GNRO-2017/00061, License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into Licensing Basis

From kanterella
Revision as of 05:45, 6 May 2019 by StriderTol (talk | contribs) (Created page by program invented by StriderTol)
Jump to navigation Jump to search

License Amendment Request to Incorporate Tornado Missile Risk Evaluator Into Licensing Basis
ML17307A440
Person / Time
Site: Grand Gulf Entergy icon.png
Issue date: 11/03/2017
From: Larson E A
Entergy Operations
To:
Document Control Desk, Office of Nuclear Reactor Regulation
References
GNRO-2017/00061
Download: ML17307A440 (103)
v • d • e


Text

          • *.* ....... **.* . . . . . . . . . . . . . . . . . . . . . . . . * * .\ *-*-*E* * ...
  • t. . .. * * . .. * ...... *---*** n.ergy* . . : GNRQ.:.2017/00061 November 3, 2017 :_ . U.S. Nuclear Regulatory Commission
    • ATTN: Document Control* Desk * . *: 11555. Ro*ckville Pike : . Rockville, MD 20852 .
  • Entergy Operations, Inc. . * * *. P.o: Box 756 "' Port Gibson,.MS 39150 . *Eric A. Larson . ' *: Site Vice President Grand Gulf Nuclear Station . Tel. (601) 437-7500.

SUBJECT:

\ . \ . : into:Licensing Basis. Docket No. 50-416 . . . . . . . *.

  • License No: NPF~29 *. * : Ladies* and Gentlemen: * * :.Pursuant to 10 CFR 50'.90; Entergy Operations, Inc. (Entergy), hereby submits a License . * ., Amendment Request (LAR) for the Grand Gulf Nuclear Station, Unit 1 (GGNS), to incorporate:
  • Analysis Report. The TMRE methodology_

was transmitted to the NRC by the Nuclear Energy * :.Institute as NEi, 1.7-02, Revision 1 on September 21, 2017, and is incorporated by reference

  • * . * :
  • into this LAR. The TMRE methodology is proposed as a means of complying with ,licensing
  • *. basis requirements tor torn8do missile protection requirements. . . . . . . . . . . . . . . . . . . . . * * *.ThisLARis one of three pilot LARs supporting NRC*approval of the TMRE methodology

.. * * : Approval of the LAR isrequested within six months of NRC staff acceptance to* support

  • utilization of the methodology by othe(licensees.

Once approved, the:ameridn,entshall be*

  • implemented withiri 90 days. This~LAR containsno Regulatory Commitments.
In accordance with 1 o CFR 50.91, Entergy is notifying the State of Mississippi of this LAR by . : '* tra:nsmitting a copy ()f this letter and enclosure to the designated State Official. . *
  • GNR0-2017/00061 P.age 2 of 3 Should you have any questions concerning the content of this letter, please contact Douglas Neve, Manager Regulatory Assurance at 601-437-2103.
  • I declare under penalty of perjury that the foregoing is true and correct. :Executed on November 3, 2017. Sincerely, Eric A. Larson Site Vice President . EAUamh

Enclosure:

Evaluation of the Proposed Changes Attachments:

1. Updated Final Safety Analysis Report Markups. 2. Probabilistic Risk Assessment Technical Adequacy Documentation GNR0-2017/00061 Page 3 of 3 cc: with Attachments and Enclosure Mr. Siva Lingam U.S. Nuclear Regulatory Commission Mail Stop OWFN 8 81 Rockville, MD 20852-2738 cc: without Attachments and Enclosure Mr. Scott Morris U.S. Nuclear Regulatory Commission Regional Administrator, Region IV 1600 East Lamar Boulevard Arlington, TX 76011-4511 NRG Senior Resident Inspector Grand Gulf Nuclear Station Port Gibson, MS 39150 *Dr. Mary Currier, M.D., M.P.H State Health Officer Mississippi Department of Health P.O. Box 1700 Jackson, MS 39215-1700 Email: mary.currier@msdh.ms.gov GNR0-2017/00061 Grand Gulf Nuclear Station, Unit No. 1 Docket No. 50-416 I License No. NPF~29 License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis ENCLOSURE:

Evaluation of the Proposed Changes 1.

SUMMARY

DESCRIPTION

2. DETAILED DESCRIPTION 2.1. Background Information 2.2. Current Licensing Basis Requirements 2.3. Reason for the Proposed Change 2.4. Description of the Proposed Change 3. TECHNICAL EVALUATION . 3.LTornado Missile Risk Evaluator Methodology 3.2. Traditional Engineering Considerations 3~3. Risk Assessment
  • 3.4. Conclusions
4. REGULATORY EVALUATION 4.1. Applicable Regulatory Requirements/Criteria 4.2. No Significant Hazards Consideration Determination 4.3. Conclusions
5. ENVIRONMENTALCONSIDERATION
6. REFERENCES ATTACHMENTS:
3. Updated Final Safety Analysis Report Markups. 4. Probabilistic Risk Assessment Technical Adequacy Documentation I .. Enclosure to GNR0-2017/00061 Page 1 of 26 1.

SUMMARY

DESCRIPTION Pursuant to 1 O CFR 50.90, Entergy Operations, Inc. (Entergy), hereby submits a License Amendment Request (LAA) for the Grand Gulf Nuclear Station, Unit 1 (GGNS), to incorporate the Tornado Missile Risk Evaluator (TMRE) methodology into the GGNS Updated Final Safety Analysis Report. The TMRE methodology was transmitted to the Nuclear Regulatory Commission (NRC) by the Nuclear Energy Institute (NEI) as NEI 17-02, Revision 1 (ADAMS Accession No. ML 17268A036), and is incorporated by reference into this LAA. The TMRE . methodology is proposed as a means for determining whether physical protection from generated missiles is warranted.

The methodology can only be applied to discovered conditions where tornado missile protection should be provided and is not currently provided.

Future modifications to the facility requiring tornado missile protection would not be evaluated using the TMRE methodology.

2. Detailed Description 2.1 Background Information The NRC issued Regulatory Issue Summary (RIS) 2015-06, Tornado Missile Protection, on June 10, 2015 (ADAMS Accession No. ML 15020A419).

The RIS documented the following:

Systems, structures, and components (SSCs) of nuclear power plants are designed to withstand natural phenomena such as earthquakes, tornadoes, hurricanes, and floods without the loss of capability to safely maintain the plant. In general, the design bases for these structures, systems, and components reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time 'in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena, and (3) the importance of the safety functions to be performed.

The specific criteria for each nuclear power plant are contained in the individual plant's specific licensing basis. In the late 1970s and early 1980s several licensees identified components that did not conform to their plant specific licensing basis for tornado-generated missile protection.

Examples of nonconforming items included components not located inside structures designed to protect against tornados and tornado-generated missiles, components not provided with tornado missile barriers, and components not designed to withstand tornados and tornado missiles.

Topical reports were submitted by the Electric Power Research Institute (EPRI) for NRC review of the probability-based TORMIS

  • methodology.

The TORMIS methodology determines the probability of components being struck and disabled by a tornado-generated missile, and was accepted for use by the NRC. In cases where some components were not in conformance with a plant's licensing basis, licensees used the TORMIS methodology as a means for demonstrating that the probability of these components being struck by a tornado-generated missile was low enough to justify that protection from tornado-generated missiles was not required.

Several licensees have incorporated the TORMIS methodology, or other probabilistic methodologies, into their plant specific licensing basis. I Enclosure to GNR0-2017/00061 Page2 of 26 The Nuclear Energy Institute (NEI) developed another risk-informed methodology for identifying . and evaluating the safety significance associated with structures, systems and components (SSCs) that are exposed to potential tornado-generated missiles.

The TMRE methodology is an alternative methodolog*y for determining whether protection from tornado-generated missiles is required.

The methodology can only *be applied to discovered conditions where tornado missile protection should be provided and is not currently provided.

Future modification$

to the facility requiring tornado missile protection would not be evaluated using the TMRE methodology.

2.2 Current Licensing Basis (CLB) General Design Criteria GGNS was designed to meet the General .O.esign Crite.riq (GDC) iri 1 O CFR 50, Appendix A. The GGNS design basis protects its structures, systems ~nd components (SSC) against certain tornado-generated missiles which were determined to be bounding cases. These bounding missiles, and the criteri~ for .determining that these missiles were bounding, were evaluated and approved t>y the NRC during the original licensing review. GGNS received its Safety Evaluation Report (NUHEG 0831) in June 1981. The NRC foun,d that these bounding *assumptions provide reasonable assurance that the safety function of SSCs requJred for shutdown at GGNS will not be imP,aired by missiles and that GGNS's approach to tornado missile protection complies with

  • GDC 2 and 4. , Grand Gulf Nuclear Station Safety Evaluation Report NRC staff issued.NUREG 0831, Grand Gulf Nuclear Station Safety Evaluation Repe>rt, to document the scope of their review during the initial licensing process. Excerpts*

relevant to tornado mi$sile protection from NUREG 0831 include:

  • Section 3.5.1 *
  • The tornado missile spectrum was reviewed in accordance with :SAP, 3:5.1.4 (NU REG"'.' 0800). Conformance with the acceptance criteria formed the basis for the staff .. evaluation of the tornado-missile spectrum with respect to the applicable regulations of 10 CFR 50. . ... * .* The applicant has identified all safety-related structures, systems, and components requiring protection from externally generated missiles.

AU safety-related structures are designed to withstand postulated tornado-generated missiles without damage to the safety-related equipment they contain. * (

Enclosure to GNR0~2017/00061 Page 3 of 26 Section 3.5.2 -* The applicant has identified all safety-related structures, systems, and components requiring protection from externally generated missiles.

All safety-related structures are designed to.withstand postulated tornado-generated missiles without damage to the safety-related equipment they contain. All safety-related systems and components and stored fuel are located within tornado-missile-protected structures or are provided with tornado-missile barriers.

Buried safety-related systems such as piping and electrical circuits are protected by the overlaying earth.

  • Based on the above, the staff concludes that the applicant's list of safety-related structures, systems, and components to be protected from externally generated missiles and the provisions in the plant design providing this protection are in accordance with . the requirements of GDC 2 and 4 with respect to missile*and environmental effects and the guidelines of Regulatory Guide 1.13; Regulatory Guide 1.27; and Regulatory Guide .1.117, concerning protection of safety-related structures, systems, and components from tornado generated missiles and is, therefore, acceptable.

Updated Final Safety Analysis Report (UFSAR) Revision 2016-00 The Grand Gulf licensing basis for tornado missiles is described in the UFSAR:-and is listed below. Appendix 3A, Conformance with NRG Regulatory Guides

  • The GGNS site lies within Region I for determini'ng the Design Basis Tornado (Reference UFSAR Section 2.3.1 :2.8). The Region I associated Design Basis Tornado parameters are as follows: Maximum wind speed, mph 360 Rotational speed, mph 290 Translational speed; Maximum, mph 70 Minrmum, mph 5 Radius of maximum rotational speed, ft. 150 Pressure drop, psi 3.0 Rate of pressure drop, psi/sec 2.0 Section 3.1 Compliance with NRG General Design Criteria Criterion 2 -Design Bases for Protection Against Natural Phenomena Enclosure to GNR0-2017/00061 Page 4 of26 The Grand Gulf Nuclear Station fully satisfies and is in compliance with the General Design Criteria 2. *
  • Criterion 4 -Environmental and Missile Design Bases. The* Grand Gulf Nuclear Station fully satisfies and is in compliance with the General Design Criteria 4. r Section 3.3 Wind and Tornado Loadings Structures, systems, or components whose failure, due to design wind loading, tornado wind loading, or associated missiles, could prevent safe shutdown of the reactor, or result in significant uncontrolled release of radioactivity from the unit, are protected from* such failure by one of the following methods: a) the structure or component is designed to withstand design wind, tornado wind and tornado generated missiles, or b) the system or components are housed within a structure which is designed to withstand the design wind, tornado wind and tornado generated missiles.

FSAR Table 3.3-1 lists all safety related structures and the method of vyind/tornado protection as applicable.

Section 3.5 Missile Protection Section 3.5.1 Missile Selection and Description The following criteria were adopted for assessing the plant's capability to assure that, in the event of a generated missile of any type postulated in Section 3.5.1, there is: a. No loss of containment function b. No loss of function 'to systems required to shutdown the reactor and maintain it in a safe shutdown condition, or mitigate the consequences of the missile damage. c. No offsite exposure exceeding the guidelines of 10 CFR 100 d. No loss of integrity of the spent fuel pool Section 3.5.1 .4, Missiles Genera.tad by Natural Phenomena Tornado-generated missiles were considered as the limiting natural-phenomena hazard in the design of all structures which are required for safe shutdown.

The missiles

  • considered in design are as listed below. Since tornado missiles are considered the design basis missiles, missiles generated from other natural phenomena are not considered critical.

Enclosure to GNR0-2017/00061 Page 5 of 26 Table 2-1 Grand Gulf Design Basis Missiles .Missile Weight Horizontal Velocitv (fos) a. Wood Plank 115 272 4 in. x 12 in. x 12 ft. b. Steel Pipe 6 in. x 19 ft. 286 170 schedule 40 1 c. Steel Rod 1 in. x 3 ft 9 1'67 d. Utility Pole 13% in. x* 35 ft 1123 180 e. Steel Pipe 12 in. x 15 ft. 749 154 schedule 40 f. Automobile 20 ft contact 3991 194 area. 2.3 Reason for the Proposed Change Vertical Velocity (fps) 190 119 167 126 108 136 In response to RIS 2015-06, Entergy performed walkdowns at GGNS to identify potential discrepancies with the GGNS CLB related to tornado missile protection.

Those walkdowns identified conditions where the plant configuration did not conform to the design and licensing . bases. The non-conforming conditions were entered into the corrective action program (CR-* *GGN-2015-047'60) and are summarized in the table below. Conditions that rendered the affected SSCs inoperable were processed in accordance with Enforcement Guidance Memorandum (EGM) 15-002 and DSS-ISG-2016-01, with short-term and long-term compensatory actions taken. That action resulted in those SSCs being restored to operable but nonconforming status. The compensatory actions will remain in effect until the SSCs have been restored to full qualification.

  • * *

Missile Protection Non-Compliance, in general, tornado missile scenarios do not represent an immediate safety concern because their risk is bounded by the initiating event frequency and safety-related SSCs are typically designed to withstand the effects of tornados.

The NRC staff study establi.shed that the core damage frequency (CDF) associated with tornado missile related non-compliances is well below a CDF r~quiring immediate regulatory action.

Enclosure to GNR0-2017/00061 Page 6.of 26 Table 2-~ Non-Conforming (Safety-Related)

SSC Vulnerabilities Item System ID Vulnerability Description General Location Diesel Generator Yard (above Fuel Oil Storage 1 Tanks (1 P75-A003A, Diesel Generator Fuel Oil Storage Tank undergrqund Diesel 1 P75-A003B, and Vents Generator Fuel Oil 1 P81-A001)

Storage Tanks) P41 SSW Return SSW Vertical Piping between Basins and SSW Cooling Tower 2 Lines SSW Superstructures Basin at Gridlines.

C2, C3, C6, & C7 FtJel Oil Day Tank Diesel Generator Fuel Oil Day Tank Vents

  • Diesel Generator 3 (Q1 P75A004A, (Penetrations DC-20A, DC-21 A, and DC-Building (roof El. 172 1-Q1 P75A004B, and . Q1 P81 A002) 22A) 011) North Endof P41. HPCS (Div. 3) SSW Supply and Return Headers Breezeway between 4 Room Cooler Diesel Generator

... (Q1T51 B001-C} (Penetrations DP-1 A and DP-2A) B'uilding and Auxiliary Building South End of Control 5 Various Cables to Cable Chase Room* 1 A539 (Behind Door Building (Acces*s gained Control Room 1A501) . from the Auxiliary

  • Building Roof) ,-Plant modifications to restore compliance with the CLB would have very limited safety benefit, but would require extensive resources and would divert those resources
  • fr9m more safety . significant activities.

NRC approval of the TMRE methodology and this license amendment

  • , request would .revise the GGNS CLB to restore the non-conforming conditions to full qualification:

Utilization of risk insights to the allocation of NRG staff and industry resources is consistent with the NRC policy. *

Regulatory Guide

  • 1.117 describes a method acceptable to the NRC staff for identifying those structures, .systems, and components of light-water-cooled reactors that should be protected from -the effects of the Design Basis Tomado. This LAR proposes to add an alternative methodology to the GGNS UFSAH, TMRE, to describe a method to determine whether protection from tornado-generated missiles is required.

The methodology can only be* applied to discovered*

conditions where tornado missile protection should be provided and is not currently provided.

Future modifications to the facility requiring tornado missile prot~ction would not be evaluated using the TMRE methodology::

Enclosure to GNR0-2017/00061 Page 7 of 26 2. Revises the GGNS UFSAR section 3.5.1.4, Missiles Generated by Natural Phenomena, to confor~ that section to the use of the TMRE methodology.

3 .. Revises the GGNS UFSAR to add a new table as Table 3.5.1-4a, Safety-Related Structures,.Systems And Components .That Do Not Require Protection from Tornado Generated Missiles Based on Tornado Missile Risk Evaluator Methodology.

The GGNS UFSAR markups are in Attachment

1. The TMRE methodology was transmitted to the NRC by NEI as NEI 17-02, Revision 1, on September 21, 2017 and is hereby incorporated by reference into this LAA.

One significant activity undertaken in response to the policy statement is the use of PAA to support decisions to modify an individual plant's licensing basis. Regulatory Guide 1.17 4, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis (LB), provides guidance on the use of PAA findings and risk. insights to support licensee requests for changes to a plant's LB, as in requests for license amendments and technical specification changes under 10 CFR 50.90. The TMRE methodology is proposed as a PAA-based methodology for ~valuating the risk impact of existing conditions where tornado missile protection is required in a licensee's CLB, but the required protection was not

  • provided.

For conditions that meet the acceptance criteria, the GGNS licensing basis would be revised. *

  • I GDC.2 requires that SSC important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions.

GDC 4 requires that SSC important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes.

Regulatory Guide 1.117, Tornado Design Classific.ation, Rev. 1, describes a method acceptable to the NRC staff for identifying those structures, systems, and components of lightwater-cooled reactors that should be protected from the effects of the Design .Basis Tornado, including tornado missiles, and remain functional.

The TMRE methodology is proposed as an alternative methodology for identifying whether certain SSCs mu.st be protected from the effects of tornado missiles.

The TMRE methodology employs a simplified, conservative assessment of risks to .core damage and large early release posed by tornado-gen*erated missiles at nuclear plants.

  • The guidance for use of the methodology is found in NEI 17-02, Tornado Missile Risk Evaluator Industry Guidance Document, Rev. 1, which is incorporated by reference into this LAA. The guidance document provides a detailed approach to .gathering the necessary information and translating the information into a PAA model. The risk assessment methods and acceptance criteria 'of the NRC Regulatory Guide 1.174 are used to determine whether risks posed by potential tornado missiles at a site warrant protective measures Enclosure to GNR0-2017/00061 Page 8 of 26 3.2 Traditional Engineering Considerations Two of the five key principles of risk-informed decision making address the traditional engineering considerations of defense-in-depth and maintaining sufficient safety margins. Those two considerations are discussed below with respect to the proposed cha,nge to the GGNS licensing basis. The proposed*

change is consistent with a defense-in-depth philosophy.

The proposed change is consistent with a defense-in-depth philosophy.

Defense-in-depth is an approach to designing and operating nuclear facilities to prevent and mitigate accidents that release radiation or hazardous materials.

The key is creating multiple Independent and redundant layers of defense to compensate for potentjal human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon. No individual failure, including one caused by the impact of a tornado missile, would prevent the fulfillment of a safety function.

  • A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o No new accidents.

or transients are .introduced with the proposed change~ and th.e facility is still well protected from torna~o missiles.

  • o The proposed change does not significantly impact the availability and reliability of SSCs that provide* safety functions that prevent challenges from progressing to core damage. The magnitude of the change is consistent with the guidance of Heguiatory Guide 1.174. o None of the five non-conforming conditions in the TMRE model only affect Large Early Release Frequency (LEAF), which is an indication that there was no significant impact on prevention of containment failure~ . . . o The change does not significantly reduce the effectiveness of the emergency . preparedness program including the ability to detect and measure releases of radioactivity, notify offsite agencies and the public, and shelter or evacuate the public as necessary.
  • Over-reliance on programmatic activities as compensatory measures associated with the change in the LB is avoided. *
  • o Implementation of the proposed change does not require compensatory measures.

The risk assessment associated with this *LAR gave no' credit to compensatory measures *

  • implemented in response to the non-conforming conditions.

o No plant operating procedures will be changed to implement

  • the proposed change. o The proposed change dpes not rely upon proceduralized operator actions within an hour of a* tornado pas~ing that would require operators*

to travel into areas that are not protected from the effects of the tornado or tornado missiles.

Enclosure to GNR0-2017/00061 Page 9 of 26

  • System redundancy, independence, and diversity are preserved commensurate with the expected consequences of challenges to the system, and uncertainties.

o The proposed change does not modify the redundancy, independence, or diversity described in the GGNS UFSAR. The proposed change does not result in a disproportionate increase in risk. o The proposed change has no impact on the assumptions in the GGNS safety analyses presented in the UFSAR, chapters 6 or 15. o The proposed change has no impact on the availability or reliability of SSCs that could either initiate or mitigate events, with the exception of tornado missile protection, which is thoroughly evaluated in this LAA. " o Equipment available both onsite and offsite supporting Diverse and Flexible Coping Strategies (FLEX) could be utilized if needed to mitigate the impact of a tornado missile. Critical equipment is stored in structures that would prevent it from being impacted by a tornado or tornado missile.

  • Defenses against potential common-cause failures are preserved, and the potential for introduction of new common-cause failure mechanisms is assessed.

o The non-conforming conditions are physically distributed about the GGNS site, so there is a low likelihood of multiple SSCs being impacted by a single missile.

  • Independence of barriers is not degraded.

o Of the three fission product barriers, neither the fuel clad nor reactor coolant system piping is directly exposed to tornado missiles, and the containment remains a robust tornado missile barrier. o The proposed change does ndt significantly increase the likelihood or consequence of

  • an event that challenges multiple barriers, and does not introduce a new event. . . I . . . . . .
  • D~fenses against human errors are preserved.

o Implementation of the proposed change will not create new human actions that are important to preserving the layers of defense, or significantly increase mental or physical demand on individuals responding to a tornado. ,. o GGNS has a procedure that prescribes actions to be taken by plant staff in the event of a tornado watch, tornado warning, and after a tornado has passed. This includes tornado walkdowns for tornado missile vulnerable SSCs. It includes a table of plant vulnerabilities to tornado-generated missiles and recovery actions that reduce the impact of a tornado missile affecting the identified SSCs:

  • o Proceduralization of safety-significant operator actions, coupled with training and standards for procedure compliance, preserve the defense against human errors.
  • Enclosure to GNR0-2017/00061 Page10 of 26
  • The intent of the plant design criteria is maintained.

o This LAR only affects plant design criteria related to tornado missile protection, :and a very small fraction of the overall system areas would remain not protected from tornado missiles.

All other aspects of the plant design criteria are unaffected. .

  • o This LAR maintains the intent of the plant design criteria for tornado missile protection, which is to provide reasonable assurance of achieving and maintaining safe shutdown in . the event of a tornado. The evaluation performed and documented in this LAR
  • demonstrates that the risk associated with the proposed change is very small and within accepted guidance for protection of publi'c health and safety. o The methodology*cannot be used.in the modification process for a future plant.change to avoid providing tornado missile protection.

Therefore, the intent of the plant's**design

  • criteria is maintained.

o Protection of the identified SSCs would have. assured they would not be damaged by design basis tornado missiles.

In lieu of protection for the identified nonconforming SSCs, .GGNS has analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequent effect on CDF and LEAF. While there

  • is some slight reduction in protection from a defense .. in-depth:perspective, the impact is known, and it-is negligible.

Therefore, the intent of the plant's design criteria.is maintained.

The pmposed change maintains sufficient safety margins. The vast majority of each system important to safety remains. protected from tornado missiles, consistent with the CLB~ The identified vu'lnerabilities represent a small fraction of the potential target area of the system. The likelihood of redundant trains bbth being impacted by tornado missi.les is muc.h lower than the likelihood of one train being impacted.

The TMRE methodology includes a conservative treatment of conditions where a single tornado missile could impact more than one component through physical correlation.

The number of potential

'missiles

  • * .identified at GGNS is less than the number of missiles assumed by the TMRE methodology.

GGNS has diverse and flexible coping strategies to restore critical safety functions in the event of a hypothetical loss of the primary functions.

In some cases, non-safety related equipment could function to mitigate the impact of a hypothetical tornado missile strike to safety-related equipment.

  • * *
  • Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Electrical and* Electronic Engineers (IEEE) or alternatives approved by the N RC) continue to be met. The proposed change is not in conflict with approved codes and standards relevant to the
  • SSCs. . .. The safety analysis acceptance criteria in the licensing basis are unaffected by fh~ proposed change. The req.uirements credited in the accident analyses will remain the sa111e. Therefore,*

th~ proposed change maintains sufficient safety margins and continues to protect. public health and safety. * \

Enclosure to GNR0-2017/00061 Page 11 of 26 3.3 Risk Assessment The TMRE methodology is used to estimate the quantitative risk associated with generated missiles associated with discrepancies with the GGNS CLB related to tornado missile protection.

It makes use of the GGNS internal events PRA model, which was used to estimate the risk associated with the passage of a tornado over GGNS site. The TMRE is a hybrid methodology comprised of two key elements:

(1) a deterministic element to establish the likelihood t.hat a specific SSC ("target")

will be struck by tornado-generated missile; and (2) a probabilistic element to assess the impact of the missile strikes on the core damage and large early release frequencies.

The output of the deterministic element is a calculated Exposed Equipment Failure Probability (EEFP) that is based largely on a simplified generic relationship between tornado strength and the population of materials at a typical nuclear. power plant that may become airborne during a tornado. Site-specific inputs to the EEFP include the number of potential missiles and the size and location of the target SSC being evaluated.

The site-specific frequency of a tornado striking the GGNS site is also used in the TMRE methodology.

The outcome of the probabilistic element is an estimation of.an increase in core damage frequency and large early release frequency associated with not protecting certain SSCs from tornado missiles.

3.3.1 High Winds Equipment List The TMRF high winds equipment list (HWEL) was dev,eloped using the current GGNS internal events PRA model using the TMHE methodology provided in NEI 17-02 .. The HWEL identifies potential vulnerable components that needed to be walked down. The list contained all basic eventsJor the relevant GGNS loss of offsite power (LOOP) and station black out (SBO) accident sequences.

The following were considered in the development and update of the HWEL, consistent with the NEI 17-02 methodology:

  • The non-conforming items were added to the list.
  • Items screened based on being in category I structures were reviewed for the presence of potential missile paths. *
  • The TMRE model uses the loss of offsite power (LOOP) sequences with no offsite . power (NO LOOP) recovery, therefore PRA logic and components that do riot support mitigating a LOOP can be screened.
  • * .
  • Operator actions were assessed based on the N El 17-02 methodology.

Internal events PRA data was* used to perform the assessment of op~rator actions .. Note that Operator interviews for the credited operator actions were performed during the development of the internal events model that the TMRE model is based on. In addition, an SRO was interviewed during TMRE development for insights related to tornado events. The main insights were that auxiliary operators would take shelter in Category 1 structur~s if Enclosure to GNR0-2017/00061 Page 12 of 26 possible and that operators can access the Auxiliary Building (AB) from the Control Building (CB) by using multiple paths in the Turbine Building (TB). Once in the AB, the operators can access the rnesel Building (OB) by exiting the AB to the DB breezeway and then enter any of

  • the three EOG roorris. 3.3.2 Target Walkdowns The scope of the walkdowns considered the following:
  • Locate and identify*

the SSC; verify that the SSC is located where it is documented to be. Note support systems or subcomponents, such as electrical cabling, instrument air lines, and controllers.

  • Document and describe barriers that could prevent or limit exposure oUhe SSC to tornado missiles.

This may include barriers or shielding designed to protect an SSG from tornado missiles, as well as other SSCs that may preclude or limit the exposure of the target SSC to missiles (e.g., buildings, large sturdy components).

  • Determine and/or verify the dimensions of the target SSCs, including any subcomponents or support systems. Missile paths may limit target areas when missiles are bk>cked by barriers.
  • Determine the proximity and potential correlation to other target SSCs. Correlated targets are SSCs that can be struck by the same tornado missile.
  • Proximity of non-Class I structures to exposed target SSCs should be documented.

A non-Class I structure may collapse or tip;..over and cause damage to an SSC.

  • Identify vent paths for tanks that may be exposed to atmospheric pressure changes. 3.3.3 Missile Walkdowns The missile walkdown was performed in accordance with Section 3.4 of NEI 17-02. The area is defined by a 2500 ft radius from the approximate center of the Unit 1 Containment.

To support the walkdowns the plant was divided into zones. The potential missile count for each zone was determined.

The missile count is summarized in Table 3-*1. The total missile estimate is 233,980. This missile count justifies the use of the generic missile count from the TMRE guidance which is 240,000.

Enclosure to GNR0-2017/00061 Page 13 of 26 Table 3-1 TMRE Tornado Missile Count Summary. Total Number of Zonal

  • Zone Missiles (Non-Structural and Structural) 1 37477 2 11257 3 7978 4 16735 5 .2857 6 16171 7 16304 8 22118 9 12380 10 26700 11 6460 . 12 17570 13 26293 Fence and Pole Missiles 13680 I Total Number of Missiles on Site (Non-Structural and 233980 Structural) 3.3.4 Tornado Hazard Frequency The guidance in NEI 17-02 as well as NUREG/CR-4661 was used to determine the tornado initiating events for the GGNS TMRE PAA model. The result was site specific tornado frequencies for each relevant tornado category .. NUREG/CR-4661 tornado strike data for GGNS is provided with wind speeds associated with varying frequencies per year. The F'-scale (Fujita prime) was used to classify tornadoes.

Using this data, a site-specific tornado frequency curve (hazard curve) was developed, and the frequency of all tornadoes considered in the TMRE (F'2 through F'6) was calculated.

Since F' probabilities are not directly available, they must be derived from site specific Fujita scale data available in Table 6-1 of NUREG/CR-4661.

  • Using the trend line equation, exceedance probabilities for the upper ranges of each F' category, F'2 through F'6 was calculated, resulting in the following tornado initiating event frequencies.

Enclosure to GNR0-2017/00061 Page 14 of 26 Table 3-2 GGNS Plant Specific Initiating Event Frequency Fujita Prime Frequency Per Vear F'2 S.OSE-04 'F'3 1.19E-04 F'4 2.87E-05 , F'S 5.00E-06 F'6 2.36E-07 3.3.5 Target Evaluation*

The list of potentially vulnerable targets to tornado missiles that are modeled in the PRA are identified and characterized.

These targets have been added to the TMRE model. The failure probability of theJargets is calculated using the Exposed Equipment Failure Probability (EEFP). The EEFP is the conditional probability that an exposed target is hit and failed by a tornado missile, given a torna.do of a certain magnitude.

  • For each target, five EEFP values were calculated, one value for each tornado category F'2 through F'6. The EEFP is defined as: EEFP = (M!P) x (# of Missiles) x (Target Exposed Area) x Fragility
  • The Missile Impact Parameters (MIP) is the probability of a tornado missile hit on I a target, pe*r target square area, per missile, per tornado. Gener.ic MIP values are provided in Table 5-1 of NEI 17-02. * # of Missiles is the number of damaging missiles.

The generic values recommended in Table 5-1 and 5-2 of NEI 17-02 are used

  • Target Exposed Area is determined for each specific target.
  • Fragility is the conditional probability of the target failing to perform its function given that it is hit by a tornado missile. For the purposes of the TMRE, it is assumed to be 1.0.

\ Enclosure to GNR0-2017/00061 Page 15 of 26 The calculation of the. EEFPs results is provided in Table 3-3. ( . Table 3-3 Summary of EEFPs Based on Tornado Category Exposed Equipment Failure Probability for Item Description System Tornado Category <1> F 12 F 13 F 1 4 F 1 5 F 1 6 Diesel Generator Diesel Fuel Oil .Fuel Oil Storage 1 Storage Tank Tank (1 P75-3.0E-04 . 9.9E:*04 2.3E-03 6.8E-03 1.0E-02 A003A, 1 P75-Vents A003B, 1 P81-A001) Loop "A" (C2 & C3) SSW Pump Straight (01 P41 C001 A-2 Vertical A) & Loop "B" 6.1 E-4 2.0E-3 4.6E-3 1.4E-2 2.1 E-2 SSW Return (C6 & C7) SSW (Note 1) (Note 1) (Note 1) (Note 1) (Note 1) Lines Pump (01 P41C0018-B) Diesel Fuel Oil Day Tank, 01 P75A004A (Div. 3 Generator 1 ), 01 P75A004B 1.4E-05 4.5E-05 1.0E-04 3.1 E-04 4.6E-04 Fuel Oil Day (Div. 2), and Tank Vents 01 P81A002 (Div. 3) SSW Supply . HPCS (Div 4 Header and 3) Room 2.3E-04 *7.5E-04 1.7E-03 5.2E-03 7.8E-03 Return Cooler, Header 01T51B 01-C ' . Cable Chase Room See Attachment B 5 (Room of ENTG#GG052-3.7E-04 1.2E-03 2.8E-03 8.3E-03 1.2E-02 1A539} TMRE-002 (Note 2} (Note 2) (Note 2) (Note 2) (Note 2) Behind Door 1A501 Table 3-3 Notes: 1. For Item 2 Parts A & B, each loop is comprised of two (2) vertical runs. As a result, the EEFP for each loop will be twice that of each vertical run. 2. The EEFPs for doors used in the TMRE model were adjusted to account for a smaller number of missiles (45%) per Category G in Table 5-2 of NEI 17 .. 02. The table shows the original (non-adjusted) values.

Enclosure to GNR0-2017/00061 Page 16 of 26 3.3.6 Model Development The TMRE model was developed using the current internal events model. The GGNS model addresses, among other initiators, LOSP, 880, consequential steam line break, and consequential loss of coolant accidents.

The LOSP initiating event accident sequence addresses the tornado damage states expected based on a review of the vulnerable equipment and the LOSP. The Tornado initiating events for TMRE are added to the model at the LOSP initiating event location in the fault tree by modifying the initiating event frequency.

The equipment vulnerable to tornado missiles were added to the model using the EEFP events identified.

  • 3.3. 7 Model Quantification.

The TMRE model is quantified in PRAQuant using the flag files and modified recovery rule files. The Core Damage Frequency (CDF) is truncated.at 1 E-12/yr and the Large Early Releas.e Frequency (LERF) is truncated at 1 E-13/yr. This is consistent with the GGNS base model. The core damage frequency and large early release frequency for the degraded and compliant cases are in Table 3-4. Table 3-4 Quantification Results CDF /year LERF /year Compliant 7.38E-07 3.94E-08 Degraded 8.81 E-07 5.54E-08 Delta 1.43E-07 1.6E-08 Per Regulatory Guide 1 .17 4, a risk-informed License Amendment Request (LAR) includes an evaluation of the change in risk (e.g., ~CDF). For the purposes of the TMRE, a licensee needs to calculate this change in risk by comparing two different configurations:

the Compliant Case (configuration with the plant built per the required design/licensing bases), and the Degraded Case (current plant configuration, including potential non-conformances for tornado missile* protection).

The ~CDF and ~LERF are simply calculated as follows: ~CDF = CDFoegraded

-CDFcompliant

~LERF = LERFoegraded

-LERFcompliant The TMRE results for GGNS are 1.43E-7 per year ~CDF and 1.60E-8 per year ~LERF. 3.3.8 Results The tornado initiating event contribution is provided in Table 3-.5 for the degraded and compliant model result.

  • Enclosure to GNR0-2017/00061 Page 17 of 26 Table 3-5 Initiating Event CDF Contribution Initiating o/o CDF o/o CDF *, Frequency Contribution Contribution
  • . Description Event Compliant Degraded %GG-T-F2.

5.0SE-04 61.7% 54.4% . GGNS FREQ FOR F'2 , TORNADO %GG-T-F3 1.19E-04 17.5% 17.4% GGNS FREQ FOR F'3 / TORNADO %GG-T-F4 2.87E-05 6.2% 7.7% GGNS FREQ FOR F'4 TORNADO %GG-T-F5 5.00E-06 12.5% 17.8% GGNS FREQ FOR F'S TORNADO %GG-T-F6 2.36E-07 1.9% 2.6% GGNS FREQ FOR F'6 TORNADO The results were reviewed to identify the dominant target sets for the CDF contribution in the compliant and degraded results.

  • The dominant contributor for the compliant case was the Condensate Storage Tank (CST) with a contribution of over 60%. This is followed by the Division 1 and 2 Standby Service Water (SSW) *Cooling Tower fans, the Division 1 and 2 Diesel Generator Exposed cables, and the Division 1 and 2 Transformers, all of which contribute less than 10% each. The dominant contribution to the degraded case was the CST, again with a contribution of over 60%.
  • For the degraded case, this is followed by the Division 1 and 2 SSW Cooling Tower fans, the Division 1 SSW return line, the Division 2 Diesel Generator Cables, and the Division 2 Transformer.

The dominant initiating event for both the compliant and degraded cases is the F'2 initiator, which has the largest frequency.

Although the importance of the initiators would be expected to mirror the individual percent contributions to the total of all five initiators' frequencies, Table 3-5 shows that this is not the case. In particular, the degraded F'S initiator GDF contribution is more -than double the F'4 contribution and is 10% higher than the F'3 contribution instead of being lower. A review of the cut sets for the initiators showed that, although all three initiators had similar cut sets with similar failures, the F'S cut sets with multiple tornado failure events were significantly higher than the similar F'4 and F'3 cut sets. The following example demonstrates why this difference exists. F'S Initiator cut set Prob. Inputs , 1.94E-'03

%GG-T-F5, FL_SCRAMMED, P41-TOR-F5-C003A, P41-TOR-F5-C003B, P41-TOR-F5-C003C, P41-TOR-F5-C003D F'4 Initiator cut set Prob. Inputs 2.27E-05 %GG-T-F4, FL_SCRAMMED, P41-TOR-F4-C003A, P41-TOR-F4-C003B, P41-TOR-F4-C003C~ P41-TOR-F4-C003D F'3 Initiator cut set

  • Prob. Inputs 2.27E-05 %GG~T-F3, FL_SCRAMMED, P41-TOR-F3-C003A, P41-TOR-F3-C003B, P41-TOR-F3-C003C. P41-TOR-F3-C003D Enclosure to GNR0-2017/00061 Page 18 of 26 In the above example, the initiators

(%GG-T-F3, %GG-T-F4 and %GG~T-F5) and flag event FL_SCRAMMED are set to true. the remaining events represent the failure of SSW cooling . tower fans A,* B, C and D from tornado missiles.

The EEFP for failure of each fan from a F'3 tornado is 3.0E-02, F'4 tornado is 6.9E-02 and 2.1 E-01 for a F'S tornado. The increases in EEFP from F3 to F'4 to F'S are due to the missile impact parameter (MIP) increasing by a factor of 1.75 from F'3 to F'4, and about 2.5 from F'4 and F'S and the missile count increasing from 155,000 to 205,000 to 240,000. Thus, when the initiators are set to true, .the frequency for the F'S cut set is* almost an order of magnitude greater than the F'3 andF'4 cut sets. When the initiators are set to their normal frequencies

(%GG-T-F3

= 1.19E-04, %GG-T-F4 .. = 2.87E-05 and %GG-T-F5 = 5.0E-06), the F'S cut set frequency in the degraded sce'nario is 9.7E-09/yr compared to 6*.sE-10/yr for F'4 and 9.64E-11 for F'3. Thus, the increase *in EEFP for multiple.

  • tornado failure events in a single cut set for increasing tornado classes cari have more*impact than the decreasing initiator frequency of the higher classification tornado classes. This becomes apparent in the change from F'3 to F'S and F'4 to F'S tornado results. 3.3.9 Non-conformance Results. . . . Screened non-conformances are evaluated as having a negligible impact on the TMRE risk contribution.

Non-conformances addressed quantitatively are listed in Table 3-6. lable 3~6 Non-Conformances Modeled in the GGNS TMRE Model Item Non-Conformance Description 1 Diesel Generator Fuel Oil Storage Tank Vents 2 SSW Vertical Piping between. Basins and SSW Superstr~ctures 3 ** Diesel Generator Fuel Oil Day Tank Vents (Penetrations DC.-20A, DC-21 A, and DC-22A) 4 SSW Supply and Return Headers (Penetrations DP'..1 A and DP-2A) 5 Cable Chase Room 1 ,.L\539 (Behind Door 1 A501) 3.3.10 Sensitivities and Uncertainties NEI 17-02 identifies sensitivity studies that should be performed and documented if the ~CDF or ~LERF between the compliant and the degraded case exceed 10-7/yr or 10-8/yr, respectively.

As indicated above the ~CDF or ~LERF both meet the criteria.

Therefore, both sensitivities are examined for GGNS. Sensitivity t-Zonal vs. Uniform Missile Distribution This sensitivity addresses conc~rns regarding the potential under.estimation of target hit probability due to th.e missile distribution at the GGNS site, as compared to the missile distribution for the*EPRI NP-768 Plant A simulations.

In accordance with the guidance, the sensitivity evaluates SSCs with a tornado missile failure basic event RAW;;:: 2 and only applies.

Enclosure to GNR0-2017/00061 Page fg of 26 to basic events for tornado categories F'4, F'5 and F'6. The basic event failure probability for these events is multiplied by 2.75 and delta CDF and LERF are re-calculated.

The CDF and LERF frequencies for Sensitivity 1 are included in Table 3-7. Table 3-7 Sensitivity_

1 Results CDF /year LERF /year Compliant 8.13E-07 4.50E-08 ) Degraded 1.24E-06 '\ 9.47E-08 Delta* 4.27E-07 4'.97E-08

.. The TMRE results for Sensitivity 1 are 4.27E-7 per year ~CDF and 4.97E-8 per year ~LERF. Both values are slightly more than triple the corresponding base TMRE model ~CDF and ~LERF. However, both ~CDF and ~LERF meet the Regulatory Guide 1.174 criteria.

Sensitivity 2-Missile Impact Parameter This sensitivity addresses concerns regarding the potential underestimation of target hit probability due to SSCs that are located or oriented in a way that exposes them to a higher missile impact probability than the average MIP. Based on the NEI guidance, this sensitivity evaluates highly exposed SSCs with a tornado missile failure basic event RAW~ 2 and only applies to basic events for tornado categories F' 4, F'S and F'6. The basic event failure probability for these events is multiplied 2.5 and delta CDF and LERF are re-calculated.

\ For the purposes of this sensitivity study, the term* highly exposed refers to an SSC for which all of the following characteristics apply: *

  • Is not located inside a Category I structure (i.e., they are outside or in a . Category I structure)
  • Is not protected against horizontal missiles .
  • Has an elevation less than 30' above grade The CDF and LERF frequencies for Sensitivity 2 are included in Table 3-8.

Enclosure to GNR0-2017/00061 Page 20 of 26 Table 3-8 Sensitivity 2 Results CDF /year Compliant 7.89E-07 Degraded 1.14E-06 Delta 3.51 E-07 LERF.lyear 4.32E-08 8.42E-08 4.10E-08 The TMRE results for Sensitivity 2 are 3.51 E-07 per year ~CDF and 4.1 OE-8 per year ~LERF; Both ~CDF and ~LEAF meet the Regulatory Guide 1 .17 4 criteria.

SSW Cooling Tower Fans Sensitivity The SSW Cooling Tower {CT) fans are important in that they support operation bf the e'mergency diesel generators and ECCS systems. This sensitivity assesses the impact of increased probabilities for the cooling tower fan EEFPs. The fan EEFPs are *increased by a factor of two. Table 3-9 SSW Cooling Tower Fans Increased Failure Sensitivity CDF /year LERF /year Compliant 1.14E-06 8.81E-08 Degraded 1.36E-06 1.14E-07 Delta 2.20E-07 2.59E-08 The TMRE results for this sensitivity are 2.20E-07 per year ~CDF and 2.59E-8 per year ~LEAF. While this is an increase compared to the base quantification, both 8CDF and ~LEAF meet the Regulatory Guide 1 .17 4 criteria.

SSW Cooling Tower Fans Missile Barrier Sensitivity The SSW Cooling Tower fans are protected from vertical*

missiles by steel bars. This protection was not credited in the base TMRE model. Since the tower fan missile basic events are modeled as vulnerabilities and not non-conformances, they were set to false in both the compliant and the degraded cut sets and the new compliant and degraded CDF and LEAF values determined as shown in Table 3-10. Table 3-1 O Credit for SSW Cooling Tower Fan Missile Barriers CDF /year LERF /year Compliant 6.56E-07 2.98E-08 Degraded 7.70E-07 4.24E-08 Delta 1.14E-07 1.26E-08 Enclosure to GNR0-2017/00061 Page 21 of 26 The resulting

~CDF is 1.14E-07 per year and ~LEAF is 1.26E-08 per year. These results show that crediting the SSW CT fan missile barrier results in delta CDF and LEAF approximately twenty five percent lower than the base TMRE results. Modeling Conservatisms There is a potential that conservative assumptions can'-mask delta risk estimates in PAA results. There is potential to have a larger impact on-the compliant model resulting in under estimating delta risk by over estimating the compliant model risk. The conservative assumptions can be bounded by performing a single sensitivity where the compliant risk model results are set to zero. Table 3-11 Modeling Conservatism, Sensitivity CDF}year 'LERF /year Degraded 8.81 E-07 5.54E-08 Compliant 0 0, Delta Risk 8.81 E-07 5.54E-08 Both ~CDF and ~LEAF meet the Regulatory Guide 1.17 4 criteria 3.3.11 Conclusions The TMRE guidance provided in NEI 17-02 was followed without exception and no deviations were applied. The total change in risk associated with tornado missile damage to non-conforming conditions identified results in a risk increase of 1.43E-07 per year ~CDF and 1.60E-08 per year ~LEAF. The tornado risk change for accepting GGNS non-conforming conditions results in a very small risk increase (Region 111) per Regulatory Guide 1.17 4. 3.4 Technical Evaluation Conclusions Utilization of TMRE, which employs a probabilistic approach permitted in regulatory guidance, is a sound and reasonable method of addressing tornado missile protection at GGNS for certain SSCs that are not fully protected from the effects of tornado missiles.

The proposed change would revise the UFSAR to make TMRE part of the GGNS licensing basis for conformance to 1 OCFR 50 General Design Criteria 2 and 4. Future discovery of existing tornado missile protection non-conforming conditions will continue to be evaluated using the corrective action program. The TMRE methodology could be used to resolve those non-conforming conditions by revisi'ng the CLB under 10 CFR 50.59, provided the acceptance criteria are satisfied and conditions stipulated by the staff in the safety evaluation approving the requested amendment are met. Future modifications to the facility requiring tornado missile protection would not be evaluated using the TMRE methodology.

The TMRE Guidance, provided in NEI 17-02, Revision 1 , was followed without exception and no deviations were applied.

Enclosure to GNR0-2017/00061 Page 22 o.f 26. 4. REGULATORY EVALUATION 4 .. 1 . . Applicable Regulatory Requirements/Criteria The NRC requires that nuclear power plants be designed to withstand the effects of natural phenomena, including tornado and high-wind-generated.missiles, so as not to adversely impact the health and safety of the public in accordance with the requirements of 10 CFR 50, Appendix A, General Design Criterion 2, 11 Design Bases for Protection against Natural Phenomena," and GDC 4, .11 E11vironmental and Dynamic Effects Design Bases." Methods acceptable.

to the. NRC to comply with the aforementioned regulations are described in Regulatory Guides 1.117, "Tornado*

Design Classification," Revision 1, and NUREG-0800, 11 Standard Review Plan for the Review of .Safety Analysis Reports for Nuclear Power Plants", Section 3.5.1 .4, "Missiles

  • Generated by Natµral Phenomena," and Section ~.5.2, "Structures, Systems, and Components to be Protected from Externally-Generated Missiles," Revision 2, July 1981. The SRP, Sections 3.5.1.4 and 3.5.2, contain the current acceptance criteria governing tornado missile.protection.

The~e criteria generally specify.that SSCs that are important to safety be* provided with sufficient, positive tornado missile protection (i.e., barriers) to withstand the maximum credible tornado threat. The appendix to Regulatory Guide 1. t17, lists the types of SSCs that should be protected from design basis tornadoes.

However, SRP Section 3.5.1.4 permits relaxation of the abov,f deterministic criteria if it can be demonstrated that the frequency of damage to unprotected essential safety-related features is sufficiently small. To use this probabilistic criterion, the NEI developed the TMRE methodology, NEI 17~02, Rev. 1, transmitted to the NRC staff in September 2017, which is incorporated by *reference into this LAR. NEI 17-02, Rev.* 1, contains guidance for application of the methodology and the technical basis for its acceptability.

This LAR requests NRC approval for us~ of the TMRE methodology in lieu of the deterministic methodology when assessing the .need for positive tornado missile protection for specific safety-related plant features*

in accordance with the criteria of SRP Section 3.5.1.4. This LAR utilizes a risk-informed change process consistent with the guidelines*

of Regulatory Guide 1 ~174, "An Approach for Using Probabilistic Risk Assessment in Risk Informed De_cision on Plant-Specific Changes to the Licensing Basis." As discussed in Regulatory Guide 1.'174, in implemerJting risk-informed decision-making, licensing basis changes are expected to meet a set of key principles.

Some of these principles are written in terms typically used in traditional engineering decisions (e.g., defense-in-depth).

While written in these terms, it should be understood that risk analysis techniques can be, and are encouraged to be, used to help ensure and show that these principles are rnet. These principles.

ipclude the following:

1. The proposed change meets the current regulations unless it is explicitly related to a
  • requested exemption.
  • The proposed change continu*es to meet current regulations including 1 O CFR *so,* Appendix A, GDC 2 and GDC 4. No exemptions are requested or required to implement this LAR upon approval by the NRC. Standard Review Plan section 3.5.1.4 permits relaxation of deterministic criteria if *it can be demonstrated that the. frequency of damage to unprotected safety-related features is sufficiently small. Regulatory Guide Enclosure.to GNR0-2017/00061 Page 23 of 26 1.17 4 establishes criteria, approved by the NRG, to quantify the "sufficiently small" frequency of damage. Application of the TMRE methodology to the unprotected features at GGNS demonstrates that the Regulatory Guide 1.17 4 criteria are met. 2. The proposed .change is consistent with a defense:.in-depth philosophy.

This is discussed in Section 3.2 of this enclosure.

3. The proposed change maintains sufficient safety margins. This is discussed in Section 3.2 of this enclosure.
4. When proposed changes result in an increase in GDF or risk; the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

The NRC's policy statement on probabilistic risk assessment encourages greater use of this analysis technique to improve safety decision making and improve regulatory

  • efficiency.

One significant activity undertaken

  • in response to the policy statement is the use of PRA to support decisions to modify an individual*

plant's licensing basis. Regulatory Guide 1.174 provides guidance on the.use of PRA findings and risk insights to support licensee requests for changes to a plant's licensing basis, as in requests for license amendments under 1 b CFR 50.90, "Application For Amendment Of License,

  • acceptable method for the licensee and NRG staff to use'in assessing the nature and impact of licensing basis changes when the licensee chooses to support the changes with risk information.

Regulatory Guide 1.174 also makes use of the NRC's Safety Goal Policy Statement.

One key principle in risk-informed regulation is that proposed increases in GDF and risk are small and are consistent with the intent *of the Commission's Safety Goal Policy Statement.

The safety goals and associated quantitative health objectives define an acceptable level of risk that is a small *fraction of other risks to which the public is exposed. The acceptance guidelines defined in Section 2.4 of Regulatory Guide 1 .17 4 are based on subsidiary objectives derived from the safety goals and their quantitative health objectives.

Application of the TMRE methodology to the unprotected features at GGNS demonstrates that the Regulatory Guide 1.17 4, section 2.4, criteria are met, and therefore, the change is small and consistent with the intent of the Commission's Safety Goal Policy Statement.

5. The impact of the proposed change should be monitored using performance measurement strategies.

NEI 17-02, Section 8, describes post license amendment configuration change control. Entergy Operations Design Control programs that meet 1 O CFR 50 Appendix B will ensure that subsequent configuration changes are evaluated for their impact on the TMRE risk basis for accepting the identified nonconforming conditions.

Entergy Operations has confirmed that sufficient mechanisms to assure that any significant changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site D_esign Enclosure to GNR0-2017/00061 Page 24 of 26 Control program. Temporary additional missiles from construction activities shall be addressed in the TMRE analysis.

Permanent changes that increase the site missile .* burden within the.2500 1 missile radius established for TMRE shall be included in the TMRE analysis.

The risk evaluation supporting this change was performed using the GGNS Internal Events model. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities", describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an-application, is sufficient to provide confidence .in the results, such that the PRA can be used in regulatory decision-making for light-water reactors.

The proposed change does not affect compliance with these regulations or guidance and will ensure that the lowest functional capabilities or performance levels of equipment required for safe operation are met. 4.2 No Significant Hazards Consideration Analysis Pursuant to 1 O CFR 50.90, Entergy, hereby submits a License Amendment Request for the Grand Gulf Nuclear Station, Unit 1, to incorporate the TMRE methodology into the GGNS UFSAR. TMRE is an alternative methodology for determining whether protection from generated missiles is required.

Entergy has evaluated whether a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 1 O CFR 50.92, 11 lssuance of amendment," as discussed below: 1) Will operation of the facility in accordance with this proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response:

No. The proposed amendment is to incorporate the TMRE methodology into the GGNS UFSAR. The TMRE methodology is an alternative methodology for determining whether protection from tornado-generated missiles is required.

The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The proposed amendment does not involve an increase in the probability of an accident previously evaluated.

The relevant accident previously evaluated is a Design Basis Tornado impacting the GGNS site. Th~ probability of a Design Basis Tornado is driven by external factors and is not affected .by the proposed amendment.

There are no changes required to any of the previousiy evaluated accidents in the UFSAR. The proposed amendment does not involve a significant increase in the consequences of a Design Basis Tornado. The TMRE methodology is a risk-informed methodology for . determining whether certain safety-related features that are *currently not protected from Enclosure to GNR0-2017/00061 Page 25 of 26 tornado-generated missiles, require such protection.

The criteria for significant increase in consequences was established in the NRC Policy Statement on probabilistic risk assessment, which were incorporated into Regulatory Guide 1 .17 4, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-specific Changes to the Licensing Basis. The TMRE calculations performed by Entergy Operations GGNS meet the* acceptance criteria of Regulatory Guide 1.17 4, which therefore confirms that the proposed amendment does not involve a significant increase in the consequences of an accident previously evaluated.

2) Will operation of the facility in accordance with this proposed change create the * . possibility of a new or different kind of accident from any accident previously evaluated?

Response:

No. The proposed amendment is to incorporate the TMRE methodology into the GGNS

The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The proposed amendment will involve no physical changes to the existing plant, so no new malfunctions could create the possibility of a new or different kind of accident.

The proposed amendment makes no changes to conditions external to the plant that could create the possibility of a new or different kind of. accident.

The proposed change will not create the possibility of a new or different kind of accident due to new accident precursors, failure mechanisms, malfunctions, or accident initiators not considered in the design and licensing bases. The existing Updated Final Safety Analysis Report accident analysis will continue to meet requirements for the scope and type of accidents that require analysis.

Therefore, the proposed amendment will not create the possibility of a new or different kind of accident than those previously evaluated.

3) Will operation of the facility in accordance with this proposed change involve a significant reduction in a margin of safety? Response:

No. The proposed amendment is to incorporate the TMRE methodology into the GGNS UFSAR. The TMRE methodology is an alternative methodology for determining whether protection from tornado-generated missiles is required.

The methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. The change does not exceed. or alter any controlling numerical value for a parameter established in the UFSAR or elsewhere in the GGNS licensing basis related to design basis or safety limits. The chqnge does not impact any UFSAR Chapter E:i'or 15 Safety Enclosure to GNR0-2017/00061 Page 26 of 26 Analyses, and those analyses remain valid. The .change does not reduce diversity or redundancy as required by regulation or credited in the UFSAR. The change does not reduce defense-in-depth as described in the UFSAR. Therefore, the changes associated with this license amendment request do not involve a significant red~ction in the margin of safety. 4.3 Conclusion In conclusion, based on the.considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public. 5 Environmental Consideration A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 1 O CFR 1 20, or would change an inspection or surveillance requirement.

However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets .the eligibility criteri.on for categorical exclusion set forth in 1 O CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement.

or environmental assessment need be prepared in connection with the proposed amendment.

6_ REFERENCES 6.1 NEI 17-02, "Tornado Missile Risk Evaluator Industry Guidance Document", Rev. 1, September 21, 2017 (ADAMS Accession No. ML 17268A036).

6.2 Regulatory Issue Summary 2015-06, Tornado Missile Protection (RIS), on June 10, 2015 (ADAMS Accession No. ML 15020A419).

6.3 Enforcement Guidance Memorandum 15-002, "Enforcement Discretion for Tornado Missile Protection Noncompliance" (ADAMS Accession No. ML 15111A269).

6.4 Grand Gulf Nuclear Station, Unit 1, Updated Final Safety Analysis Report, Revision 2016-00. 6.5 NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," Revision 2, July 1981. 6.6 NUREG-0831, "Grand Gulf Nuclear St~tion Safety Evaluation Report", September 1981. 6.7 NUREG/CR-4461, "Tornado Climatology of the Contiguous United States," Revision 2, February 2007. ) *6.8 Regulatory Guide 1.117, "Tornado Design Classification," Revision 1, April 1978. 6.9 Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Informed Decisions on Plant Specific Changes to the Licensing Basis," Revision 2, May 2011.

  • GNR0-2017/00061

........ . Missile Barriers for Outdoor Equipment . Barrier Design Procedures . 3.5-19 3.5-19 . 3.5-20 3.5.2.5 3.5.3 3.5.3.1 3.5.3.2 Tornado Missile Barrier Design Procedures

... 3.5-20 Barrier Design Procedures for Internally Generated Missiles ...............

3.5-21 3.5.3.3 Tornado Missile Risk Evaluator 3.5.4 References

..... 3.6 PROTECTION AGAINST THE DYNAMIC EFFECTS ASSOCIATED WITH THE POSTULATED RUPTURE OF PIPING 3.6A PROTECTION AGAINST DYNAMIC EFFECTS ASSOCIATED WITH THE POSTULATED RUPTURE OF PIPING (EXCEPT THE PIPING COVERED IN SECTION 3.6B} .............. . 3.6A.l . . 3.5-22 . . 3. 6A-1 3.6A-1 3.6A.l.l 3.6A.l.2 3.6A.l.3 3.6A.2 Postulated Piping Failures in Fluid Systems Inside and Outside the Containment. . 3.6A-l . 3. 6A-l .... 3.6A-6 Design Bases Description 3.6A.2.l Safety Evaluation Determination of Break Locations and Dynamic Effects Associated with the Postulated Rupture of Piping Criteria Used to Define High/Moderate Energy . 3.6A-7 3.6A-ll and Break/Crack Location and Configuration

.. 3.6A-ll 3.6A.2.2 Analytical Methods ..... . 3.6A-21 3.6A.2.3 *Location, Design, artd Analysis of Restraints.

3.6A-22 3.6A.2.4 Guard Pipe Assembly Design .. 3.6A.2.5 . Material to be Submitted for the Operating License Review . 3.6A.2.6 References . . . 3.6B PROTECTION AGAINST DYNAMIC EFFECTS ASSOCIATED WITH POSTULATED RUPTURE OF PIPING (IN THE RECIRCULATION SYSTEM AND IN-CONTAINMENT MAIN STEAM) . . . . .

  • . . 3.6B.l Postulated Piping Failures in Fluid Systems 3.6A-30 3.6A-35 3.6A-36 .. 3.6B-1 Inside and Outside of Containment

....... 3.6B-l 3.6B.2 Determination of Break Locations and Dynamic 3-iii Revision 2016-00 GRAND GULF NUCLEAR GENERATING STATION Updated Final Safety Analysis Report (UFSAR) LIST OF TABLES Table 3.2-1 Classification of Systems, Components and Structures (56 Sheets) Table 3.2-2 Code Classification Groups -Industry Codes and Standards for Mechanical Components Table 3.2-3 Summary of Safety Class Design Requirements (Minimum)

Table 3.2-4 Quality Group A, Band C Components

-Applicable ASME Code Edition and Addenda (4 Sheets) Table 3.2-5 ASME Section III Components or Component Parts Obtained to the Guidance of Generic Letter 89-09 Table 3.3-1 Tornado-Protected Components and Resistant Enclosures (2 Sheets) Table 3.4-1 Structures, Penetrations, and Access Openings Designed for Flood Protection Table 3.4-2 Seismic Category I Systems and Components Protected from Environmental Floods Table 3.4-3 Deleted Table 3.5-1 Potential Missiles (Rotating)

Outside Containment (2 Sheets) Table 3.5.1-4a Safety-Related Structures, Systems, and Components that do not Require Protection from Tornado Generated Missiles Based on Tornado Missile Risk Evaluator Methodology Table 3.5-2 Potential Missiles (Pressurized)

Outside Containment (2 Sheets) Table 3.5-3 Potential Missiles (Rotating)

Inside Containment Table 3.5-4 Table 3.5-5 Table 3.5-6 Table 3.5-7 Potential Missiles (Pressurized)

Inside Containment (3 Sheets) Missile Characteristics of the Selected Generic Potential Pressurized Missiles Missile Barriers for Natural Phenomena and Internally Generated Missiles Cumulative Probability of Hypothetical Turbine Missiles Damaging Safety-Related Structures, Systems, and Components -P 4 3-xvii Revision 2016-00 Table 3.5-8 Table 3.5-9 GRAND GULF NUCLEAR GENERATING STATION Updated Final Safety Analysis Report (UFSAR) 1 '-' Safety-Related Components Located Outdoors (4 Sheets) .Evaluation of Secondary Missiles Inside Containment 3-xviia Revision 2016-00 GGNS-UFSAR REGULATORY GUIDE1.117, APRIL 1978, TORNADO DESIGN CLASSIFICATION Regulatory Guide 1.117 Position This guide describes a method acceptable to the* NRC for identifying those structures.

systems, and components of light-water-cooled reactors that should be protected from the effects of the design basis tornado (including tornado missiles) and remain functional.

GGNS Position Section D of the Guide indicates that implementation of this guide is not applicable to Grand Gulf based upon the docket date. Therefore, Grand Gulf complies with the requirements of the , guide only to the extent discussed in the referenced section. Alternatively, an alternate methodology, Tornado Missile Risk Evaluator (TMRE}, can be used to determine whether protection from tornado-generated missiles is required.

The TMRE methodology can only be applied to discovered conditions where tornado missile protection was not provided, and cannot be used to avoid providing tornado missile protection in the plant modification process. FSAR Subsection . 3.5.2.3 Barriers for Missiles Generated Outside of Plant Structures A tabulation of protected components and the structures, shields, and barriers that are designed to provide protection from identified missiles g~nerated outside these structures, shields, and

  • barriers is given in Table 3.5-6. The missile barriers indicated are designed for the tornado and internally generated missiles using the procedures given in subsection 3.5.3. Structures which protect plant systems from missiles generated outside plant structures are identified in Figure 3.4-1. 3.5.2.4 Missile Barriers Within Plant Structures Other Than Containment Missile barriers or restraints are provided within plant structures outside the containment, as.* necessary, to provide protection for components listed in Table 3.5-6. For the pressurized and rotating component failure missiles identified in subsection 3.5.1.2 which originate outside the containment, the following steps are taken to identify the missiles and to protect the safety-related components:
a. Missiles are categorized as to the system in which they originate. (See Table 3.5-1 through 3.5-4.) b. The components which are protected from a missile are identified.
1. A determination is made as to whether the missile characteristics are severe enough to cause loss of function to protected components utilizing the procedures given in BC-TOP-9 (Ref. 4). Credit is taken for existing structures or components which are interposed between ~he missile origin and the protected component.
2.
  • A trajectory is altered by changing the orientation or position of the missile and/or the position of the protected component if this is feasible.

1 GGNS-UFSAR

3. If loss of function of the protected component can occur due to missile . damage, either suitable restraints are provided to prevent the. missile from leaving its point of origin or barriers are installed to intercept the' missile trajectory.

3.5.2.5 Missile Barriers for Outdoor Equipment The protection against potential tornado missile damage which is afforded to partially exposed building openings and safety-related components located outdoors is listed in Table' 3.5-8. 3.5.3 Barrier Design Procedures Missile-resistant barriers and structures are designed to withstand and absorb missile impact loads to prevent damage to the protected structures, systems, and components.

The layout and principal design features of structures serving primarily as missile-resistant barriers are sh.own. in Figure 3.4-1. 3.5.3.1 Tornado Missile .Barrier Design Procedures Tornado resistant structures may sustain local missile damage such as partial penetration and local cracking and/or permanent deformation, provided that structural integrity

is maintained and . that perforation is precluded, and the contained Category I systems, components, and. -equipment are not subjected to damage by secondary miss.iles such as from concrete spalling and* scabbing.

to be more than adequate.

It is considered that a thickness of 24 in. for reinforced concrete with a minimum strength of 4000 psi for the walls and roof slabs of seismic Category I structures is adequate to resist the local impact effects (i.e., penetration and scabbing) of tornado-generated missiles in the horizontal and vertical directions.

[HISTORICAL INFORMATION]

[This criterion is based on the results of the test program, "Missile Impact Testing of Reinforced Concrete Panels," conducted by Calspan Corporation for Bechtel Corporation and reported in Calspan Report No.* HC-5609-D-1, January 1975 (Ref. 2), and reported by A. E. Stephenson (Sandia Laboratories), "Tornado Vulnerability Nuclear Production Facilities," April 1975 (Ref. 3), and "Full Scale Tornado Missile Impact Tests" (Ref. 5).] Barrier *structural response was calculated using a time history approach.

Equivalent dynamic models were developed for the wall and roof barriers.

[HISTORICAL INFORMATION]

[Conservative impact force time histories were derived from the available experimental evidence (Ref. 2, 5). The resulting maximum barrier deflections calculated from the dynamic analysis were used to determine structural stresses, reactions and ductilities in accordance with the design principles of BC-TOP-9A (Ref. 4).] The 24-inch thickness of concrete is kept constant*

and the reinforcing is changed to lower structural response, as needed. . ' . Table 3.5-1 O outlines the specific references to the significant protection parameters for the seismic Category I structures.

All safety systems/components are protected from generated missiles by a concrete roof or wall. Where exhaust or intake openings exist, the openings c;1re protected by a concrete maze enclosure which protects the essential equipment by preventing a linear missile trajectory.

The intake and exhaust openings for the mechanical draft cooling towers are exceptions.

In order to optimize the total system design of these structures (and allow effective flow of their air currents), these structures were allowed to remain open, without mazes. The standby service water cooling tower fans are protected from vertical 2

. GGNS-UFSAR missiles by a 7-inch-thick steel grating, as shown in Figure 3.8-115. This protection is supplemented by the redundancy of the standby service water system, which is discussed in subsection 9.2~ 1. 3.5~3.2 Barrier Design Procedures for Internally Generated Missiles In general, protection from internal missiles is provided by barriers.

The procedures and calculations employed in.design of missile-resistant barriers for turbine missiles and other internally generated missiles are described in Bechtel Topical Report, "Design of Structures for Missile Impact," ~C-TOP-9A (Ref. 4). 3.5.3.3 Tornado Missile Risk Evaluator The Nuclear Energy Institute (NEI) developed the Tornado Missile Risk Evaluator (TMRE) informed methodology for identifying and evaluating the safety significance associated with structures, systems and components (SSCs) that are exposed to potential tornado-generated missiles.

TMRE is an alternative methodology for determining whether protection from generated missiles is required.

The methodology can only be applied to discovered conditions where tornado missile protection was not provided.

and cannot be used to avoid providing tornado missile protection in the plant modification process. The TMRE methodology was transmitted to the NRC by NEI as NEI 17-02. Revision 1, on September 21, 2017 and is hereby incorporated by reference into this UFSAR. 3.5.4 1. 2. 3. References NEI 17-02. Revision 1 1 Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," September 2017 [HISTORICAL INFORMATION]

["Missile Impact Testing of Reinforced Concrete Panels," Calspan Report No. HC-56-9-D~

1, Calspan Corporation, Buffalo, New York, January 1975.

  • Stephenson, A. E., "Tornado Vulnerability Nuclear Production Facilities," Sandia Laboratories, April 1975. 4 .. "Design of Structures for Missile Impact," BC-TOP-9A, Revision 2, Bechtel Power Corporation, San Francisco, California, September 1974. 5. Stephenson, A. E., "Full Scale Tornado Missile Impact Tests," EPRI Report No. NF-440, Sandia Laboratories, July 1977.] 3 , .

GGNS-UFSAR TABLE 3~5-8: SAFETY-RELATED COMPONENTS LOCATED OUTDOORS Component

1. Diesel Generator fuel oil storage tanks 2. Category I electrical manholes 3. Electrical Category I duct banks 4. SSW cooling tower Protection Against Tornado Generated Missiles, Turbine Missiles*, or a Seismic Event Buried 1 O feet below finished grade and protected with a 2'-0" thick reinforced concrete slab on top (see Figure . 3.8-87) Protected by a box section below grade with a 1 '-0" thick reinforced concrete _wall *& 2' -0" thick reinforced concrete cover slab (see Figure 3.8-88)
  • Located 4 feet below finished grade or with c:tn equivalent amount of concrete cover (see Figure H.8-88) . . . a. 24-in. dia. SSW supply & return Buried 37'-0"(+)

below grade and checked per BC-lines TOP-4A Rev. 3 against seismic loadings b. 10-in. dia. HPCS supply & return lines c. Fanstacks Buried 5'-01"(+) .below grade *and checked per TOP-4A Rev. 3 against seismic loadings*

Protected by a 2'-0" thick reinforced concrete cylindrical wall and 0'-7" heavy duty steel grating (see Figures 3.8-97, 3.8-98, 6r 3.8-115) d. Air intake louvers with centerline Protected by a 2'-0" thick reinforced concrete barrier at El. 151 '-3" wall (see Figures 3.8-94 & 3.8-95) e. Air exhaust louvers with centerline at El. 151 '-3" f. ,16-in dia. SSW vertical piping between basins and SSW s u pe rstructu res 5. Control Building a. Air intake louvers. with centerline at El. 139' -2" b. Air exhaust louvers with centerline at El. 194'-1 O" c .. HVAC outside air intake louver/damper.

Centerline of louver at El. 208' -8" d. Elevator machine room intake air damper with centerline at El. 212'-4" e. Elevator machine room service door at El. 207' -6" Protected by a 2'-0" . thick reinforced concrete barrier wall (see Figures 3.8-94 & 3.8-95) Exposed to horizontal missiles between elevations 133;-0" and 141'-6" but shielded by SSW superstructures.

pump rooms. and valve, rooms. Protected by a 2' -0" thick reinforced concrete barrier wall (see Figure 3.8-103) Protected by a 2' -0" thick reinforced concrete barrier wall (see Figure. 3.8-107) Damper located horizontally on floor of elevator machine room and protected by 2'-0" thick reinforced concrete barrier wall and a 2'-0" thick reinforced concrete roof slab of machine room. Louver is exposed -but shielded by turbine bldg. with roof El. 232'-0" located approximately 12 feet to the east (see Figure 3.8-117) . Exposed but shielded by turbine bldg. with roof El. 232'-0" located approximately 120 feet to the east (see Figure 3.8:117)

  • Exposed but shielded by turbine bldg. with roof El. 232'-0" located approximately 120 feet to the east (see 4
f. Elevator machine room exhaust air check damper with centerline El. 212'-4" g. Six inch dia. openings 81 on north face of wall h. Stairwell door elevation 133'-0" 6. Diesel-generator Building a. Air exhaust louver with centerline at El. 163' -9" b. Air exhaust louvers with centerline at El. 162'-0" c. Air intake louvers with centerline at El. 159'-8" d. Diesel generator exhaust pipes above roof El. 172' -0" e. Diesel generator lube oil sump vents top El. 175' -0" f. Diesel generator fuel oil tank vent top El. 173'-6" 7. Auxiliary Building a. RHR room blowout shafts above El. 185'-0" GGNS-UFSAR
  • Figure 3.8'." 117) Exposed but shielded by the partially.

completed Unit 2 Containment shell located approximately 90 feet to the north (see Figure 3.8-117) Exposed due to partial completion of Unit 2 Auxiliary Bldg .* but shielded by the partially completed Unit 2 Containment shell located approximately 50 feet to the northwest.

Exposed but partially shielded by ESF21 transformer

  • located approximately 20 feet to the west. Protected by adjacent Auxiliary Bldg. wall & generator bldg. with roof El. 172'-0" (see Figure 9.5-21)
  • Protected by adjacent Auxiliary Bldg. wall & generator bldg. with roof EL 172'-0" (see Figure 9.5-21) Protected by a 2'-0" thick reinforced concrete barrier wall (see Figure 9.5-21) See subsection 9.5.8.3 Exposed.but partially shielded from horizontal missiles by concrete parapet with top elevation of 17 4' -0" Exposed but shielded from horizontal missiles by concrete parapet with top elevation of 17 4' -0" Protected by a.2'-0" thick reinforced concrete barrier structure (see Figure 3.8-81) b. RHR pump room & RCIC room Protected by a 2'-0" thick reinforced concrete barrier blowout shafts above El. 185'-0"
  • structure (see Figure 3.8-81) c. Steam tunnel blowout shaft above El. 185' -0" d. Louver and door at El. 185'-0" e. Door at roof El. 185'-0" f. Main entrance' door at El..139'-0" g. Exit door at El. 139'-0" Protected by a 2' -0" thick reinforced concrete barrier structure (see Figure 3.8-81) Protected by a 2' -0" thick reinforced concrete barrier wall (see Figure 3.8-81) Protected by a 2' -0" thick reinforced concrete barrier wall (see Figure 3.8-81) Protected by a 2'-0" thick reinfo.rced concrete barrier wall & 2'-0".thick top slab (see Figure 3.8-79) Protected by a 2'-0" thick reinforced concrete barrier wall & 2'-0" thick top slab (see Figure 3.8-79) *For protection against turbine missiles, see subsection 3.5.1.3.3.

Table* 3.5.1-4a Non-Conforming (Safety-Related)

SSC Vulnerabilities Item System ID Vulnerabilit:it Descri~tion General Location Diesel Generato.r Fuel Yard {above underground Oil Storage Tanks Diesel Generator Fuel Oil Storage Tank Vents Diesel Generator Fuel Oil 1 {1P75-A003A 1 1P75-and Inlets Storage Tanks) A003B 1 and 1P81-A001)

SSW Vertical Piping between Basins and SSW SSW Cooling Tower Basin l P41 SSW Return Lines at Gridlines B2, B3. C2, Superstructures C3, C6, & C7 Fuel Oil Day Tank {Q1P75A004A, Diesel Generator Fuel Oil Day Tank Vents Diesel Generator Building J. Q1P75A004B 1 and {Penetrations DC-20A, DC-21A, and DC,22A) (roof El. 172'-0 11} Q1P81A002)

North End of Breezeway P41 HPCS {Div. 3) Room SSW Supply and Return Headers {Penetrations between Diesel 1: Cooler (QlTSiBOOl-C}

DP-lA and DP-2A) Generator Building and Auxiliary Building South End of Control (See Section 3.1.1.15, Building (Access gained 2 Reference GGNS~CS Cable Chase Room 1A539 (Behind Door 1A501) from the Auxiliary 00002) Building Roof) 6 ifl*.' .. . GNR0~2017/00061 Grand Gulf Nuclear Station, Unit No. 1 Docket No. 50-416 I License No. NPF-29 License Amendment Request to lncorpo~ate Tornado Missile Risk Evaluator into Licensing Basis Attachment 2 Probabilistic Risk Assessment Technical Adequacy Documentation

,/ *ENERCON GGNS TMRE PRA Application PAGE N0.1 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 J.1 Overview This Attachment documents the necessary information to demonstrate that the internal events Probabilistic Risk Assessment (PRA) for the. Grand Gulf Nuclear Station (GGNS) meets the requirements of the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS)

PRA Standard [J.1] as endorsed by Regulatory Guide (RG) 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," [J.2] at an appropriate capability category to support the GGNS Tornado Missile Risk Evaluator (TMRE) program. This enclosure provides documentation that is consistent with the requirements of Section 3.3 and Section 4.2 of RG 1.200, Revision 2:

  • Section J.2 addresses the need for the PRA model to represent the as-built, as-operated plant, *
  • Section J.3 discusses permanent plant changes that have an impact on those systems, structures, and components (SSCs) modeled in the PRA but have not been incorporated in the baseline PRA model.
  • Section J.4 demonstrates that the GGNS PRA has been performed consistent with the ASME/ANS PRA Standard requirements as endorsed in RG 1.200, Rev. 2. The peer review that has been conducted and the resolution of findings from those
  • reviews are discussed in this section. The unique TMRE considerations for certain supporting requirements (SRs) with NRC clarifications from the TMRE guidance document, NEI 17-02 are also discussed in this section.
  • The conclusion on the technical adequacy of the GGNS PRA are provided in Section J.5. Other technical elements of the PRA, including but not limited to internal flooding, fire; and other external events, are not required for the TMRE and are not discussed in this document.

J.2 Basis to Conclude that the PRA Model Represents the As-Built, As-Operated Plant The GGNS PRA Model of Record (MOR) is maintained as a controlled document and is updated on a periodic basis to represent the as-built, as-operated plant. Entergy procedures provide the guidance, requirements, and processes for the maintenance, update, and upgrade of the PRA: a. The process includes a review of plant changes, relevant plant procedures, and plant operating data, as required, through a chosen freeze date to assess the effect on the PRA model. b. The PRA model and controlling documents are revised as necessary to incorporate those changes determined to impact the ENERC .N GGNS TMRE PRA Application PAGE NO. 2 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 model. c. The determination of the extent of model changes includes the following:

  • Accepted industry PRA practices, ground rules, and assumptions consistent with those employed in the ASME/ANS PRA Standard,
  • Current industry practices,
  • NRC guidance,
  • Advances in PRA technology and methodology, and
  • Changes in external hazard conditions.

For plant changes of small or negligible impact, the model changes can be accumulated and a single revision performed at an interval consistent with major PRA revisions.

The results of each evaluation determine the necessity and timing of incorporation of a particular change into the PRA model. An electronic tracking database is utilized to document pending model changes and updates. J.3 Identification of Permanent Plant Changes Not Incorporated in the PRA Model \ The current GGNS Internal Events model (Revision 4a) is based on the plant configuration as of August2012 (plus ELAP/FLEX changes noted below) and plant-specific data through August, 2012. It is a complete model update of the Revision 3 model and includes a mini-update focused on including the ability to credit the operators declaring an extended loss of AC Power (ELAP) event in progress, and implementing FLEX strategies and equipment to respond to the ELAP. The GGNS ELAP/FLEX modifications were implemented in 2016. Review of the PRA model change database as of August 2017 indicates that there are currently no identified permanent plant modifications that have not been incorporated into the Revision 4a PRA model of record. J.4 Conformance with ASME/ANS PRA Standard The following sections describe the conformance and capability of the GGNS PRA against the ASME/ANS PRA Standard.

There have been two (2), formal internal events MOR revisions since 2008. J.4.1 2008 Internal Events Update The 2008 revision of the model of record, Revision 3, was a general update of the model that included the following changes.

  • Updated plant specific data (thru 8-2006)
  • Updated plant specific (thru 8-2006) and generic initiator frequencies
  • New initiators a Loss of service transformer (ST11 and ST21) a Reactor Vessel Rupture a Loss of CRD a Break (LOCA) Outside of Containment ENE RC ON GGNS TMRE PRA Application .PAGE NO. 3 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1
  • Major changes to LOSP modeling o Added loss of preferred offsite power initiator o Added con$equential loss of offsite power event as a result of transient initiator o Added consequential loss of offsite power event as a result of LOCA initiator o New industry data used for LOSP recovery analysis *
  • Separated loss of PCS initiator into Closure of MSIVs initiator and Loss of PCS due to other causes initiator
  • Updated common cause analysis
  • Updated human reliability analysis
  • Included modeling for loss of ECCS pumps due to containment failure
  • Revised instrument air system modeling to incorporate new Plant Air compressors
  • Revised modeling of CRD-less credit for CRD * -Added more detailed modeling for failure to scram (C11 and C71 system~)
  • Added more detail to power conversion model ** J.4.2 2017 Internal Events Update In 2015, due to the number of open model change requests (MCRs), physical plant changes, and operating philosophy changes such as changing to a 24 month refueling cycle, the GGNS PRA MOR was completely re-generated.

In addition, a new, Internal Flooding Analysis was performed.

This new Revision 4 MOR underwent a BWR Owners Group Peer Review in September 2015, and a final Peer Review Report was issued in February 2016 [J.3]. Following the Peer Review, the Revision 4 MOR was revised to address the Peer Review comments as documented in Reference J.4. After completion of the Revision 4 MOR, but before the Revision 4 MOR was issued for use, a mini-update was performed to add FLEX capabilities into the Revision 4 MOR so that sensitivity studies associated with the use of FLEX equipment could be performed.

As part of this update, identified modeling issues were also identified and resolved as documented in

  • Reference J. 7. This mini-update is ref~rred to as the GGNS Rev 4a PRA MOR, and is the current GGNS MOR. Changes incorporated into the Rev 4a PRA MOR of record since the last released MOR (Revision
3) include the following.
  • . Data o Plant specific data updated thru 8-2012 o Updated maintenance unavailability o Updated LOSP frequencies and non-recovery data
  • Initiating events o Updated plant specific initiating events using\ plant operating experience (thru 8-2012), . o *, Updated Support System Initiating Event fault trees to reflect current design and data
  • o Incorporated new generic data for other initiator frequencies ENER:C. GGNS TMRE PRA Application PAGE NO. 4 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION
  • 1 o Breaks Outside Containment (feedwater line break and main steam line break) removed from at-power internal events model and included in internal flood analysis
  • Success criteria updated o Additional HVAC analyses o New MAAP analyses to reflect plant power uprate o Update of HRA timing based on above analyses o Credit for High Pressure Containment Spray. (HPCS) pump to function post containment failure added.(U1LTbranch on event trees) o Credit for control rod drive injection removed due to lack of flow* and makeup capability.
  • Accident sequence analysis o Updated to reflect success criteria changes and updated procedures o Updated ISLOCA and ATWS models '~:, o Updated to include potential to enter ELAP and credit FLEX equipment
  • System models
  • o Updated all models and documentation to incorporate current procedures and design o Expanded the modeling of support systems o Revised to reflect 24 month operating cycle o Addition of FLEX equipment and capabilities
  • Human Reliability o Addition of new HFEs developed for system models and accident sequ~nces o Use of Human Reliability Analysis Calculator o Update timing o Update of dependency assessment o . Use of delay times *. LERF o Developed LERF specific model incorporating new MAAP analyses o Integrated with the Level 1 model o Incorporated containment isolation and hydrogen ignition systems into the model o Utilized plant specific inputs to support Capability Category II analysis
  • Internal flooding o Complete revision using EPRI methodology and data ... o Used updated flooding piping assessment for most recent frequency data o Detailed flooding walkdowns o *integrated with internal events at-power PRA model J.4.3 Internal Events PRA Peer Review In 2015 the Revision 4 MOR underwent a BWR Owners Group Peer Review using the NEI 05-04 process, the ASME PRA Standard (ASME/ANS RA-Sa-2009) and Regulatory Guide 1.200, Rev. 2. The GGNS Peer Review was a full-scope review of the Technical Elements of the internal events and internal flooding, at-power PRA. A summary of the assessment against each of the eight technical elements (i.e. high-level requirements) of ASME/ANS RA-Sa-2009 is provided in Tables J.1 through J.8 of this attachment.

Table J.9 lists those supporting

-ENERC 'N .* GGNS TMRE PRA Application PAGE NO. 5 OF 62 Attachment J REPORT NO. ENTG#GG052.-TMRE;.002 REVISION 1 requirements (SRs) from the PRA Standard that have been identified in the TMRE Guidance Document as being applicable to the TMRE PRA. A systematic review of these SRs relati,ve to the GGNS TMRE model development was performed and.documented in the notes column of Table J.9. Table J.10 provides a listing of the Finding level GGNS Peer Review Facts and Observations (F&O) [J.4]. The table also includes the resolution of each Finding. The Findings were resolved so as to meet the .Capability Category 11 requirements of the ASME PRA Standard Supporting Requirements that were applicable to the Finding. All of the Findings are considered closed. The resolution and closure of the Findings from the peer review have been subjected to a review in accordance with the NEI 05-04 Appendix X, "Close Out of Facts and Observations (F&Os)" finding closure review process [J.5]. The closure review determined that air of the findings were closed. Reference J.6 documents the closure review. J.5 Conclusions on PRA Technical Adequacy The GGNS PRA*model is sufficiently robust and suitable for use in risk informed processes such as the TMRE Program. The peer review and closure of findings from the review demonstrate that the PRA has been performed in a technically correct manneL There are no open finding-level F&Os for the GGNS PRA. The assumptions and approximations used in development of the PRA have been reviewed and are appropriate for this application.

Entergy procedures are in place for controlling an updating the models, and for assuring that the model represents the as-built, as-operated plant. The conclusion is that the GGNS PRA model is acceptable to. be used as the basis for risk-informed applications including the* Tornado Missile . Risk Evaluator (TMRE). References , \. , . , J.1 ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency

  • J.3 GGNS 2015 PRA Peer Review Report, Revision 0, BWR Owners Group, February 201.6 J.4 . .PSA-GGNS-01-FNO-RES, Resolution of GGNS PRA P.eer Review Facts and Observations, Revision 0, August 2017 J.5 NEI 05-04, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, Revision 3 J.6 ENERCON Report ENT#GG052-REPT-001, Grand Gulf Nuclear Station Probabilistic_

Risk

  • Assessment Peer Review Findings Closure, Revision O

'E.NERC N GGNS TMRE PRA Application PAGE NO. 6 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 J.7 PSA-GGNS-01-QU, Grand Gulf Nuclear Station Probabilistic Risk Assessment Model Integration and Quantification, Revision 1, July 24, 2017 .

  • I

,, GGNS TMRE PRA Application PAGE NO. 7 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.1: GGNS Assessment of Supporting*

Requirement (SR) Capability Categories For Initiating Events (IE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR I II Ill Met Not Met N/A Clarification HLR-IE-A IE-A1 ALL x x IE-A2 ALL x IE-A3 ALL. x IE-A4 1/11 x IE-A5 II x IE-A6 II x IE-A7 ALL IX IE-AB II x \ IE-A9 II x IA-10 x HLR-IE-8 IE-81 ALL x IE-82 ALL x , IE-83 II x IE-84 ALL x IE-85 x HLR-IE-C IE-C1 ALL x x IE-C2 ALL x x IE-C3 ALL x x IE-C4 ALL x IE-C5 1/11 x IE-C6 ALL x IE-C7 1/11 ! x IE-CB ALL x IE-C9 ALL x IE-C10 ALL x IE-C11 ALL x \ IE-C12 ALL x IE-C13 1/11 x IE-C14 1/11 x IE-C15 ALL *x(1) x HLR-IE-D IE-01 ALL x IE-02 ALL x IE-03 ALL x GGNS TMRE PRA Application . PAGE NO. 8 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.2: GGNS Assessment of Supporting Requirement (SR) Capability Categories For Accident Sequences (AS), ASME/ANS-RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Caoabilitv Cateaorv SR TMRE HLR. SR I II Ill Met Not Met N/A Clarification HLR-AS-A AS-A1 ALL x x AS-A2 ALL x AS-A3 ALL x x AS-A4 ALL x x AS-A5 ALL x x AS-A6 ALL x AS-A7 1/11 x AS-A8. ALL x AS-A9 II x AS-A10 II x x AS-A11 ALL x HLR-AS-8 AS-81 ALL x x AS-82

  • ALL. x AS-83 ALL x x AS-84 x* AS-85 ALL x AS-86 ALL .x AS-87 ALL x x HLR-AS-C AS-C1 ALL. x AS-C2 ALL x AS-C3 ALL X-GGNS TMRE PRA Application PAGE NO. 9 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.3: GGNS Assessment of Supporting Requirement (SR) Capability Categories For Success Criteria (SC), ASME/ANS RA-S,a-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE HLR SR I II Ill Met Not Met N/A Clarification HLR-SC-A SC-A1 ALL x SC-A2 11/111 x SC-A3 ALL x SC-A4 x N/A SC-A5 11/111 x SC-A6 ALL x . HLR-SC-8 SC-81 II x SC-82 11/111 x x SC-83 ALL x . SC-84 ALL x SC-85 ALL x HLR-SC-C SC-C1 ALL x SC-C2 ALL x SC-C3 ALL x GGNS TMRE PRA Application
  • PAGE N0.100F62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.4: . GGNS 'Assessment of Supporting Requirement (SR) Capability Categories For System Analysis (SY), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, *Rev. 2 . ' ' . Capability Category . SR TMRE' HLR SR I II Ill Met Not Met N/A Clarification HLR-SY-A SY-A1 ALL x SY-A2 ALL x SY-A3 ALL x SY-A4 11/111 x x SY-A5 ALL x SY-A6 ALL x SY-A7 1/11 x SY-A8 ALL x SY-A9 ALL x SY-A10 ALL x SY-A11 ALL x x SY-A12 ALL x x SY-A13 ALL x x SY-A14 ALL x x SY-A15 ALL x x SY-A16 1/11 x SY-A17 ALL x x SY-A18 ALL x SY-A19 .. ALL x SY-A20 ALL x SY-A21 ALL x SY-A22 II x. SY-A23 ALL x SY-A24 ALL x HLR-SY-8.

SY-81 11/111 x SY-82 1/11 x SY-83 ALL x SY-84 ALL x SY-85 ALL x SY-86 ALL x GGNS TMRE PRA Application 1PAGE NO~ 11 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 . Table J.4, continued: . GGNS Assessment of Supporting Requiremen~ (SR) Capability Categories For System Analysis (SY), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRE . HLR SR I II Ill Met Not Met N/A Clarification

,*<'.\. HLR~SY-SY-87 II . x I x B(cont'd)

SY-88 ALL x x SY-89 ALL x SY-810 11/111 x SY-811 ALL x SY-812 ALL x SY-813 ALL x SY-814 ALL x x SY-815 ALL.* x h .. \X HLR-SY-C SY-C1 ALL x ,* SY-C2

  • ALL x SY-C3 ALL x
  • Note 1 -Based on the closure review of the Findings associated with SR, the SR is now met at CC-II or greater. Table J.5: GGNS Assessment of Supporting Requirement (SR) Capability Categories For Human Reliability (HR), ASME/AN.s RA.;.Sa-2009 as endorsed by. RG 1.200, Rev. 2
  • Capability Category SR TMRE HLR SR I II Ill Met Not Met N/A Clarification I HLR-HR-A HR-A1 ALL x HR-A2 ALL x HR-A3 ALL x HLR-HR-8 . HR-81 x HR-82 x HLR-HR-C HR-C1 ALL x HR-C2 I x HR-C3 ALL x HLR-HR-D HR~D1 ALL x HR-D2 II X.

ENER'C-N GGNS TMRE PRA Application PAGE N0.12 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION.

1 Table J.5, continued:

GGNS Assessment of Supporting Requirement (SR) Capability Categories

  • For Human Reliability (HR), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 \ Capability Category SR TMRE HLR SR I II 111 Met-Not Met N/A Clarification HLR-HR-HR-03 11/111 x D(cont'd)

HR-04. .ALL x* I HR-05 ALL x HR-06 ALL x HR-07 1/11 x HLR-HR-E HR-E1 ALL x I HR-E2 ALL x HR-E3 11/111 . x x HR-E4 11/111 x x HLR-HR-F HR-F1 1/11 x HR-F2 I x'1) HLR-HR-G HR-G1 111 x HR-G2 ALL x HR-G3 11/111 x HR-G4 II x I HR-G5 II ', x x HR-G6 ALL x .HR-G7 ALL x'1) .x HR-G8 ALL x HLR-HR-H HR-H1 II x x HR-H2 ALL x x HR-H3 ALL x HLR-HR-1 HR-11 ALL x HR-12 ALL x HR-13 ALL x Note 1 -Bas~d on the closure review of the Findings associated with SR, the SR is now met at CC-II or greater. l

.ENERC N GGNS TMRE PRA Application PAGE NO. 13 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.6: GGNS Assessment of Supporting Requirement (SR) Capability Categories For Data Analysis (DA), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category Not SR TMRE HLR SR I II Ill Met Met NIA Clarification HLR-DA-A DA-A1 ALL x x DA-A2 ALL x DA-A3 ALL x PA-A4 ALL x HLR-DA-8 DA-81 . II x DA-82 1/11 x HLR-DA-C DA-C1 ALL x DA-C2 ALL x DA-C3 ALL x(1> DA-C4 ALL .. X DA-CS ALL x DA-C6 ALL x DA-C7 11/111 x DA-CB 11/111 x DA-C9 1/11 x DA-C10 II x DA-C11 ALL x DA-C12 ALL x I

  • DA-C13 11/111 x DA-C14 ALL x(1> DA-C15 ALL x DA-C16 ALL x HLR-DA-D DA-D1 II x DA-D2 ALL x DA-D3 II x DA-D4 11/111 x DA-DS II x DA-D6 II x DA-D7 x DA-DB II x ENERC N GGNS TMRE PRA Application PAGE N0.14 OF 62 Attachment J 'REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.6; continued:

GGNS Assessment of Supporting Requirement (SR) Capability Categories For Data Analysis (DA), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category Not SRTMRE HLR SR I II Ill Met Met N/A Clarification HLR-DA-E DA-E1 ALL x(1> DA-E2 ALL x DA-E3 ALL x Note 1 ....,. Based on the closure review of the Findings associated with SR, the SR 1s now met at CC-II or greater. Table J.7: GGNS Assessment of Supporting Requirement (SR) Capability Categories For Quantification (QU), ASME/ANS RA-Sa-2009 as endorsed.by RG 1.200, Rev. 2 Capability Category Not SRTMRE HLR SR Met Met N/A Clarification I II Ill HLR-QU-A QU-A1 ; ALL x QU-A2 ALL x(1> QU-A3 11/111 x QU..:A4 ALL x* QU-AS ALL x x HLR-QU-8 QU-81 ALL x QU-82 ALL X. au.:s3 ALL x QU-84 ALL x QU-85 ALL x QU-86 ALL x QU-87 ALL x QU-88 ALL x QU-89 ALL x QU-810 x HLR-QU-C QU-C1 ALL x QU-C2 \ ALL x QU-C3 ALL x Note 1 -Based on the closure review of the Findings associated with SR, the SR is now met at CC-II or greater.

GGNS TMRE PRA Application PAGE NO. 15 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.7, continued:

GGNS Assessment of Supporting Requirement (SR) Capability Categories

.. For Quantification (QU), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 -i Capability Category Not SR TMRE HLR SR I II 111 Met Met N/A Clarification HLR-QU-D QU-01 ALL x QU-02 ALL x QU-03 ALL x QU-04 11/111 x(1) QU-05 ALL x x* QU-06 11/111 x QU-07 ALL x x HLR-QU-E QU-E1 ALL x *x QU-E2. ALL x x QU-E3 II .x QU-E4 ALL x x HLR-QU-F QU-F1 ALL x QU-F2 ALL x QU-F3 11/111 x(1) QU-F4. ALL x QU-F5 ALL x QU-F6 ALL x(1) Note 1* -Based on the closure review of the Findings associated with SR, the SR 1s now met at CC-II or greater.

GGNS TMRE PRA Application PAGE NO. 16 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.8: GGNS Assessment of Supporting Requirement (SR) Capability Categories For LERF Analysis (LE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 Capability Category SR TMRq HLR SR Met Not Met N/A I II 111 . Clarification HLR-LE-A LE-A1 ALL x LE-A2 ALL x LE-A3 ALL x LE-A4 ALL x LE-AS ALL. x HLR-LE-8 LE-81 II x ,. LE-82 II x LE-83 ALL x HLR-LE-C LE-C1 II x LE-C2 I . x(1) LE-C3 I x. x LE-C4 II x LE-C5 II x LE-C6 ALL x LE~C7 ALL x LE-CB ALL x LE-C9 11/111 x . LE-C10 I x LE-C11 11/111 x LE-C12 I x LE-C13 11/111

  • x HLR-LE-D LE-01 II x LE-02 II x LE-03 I x LE-04 II x LE-05 x LE-06 x LE-07 II x HLR-LE-E LE-E1 ALL x LE-E2 II x LE-E3 I x LE-E4 ALL x

'ENERC N GGNS TMRE PRA Application PAGE N0.17 OF 62 Attachment J

  • REPORT NO. ENTG#GG052-TMRE-002 REVISION 1* Table J.8, continued: . GGNS Assessment of Supporting Requirement (SR) Capability Categories For LERF Analysis (LE), ASME/ANS RA-Sa-2009 as endorsed by RG 1.200, Rev. 2 I
  • Canabilitv Cateuorv . ' HLR SR Met Not Met .N/A SR TMRE I II Ill Clarification HLR-LE-F LE-F1 I x'*1) LE-F2 ALL x'1) LE-F3 ALL x HLR-LE-G LE-G1 ,ALL x LE-G2 ALL x LE-G3 I x'1) LE-G4 ALL *x LE-G5 ALL .x,1) -*** LE-G6 ALL x'1) Note 1 -Based on the closure review of the Findi.ngs associated with SR, the SR is now met at CC-II or greater.
  • eNERC N GGNS TMRE PRA Application PAGE NO. 18 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment IE-A1 Tornado initiating events will be consistent with the intervals defined in the TMRE process: TMRE considers all tornadoes will result in a LOOP. Tornado initiati.ng event frequencies will be based on a hazard curve that uses site specific data provided in Table 6.1 of NUREG 4461 [IE-C1]. IE-A10 For multi-unit sites with shared systems, INCLUDE multi-unit site initiators (e.g., multi-unit LOOP events or total loss of *service water) that may .impact the model. NRC Comments * (No comments if blank) TMRE process should ensure that the initiating events caused by extreme winds that give rise to significant accidenf sequences and ) accurately capture the additional risk of the unprotected SSCs (that should be protected per the CLB) are identified and used for this application.

NEI 17-02 Section Addressing SR 4.3, 6.2 6.2 Additional GGNS TMRE co.mments The only initiating events caused by extreme winds that are considered in TMRE were tornados.

Only tornados will produce tornado missiles.

The TMRE process was followed as described.

See sections 4.4 and 4.6. NIA. GGNS is a single unit site.

  • PAGE NO~ 19 OF 62 i:.'.tKf!fh::r.u:.:e**;*;Jvn,y proje~:f..

E:verx ti"ay Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment IE-85 IE-C1 multi-unit initiating events if they impact mitigation capability.

Two unit sites should consider proximity of each unit to each other, the footprint of potential tornadoes for the region, and the systems shared between each unit. Tornado initiating event frequencies will be based on a hazard curve that uses site specific data provided in Table 6.1 of NUREG 4461 NRC Comments (No comments if blank) l'Heif qirt§ijg!)

        • bH.*,i 1@~~tr~f lurv~:t**::*

m~,,~r~,ir

          • ?ij~lfe>µrlg:L
NoaeG.s4,~t,.

NEI 17-02 Section Addressing SR 6.2 4.1 Additional GGNS TMRE comments N/A. GGNS is a single unit site. The TMRE process was followed as described.

No additional comments.

See section 4.4.

ENE.RC ON GGNS TMRE PRA Application PAGE NO. 20 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment IE-C3 Do not credit recovery of offsite power. IE-C15 CHARACTERIZE the uncertainty in the tornado initiating event frequencies and PROVIDE mean values for use in the quantification of the PRA results. NUREG 4461, Tornado Climatology, data includes uncertainty. , urn1za::.ma1:ac81aerr

  • ** **s$t1Ger19~~***:~typi*~~1 ~~~,R):: ptqyig~flli
  • tnEtinternal eve *'fnoae,:i:~r,****
.::.::::.*:**::*

..... ::*::*;***:,,, *.ne.cessa ip:pfu~ig~t(!

rr99p§¢.ctu~J

  • ~grh~¢1:qH~v,ijH NRC Comments (No comments if blank) Same comment . as AS-A10 NEI 17-02 Section Addressing SR 6.1, Appendix A 4.3 Additional GGNS TMRE comments TheTMRE process was followed as described.

Offsite power recovery was not credited.

See section 4.6. The TM.RE process was followed as described.

As mentioned, NUREG 4461, Tornado Climatology, data includes uncertainty.

Additionally, the squared value is provided to help characterize the uncertainty of the GGNS initiating event best fit interpolated/

extrapolated frequencies.

See

  • section 4.4.
  • Attachment J REPORT NO. ENTG#GG052-TMRE-002 . REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA NRC Comments Standard Supporting NEI 17-02 Section Additional GGNS Requirements Requiring (No comments if Addressing SR TMRE comments Self-Assessment blank) AS-A1 Modify the internal 6.1, 6.3, 6.4, 6.5 The TMRE process events accident was followed as sequences in described.

The compliancewith this transient LOOP SR accident sequence event tree from the internal events model was utilized consider the consequences of a tornado event. SSCs are not credited in accordance with the TMRE process. Operator actions are adjusted as necessary according to the TMRE process. Section 4.0 describes the calculation process. AS-A3 Review the FPIE 6.1, 6.3, 6.4, 6.5 The TMRE process success criteria and was followed as modify the described.

SSCs are associated system not credited in models as necessary accordance with the to account for the TMRE process. See tornado event and its section 4.0. consequences.

AS-A4 Review the FPI E 6.4 The TMRE process success criteria and was followed as modify the . described.

Operator associated operator

  • actions are adjusted as actions as necessary necessary according to to account for the the TMRE.process.

tornado event and its See section 4. 1. consequences.

ENERCON GGNS TMRE PRA Application

  • PAGE NO. 22 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J .. 9: SRs with Unique TMRE Considerations TMRE -ASME PRA NRC Comments Standard Supporting.* (No comments if NEI 17-02 Section Additional GGNS Requirements Requiring blank) Addressing SR TMRE comments Self-Assessment AS-A5 Modify the FPIE 6. ( 6.3, 6.4, 6.5 The TMRE process accident sequence was followed as model in a manner described.

The' that is consistent with transient LOOP the plant-specific:

accident sequence system design, event tree from the EOPs, abnormal internal events model procedures, and was utilized consider plant transient the consequences of a response.

Account tornado event. Certain for system functions exposed SSCs are not that, as a credited in accordance consequence of the with the TMRE tornado event, will process. Operator not be operable or actions are adjusted as potentially degraded, necessary according to and operator actions the TMRE process. that will not be See section 4.0. possible or impeded.

ENERCON GGNS TMRE PRA Application PAGE NO. 23 OF 62 .. Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment AS-A10 Capability Category I. In modifying the accident sequence models, INCLUDE, for each tornado initiating event, INDIVIDUAL EVENTS IN THE ACCIDENT SEQUENCE SUFFICIENT TO BOUND SYSTEM OPERATION, TIMING,AND OPERATOR ACTIONS NECESSARY FOR . KEY SAFETY FUNCTIONS.

NRC Comments (No comments if blank) In constructing the accident sequence models, support system modeling, etc. realistic criteria or assumptions should be used, unless a conservative approach can be justified.

Use of conservative assumptions in the base model can distort the results and may not be conservative for delta CDF/LERF calculation.

While use of conservative or bounding assumptions in PRA models is acceptable, a qualitative or quantitative assessment may be needed to show that those assumptions do not underestimate delta CDF/LERF estimates.

NEI 17-02 Section

  • Addressing SR 6.3, 7.2.3, Appendix A Additional GGNS TMRE comments The TMRE process Was followed as described.

The diesel driven fire water pumps were modeled * (PRA-1 and PRA-3) because of their potential for injecting water to the reactor vessel. Several components (e.g. PRA-27, turbine trip valves) were modeled to not fail in the compliant case, but fail due to tornado in the degraded case. This maximizes the delta CDF. Other active components not in Cat I structures are not credited in accordance with the TMRE process. This conservative

  • assumption can distort the delta CDF /LERF. A specific sensitivity was performed to address that possibility.

See section 4.11 for all sensitivities.

ENE C N GGNS TMRE PRA Application PAGE NO. 24 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA NRC Comments Standard Supporting (No comments if NEI 17-02 Section Additional GGNS Requirements Requiring blank) Addressing SR TMRE comments Self-Assessment AS-81 For each tornado 6.1, 6.3; 6.5, 6.6 The TMRE process event, IDENTIFY was followed as mitigating systems described.

Impacts on impacted by the mitigating systems occurrence of the were included for all initiator and the ) modeled tornado extent of the impact. initiating events as INCLUDE the described in section impact of initiating 4.6. events on mitigating systems in the accident progression either in the accident sequence models or in the system models. AS-83 IDENTIFY the 5.6, 6.3, 6.4, 6.6 The TMRE process phenomenological was followed as conditions created

  • described.

Unique by the accident weather phenomena progression.

such as intense rain Consider could be an issue concurrent impacts during tornado related to tornado initiating events for missiles (e.g., the structures that are possibility of not designed to multiple missile withstand the winds. strikes in a given Except as noted sequence.

Also above (AS-A 10) high winds and active components rains after the in non-Cat I tornado event could structures were not result in 'hazardous credited in conditions (e.g. accordance with the debris and TMRE process. structural Operator actions instabilities) for . that require travel actions outside the through non-Cat I control room. structures or areas are not credited.

See section 4.0.

ENERCON GGNS TMRE PRA Application PAGE NO. 25 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment AS-87 Review FPIE time phased dependencies to identify model changes needed to address all the concurrent system functions failed by the tornado event; e.g. LOOP, instrument air, fire protection

...... etc. Do not model offsite SC-A4 Consider impact on both units for the same tornado including the mitigating systems that are shared. NRC Comments (No comments if blank) NEI 17-02 Section Addressing SR 6.1 6.1 Additional GGNS TMRE comments The TMRE process was followed as described.

Time phased dependencies were reviewed and no model changes were identified for the TMRE model. See section 4.0. N/A. GGNS is s single unit site.

ENE RC N GGNS TMRE PRA Application PAGE NO. 26 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations SY-A4 NRC Comments (No comments if blank) NEI 17-02 Section Addressing SR Section 3 Additional GGNS TMRE comments The TMRE process was followed as described.

Walkdowns were performed focusing on targets vulnerable to tornado missiles.

The results were recorded in the walkdown report. The walkdowns also surveyed the plant for the missile inventory.

Pathways for operator x-control room actions were discussed with the site personnel; however, operator actions that require travel through non-Cat I structures or areas are not credited.

ENE RC N GGNS TMRE PRA Application PAGE NO. 27 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA NRC Comments Standard Supporting (No comments if NEI 17-02 Section Additional GGNS Requirements Requiring blank) Addressing SR TMRE comments Self-Assessment SY-A11 New basic events will 6.3, 6.5, 6.6 The TMRE process be added to address was follow~d as all the failure modes described.

New basic of the system targets events and flags were exposed to tornado added to address all missiles; safety the failure modes of related and non-the safety related safety related. system targets The exclusions of exposed to tornado SY-A15 do not apply missiles in accordance for SSCs impacted with the TMRE by tornado missiles.

process. -

E N._E C N GGNS TMRE PRA Application PAGE NO. 28 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA NRC Comments : Standard Supporting (No comments if NEI 17-02 Section Additional GGNS Requirements Requiring blank) Addressing SR TMRE comments Self-Assessment SY-A12 DO NOT INCLUDE in 5.2 The TMRE process a system model was followed as component failures described.

No that would be additional comment for beneficial to system the TMRE model. operation, unless omission would distort the results. For example, do not assume a vent pipe will be sheered by a high energy missile verses crimped unless it can be shown this is true for all missiles at all speeds. Exceptions would be components that are intentionally designed to "fail" favorably when struck by a missile; e.g. a frangible plastic pipe used as a vent is designed to break off and not crimp when struck by a missile. SY-A13 Consider the 8.5 The TMRE process target's potential to was followed as cause a flow described.

Targets diversion when potential to cause a struck by a tornado flow diversion when missile. struck by a tornado missile were considered.

Beyond steam breaks around main steam lines, no additional flow diversions were required to be modeled.

ENE RC N . GGNS TMRE PRA Application PAGE NO. 29 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 TableJ.9:

SRs with Unique TMRE Considerations TMRE -ASME PRA NRC Comments . Standard Supporting NEI 17,-02 Section Additional GGNS. Requirements Requiring (No comments*

if Addressing SR TMRE comments Self-Assessment blank) SY-A14 Missile targets will 6.5 The TMRE process be assessed for all . was followed as failure modes -described.*

SSCs some new failure we.re assessed for all modes may be failure modes. identified that are Section 4.3 describes not in the FPIE the walkdown review model. The I for targets exclusions of SY-considering additional A 15 do not apply failure modes:

SY-A15 The failure of SSCs The failure by 6.5 The TMRE process due to tornado 'tornado missiles was followed as missiles shall not should be included

  • described.

The failure use the exclusions 1n the model for all . by tornado missiles of SY-A15. unprotected targets was included iri the that are supposed model for all to be protected unprotected targets according to the 'that are supposed to CLB and any be. protected unprotected targets according to the CLB that are not in the and any unprotected CLB but are in the targets that *are not iri

  • PRA model. This is the CLB but are in the to. facilitate PRA model. sensitivity studies regarding possible correlation of
  • tornado missile damage across systems. It. is not expected that the number of basic events adde(j to the model for this analysis will be so large that this screening is necessary.

ENERCON GGNS TMRE PRA Application PAGE NO. 30 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: s*Rs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment SY-A17 Certain post initiator HFEs will be modified to account for. the tornado event. tactr SJrn'p ... if:~irr SY-87 Capability Category I. BASE support system modeling on the .use of CONSERVATIVE SUCCESS CRITERIA AND TIMING. Sensitivity studies will be performed to identify where conservative assumptions may be distorting risk and adjusted accordingly.

NRC Comments (No comments if blank) Same comment as AS-A10 NEI 17-02 Section.*

Addressing SR 4.4 q,2.3. Additional GGNS . .. TMREccomments The TMRE process was followed as described.

The HFE review is documented in section 4.1. The TMRE process* was followed as described.

The systems analysis from the internal events was the foundation for the TMRE model. Credit given to available PRA SSCs was in accordance with the TMRE process. Sensitivities are provided in section 4.11.

EN ERC N GGNS TMRE PRA Application PAGE NO. 31 OF-62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA NRC Comments Standard Supporting NEI 17-02 Section Additional GGNS Requirements Requiring (No comments if Addressing SR

  • TMRE comments Self-Assessment blank) SY-88 Consider spatial J 5.6 The TMRE process relationships was followed as between components described.

Correlation to identify correlated was considered where failures.

Where the the same missile can same missile can impact targets that are impact targets that in close proximity to are in close proximity each other. to each other. SY-814 Statistical correlation The industry Appendix B.4.4 There are no of tornado missile indicated in earlier deviations taken damage between discussions that from the TMRE redundant and information is guidance spatially separated available to show document.

I components is NOT that statistical required.

correlation of tornado missile damage for specially separated components is insignificant.

Until that information is reviewed and accepted by the staff, this SR should be met (spans all capability categories) and dependent failures of multiple SSCs should be considered.

SY-815 INCLUDE new 6.4 The TMRE process operator interface was followed as dependencies described.

No new across systems or operator interface trains related to the dependencies across tornado event. systems or trains were identified in the TMRE model development.

See section 4.1.

ENERC N GGNS TMRE PRA Application PAGE NO. 32 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment

... ' . . . .. . . . . .. . . ... ~:~Y§t~rn~fiij r¢vt~w * * :ortt1~:fef1evantt*:*.;:

..... pfge~awr~$

$H~ir*~ l!$&d:Jc:ljq~ntify;Jhe.!:;***

~~tiot:;qperatqtf
*** *.* I <<<u*L;; ;:\/ Ji'[~~p 1 QQ$:~~lf§ ulre* .. ,,:.>+ ::,* lfqf~~ph'of::tH tOrnadoacclae

$.~qtJ'enc;e~!

1 :ili 2 HR-E3 Operators will be interviewed (if necessary) to assess the need for changes to operator actions for the tornado initiating events. NRC Comments (No comments if blank) NEI 17-02 Section Addressing SR 6.4 Additional GGNS TMRE comments The TMRE process was followed as described.

Operator interviews for the credited actions were performed during the development of the internal events model that the TMRE model is based on. Furthermore, during the TMRE development a GGNS SRO was consulted for further considerations.

See section 4.1.

. GGNS TMRE' PRA Application PAGE NO. 33 OF 62 Attachmenf J. REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Consideration's TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment HR-E4 Operators talk-: throughs or simulator observations will be conducted (if necessary) to assess the need for

  • changes to operator actions for the tornado [Note: this applies to new sequences or failure combinations not.accounted for in
  • the internal events mod.el. It is* not intended that operator action timing needs be .. changed due to the tornado event alone] NRC Comments . (No comments if NEI 17-02 Section Additional GGNS blank) Addressing SR.
  • TMRE comments 6.4 The TMRE process was followed as described.

Operator interviews/

talk

  • throughs for the credited actions were performed during the development of the *
  • model that the TMRE model is based on. Furthermore, during the TMRE. development a GGNS
  • SRO was consult~d for further considerations.

See section 4.1.

GGNS TMRE PRA Application PAGE NO. 34 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE~002

  • REVISION 1' Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA NRC Comments Standard Supporting (No comments if NEI 17-02 Section Additional GGNS Requirements Requiring , blank)
  • Addressing.SR TMRE comments Self-Assessment HR-GS Operators will be 6.4 The TMRE process interviewed and was followed as simulator described.

Operator observati.ons interviews/

talk conducted (if throughs for the necessary) ,to assess credited actions were the need for changes performed during the to operator action development of the timing as a result of internal events model the tornado event. that the TMRE model [Note: this applies to is based on. new sequences or Furthermore, during failure combinations

    • the TMRE not accounted for in development a *GGNS the internal events ,* SRO was con.suited model. It is not for further intended that considerations.

See operator action timing section 4.1. needs be changed due to the tornado event alone] HR-G7 Dependencies will 6.4 The TMRE process be recalculated was followed as when the model is described.

No new quantified or combinations were modified by created or credited.

inspecting cutsets.

ERC N GGNS TMRE PRA Application PAGE NO; 35 OF 62 Attachment J REPORT NO.

  • ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE .considerations*

TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment H1/H2 Do not credit recovery actions to restore functions, systems, or components unless an explicit*basis accounting for tornado impacts on the site and th~ SSCs of concern is provided.

NRC Comments * (No comments if blank) NEI 17-02 Section. Addressing SR. . 6.4 Additional GGNS TMRE comments*

The TMRE process was followed as described.

Recovery , actions to restore fu.nctions:

systems, or components were not credited.

ENERC N GGNS TMRE PRA Application PAGE NO. 36 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 \ Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Se.If-Assessment

  • DA-A 1 Develop new basic events for tornado missile targets (all failure modes) in accordance with this SR. QU-A5. Do not credit recovery actions to restore functions, systems, or components unless an explicit basis accounting for. tornado* impacts on. the site and the SSCs of concern is provided.

NRC Comments (No comments if

New basic events and flags were added to address all the failure modes of the safety related and safety related system targets exposed to tornado missiles in accordance with the TMRE process. See section 4.0. The TMRE process was followed as described.

Recovery actions to restore functions, systems, or components were not credited.

  • Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9:* SRs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment QU-C1 Identify new operator action dependencies created as a result of the changes to the internal events PRA model or failures associated with tornado events. QU-05 Review *
  • nonsignificant cutset 6rsequencesto determine the sequences are valid NRC Comments (No comments if blank). NEI 17-02 Section Addressing SR 6.4 7.3 Additional GGNS TMRE comments The TMRE process was followed as described.

No new , operator actions or ' combinations were created or credited.

The TMRE process was followed as described.

Cutsets were reviewed including significant and non-significant cutsets to ensure the sequences are valid.

  • eNERC -N GGNS TMRE PRA Application PAGE NO. 38.0F62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA Standard Supporting Requirements Requiring Self-Assessment QU-07 Review BE iljl1portance to make sure they make logical sense. QU-E1 Identify.sources of uncertainty related to MIP and missiles QU-E2 Identify assumptions made that are different than those in the internal everits model QU-E4 Identify how the model uncertainty is affected by assumptions related to MIP and missiles NRC Comments
  • NEI 17-02 Section (No comments if -Addressing SR blank) 7.3 7.1, Also see Appendices A and. B for bases. Section 6 7.1, Appendix A Additional GGNS TMRE comments The TMRE process was followed as described.

HE importances were reviewed to ensure they make logical sense. The TMRE process was followed as described.

The TMRE process was followed as described.

Assumptions are listed in section 3. The TMRE process was followed as described.

Ass.umptions related to MIP and missiles unique to GGNS are described in section 3. I ENERC N GGNS TMRE PRA Application PAGE NO. 39 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Table J.9: SRs with Unique TMRE Considerations

,. TMRE -ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Additional GGNS (No comments if Requirements Requiring blank) Addressing SR

  • TMRE comments Self-Assessment
  • LE-C3 Do not credit Same comment 6.3, 7.2;3, Appendix The TMRE process
  • recovery of offsite as AS-A10 *A *was followed as power. Do not credit described.

No recovery actions to additional comments.

restore functions, systems, or components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

ENERC N GGNS TMRE PRA Application PAGE NO. 40 OF 62 Attachment J REPORT NO. ENTG#GG052-TMRE-002 REVISION.

1 *Table J.9: SRs with Unique TMRE Considerations TMRE -ASME PRA NRC Comments Standard Supporting NEI 17-02 Section Additional GGNS Requirements Requiring (No comments if Addressing SR TMRE comments Self-Assessment blank) Multiple Changes made for Section 8 The TMRE process SRs application of the was followed as PRA to tornado described.

No missile impact risk additional comments.

determination such as those to initiating event analysis, accident sequences, systems analysis, human reliability analysis, and parameter estimation should be documented, as described .in Various documentation SRs for each HLR. The documentation should be sufficient to understand basis and facilitate review. Examples of such SRs include IE-01 through IE-03, SY-C1 through SY-C3, and DA-E1 through DA-E3. It is

  • recognized that the documentation of changes to the PRA and their
  • basis will be captured in the template of the license amendment request.

2-1 (F) 3-1 (F) ENERCON GGNS TMRE PRA tpplication PAGE NO. 41 OF 62 IE-C15 IE-C12 IE-C4 Attachment L REPORT NO. ENTG#GG052-TMRE-002

  • REVISION 1 Table J.10 Peer Review Findings*

The mean values provided in the IE Notet?ook were not used in.the quantification of the PRA results. The values from Table 9 in the IE Notebook were not correctly used in the CAFTA model. (This F&O originated from SR IE-C15) {This F&O originated from SR IE-C12) Table 6 of the initiating events report shows data used for Bayesian updating of plant specific initiating events. In some cases it appears that the plant experience would imply a substantially higher frequency than the prior data. For example_ for % T2 the pdor is 1.12E-2 /yr whereas the plant specific experience is -0.3/yr. Also for %TSTT1 the prior is 8.BOE-3 /yr whereas the plant experience is -0.13/yr.

These differences are large enough that the prior may not be appropriate for Bayesian updating.

Some explanation of this difference is warranted especially with regard to the Bayesian process. Also since the exp~rience timeframe covers a period of much earlier GGNS operation, it is possible that more recent data is better because of plant fixes. The Initiating Events notebook was updated to ensure that it specified which column of values . should be *used in the CAFT A rr file, and the rr file used for quantification was updated to ensure it contains the values from the column entitled "Frequency Mean (/rx-yr)". Based on a review of Reference 43, and Table 9 -there is a typo in the Prior Frequency Mean value and corresponding spreadsheet in Appendix D. The value should be 1;12E-1 instead of 1.12E..:2

-values have been updated in Table 6 of Reference 3, Appendix spreadsheet, and rr file. The concern associated with % TSTT1 was a application of the boundary conditions associated with the tra.nsformer ST11. The initial analysis*

incorrectly inclwjed the Loss of Switchyard Power Lines in both the LOOP and the %TSTT1 IE frequencies, and should have only included them in the LOOP frequency.

The underlying methodology was not changed, but the classification of the , events was corrected to only have them impact the LOOP event. The initial methodology used ini,tiating event fault trees to model support system initiators, and the fault trees associated with ST11 an'd ST12 . were revised to address this concern. The revision to the initiating event boundary conditions has .reduced the frequency to being comparable to the generic estimate.

The. current value is 9.19E-3/yr (Table 9 of Refe_rence 3). *

-3.2 (F) 5-4 (F) ENE RC_ N GGNS TMRE PRA Application PAGE NO. 42 OF 62 IE-C15 IE-C2 AS-87 SC-A5 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 (This F&O originated from SR IE-C15) Table 9 of the Initiating Events Notebook includes a summary of the Initiating Events Frequencies derived from the updated IE analysis.

The Frequency per reactor year (the fourth column from the left) *shows the final updated number that should be used for quantification.

However, the IE frequencies used for quantification have come from other columns that do not represent the most recent data. -DC battery life is presented as 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> in the SC notebook, but the Div II battery was credited to 1 O hours *per the LOSP notebook.

The documentation is not consistent, and it is not clear if an operator action for_load shedding is required

  • The Initiating Events notebook was updated to ensure that it specified which column of values should be used in the CAFT A rr file, and the rr file used for quantification was updated to ensure it contains the values from the column entitled "Frequency Mean (/rx-yr)". A review of the LOSP analysis shows that the lifetimes calculated in App G do NOT credit load shedding -but are based on the actual battery design instead of assuming the minimum 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> lifetime.

However, as stated in Assumption 7, Batteries 1A3 and 183 are designed (and assumed by the model) to supply power to required de loads for four hours after the loss of both battery chargers.

Although the actual depletion times of the 1A3 and 183 batteries are considerably longer than the designed depletion time of four hours, as shown in Appendix G, no credit is currently taken for these longer lifetimes.

This is consistent with-the DC Power notebook and the Mathcad calculations for offsite. power recovery.

The purpose of MAAP run RSCCALMAP-2014-0705 is to determine the timing of loss of RCIC post-SBO regardless of whether suction is taken from the CST or SP. The run indicates that RCIC would be lost within 5. 78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br /> due to inadequate RPV pressure to support the RCIC turbine caused by procedural depressurization.

So this is the

  • limitin factor rather than the batte de letion time 5-6 (F) 5-7 (F) ENERCON GGNS TMRE PRA Application PAGE NO. 43 OF 62 AS-87 AS-A7 Attachm_ent L REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 AC power recoveries are developed on a cutset level to account for timing in the LOSP notebook (report GGNS-01-IE-01

). Spot checks of the Qrecover file compared to the notebook identified the following errors/inconsistencies:

ZHE-OSP-DSGO-NW

-utilized the "averaged" recovery value of 6.56E-1 ZHE-OSP-DLGO-NW

-was entered into the Qrecover file with a probability-of 1.22E-2 instead of 1.22E-1. Approximately 1 O other events were spot checked and found to be entered properly.

Additionally, the normal weather offsite power recovery data were applied to all the LOSP initiating events. The weighted average of the offsite power recovery probabilities did not include the severe weather portion in the weighting.

This makes the application of the recovery probabilities non-conservative The very small LOCA (%83) was identified as an initiating event in the IE analysis.

In Table 1 of the AS notebook, it was listed as being treated as a transient.

However, no basis is given, and the %83 initiating event is not included in the CAFTA model. if the 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> were to be used. This limitation may change if suction from the Upper Containment Pool is credited in the EOP network of procedures n the _ future. No change to RCIC, DC Power or Accident _ Sequence notebooks were required.

These were documentation changes only, and do not impact quantification or other notebooks.

The single typo documented in the review located in the recovery factors was corrected.

Note that even the review found no additional differences.

The loss of offsite power recoveries were updated to the "normal" recove"ry rate which includes weather related events. * -) The timing for long term scenarios was addressed by the documented sensitivity study in the peer reviewed quantification notebook (RSC GGNS"'.'01-QU, Rev. 0) and has been included in the base model. . The %83 has been added to the list of transient events since it can be mitigated by the same equipment as a transient initiating eveht. For ease of review, the %83 Initiating Event has been separated from the % T3A initiator and included in the model in the same locations as the other

  • transient initiatin events that are not " rou ed" 5-8 (F) ENERCON GGNS TMRE PRA Application PAGE NO. 44 OF 62 AS-81 Attachment L REPORT NO.* ENTG#GG052-TMRE-002 REVISION 1 The small and medium LOCA A TWS scenarios do not appear to have considered the LOCA effects on system success criteria, such as SLC. Large LOCA A TWSs have not been addressed with either a valid qualitative argument or a quantitative evaluation.

A success criteria basis could not be found for using RCIC to depressurize to allow SOC in transients or ATWS. In transient sequences with success of depressurization, SOC is credited to prevent core damage, which disagrees with the MAAP calculation RSC-CALMAP-2014-1202, which shows this sequence as core damage. under the general transient initiator.

This is a modeling convention choice, but the underlying methodology associated with identifying and grouping initiating events is not changed. The LOCA would not impact the RPS (Mechanical or Electrical) system, the ability to manually scram, the ability to perform alternate rod insertion, or the ability to trip the recirculation pumps. Therefore, the only system in question is SLC. Based on C41 -the system design criteria for SLC -In .. accordance with GDC 4, structures, systems, and components important to safety shall be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including coolant accidents:

Therefore, SLC is designed to operate following a LOCA. Conservatively, SLC is not credited for medium LOCA cases. As stated in Section 4.7 of this notebook, "Due to the circumstances involved with SBO and LLOCA sequences with a failure to scram, core damage occurs." Therefore, LLOCA ATWS scenarios are modeled as resulting in core damage in the GGNS PRA. RCIC is not*credited as a method of depressurization in the transient or A TWS accident sequences.

Decay heat removal options with successful RCIC injection are limited to W1 (RHR in Suppression Pool Cooling Mode) and W3 (RHR in Containment Spray Mode). Decay heat removal via W2 (RHR in Shutdown Cooling Mode) is not credited,as a viable o tion when RCIC is in"ectin 5-9 (F) ENERC N GGNS TMRE PRA Application PAGE NO. 45 OF 62 SC-81 SC-82 *

  • Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION**

.1 GGNS assumes that suppression pool makeup is . required in combination with containment venting in , order to avoid cavitation of ECCS pump suction in containment heat-up sequences.

Th~ assumption that venting fails the ECCS pumps is conservative, which is *noted in Topic 7 of Table 11 of

  • the au notebook".

' Regarding SPMU successfully facilitating pump operation, there-is no ana.lytical basis for this success criteria, but instead is based upon the expert judgment of the modeler. While this may be a reasonable assumption, it would be better to have an analytical basis or at least carry this item as an additional source of modeling uncertainty.

Since these assumptions are a significant driver to the CDF and LERF, consideration should be given to attempt to refine the assumption.

At a minimum, sensitivity analyses should be performed to ensure the impact of these SC assumptions are fully understood for risk characterization.

for inventory control. RSC-CALMAP-2016~0601 assesses a transient with depressurization in which LPCI and SPC alternate based on RPVlevel.

The assessment indicates that the plant is in a safe stable state. after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> with no core damage occurring.

The run can also apply to SOC since it has a similar flow rate to SPC and uses the same heat exchangers.

Therefore depressurization/SDC can be credited. . RSC-CALMAP-2014-1103

[64] indicates that SP level is just slightly above 15 ft after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following a transient with E;D and failure of containment heat removal. Boiloff occurs following containment venting or failure. Based *on the SP * -level plot associated with the MAAP analysis, SP level would decrease to the SPMU limit of 14.5 ft about 1-2 hours after the mission time. This would be close enough to require SPMU; however, this analysis assumes that no injection ffom the CST or other external source occurs. As.long as an external source i_s available, the SP level will not reach the SPMU limit until well beyond the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> PRA mission time. Therefore SPMU is determined not to be required for any additionar initiators other than the previously required MLOCA and LLOCA. The ECCS pumps can pump saturated water as long as SP level remains above 14.5 ft (the.level below which the suction lines become uncovered).

This limit will not be reached if an external source such as the CST is available to p*rovide suction for the ECCS pumps. However; per Reference 28, "The HPCS pump may not be able to move fluid at times during the event due to a combination of

  • flashin of the SP water, steam entra ment, 4-10 (F) 4-4 (F) ENERCON GGNS TMRE PRA Application PAGE NO. 46 OF 62 HR-H3 HR-G7 HR-F1 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 The independent evaluation of HF Es did n,ot include any delay time to the cue. This carried forward into the dependency analysis where all HFEs were evaluated to have tt,e same delay time of zero. This paired events that should be separated in the accident sequence by hours together resulting in dependent combinations that should not exist or have a lower dependency.

With all of the actions having the same delay time, complete**

dependence was calculated resulting in much higher dependent failure probabilities than actually exist.* The HRA calculator software has overrides available to offset delay times or reduce dependence, but these were not used. * -There also does not appear to be any evaluation of intervening successes which would remove the dependence between actions.

  • There are multiple HFEs for performing the same action, only on a different piece of equipment.

For example, there are three different HFEs for failing to start standby air compressors.

If an operator fails to start a compressor, they likely fail to start any compressor, not just one in particular.

There should _be cavitation, or a pump trip when containment fails." Boiling and voiding could create conditions leading to a pump trip which would require a restart but failure of the pump would not occur. However, injection of CST volume will increase level in the SP and the pot~ntial for trip is eliminated in the majority of cases. Ttie use of HPCS after -containment failure is now addressed in Event U1 LT, discussed in Section 3.2.8. Time delays have been added into the HRA calculator, and the dependency analysis has been redone using the new information, including the consideration-of intervening dependencies,.

Although the delay times were not included in the -HRA calculator, and the default dependency was complete dependence, as part of the dependency review, the dominant Operator Action combinations were reviewed for separation of events and for _ intervening success. When long times between actions or intervening successes were identified, the default dependency was changed in the HRA calculator software.

Although this was not done-for ALL combinations" this methodology was used in the analysis forthe dominant combinations.

The inclusion of the delay times reduced the number of instances where the dependency override was required, but did not change the actual methodology.

-A review of the HRAs in the GGNS MOR was performed to identify those that for performing the same action, only on a differen*t piece of equipment within the same system. These individual HFEs

  • have been replaced with a common HFE for the -action.

ENERC N GGNS TMRE PRA Application PAGE NO. 47 OF 62 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION only one failure for the operator to start a compressor that fails the action for all air compressors.

Otherwise there are failed and unfailed actions in the model to start the compressor.

1 The methodology used for the calculation of the HEP values are not impacted by this change. The "combined" HEP has the same value that the individual HEPs originally had, but instead of assigning a dependency of 1.0 during the ..

  • dependency analysis, this applies the 1.0 dependency as part of the initial analysis.

The first operator action listed in the table below are the new operator actions *that replaced the other operator actions listed belowthem in the table. These changes were made in the Rev 4a MOR, but the system notebooks still need to be revised to reflect these changes. Operator Action Prob Description P43-XHE'."FO-TBCWABC 1.36E~05 HUMAN ERROR FAIL TO OPERATE EITHER TBCW TRAIN A, B OR C P43-XHE-FO-TBCWA 1.36E:-05 HUMAN ERROR FAIL TO OPERATE TBCW TRAINA P43-XHE-FO-TBCWB 1.36E-05 HUMAN ERROR FAIL TO OPERATE TBCW TRAIN B P43-XHE-FO:-TBCWC 1.36E-05 HUMAN ERROR FAIL TO OPERATE TBCW TRAINC P51-XHE-FO-C001ABC 5.54E-04 OPERATOR FAILS TO START EITHER C001A, B OR C WHEN IT IS IN SHUTDOWN MODE.

ENERCON Attachment L GGNS TMRE PRA Application PAGE NO. 48 OF 62 REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 P51-XHE-FO-C001A 5.54E-04 OPERA TOR . FAILS TO START C001A WHEN IT IS IN SHUTDOWN MODE. P51-XHE-FO-C001B 5.54E-04 OPERATOR

  • FAILS TO START C001 B WHEN IT IS IN SHUTDOWN MODE. P51-XHE-FO-C001 C 5.54E-04 OPERA TOR .FAILS TO STARTC001C WHEN IT IS IN SHUTDOWN MODE. P64-XHE-FO-F1 OABL 3.96E-O~ OPERA TOR \ FAILS TO OPEN MOVFA10A OR FA10B LOCALLY FOLLOWING A LOSS OF POWER P64-XHE-FO-F1 OAL 3.96E-03 OPERA TOB FAILS TO OPEN MOVFA10A LOCALLY FOLLOWING A LOSS OF POWER _.
  • P64-XHE-FO-F10BL 3.96E-03 OPERATOR FAILS TO OPEN MOVFA10B LOCALLY FOLLOWING A LOSS OF POWER P75-XHE~FO-DG112 2.67E-03 FAILURE TO MANUALLY START DIVISIO-N I OR DIVISION II DIESEL GENERA TOR P75-XHE-FO-DG11 2.67E-03 FAILURE TO MANUALLY START DIVISION I DIESEL GENERATOR P75-XHE-FO-DG 12 2.67E-03 FAILURE TO MANUALLY START DIVISION II DIESEL GENERATOR X77-XHE-FO-C001AB2 1.36E-05 FAILURE TO TRANSFER DIV 1, 2 OR 3 DIESEL OUTSIDE AIR FAN TO HIGH SPEED 4-5 (F) ENERC .N GGNS TMRE PRA Application PAGE NO. 49 OF 62 HR-F2 HR-H2 Attachment L REPORT NO. ENTG#GG052..;TMRE-002 REVISION 1 The timing of cues is not explicitly documented in the HRA calculator.

The time delay to the cue is set to zero in every instance.

The time delay is an important step because it can limit the amount of time in the scenario to recover from the action. The only timing listed in the time window is the median response and execution time. Operator recovery is based on the remaining time available, but without the time delay to the cue included, more time is allowed to recover than is actually available.

X77-XHE-FO-C001A 2.72E-03 FAILURE TO TRANSFER DIV 1 DIESEL OUTSIDE AIR FAN TO HIGH SPEED X77-XHE-FO-C001 B 2.72E-03 FAILURE TO TRANSFER DIV 2 DIESEL OUTSIDE AIR FAN TO HIGH SPEED X77-XHE-FO-C002 1.36E-05 FAILURE TO TRANSFER DIV 3 DIESEL OUTSIDE AIR FAN TO HIGH SPEED Y47-XHE-F0-1C01AB2 7.84E-04 Failure to Manually Start 1Y47-C001A, B or 2Y47-C001A Fan after Auto-Start Failure Y47-XHE-F0-1C01A 7.84E-04 Failure to Manually Start 1Y47-C001A Fan after Auto-Start Failure Y47-XHE-F0-1C01B 7.84E-04 FAILURE TO MANUALLY START 1Y47-C001 B FAN AFTER AUTO-START FAILURE Y47-XHE-F0-2C01A 7.84E-04 Failure to Manually Start 2Y47-C001A Fan after Auto-Start Failure Time*delays have been added into the HRA calculator, and the dependency analysis has been redone using the new information, including the consideration of intervening dependencies.

The HRA calculator is used for the calculation of the HFE values. Inclusion of the timing of cues does not impact the HFE calculated, but could impact the "order of the HFEs in the dependency analysis.

The methodology used for the dependency analysis is not changed by including 4-6 (F) 4-7 (F) 4-12 (F). ENERCON

  • GGNS TMRE PRA Application PAGE NO. 50 OF 62 HR-F2 HR-G4 HR-G2 DA-82
  • Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Scenario timeframes are included in the evaluation of the HFE. However, there are no references to where the scenario timeframes are calculated.

There was some indication that MAAP had been used in the past to develop the scenarios, but nothing could be found to support the times used. Following plant uprate a scaling evaluation of the increased power was performed to revise the scenario times. Additional MAAP cases were performed following the uprate, but these have not been incorporated into the HFE analysis.

All operator actions include an estimation of the failure in cognition.

However, a number of operator actions had the execution failure probability set to zero stating that the action is memorized and practiced routinely.

These actions are in the first few minute~ following an initiating event and based on the time available may have high HEPs. One outlier was identified when grouping equipment for the battery charge(s.

Battery charger 1 C5 is always in. standby as a backup to battery charger 1 C4. In the model 1 C5 is set to standby with a probability of the timing of cues, but the inclusion of the cues helps to reduce the level of review required during the dependency analysis.

Scenario time frames were looked at and addressed by adding in the delay times for the cues; and adding in timing notes into the HRA calculator files to show where the timing comes from. Although the basis for some of the timeframes was not originally included in the HRA calculator, the timeframes were based on expected plant response times determined from operator interviews or supporting MAAP analyses.

Therefore, the methodology used by the HRA calculator to calculate the HFEs was not impacted, but the justification (documentation) for the selected time frames was desired to help verify the appropriate time frames were used. The updated HRA evaluation no longer sets the execution probability to zero and instead is based on the maximum *combined value for CBDTH/HCR approach.

Most of the HRA events include execution actions. For the events where no execution actions were previously included, the execution actions were added using the same methods -as for all other operator actions. Underlying methodologywas not impacted by adding additional detail into some of the HFE evaluations.

Determined the correct grouping for this battery charger, the exposure time for this-outlier was removed from consideration for the BCC LP type code. The type code was updated in sections 5.2 4-13 (F) 4-14 (F) 4-15 (F) ENER**c'o*N GGNS TMRE PRA Application PAGE NO. 51 OF 62 DA-C3 DA-C3 DA-C13 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION

  • 1 1. It is grouped. with the rest of the battery chargers that and 5.3. are normally in operation.

Its failure probability is calculated the same as the other battery chargers.

A number of component types were excluded from the evaluation including motor operated valves, air operated valves, and temperature switches in GGNS-01-DA-01.

These component types were not reviewed for plant specific failures to determine if bayesian updating of the generic failure data should be performed. (This F&O originated from SR DA-C3) The failures removed from consideration do not have adequate justification for disregarding previous plant failures.

Many failures were removed in previous model revisions, but there is no documentation as to why the failures were no longer applicable. (This F&O originated from SR DA-C3) \ One discrepancy was identified for battery charger unavailability.

In the notebook unavailability was calculated for the L51 battery chargers based on past history. However, the reliability database had zero unavailability for each of the battery chargers.

Additional plant-specific data was obtained for various valves and air compressors which were previously not included in the PRA. The new data includes number and type of failures, demand data, and exposure data per component and type code, and this data was analyzed consistent with the established data notebook methodology.

The riew data was compiled into the spreadsheets in References 21 and 23, and all changes and additions were incorporated into the plant-specific data collection in section 5.2, the Bayesian update performed in section 5.3, and the final plant specific database in section 5.4 of the Data notebook.

The same methodology for Bayesian updating was used for the new component types evaluated.

No new methodology was employed.

The bases for failure inclusion and exclusion are established in section 5.2 of Reference 7, where it is stated that all failures included in the PRA must have occurred during the PRA time frame (September 1, 2006 through August 31, 2012) and must meet the definition of a PRA functional failure. Failures outside the time frame of interest were discarded.

The unavailability data for the chargers and for severai other identified components were reviewed and updated in the database to ensure they w~re consistent with actual plant operating history as documented in the data notebook.

This is the same methodology that was employed for determining unavailabilit

's of other com onents modeled in the 4-17 (F) 4-19 (F) ENE RC N GGNS TMRE PRA Application PAGE NO. 52 OF 62 DA-C14 DA-E1 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 Coincident unavailability was identified to occur in the* data analysis timeframe (PSA-GGNS-01-DA-01

). This unavailability is not included in the model so is therefore not included in the final results. (This F&O originated from SR DA-C14) There are numerous conflicts between the two data analysis notebooks and the two common cause notebooks.

This is likely due to a two year gap between

  • publishing of the notebooks.

Information is not consistent between notebooks and even within the same notebook.

The final data rollup notebook appears to be accurate, but its information is based off the plant specific notebook which has information that is out of date, not used, and results in contradictory information to the data development notebook.

The same is true of the common cause PRA. No new methodologywas employed.

The model unavailabilities for 125V DC battery chargers were updated consistent with the MCR GG-4962 response documented in section 7.1 of the Data notebook.

All unavailability distributions were reviewed for similar concerns, and the following were impacted:

DC power components (resolved by MCR GG-4962), radial well pumps and air compressors (resolved by MCR GG-4904), and AC circuit breakers and switchyards (resolved by MCR GG-4908).

After thoroughly examining previous analyses and the current system notebooks, it was determined that the previously identified coincident unavailabilities did not meet the criteria for inclusion.

Upstream or downstream unavailability is accounted for in the model and did not meet the standard for coincident unavailability.

It was determined that no more than one safety related system was scheduled to be in maintenance at any given time. The data notebook has been updated to provide this rationale.

Conflicts between notebooks were resolved by aggregation of all data from both notebooks and both CCF calculations into a single data notebook.

The Excel spreadsheets that previously evaluated the data (References 21-17 of the previous Data Notebook) have been incorporated directly into the current Data notebook, and the basis for the formulae used in the spreadsheets has also been added into the methodology section. The combination of notebooks and calculations impacts all of subsection 5.0 and is responsible for the addition of section 6.0 to the data notebook.

1-3 (F) 1-6 (F) ENERC GGNS TMRE PRA Application PAGE NO. 53 OF 62 QU-04 QU-F2 Attachment L . REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 notebooks.

Much of the plant specific data (run and demand estimates, maintenance unavailability data) was not found in the notebooks, but in spreadsheets provided separately.

This information should be included in the notebook for ease in identification (This F'&O originated from SR DA-E1) This was not addressed as a comparison of results to simiiar plants was not conducted.

The documentation does not describe significant accident sequences in sufficient detail. A sensitivity study on LOOP recovery may be appropriate as the base case (Table 15). The key sequences use a battery lifetime of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Appears division II battery lifetime is 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. * (This F&O originated from SR QU-F2) A comparison to the three other BWR-6 plants has been included in the Rev 4a Summary Report. A detailed discussion of the significant accident sequences for both CDF and LERF has been added into the Integration and Quantification notebook for the internal events model. See Section 6 of PSA-GGNS-01-QU Rev 1a for details. Similarly, a detailed discussion of the significant accident sequences for both CDF and LERF has been added into the Internal Flood Analysis for the flood scenarios.

See Section 14 of PSA-GGNS IF Rev 2 for details. During the Peer Review, a sensitivity study on the LOOP initiators was performed, and based on the sensitivity study, the Recovery Rule files were changed from using the normal weather recovery probabilitie;, to using the average weather recovery probabilities.

A review of the LOSP. analysis shows that the lifetimes calculated in App G do NOT credit load shedding -but are based on the actual battery design instead of assuming the minimum 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> lifetime.

However; as stated in Assumption 7, Batteries 1A3 and 183 are designed (and assumed by the model) to supply power to required de loads for four hours after the loss of both battery chargers. .

t-7 (F) 1-8 (F) 1-12 (F) ENE RC N GGNS TMRE PRA Application PAGE NO. 54 OF 62 QU-F6 QU-A2 LE-E4 Attachment L REPORT NO. ENTG#GG052~TMRE-002 REVISION 1 A quantitative definition of significant is not provided. (This F&O originated from SR QU-F6) RSC 14-15_provides res_ults.

Fault tree linking is used. Significant is not defined but sequences are rank ordered and provide a high percentage of the CDF results. (This F&O originated from SR QU-A2) The LERF is quantified using the same general process as the *coF, and is documented in the QU notebook.

The review of the LE uantification a ainst the Although the actual depletion times of the 1A3 and 183 batteries are considerably longer than the designed depletion time of four hours, as shown in Appendix G,-no credit is currently taken for these longer lifetimes.

rhis is consistent with the DC Power notebook and the Mathcad calculations for offsite power recovery.

The quantitative definition of " significant" has been included in the GGNS PRA Rev 4 and Rev 4A Summary Reports, and in the GGNS PRA Rev 4A Uncertainty and Sensitivity report .. These reports also identify the risk significantaccidentsequences based on this definition.

Although the specific definition of Significant was not provided in the documentation previously, the evaluation of the results was performed against the definition of significant as provided in the Standard.

This was a documentation only issue that does not impact methodologies used in the analysis.

The quantitative definition of" significant" has been included in the GGNS PRA Rev 4 and Rev 4A Summary Reports, and in the GGNS PRA Rev 4A Uncertainty and Sensitivity report .. These reports also identify the risk significant accident sequences based on this definition.

Although the specific definition of Significant was not provided in the documentation previously, the evaluation of the results was performed against the definition of significant as provided in the Standard.

This was a

  • documentation only issue that does not impact methodologies used in the analysis.

The updated quantification of the Internal Events PRA and the Internal Flood PRA both now show conver ence for both the re-recove and the 5-10 (F) ENE RC N GGNS TMRE PRA Application PAGE NO. 55 OF 62 LE-A2 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION requirements of Tables 2-2.7-2(a), (b) and (c) is essentially identical to the CDF reviews documented

  • under the au High Level Requirement.

Direct linking of the Level 1 sequences with the CET provides assurance that all system dependencies are captured, etc. A LERF truncation sensitivity was performed, but does not meet the criterion identified in the au notebook.

However, the truncation was as low as could be achieved, and the lack of convergence does not significantly affect the results. Also when uncertainty is considered LERF mean value is calculated to exceed mean CDF value. This is not possible.

The characteristics identified as important in A 1 are documented in Section 1 of the LE notebook GGNS-01-LE).

However, the LE notebook does not provide any bases for the binning of sequences (e.g., determination of which sequences are high pressure and which are low). Per the Grand Gulf PRA team, selection was based on information from MAAP gathered from both success criteria and LERF-specific assessments and the engineer's experience working on other BWR 6 designs. This SR is considered met because the binning appears reasonable in most cases, but documentation of more definitive bases is needed. Some examples of se uences for which the hi h/low ressure binnin are 1 post-recovery cases. Although convergence was not previously obtained, this was due to a computer memory and software limitation.

If the software and computer memory issues did not exist, convergence.

would have been obtained for the prior model. A review of the LERF model identified an error where a gate that was supposed to be an AND gate was inadvertently modeled as an OR gate. Additionally, the LERF model reviewed by the Peer Review Team double counted early and late hydrogen events in many of the cut sets which resulted in overestimation of LERF. With these modeling issues corrected,

  • convergence was obtained, and the LERF was calculated to be -1 OX lower than CDF -as should be expected.

This was a modeling issue, but not a methodology issue. The same methodology for quantification was employed.

  • Added wording to Section 1.2.2 to clearly define the high to low pressure transition at 200 psig. Also clarified that only the pressure at th~ time of RPV failure is relevant for this binning criterion.

This changes the binning of SLOCA sequences with successful depressurization prior to RPV failure to low pressure.

The methodology used for binning was not well described in the analysis, but the methodology itself was determined to be appropriate.

However,

  • additional level of detail was d~sired to explain binning criteria that was not readily obvious.

5-12 (F) 5-13 (F) ENE RC N GGNS TMRE PRA Application PAGE NO. 56 OF 62 LE-C10 LE-C12 . LE-i=2 LE-C3. LE-G3 LE-G6 LE-C1 LE-C2 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 not obvious are: P-009 (SORV, RCIC initially successful, but LPI fails and RX depressurization not questioned) is "Low" pressure, and all Small LOCAs (even with depressurization successful) are binned as high pressure.

There is no quantitative definition of significant accident progression sequences.

There are SRs that require documenting the quantitative definition, as well as review of the significant severe accident progression sequences for possible credit for repairs and engineering analyses to provide a more realistic analysis.

An example of the lack of reviews for excess conservatism is that the operator action for turning on the H2 igniters was set to 1.0 in the analysis, yet is very significant to the results. The. approach to the LE analysis was the NUREG/CR-6595 analysis, with a more detailed evaluation of the loss of OHR sequences.

Since the Level 1 and LE results are dominated by loss of OHR, this SR was evaluated as met to Category II. However, the following items are also noted from the peer review: -The Level 1 SR review identified many items that will change the GDF risk results (incorrect IE frequencies utilized, incorrect offsite power recoveries applied, etc.). Accident sequences are quantitatively assessed in the new MAAP analysis notebook [RSC 16-02, Rev 1]. .. Although not included in the documentation, the ASME Standard definition of Significant accident progression sequences was used in the analysis.

The results were reviewed for excess conservatism, and the single operator action identified in the Finding was' determined to be the only significant conservatism that should be refined. This HFE has been evaluated using the same HRA methodology used for the other HFEs included in the model. Updates to the igniter operator actions are added to the LERF basic events table (Table 11) and they are discussed in the updated HRA notebook.

The correct HEPs are introduced into the model during the recovery rules process. As stated in the finding, the methodology used is correct and applicable, but the results were impacted by corrections to technical inc.Qnsistencies/errors in the Level 1 PRA model, and the calculation of an HEP value for Operators turning on the igniters (removing the excess conservatism introduced by having this operator action set to a probability of 1.0). No methodology changes were required (NUREG/CR-6595 5-14 (F) 5-16 (F) ENERCON GGNS TMRE PRA Application PAGE NO. 57 OF 62 LE-E1 LE-C2 LE-C4 LE-C7 LE-03 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 No credit is given to operator actions in the LE analysis.

There is no documentation of a review of Grand Gulf procedures for severe accident responses by operations.

There is a HEP identified for turning on hydrogen igniters, but it is set to 1.0 inthe model. methodology is the still being used), but updated insights were obtained, and the LERF notebook was revised to reflect the new insights.

-A new "Basis for Value" column was also added to the LERF basic events table (Table 11 of LERF notebook) to explain the bases for the values used. The L.ERF notebook was updated fo include the following discussion on Procedure Reviews: As part of the LERF sequence model development, a review of the EOPs, AOPs, and SOPs was performed to identify the operator actions that would be employed to respond to the LERF seq-uence in progress.

As part of this review, the systems that could -be used by the operators to respond to the scenario were also identified.

For the systems that were identified that were not credited in the CDF model, new system logic was developed, including the operator actions associated with the use of the system. For the systems that could be used to respond to the LERF scenario that were also used in the CDF model, the system analyst ensured that the operator actions required to respond to the lERF scenario were. -included in the system model. Once all the LERF related operator actions were identified, they were evaluated as part of the Human Reliability Analysis [15]. Updates to the igniter HEPs are performed in the HRA notebook [15] and the values are added to Table 9 of this notebook Per the containment capacity report (GGNS 92-0034), Although the CDF accident progression sequences the failure location with the lowest mean pressure is the do consider the potential that the location of the basemat 65 sid :The containment failure location containment failures could im act the survivabilit 5-18 (F) ENERC N GGNS TMRE PRA Application PAGE NO. 58 OF 62* LE-C1 LE-E3 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION was not considered in the LE analysis (all overpressurization was considered a large release, after the 0.5 'scrubbing credit for the Auxiliary Building).Since basemat failures could potentially result in underground releases to allow significant scrubbing, the approach taken is conservative.

It is noted that other containment failure locations have . mean failure pressures that are not much higher than the basemat failures, but some credit could be given to reduce the LERF. The GG LE analysis does not provide a quantitative definition of 'Large' releases, and does not document the evaluation of sequences as resulting in a 'Early' release. Discussions with the GG PRA team identified that the 'Early' evaluations were based on comparison of MAAP-predicted containment failure time for the dominant sequence (loss of OHR) with the time of declaration of a general emergency.

This is accep.table, but the evaluation needs to be documented.

The

  • evaluation of 'Large' was qualitative, but appears reasonable (e.g., ISLOCA, Containment isolation, Containment rupture), but needs to be documented, . and the bases should be tied to a quantitative definition of'Large.'

1 of the HPCS pump based on the MAAP runs performed in response to GG-5471 (Finding 5-9), the LERF analysis does not credit any fission product scrubbing based on Containment Failure location.

Additional GOTHIC room heatup analyses were also run to evaluate the environment that would be present in the HPCS and LPCS rooms following a Containment failure at a location other than at the base mat. The specific locations reviewed were based on the same design basis Containment performance calculation used to identify the base mat as the weakest point. Since no approved methodology for crediting scrubbing due to Containment failure location currently exists, no credit has been take.n in the GGNS PRA LERF model. A specific definition of Large and Early were used in the analysis, but these definitions were not documented.

Documentation of these definitions was a documentation enhancement, but does not result in a change in methodology.

The new MAAP analysis notebook [RSC 16-02, Rev 1] defines 'Large' and 'Early' releases and documents the results of the LERF MAAP analyses versus the defined criteria.

Section 2.8 of RSC 16-02 defines the criteria and summarizes the MAAP runs that contribute to LERF; ,:__ The definitions of Early and Large are also discussed in the updated LERF notebook.

5-20 (F) 5-22 (F) 1-13 (F) 7-1 (F) ENERCON GGNS TMRE PRA Application PAGE NO. 59 OF 62 ;*§.ieP~iiiij;;

§1rga,!s1m~i1!

Attachment L REPORT NO. REVISION LE-F1 The Quantification notebook (PSA-GGNS-QU-01)

LE-F2 presents the total LERF, the top 100 LERF cutsets, and LE-G3 some LERF importance

  • analyses.

There is no presentation of the relative contribution to LERF from various contributors other than the importance analysis.

LE-G5 Limitations in the analysis have not been identified.

The LE analysis should be examined to identify how any simplifying assumptions can impact applications.

IFPP A-5 Walkdowns are documented in RSC 13-20 Internal Flooding Walkdown Documentation.

In general, this information was found to substantiate the flood zone definition discussions in Section 4.0 of RSC 13-37, Revision 0. Flooding scenarios associated with Control Building area OC125, which contribute to approximately 5% CDF may be overly conservative.

Based on discussions with GG PRA consultants, these scenarios were dominant due to the presence of DC equipment in this room, as documented in the GG equipment database.

However, this critical equipment is not located in this area. IFSO B-3 IFSN B-3 IFEV B-3 IFQU B-3 (This F&O originated from SR IFPP-A5) There is.no apparent documentation of an uncertainty analysis for any of the following:

internal flood plant partitioning; internal flood sources; flood-induced initiating events; accident sequences and. quantification ENTG#GG052-TMRE-002 1 The Summary .Report the presents the relative contribution to LERF from various contributors, and also provides a discussion of the significant LERF scenarios on a sequence level. The Limitations of the LERF analysis have been added into the LERF documentation.

The DC equipment was inadvertently identified as being in OC125 when it should have been in OC215. This was essentially a typo in the input, but not a methodology impact. The Equipment was mapped to correct location (OC215) in TIFA to support resolution of the concern. Room OC215 has no flood sources, so no new scenarios were introduced by the addition of this equipment.

TIFA, FRANX, and the integrated model were updated to reflect this equipment in the new room, and removed from OC125. The uncertainty associated with internal flood plant partitioning; internal flood sources; flood-induced initiating events; accident sequences and quantification has been added.into Table 1 of the Rev 4 GGNS Uncertainty and Sensitivity Report. Rev 4A moved these into the Internal Flood report. Documentation of the limitations of the analysis does not impact the LERF results or methodology, but provides insights to an analyst when the LERF is required to be used for a risk informed application.

7-2 (F) 7-4 (F) 7-5 (F) ENERCON GGNS TMRE PRA Application "PAGE NO. 60 OF 62 IFSOA-3 IFSN A-13 IFEV A-3 IFQU A-1 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 The EDG building is screened from further analysis based upon a statement in FSAR "pipe cracks are not postulated inside the diesel generator_

building;" The flood induced initiating event defaults to loss of power conversion system plant initiator (T-2) is conservative (This F&O originated from SR IFEV-A3) It is not evident that accident sequences were performed and documented.

There is little evidence contained in RSC-CALKNX-2015-0803 The report has been updated to provide the following basis that reflects the inability_

of a flood within the EDG building to result in a reactor trip. A flood in the DG building will not lead directly to a reactor trip since offsite power is not affected.

Any administrative need to shutdown would not occur for several hours and the likelihood of mitigation is high. Therefore, DG building flooding events are screened from further consideration.

Additionally, ,since the failure of multiple diesel generators from an internal flood is not feasible, safe shutdown could be achieved using one of the two other diesel generators. , -On the basis of this assessment, the diesel generator building is excluded from the analysis The flood induced initiating events default to loss of power conversion system plant initiator unless the pipe break itself is associated with a system that induces a reactor trip (e.g. PSW, Circ Water, etc.) in which case it is mapped to the initiator associated with the pipe that is impacted.

This clarification was not clear within the documentation, but was readily obvious when looking at the mapping done within FRANX. This is not a change in methodology, but is a level of detail in the documentation only. Mapping is now shown in the tables in Appendix E of this report, and a discussion was added to Section 9.1 on the selection of initiating events. The internal flood is integrated with the internal events model, and the internal flood accident sequences are quantified using the same 7-6 (BP) 7-7 (F) 7-8 (F) ENERC N GGNS TMRE PRA Application PAGE NO. 61 OF 62 Attachment L REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 IFSN A-6 SSC damage and susceptibility to flooding effects due to submergence, spray, jet impingement, and HELB have been discussed in Sections 6.0, 7.0, and 8.0 of GGNS Internal Flood Notebook RSC 13-37. IFQU A-1 In Table 1, reference to Section 14.0 seems incorrect IFQU A-2 IFQUA-3 IFQU A-4 IFQUA-7 IFQU A-10 IFQU 8-1 IFQU 8-2 IFQU A-1 O Although it is apparent that quantification of the flooding model was performed as documented RSC-CALKNX-2015-0803, it is not evident that the LERF analysis was reviewed and documented.

methodology that was used for the internal events model. However, the documentation of this quantification required additional detail and discussion.

The Summary Report for Rev 4 contains sequence level quantification and discussions.

In Rev 4a, these discussions were moved into the Internal Flood Notebook.

Nothing to resolve since this was considered to be a "Best Practice".

Table 1 has been revised to reference the correct sections and/or-other reports as necessary.

A review of the Internal Flood LERF analysis was performed and documented.

This review included cut set reviews for the IF LERF as documented in Section 14.1, a review and discussion of the significant LERF accident sequences as documented in Section 14.3, a review and discussion of the significant LERF cut sets as documented in Section 14.4.2, and identification of the top LERF basic events, HFEs, Maintenance events, CCF events, and initiating events based on Fussell-Vesely and RAW as documented in Section 14.4.3. As stated in the Finding, the internal flood model was uantified usin the same methodolo as the ENERCON Attachment L GGNS TMRE PRA Application PAGE NO. 62 OF 62 REPORT NO. ENTG#GG052-TMRE-002 REVISION 1 internal events model, but documentation of the LERF portion of the internal flood analysis required additional detail. ...

Retrieved from "https://kanterella.com/w/index.php?title=GNRO-2017/00061,_License_Amendment_Request_to_Incorporate_Tornado_Missile_Risk_Evaluator_Into_Licensing_Basis&oldid=1580447"