ML18022A271

NEI 17-02 Tornado Missile Risk Evaluator (TMRE) - Resolution of NRC Staff Comments - January 18, 2018

ML18022A271
Person / Time
Site:	Nuclear Energy Institute
Issue date:	01/18/2018
From:	Nuclear Energy Institute
To:	Office of Nuclear Reactor Regulation
Brown A
References
NEI 17-02
Download: ML18022A271 (64)

Text

NEI 17-02 January 18, 2018 Tornado Missile Risk Evaluator (TMRE) -

Resolution of NRC Staff Comments

Purpose

• Resolve remaining NRC staff comments on the TMRE Guidance Document (GD) - NEI 17-02 as described in ML17235B148.

o Meeting November 8, 2017 addressed NRC comments regarding structural engineering o Meeting today will address remaining NRC comments regarding risk modeling 1

Agenda

• Introduction

• Resolution of specific NRC staff comments o PRA modeling, Missile Impact Parameter and sensitivity studies o Defense in depth and safety margin o Several deterministic topics

• Summary

• Next Steps 2

Tornado Missile Risk Evaluator

• Tornado missile protection (TMP) old design issues are of low safety significance

• Goal of TMRE to provide a simple risk assessment model to resolve TMP old design issues o Simple for the industry to apply o Simple for the NRC staff to review

• Model development began fall 2015 and was functionally completed November 2016

• Multiple public meetings with NRC staff to address TMRE model development 3

Introduction

• Comments addressed by TMRE Technical Advisory Group members and pilot plant representatives

• NEI 17-02, Revision 0 provided to NRC on June 23, 2017

• NRC July 6, 2017 public meeting to discuss comments

• NEI 17-02, Revision 1 provided to NRC on September 21, 2017

• TMRE pilot applications reference NEI 17-02, Rev 1

• NRC November 8, 2017 public meeting addressed engineering comments

• Today we should address remaining comments 4

Revision 0 to Revision 1

• Removed Sections 2, 4, 10 and Appendix F from Revision 0.

• The removal of these sections addressed questions #1.a/b, #3.a/b/c/d, and

1. 8.a/b/c.

• Added guidance to Section 5 Evaluate Target and Missile Characteristics to permit increased conservatism when developing EEFP values:

• Can use <30 ft MIP when it is difficult to determine if target is >30 ft for all missile sources.

• A higher percentage can be used for robust targets.

• Add shielding guidance in Section 5.3.2.

• Fixed several typographical and editorial errors.

• Fixed several calculation errors in Section 5, Appendix A, B, and C.

5

November 8, 2017 Public Meeting

• At the 11/8 public teleconference the industry addressed the following staff questions:

• #4.f

• #5.d/g

• #7.b

• #10.c/d

• #11.a/b/c/d/e/f/g/i

• These changes addressed several calculation errors:

• Section 5 (Tables 5-2 and 5-3)

• Appendix B (Tables B-14 thru B-18)

• Appendix C (Tables C-1, C-3, C-5, and C-14) 6

PRA TOPICS, MIP, SENSITIVITY STUDIES LEO SHANLEY - JENSEN HUGHES 7

1. 4.e - Response

• Operator actions that occur within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the tornado event, that require transit and/or action outside of protected structures, are assumed to fail with a probability of 1.0 (Section 6.4).

• Operator actions inside protected structures within the first hour are not modified (Section 6.4).

• The guidance will be updated to include additional information and justification for this treatment.

8

1. 4.e - Response

• There is currently no industry guidance available for HW HRA.

• 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is a typical time used in recent peer-reviewed HW PRAs for failing actions outside protected structures.

o Although tornado-force winds are present for a few minutes at the site, they are typically accompanied with thunderstorms, which can have extreme winds, lightning, hail, and/or heavy rainfall.

o Damage and debris will impede access to some areas.

o Post-event damage assessment will divert resources outside CR.

o Operators will generally not be dispatched outside protected structures during the event due to personnel safety concerns.

9

1. 4.e - Response

• Regardless of time frame chosen, it is clear that there is some period during/following the event that such operator actions cannot be reliably performed.

o The actual time will be different for every event, based on unique circumstances; however, a standard time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is used in TMRE (and HW PRAs).

• Conservatism (if any) in the compliant case will not lead to any significant non-conservatism in delta 10 risk calculations.

1. 6.c - Response

• No changes to HEPs are provided for in the TMRE guidance, beyond setting operator actions (one-hour or less in exposed areas) to 1.0 (per previous discussion of question 4.e).

• No changes to the guidance are proposed.

11

1. 6.c - Response

• Throughout the development of the TMRE methodology, it has been established that operator action HEPs would not be adjusted, with the exception of the external actions within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

• There is no industry guidance available for HW HRA.

• Any changes to HEPs would be applied to both compliant and degraded cases, minimizing the impact on the delta risk calculations.

12

1. 4.c and #9.a - Response

• No credit is taken in the TMRE for offsite power recovery or for SSCs dependent on offsite power.

• The guidance will be updated to include additional information and justification for this treatment.

13

1. 9.a - Response

• Current peer-reviewed HW PRAs do not consider offsite power recovery.

o Lack of data and unique event impacts make justifying non-recovery curves extremely difficult.

o Wind and/or debris damage to switchyard components or on-site transmission systems are generally difficult to fix quickly.

o Specific damage and the repairs needed to recover offsite power will be unique to every tornado event.

• Offsite power recovery data for severe weather events is sparse, and only a subset of data is from tornado events.

o 2 LOOP and 1 partial LOOP events in US since 1990.

o Recovery times are beyond normal battery capabilities, so 14 recovery not likely to mitigate SBO.

1. 9.a - Response

• The impact of not crediting offsite power recovery is expected to have a larger impact on the degraded case than the compliant case, minimizing the potential for non-conservative delta CDF/LERF o If recovery is credited, it would be included in the compliant and degraded cases.

o Need for offsite power recovery will be more important in cutsets where non-conforming SSCs (e.g., EDGs) have failed due to tornado missile damage.

15

1. 4.c - Response

• Taking credit for SSCs reliant on offsite power is more problematic.

o Many such SSCs are housed in non-Category 1 structures (e.g., turbine buildings) or outside, so likelihood of damage is higher.

o Offsite power recovery efforts will be focused on returning power to ES switchgear, not NSR power.

o System damage assessment, safety reviews, and system restoration efforts would likely be very time consuming.

• NSR systems reliant on offsite power typically do not have significant impact on CDF reduction for internal 16 event LOOP scenarios.

1. 4.c. and #9.a. - Conclusions

• 4.c. - SSCs dependent on offsite power will continue to be screened and not credited in the TMRE analysis, per the current revision of the guidance.

• 9.a. - There is insufficient data to develop a justifiable offsite power non-recovery curve for TMRE. It is not clear that a meaningful sensitivity analysis can be developed, without adding more uncertainty to the issue.

17

1. 6.a - Response

• With the exception of offsite power recovery, function-, system-, and component-specific recovery is used in a limited fashion in internal events PRAs (the basis for the TMRE PRA).

• Function-, system- and component-specific recovery or repair actions would not be expected to have been evaluated for tornado events, and thus would typically not be applicable.

• There is no intent to require additional justification of removing credit for repair or recovery.

18

1. 6.a - Response

• Supporting Requirements HR-H1 and HR-H2 in Appendix D of NEI 17-02 allow for taking credit for recovery actions as an exception.

o Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

• Not taking credit for repair and recovery provides for a simpler and more predictable analysis.

• If credit for repair and recovery were taken, it would be 19 in both the compliant and degraded cases.

1. 9.b - Response

• This question is specific to sensitivities addressing the assumption that non-Category 1 structures and exposed NSR SSCs are failed with a probability of 1.0 in both the degraded and compliant cases.

• The guidance document will be updated to:

o Refer to Section 7.2.3 for sensitivity methods for this issue.

o Section 7.2.3 will provide additional guidance on 20 appropriate sensitivity studies.

1. 9.b - Response

• The concern with setting SSCs failure probabilities to 1.0 in both degraded and compliant cases is that conservatisms in the compliant case could mask increases in risk.

o Although this may be the case, it is likely that the conservatisms will affect the degraded case more, because more SSCs are failed in the degraded case due to tornado missiles.

o The assumption itself may be realistic or only slightly conservative, depending on the SSC and the tornado intensity.

o It would NOT be reasonable to consider these SSCs to fail with 1.0 only in the degraded case, while treated differently in the 21 compliant case - this would be overly conservative

1. 5.e - Response

• Percentage of missiles considered capable of damaging robust targets or barriers are based on conservative calculations of missile damage capability.

• Most reductions in damaging missile populations are nominal (factors of 2 - 5 reduction).

• The guidance will be maintained as is, allowing licensees to use Table 5-2 missile percentages for 22 robust targets.

1. 5.e - Response

• Calculations of missile damage capabilities are conservative.

o Assume normal impact on target.

o Assumes missile velocity is at design basis speeds (equivalent to 360 mph tornado wind speeds).

o Many targets and failure modes are dominated by heavier missiles, which are unlikely to fly at lower intensity tornado wind speeds.

• Most categories provide nominal reduction in missile populations.

o Only 2x - 3x reduction in missile population for 6-of-9 23 categories (B through G).

1. 5.h - Response

• Section 5.6 provides guidance and examples of how to identify correlated targets and examples of how to treat them in the TMRE model.

• It is not possible to account for all correlated target configurations; the analyst must use the guidance and experience to identify and model correlated targets.

• The guidance cannot be prescriptive due to the countless examples of correlated targets; adequate discussion is provided for analysts to evaluate 24 correlated targets.

1. 5.h - Response

• Correlated targets are part of the HWEL, as described in Section 3.1.

• 3.2.4.f provides a discussion of correlated targets for the Vulnerable SSC Walkdown.

• Section 5.6 defines correlated targets, how to identify them, and two examples for how to model them.

• The analyst must determine whether targets are correlated and justify/document the modeling of the 25 correlation.

1. 2.b and #10.a - Response

• In design and licensing requirements, the 30 demarcation for heavier missiles is typically measured to the highest point within 1/2 mile.

• The guidance will be updated to include additional details for the analyst to identify target height with respect to the 30 demarcation, as well as the basis for 30 as the demarcation.

26

1. 2.b and #10.a - Response

• 30 feet was chosen as the elevation demarcation for MIP, based on demarcation for heavier missiles in design basis requirements (SRP 3.5.1.4 Rev 0 and RG 1.76 Rev 1).

• TORMIS sensitivities in NEI 17-02 Appendix E substantiate lower hit probabilities (and hence lower MIP values) at higher elevations with respect to grade.

• A majority of the missiles at sites start from grade or near grade levels.

o Recent missiles surveys of seven sites indicate only ~1/3rd of missiles on site are greater than 15 above grade, primarily from multi-storied structures.

• EPRI NP-768 Plant A TORMIS simulations assume uniform distribution of initial missile elevations from 5 to 50 above grade.

o A larger percentage of missiles in Plant A TORMIS simulations are injected at higher elevations than at actual sites.

o Mean missile injection elevation for Plant A TORMIS simulations is 27.5.

• Design requirements for using highest point within 2500 feet is reasonable for determining basis for target height.

27

1. 10.b - Response

• Additional justification for the MIP development will be provided in the updated guidance document 28

1. 10.b - Response

• Building 1 (Containment) is 230 feet tall, but lower portion of building is completely shielded by Buildings 2 (Aux Bldg) and 3 (Fuel Handling Bldg) o Aux Bldg is 80 feet tall and Fuel Handling Bldg is 60 feet tall, so all exposed surfaces of Building 1 are >30 above grade

• EPRI NP-768 Plant A TORMIS simulations assume uniform distribution of initial missile elevations from 5 to 50 above grade, so some missiles are within 30 of exposed surface on west (FHB) side of 29 Building 1

1. 10.b - Response

• Use of containment data in deriving <30 MIP leads to lower (less conservative) <30 MIPs

• >30 MIPs are derived in a conservative manner, since they include entire surface of all buildings, including surfaces less than 30 above grade

• TMRE methodology provides conservative tornado failure probabilities, when compared to TORMIS-based failure probabilities in RG 1.200 HW PRAs (Appendix A)

• Sensitivity case factors (2.5x and 2.75x) are significantly 30 greater than increase in MIP, if it were derived without Building 1

Aggregation of Sensitivities - Response

• Industry did not intend that sensitivity cases be aggregated and made no commitment to do so.

• Sensitivity studies are performed to understand the relative importance of an uncertainty or assumption.

o Aggregating multiple TMRE sensitivities into a single case can produce overly conservative results that do not necessarily provide any insight into the uncertainty of the issue.

o Industry has demonstrated conservative nature of TMRE 31 compared to RG 1.200 High Wind PRAs.

Aggregation of Sensitivities - Response

• The Zonal vs. Uniform sensitivity increases the failure probability of risk significant missile targets in the F4 to F6 range by a factor of 2.75 o This factor is an average of the ratio of target hit probabilities from TORMIS simulations, given a zonal vs. uniform missile distribution (Section A.7) o It was difficult to correlate the increase in hit probabilities with the location/orientation of individual targets with respect to missile concentration; an average ratio was determined

• The Missile Impact Parameter sensitivity increases the failure probability of risk significant missile targets in the F4 to F6 range by a factor of 2.5 o This factor is the ratio of the highest MIPs derived from the EPRI 32 NP-768 Plant A data (from Building #4) to the MIP derived using the average of Plant A data (Section A.6)

Aggregation of Sensitivities - Response

• The two specific sensitivities being discussed address uncertainty in the MIP values derived for TMRE.

• The sensitivity factors were developed individually; dependencies between the phenomena may not be properly accounted for, if the factors are merely combined (i.e., 2.5

• 2.75 7).

o All [risk significant] target hit probabilities are increases in the Z vs U sensitivity, regardless of their proximity or orientation to higher concentrations of missiles.

o Some percentage of highly exposed targets will not be adversely affected by missile distribution; highly exposed targets can be near areas of high, low, or average missile density.

33

1. 9.c - Response

• Additional information regarding the sensitivity study will be included in Appendix A to justify the factor developed using the TORMIS results.

34

1. 9.c - Response

• Significant time has been devoted to evaluating the results for trends and attempting to understand the anomalous results for some of the targets.

o Significant time has been spent by industry and NRC discussing the results.

• Upper and lower bounds were consistent with typical TORMIS simulations; bounds were between a factor of 2 - 3 from the mean value considering all simulations.

• Statistical tests on distributions of retained data showed better fit than considering all data.

35

1. 5.f, #5.a, #5.b - Response

• The analyst must ensure that target categorization (target type, dimensions, and failure mode) of site specific targets is bounding and/or justified

• The guidance document will be updated to address this issue to ensure adequate categorization of targets 36

1. 4.a - Response

• The guidance document will be updated to provide references to specific sections of other documents 37

RG 1.174, DEFENSE-IN-DEPTH, AND SAFETY MARGIN STEVE VAUGHN - NEI 38

1. 7.a - Response

• Section 7.3 will be revised to reference the criteria in RG 1.174.

39

1. 7.c - Response

• Section 7.5 will be revised to ensure that all seven principles of defense in depth are considered and an appropriate level of detail provided for each.

40

1. 7.d - Response

• Section 7.5 will be revised to reference the criteria in RG 1.174.

• Section 7.5 will be revised to state that relative to the changes requested, safety margins established in the licensing and design bases are described, and sufficient information should be provided to demonstrate that these margins will not be significantly reduced or exceeded by the proposed changes.

41

LICENSING BASES, SUBMERGED MISSILES, DE MINIMIS PENETRATIONS JOHN CAVES- DUKE ENERGY 42

1. 2.a - Response

• Licensing and design bases for the plant are unaffected by a LAR to use TMRE, except for conditions discovered that do not conform to the CLB. Site specific licensing and design basis criteria are used in the discovery process as well as any future plant design changes or modifications.

• TMRE is a risk-informed application, which uses realistic but conservative modeling including the spectrum of expected missiles and the effects of physical obstructions on those missiles. The risk modeling is not dependent upon the plant-specific licensing and design basis.

• A site-specific LAR to change the design and licensing bases for use in future design changes or modifications is outside the scope of the TMRE methodology.

43

1. 4.b - Response

• NEI 17-02, Rev. 1, included a proposed treatment of De Minimis penetrations, concluding they would have a negligible impact on delta-CDF/LERF conclusions.

• Harris treated three penetrations as De Minimis in the pilot LAR, and included a sensitivity study to document and justify the negligible impact.

• NRC staff commented on concerns regarding the De Minimis treatment in the discussion topics for the July 6, 2017 public meeting and in the acceptance review comments for the Harris LAR.

44

1. 4.b - Response

• Duke Energy determined that there is minimal value in documenting and having NRC review the technical justification for the De Minimis screening approach.

• Duke Energy withdrew the aspect of its LAR related to the De Minimis screening approach in letter dated January 11.

• As the De Minimis screening approach was described in NEI 17-02, Rev. 1, which was incorporated by reference into the LAR, the explicit aspects of the methodology requested to be withdrawn were attached as marked-up pages.

45

1. 4.b - Response

• Vogtle and Grand Gulf pilot LARs for TMRE were also affected, as those requested approval of the methodology which could be applied in the future in the event of future discovery of additional non-conforming conditions.

• Vogtle and Grand Gulf are also withdrawing treatment of De Minimis penetrations, as described in NEI 17-02, Rev 1, from their LARs.

• NEI will revise NEI 17-02 to remove treatment of De Minimis penetrations so it will not be in the revision submitted to the staff for endorsement.

46

Submerged Vulnerabilities

• Harris identified a vulnerability where a tornado missile could enter the water and strike a submerged safety-related component.

• This demonstrates the value of the pilot process for identifying gaps in the TMRE methodology prior to its endorsement by the staff.

• Example on next page.

47

Submerged Vulnerabilities Robust Structure Coarse Screen Traveling Screens Vulnerable Missile Path Safety through 12 of water to Related valve and 30 of water Pump to pump 48

Submerged Vulnerabilities - Proposed TMRE Treatment

• EEFP represents the failure probability of a target struck directly by a missile travelling through air.

• The MIP is the probability of a missile striking a target, per missile, per area, per tornado.

• The EEFP assumes a total number of missiles at the site, which consists of 23 different missile types (see Table 3-2 in NEI 17-02, Rev. 1 [1]).

• The EEFP assumes that if a missile traveling through the air impacts a target, the target is failed. Certain types of robust targets are only failed by a fraction of the total missile population, based on the properties of the target and missiles (see Table 5-2 in NEI 17-02).

49

Submerged Vulnerabilities - Proposed TMRE Treatment

• For an underwater target to be struck by a missile travelling through the air and water at a specific trajectory, the use of the EEFP formula per the TMRE guidance is very conservative.

• MIP is based on total number of missile hits on targets, regardless of the missile orientation, relative motion of the missile (e.g., tumbling), or speed of the missile.

• The missile must be traveling at a specific trajectory to strike an underwater target.

• The impact with and travel through the water reduces the velocity of the missile significantly.

50

Submerged Vulnerabilities - Proposed TMRE Treatment

• Characteristics of actual missiles demonstrating conservative treatment include:

• Very few, if any, tornado missiles are expected to have an optimal shape to efficiently travel through water. Cylindrical missiles could be expected to travel through the water in a reasonably straight and predictable path.

• Missiles that are tumbling or skewed relative to their trajectory will lose much more energy and travel less distance after striking the water.

• Many tornado missile types will deform or break apart after striking the water, reducing their travel distance through the water.

51

Submerged Vulnerabilities - Proposed TMRE Treatment

• Harris will supplement their LAR

• Identify additional non-conforming conditions for the submerged vulnerabilities.

• Propose a revision of the TMRE methodology to qualitatively address submerged targets.

• Provide a justification for the qualitative treatment.

• Apply the proposed methodology to the additional conditions.

52

Submerged Vulnerabilities - Proposed TMRE Treatment Following staff disposition of the Harris supplement, NEI plans to incorporate the proposed changes into NEI 17-02 when submitted for endorsement.

53

SECONDARY EFFECTS AND SPALLING CONSIDERATIONS KEN LOWERY- SOUTHERN NUCLEAR 54

1. 4.d - Response NEI 17-02 Does Not Address Secondary Effects

• Impacted SSCs do not become secondary missiles nor create a II/I type concern

• Missiles do not ricochet or disintegrate to become secondary missiles

• There are no deflections, bounces, or secondary missiles from impacted walls or deconstructed equipment, etc.

55

1. 4.d - Response It is appropriate to limit consideration of secondary effects due to:

• Reduced missile energy following initial impact

• Limited secondary missile consequences 56

1. 4.d - Response

• In conclusion, NEI 17-02 does not include consideration of the remote possibility of secondary effects because

• Damaging impacts to safety-related SSCs are already low-risk events, as shown by TMRE

• Addition of even more unlikely secondary effects are negligible

• Failure modes and effects for safety related SSCs have already been considered

• Determining the frequency of SSC failure from direct missile impact is sufficient for the TMRE analysis

• NEI 17-02 will be updated to reflect that consideration of 57 secondary effects is not required

1. 5.c - Response

• NEI 17-02, Appendix C approach is based on best-estimate of safety-significant failure modes rather than a deterministic design basis approach (which considers scabbing and spalling)

• The significant failure modes considered are perforation and panel failure at supports

• Focusing on more significant failure modes is consistent with other risk-informed approaches (e.g. seismic, aircraft impact, etc.)

58

1. 5.c - Response

• NEI 07-13, Methodology for Performing Aircraft Impact Assessments for New Plant Designs, Final, August 2008

• Appendix C approach for addressing spall/scabbing is consistent with NRC-endorsed guidance for performing beyond-design-basis aircraft impact assessments (NEI 07-13).

59

1. 5.c - Response

• Under missile impact conditions, spalling and scabbing are considered secondary effects:

o Testing has demonstrated that the concrete is ejected in small pieces with relatively low velocity, based on the observation that the ejecta tend to collect near the back surface of the reinforced concrete target. - NEI 07-13 o Tests have also clearly demonstrated that a wall liner prevents the scabbing phenomenon - NEI 07-13 60

1. 5.c - Response

• In addition to being secondary, spalling (and scabbing) effects are judged to have low-risk significance:

o Ejected concrete fragments typically small and of low-velocity (NEI 07-13); Therefore, there are limited effects away from impact location o Most concrete roof designs have steel decking, which serve as formwork; decking confines concrete and prevents back-face spalling 61

1. 11.h - Response

• NEI 17-02, Appendix C relied on the Bechtel Topical report (BC-TOP-9A, Revision 2) for concrete and steel perforation empirical equations

• Rather than design values, Appendix C is based on median (or best-estimate) values for material properties (Appendix C, Section C.3.1)

• Dynamic increase factors on material properties were also utilized, consistent with NEI 07-13

• On the basis that spalled concrete has (1) limited spatial extent, (2) small fragment size, (3) low velocity, or (4) is precluded by a steel liner, the effects of spalling (and scabbing) from concrete roof impacts are judged to have low risk significance 62

SUMMARY

NEXT STEPS 63