiles from events and conditions outside the nuclear unit. Protection from a spectrum of missiles with the critical characteristics set forth in applicable regulatory guidance provides assurance that the necessary SSCs will be available to mitigate the potential effects of extreme winds and missiles associated with such winds on plant SSCs important to safety.

2.4 Applicable Regulatory Guidance and Review Plans The guidance in this section was used by the NRC staff to determine whether the methodology proposed in NEI 17-02 is acceptable for use at Browns Ferry. As the licensee has submitted the methodology to evaluate changes to the protection of SSCs from externally generated tornado missiles, the guidance applies to the acceptability of the application of that methodology at Browns Ferry, within the constraints identified in the LAR.

NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR [Light-Water Reactor] Edition (the SRP), includes three relevant sections:

Section 3.5.1.4, Revision 4, Missiles Generated by Extreme Winds (Reference 9), and Section 3.5.2, Revision 3, Structures, Systems, and Components to be Protected from Externally-Generated Missiles (Reference 10), contain the current acceptance criteria governing tornado-missile protection. These criteria generally specify that SSCs that are important to safety shall be provided with sufficient, positive tornado-missile protection (i.e., barriers) to withstand the maximum credible missile hazard created by tornadoes.

Section 19.1, Revision 3, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load (Reference 11), provides the NRC staff with guidance for evaluating the acceptability of the results of a licensees probabilistic risk assessment (PRA) when used to request risk-informed changes to the licensing basis.

Section 19.2, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, dated June 2007 (Reference 12),

provides the NRC staff with guidance for evaluating the risk information used by a licensee to support permanent, risk-informed changes to the licensing basis.

Regulatory Guide 1.76, Revision 1, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants (RG 1.76, Reference 13), provides a method to define design-basis tornado and design-basis tornado-generated missiles that a nuclear power plant should be designed to withstand to prevent undue risk to the health and safety of the public. Current NRC guidance on tornado characteristics for consideration in the design of nuclear power plants is found in this guide.

Regulatory Guide 1.117, Revision 2, Protection Against Extreme Wind Events and Missiles for Nuclear Power Plants, dated July 2016 (RG 1.117, Reference 14), provides an approach for identifying those SSCs of light-water-cooled reactors that should be protected from the effects of the worst-case extreme winds (tornadoes and hurricanes) and wind-generated missiles, such

that they remain functional. Appendix A, Structures, Systems, and Components to be Protected Against Extreme Wind Events (Tornado and Hurricane), to RG 1.117 lists the types of SSCs that should be protected from design-basis tornadoes. The NRC staff notes that this list is unchanged from the previous revision of the regulatory guide. In addition to physical design methods, the NRC allows the use of probabilistic analysis to demonstrate that the probability of a tornado-generated missile striking safety-related equipment is sufficiently low such that no additional protective measures are required.

Regulatory Guide 1.174, Revision 3, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis (RG 1.174, Reference 15), describes an acceptable approach for developing risk-informed applications for a licensing basis change that considers engineering issues and applies risk insights. It provides general guidance concerning analysis of the risk associated with proposed changes in plant design and operation.

Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities (RG 1.200, Reference 16),

describes an acceptable approach for determining whether the PRA, in total or the parts that are used to support an application is acceptable for use in regulatory decision making for LWRs.

ASME International (formerly, the American Society of Mechanical Engineers (ASME)) and the American Nuclear Society (ANS) formed a Joint Committee on Nuclear Risk Management. This joint committee published ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, February 2009 (hereafter referred to as the PRA Standard (Reference 17)). The NRC staff endorsed this version for use in RG 1.200. This industry standard sets forth requirements for PRAs used to support risk-informed decision for commercial nuclear power plants.

NUREG/CR-4461, Tornado Climatology of the Contiguous United States, was based, in part, on a summary of information from a variety of sources collected in WASH-1300, Technical Basis for Interim Regional Tornado Criteria, May 1974 (Reference 18). The initial version of NUREG/CR-4461 summarized data on tornadoes that occurred from January 1954 through December 1983 and were listed in a tornado database maintained by the National Severe Storms Forecast Center. Revision 1 of NUREG/CR-4461 (Reference 19) updates the 1986 report using tornado data collected from January 1, 1950, through August 2003. It contains statistics on tornado dimensions and wind speeds by region of the country and estimates of strike probabilities and design wind speeds by boxes with sides of 1 degree, 2 degrees, and 4 degrees of latitude and longitude. The guidance in NUREG/CR-4461, Revision 2 (Reference 20), examines the implications of switching from the Fujita scale (F-scale) to the enhanced Fujita scale (EF-scale). This alters design wind speed estimates for tornadoes. From this point on, all references to NUREG/CR-4461 refer to Revision 2 unless a different version is explicitly cited.

The TMRE methodology uses data, examples, and analysis developed by the Electric Power Research Institute (EPRI). These were presented in a topical report, EPRI NP-768, Tornado Missile Risk Analysis, May 1978 (Reference 21), supplemented by EPRI NP-769, Tornado Missile Risk Analysis Appendixes, May 1978 (Reference 22).

Analysts determined the number of hits per targets. These values are used to determine the missile impact parameter. From this analysis, a methodology and computer code (TORMIS)

were developed and documented in EPRI NP-2005, Tornado Missile Simulation and Design Methodology, August 1981 (Reference 23).

In a memorandum dated November 29, 1983 (Reference 24), the NRC staff concluded that the EPRI methodology based on EPRI NP-768 and EPRI NP-769 and documented in EPRI NP-2005 can be used to assess the need for positive tornado protection for specific safety-related plant features contained in EPRI NP-768 and EPRI NP-769.

3.0 TECHNICAL EVALUATION

Consistent with the design criteria above, this review is intended to demonstrate that the licensee has properly established the capability of SSCs to withstand design wind loadings so that the design reflects appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena. The Browns Ferry UFSAR, Section 1.6.1.1.10.c, states that: All Class I structures and equipment that are required to support and maintain safe shut down of all the units as a result of a tornado design basis event are designed to maintain their integrity when subjected to loading resulting from a 300-mph tornado. Further, Browns Ferry UFSAR Appendix C, Section C.6.4, Equipment Seismic/Structural Qualification (ESQ) After July 2007, states, in part: Class I equipment, which is exposed to the outside environment, is required to be qualified for Browns Ferry design basis wind, tornado missiles, snow, and ice as applicable at the equipment location.

In RG 1.117, the NRC staff determined that the likelihood of a design-bases tornado occurring concurrent with a loss-of-coolant-accident is sufficiently small that the bounding safety functions are considered to be those in support of a loss of offsite power (LOOP), with protection afforded for long-term core cooling. These criteria are used by the NRC staff to assess those SSCs that should be protected from externally generated tornado missiles. In Appendix A, Technical Basis for TMRE Methodology, to the industry guidance, a nonrecoverable LOOP is assumed.

The NRC staff notes that, per RG 1.200, a safe and stable condition is required for a technically acceptable PRA. As such, it is assumed that long-term cooling is achieved and assured in that condition.

The NRC staffs review focused on (1) evaluating the acceptability of the NEI guidance process, as used by the licensee, for assessing the risk from SSCs that do not conform to the plant-specific licensing basis related to tornado-missile protection; (2) validating the acceptability of the licensees PRA for use in the implementation of the methodology; (3) confirming that the risk associated with not physically protecting the identified nonconforming SSCs according to the tornado-missile protection licensing basis is sufficiently small; and (4) confirming that the proposed change ensures that SSCs important to safety are designed to withstand the effects of tornadoes without loss of capability to perform their safety functions, and that their design reflects the importance of the safety functions to be performed.

3.1 Tornado Missile Risk Evaluation Methodology The TMRE methodology uses plant walkdowns to identify and quantify potential externally generated tornado missiles and evaluate the availability of protection for onsite SSCs necessary to support withstanding the effects of normal and accident conditions related to a tornado. This information is used to calculate a failure probability for onsite SSCs necessary to support safe shutdown that are not protected, which are referred to as nonconforming SSCs. The exposed equipment failure probability (EEFP) is a conditional probability that associates the failure of an

exposed SSC due to an externally generated missile assuming a tornado of a given category.

The failure probabilities are then incorporated into the PRA model for the facility.

The TMRE methodology outlines those aspects that are conservative in Appendix A to NEI 17-02. It indicates that the methodology is based on information derived from EPRI NP-768. Two areas were identified to be potentially nonconservative. The methodology instructs the use of sensitivity studies for these two areas. One of the nonconservatisms exists with calculations in the compliant case and the other in derivation of the missile impact parameter (MIP). The MIP is used to develop the EEFP and represents the probability of a damaging hit on a target per unit surface area, per missile, per tornado; and is sensitive to tornado intensity and the elevation of the target.

Then the methodology looks at two cases and uses the difference to determine whether the risk from not providing physical protection to the nonconforming SSCs is acceptably small. This is evaluated according to the acceptance guidelines of RG 1.174. The first case assumes that all nonconforming SSCs are protected. This is known as the compliant case. The second case is known as the degraded case and assumes that the nonconforming SSCs are considered failed as a result of the tornado and related conditions.

3.1.1 Selection of SSCs As discussed in Section 2, Overview of Tornado Missile Risk Evaluator Methodology, of the TMRE methodology, development of a high-winds equipment list (HWEL) comprises three major steps. The first step is the performance of walkdowns to gather information associated with those SSCs that are required to be protected. The walkdowns are used to confirm the identified nonconformances and identify any additional vulnerabilities. The concept of vulnerabilities reflects SSCs credited in the PRA that are not protected from tornadoes. Next, the information is used to create the HWEL. Finally, the HWEL is refined to ensure that the SSCs remaining are those SSCs needed to withstand design wind loadings to support safe shutdown of the facility.

Section 2.3, Evaluate Target and Missile Characteristics, Section 5, Evaluate Target and Missile Characteristics, and Section 6.5, Target Failures and Secondary Effects, of the TMRE methodology, state that Tornado missile failures do not need to be considered for SSCs protected by 18 [inch] reinforced concrete walls, 12 reinforced concrete roofs, and/or 1 steel plate. The guidance does not require analysis for evaluating the risk of nonconforming conditions that are protected as described in TMRE methodology Section 2.3.

Conduct of the Walkdowns Section 3, Perform Plant TMRE Walkdown, of the TMRE methodology, describes the process for preparing, conducting, assessing, and documenting the performance of a walkdown of a site to gather sufficient information about the number and types of missiles on site as well as confirmation and identification of SSCs that should be protected from externally generated missiles. The licensee used walkdowns to gather physical data associated with known vulnerable and nonconforming SSCs and to identify other SSCs modeled in the internal events PRA that are not protected from tornadoes and tornado missiles. From this, the licensee developed an HWEL.

In Section 3.3.3, Missile Walkdowns, of the enclosure to the LAR, the licensee indicated that the guidance in the TMRE methodology was followed. Section 3.4, Tornado Missile

Identification and Classification, of the TMRE methodology provides guidance on the expertise needed to perform a tornado-missile walkdown, verify the total number of missiles through TMRE walkdown for nonstructural missiles, structural missiles, and consider nonpermanent missiles. The personnel recommendations for the tornado-missile walkdown are discussed in Section 3.4.1, Perform Plant TMRE Walkdown, of the TMRE methodology, which states:

Personnel performing the Tornado Missile Walkdown do not require PRA expertise or knowledge, and structural engineering experience is not required.

The personnel only need to be trained on the methods for identifying and counting potential missiles. This section and Section 4.3 of EPRI 3002008092

[Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants] provide adequate information to support training Tornado Missile Walkdown personnel.

In response to the October 22, 2020 RAI 01 (Reference 3), the licensee confirmed that the personnel who performed the walkdown were trained in accordance with the Section 3.4.1 guidelines. The NRC staff determined this response was adequate for this application.

The NRC staff reviewed the approval of another risk-informed tornado protection methodology known as TORMIS (from the name of the EPRI computer code used to implement the methodology, which was evaluated in Reference 24). Given that no specific expectations are required in the conduct of walkdowns for that methodology and the expectation for the personnel involved to be familiar with plant layout and drawings (allowing personnel to properly define the missiles and classify/group missiles accordingly), the NRC staff finds the means used by the licensee to qualify walkdown personnel to be acceptable.

Determination of Applicable Missiles As discussed above, RG 1.76, Revision 1, provides a method to define design-basis tornado and design-basis tornado-generated missiles. It defines tornado-generated missiles as objects moving under the action of the aerodynamic forces induced by the tornado wind. Wind velocities in excess of 75 miles per hour are capable of generating missiles from objects lying within the path of the tornado wind and from the debris of nearby damaged structures. The Browns Ferry UFSAR, Section 12.2.2.9.2, Tornado Generated Missiles, identifies wood boards, cross-ties, concrete, warning beacons, and automobiles as missiles generated by tornado and used for the design basis.

TMRE methodology Section 3.4.4, Structural Missiles, and Section C.4, Debris from Damaged Structures, of Appendix C, Bases for Target Robustness and Missile Characteristics, contain guidance, including lists showing the type and size of a few structures, for determining the number of missiles generated by building deconstruction. The guidance for building deconstruction was based on typical construction practices and an assumption of a moderately stacked warehouse, which was confirmed by a walkdown of a typical warehouse at a nuclear power plant. The guidance of this section states that the tornado missile inventory of the turbine building (TB) should be assessed independently. In response to the October 22, 2020 RAI 03.a (Reference 3), the licensee stated that no specific TMRE missile inventory of the TB occurred. The licensee states in the RAI 03.c response that the insights of previous walkdowns were utilized to estimate the number of missiles in and siding from the TB for each unit. To address the uncertainty associated with these estimates, the licensee stated that the number of TB component-based missiles and the total number of TB structural missiles (including siding) were increased by a factor of 5 and 10, respectively. This TB missile total,

when added to the LAR analysis total, resulted in a missile inventory of 179,744 missiles, which has margin to the value of 240,000 missiles used in the LAR analysis. The NRC determined that given the use of large multiplication factors and the amount of margin to the missile inventory value used in the analysis, the lack of a specific TMRE missile inventory of the TB would not impact the NRC staffs conclusions on this application.

The NRC staff finds the approach for determining the missile inventory from building deconstruction in the TMRE methodology to be acceptable because (1) it considers different building types, (2) it is based on typical construction practices and representative warehouse inventory, and (3) the approach conservatively assumes that the entire building deconstructs, resulting in its construction constituents, as well as the inventory within, being available as missiles. Section C.4 of the TMRE methodology also includes an example evaluation of the guidance to determine the number of missiles from building deconstruction. Because of the availability of guidance as well as an example for the implementation of the guidance to determine missile inventory from building deconstruction, the NRC staff finds that extensive structural engineering experience is not necessary for personnel performing the tornado-missile inventory walkdown.

Section 3.4.2, Non-Structural Missile Inventory, of the TMRE methodology, provides guidance on the process for counting nonstructural missile inventory to verify bounding values of plant nonstructural missiles. Due to the large diversity of objects to consider in the missile count, the TMRE methodology recommends grouping missiles of similar size and type into various zones around the plant. While not all-inclusive, Table 3-2, Potential Tornado Missile Type, of the TMRE methodology, provides examples of missiles to consider while performing a walkdown.

Missile inventory was counted from the missile survey out to 2,500 feet (ft) from the reference point. The NRC staff noted that the 2,500-ft missile source distance is a typical value used to support site-specific tornado-missile count for applications and was derived from a case study discussed in Section 2.3.3, Off Site Missile Assessment, of EPRI NP-769. For nonstructural missile count, the NRC staff finds counting missiles to a distance of approximately 2,500 ft is acceptable, because it is consistent with typical counting practice and the EPRI studies used as the basis for the TMRE methodology.

The TMRE guidance also states that in the case of targets greater than 1,500 ft from the reference point, a qualitative evaluation of the missile inventory within 2,500 ft of the outlying targets should be performed. In response to the October 22, 2020 RAI 02 (Reference 3), the licensee confirmed that all SSCs including the turbine building, auxiliary buildings, intake structures, tank areas, and the alternate alternating current power diesel generator, were within 1500 ft of the reference point. The NRC staff finds the licensees approach for considering missiles around targets that are further from the reference point acceptable because the insights from EPRI NP-768 data, which is used to support the TMRE methodology, suggest that the majority of the hits would occur from tornado missiles within 600 ft of the target.

Section 3.4.3, Non-Permanent Missiles, of the TMRE methodology, provides guidance on the consideration of nonpermanent missiles, such as those present during outages and construction periods. This section of the NEI guidance states that it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory. The guidance further states that outages are of relatively short duration compared to the operational time at a nuclear power plant. The NRC staff notes that duration of outages, or other temporary activities that involve bringing additional equipment to the sites, may be relatively long, specifically for a multi-unit site.

For Browns Ferry, the NRC staff notes that the generic missile count from the TMRE methodology (240,000) was used for its TMRE analysis. The NRC staff also notes that the licensees actual missile count (161,374) was lower than the TMRE methodology generic missile count. Given that the licensee has margin in the missile count to account for potential increases in missile counts during outage preparation and staging, the NRC staff finds the licensees approach consistent with the NEI guidance. In the future, should the result of a proposed change exceed those assumptions and the risk metric thresholds in the TMRE methodology, NRC approval would be required before staging material that would create a missile count in excess of 240,000 missiles.

In summary, the NRC staff finds the licensees approach for characterizing tornado missiles in TMRE acceptable because (1) the licensees process for performing missile counts considered structural and nonstructural missiles, (2) the licensees process is based on the relevant industry guidance, and (3) the methodology includes the externally generated missiles identified in the Browns Ferry UFSAR, as updated.

High-Winds Equipment List The licensee stated that the guidance in Sections 3.1, Vulnerable SSC Walkdown Preparation, and 3.2, Vulnerable SSC Walkdown, of the TMRE methodology was used to review previously identified nonconforming SSCs, collect and verify any data needed for the TMRE model via the development of HWEL, and locate and evaluate unprotected SSCs included in the TMRE PRA model via walkdowns. Sections 3.3.1, High Wind Equipment List, and 3.3.2, Target Walkdowns, of the enclosure to the LAR describe the licensees process for SSC (target) identification. Consistent with the TMRE methodology, specific configurations of interest observed during the walkdowns include:

active (e.g., pumps or compressors) or passive (e.g., tanks, piping) components that were directly exposed to tornado winds whether inside or outside; components inside non-Category I structures; components adjacent to non-Category I structures; and components subject to failure, due to secondary effects.

The enclosure to the LAR also provides details about the development of the site-specific HWEL. The NEI guidance recommends refinement of the HWEL using certain screening criteria including:

screening out SSCs that were located inside Category I structures and that were located away from vulnerable openings or features such as ventilation louvers and roll-up doors, and screening SSCs that were dependent on offsite power, because the TMRE methodology assumed there would be a nonrecoverable LOOP due to the tornado event.

Given that the licensees TMRE PRA and corresponding results do not screen out any SSCs based on the area of the penetrations, and that Category I structures were required to be designed to withstand the effects of tornado missiles, the NRC staff finds that the licensees approach for screening SSCs in Category I structures acceptable.

3.1.1.1 Missile Impact Parameter The NRC staffs evaluation of the MIP values in the TMRE methodology examined the dependencies of MIP values and the appropriateness of the area scaling approach. The dependencies that were examined included the tornado region (tornado frequency), building configurations in EPRI NP-768, tornado intensity, missile location, and target height.

As discussed in Section 2.4 of this safety evaluation, the TMRE methodology uses the NRC-approved data in EPRI NP-768 to derive the generic MIP values. Multiple scenarios of tornadoes striking a site were considered as part of the NRC reviewed and approved information provided in EPRI NP-768. Tornadoes were considered to take multiple alternative paths and be of different intensity. To explore the effect on missile-hit frequencies of sites located in different places in the country, average tornado frequency of three NRC tornado regions (Regions I, II, and Ill, numbered in decreasing order of tornado occurrence frequencies) were used as input to the calculations in EPRI NP-768. The calculations also explored effects of different missile types, different initial missile insertion heights, different initial locations of missiles through the site, and different configurations of buildings in the nuclear power plant. To study the different alternatives, the EPRI NP-768 analysis uses a Monte Carlo approach that sampled and addressed uncertainties of parameters such as wind speeds, initial missile locations, and insertion heights. The EPRI NP-768 report examined statistical convergence on target hit frequencies to select a sufficiently large sample of tornado paths and intensities (measured in the Fujita-prime scale (F-scale)), as well as missile trajectories.

Targets The EPRI NP-768 report analyzed effects of different configurations of buildings and missiles at nuclear power plants by considering two hypothetical nuclear power plants, referred to as Plants A and B. The targets selected for the computation of hit frequencies were the buildings of Plants A and B. Plant A was a single-unit plant with seven buildings. Plant B was a two-unit plant with 16 buildings. Plant B was analyzed in two configurations: configuration B1 postulated that all Unit 2 buildings were under construction when the tornado struck (with construction material providing a source of missiles); configuration B2 postulated both units as being operational at the time of the tornado strike. The types of missiles considered included wood beams, pipes, steel rods, utility poles, plates, and automobile vehicles (cars and trucks). At Plant A, the missiles were assumed to be distributed uniformly over an enclosed area, while for Plant B, the distribution of missiles was nonuniform in the B1 and B2 configurations, which included different assumptions on insertion heights and the initial location of missile types (e.g.,

vehicles were predominantly located in parking lots).

Missile trajectories were simulated and the characteristics of the hits on the different buildings or targets were recorded (such as impact speeds and scabbing damage) using the EPRI methodology. The EPRI methodology employs Monte Carlo techniques in order to propagate the transport of tornado-generated missiles and to assess the probability of missile strikes causing damage to unprotected SSCs. Statistics were derived to quantify the number of hits per target, the number of hits per missile, the number of hits with specific features (including whether a threshold velocity was exceeded or whether a given amount of damage was caused by the hit) and associated hit frequencies.

The TMRE methodology notes that the majority of the tornado-generated missile hits in the EPRI NP-768 analysis affected the vertical walls, with few hits on the building roofs. Based on that observation, the guidance selected the vertical wall exposed area only to define the MIP for

near-ground targets for use in the TMRE methodology. The exception in the selection of areas was for the target referred to as Target 6 (service water intake structure), which was 20 ft in height. For Target 6, the total building area (walls and roof) was selected for estimating MIP values for both near-ground and elevated targets, on the basis that it was a short building with expected missile hits to the roof. In the TMRE methodology, Table B-3, Plant A Tornado Missile Impact Parameters for Near Ground Targets, of Appendix B, Bases for MIP and Missile Inventories, revised average MIP values over all building targets for the three NRC tornado regions are provided. The average value for each tornado intensity interval was computed as a weighted average using the target areas as the weights (based on building wall areas with the previously stated exception of Target 6). This area-weighted average is equivalent to adding missile-hit frequencies for all targets, and then dividing by the total reference area, as well as the tornado frequency, for the F tornado intensity category under consideration.

Section B.3.2, Selection of Conservative Tornado Region MIP, of Appendix B to the TMRE methodology asserts that differences in MIP values between the NRC tornado regions were unexpected and that no specific discussion is provided in EPRI NP-768 to explain those differences. To address the possible uncertainty, the maximum average of the three NRC tornado regions for each F tornado intensity category was selected to define reference MIP values. The TMRE methodology further states that lack of convergence might have caused the numerical differences in the NRC tornado regions and postulates a transition height between near-ground and elevated targets as 30 ft above the reference. Depending on the location of the target (the location was measured with respect to the target center), the guidance provides different MIP values.

The NRC staff examined the TMRE methodologys approach for computing the MIP values from EPRI NP-768 data. The NRC staff determined that the MIP values were appropriately calculated for the seven targets in Plant A studied in EPRI NP-768 and that the MIP average values in Tables B-3 and B-5 of NEI 17-02 were acceptable. The NRC staff also compared the MIP values for each target in EPRI NP-768 to the average MIP values in the TMRE methodology, which would be used generically. The targets in the EPRI NP-768 analysis were buildings that shielded each other against tornado-generated missiles. The reference MIP values in the TMRE methodology were averages from multiple targets (each target had a different level of exposure to tornado missiles). In an as-built, as-operated nuclear power plant, specific targets may be more exposed and have higher MIP values than the generic MIP values proposed in the TMRE methodology. Section A.5, Benchmark Results, of Appendix A to the TMRE methodology, presented the results of a benchmark analysis, comparing results from using the average MIP values to site-specific high-winds PRA results, and concluded that the average MIP values and the associated EEFP tended to overestimate (in several cases, depending on the F tornado category, by orders of magnitude) SSC failure probabilities. The TMRE methodology states that the technical acceptability of high-winds PRA models used to benchmark the TMRE methodology were consistent with the guidance in RG 1.200. As the NRC staff used the results of those high winds PRA models to provide an order of magnitude estimation of SSC failure probabilities for this application, primarily for benchmarking purposes, the staff concluded that there was no need to review the technical acceptability of the high winds PRA models.

The TMRE methodology does not include the containment building for the near-ground MIP calculations. The licensee also applied the robust missile fractions from the TMRE methodology (discussed in Section 3.3 of this safety evaluation). The NRC staff has determined that the net result of these changes is not significant and did not affect the licensees conclusions.

The NRC staff concludes that the licensees approach of excluding the containment building in the computation of the reference MIP values for near-ground structures in its TMRE methodology is acceptable, because it eliminates the impact of the containment building on the near-ground MIP values.

Section B.4, MIP Values for Use in the TMRE, of Appendix B to the TMRE methodology, provides two sets of MIP values: one for elevated targets and one for near-ground targets. As previously noted, the demarcation between near-ground and elevated targets was 30 feet above the primary missile source for a target. The EPRI NP-768 data supported the assumption of decrease in hit frequency with target height. For example, the MIP value of Target 1, which was only impacted at heights above 60 ft, was one order of magnitude less than the MIP value of other targets. As noted in Table B-2a, Elevated and Near Ground Missile Impact Parameter Comparisons, of Appendix B to the TMRE methodology, the guidance proposed an MIP (elevated target) = 0.43 x MIP (near-ground target).

Conservatism in MIP Calculation Section B.3.4, Basis for Target Elevation Demarcation, of Appendix B to the TMRE methodology provides the bases for the 30 ft demarcation. Section B.3.4 states that the demarcation elevation of 30 ft was decoupled from the EPRI NP-768 data because the EPRI NP-768 data did not provide quantifiable insights into missile hit probability at different elevations. The TMRE guidance further states that an assumed demarcation elevation was qualitatively justified based on regulatory documents associated with tornado missiles (i.e.,

RG 1.76, Revision 1 and SRP Section 3.5.1.4). Those regulatory documents included the 30 ft demarcation for heavier missiles, such as automobiles.

The NRC staff considered insights from the target elevation sensitivity study in Appendix E, TMRE Methodology Sensitivity Studies, to the TMRE methodology, to examine the appropriateness of the change in MIP values for elevated targets and the transition elevation of 30 feet. The NRC staff concludes that assuming 30 feet as a transition distance to consider a lower value of the MIP is acceptable for this application, because it is generally consistent with insights obtained from the EPRI NP-768 data and the Appendix E sensitivity analyses. The NRC staff emphasizes that any use of such transition distances or reduction factors outside the scope of the TMRE methodology is not approved through the granting of this amendment request.

The NRC staff concludes that selection of only the exposed vertical wall area to calculate MIP values for near-ground targets is justified because the majority of the missile hits in the EPRI NP-768 analysis occurred near the ground and on the vertical walls. The EPRI NP-768 data and the TMRE methodology sensitivity analyses consistently showed that elevated targets have fewer hits and, therefore, using smaller MIP values for elevated targets is acceptable. Using different MIP values for each tornado intensity is acceptable and supported by EPRI NP-768 data. The airborne missile paths are longer and cause more target hits for more intense tornadoes and, therefore, the average MIP values monotonically increase with increasing tornado intensity.

The reference MIP values derived in the TMRE methodology were averaged over all examined targets (weighted by the exposed vertical wall area) with the exception of the containment building. The NRC staff concludes that computing the MIP values as an average of the examined targets is reasonable. The average value takes credit for mutual shielding of the buildings (i.e., the average MIP values correspond to a target that is neither the most exposed

nor the least exposed) and mutual shielding is a more realistic representation of actual nuclear power plant configurations. The TMRE methodology guidance includes a benchmark comparison supporting the conclusion that use of average MIP values does not underestimate, in general, the EEFP with respect to site-specific failure probability of SSCs calculated using high winds PRA models. In summary, the NRC staff concludes that the use of average MIP values in the TMRE methodology, which does not include the containment building of the EPRI NP-768 Plant A are acceptable for this application.

3.2 Determination of Site Tornado Frequency The licensee developed site-specific tornado frequencies for each category of tornadoes, which it classified using the F-scale. Section 4, Determine Site Tornado Hazard Frequency, of the TMRE methodology provides guidance on the development of site-specific tornado initiator frequencies.

The TMRE methodology uses the tornado data found in NUREG/CR-4461 to develop the site-specific tornado frequencies to be used in the TMRE PRA model. NUREG/CR-4461 provides, for each U.S. nuclear plant site, tornado wind speeds associated with 10-5/year, 10-6/year, and 10-7/year occurrence frequencies for a tornado strike. Additionally, the total tornado strike frequency is provided for all locations in the continental United States. Using data from NUREG/CR-4461, and the approach detailed in Section 4 of the TMRE methodology, the licensee developed a site-specific tornado frequency curve (hazard curve) for the licensees site. The site-specific hazard curve was then used to derive the frequency of all tornadoes considered in the TMRE methodology (F-2 through F-6).

For the purposes of the TMRE methodology, NEI used the F-scale to classify tornado wind speed. This scale is different from the original F-scale and the enhanced Fujita scale (EF-scale) that is typically used. Section 4.2, Background, of the TMRE methodology states that for the TMRE application, the F-scale was chosen because the MIP values were derived based on simulations that used the F-scale to categorize the tornadoes. Because F-scale occurrence frequencies were not directly available from NUREG/CR-4461, those frequencies were derived from the site-specific F-scale data. As noted in Section 4.2 of the TMRE methodology, using the F-scale data instead of the EF-scale data resulted in higher and, therefore, more conservative, strike frequencies. Although the TMRE methodology uses the F-scale for consistency in MIP derivation, RG 1.76, Revision 1, uses the EF-scale and, therefore, the use of the F-scale is limited to this application.

The licensee described its process for determining tornado-initiating event frequencies in Section 3.3.4, Tornado Hazard Frequency, of the enclosure to the LAR. As stated in that section, the TMRE methodology and data from NUREG/CR-4461 were used to determine the tornado initiating event frequencies for the Browns Ferry TMRE PRA model. Site-specific tornado frequencies for applicable tornadoes were developed as a result of this effort. Using guidance in the TMRE methodology and plotting the Browns Ferry data points in an XY scatter chart with a logarithmic trend line, the licensee derived the hazard curve used to calculate tornado initiating event frequencies for each tornado intensity.

The NRC staff finds that the licensees process for generating tornado initiator frequency is consistent with guidance in the TMRE methodology and is technically acceptable for this application. The NRC staffs finding is based on the licensees: (1) use of the most recent data from NUREG/CR-4461, which has been endorsed by the NRC staff and includes tornadoes reported in the contiguous United States from January 1950 through August 2003,

(2) demonstration of acceptable results in the derivation of a site-specific tornado frequency curve (hazard curve), and (3) use of a technically sound approach to determine the frequency of each tornado category for use in the TMRE PRA model.

3.3 Failure Probability The second part of the methodology is the calculation of the failure probability of the SSCs due to externally generated tornado missiles. The failure probability of all SSCs impacted by tornado missiles that are part of the TMRE model (i.e., nonconformances and vulnerabilities) is determined through the EEFP. As described in Section 5 of the TMRE methodology, the EEFP represents conditional probability that an exposed SSC is hit and failed by a tornado missile, given a tornado of a certain magnitude. An EEFP is calculated for each nonconformance and vulnerability at each of the tornado categories from F2 through F6. For buildings above 30 ft, a summation of EEFPs is used due to the MIP component of the EEFP being driven in part by elevation.

The EEFP is fundamental to the TMRE because it provides the likelihood of an SSC being failed by a tornado missile. The NRC staff reviewed the EEFP, the derivation of the term, and its sensitivities. The TMRE methodology indicates that the EEFP was developed to be a conservative estimate. As such, deviations from the methodology can result in nonconservative probabilities and are not permitted by the methodology.

Robustness The fragility factor used in the EEFP determination is the conditional probability of the SSC failing to perform its function given that it is hit by a tornado missile. For the purposes of the TMRE methodology, the SSCs were assumed to always fail if hit by a tornado missile (i.e., the factor is assumed to be 1). However, as discussed previously, the TMRE methodology defines adjustment factors on the missile inventory to account for levels of target robustness to withstand missile impacts. Section 5 of the TMRE methodology includes guidance for the consideration of robust targets. Robust targets (e.g., steel pipes and tanks) are those that can only be damaged by certain types of missiles. Robust targets are subdivided into categories based on their characteristics such as the thickness of the steel or concrete used for the construction of the specific SSCs. To account for target robustness, the TMRE methodology assigns a certain fraction of the total missile inventory to be used in calculation of the EEFP for that target.

Nine categories of robust targets are defined in Table 5-2, Missile Inventories for EEFP Calculations, of the TMRE methodology, to adjust missile counts from 1 percent (very robust target, such as a reinforced concrete roof of at least 8 inches in thickness) to 55 percent (less robust target, such as a steel pipe of at least 16 inches in diameter and less than 3/8-inch thickness). Other targets not belonging to any of those nine categories were considered to be not robust, and any missile hit was assumed to fail the target (i.e., the missile count is 100 percent for these targets). An example of missile inventory adjustments to account for target robustness is presented in Table 5-3, Example Missile Inventories for Different Targets (For F6 Tornado EEFP Calculations), of the TMRE methodology. The basis for the identification of certain SSCs as robust, and the determination of the fraction of missile inventory that can damage each such SSC was provided in Appendix C, Section C.3, Approach, of the TMRE methodology. The NRC staff finds the approach for the identification of certain SSCs as robust to be acceptable for this application because the characterization appropriately captures the varying level of damage that may be caused by a tornado missile hit.

Section B.6, Missiles Affecting Robust Targets, of Appendix B to the TMRE methodology, states that the number of missiles used in the EEFP calculation could be adjusted to account for the population of missiles that could damage an SSC and provided the percentage of the total missile inventory for each type of robust target. These percentages depended on specific missile type counts taken from two plant missile inventories as shown in Tables B-15, Unrestrained Missile Inventories, B-16, Restrained Missile Inventories, and B-17, Average Missile Type Inventory, of Appendix B to the TMRE methodology. In accordance with Table 5-2 of the TMRE methodology, the Browns Ferry licensee has appropriately incorporated robustness values in EEFP calculations.

The NRC staff concludes that the licensees approach for adjusting the number of missiles for robust targets by using the robust missile data in Table 5-2 of the TMRE methodology is acceptable for this application. It has been reviewed and determined to develop conservative robust missile adjustment factors. The NRC staff further concludes that additional comparison of site-specific missile type inventories is not necessary for this application.

Failure Modes As discussed above, Section 6.5 of the TMRE methodology was added to provide guidance on the consideration and treatment of additional tornado and tornado-missile-induced failure modes for all nonconforming SSCs in the TMRE PRA model. Guidance was provided on functional failures of SSCs as well as the impact of secondary effects. The NRC staff finds that the guidance in TMRE methodology Section 6.5 adequately captures the important tornado and tornado-missile-induced failure modes for SSCs as well as their treatment in the TMRE PRA model. The NRC staff further finds that the direct impact on exposed SSCs is the dominant failure mode for this application compared to more complex failure modes (e.g., spurious closure or opening).

The TMRE methodology includes consideration of secondary failure modes in Section 3.2.3, SSC Failure Modes. It states that flooding and combustion motor intake effects caused by tornado-missile-induced failures of fluid-filled tanks and pipes should be considered as viable secondary failure modes considered in the development of the TMRE PRA.

The NRC staff reviewed the licensees approach for considering primary and secondary failure modes in the LAR, as supplemented, and finds it to be acceptable for this application because (1) the approach captures the most important secondary failure modes, (2) the licensee considered these secondary failure modes for SSCs in its TMRE PRA development, and (3) the licensee either included identified secondary failure modes in the TMRE PRA or dispositioned them appropriately.

The NRC staff also finds that the licensees process for determination of the impact of tornado missiles on targets by determining EEFPs is acceptable (i.e., evaluating the risk associated with the lack of tornado-missile protection for nonconforming SSCs), because (1) the approach is consistent with the derivation of the MIP values and, therefore, uses the MIP values appropriately; (2) the approach to defining missile inventories based on a reference radius (2,500 ft) or the target area is consistent with the original analysis in EPRI NP-768; (3) adjusting inventories to account for robustness levels is adequately justified and an acceptable first order approximation in lieu of detailed fragility analyses for this application, as targets are expected to have different levels of resilience to missile hits; and (4) the approach to estimating exposed areas, in general, tends to overestimate the area in the path of missiles, and

therefore, it is appropriate for the risk evaluations performed to support this application. The NRC staffs conclusion on acceptability of using EEFPs in risk evaluations is limited only to address the tornado-missile protection nonconforming conditions within the scope of the TMRE methodology as described in other sections of this safety evaluation.

3.4 Risk Results Review 3.4.1 Key Principle 1: Compliance with Current Regulations As a key principle of risk-informed integrated decision making, Regulatory Position 1 in RG 1.174 states that, The licensee should affirm that the proposed licensing basis change meets the current regulations unless the proposed change is explicitly related to [a requested]

exemption (i.e., a specific exemption under 10 CFR 50.12).

The licensee states, in part, in Section 4.1, Applicable Regulatory Requirements/Criteria, of the enclosure to the LAR that RG 1.174 establishes criteria to quantify the sufficiently small frequency of damage discussed in SRP Section 3.5.1.4, which allows for a probabilistic basis for relaxation of deterministic criteria for tornado-missile protection of SSCs. However, the cited SRP sections discuss the probability of occurrence of events and not the change in core damage frequency (CDF) and large early release frequency (LERF). The probabilistic criteria in SRP Section 3.5.1.4 (i.e., the probability of damage to unprotected safety-related features) is not directly comparable to RG 1.174 acceptance guidelines. In response to the June 18, 2020 RAI 10 (Reference 2), the licensee stated that this approach provides reasonable assurance of public health and safety including the environment. The licensee explained that it reached this conclusion because this methodology does not impact the consequences of a tornado event or the likelihood of a tornado, and it provides a more realistic assessment of the impact of tornado missile events.

Based on its review of the LAR and its supplements, the NRC staff finds that the proposed change continues to meet the regulations, because the design basis for the SSCs impacted by the proposed change will reflect the importance of the safety functions to be performed by those SSCs in accordance with the licensing basis, and, therefore, there is reasonable assurance that, subsequent to the proposed change, necessary safety-related SSCs will continue to be available to perform their safety functions during and following a tornado event at Browns Ferry.

The NRC staff notes that exemption from the applicable regulations was neither requested by the licensee in the application, nor is granted by the NRC staff. All applicable design requirements remain. Therefore, Key Principle 1 in risk-informed decision making is satisfied.

3.4.2 Key Principle 2: Evaluation of Defense-in-Depth Defense-in-depth is an approach to designing and operating nuclear facilities involving multiple independent and redundant layers of defense to compensate for human and system failures.

Regulatory Position 2.1.1 in RG 1.174 states that defense-in-depth consists of a number of elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

Overreliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

Independence of barriers is not degraded.

Defenses against human errors are preserved.

The intent of the plants design criteria is maintained.

In Section 3.2, Traditional Engineering Considerations, of the enclosure to the LAR, the licensee provided a discussion of how its risk-informed assessment was consistent with the defense-in-depth philosophy. The following sections provide an evaluation of each of the seven considerations.

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

In Item 1 of Section 3.2, the licensee states that the proposed change does not introduce new accidents or transients as compared to those present in the licensees internal events PRA and those analyzed during the safety analyses. In Section 2.3, Reason for the Proposed Change, of the enclosure to the LAR, the licensee identified six nonconforming conditions for Browns Ferry. Moreover, most of each system that is important to safety is protected from tornado missiles. The licensee also explained that no conditions were discovered within the scope of the proposed change that would affect containment integrity during a tornado event and that the containment would continue to provide its function as a key fission product barrier.

In response to the June 18, 2020 RAI 11 (Reference 2), the licensee explained that the Browns Ferry UFSAR safety analysis acceptance criteria described in Chapters 6 and 14 were not impacted by this proposed change. Because the analyzed events are only limited to tornado events that may initiate a design basis accident, the NRC staff finds that the impact of the proposed change is negligible. In addition to the UFSAR safety analysis credited equipment, the site also has available both on-site and near-site Diverse and Flexible Mitigation Capability (FLEX) equipment that can address safety margin.

The NRC staff notes that the proposed change does not significantly affect the availability and reliability of SSCs that mitigate accident conditions nor significantly reduce the effectiveness of the licensees emergency preparedness program. Therefore, the NRC staff finds that the proposed change continues to preserve a reasonable balance between prevention of core damage, prevention of containment failure, and consequence mitigation.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

In Item 2 of Section 3.2, the licensee states that the implementation of the proposed change does not require compensatory measures and does not change the licensees existing operating procedures. In response to the June 18, 2020 RAI 15 (Reference 2), the licensee states that

the proposed change does not rely upon proceduralized operator actions within an hour of a tornado passing that would require operators to travel into areas that are not protected from the effects of the tornado or tornado missiles. The NRC staff notes that no new operator actions developed specifically in response to the proposed change were included in the licensees risk assessment supporting the proposed change. In response to the October 22, 2020 RAI 05 (Reference 3), the licensee stated that the Browns Ferry TMRE dependency analysis was updated to reflect the removal of these actions from the internal events PRA combinations.

Therefore, the NRC staff finds that the proposed change avoids an over-reliance on programmatic activities because the proposed change does not result in human actions or compensatory measures.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

In Item 3 of Section 3.2, the licensee explained that the redundancy, independence, and diversity associated with the functions of the nonconforming SSCs are unchanged. The licensee also states that the proposed change had no impact on the availability and reliability of SSCs that could either initiate or mitigate events, except for the tornado-missile protection of the identified nonconforming SSCs, which was evaluated in the application. The licensee further states that the expected frequency of tornado strikes remains low. Additional equipment is available to mitigate the effect of tornado-missile impact, stored in protective structures. Based on the review of the LAR, as supplemented, the NRC staff finds that system redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

In Item 4 of Section 3.2, the licensee states that tornado events and missiles generated by such events represent a common-cause initiating event, which can affect multiple SSCs. The licensees risk assessment supporting the proposed change captures such impacts. The NRC staff concludes that the licensee has adequately assessed the potential for the introduction of new common-cause failure mechanisms. The proposed change is acceptable because it does not degrade defenses against potential common-cause failures and considers the impact of the potential common-cause initiator.

Independence of barriers is not degraded.

In Item 5 of Section 3.2, the licensee states that in all three units, neither the reactor fuel cladding nor any part of the reactor coolant pressure boundary is directly exposed to tornado missiles, and the containment structure is a robust tornado-missile barrier. The NRC staff finds that the proposed change is acceptable because it does not degrade any of the reactor fuel barriers.

Defenses against human errors are preserved.

In Item 6 of Section 3.2, the licensee states that Browns Ferry has procedures that prescribe actions to be taken in the event of a tornado watch or tornado warning and after a tornado has passed. Abnormal and emergency procedures include alternative actions if equipment is damaged by tornadoes. The proposed changes do not appear to create new human actions that are important to preserving the layers of defense or significantly increase mental or physical

demand on individuals responding to a tornado. Therefore, the NRC staff concludes that the proposed change preserves defenses against human error and does not introduce new human error mechanisms.

The intent of the plants design criteria is maintained.

In Item 7 of Section 3.2, the licensee states that the proposed change only affected a very small fraction of the potential target area of the system. The licensee explained that in lieu of protection for the identified nonconforming SSCs, it had analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequent effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact is known, and it was determined by the licensee to be negligible. The licensee concluded that the intent of the plants design criteria is maintained. The licensee also states that the methodology utilized to support the proposed change could not be used in the modification process for a future plant change to avoid providing tornado-missile protection.

Therefore, the NRC staff finds that the intent of the plants design criteria is maintained by the proposed change.

In summary, the NRC staff finds that the proposed change does not significantly affect the seven considerations for defense-in-depth and the proposed change preserves defense-in-depth commensurate with the expected frequency and consequence of challenges to the system resulting from the proposed change.

3.4.3 Key Principle 3: Evaluation of Safety Margins Regulatory Position 2.1.2 in RG 1.174 discusses two specific criteria that should be addressed when considering the impact of the proposed changes on safety margin, as follows:

the codes and standards or their alternatives approved for use by the NRC are met, and safety analyses acceptance criteria in the licensing basis (e.g., FSAR supporting analyses) are met or proposed revisions provide sufficient margin to account for uncertainty in the analysis and data.

Section 3.2 of the enclosure to the LAR discusses the impact of the proposed change on the safety margin. The licensee states that consensus codes and standards (e.g., ASME, Institute of Electrical and Electronics Engineers, or alternatives approved by the NRC) continue to be met and that the proposed change was not in conflict with approved codes and standards relevant to the SSCs impacted by the change. In the enclosure to the LAR, the licensee states that the safety analysis acceptance criteria were not impacted by the proposed change. The licensee states that special considerations such as single-failure criteria were not considered.

The LAR documents that only a very small fraction of available SSCs that could be used to accomplish the objective is not protected from the effects of tornado missiles, and the remaining unaffected components provide reasonable assurance the objective would be achieved. In the event exposed components of one train of safety-related equipment is affected by a tornado missile, there is reasonable assurance that opposite train equipment would be available to provide the safety function.

The NRC staff concludes that the proposed change maintains sufficient safety margin because codes and standards or their alternatives accepted for use by the NRC will continue to be met and the safety analysis acceptance criteria remain unaffected by the proposed change.

3.4.4 Key Principle 4: Change in Risk Consistent with the NRCs Safety Goal Policy Statement 3.4.4.1 PRA Acceptability The objective of the PRA acceptability review is to determine whether the plant-specific PRA used in evaluating the LAR, as supplemented, is of sufficient scope, level of detail, and technical elements for the application. The NRC staff evaluated the PRA acceptability information provided by the licensee in its tornado-missile risk evaluation LAR and supplements, including industry peer-review results against the criteria discussed in RG 1.200.

3.4.4.2 Internal Events PRA Model For each supporting requirement (SR) in the PRA Standard, there are three possible degrees of satisfaction referred to as capability categories (CC) (i.e., CC-I, CC-II, and CC-Ill), with CC-I being the minimum, CC-II considered widely acceptable, and CC-Ill indicating the maximum achievable level of detail, plant-specificity, and realism. For many SRs, the CCs are combined (e.g., the requirement for meeting CC-I is combined with CC-II) or the requirement is the same across all CCs so that the requirement is simply met or not met. For each SR, the peer review team designates one of the CCs or indicates that the SR is met or not met. According to Section 2.1, Consensus PRA Standards, of RG 1.200, Revision 2, CC-II is the level of detail that is adequate for the majority of risk-informed applications. Therefore, in general, a fact and observation (F&O) is written for any SR that is determined not to be met or does not fully satisfy CC-II of the ASME standard, consistent with RG 1.200. of the LAR provided details on Browns Ferry PRA technical adequacy. Section 4 of the enclosure state that the internal events PRA model was peer reviewed using RG 1.200 that endorses the use of the 2009 version of the PRA Standard.

The enclosure to the LAR described the peer review process for Browns Ferry internal events PRAs. The licensee stated that all upgrades to the internal events PRAs have been peer reviewed. In addition, the licensee performed a systematic review of the SRs related to development of the TMRE PRA model and determined that changes made in interim updates have not affected it.

Given the uncertainties in crediting FLEX equipment in PRA models and how they should be addressed the licensee stated in response to the October 22, 2020 RAI 07 (Reference 3), that no FLEX equipment is credited in any Browns Ferry PRA model and therefore, FLEX equipment was not credited in the TMRE PRA model.

Based on its review of the LAR, as supplemented, the NRC staff finds that the open internal events finding-level F&Os related to this application have been satisfactorily dispositioned for this application or do not affect this application. The NRC staff also finds that that the licensee has demonstrated that the internal events PRA meets the guidance in RG 1.200. Specifically, internal events PRA for Browns Ferry have been reviewed against the applicable SRs in the PRA Standard. Therefore, the NRC staff concludes that the internal events PRA model is technically acceptable for this application. Accordingly, the NRC staff finds that the licensees internal events PRA model provides an adequate basis for the development of its TMRE PRA model.

3.4.4.3 Tornado-Missile PRA Model In addition to the internal events technical elements, the details of the conversion process from the internal events PRA to the TMRE PRA was reviewed to determine that it followed industry guidance in the TMRE methodology, and to determine whether the conversion process was acceptable for this application.

Appendix D, Technical Bases for TMRE Methodology, to the TMRE methodology includes SRs at CC-II from Part 2 (internal events PRA) of the PRA Standard that have been selected specifically by the NRC staff for the application of the TMRE PRA model in assessing tornado-missile protection nonconformance risk. The selected SRs required specific consideration during the development of the TMRE model from the internal events model. The licensee listed how it conformed with the SRs in Appendix D of the TMRE methodology in Section 5.1 of of the LAR.

Section 6.1, Event Tree/Fault Tree Selection, of the TMRE methodology, states other internal initiating events besides LOOP should be reviewed to ensure a tornado event cannot cause another initiating event or impact the TMRE modeled initiator. In response to the June 18, 2020 RAI 09 (Reference 2), the licensee confirmed that the walkdowns were performed to assess potential initiating events and determined that the LOOP initiator was the only impacted internal events initiator. Based on the licensees response, the NRC staff determined that Browns Ferry adequately assessed the impact of tornado events on plant initiating events for this application.

Section 6.2, Tornado Initiating Events, of the TMRE methodology, states that for multi-unit sites, the tornado event should be assumed to result in a multi-unit LOOP used in the TMRE PRA model. The licensees LAR addressed the Browns Ferry multi-unit aspect in the IE-A10 and IE-B5 entries in Section 5.1 of Enclosure 3 of the LAR.

Based on its review, the NRC staff finds that the licensee has conformed to the above-mentioned SRs, because it has adequately considered them in the development of the TMRE PRA model from the internal events model. In addition, the NRC staff concludes that the licensee has identified key assumptions and sources of uncertainty consistent with the guidance in RG 1.200, and has adequately addressed them for this application, demonstrating that those assumptions either do not impact the decision or are addressed via the sensitivity analyses in the TMRE methodology.

As a result of its review of the LAR, as supplemented, the NRC staff concludes that the Browns Ferry TMRE PRA is acceptable for this application because (1) the internal events model which is the base for the TMRE PRA is technically acceptable, (2) the licensee has appropriately considered specific SRs that were identified as being important to the TMRE PRA development, and (3) the licensee has appropriately identified key assumptions and sources of uncertainty and has adequately dispositioned them for this application. Therefore, the NRC staff finds that the quantitative results obtained from the Browns Ferry TMRE PRA models along with appropriate sensitivity studies can be used to demonstrate that the incremental risk due to those SSCs that are not protected from tornado-generated missiles per the licensees current licensing basis meets the acceptance guidelines in RG 1.174.

3.4.4.4 Comparison Against Acceptance Guidelines Including Uncertainty and Sensitivity Analyses Compliant and Degraded Cases Section 6.3, Compliant Case and Degraded Case, of the TMRE methodology provides the guidance for creating two configurations, referred to as compliant and degraded cases, which were to be used to evaluate the change in risk associated with not providing tornado-missile protection for the nonconforming SSCs. As described in Section 6.3 of the TMRE methodology:

The Compliant Case represents the plant in full compliance with its tornado missile protection current licensing basis. Therefore, all nonconforming SSCs that were required to be protected against missiles are assumed to be so protected, even when reality determines the SSCs are not protected. In the Compliant Case, nonconforming SSCs are assumed to have no additional failure modes beyond those normally considered in the internal events PRA.

The Degraded Case represents the current configuration of the plant (i.e., configuration with nonconforming conditions with respect to the tornado missile protection current licensing basis). As such, the TMRE PRA model will include additional tornado induced failure modes for all nonconforming SSCs. The failure probabilities for those additional tornado-induced failure modes were based on EEFP calculations.

Therefore, the primary difference between the compliant and degraded cases is the treatment of the nonconforming SSCs. The NRC staff finds that the licensees approach is acceptable because it appropriately modifies the failure probabilities of affected SSCs for estimating the risk associated with the proposed change.

Section 3.3.5, Target Evaluation, of the enclosure to the LAR describes the EEFP determined and used for vulnerable SSCs for both compliant and degraded cases. These EEFP values are listed in multiple tables in this section of the LAR. However, it was unclear to the NRC staff if the Browns Ferry analysis met the requirements of Section 6.3 of the TMRE methodology. In response to the October 22, 2020 RAI 06 (Reference 3), the licensee stated that the calculated passive non-safety-related SSC EEFPs were included in both the compliant and degraded cases. The licensee confirmed that any non-Category I structure failure and associated PRA components were failed in both compliant and degraded cases. The NRC staff determined that the Browns Ferry TMRE compliant and degraded cases both incorporated the required PRA component failures.

The NRC staff finds the licensees approach for developing compliant and degraded cases acceptable, because it appropriately modifies the failure probabilities of affected SSCs associated with the proposed change and captures the residual risk from the nonconforming conditions and vulnerabilities, as well as the change in risk from the identified nonconforming conditions.

Comparison of PRA Results with Acceptance Guidelines The licensee presented the change in risk between the degraded case (i.e., current plant) in which nonconforming SSCs are modeled as vulnerable to a tornado missile and the compliant plant case in which the plant is in full compliance with its design-basis tornado-generated missile protection requirements. The approach for calculation of the change in risk captures the

incremental risk from leaving the nonconforming SSCs unprotected (i.e., in the current as-is condition).

In Table, CDF and LERF Results, in Section 3.3.8, Results, of the enclosure to the LAR, the licensee provided the following results for all three units.

Browns Ferry, Unit 1 The compliant-case CDF and LERF were 4.27x10-6/year and 8.78x10-7/year, respectively. The corresponding metrics for the degraded case were 4.27x10-6/year and 8.79x10-7/year, respectively. Consequently, the licensee reported the change in risk from the tornado-missile nonconformances as 1.77x10-9/year for CDF and 6.47x10-10/year for LERF.

Browns Ferry, Unit 2 The compliant-case CDF and LERF were 3.33x10-6/year and 7.98x10-7/year, respectively. The corresponding metrics for the degraded case were 3.33x10-6/year and 7.98x10-7/year, respectively. Consequently, the licensee reported the change in risk from the tornado-missile nonconformances as 4.93x10-10/year for CDF and 1.26x10-11/year for LERF.

Browns Ferry, Unit 3 The compliant-case CDF and LERF were 6.04x10-6/year and 8.02x10-7/year, respectively. The corresponding metrics for the degraded case were 6.05x10-6/year and 8.02x10-7/year, respectively. Consequently, the licensee reported the change in risk from the tornado-missile nonconformances as 3.31x10-9/year for CDF and 3.81x10-10/year for LERF.

Based on its review, the NRC staff finds that the licensees results meet the guidelines for very small change in risk in RG 1.174 (e.g., Region III). Per the guidance in RG 1.174, the total base CDF and LERF need not be reported for very small increases in risk.

Uncertainty and Sensitivity Analyses Regulatory Position 2, Element 2: Perform Engineering Analysis, in RG 1.174 states, in part, that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings. Regulatory Position 3, Element 3: Define Implementation and Monitoring Program, states, in part, that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations. The NRC staff had a variety of concerns regarding uncertainty and the conservatism of some parts of the methodology. Those concerns and the licensees resolution were reviewed by the NRC staff.

Section 3.3.2, Assessment of Assumptions and Approximations, of RG 1.200 states that for each application that calls upon the guide, the applicant identifies the key assumptions and approximations relevant to that application. Those assumptions and approximations were used to identify sensitivity studies as input to the decision making associated with the application.

RG 1.200 defines the terms key assumption and key source of uncertainty in the same section of the guidance.

Section 7.2, Sensitivity Analysis, of the TMRE methodology identifies certain sensitivity studies and provides guidance on their performance.

Section 7.2.1, TMRE Missile Distribution Sensitivity, of the TMRE methodology provides guidance for performing sensitivities to address uncertainties associated with highly exposed and risk-significant target with a large concentration of nearby missiles that may be underestimated. The TMRE guidance allows screening of this sensitivity if the delta risk exceeded 1x10-7/year and 1x10-8/year CDF and LERF respectively. With all three Browns Ferry units meeting these criteria this sensitivity was not performed.

Section 7.2.2, Compliant Case Conservatisms, of the TMRE methodology provides guidance for performing sensitivities to address the impact of potential compliant-case conservatisms.

This section states that the licensee would identify modeling conservatisms (accident sequence, system, and large early release SRs identified in TMRE methodology Appendix D, Technical Basis for TMRE Methodology) related to equipment failures only. The guidance further states that sensitivity analyses will be performed. The licensee stated that it would follow TMRE methodology for addressing compliant-case conservatisms.

In Section 3.3.9, Sensitivities, of the enclosure to the LAR, the licensee stated no sensitivities were required. In response to the October 22, 2020 RAI 04 (Reference 3), the licensee provided the results of compliant case conservatism sensitivity study that determined Browns Ferry was below the acceptance thresholds.

The NRC staff finds the licensees approach for addressing cases where change in risk estimates from sensitivity analyses exceed the RG 1.174 acceptance guidelines for very small change in risk in future implementation of its TMRE methodology to be acceptable because (1) it relies on refinements that are within the scope of the TMRE methodology as well as the licensees PRA model configuration control process, and (2) the relevant TMRE methodology guidance that will be followed by the licensee will require prior NRC staff approval for cases where the refinements are not sufficient to meet the acceptance guidelines of RG 1.174.

The sensitivities performed by the licensee demonstrate that the incremental risk from deciding not to protect the nonconforming SSCs against tornado-missile damage continues to remain very small per the acceptance guidelines in RG 1.174. Therefore, the NRC staff finds that the results are robust relative to the uncertainties involved because sensitivity studies have demonstrated that the NRC staffs decision would not be changed due to the uncertainties.

Based on the results from the base and sensitivity cases using the TMRE PRA, the NRC staff concludes that Key Principle 4 of risk-informed decision making is met.

3.4.5 Key Principle 5: Performance Measurement Strategies - Implementation and Monitoring Program Regulatory Position 3 in RG 1.174 states, in part, that Careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies.

This regulatory position further states that an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continue to reflect the actual reliability and availability of the SSCs evaluated.

This will ensure that the conclusions that have been drawn from the evaluation remains valid.

In Enclosure 3 of the LAR, the licensee states that administrative controls are in place to ensure that the PRA models support the application. Procedures address control of the model and associated computer files. PRA models will reflect the as-built, as-operated plant over time.

The process includes provisions for monitoring issues affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience). Risk associated with unincorporated changes will be assessed. The tornado-missile risk of nonconforming SSCs will be reevaluated when relevant factors change to ensure the continued validity of the results.

In response to the June 18, 2020 RAI 12 (Reference 2), the licensee stated that if the Browns Ferry performance monitoring program determined that the risk acceptance guideline for very small change, as defined by RG 1.174, are exceeded, sensitivity evaluations would be performed as required by NEI 17-02. The NRC staff determined that the Browns Ferry response is in accordance with the TMRE methodology because it aligns with the process described in NEI 17-02.

Browns Ferry design control programs meet 10 CFR Part 50 Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants. Section 8.1, Plant Configuration Changes, of the TMRE methodology states that Appendix B design controls will ensure that subsequent plant configuration changes are evaluated. This will include assessment of their impact on the risk basis for accepting the identified nonconforming conditions using TMRE. This section also states that licensees shall ensure that plant changes that increase the site missile burden is evaluated.

In response to the June 18, 2020 RAI 13 (Reference 2), the licensee detailed Browns Ferry processes that will ensure any changes to the facility, site tornado missiles, or PRA model to ensure an updated TMRE analysis, will be performed as required by NEI 17-02.

The enclosure to LAR Section 4.1, Applicable Regulatory Requirements/Criteria, states that the licensee has confirmed that the risk-informed change process assures that any significant permanent changes to site missile sources, such as a new building, warehouse, or laydown area, will be evaluated for impact to the TMRE basis, even if such a change is not in the purview of the site design control program.

The NRC staff concludes that the cumulative risk associated with previous nonconforming conditions that remain unprotected against tornado missiles needs to be considered in future decision making. Further, the NRC staff concludes that the licensees PRA maintenance and monitoring programs are sufficient to track the as-built, as-operated, condition of the plant and the performance of equipment that, when degraded, can affect the conclusions of the licensees risk evaluation and integrated decision making that support the change to the licensing basis.

3.5 Methodology Conclusion The NRC staff has reviewed the licensees evaluation of the risk from tornado missiles to identified nonconforming SSCs. The licensees process is consistent with the guidance in the TMRE methodology. The licensees results for tornado-missile risk from nonconforming SSCs meet the risk acceptance guidelines of RG 1.174. Therefore, the NRC staff finds that the identified SSCs that do not conform to the tornado-missile protection licensing can remain in the current condition. Specifically, the NRC staff has found that the licensees risk evaluation is based on an acceptable internal events PRA which has been subjected to a peer review process assessed against the PRA Standard and is based on a TMRE PRA that has been acceptably developed;

determines tornado-missile risk of nonconforming SSCs that results in an integrated, systematic process that reasonably reflects the current plant configuration and operating practices, and applicable plant and industry operational experience; maintains defense-in-depth and safety margin; includes evaluations that provide reasonable confidence that the risk of nonconforming tornado-missile protection is maintained and that any potential increases in CDF and LERF resulting from uncertainty in treatment are small; and includes provisions for future sensitivity studies and the periodic reviews of the tornado-missile risk of nonconforming SSCs to ensure the risk remains acceptably low.

The licensees results for tornado-missile risk include the contribution of nonconforming SSCs.

On that basis and for the reasons stated above, the NRC staff concludes that the licensees process and evaluation demonstrate that the tornado-missile risk from nonconforming SSCs is acceptably low as it meets the risk acceptance guidelines of RG 1.174.

3.6 Deviations from the TMRE Methodology The NRC staff found that the licensees implementation of the TMRE methodology, as updated, was acceptable for use to support the determination of the risk from not providing physical tornado-missile protection to legacy nonconforming SSCs (i.e., SSCs that should have such protection according to the plant-specific licensing basis but, in reality, do not).

The NRC staff notes that the licensee's approaches in addressing the following issues, which constitute deviations from the corresponding approaches in the TMRE methodology guidance, were important to the NRC staff's safety decision for this application and apply to the future use of the TMRE methodology at Browns Ferry. Specifically, NEI 17-02, Rev. 1B, Section 7.2.1, provided qualitative "considerations" and two examples of situations where qualitative factors could preclude the need to apply a higher, target-specific, MIP. As the licensee did not use those "considerations," the NRC staff did not review the acceptability of those factors as part of this application. Therefore, use of the qualitative "considerations" and examples is not considered as part of the TMRE approval for Browns Ferry.

3.7 Scope and Limitations of Application of the TMRE Methodology The TMRE methodology can only be applied to conditions where it has been discovered that tornado-missile protection consistent with the original licensing basis was not provided. The methodology cannot be used either to remove existing tornado-missile protection or to avoid providing tornado-missile protection in the plant modification process.

Section 3.4 of the enclosure to the LAR states, in part, that the TMRE methodology could be used to resolve those nonconforming conditions by revising the current licensing basis under 10 CFR 50.59, provided the acceptance criteria are satisfied, and conditions stipulated by the [NRC] staff in the safety evaluation approving the requested amendment are met. The TMRE methodology would only be applied when legacy conditions are discovered where tornado missile protection was required and not provided. It cannot be used to avoid providing tornado missile protection in the plant modification process. Therefore, future changes to the

facility requiring physical tornado-missile protection must not be evaluated using the TMRE methodology.

The licensee will need prior NRC approval should the delta-CDF or delta-LERF values during subsequent implementation by the licensee for legacy nonconforming SSCs, or any of the required sensitivity studies in the TMRE methodology exceed the acceptance guidelines for Region Ill (very small change) of RG 1.174, if the apparent change in risk cannot be reduced with refinements within the scope of the licensees approved TMRE methodology.

The NRC staff notes that all proposed changes not within the scope of the TMRE methodology as described in this safety evaluation are expected to be reviewed consistent with the criteria in 10 CFR 50.59, another governing change process identified in 10 CFR, or the plants licensing basis. Legacy nonconforming conditions within the scope of this approval may be evaluated using the licensees TMRE methodology and if the results meet the defined TMRE acceptance criteria, NRC approval need not be sought. However, such changes are still required to be reported under the requirements of 10 CFR 50.71.

3.8 Technical Conclusion Based on its review summarized in this safety evaluation, the NRC staff finds the SSCs identified in the LAR that do not conform to the current tornado-missile protection licensing basis can remain in the as-built condition. The licensee has demonstrated that these nonconforming conditions should not prevent mitigation of the potential effects of extreme winds and missiles associated with such winds. Further, the licensee has demonstrated that the proposed change ensures SSCs important to safety are designed to perform their safety functions during and following a tornado at Browns Ferry, where their design reflects the importance of the safety functions to be performed.

4.0 STATE CONSULTATION

In accordance with the NRCs regulations, the Alabama State official was notified of the proposed issuance of the amendments on March 16, 2021. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The NRC has previously issued a proposed finding that the amendments involve no significant hazards consideration in the Federal Register on July 14, 2020 (85 FR 42442), and there has been no public comment on such finding. Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The NRC has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the NRCs regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

7.0 REFERENCES

1. Barstow, J., Tennessee Valley Authority, letter to U.S. Nuclear Regulatory Commission, License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis, dated May 6, 2020 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML20127H904).

2. Polickoski, J.T., Tennessee Valley Authority, letter to U.S. Nuclear Regulatory Commission, Browns Ferry Nuclear Plant, Units 1, 2, and 3, Response to Request for Additional Information Regarding License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis, dated July 31, 2020 (ADAMS Accession No. ML20213C669).

3. Polickoski, J.T., Tennessee Valley Authority, letter to U.S. Nuclear Regulatory Commission, Browns Ferry Nuclear Plant, Units 1, 2, and 3, Response to Request for Additional Information Regarding License Amendment Request to Incorporate Tornado Missile Risk Evaluator into the Licensing Basis, dated January 29, 2021 (ADAMS Accession No. ML21029A338).

4. U.S. Nuclear Regulatory Commission Electronic Mail to Tennessee Valley Authority, "Browns Ferry Nuclear Plant, Units 1, 2, and 3 Request for Additional Information Regarding Incorporation of TMRE into the Licensing Basis," dated June 18, 2020 (ADAMS Accession No. ML20175A190).

5. U.S. Nuclear Regulatory Commission Electronic Mail to Tennessee Valley Authority, Browns Ferry Nuclear Plant, Units 1, 2, and 3 - Request for Additional Information Regarding Request to Incorporate TMRE (EPID L-2020-LLA-0099), dated October 22, 2020 (ADAMS Accession No. ML20296A378).

6. Jones, B. K., Duke Energy, letter to U.S. Nuclear Regulatory Commission, License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis

- Supplement and Request for Additional Information Response, dated September 19, 2018 (includes NEI 17-02, Revision 1B, Tornado Missile Risk Evaluator (TMRE)

Industry Guidance Document, September 2018 (ADAMS Accession No. ML18262A328).

7. U.S. Nuclear Regulatory Commission, Regulatory Issue Summary 2015-06, Tornado Missile Protection, dated June 10, 2015 (ADAMS Accession No. ML15020A419).

8. Tennessee Valley Authority, Browns Ferry Nuclear Plant Updated Final Safety Analysis Report, Amendment 26 (ADAMS Accession No. ML15295A025).

9. U.S. Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 3.5.1.4, Revision 4, Missiles Generated by Extreme Winds, dated March 2015 (ADAMS Accession No. ML14190A180).

10. U.S. Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 3.5.2, Revision 3, Structures, Systems, and Components to be Protected from Externally-Generated Missiles, dated March 2007 (ADAMS Accession No. ML070460362).

11. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 19.1, Revision 3, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load, dated September 2012 (ADAMS Accession No. ML12193A107).

12. U.S. Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 19.2, Revision 0, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, June 2007 (ADAMS Accession No. ML071700658).

13. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.76, Revision 1, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, dated March 2007 (ADAMS Accession No. ML070360253).

14. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.117, Revision 2, Protection Against Extreme Wind Events and Missiles for Nuclear Power Plants, dated July 2016 (ADAMS Accession No. ML15356A213).

15. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, Revision 3, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, dated January 2018 (ADAMS Accession No. ML17317A256).

16. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, March 2009 (ADAMS Accession No. ML090410014).

17. American Society for Mechanical Engineers/American Nuclear Society, ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 2009.

18. U.S. Atomic Energy Commission, WASH-1300, Technical Basis for Interim Regional Tornado Criteria, dated May 1974 (ADAMS Accession No. ML13073A158).

19. Pacific Northwest National Laboratory and U.S. Nuclear Regulatory Commission, NUREG/CR-4461, Revision 1, Tornado Climatology of the Contiguous United States, dated April 2005 (ADAMS Accession No. ML051080477).

20. Pacific Northwest National Laboratory and U.S. Nuclear Regulatory Commission, NUREG/CR-4461, Revision 2, Tornado Climatology of the Contiguous United States, dated February 2007 (ADAMS Accession No. ML070810400).

21. Electric Power Research Institute, EPRI NP-768, Tornado Missile Risk Analysis, May 1978.

22. Electric Power Research Institute, EPRI NP-769, Tornado Missile Risk Analysis Appendixes, May 1978.

23. Electric Power Research Institute, EPRI NP-2005, Tornado Missile Simulation and Design Methodology, August 1981.

23. Rubenstein, L. S., memorandum to Frank J. Miraglia, U.S. Nuclear Regulatory Commission, Safety Evaluation Report - Electric Power Research Institute (EPRI)

Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRA)

Methodology, dated October 26, 1983 (ADAMS Accession No. ML080870291).

24. Wermiel, J. S., memorandum to Public Document Room, U.S. Nuclear Regulatory Commission, Electric Power Research Institute Reports (EPRI N--768, 769 and 2005, Volumes 1 and 2) Concerning Tornado Missile Probabilistic Risk Assessment (PRA)

Methodology and Corresponding Safety Evaluation Report, dated November 29, 1983 (ADAMS Legacy Accession No. 8312140192).

Principal Contributor: C. Moulton, NRR Date: April 30, 2021

ML21075A076 *by e-mail OFFICE NRR/DORL/LPLII-2/PM NRR/DORL/LPLII-2/LA NRR/DRA/APLB/BC(A)

NAME MWentzel RButler SVasavada DATE 3/29/2021 3/23/2021 3/11/2021 OFFICE OGC - NLO* NRR/DORL/LPLII-2/BC NRR/DORL/LPLII-2/PM NAME ANaber DWrona MWentzel DATE 4/14/2021 4/30/2021 4/30/2021