ML18022A271

Nuclear Energy Institute: NEI 17-02 Tornado Missile Risk Evaluator (TMRE) - Resolution of NRC Staff Comments - January 18, 2018

ML18022A271
Person / Time
Site:	Nuclear Energy Institute
Issue date:	01/18/2018
From:	Nuclear Energy Institute
To:	Office of Nuclear Reactor Regulation
Brown A
References
NEI 17-02
Download: ML18022A271 (64)

Text

January 18, 2018 NEI 17-02 Tornado Missile Risk Evaluator (TMRE)

- Resolution of NRC Staff Comments Purpose *Resolve remaining NRC staff comments on the TMRE Guidance Document (GD)

- NEI 17-02 as described in ML17235B148.

oMeeting November 8, 2017 addressed NRC comments regarding structural engineering oMeeting today will address remaining NRC comments regarding risk modeling 1

Agenda *Introduction

• Resolution of specific NRC staff comments oPRA modeling, Missile Impact Parameter and sensitivity studies oDefense in depth and safety margin oSeveral deterministic topics

• Summary *Next Steps 2

Tornado Missile Risk Evaluator

• Tornado missile protection (TMP) old design issues are of low safety significance

• Goal of TMRE to provide a simple risk assessment model to resolve TMP old design issues oSimple for the industry to apply oSimple for the NRC staff to review

• Model development began fall 2015 and was functionally completed November 2016

• Multiple public meetings with NRC staff to address TMRE model development 3

Introduction

• Comments addressed by TMRE Technical Advisory Group members and pilot plant representatives

• NEI 17-02, Revision 0 provided to NRC on June 23, 2017 *NRC July 6, 2017 public meeting to discuss comments

• NEI 17-02, Revision 1 provided to NRC on September 21, 2017 *TMRE pilot applications reference NEI 17-02, Rev 1 *NRC November 8, 2017 public meeting addressed engineering comments

• Today we should address remaining comments 4

• Removed Sections 2, 4, 10 and Appendix F from Revision 0.

• The removal of these sections addressed questions #1.a/b, #3.a/b/c/d, and #8.a/b/c. *Added guidance to Section 5 "Evaluate Target and Missile Characteristics" to permit increased conservatism when developing EEFP values:

• Can use <30 ft MIP when it is difficult to determine if target is >30 ft for all missile sources.

• A higher percentage can be used for robust targets.

• Add shielding guidance in Section 5.3.2.

• Fixed several typographical and editorial errors.

• Fixed several calculation errors in Section 5, Appendix A, B, and C.

Revision 0 to Revision 1 5

• At the 11/8 public teleconference the industry addressed the following staff questions:

• 1. 4.f *#5.d/g *#7.b *#10.c/d *#11.a/b/c/d/e/f/g/

i *These changes addressed several calculation errors:

• Section 5 (Tables 5

-2 and 5-3) *Appendix B (Tables B

-14 thru B-18) *Appendix C (Tables C

-1, C-3, C-5, and C-14) November 8, 2017 Public Meeting 6

PRA TOPICS, MIP, SENSITIVITY STUDIES LEO SHANLEY - JENSEN HUGHES 7

1. 4.e - Response *Operator actions that occur within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the tornado event, that require transit and/or action outside of protected structures, are assumed to fail with a probability of 1.0 (Section 6.4).

• Operator actions inside protected structures within the first hour are not modified (Section 6.4).

• The guidance will be updated to include additional information and justification for this treatment.

8

1. 4.e - Response *There is currently no industry guidance available for HW HRA. *1 hour is a typical time used in recent peer

-reviewed HW PRAs for failing actions outside protected structures.

oAlthough tornado

-force winds are present for a few minutes at the site, they are typically accompanied with thunderstorms, which can have extreme winds, lightning, hail, and/or heavy rainfall.

oDamage and debris will impede access to some areas. oPost-event damage assessment will divert resources outside CR.

oOperators will generally not be dispatched outside protected structures during the event due to personnel safety concerns.

9

1. 4.e - Response *Regardless of time frame chosen, it is clear that there is some period during/following the event that such operator actions cannot be reliably performed.

o The actual time will be different for every event, based on unique circumstances; however, a standard time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is used in TMRE (and HW PRAs). *Conservatism (if any) in the compliant case will not lead to any significant non

-conservatism in delta risk calculations.

10

1. 6.c - Response *No changes to HEPs are provided for in the TMRE guidance, beyond setting operator actions (one-hour or less in exposed areas) to 1.0 (per previous discussion of question 4.e

). *No changes to the guidance are proposed.

11

1. 6.c - Response *Throughout the development of the TMRE methodology, it has been established that operator action HEPs would not be adjusted, with the exception of the external actions within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

• There is no industry guidance available for HW HRA. *Any changes to HEPs would be applied to both compliant and degraded cases, minimizing the impact on the delta risk calculations.

12

1. 4.c and #9.a

- Response *No credit is taken in the TMRE for offsite power recovery or for SSCs dependent on offsite power.

• The guidance will be updated to include additional information and justification for this treatment.

13

1. 9.a - Response *Current peer

-reviewed HW PRAs do not consider offsite power recovery. oLack of data and unique event impacts make justifying non

-recovery curves extremely difficult.

oWind and/or debris damage to switchyard components or on-site transmission systems are generally difficult to fix quickly. oSpecific damage and the repairs needed to recover offsite power will be unique to every tornado event.

• Offsite power recovery data for severe weather events is sparse, and only a subset of data is from tornado events.

o2 LOOP and 1 partial LOOP events in US since 1990.

oRecovery times are beyond normal battery capabilities, so recovery not likely to mitigate SBO.

14

1. 9.a - Response *The impact of not crediting offsite power recovery is expected to have a larger impact on the degraded case than the compliant case, minimizing the potential for non-conservative delta CDF/LERF oIf recovery is credited, it would be included in the compliant and degraded cases.

oNeed for offsite power recovery will be more important in cutsets where non-conforming SSCs (e.g., EDGs) have failed due to tornado missile damage.

15

1. 4.c - Response *Taking credit for SSCs reliant on offsite power is more problematic.

oMany such SSCs are housed in non

-Category 1 structures (e.g., turbine buildings) or outside, so likelihood of damage is higher.

oOffsite power recovery efforts will be focused on returning power to ES switchgear, not NSR power.

oSystem damage assessment, safety reviews, and system restoration efforts would likely be very time consuming.

• NSR systems reliant on offsite power typically do not have significant impact on CDF reduction for internal event LOOP scenarios.

16

1. 4.c. and #9.a.

- Conclusions

• 4.c. - SSCs dependent on offsite power will continue to be screened and not credited in the TMRE analysis, per the current revision of the guidance. *9.a. - There is insufficient data to develop a justifiable offsite power non

-recovery curve for TMRE. It is not clear that a meaningful sensitivity analysis can be developed, without adding more uncertainty to the issue.

17

1. 6.a - Response *With the exception of offsite power recovery, function-, system-, and component

-specific recovery is used in a limited fashion in internal events PRAs (the basis for the TMRE PRA).

• Function-, system- and component

-specific recovery or repair actions would not be expected to have been evaluated for tornado events, and thus would typically not be applicable.

• There is no intent to require additional justification of removing credit for repair or recovery.

18

1. 6.a - Response *Supporting Requirements HR

-H1 and HR-H2 in Appendix D of NEI 17

-02 allow for taking credit for recovery actions as an exception.

oDo not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

• Not taking credit for repair and recovery provides for a simpler and more predictable analysis.

• If credit for repair and recovery were taken, it would be in both the compliant and degraded cases.

19

1. 9.b - Response *This question is specific to sensitivities addressing the assumption that non

-Category 1 structures and exposed NSR SSCs are failed with a probability of 1.0 in both the degraded and compliant cases.

• The guidance document will be updated to:

oRefer to Section 7.2.3 for sensitivity methods for this issue. oSection 7.2.3 will provide additional guidance on appropriate sensitivity studies.

20

1. 9.b - Response *The concern with setting SSCs failure probabilities to 1.0 in both degraded and compliant cases is that conservatisms in the compliant case could mask increases in risk.

oAlthough this may be the case, it is likely that the conservatisms will affect the degraded case more, because more SSCs are failed in the degraded case due to tornado missiles. oThe assumption itself may be realistic or only slightly conservative, depending on the SSC and the tornado intensity.

oIt would NOT be reasonable to consider these SSCs to fail with 1.0 only in the degraded case, while treated differently in the compliant case

- this would be overly conservative 21

1. 5.e - Response *Percentage of missiles considered capable of damaging robust targets or barriers are based on conservative calculations of missile damage capability.

• Most reductions in damaging missile populations are nominal (factors of 2

- 5 reduction).

• The guidance will be maintained as is, allowing licensees to use Table 5

-2 missile percentages for robust targets.

22

1. 5.e - Response *Calculations of missile damage capabilities are conservative.

oAssume normal impact on target. oAssumes missile velocity is at design basis speeds (equivalent to 360 mph tornado wind speeds

). oMany targets and failure modes are dominated by heavier missiles, which are unlikely to fly at lower intensity tornado wind speeds.

• Most categories provide nominal reduction in missile populations.

oOnly 2x - 3x reduction in missile population for 6

-of-9 categories (B through G

). 23

1. 5.h - Response *Section 5.6 provides guidance and examples of how to identify correlated targets and examples of how to treat them in the TMRE model.

• It is not possible to account for all correlated target configurations; the analyst must use the guidance and experience to identify and model correlated targets.

• The guidance cannot be prescriptive due to the countless examples of correlated targets; adequate discussion is provided for analysts to evaluate correlated targets.

24

1. 5.h - Response *Correlated targets are part of the HWEL, as described in Section 3.1.

• 3.2.4.f provides a discussion of correlated targets for the Vulnerable SSC Walkdown. *Section 5.6 defines correlated targets, how to identify them, and two examples for how to model them.

• The analyst must determine whether targets are correlated and justify/document the modeling of the correlation.

25

1. 2.b and #10.a

- Response *In design and licensing requirements, the 30' demarcation for heavier missiles is typically measured to the highest point within 1/2 mile.

• The guidance will be updated to include additional details for the analyst to identify target height with respect to the 30' demarcation, as well as the basis for 30' as the demarcation.

26

1. 2.b and #10.a

- Response *30 feet was chosen as the elevation demarcation for MIP, based on demarcation for heavier missiles in design basis requirements (SRP 3.5.1.4 Rev 0 and RG 1.76 Rev 1).

• TORMIS sensitivities in NEI 17

-02 Appendix E substantiate lower hit probabilities (and hence lower MIP values) at higher elevations with respect to grade.

• A majority of the missiles at sites start from grade or near grade levels.

oRecent missiles surveys of seven sites indicate only ~1/3rd of missiles on site are greater than 15' above grade, primarily from multi

-storied structures.

• EPRI NP-768 Plant A TORMIS simulations assume uniform distribution of initial missile elevations from 5' to 50' above grade.

oA larger percentage of missiles in Plant A TORMIS simulations are injected at higher elevations than at actual sites.

oMean missile injection elevation for Plant A TORMIS simulations is 27.5'.

• Design requirements for using highest point within 2500 feet is reasonable for determining basis for target height.

27

1. 10.b - Response *Additional justification for the MIP development will be provided in the updated guidance document 28

1. 10.b - Response *Building 1 (Containment) is 230 feet tall, but lower portion of building is completely shielded by Buildings 2 (Aux Bldg) and 3 (Fuel Handling Bldg) oAux Bldg is 80 feet tall and Fuel Handling Bldg is 60 feet tall, so all exposed surfaces of Building 1 are >30' above grade

• EPRI NP-768 Plant A TORMIS simulations assume uniform distribution of initial missile elevations from 5' to 50' above grade, so some missiles are within 30' of exposed surface on west (FHB) side of Building 1 29

1. 10.b - Response *Use of containment data in deriving <30' MIP leads to lower (less conservative) <30' MIPs

• >30' MIPs are derived in a conservative manner, since they include entire surface of all buildings, including surfaces less than 30' above grade

• TMRE methodology provides conservative tornado failure probabilities, when compared to TORMIS

-based failure probabilities in RG 1.200 HW PRAs (Appendix A)

• Sensitivity case factors (2.5x and 2.75x) are significantly greater than increase in MIP, if it were derived without Building 1 30 Aggregation of Sensitivities

- Response *Industry did not intend that sensitivity cases be aggregated and made no commitment to do so.

• Sensitivity studies are performed to understand the relative importance of an uncertainty or assumption

. oAggregating multiple TMRE sensitivities into a single case can produce overly conservative results that do not necessarily provide any insight into the uncertainty of the issue. oIndustry has demonstrated conservative nature of TMRE compared to RG 1.200 High Wind PRAs

. 31 Aggregation of Sensitivities

- Response *The Zonal vs. Uniform sensitivity increases the failure probability of risk significant missile targets in the F'4 to F'6 range by a factor of 2.75 oThis factor is an average of the ratio of target hit probabilities from TORMIS simulations, given a zonal vs. uniform missile distribution (Section A.7) oIt was difficult to correlate the increase in hit probabilities with the location/orientation of individual targets with respect to missile concentration; an average ratio was determined

• The Missile Impact Parameter sensitivity increases the failure probability of risk significant missile targets in the F'4 to F'6 range by a factor of 2.5 oThis factor is the ratio of the highest MIPs derived from the EPRI NP-768 Plant A data (from Building #4) to the MIP derived using the average of Plant A data (Section A.6) 32 Aggregation of Sensitivities

- Response *The two specific sensitivities being discussed address uncertainty in the MIP values derived for TMRE.

• The sensitivity factors were developed individually; dependencies between the phenomena may not be properly accounted for, if the factors are merely combined (i.e., 2.5 * ). oAll [risk significant] target hit probabilities are increases in the Z vs U sensitivity, regardless of their proximity or orientation to higher concentrations of missiles. oSome percentage of highly exposed targets will not be adversely affected by missile distribution; highly exposed targets can be near areas of high, low, or average missile density. 33

1. 9.c - Response *Additional information regarding the sensitivity study will be included in Appendix A to justify the factor developed using the TORMIS results. 34

1. 9.c - Response *Significant time has been devoted to evaluating the results for trends and attempting to understand the anomalous results for some of the targets.

oSignificant time has been spent by industry and NRC discussing the results.

• Upper and lower bounds were consistent with typical TORMIS simulations; bounds were between a factor of 2 - 3 from the mean value considering all simulations.

• Statistical tests on distributions of retained data showed better fit than considering all data. 35

1. 5.f, #5.a, #5.b

- Response *The analyst must ensure that target categorization (target type, dimensions, and failure mode) of site specific targets is bounding and/or justified

• The guidance document will be updated to address this issue to ensure adequate categorization of targets 36

1. 4.a - Response *The guidance document will be updated to provide references to specific sections of other documents 37 RG 1.174, DEFENSE

-IN-DEPTH, AND SAFETY MARGIN STEVE VAUGHN

- NEI 38

1. 7.a - Response *Section 7.3 will be revised to reference the criteria in RG 1.174. 39

1. 7.c - Response *Section 7.5 will be revised to ensure that all seven principles of defense in depth are considered and an appropriate level of detail provided for each.

40

1. 7.d - Response *Section 7.5 will be revised to reference the criteria in RG 1.174. *Section 7.5 will be revised to state that relative to the changes requested, safety margins established in the licensing and design bases are described, and sufficient information should be provided to demonstrate that these margins will not be significantly reduced or exceeded by the proposed changes.

41 LICENSING BASES, SUBMERGED MISSILES, DE MINIMIS PENETRATIONS JOHN CAVES

- DUKE ENERGY 42

1. 2.a - Response *Licensing and design bases for the plant are unaffected by a LAR to use TMRE, except for conditions discovered that do not conform to the CLB. Site specific licensing and design basis criteria are used in the discovery process as well as any future plant design changes or modifications. *TMRE is a risk-informed application, which uses realistic but conservative modeling including the spectrum of expected missiles and the effects of physical obstructions on those missiles. The risk modeling is not dependent upon the plant

-specific licensing and design basis.

• A site-specific LAR to change the design and licensing bases for use in future design changes or modifications is outside the scope of the TMRE methodology.

43

• NEI 17-02, Rev. 1, included a proposed treatment of De Minimis penetrations, concluding they would have a negligible impact on delta-CDF/LERF conclusions.

• Harris treated three penetrations as De Minimis in the pilot LAR, and included a sensitivity study to document and justify the negligible impact.

• NRC staff commented on concerns regarding the De Minimis treatment in the discussion topics for the July 6, 2017 public meeting and in the acceptance review comments for the Harris LAR. #4.b - Response 44

• Duke Energy determined that there is minimal value in documenting and having NRC review the technical justification for the De Minimis screening approach.

• Duke Energy withdrew the aspect of its LAR related to the De Minimis screening approach in letter dated January 11.

• As the De Minimis screening approach was described in NEI 17

-02, Rev. 1, which was incorporated by reference into the LAR, the explicit aspects of the methodology requested to be withdrawn were attached as marked

-up pages.

1. 4.b - Response 45

• Vogtle and Grand Gulf pilot LARs for TMRE were also affected, as those requested approval of the methodology which could be applied in the future in the event of future discovery of additional non-conforming conditions.

• Vogtle and Grand Gulf are also withdrawing treatment of De Minimis penetrations, as described in NEI 17

-02, Rev 1, from their LARs.

• NEI will revise NEI 17

-02 to remove treatment of De Minimis penetrations so it will not be in the revision submitted to the staff for endorsement.

1. 4.b - Response 46

• Harris identified a vulnerability where a tornado missile could enter the water and strike a submerged safety

-related component.

• This demonstrates the value of the pilot process for identifying gaps in the TMRE methodology prior to its endorsement by the staff. *Example on next page.

Submerged Vulnerabilities 47 Submerged Vulnerabilities Safety Related Pump Vulnerable Missile Path through 12' of water to valve and 30' of water to pump Coarse Screen Traveling Screens Robust Structure 48

• EEFP represents the failure probability of a target struck directly by a missile travelling through air.

• The MIP is the probability of a missile striking a target, per missile, per area, per tornado.

• The EEFP assumes a total number of missiles at the site, which consists of 23 different missile types (see Table 3

-2 in NEI 17

-02, Rev. 1 [1]).

• The EEFP assumes that if a missile traveling through the air impacts a target, the target is failed. Certain types of "robust" targets are only failed by a fraction of the total missile population, based on the properties of the target and missiles (see Table 5

-2 in NEI 17

-02). Submerged Vulnerabilities

- Proposed TMRE Treatment 49

• For an underwater target to be struck by a missile travelling through the air and water at a specific trajectory, the use of the EEFP formula per the TMRE guidance is very conservative.

• MIP is based on total number of missile hits on targets, regardless of the missile orientation, relative motion of the missile (e.g., tumbling), or speed of the missile.

• The missile must be traveling at a specific trajectory to strike an underwater target.

• The impact with and travel through the water reduces the velocity of the missile significantly.

Submerged Vulnerabilities

- Proposed TMRE Treatment 50

• Characteristics of actual missiles demonstrating conservative treatment include:

• Very few, if any, tornado missiles are expected to have an optimal shape to efficiently travel through water. Cylindrical missiles could be expected to travel through the water in a reasonably straight and predictable path.

• Missiles that are tumbling or skewed relative to their trajectory will lose much more energy and travel less distance after striking the water. *Many tornado missile types will deform or break apart after striking the water, reducing their travel distance through the water.

Submerged Vulnerabilities

- Proposed TMRE Treatment 51

• Harris will supplement their LAR

• Identify additional non

-conforming conditions for the submerged vulnerabilities.

• Propose a revision of the TMRE methodology to qualitatively address submerged targets.

• Provide a justification for the qualitative treatment.

• Apply the proposed methodology to the additional conditions.

Submerged Vulnerabilities

- Proposed TMRE Treatment 52 Following staff disposition of the Harris supplement, NEI plans to incorporate the proposed changes into NEI 17

-02 when submitted for endorsement.

Submerged Vulnerabilities

- Proposed TMRE Treatment 53 SECONDARY EFFECTS AND SPALLING CONSIDERATIONS KEN LOWERY- SOUTHERN NUCLEAR 54 NEI 17-02 Does Not Address Secondary Effects

• Impacted SSCs do not become secondary missiles nor create a II/I type concern

• Missiles do not ricochet or disintegrate to become secondary missiles

• There are no deflections, bounces, or secondary missiles from impacted walls or deconstructed equipment, etc.

1. 4.d - Response 55 It is appropriate to limit consideration of secondary effects due to: *Reduced missile energy following initial impact

• Limited secondary missile consequences

1. 4.d - Response 56

• In conclusion, NEI 17

-02 does not include consideration of the remote possibility of secondary effects because

• Damaging impacts to safety

-related SSCs are already low

-risk events, as shown by TMRE

• Addition of even more unlikely secondary effects are negligible

• Failure modes and effects for safety related SSCs have already been considered

• Determining the frequency of SSC failure from direct missile impact is sufficient for the TMRE analysis *NEI 17-02 will be updated to reflect that consideration of secondary effects is not required

1. 4.d - Response 57

1. 5.c - Response *NEI 17-02, Appendix C approach is based on best

-estimate of safety-significant failure modes rather than a deterministic design basis approach (which considers scabbing and spalling)

• The significant failure modes considered are perforation and panel failure at supports

• Focusing on more significant failure modes is consistent with other risk

-informed approaches (e.g. seismic, aircraft impact, etc.) 58

1. 5.c - Response *Appendix C approach for addressing spall/scabbing is consistent with NRC-endorsed guidance for performing beyond

-design-basis aircraft impact assessments (NEI 07

-13). *NEI 07-13, Methodology for Performing Aircraft Impact Assessments for New Plant Designs, Final, August 2008 59

1. 5.c - Response *Under missile impact conditions, spalling and scabbing are considered secondary effects:

o"Testing has demonstrated that the concrete is ejected in small pieces with relatively low velocity, based on the observation that the ejecta tend to collect near the back surface of the reinforced concrete target." - NEI 07-13 o"Tests have also clearly demonstrated that a wall liner prevents the scabbing phenomenon

" - NEI 07-13 60

1. 5.c - Response *In addition to being secondary, spalling (and scabbing) effects are judged to have low

-risk significance:

oEjected concrete fragments typically small and of low

-velocity (NEI 07-13); Therefore, there are limited effects away from impact location oMost concrete roof designs have steel decking, which serve as formwork; decking confines concrete and prevents back

-face spalling 61

• NEI 17-02, Appendix C relied on the Bechtel Topical report (BC

-TOP-9A, Revision 2) for concrete and steel perforation empirical equations *Rather than design values, Appendix C is based on median (or best-estimate) values for material properties (Appendix C, Section C.3.1)

• Dynamic increase factors on material properties were also utilized, consistent with NEI 07

-13 *On the basis that spalled concrete has (1) limited spatial extent, (2) small fragment size, (3) low velocity, or (4) is precluded by a steel liner, the effects of spalling (and scabbing) from concrete roof impacts are judged to have low risk significance

1. 11.h - Response 62

SUMMARY

& NEXT STEPS 63