ML17268A036

NEI 17-02, Revision 1, Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document

ML17268A036
Person / Time
Site:	Nuclear Energy Institute
Issue date:	09/30/2017
From:	Vaughan S Nuclear Energy Institute
To:	Doug Broaddus Division of Operating Reactor Licensing
Schwab A
Shared Package
ml17268a023	List: ML17268A033 ML17268A036
References
NEI 17-02, Rev. 1
Download: ML17268A036 (226)

Text

NEI 17-02, [Rev 1]

TORNADO MISSILE RISK EVALUATOR (TMRE)

INDUSTRY GUIDANCE DOCUMENT Prepared by the Nuclear Energy Institute September 2017 Executive Summary This Nuclear Energy Institute (NEI) guidance document establishes an acceptable risk-informed methodology for identifying and evaluating the safety significance associated with structures, systems and components (SSCs) that are exposed to potential tornado-generated missiles. The methodology, called the Tornado Missile Risk Evaluator (TMRE) was developed to provide NEI membership with a simple, cost-effective tool to address questions concerning vulnerability to tornado missiles. This document provides guidance on the identification of these vulnerabilities at a nuclear power plant site, the development and application of a TMRE model for the site, and a process for resolving discrepancies against licensing basis requirements. Overall the methodology provides a path forward to resolve low safety significant nonconforming conditions associated with tornado missile protection requirements of the licensing basis.

The Nuclear Energy Institute is the nuclear energy industrys policy organization.

This document and additional about nuclear energy are available at nei.org 1201 F Street, NW Washington, DC 20004 Page 1 of 226

September 21, 17 NEI 17-02, [Rev 1]

Use and Applicability of this Guidance Document The purpose of this document is to provide references, summations, examples and rationales in enough detail to enable the user to develop a TMRE model for their power plant with minimum effort and without the necessity for reliance on contractors or consultants. NEI estimates that the TMRE can be implemented and adopted with an expenditure of approximately 400-700 person-hours. Wherever possible, the TMRE methods and parameters have been simplified with the development of generic, bounding inputs that can be used by all plants. In some cases, plant-specific inputs must be used, and these are identified for the user with guidance on where/how to obtain the input. The use of this guideline, or the information it contains, is not mandatory.

Page 2 of 226

September 21, 17 NEI 17-02, [Rev 1]

Revision Table Date Responsible Revision Description of Changes Modified Person 0 Initial Issuance June 2017 S. Vaughn Editorial changes, fixed several errors in Appendices A, B and C, and removed Sections 2, 4, and 10 and Appendix F because September 1 S. Vaughn they were considered not within scope of the TMRE 2017 methodology Acknowledgements This document was developed by the TMRE Steering Committee. NEI wishes to acknowledge the efforts of the following individuals:

Victoria Anderson NEI Mel Arey Duke Energy Anya Barry NEI Scott Brinkman Duke Energy Hasan Charkas EPRI Alex Gilbreath Southern Nuclear Jack Grobe Exelon Ted Kulczycky NextEra Atanya Lewis NextEra Ken Lowery Southern Nuclear Art Mironenko Duke Energy Bruce Montgomery NEI Chris Riedl TVA Leo Shanley Jensen-Hughes Bret Tegeler Jensen-Hughes Jordan Vaughan Duke Energy Page 3 of 226

September 21, 17 NEI 17-02, [Rev 1]

Notice Neither NEI, nor any of its employees, members, supporting organizations, contractors, or consultants make any warranty, expressed or implied, or assume any legal responsibility for the accuracy or completeness of, or assume any liability for damages resulting from any use of, any information apparatus, methods, or process disclosed in this report or that such may not infringe privately owned rights.

The opinions, conclusions, and recommendations set forth in this report are those of the authors and do not necessarily represent the views of NEI, its employees, members or consultants.

Because NEI is supported in part by Federal funds, NEIs activities are subject to Title VI of the Civil Rights Act of 1964, which prohibits discrimination based on race, color, or national origin, and other federal laws and regulations, rules, and orders issued thereunder prohibiting discrimination. Written complaints of exclusion, denial of benefits or other discrimination of those bases under this program may be filed with the United States Nuclear Regulatory Commission, Washington, DC 20555 or any other appropriate federal regulatory agency or, among others, the Tennessee Valley Authority (TVA),

Office of Equal Employment Opportunity, 400 West Summit Hill Drive, Knoxville, TN 37902 Page 4 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table of Contents

1. INTRODUCTION ........................................................................................ 8

1.1 BACKGROUND

............................................................................................ 8 1.2 PURPOSE ................................................................................................. 9 1.3 OVERVIEW AND COMMENTS ............................................................................ 9 1.4 ABBREVIATIONS .......................................................................................... 9 1.5 DEFINITIONS ........................................................................................... 10 2 OVERVIEW OF TORNADO MISSILE RISK EVALUATOR METHODOLOGY .. 12 2.1 PERFORM TMRE WALKDOWN ....................................................................... 14 2.1.1 PRE-WALKDOWN ACTIVITIES ............................................................................. 14 2.1.2 VULNERABLE SSC WALKDOWN .......................................................................... 14 2.1.3 MISSILE WALKDOWN ..................................................................................... 15 2.2 DETERMINE SITE TORNADO HAZARD FREQUENCY .................................................... 15 2.3 EVALUATE TARGET AND MISSILE CHARACTERISTICS .................................................. 15 2.4 DEVELOP TMRE PRA MODEL ........................................................................ 16 2.5 QUANTIFY RISK, PERFORM SENSITIVITY ANALYSES, AND COMPARE TO THRESHOLDS ............... 17 2.6 PLANT CONFIGURATION CHANGES ................................................................... 18

2.7 REFERENCES

........................................................................................... 18

3. PERFORM PLANT TMRE WALKDOWN ...................................................... 19 3.1 VULNERABLE SSC WALKDOWN PREPARATION ....................................................... 19 3.2 VULNERABLE SSC WALKDOWN ....................................................................... 22 3.2.1 PERSONNEL FOR VULNERABLE SSC WALKDOWN ....................................................... 22 3.2.2 VULNERABLE SSC IDENTIFICATION AND DATA COLLECTION ............................................ 23 3.3 EX-CONTROL ROOM ACTION FEASIBILITY ............................................................. 25 3.4 TORNADO MISSILE IDENTIFICATION AND CLASSIFICATION ............................................ 25 3.4.1 TORNADO MISSILE WALKDOWN PERSONNEL ........................................................... 25 3.4.2 NON-STRUCTURAL MISSILE INVENTORY ................................................................. 25 3.4.3 TEMPORARY MISSILES .................................................................................... 28 4 DETERMINE SITE TORNADO HAZARD FREQUENCY ................................ 38 4.1 DATA SOURCES ........................................................................................ 38

4.2 BACKGROUND

.......................................................................................... 38 4.3 HAZARD FREQUENCY CALCULATIONS ................................................................. 39 4.4 PLOT DATA POINTS .................................................................................... 39 Page 5 of 226

September 21, 17 NEI 17-02, [Rev 1]

4.5 TRENDLINE EQUATION ................................................................................. 40 4.6 CALCULATE EXCEEDANCE PROBABILITIES .............................................................. 41 5 EVALUATE TARGET AND MISSILE CHARACTERISTICS ........................... 42 5.1 MISSILE IMPACT PARAMETER (MIP) ................................................................. 43 5.2 MISSILE INVENTORIES ................................................................................. 44 5.2.1 MISSILE INVENTORY EXAMPLE ........................................................................... 45 5.3 TARGET EXPOSED AREA ............................................................................... 48 5.3.1 TYPES OF TARGETS AND CALCULATIONS .................................................................. 48 5.3.2 TARGET SHIELDING ........................................................................................ 55 5.3.3 TARGET ELEVATION ....................................................................................... 56 5.4 TARGET FRAGILITIES ................................................................................... 57 5.5 EXPOSED EQUIPMENT FAILURE PROBABILITY (EEFP) EXAMPLES .................................... 57 5.6 CORRELATION BETWEEN TARGETS .................................................................... 64 5.6.1 CORRELATED TANKS EXAMPLE ........................................................................... 64 5.6.2 CORRELATED SAFETY VALVES EXAMPLE ................................................................. 67 6 DEVELOP TMRE PRA MODEL ................................................................... 71 6.1 EVENT TREE/FAULT TREE SELECTION ................................................................. 71 6.2 TORNADO INITIATING EVENTS ......................................................................... 73 6.4 IMPACTS ON OPERATOR ACTION HUMAN ERROR PROBABILITIES .................................... 76 6.5 TARGET IMPACT PROBABILITY BASIC EVENTS ......................................................... 78 6.6 NON-CATEGORY I STRUCTURES AND OTHER NSR SSCS ............................................. 81 6.7 PRA TECHNICAL ADEQUACY .......................................................................... 81 7 QUANTIFY RISK, PERFORM SENSITIVITY ANALYSES, AND COMPARE TO THRESHOLDS .......................................................................................... 83 7.1 CDF AND LERF QUANTIFICATION .................................................................... 83 7.2 SENSITIVITY ANALYSES ................................................................................. 83 7.2.1 TMRE SENSITIVITIES ..................................................................................... 83 A ZONAL VS. UNIFORM MISSILE DISTRIBUTION ........................................................... 83 B MISSILE IMPACT PARAMETER ............................................................................ 84 7.2.2 OPEN PRA F&OS ........................................................................................ 84 7.2.3 COMPLIANT CASE CONSERVATISMS ...................................................................... 84 7.3 COMPARISON TO RISK METRIC THRESHOLDS ......................................................... 84 7.4 ADDRESSING RISK SIGNIFICANT TARGETS ............................................................. 85 7.5 DEFENSE-IN-DEPTH AND SAFETY MARGIN ............................................................ 85 8 PLANT CONFIGURATION CHANGES ........................................................ 88 Page 6 of 226

September 21, 17 NEI 17-02, [Rev 1]

8.1 PLANT CONFIGURATION CHANGES .................................................................... 88 8.2 FUTURE IDENTIFICATION OF NONCONFORMING CONDITIONS ........................................ 88 APPENDIX A: TECHNICAL BASIS FOR TMRE METHODOLOGY ....................... 89 APPENDIX B: BASES FOR MIP AND MISSILE INVENTORIES ....................... 129 B.1 BACKGROUND INFORMATION ON MISSILE IMPACT PARAMETER (MIP) ........................... 129 B.1.1 DEFINITION OF MISSILE IMPACT PARAMETER (MIP) ............................................. 130 B.2 USING EPRI NP-768 DATA TO DETERMINE MISSILE IMPACT PARAMETER (MIP) ............... 130 B.2.1 NORMALIZING EPRI NP-768 MISSILE HIT PROBABILITY ........................................ 131 B.2.2 REVIEW OF SINGLE MISSILE HIT PROBABILITIES (H-VALUE P) FOR PLANTS A AND B ........... 132 B.2.3 SELECTION OF TARGET MISSILE HIT PROBABILITIES (P) FOR DEVELOPING MIP ................ 132 B.3 DERIVATION AND CALCULATION OF THE MISSILE IMPACT PARAMETER (MIP) .................... 133 B.3.1 CALCULATION OF TARGET AREAS .................................................................. 133 B.3.2 SELECTION OF CONSERVATIVE TORNADO REGION MIP .......................................... 136 B.3.3 SEPARATE MIP DERIVATION FOR ELEVATED TARGETS AND NEAR GROUND TARGETS ......... 137 B.4 MIP VALUES FOR USE IN THE TMRE................................................................ 137 B.4.1 NEAR GROUND TARGET MIP ...................................................................... 137 B.4.2 ELEVATED TARGET MIP ............................................................................ 138 B.4.3

SUMMARY

OF MIP VALUES ........................................................................ 138 B.4.4 POTENTIAL FOR STATISTICAL CORRELATION BETWEEN TARGETS ................................. 139 B.5 MISSILE INVENTORIES ............................................................................... 140 B.6 MISSILES AFFECTING ROBUST TARGETS ............................................................. 142 B.6.1 CATEGORIZING ROBUST TARGETS .................................................................. 143 B.6.2 MISSILE TYPE INVENTORIES......................................................................... 145 B.7 REFERENCES .......................................................................................... 149 APPENDIX C: BASES FOR TARGET ROBUSTNESS AND MISSILE CHARACTERISTICS ............................................................................... 151 APPENDIX D: TECHNICAL BASIS FOR TMRE METHODOLOGY ..................... 185 APPENDIX E: TMRE METHODOLOGY SENSITVITY STUDIES .................... 199 E.1 OBJECTIVES .......................................................................................... 199 E.2 METHODOLOGY OVERVIEW ......................................................................... 199 E.3 DESCRIPTION OF PLANT MODELS ................................................................... 200 Page 7 of 226

September 21, 17 NEI 17-02, [Rev 1]

1. INTRODUCTION The Tornado Missile Risk Evaluator (TMRE) is designed to provide operators of commercial nuclear power plants a cost-effective method to conservatively assess the risks posed by tornado-generated missiles. The TMRE is a hybrid methodology comprised of two key elements: (1) a deterministic element to establish the likelihood that a specific structure, system, or component (SSC) (or target) will be struck and damaged by tornado-generated missile; and (2) a probabilistic element to assess the impact of the missile damage on the core damage and large early release frequencies.

The output of the deterministic element is a calculated Exposed Equipment Failure Probability (EEFP) that is based largely on a simplified generic relationship between tornado strength and the population of materials at a typical nuclear power plant that may become airborne during a tornado. Site-specific inputs to the EEFP include the likelihood of a tornado striking the site and the size and location of the target SSC being evaluated.

The probabilistic element uses the existing plant-specific peer-reviewed internal events probabilistic risk assessment (PRA) model to evaluate the impact of the loss of a target SSC. The risk assessment methods and acceptance criteria of the Nuclear Regulatory Commission (NRC) Regulatory Guide (RG) 1.174 are used to determine whether risks posed by potential tornado missiles at a site warrant protective measures.

Use of the TMRE is a new methodology as defined in Title 10 of the Code of Federal Regulations (10 CFR) 50.59, requiring NRC review and approval. This guidance document describes how to develop and apply the TMRE and how to adopt the TMRE in the plant-specific licensing basis.

1.1 BACKGROUND

The need for the TMRE originated with NRCs issuance of Regulatory Issue Summary (RIS) 2015-06, which reminded licensees of the need to comply with the plant-specific licensing basis for protection against tornado missiles. The RIS cited several examples where NRC issued violations for licensees failing to provide protection for SSCs that were exposed to potential tornado missiles. Examples of exposed SSCs included safety-related vent pipes for emergency diesel generator exhausts, diesel fuel oil storage tanks, and exhaust pipes for auxiliary feedwater and reactor core isolation cooling systems. The NRC typically cited 10 CFR 50, Appendix A, General Design Criterion 2, along with general statements in the station Updated Final Safety Analysis Report (UFSAR) regarding protection against the effects of tornadoes, as the basis for the violation.

The problem posed by RIS 2015-06 for many licensees is that in many cases, the licensing basis is stated in general terms without sufficient detail to provide clarity and predictability on how protection from tornado missiles was deemed adequate by NRC during the plant licensing phase. This allows questions to be raised whether safety-related components that are exposed to the elements met NRC regulatory requirements. This situation is exacerbated by the fact that NRC requirements for tornado missile protection evolved substantially over the years, and the level of detail in which the issue was described in plant UFSARs grew from almost no description at all to detailed descriptions of tornado missile characteristics and the design standards adopted for protection from them.

NRC explored the safety significance of the variations in protection from tornado missiles during the Systematic Evaluation Program (SEP) in the 1980s. Specifically, the NRC evaluated selected plants that Page 8 of 226

September 21, 17 NEI 17-02, [Rev 1]

were licensed prior to the issuance of the NRC Standard Review Plan (SRP) to determine whether plants of this vintage should be required to take additional measures to upgrade their level of protection. The conclusion reached by the SEP was that tornado missiles did not pose a significant risk to public health and safety to warrant generic regulatory action.

With the advent of Fukushima, additional interest was focused on protection from external events of all types. New methods to assess the risks of beyond design basis seismic, flooding, and high wind events were developed and updated.

The requirements for protection against external events described in the licensing basis are deterministic and must be met to maintain safety margins and defense-in-depth. On the other hand, the NRC recognizes the merits of alternative methodologies to determine the need for physical protection from tornado missiles, such as TORMIS, developed by EPRI during the 1980s and approved for use at several plants. Subsequent to the issuance of RIS 2015-06, NRC expressed willingness to consider risk-informed approaches to address this issue.

1.2 PURPOSE The purpose of the TMRE is to present NRC with a RG 1.174 risk-informed option to assess the risk posed by tornado missiles at any site to determine whether additional physical protection is warranted.

Because it is risk-informed, the TMRE can be applied regardless of the vintage of the plant or the content of the plants licensing basis.

The impetus and foundation for the TMRE is the NRC-approved methodology developed for use at Calvert Cliffs in 1995. The Calvert Cliffs approach used a simplified method to calculate the likelihood that a SSC would be rendered unavailable by a missile strike during the passage of a tornado and then used the plant internal events PRA to evaluate a core damage frequency contribution from the event.

This was then related to a threshold for exceeding 10 CFR Part 100 doses offsite.

1.3 OVERVIEW AND COMMENTS This guidance document is a compilation of the structure of the TMRE methodology (Section 2), and a step-by-step explanation of how to develop and deploy the TMRE at a site (Sections 3 through 7).

Several appendices are provided to amplify elements of the guidance where warranted.

1.4 ABBREVIATIONS AOV - air operated valve BE - basic event CAP - corrective action program CDF - core damage frequency CLB - current licensing basis DB - design basis EEFP - exposed equipment failure probability EGM - enforcement guidance memorandum EPRI - Electric Power Research Institute FSAR - final safety analysis report HEP - human error probability HW - high winds Page 9 of 226

September 21, 17 NEI 17-02, [Rev 1]

HWEL - high winds equipment list IA - instrument air LAR - license amendment request LERF - large early release frequency LOOP - loss of off-site power LOS - line of sight MCC - motor control center MFW - main feed water MIP - missile impact parameter MOV - motor operated valve NEI - Nuclear Energy Institute NPP - nuclear power plant NRC - Nuclear Regulatory Commission NUREG - U.S. Nuclear Regulatory Commission technical report designation PRA - probabilistic risk assessment PSAR - preliminary safety analysis report RG - regulatory guide RIS - regulatory issue summary RWST - reactor water storage tank SEP - safety evaluation program SSC - system, structure, component SSEL - safe shutdown equipment list SR - supporting requirement SW - service water TMRE - tornado missile risk evaluator UFSAR - updated final safety analysis report 1.5 DEFINITIONS Correlation - The relationship between two or more SSCs that infers that by nature of their proximity to each other they could be damaged by a single tornado missile.

De Minimus Penetration - Any penetration in a tornado-generated missile resistant reinforced concrete wall or other tornado-generated missile resistant structure that is less than 10 square feet.

Exposed Equipment Failure Probability (EEFP) - The conditional probability that an exposed SSC is hit and failed by a tornado missile, given a tornado of a certain magnitude.

High Winds Equipment List (HWEL) - List of potential vulnerabilities, vulnerabilities, and nonconforming SSCs identified during the walkdown that can be evaluated using the TMRE to determine the risk of leaving them unprotected.

Missile Impact Parameter (MIP) - The probability of a tornado missile hit on a target, per target unit surface area, per missile, per tornado.

TMRE PRA - An adaption of the plant internal events PRA suitable for use in the TMRE.

Page 10 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE Walkdown - A plant walkdown focused on collecting physical information to characterize exposed SSCs and the plant missile population for use in developing the TMRE model for the plant.

Vertical Missile - Any missile that has a non-horizontal velocity component.

Page 11 of 226

September 21, 17 NEI 17-02, [Rev 1]

2 OVERVIEW OF TORNADO MISSILE RISK EVALUATOR METHODOLOGY The Tornado Missile Risk Evaluator (TMRE) will be used to estimate the quantitative risk associated with tornado-generated missiles at U.S. nuclear power plants (NPP). It makes use of the licensees internal events Probabilistic Risk Assessment (PRA) model, which is modified to reflect the anticipated effects of the passage of a tornado over the site. The TMRE involves three major steps:

• Site walkdowns are performed to gather relevant information regarding the SSCs that are not protected against tornado-generated missiles and missile characteristics.

• Failure probabilities for exposed SSCs important to safe shutdown are calculated using the Exposed Equipment Failure Probability (EEFP). This calculation takes into account the number of missiles that are damaging to the SSC, the exposed area of the SSC, and the Missile Impact Parameter (MIP), a parameter that relates the likelihood of a missile striking a target, based on the tornado intensity. If a damaging missile strikes an exposed SSC, it is assumed to fail.

• The increases in core damage frequency (CDF) and large early release frequency (LERF) are calculated using the TMRE PRA and compared to acceptance criteria in RG 1.174 [Ref. 2.4].

Figure 2-1 provides an overview of the process, which is described in detail in Sections 3 through 7.

Page 12 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 2-1: TMRE Flowchart Page 13 of 226

September 21, 17 NEI 17-02, [Rev 1]

2.1 PERFORM TMRE WALKDOWN The TMRE Walkdown is used to gather physical data associated with vulnerable and nonconforming SSCs, and to identify any other SSCs that are modeled in the PRA but are not protected from tornado winds or missiles. Additionally, the walkdown is used to validate the missile inventories, used in the EEFP calculations, as bounding for the site. The TMRE walkdown process includes pre-walkdown activities, a Vulnerable SSC Walkdown, and a Missile Walkdown.

2.1.1 PRE-WALKDOWN ACTIVITIES Prior to sending personnel out on a walkdown, several activities are recommended to ensure that a complete walkdown is performed in an efficient manner. Preparations are needed primarily for the walkdown activities associated with identifying and characterizing vulnerable SSCs; less effort is needed to prepare for the missile count verification part of the walkdown.

The Vulnerable SSC Walkdown includes reviewing any previously identified potential vulnerabilities and nonconforming SSCs, to collect any data needed for the TMRE model. The Vulnerable SSC Walkdown will also search for and evaluate any SSCs credited in the TMRE PRA model that are not protected from tornado winds or missiles. Although these SSCs may not be required to be protected by the plants licensing basis, their ability to function during a tornado event needs to be evaluated to ensure they are properly modeled in the TMRE PRA.

This guideline recommends the development of an HWEL, which provides the walkdown team with a list of SSCs to review during the walkdown. The initial HWEL will contain the list of previously identified potential vulnerable and nonconforming SSCs and a list of potentially unprotected PRA SSCs. During the TMRE walkdown, additional SSCs may be identified that will be added to the HWEL (e.g., PRA SSCs that were initially considered to be protected, but evidence from the walkdown indicated otherwise).

The HWEL development is detailed in Section 3, which is based primarily on the EPRI HW Walkdown Guidance (EPRI 3002008092, Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants [Ref. 2.1]). It includes identifying potentially unprotected SSCs in the PRA and determining their location. This is done prior to walkdowns using plant documentation.

2.1.2 VULNERABLE SSC WALKDOWN The Vulnerable SSC Walkdown is performed to gather information on HWEL SSCs that are exposed to tornado missiles. The walkdown will determine which SSCs are vulnerable to tornado missiles and will be used to collect data, such as the exposed SSC target location, elevation, surface area, and construction details, and the type and location of any local structures that may provide a shielding effect. The data collected is needed for the TMRE model, specifically to determine the EEFP. It can also aid in development of modeling approaches for specific configurations, such as when SSCs are physically correlated. The EEFP is used to calculate the probabilities for SSC failure that are used in the TMRE PRA model; the EEFP is briefly discussed in Section 2.4, and described in detail in Section 5.

Page 14 of 226

September 21, 17 NEI 17-02, [Rev 1]

2.1.3 MISSILE WALKDOWN The second major goal of the TMRE Walkdown is to perform a missile count. Objects within approximately 2500 feet of a common reference point (e.g., the center of containment) that can become airborne during a tornado event at the site are identified and counted. Twenty-three different missiles types are identified, each with a different capability to damage an exposed SSC. In addition to loose objects outside of structures (e.g., construction material), missiles can also be created by structures (e.g., warehouses, Butler buildings) and their contents, when those structures are not capable of withstanding tornado wind pressure effects and disassemble during a tornado. This walkdown is typically separate from the Vulnerable SSC Walkdown. Section 3.4 provides details on how the missile counts are performed.

2.2 DETERMINE SITE TORNADO HAZARD FREQUENCY The initiating events for the TMRE PRA model are tornadoes at the site. Each licensee should develop site-specific tornado frequencies for applicable tornadoes. The tornadoes of interest are those tornadoes with a wind speed of approximately 100 mph or greater. For the purposes of the TMRE, the F-scale (Fujita prime) will be used to classify tornadoes; this scale is somewhat different from the original Fujita Scale (F-Scale) and the Enhanced Fujita Scale (EF-Scale). The differences between these scales and the rationale for choosing the F-scale are discussed further in Sections 4 and 5.

NUREG/CR-4461, Revision 2 [Ref. 2.2] is the recommended source of tornado data for developing the site-specific tornado frequencies to be used in the TMRE PRA. Each U.S. NPP site is provided with tornado wind speeds associated with 10-5, 10-6, and 10-7 probabilities per year of a tornado missile strike.

Additionally, the total tornado strike frequency (i.e., the frequency of any tornado with wind speed greater than 65 mph) is provided for all locations in the continental United States. Using this data, a site-specific tornado frequency curve (hazard curve) can be developed, and the frequency of all tornadoes considered in the TMRE (F2 through F6) can be calculated. Details on the process of determining tornado frequencies for use in the TMRE are provided in Section 4.

2.3 EVALUATE TARGET AND MISSILE CHARACTERISTICS Failures of SSCs that can be struck and damaged by a tornado missile will be added as new basic events to the TMRE PRA model. Tornado missile failures do not need to be considered for SSCs protected by 18 reinforced concrete walls, 12 reinforced concrete roofs, and/or 1 steel plate. The failure probability of these SSCs is calculated using the Exposed Equipment Failure Probability (EEFP). The EEFP is the conditional probability that an exposed SSC is hit and failed by a tornado missile, given a tornado of a certain magnitude. A single SSC will have five EEFP values calculated, one for each tornado category, F2 through F6.

The EEFP is defined as:

= () (# ) ( )

Where:

The Missile Impact Parameter (MIP) is the probability of a damaging tornado missile hit on a target, per target unit surface area, per missile, per tornado. Generic MIP values are provided as part of the Page 15 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE methodology and are described in more detail in Section 5.1 and Appendix B. The MIP varies by the tornado category (i.e., F2 through F6) and the elevation of the target.

1. of Missiles is the number of damaging missiles within approximately 2500 feet of a common reference point, such as the center of containment. Generic values for the total number of missiles are provided as part of the TMRE methodology and will be verified as bounding through the TMRE walkdown activity. More robust targets (e.g., steel pipes and tanks) will not use the entire missile inventory that can damage less robust SSCs (e.g., electrical panels, instrumentation), since only certain types of missiles can damage robust targets. Robust targets are subdivided into categories based on their characteristics (basically the thickness of the SSCs steel or concrete). Depending on the targets category of robustness, a certain fraction of the total missile inventory will be used in the EEFP calculations for that target. Missile inventories also vary by F-scale, which takes into account the number of missiles produced by building deconstruction for each tornado category. The missile inventories to use for each type of target and each F-scale tornado are described in Section 5.2. Further details are provided in Appendices B and C.

Target Exposed Area is determined for each SSC, based on plant documentation and information collected during the Vulnerable SSC Walkdown. More information on target areas is provided in Section 5.

Fragility is the conditional probability of the SSC failing to perform its function given that it is hit by a damaging tornado missile. For the purposes of the TMRE, it is assumed to be 1.0 (i.e., always failed if hit by a damaging tornado missile).

Plant-specific data used as input to the EEFP calculations (e.g., size of the SSC and its elevation) will be based on plant documents and drawings, plus information gathered during the TMRE Walkdowns.

Details and examples of SSC exposed area calculations and EEFP calculations are provided in Section 5.

Target Exposed Area is a direct input to the EEFP calculation and can typically be determined using drawings and other plant documents. Additional measurements may be made during the walkdowns.

Shielding near or around an SSC may have the effect of reducing the amount of the target area actually exposed to missiles.

Target elevation affects the MIP value used in the EEFP for a given SSC. For targets that are less than or equal to 30 feet above the source of missiles (typically plant grade), the Near Ground MIP value is used.

Targets greater than 30 feet above the source of missiles are considered Elevated targets and use the Elevated MIP values. Elevated MIP values are less than the Near Ground MIP values. The basis for the MIP values and the dependence on elevation are described in detail in Appendix B. The target elevation can be determined from plant documents, but should also be confirmed by walkdown.

2.4 DEVELOP TMRE PRA MODEL The plants at-power internal events PRA model of record is typically used as the basis for the TMRE model. Since F2 tornadoes (i.e., tornadoes with wind speeds greater than or equal to 103 mph) are very likely to result in a Loss of Offsite Power (LOOP) to the plant, the LOOP event tree is typically chosen as the portion of the internal events PRA used for the TMRE PRA. This is similar to how at-power High Winds (HW) PRA models are developed. The analyst must ensure that the correct event tree(s) is chosen for the TMRE PRA, based on knowledge of the site-specific PRA model. The details for the PRA model changes needed to develop the TMRE PRA are provided in Section 6.

Page 16 of 226

September 21, 17 NEI 17-02, [Rev 1]

As described in Section 2.3, tornado events are used as initiating events in the TMRE PRA model. Each tornado from F2 to F6 will be represented as an initiating event, having a specific frequency. This is necessary, because the MIP values (and hence the EEFPs) are based on the tornado category. Since the missile strike failures are conditional on the tornado category, the tornado initiating event category must match the EEFP for that category, for each SSC.

Two PRA model cases are developed for the TMRE, the Compliant Case and the Degraded Case. Both of the cases are based on the same LOOP event tree, with certain typical modifications. For example:

• No offsite power recovery is credited in either the Compliant Case or the Degraded Case models.

• Operator actions that require transit or action outside Seismic Category I structures within the first hour of the event are assumed to fail (i.e., failure probability set to 1.0).

• Basic events are added for certain SSCs that are not protected against tornado missiles and/or winds (these are in addition to those nonconforming SSCs).

The main difference between the two models/cases is as follows:

• The Compliant Case represents the plant as if it met the current licensing basis with respect to tornado missile protection. Therefore, any nonconforming SSCs would be assumed protected against tornado missiles, and thus would not have additional tornado missile-induced failure modes in the Compliant Case.

• The Degraded Case represents the plant as it currently exists (the as-built, as-operated plant). Therefore, each of the nonconforming SSCs will need to have additional basic events added to represent the failure likelihood of the SSC due to tornado missiles. The basic events values are from the EEFP calculations, described in Section 2.4.

The specific changes to the PRA models and the differences between the Compliant Case and Degraded Case are provided in Section 6.

As part of the TMRE PRA model development, certain PRA Standard [Ref. 2.3] Supporting Requirements (SR) will need to be addressed, specifically for the TMRE PRA. These SRs are provided in tables in Section 6.

2.5 QUANTIFY RISK, PERFORM SENSITIVITY ANALYSES, AND COMPARE TO THRESHOLDS The TMRE results are based on quantifying the Compliant and Degraded Case PRA models for CDF and LERF. The risk increase (CDF and LERF) is determined by subtracting the Compliant Case value from the Degraded Case value. CDF and LERF are compared to the acceptance criteria of RG 1.174 [Ref.

2.4].

If CDF or LERF are close to or exceed the thresholds of RG 1.174, refinements to the Compliant and/or Degraded Case PRAs may be appropriate. An example may be to refine the EEFP for certain SSCs by accounting for partial shielding of SSCs.

Quantification continues until the risk thresholds are met or no additional PRA/TMRE work can be done to provide an effective reduction in CDF and/or LERF. If further reductions to CDF and LERF are not possible, the licensee will need to decide whether physical modifications should be made and to which SSCs. The preliminary TMRE results may be used to guide the modification effort.

Page 17 of 226

September 21, 17 NEI 17-02, [Rev 1]

Sensitivity studies may be needed to determine the impact of certain TMRE or site-specific PRA model assumptions. TMRE-related sensitivity studies are recommended in Section 7. Key assumptions and open issues associated with the internal events PRA and applicable to the TMRE application may require sensitivity studies. This will be a plant-specific issue, based on the status of the underlying internal events PRA (e.g., open peer review findings).

2.6 PLANT CONFIGURATION CHANGES Application of TMRE does not provide a basis for modifications to remove existing tornado missile protection or to omit protection for new configurations that otherwise require tornado missile protection according to the plant licensing basis. Design Control programs that meet 10 CFR 50 Appendix B will ensure that subsequent configuration changes are evaluated for their impact on the TMRE risk basis for accepting the identified nonconforming conditions.

2.7 REFERENCES

2.1 EPRI 3002008092, Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants 2.2 NUREG/CR-4461, Tornado Climatology of the Contiguous United States, Rev. 2, US Nuclear Regulatory Commission, February 2007.

2.3 American Society of Mechanical Engineers/American Nuclear Society, Standard for Level 1 / Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sb-2009, 2013.

2.4 U.S. Nuclear Regulatory Commission, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant Specific Changes To the Licensing Basis, Regulatory Guide 1.174, Revision 2, May 2011.

Page 18 of 226

September 21, 17 NEI 17-02, [Rev 1]

3 PERFORM PLANT TMRE WALKDOWN The TMRE Walkdown is performed after the list of nonconforming SSCs has been identified. The purpose of the TMRE Walkdown is to gather physical data associated with the nonconforming SSCs and any other SSCs that are modeled in the PRA but are not protected from tornado winds or missiles, and to validate the number of missiles to use in EEFP calculations. A significant portion of the walkdown task is performed prior to going out in the field for the actual walkdown; the preparation for the walkdown, which includes the development of a HWEL, is also described in this section.

TMRE Walkdown is broken into two phases: the Vulnerable SSC Walkdown and the Tornado Missile Walkdown. These two phases can be performed in parallel and generally do not affect each other. As such, separate personnel can be assigned to the two teams and they can proceed more or less independently. Additionally, the Tornado Missile Walkdown team does not require the same experience level as the Vulnerable SSC Walkdown. Sections 3.1 through 3.2 describe the preparations and walkdown for vulnerable SSCs. Section 3.3 describes the walkdown activities performed to help determine ex-control room operator action feasibility, which is typically performed as part of the Vulnerable SSC walkdown. Section 3.4 describes the Tornado Missile Walkdown preparation and execution.

Much of the information provided in this section can also be found in EPRI 3002008092, Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants [Ref. 3.1].

3.1 VULNERABLE SSC WALKDOWN PREPARATION Prior to sending personnel out on a walkdown, several activities are recommended to ensure that the walkdown is performed completely and in an efficient manner. The Vulnerable SSC Walkdown will review previously identified nonconforming SSCs to collect and verify any data needed for the TMRE model. The Vulnerable SSC Walkdown will also be used to locate and evaluate unprotected SSCs that are credited in the TMRE PRA model. Although all SSCs may not be required to be protected by the plants licensing basis, SSCs that are credited in the TMRE PRA must be evaluated to ensure that they can function during a tornado event.

Development of a HWEL is recommended; the HWEL will provide the walkdown team with an initial list of SSCs to review during the walkdown. The HWEL is generally developed by PRA analysts familiar with the internal events PRA model, with support from design personnel. The initial HWEL should contain the list of vulnerable SSCs to include previously identified nonconforming SSCs and those that are not explicitly modeled in the PRA. It will also include a list of potentially unprotected SSCs that are in the TMRE PRA. Additional TMRE PRA SSCs may be identified during the walkdown that that will need to be added to the HWEL. For example, some SSCs may initially be thought to be protected, but determined to be unprotected during the walkdown. The final HWEL will be based on the work done prior to the walkdown and any additional information (e.g., other unprotected SSCs) collected during the walkdown.

An example HWEL is shown in Table 3-1. It includes the following information:

• Equipment ID: This is the equipment identifier for the SSC. This is typically taken from the plant equipment identification system, but other IDs can be used.

• Equipment

Description:

This is a text description of the SSC.

Page 19 of 226

September 21, 17 NEI 17-02, [Rev 1]

• Basic Event: This is the PRA basic event ID that the failure of the SSC will be assigned.

• BE

Description:

This is the text description of the basic event.

• Building: This is the building that houses the SSC.

• Elevation: This is the floor elevation designator for the location of the SSC.

• Location: This provides more details on the location of the SSC. It may be a room number, fire or flood zone number, row and column intersection, or grid position.

• Normal Position: This column identifies the normal state (normally closed, normally open, normally running, etc.) of the SSC during at-power operations.

• PRA Desired Position: This column identifies the desired state (open, closed, etc.) of the SSC for successful function in the TMRE PRA.

• MOV/AOV Failed Position: This identifies the valve failed state due to loss of power and/or air.

This applies to MOVs, AOVs and similar valves (e.g., with solenoid or hydraulic operators). It is important to include this information in the HWEL for the walkdown team.

• Correlated SSCs: Notes of possible SSC correlations identified during the HWEL creation should be entered here, and any correlation information obtained during the walkdown should be added.

Page 20 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 3-1: Example of HWEL Entries MOV/

Basic PRA AOV Equipment Equipment Event Normal Desired Failed Correlated ID Description (BE) BE Description Building Elevation Location Position Position Position SSCs IA Compressor Valve IA-001 IA-001 IA001XC Turbine 240 TH/12 Open Open N/A N/A Outlet Valve Transfers Closed Service Water Service Water SWP1AF SW-P01A Pump A Fails to Intake 200 IA/14 On On N/A N/A Pump A R Run Main Main Feedwater FWP1BF MFW-P01B Feedwater Pump B Fails to Turbine 219 TC/8 On On N/A N/A R

Pump B Run RWST Reactor Water Near Aux RWST RWSTCF Catastrophic Yard 219 Available Available N/A N/A Storage Tank Building Failure MCC1A Energize 1A1-3 MCC 1A1-3 MCC 1A1-3 Fails Turbine 240 TA/20 Energized N/A N/A 13 d Service Water In the SW SW10AF Valve SW-10A SW-10A Discharge Yard 205 SW Pit Open Open As-Is Pit 3 from O Fails to Open Valve A SW-10B Service Water In the SW SW10BF Valve SW-10B Yard SW-10B Discharge 205 (SW Pit) Open Open As-Is Pit 3 from O Fails to Open (SW Pit)

Valve B SW-10A Page 21 of 226

September 21, 17 NEI 17-02, [Rev 1]

As noted, the HWEL will include potentially vulnerable SSCs from the TMRE PRA. This will require initial work to create the TMRE PRA, at least to the degree that is needed to support HWEL development.

Section 6.1 describes the initial step of selecting the event trees from the internal events PRA model that will be used to form the TMRE PRA model. After completing the step described in Section 6.1, the analyst will be able to determine what SSCs will be included in the TMRE PRA. The SSCs considered in the TMRE PRA and the previously identified nonconforming SSCs form the initial list of SSCs to consider for the HWEL. The following steps are taken to refine the HWEL:

a. Screen out SSCs that are not included in the selected accident sequences (if not already done in the Section 6.1 steps) and non-equipment basic events.

b. Screen out SSCs that are located inside Category I structures and that are located away from vulnerable openings or features (e.g., ventilation louvers, roll-up doors). SSCs that are potentially exposed to tornado missiles through a De Minimus penetration can also be screened.

c. Screen SSCs that are dependent on offsite power, since the TMRE assumes there will be a non-recoverable loss of offsite power.

d. Determine SSC location, normal position, desired position (from the TMRE PRA), and failed position (for MOVs and AOVs).

Following these steps, an initial HWEL will be developed; it will then be used to support the Vulnerable SSC Walkdown.

Prior to the walkdown, any ex-control room human failure events (HFE) should be identified. These actions will need to be reviewed with an operator and the operator locations, transit pathways and operation locations will need to be evaluated as part of the walkdown. The following information should be reviewed with an operator prior to the walkdown:

a. Operator action task (e.g., switch CST suction for AFW pumps)

b. Operator action location, where the action takes place

c. Normal location of the operator(s) at the time of the event. If the site procedures have specific locations for operators to take shelter during a tornado, those should be the starting location for the operators. Otherwise, potential operator locations will need to be considered.

d. Potential pathways for the operator to transit from their initial location to the action location.

3.2 VULNERABLE SSC WALKDOWN The purpose of the Vulnerable SSC Walkdown is to locate and document all potentially vulnerable and previously identified nonconforming SSCs and any TMRE PRA SSCs that are not protected from tornado missiles. Additionally, actions performed outside of the control room (ex-control room actions) will be reviewed to verify that station personnel can safely get from their initial location to the action location after a tornado has struck the plant.

3.2.1 PERSONNEL FOR VULNERABLE SSC WALKDOWN The Vulnerable SSC Walkdown should be performed by a team consisting of personnel familiar with the plant systems, personnel responsible for the TMRE PRA, and a civil or structural engineer familiar with the plant. Structural personnel provide expertise to identify screening characteristics applicable to SSCs.

Page 22 of 226

September 21, 17 NEI 17-02, [Rev 1]

Risk assessment personnel participate in the walkdowns to provide insights on the failure modes of the equipment in the TMRE PRA, as well as to have hands-on experience with the SSCs that will be modeled.

If the walkdown will be conducted primarily by vendors/contractors, it is recommended that the plant PRA personnel be actively involved in the process.

As stated previously, the Vulnerable SSC Walkdown can be performed independently from the Tornado Missile Walkdown. The personnel recommendations for the Tornado Missile Walkdown are discussed in Section 3.4.1.

3.2.2 VULNERABLE SSC IDENTIFICATION AND DATA COLLECTION The initial HWEL, developed in accordance with Section 3.1, is the roadmap for the Vulnerable SSC Walkdown. It should list all the SSCs that need to be identified and reviewed during the walkdown, both previously identified potentially nonconforming SSCs and additional TMRE PRA SSCs that may be exposed to tornado missiles. The HWEL should not be considered static; any additional SSCs in the TMRE PRA that are exposed to tornado missiles and not on the HWEL should be added. Any incorrect or missing information can also be noted while in the field, for updates to the HWEL.

3.2.3 SSC FAILURE MODES Some SSCs may be directly exposed to tornado wind forces, while others may be subject to consequential failure from other SSC failures. Examples include SSCs that are credited in the TMRE PRA but are outside Category I structures, SSCs inside non-Category I structures, and SSCs that can be affected by the failure of non-Category I structures. Specific configurations of interest are:

• Active (e.g., pumps, compressors) or passive (e.g., tanks, piping) components that are outside or in areas where they are exposed directly to tornado winds.

• Components inside non-Category I structures; these SSCs will be damaged when the structure collapses, or exposed to tornado wind pressures from walls or siding failure.

• SSCs adjacent to non-Category I SSCs, that may be impacted when the non-Category I SSC collapses These situations should be noted and documented during the walkdown. Treatment of these failures is described in Section 6.

3.2.4 WALKDOWN ACTIVITIES AND DOCUMENTATION Each of the SSCs on the HWEL should be located, and information on the SSC should be collected, to support the incorporation of the SSC EEFP in the TMRE PRA model. The information to be collected is described below. Both field notes and photographs should be taken while performing the walkdowns. In order to limit the need for additional walkdowns or document reviews later, quality notes supplemented with numerous photographs should be taken to provide necessary documentation from the walkdown. Notes and dispositions regarding specific SSCs can be added to the HWEL.

Documentation from the walkdown will also serve as useful information in the future, if plant modifications are performed which could alter the conclusions derived from the TMRE.

The walkdown activities should consist of the following:

Page 23 of 226

September 21, 17 NEI 17-02, [Rev 1]

a. Locate and identify the SSC; verify that the SSC is located where it is documented to be. Note any support systems or subcomponents, such as electrical cabling, instrument air lines, and controllers.

b. Photograph the SSC, including its surroundings. Ensure that any subcomponents or support systems identified are photographed. Example photographs are provided in Section 4 of the EPRI walkdown guidance, EPRI 3002008092 [Ref.3.1].

c. Document and describe barriers that could prevent or limit exposure of the SSC to tornado missiles; Photograph any barriers that could prevent tornado missiles from impacting the SSC.

This may include barriers or shielding designed to protect an SSC from tornado missiles, as well as other SSCs that may preclude or limit the exposure of the target SSC to missiles (e.g.,

buildings, large sturdy components).

d. Identify directions from which tornado missiles could come from to strike the target. This may best be done with sketches and notes, in addition to photographs of the area surrounding the SSC. For SSCs inside Category I structures, note whether there is a line of sight from an opening to the SSC. De Minimis penetrations that are credited for protection of SSCs should be identified.

e. Determine and/or verify the dimensions of the target SSCs, including any subcomponents or support systems. It is helpful to have the dimensions from drawings or other documents prior to the walkdown, so that the walkdown can be used for confirmation. Determine the dimensions of any openings that allow the SSC to be exposed to a tornado missile.

f. Determine the proximity and potential correlation to other target SSCs. For the purpose of the TMRE, correlated targets are SSCs that can be struck by the same tornado missile. 1 Photographs of SSCs that are close together (correlated or not) are useful for documenting the decision made regarding correlation.1

g. Note any nearby large inventories of potential tornado missiles. Relocation of large groups of potential missiles in close proximity to exposed risk significant SSCs may be considered to improve defense in depth. The intent of this is not to count missiles, since that is done in a separate walkdown.

h. Proximity of non-Category I structures to exposed target SSCs should be documented. A non-Category I structure may collapse or tip-over and cause damage to an SSC.

i. Identify vent paths for tanks that may be exposed to atmospheric pressure changes (APC). These should be noted during the documentation and drawing review, but verified and documented as part of the walkdown.

j. Look for additional issues affecting credited equipment or other potential vulnerabilities that may not have been previously identified.

General information on walkdowns can also be found in EPRI 3002008092, Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants [Ref. 3.1].

1 If targets are correlated, the entire area of the correlated targets should be determined, and one EEFP will be calculated for the correlated targets, to be used to fail all correlated SSCs.

Page 24 of 226

September 21, 17 NEI 17-02, [Rev 1]

3.3 EX-CONTROL ROOM ACTION FEASIBILITY Ex-control room HFEs should have been identified during the development of the HWEL (see Section 3.1). Operator actions performed outside of Category I structures or requiring the operator to transit outside Category I structures should be evaluated for the TMRE. These types of operator actions that need to be performed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the tornado event are assumed to be failed. However, actions requiring transit or operation outside Category I buildings after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> may also be affected by the tornado, especially for higher category tornadoes. For example, access paths may be blocked or debris may prevent easy access to some equipment. Primary and alternate paths for operator transit should be identified and verified with operations staff. Paths should be verified during the walkdown and any relevant notes should be taken. Examples of items to note are the number of pathways available for the operator (taking into account where operators typically shelter during a tornado event), whether the equipment will be accessible, and whether timing is expected to be affected. Ex-control room operator actions that are performed inside Category I buildings and do not require transit outside of Category I buildings are considered to be unaffected.

The results of the operator interviews and the walkdown notes should be reviewed by a Human Reliability Analyst. It is not expected that longer term action (greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />) human error probabilities will be noticeably impacted by the tornado event.

3.4 TORNADO MISSILE IDENTIFICATION AND CLASSIFICATION One of the key inputs to the EEFP is the number of missiles capable of damaging exposed SSCs. In order to simplify the calculations, Section 5.1 provides generic values for the number of missiles to include in the EEFP calculation. The Tornado Missile Walkdown is performed to verify that the number of missiles recommended in Table 5-1 is bounding for the site being evaluated. This walkdown is recommended to be performed separately from the Vulnerable SSC Walkdown; it can be performed in parallel with the Vulnerable SSC Walkdown or at a different time.

3.4.1 TORNADO MISSILE WALKDOWN PERSONNEL Personnel performing the Tornado Missile Walkdown do not require PRA expertise or knowledge, and structural engineering experience is not required. The personnel only need to be trained on the methods for identifying and counting potential missiles. This section and Section 4.3 of EPRI 3002008092 provide adequate information to support training Tornado Missile Walkdown personnel.

3.4.2 NON-STRUCTURAL MISSILE INVENTORY The Tornado Missile Walkdown should cover the entire plant area, out to a distance of 2500 feet from a common reference point, such as the center of the containment. If there are target SSCs more than 1500 feet from the reference point, additional verification of missile populations near those SSCs may be required. Recommendations for this situation are discussed at the end of this section. 2 The survey area may be divided into zones to simplify record keeping and allow multiple teams (if desired) to perform the walkdown. Zones should be defined by geographic or well-recognized landmarks, to minimize the potential for double-counting or overlooking missiles. A plant layout drawing 2

The bases for the areas and distances considered for the TMRE missile inventory are provided in Appendix B.

Page 25 of 226

September 21, 17 NEI 17-02, [Rev 1]

and/or satellite image of the plant can be marked up to indicate the zones. The number of zones can vary from a few (5 - 7) to about 30.

Although High Winds PRAs generally require the type and number of missiles to be counted, only the total number of missiles are required to be counted for the TMRE PRA. However, it may be beneficial to count the types of missiles, for record-keeping purposes and for potential use in the future. The types of missiles are listed in Table 3-2, including examples of which objects would be binned as a certain missile type. Not every potential missile is listed in this table, so other objects that can become missiles should be binned with the closest missile type. A similar list of missile types is provided as Table 4-2 in EPRI 3002008092 and an example missile inventory table (including nominal dimensions for the missiles) is provided in Table 4-3 of the same EPRI report. 3 In the case of targets greater than 1500 feet from the plant area reference point, a qualitative evaluation of the missile inventory within 2500 feet of the outlying target(s) should be done. The intent of this evaluation is to determine whether the missile inventory used for the TMRE is applicable to all the targets. If the missile inventory/density surrounding an outlying target is judged to be comparable to (or bounded by) the missile inventory determined from the missile survey out to 2500 feet from the reference point, then no further action is required. Otherwise, a missile inventory should be determined for the area out to 2500 feet from any outlying target.

3 Missile Type 10 in Table 3-2 is not included in EPRI 3002008092. The Dumpster/Storage Container missile type in EPRI 3002008092 is not included here; they can be binned as vehicles (Missile Type 22).

Page 26 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 3-2: Potential Tornado Missile Type Type Missile Description and Nominal Nominal Weight Example Missiles Dimensions (lbs) 1 Rebar: Steel, 1 dia x 3 long 8 Rebar 2 Gas Cylinder: Steel, 10 dia x 5 tall 290 Gas Cylinder 3 Drum, tank: Steel 20 dia x 5 tall 500 55-gallon drum 4 Utility Pole: Wood, 13.5 dia x 35 long 1500 Wooden light pole or telephone pole 5 Cable Reel: Wood, 42 dia x 1.8 wide 253 Cable Reel 6 3 Pipe: Steel, 3.5 dia x 10 long 76 Fence posts, conduit, sprinkler piping 7 6 Pipe: Steel, 6.63 dia x 15 long 284 Larger pipes 8 12 Pipe: Steel, 12.75 dia x 15 long 744 Steel light poles or utility poles 9 Storage bin: Steel 3.5 x 3 x 6 675 Small metal containers, gang boxes, filing cabinets 10 Concrete Paver 88 Concrete Roof Pavers 11 Concrete Block: 8 x 8 x 16 36 Cinder blocks 12 Wood Beam: 4 x 12 x 12 200 Thick wood beams, wood posts 13 Wood Plank: 1 x 12 x 10 27 Thinner wood planks, 2 x 4s 14 Metal Siding 125 Building siding, steel plates 15 Plywood Sheet: 7/8 x 4 x 8 - 84 Plywood sheets 16 Wide Flange: Steel, 14 WF x 15 390 Angle iron, larger I-beams 17 Channel Section: Steel, 6 C x 15 195 C-beams 18 Small Equipment: 2.5 x 2.5 x 3 388 Small portable generators, small pumps 19 Large Equipment: 4 x 3 x 6 1350 Lathe, small concrete mixers, larger generators and pumps 20 Frame/Grating: Steel, 2 x 1 x 12 74 Ladders, scaffolding, floor grating 21 Large Steel Frame: 10 x 4 x 16 1040 Warehouse shelving, pallet racks 22 Vehicle: Examples - 5.5 x 5.5 x 16 Cars, trucks, sea van containers, 4000 trash dumpsters 23 Trees 8 dia x 20 tall 700 Trees 4 4

For forested areas or large stands of trees, counts are typically estimated by determining the area of interest (e.g., via satellite image) and assuming a certain tree density.

Page 27 of 226

September 21, 17 NEI 17-02, [Rev 1]

Note that the dimensions provided in Table 3-2 are nominal dimensions, used to help classify objects that do not fit the exact description of the missile. For example, a steel light pole that is 10 in diameter and 20 high could be classified as a Type 8 (12 pipe) missile.

The following (and similar) items are either lightweight, sufficiently massive, or fixed; thus, they pose no significant threat to NPP SSCs; they should not be counted as missiles:

• Soft materials, such as insulation, foam, cardboard, etc.

• Small and light objects, such as plastic fittings, light gauge metal fasteners, ventilation louvers, etc.

• Small plants and trees, bushes, etc.

• Very heavy equipment (main transformer, turbine generator, etc.)

• Cement or concrete pads or building foundations 3.4.3 TEMPORARY MISSILES Outages Prior to and during NPP outages, additional equipment is brought onsite, staged in laydown areas, and left outdoors (e.g., scaffolding, construction material, construction trailers). Although this additional equipment may lead to a higher total missile inventory than was surveyed as part of the TMRE walkdown, it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory. Outages are of relatively short duration compared to the operational time at a NPP.

Sites have procedures that require securing equipment and potential missile sources in the event of forecasted severe weather. Additionally, the increased manpower onsite during outage periods provides for more available personnel to help secure potential missile sources. Based on these factors, the impact to the tornado missile risk posed by additional outage-related missiles is minimal.

Construction The TMRE risk estimates will be used in a risk-informed license amendment request to change the permanent licensing basis for the plant, for nonconforming SSCs. Although construction at a site may temporarily add to the missile inventory used in TMRE, the new licensing basis should reflect the state of the as-built and as-operated plant configuration, and not have to change as short-term temporary configurations or activities occur at the plant site.

Construction is a temporary condition and the additional temporary missiles do not need to be included in the missile inventory for the TMRE CDF and LERF calculations (i.e., those calculations performed in Section 7.1). A similar consideration is discussed above for outages. However, the expected final site configuration (i.e., after construction is completed) should be evaluated to ensure that the missile count used in the TMRE continues to be bounding. For example, if non-Category I structures are being built, the missile count from the final structures within the required range needs to be determined and included in the site-specific missile inventory. These are called post-construction missiles.

The guidance for periods of construction is:

• The expected missile inventory for the post-construction site should be estimated, using walkdown results for the non-construction areas, information in Sections 3.4.2 and 3.4.4, along Page 28 of 226

September 21, 17 NEI 17-02, [Rev 1]

with design and construction information. The basis and assumptions used for the estimated number of post-construction missiles shall be documented. Bounding and conservative estimates are recommended, to account for uncertainty.

o If the inventory of current missiles (those counted outside the construction area) plus the estimate of post-construction missiles is less than 240,000 missiles, the generic missile inventories provided in Table 5-1 should be used for the Section 7.1 CDF and LERF calculations.

o If the total missiles) are not bounded by 240,000, a bounding site missile inventory should be determined and documented. This bounding missile inventory should be used for the Section 7.1 CDF and LERF calculations.

• A sensitivity analysis should be performed to evaluate the impact of the additional missiles associated with construction activities, that is, those missiles not already included in the post-construction missiles. This would include missiles in construction lay-down areas that are currently inside the range, but would eventually go into Category I structures or be removed completely. The total missile count for the sensitivity analysis should include the non-construction related missile inventory determined in accordance with Sections 3.4.2 and 3.4.4, and a conservative estimate of the number of all construction-related missiles (all within 2500 of a central reference point). The basis and assumptions used to determine the conservative construction missile estimate should be documented. An example of an acceptable method for estimating missile counts would be to perform walkdowns of limited sections of the construction area, determine average missile densities in those areas, and apply the missiles densities to the remainder of the construction area. Documentation should include some sample photographs of the construction area. The results of the sensitivity analysis shall be documented.

3.4.4 STRUCTURAL MISSILES Commercial and industrial structures that are built to standard building codes will generally not withstand tornado winds greater than about 100 mph. The destruction of these structures generates additional missiles that should be accounted for in the TMRE. Each type and size of structure contains a number of missiles that can be estimated using the tables presented here (Tables 3-3 through 3-9); the basis for these tables is provided in Appendix C.

Missiles from turbine buildings (e.g., siding, laydown areas) should not be inventoried using the tables in this subsection. Missiles originating from turbine buildings should be counted separately. For example, the number of siding panels can be determined based on a review of turbine building structural drawings and walkdowns.

The contents of buildings were considered depending on building function. For example, the quantities of desks and furniture were estimated for office buildings, and quantities of pallets, drums, and shelving were estimated for warehouses. Missile Type 23 (Trees) are not included in these tables for obvious reasons.

A short description and an example of each structure type are provided here.

Wood Framed Office Buildings and Warehouses (Tables 3-3 and 3-6) - Wooden buildings have roof, floor, and wall structural systems that are constructed of sawn lumber, plywood, or engineered wood; Page 29 of 226

September 21, 17 NEI 17-02, [Rev 1]

see Figure 3-1. These buildings are prone to partial or complete loss of roof and wall systems when subjected to severe winds. Potential missiles include wood planks and plywood debris.

Figure 3-1: Typical Wood-framed Construction Trailers and Manufactured Buildings (Tables 3-4 and 3-8) - These are typically modular and have lightweight construction; see Figure 3-2. These buildings are not typically constructed on permanent foundations and are prone to uplift and roll-over under severe wind loads. Potential missiles include trailer roof and wall components, as well as steel channel framing (trailer).

Page 30 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 3-2: Typical Trailer/Manufactured Building Engineered and Pre-engineered Buildings (Tables 3-5 and 3-7) - Engineered buildings typically have roof, floor, and wall systems that are constructed with steel or concrete; see building on the left of Figure 3-3.

Pre-engineered buildings (building on the right of Figure 3-3) are typically steel-framed structures with metal siding (e.g., Butler buildings). Potential missiles include steel siding and roof decking and framing members (e.g., wall and roof purlins).

Figure 3-3: Typical Engineered (left) and Pre-engineered (right) Buildings Page 31 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 3-3: Potential Tornado Missile per Office Building, Wood Framed Missile Per 1000 ft2 Per 1000 ft2 Per 1000 ft2 Type Floor Area Wall Area Roof Area 1 14 0 0 2 0 0 0 3 0 0 0 4 0 0 0 5 0 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 0 0 0 10 0 0 0 11 4 2 9 12 69 31 76 13 0 0 25 14 31 31 0 15 2 0 0 16 0 0 0 17 1 1 0 18 0 1 0 19 0 0 0 20 0 0 0 21 0 0 0 22 0 0 0 Total 121 66 110 Page 32 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 3-4: Potential Tornado Missile per Office Building, Manufactured (Pre-Fab)

Missile Per 1000 ft2 Per 1000 ft2 Per 1000 ft2 Type Floor Area Wall Area Roof Area 1 16 0 0 2 0 0 0 3 0 0 0 4 0 0 0 5 0 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 2 0 0 10 0 0 0 11 13 3 23 12 183 20 56 13 0 0 24 14 31 25 0 15 2 0 0 16 0 0 0 17 1 1 0 18 0 1 0 19 0 0 0 20 0 0 0 21 0 0 0 22 0 0 0 Total 248 50 103 Page 33 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 3-5: Potential Tornado Missile per Office Building, Engineered and Pre-Engineered Missile Per 1000 ft2 Per 1000 ft2 Per 1000 ft2 Type Floor Area Wall Area Roof Area 1 33 0 0 2 0 0 0 3 0 0 0 4 0 0 0 5 0 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 2 0 0 10 0 0 0 11 0 0 0 12 80 0 0 13 0 25 24 14 15 0 0 15 0 8 4 16 0 16 7 17 1 1 0 18 0 1 0 19 0 0 0 20 0 0 0 21 0 0 0 22 0 0 0 Total 131 51 35 Page 34 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 3-6: Potential Tornado Missile per Warehouse, Wood Framed Missile Per 1000 ft2 Per 1000 ft2 Per 1000 ft2 Type Floor Area Wall Area Roof Area 1 27 0 0 2 1 0 0 3 1 0 0 4 0 0 0 5 5 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 6 0 0 10 0 0 0 11 6 2 4 12 30 20 78 13 0 31 24 14 20 0 0 15 0 0 0 16 0 0 0 17 2 1 0 18 2 1 0 19 1 0 0 20 2 0 0 21 0 0 0 22 0 0 0 Total 103 55 106 Page 35 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 3-7: Potential Tornado Missile per Warehouse, Engineered and Pre-Engineered Missile Per 1000 ft2 Per 1000 ft2 Per 1000 ft2 Type Floor Area Wall Area Roof Area 1 18 0 0 2 1 0 0 3 1 0 0 4 0 0 0 5 5 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 6 0 0 10 0 0 0 11 0 0 0 12 16 0 0 13 0 25 25 14 12 0 0 15 0 5 4 16 5 16 8 17 2 1 0 18 2 1 0 19 1 0 0 20 2 0 0 21 0 0 0 22 0 0 0 Total 71 48 37 Page 36 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 3-8: Potential Tornado Missile per Office Trailer/Construction Trailer Missile Per 1000 ft2 Per 1000 ft2 Per 1000 ft2 Type Floor Area Wall Area Roof Area 1 0 0 0 2 1 0 0 3 2 0 0 4 0 0 0 5 4 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 4 0 0 10 0 0 0 11 12 6 14 12 151 12 96 13 0 25 24 14 31 0 0 15 0 0 0 16 0 0 0 17 1 1 0 18 0 1 0 19 0 0 0 20 0 0 0 21 0 0 0 22 0 0 0 Total 206 45 134 References 3.0 EPRI 3002008092, Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants Page 37 of 226

September 21, 17 NEI 17-02, [Rev 1]

4 DETERMINE SITE TORNADO HAZARD FREQUENCY 4.1 DATA SOURCES DATA SOURCE: NUREG/CR-4461, Rev 2, Tornado Climatology of the Contiguous United States Tornado Climatology of the Contiguous United States NUREG/CR-4461, Rev. 2, was written to support the latest revision of Regulatory Guide 1.76, Design-basis Tornado and Tornado Missiles for Nuclear Power Plants." This NUREG uses data on tornadoes which were reported in the contiguous United States from January 1950 through August 2003, which encompasses over fifty years of data. The wind speed estimates in this report are based on the Fujita Scale and the Enhanced Fujita Scale, both of which correlate wind speeds with damage caused by tornadoes.

4.2 BACKGROUND

The initiating event for the TMRE PRA model is the frequency of a tornado strike at the site. Each licensee should develop a site-specific tornado frequency. The tornadoes of interest are those tornadoes with a wind speed of approximately 100 mph or greater. For the purposes of the TMRE, the F-scale (Fujita prime) will be used to classify tornadoes; this scale is somewhat different from the original Fujita Scale (F-Scale) and the Enhanced Fujita Scale (EF-Scale); refer to table 6-1 below. The F-scale was chosen because the TMRE MIP values are based on simulations that used the F-scale bins to categorize the tornados.

Table 4-1: Fujita Tornado F Scale Intensity Wind Speed Relationships (mph)

Intensity Description Original Fujita Fujita Enhanced Fujita F F0 Light damage 40 to 72 45 to 78 65 to 85 4073 F1 Moderate damage 73 to 112 79 to 117 86 to 110 73-103 F2 Considerable damage 113 to 157 118 to 161 111 to 135 103-135 F3 Severe damage 158 to 206 162 to 209 136 to 165 135-168 F4 Devastating damage 207 to 260 210 to 261 166 to 200 168-209 F5 Incredible damage 261 to 318 262 to 317 >200 209-277 F6 Inconceivable 319-380 277-300 NUREG/CR-4461, Revision 2, Table 6-1 provides each U.S. NPP site with tornado wind speeds associated with 10-5, 10-6, and 10-7 probabilities per year of a tornado missile strike. Excerpts of that table are shown below in Table 4-2 Additionally, the total tornado strike frequency (i.e., the frequency of any tornado with wind speed greater than 65 mph) is provided for all locations in the continental United States. Using this data, a site-specific tornado frequency curve (hazard curve) can be developed, and the frequency of all tornadoes considered in the TMRE (F2 through F6) can be calculated.

Page 38 of 226

September 21, 17 NEI 17-02, [Rev 1]

Since F probabilities are not directly available from this NUREG, they must be derived from the site-specific Fujita scale data. Using the Fujita scale data as opposed to the Enhanced Fujita Scale data results in higher, and therefore more conservative, strike frequencies.

4.3 HAZARD FREQUENCY CALCULATIONS The F-scale probabilities used in the TMRE method are based on the site-specific Fujita Scale data from NUREG/CR-4461, examples of which are shown in Table 4-2. These data are used to develop an equation for the site-specific hazard curve that is then used to calculate the yearly exceedance probabilities for each F range, F2 through F6. The following example illustrates the process using Point Beach data.

Table 4-2: Excerpt of Site-Specific Fujita Scale Data (From NUREG/CR-4461 Table 6-1)

Fujita Scale (mph) Enhanced Fujita Scale (mph)

Power Index 1E-05 1E-06 1E-07 1E-05 1E-06 1E-07 Plant Peach 46 139 199 250 123 162 198 Bottom 47 Perry 186 240 288 153 188 221 48 Pilgrim 143 203 254 126 165 200 Point 49 177 232 280 146 183 216 Beach Prairie 50 192 245 293 156 183 224 Island 4.4 PLOT DATA POINTS For this example, Microsoft Excel is used to plot the data points, but other curve-fitting software packages would be acceptable. The three site-specific Fujita Scale data points are plotted using the Excel chart function XY scatter.

Page 39 of 226

September 21, 17 NEI 17-02, [Rev 1]

4.5 TRENDLINE EQUATION The line plotted by these three points is selected (right-click) to open the drop down window. Then, the add trendline function is selected from the list. From the format trendline window, select trendline options. For this example, the logarithmic trendline option was used along with the display equation on chart and display r-squared value on chart options. The r-squared value should be >0.9.

The equation generated for the Point Beach site is:

Miles per Hour (mph) = -22.37

• ln(Frequency) - 79.333 R-squared = 0.9985 Page 40 of 226

September 21, 17 NEI 17-02, [Rev 1]

4.6 CALCULATE EXCEEDANCE PROBABILITIES Using the trendline equation, generate exceedance probabilities for the upper ranges for each F category, F2 through F6. Verify the equation duplicates the values from the NUREG.

Page 41 of 226

September 21, 17 NEI 17-02, [Rev 1]

5 EVALUATE TARGET AND MISSILE CHARACTERISTICS New failure modes for SSCs that can be struck and damaged by a tornado missile will be added to the TMRE PRA model. This applies to SSCs that are required by the plants licensing basis (nonconformances), as well as those SSCs that are not required to be protected, but are in the TMRE PRA model (vulnerabilities). Tornado missile failures do not need to be considered for SSCs protected by 18 reinforced concrete walls, 12 reinforced concrete roofs, and/or 1 steel plate.

The failure probability of exposed SSCs is calculated using the Exposed Equipment Failure Probability (EEFP). The EEFP is the conditional probability that an exposed SSC is hit and failed by a tornado missile, given a tornado of a certain magnitude. For every applicable SSC, five EEFP values will be calculated, one each for tornado categories F2 through F6.

The EEFP is defined as:

EEFP = (MIP) x (# of Missiles) x (Target Exposed Area) x Fragility The Missile Impact Parameters (MIP) is the probability of a tornado missile hit on a target, per target square area, per missile, per tornado (see Section 5.1). Generic MIP values are provided as part of the TMRE methodology and are described in more detail in Section 5.1 and Appendix B; MIP values are in Table 5-1. The MIP varies by the tornado category (i.e., F2 through F6) and the elevation of the target.

1. of Missiles is the number of damaging missiles within about 2500 feet of the target SSCs. Generic values for the number of missiles (which vary by tornado intensity) are provided as part of the TMRE methodology and will be verified through the TMRE walkdown activity (Section 3). Some targets that are more robust (e.g., steel pipes and tanks) will use different missile inventories than less robust SSCs (e.g., electrical panels, instrumentation), since only certain types of missiles can damage robust targets. The missile inventories to use for each target SSC (depending on robustness) are described in Section 5.2 and Appendices B and C; and listed in Table 5-2. Generic total missile inventories are listed in Table 5-1 for each tornado category, F2 through F6.

Target Exposed Area (ft2) is determined for each specific SSC, based on plant documentation and the TMRE walkdown. More information on calculating target areas is provided in Section 5.3.

Fragility is the conditional probability of the SSC failing to perform its function given that it is hit by a tornado missile. For the purposes of the TMRE, it is assumed to be 1.0 (i.e., the SSC is always failed if hit by a tornado missile).

NOTE: The variables and factors included in the EEFP were developed to provide a conservative estimate of SSC failure probability. The values provided in this guidance for the MIP, # of Missiles and Fragility variables were developed to be used together, and should not be modified. The conservatism in the EEFP is dependent on using the recommended values for all these variables. Each variable may not be conservative by itself, but the combination of variables used for different targets and tornado wind speeds is expected to provide a bounding estimate of the change in CDF associated with nonconforming SSCs. Appendices B and C provide the basis for the variables and Appendix A provides the results of benchmarking the TMRE against two RG 1.200 High Winds PRAs. Deviation from the recommended values could Page 42 of 226

September 21, 17 NEI 17-02, [Rev 1]

invalidate the benchmarking and result in non-conservative EEFPs and, hence, non-conservative CDF and LERF results. Therefore, all EEFP values described in this section must be used without modification, except for:

1. The total number of missiles, which may be increased if necessary based on the site-specific missile inventory.

2. The <30 ft MIP value can be used in cases where it is difficult to determine if the target is >30 ft above all missile sources.

3. When taking credit for robust targets, a higher percentage can be used.

5.1 MISSILE IMPACT PARAMETER (MIP)

The Missile Impact Parameter (MIP) is defined as: The probability of a tornado-driven missile impact on an SSC per unit area of the SSC, per missile, per tornado. It can be thought of as the missile flux through a unit area, as shown in Figure 5-1.

MIP = Probability of Missile Hit / ft2 / missile / tornado Figure 5-1: Missile Impact Parameter Generic MIP values are provided in Table 5-1 for use in the TMRE; the MIP values were developed to be applicable to all U.S. NPPs. MIP values were derived using published TORMIS data from EPRI NP-768

[Ref. 5.1]. The bases for the MIP values developed for the TMRE are provided in Appendix B.

MIP values vary with tornado intensity (i.e., F-Scale) and the elevation of target. Separate MIP values are provided for each F-Scale tornado from F2 to F6. As expected, MIP values generally increase with increasing tornado intensity, since the higher category tornadoes are expected to lift more missiles and make them airborne.

Separate MIP values are also provided for Near Ground and Elevated targets. Near Ground targets are less than or equal to 30 above the missile source (generally plant grade), while elevated targets are those greater than 30 above the primary nearby missile source. The MIP values for Near Ground targets are greater than for Elevated Targets. This is expected, since heavier missiles are less likely to Page 43 of 226

September 21, 17 NEI 17-02, [Rev 1]

be raised to higher elevations in the tornado wind field, and thus the number of missiles per unit area is lower for higher elevations.

Table 5-1: MIP Values and Missile Inventories for Use in the TMRE Targets >30 above Targets <30 above Total Missile Tornado Category grade(1,2) grade(1,2) Inventory(3)

F'2 5.8E-11 1.1E-10 155,000 F'3 2.0E-10 3.6E-10 155,000 F'4 3.4E-10 6.3E-10 205,000 F'5 8.7E-10 1.6E-09 240,000 F'6 1.3E-09 2.4E-09 240,000 (1) 2 MIP values are in units of missile hit probability / ft / missile / tornado (2)

The term grade here is meant to refer to the elevation at which a majority of the missiles that can affect the target is located. Typically, this is plant grade, although for some targets it may be different.

(3)

Total Missile Inventory values in this table shall be used, unless the site-specific missile inventory is not bounded by 240,000 missiles. See Section 5.2 for more discussion of missile inventories.

5.2 MISSILE INVENTORIES Generic missile inventories are provided as part of this guidance for use in calculating EEFPs at all US NPP sites. Values are provided in Table 5-1, which are expected to be bounding for most sites. The total number of missiles will require verification through the TMRE walkdown (Section 3.4), to ensure that the missile inventories provided herein are appropriate to use for a specific plant.

The generic total number of missiles is 240,000. Since the origins of many of the missiles are from building deconstruction, which varies with tornado intensity, the total missile count varies with tornado intensity. Table 5-1 provides the total missile inventory by F-scale. If the site walkdown confirms that 240,000 is bounding for the site 5 (see Section 3), then the variable #Missiles in the EEFP calculations is equal to the values provided in Table 5-1, for targets not defined as robust. Robust target types are listed in Table 5-2 and the percentage of the total number of missiles for each robust target type is provided. These percentages are applied to the total number of missiles at each F-scale, to reduce the missiles that are used in robust target EEFP calculations. The bases for the total number of missiles and the robust missile inventories are provided in Appendices B and C.

If the total missiles at a site are not bounded by 240,000, the number of missiles to use in the EEFP calculations (for targets that are not robust), should be the total number of missiles counted on site, rounded up at least to the nearest 5,000 missiles. For tornadoes below F6, the calculations of structure-5 The site may be either a single unit or multi-unit site; there is no distinction in the total number of missiles based on the number of units at a site.

Page 44 of 226

September 21, 17 NEI 17-02, [Rev 1]

origin missiles can be determined using the fractions provided for the different building types (see Appendix C). The same robust target percentages provided in Table 5-2 are applied to the site-specific missile count.

5.2.1 MISSILE INVENTORY EXAMPLE As an example, assume that a licensee performs a site missile inventory walkdown and determines that there are 291,000 missiles within 2500 of a central reference point, based on the guidelines provided in Section 3.4. The missiles consist of 91,000 zonal missiles (not associated with structures) and 200,000 structural missiles, based on calculations using Tables 3-3 through 3-8. The licensee chooses to assume 300,000 total missiles onsite. This is the missile inventory applied to the F6 tornado EEFP calculations.

Lower intensity tornadoes will have smaller inventories, based on the number and type of structures that contribute to the structural missiles. For the purpose of this example, the total missile inventory is:

• 100,000 zonal missiles (rounded up from 91,000)

• 200,000 structural missiles, consisting of:

o 50,000 missiles from wood-framed buildings o 50,000 missiles from pre-manufactured buildings o 100,000 missiles from engineered and pre-engineered buildings Figures 16, 17 and 18 in Appendix C provide missile release fractions for each intensity tornado. The fractions are presented in Table 5-1a as percentages.

Table 5-1a: Missile Release Fractions for Different Building Types Building Type Engineered Tornado Wood- Pre- and Pre-Intensity framed manufactured engineered F'2 10% 35% 1%

F'3 73% 95% 44%

F'4 96% 100% 77%

F'5 100% 100% 92%

F'6 100% 100% 100%

Based on these fractions and the number of missiles from each structure type, the missile inventories for each tornado intensity are calculated in Table 5-1b. These missile inventories would be used in the EEFP calculations for the example site.

Page 45 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 5-1b: Example Missile Inventory Calculation Number of Missiles Building Type Engineered Tornado Wood- Pre- and Pre-Intensity Zonal framed manufactured engineered Total F'2 100,000 5,000 17,500 1,000 123,500 F'3 100,000 36,500 47,500 44,000 228,000 F'4 100,000 48,000 50,000 77,000 275,000 F'5 100,000 50,000 50,000 92,000 292,000 F'6 100,000 50,000 50,000 100,000 300,000 Note that robustness depends on the dimensions (primarily thickness, but also diameter for pipes) of the target and target failure mode. For each robust target, documentation should be provided justifying the robust category used for the target. If the target does not meet the specifications for any of the robust categories, the total number of missiles should be used to calculate the EEFP for that target.

Table 5-2: Missile Inventories for EEFP Calculations Percentage Category Target Description Failure Mode of Total Missiles Steel Pipe - at least 16 diameter and Crushing/Crimping of >

A 5%

3/8 thickness 50%

Steel Pipe - at least 16 diameter and Crushing/Crimping of >

B thickness less than 3/8 but at least 55%

50%

0.125 Penetration or Global C Steel Tank - at least 0.25 thickness 40%

Failure Penetration or Global D Steel Tank - less than 0.25 thickness 50%

Failure Steel Pipe - at least 10 diameter and Penetration or Global E 35%

3/8 thickness Failure Crushing/Crimping, Steel Pipe - Less than 10 diameter or F Penetration, or Global 50%

3/8 thickness Failure Penetration or Global G Steel Door 45%

Failure Concrete Roof - Reinforced, at least Penetration or Global H 1%

8 thick Failure Concrete Roof - Reinforced, at least Penetration or Global I 20%

4 thick Failure None of the above (i.e., not a robust J Any/All 100%

target)

Page 46 of 226

September 21, 17 NEI 17-02, [Rev 1]

Failure modes listed in Table 5-2 are described:

• Crushing/Crimping of >50%: The pipe is crushed such that the flow area through the pipe is reduced no more than 50% of the original flow area. This failure mode would be used primarily for exhaust pipes (e.g., for diesel generators, steam relief valves).

• Penetration: Refers to localized perforation (or punching shear) and is dependent on pipe (or wall) thickness, rather than structural response of a pipe, tank, or concrete panel. Appendix C describes the empirical equations that are used for predicting this failure mode.

• Global Failure: Refers to the overall flexural response (or bending) of pipes, tanks, and concrete panels. These global modes are influenced by structural section properties (wall thickness, diameter, etc.) as well as member span and boundary conditions. Appendix C describes the analytical models developed to predict deformations of pipes, tanks, and concrete panels Ensure that credit is not taken for beneficial failure modes of SSCs struck by tornado missiles. For example, do not consider that an exhaust pipe will shear before being crimped, unless it is true for all missile types at all speeds. Exceptions are SSCs designed to fail to prevent an adverse failure mode (e.g.,

turbine building siding coming off to prevent structural failure, plastic piping designed to break/shear as opposed to being crushed).

Some examples for determining missile inventories for use in EEFP calculations, based on the type of component and results of the site-specific missile inventory, are provided in Table 5-3.

Table 5-3: Example Missile Inventories for Different Targets (For F6 Tornado EEFP Calculations)

No. Target Description Robust Failure Mode Robust #Missiles for Target? Category EEFP(1) 1 Electrical panel No NA (Hit) NA 240,000 2 Level Detector/Indicator No NA (Hit) NA 240,000 3 Ventilation Fan No NA (Hit) NA 240,000 4 Emergency Diesel Generator Yes Crimping/ A 12,000 Exhaust Pipe: Crushing (5% of 16 diameter, 3/8 thick steel >50% 240,000) 5 Condensate Storage Tank: Yes Penetration C 96,000 3/8 thick steel (40% of 240,000) 6 Service Water Piping: Yes Penetration F 120,000 6 diameter, 3/16 thick steel (50% of 240,000) 7 Reinforced Concrete Roof: Yes Penetration I 48,000 6 thick (20% of 240,000)

(1)

If 240,000 Total Missiles is not bounding, use site specific missile inventory for total missiles (robust percentages can still be applied).

Page 47 of 226

September 21, 17 NEI 17-02, [Rev 1]

5.3 TARGET EXPOSED AREA The Target Exposed Area is the area (ft2) of an SSC that is exposed to being struck by a tornado missile (i.e., that has no or inadequate missile protection 6) which can result in the failure of the SSC. Thus, it must be (1) exposed to tornado missiles and (2) if struck, will prevent the SSC from performing its function as modeled in the PRA. This section provides details on various types of SSCs and how their Target Exposed Area should be calculated for the EEFP.

5.3.1 TYPES OF TARGETS AND CALCULATIONS The types of SSCs that should be considered vulnerable to tornado missile failures are those not located inside Category I structures. If an SSC is shielded by walls with 18 of reinforced concrete, roofs with 12 of reinforced concrete, and/or 1 of steel plate, no EEFP calculations are required (see Appendix B).

Note that some SSCs inside Category I structures may still be vulnerable to tornado missiles from missiles entering through openings or penetrations in the walls or roofs of such structures. Additionally, roofs that are less than 12 thick reinforced concrete will also allow some missile penetration. These situations are discussed further in this subsection.

Some examples of the types of SSC exposed to tornado missiles are discussed here. For exposed SSCs outside Category I structures, the target area can generally be estimated using the smallest polyhedron(s) that encompasses the target. For SSCs inside Category I structures that can be hit by tornado missiles entering through a non-qualified penetration (e.g., access door, ventilation louver), the target area is the either the area of the opening or the area of the target (based on an encompassing polyhedron), whichever is smaller.

Tanks The simplest, yet most conservative, approach for modeling a tank is to define a polyhedron that bounds the dimensions of the tank and its subcomponents (i.e., exposed tank discharge piping and valves, level detectors and indicators, or other critical SSCs associated with the tank).

A more refined method would model a tank as a cylinder, such that the surface area calculation for the tank is straightforward (i.e., Area = dh, where d is the diameter and h is the height of the tank). The top of the tank can generally be neglected, since it would (1) require a vertical missile to penetrate the top of the tanks and (2) require the missile, having penetrated the top of the tank, to affect suction from the tank. Additional area should be added for critical SSCs or subcomponents associated with the tank. Note that some SSCs associated with a tank, such as a level detector cannot be considered as a robust target, so the total missile inventory would be used in the EEFP for that portion of the tanks total failure probability. Example 1 in Section 5.5 includes associated SSCs in the tank area calculation.

Since tanks may be more than 30 feet in height, the total tank failure probability can be calculated by summing the tank failure probability (EEFP) from near ground missile strikes (i.e., <30) with the EEFP from elevated missile strikes. Since the MIP values for elevated targets (>30) are less than the near ground MIP values, this will reduce the overall failure probability of the tank. Alternatively, different basic events for the near ground and elevated strikes may be developed.

6 See Section 5.3.2 for a discussion of target shielding.

Page 48 of 226

September 21, 17 NEI 17-02, [Rev 1]

Similar to excluding the top of the tank, portions of the tank above the normal water level or above the success criteria minimum water level (for the applicable event sequence(s)) can be excluded from tank failure probability calculations. If a missile were to penetrate the tank above the minimum required water level, the tank would still contain the volume of liquid needed for success.

For tank failure due to vertical missiles penetrating the top of tank or the side of a tank above the water level is that the missile, the analyst should consider whether such a missile can cause some failure of the tank suction after penetrating the tank. Missile velocity, even for very energetic missiles, decreases significantly after travelling through only a few feet of water, so the main concern would be plugging of the suction. Although this is considered unlikely, the analyst should qualitatively evaluate the potential.

An example of the lower part of a condensate storage tank is shown in Figure 5-2. The following are items of interest:

• The piping connected to the outside of the tank is the suction source for the pumps fed from the CST. If this exposed pipe or the isolation valve is damaged by a tornado missile, the tank would not perform its function to provide a water supply. Therefore, the EEFP associated with the piping and valve would need to be included in the total failure probability for the tank. Even if a polyhedron were drawn around the piping and the valve, it would not add much to the total area of the tank.

• The equipment highlighted by the red outline is a sample connection with heat tracing to keep it from freezing. If the sample connection were struck and sheared off, it would produce a leak in the tank. However the connection does not protrude much from the tank, and if that area of the tank were hit by a damaging missile, it would be considered to fail. So, this additional part of the tank could be neglected in the area calculation. Documentation would be expected to describe the basis for excluding the target.

• A pair of drain valves in series is protruding from the bottom of the tank and highlighted by a green outline. If the piping and valves were sheared off, this would result in draining the tank.

• A junction box and conduit for tank grounding are highlighted by a yellow outline. Failure of this equipment would not affect the PRA functionality of the tank.

Page 49 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-2: Example Tank Pipes Pipes are similar to tanks, in that they can be considered cylindrical targets, such that Area = dl, where d is the diameter and l is the length of pipe being considered. The analyst should determine whether exposed pipe ends (e.g., open exhaust pipe ends) should be considered in the area of the pipe. If exposed sections of pipes include additional SSCs that are required to function or not be failed, their failure probability should be added to the pipe failure probability. In some cases, these additional SSCs would not be considered robust (e.g., valve operators, flow detectors) and the total inventory of missiles would be used for that portion of the pipes total failure probability. Manual and check valves can generally be considered robust, in the same category of the pipe. The analyst should document any assumptions regarding valves and other components associated with piping targets.

An example of exposed service water piping (the light blue colored pipe) is shown in Figure 5-3. Most of the surface area of this pipe could be hit by a tornado missile. However, an argument could be made that some portions of the piping (e.g., on the very far right of the picture) are very close to either the ground or a wall, and thus may not truly be exposed to a credible tornado missile flux. In such cases, a small portion of the pipe surface area may be excluded from EEFP calculations, although it is unlikely to result in a meaningful reduction. Any such reduction to the effective surface area must be documented with the engineering judgment used.

Page 50 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-3: Example Piping Pumps/Compressors/Fans If a pump (or compressor or fan) and/or its subcomponents are exposed, the simplest solution is to consider a polyhedron(s) that encompasses the pump, motor, electrical subcomponents (e.g., cables, junction boxes, controllers), and any other exposed subcomponents whose failure would result in the failure of the pump. Although many pumps are typically sturdy and can withstand some mechanical shocks, the pump/compressor/fan and its subcomponents are considered not robust from the missile inventory perspective (i.e., the total missile inventory should be used in the EEFP). The surface area encompassing the pump/compressor/fan and its subcomponents should be relatively small, resulting in a relatively low EEFP. However, the licensee may perform more detailed calculations using the surface area of individual components.

An example of an exposed air compressor, its subcomponents, and support components is shown in Figure 5-4. This air compressor is inside a Category I building but is directly exposed to tornado missiles through a large 12 x 24 (288 ft2) roll-up door in the building. If the compressor, any of its subcomponents, or the electrical and cooling water supports are struck by a damaging tornado missile, the compressor would not function. Therefore, a polyhedron encompassing all those SSCs would be used to determine the Target Exposed Area for the compressor EEFP. The bottom of the polyhedron would be excluded from the Target Exposed Area calculation since it is the floor of the building and a missile cannot hit the SSCs from the direction of the floor. Consideration could also be given to not including the far side of the compressor, from which missiles would not travel (the compressor is being viewed from the opening).

Page 51 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-4: Example Air Compressor with Subcomponents Valves Although valve bodies and their connections to piping are generally robust, their operators, actuators, and support systems (e.g., instrument air, electrical power) are not. When calculating the target area for a valve, all the exposed subcomponents and applicable support components (e.g., solenoid valves, controllers, cables, instrument air tubing) need to be included in the total valve area. When determining the number of missiles, the full missile count can be used for the combined components and subcomponents, or the calculation can be refined to apply the correct missile counts to individual components. It is important to understand the impact of the failure of support systems on the desired function of the valve. If failure of the support system does not cause a functional failure of the valve, components associated with the support system do not need to be included in the total area used for the valve in the EEFP.

Targets Located Inside of a Category I Structure Some targets located inside of a Category I structure may be vulnerable to missile hits due to openings in the structure that are not missile barriers or due to roofs that are less than 12 of reinforced concrete (see Appendix C for the basis of required roof thickness). In cases such as these, the target would be considered the surface area of the opening (e.g., door, ventilation louver, piping penetration) through which a missile can travel and strike the SSC in question. SSCs exposed to missiles only through De Minimis penetrations do not need to be considered as targets. For roofs with SSCs below them, the target dimensions should be projected vertically to an area of the roof that is directly above the SSC or its subcomponents.

If the exposed area of a target inside the Category I structure is smaller than the opening through which a missile must pass to strike the target, then the exposed area of the target, when approached from the Page 52 of 226

September 21, 17 NEI 17-02, [Rev 1]

direction of the opening, should be used. Therefore, the area for vulnerable targets inside Category I structures should be the smaller of the area of the opening or the area of the target itself.

Figures 5-5 through 5-7 provide an example of targets (service water pumps and piping) inside a Category I pump house with unqualified openings (ventilation louvers, a personnel door, and a rollup door). Figure 5-5 shows the outside of the pump house; the light blue rollup door is made of thin sheet metal. Another view is shown in Figure 5-6; this view highlights the large ventilation louvers/openings.

The rollup door and louvers will not stop most types of damaging tornado missiles.

Figure 5-5: Example of Service Water SSCs Missile Exposure from Openings in Service Water Pump House Page 53 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-6: Example of Service Water SSCs Missile Exposure from Openings in Service Water Pump House Figure 5-7 shows examples of missile paths through the various openings in the pump house. As seen in this figure, intervening structures (walls and partitions) inside the pump house prevent missiles from the openings on the south side of the building from striking the service water header or pipes (missile paths shown in orange and blue lines). The only exposure of the service water SSCs to missiles is from the rollup doors (indicated in red lines), impacting the service water header. The exposed area of the service water header and supporting subcomponents (e.g., electric cables for isolation valves) is larger than the area of the roll-up door opening. The exposed area could be reduced, taking into account the circulating water pumps between the rollup door and the service water SSCs. However, unless it can be shown by additional analysis, those pumps may not provide a substantial barrier to prevent a missile from striking the service water header. Therefore, in this example, the area considered for the exposed service water system header would be the area of the rollup door.

Page 54 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-7: Example of Service Water SSCs Missile Exposure from Openings in Service Water Pump House The service water pumps and piping inside a pump house (on the top left of Figure 5-7) are also vulnerable to vertical missiles striking the roof above them. The roof thickness for this pump house is less than 12 of reinforced concrete, which would allow missile penetration and potential damage to the service water SSCs. Therefore, they should be considered targets for vertical missiles. Example 3 in Section 5.5 describes modelling of these targets.

5.3.2 TARGET SHIELDING When considering shielding in the context of the TMRE and EEFP, the analyst must consider all reasonable paths by which a tornado missile can strike an SSC. Unlike some design basis considerations, missiles are not limited to horizontal flight paths. Missiles can strike a target from essentially any angle, so that shielding, such as parapet walls or other horizontal missile protection, would not be considered complete shielding. Some targets may be shielded from all but vertical missiles.

Obviously, a missile cannot strike the portion of an SSC that is against the ground or a missile barrier, so those surfaces of an SSC would not be considered in the Target Exposed Area calculation. However, Page 55 of 226

September 21, 17 NEI 17-02, [Rev 1]

partial shielding is possible for SSCs that may be close to the ground or a missile barrier. For example, the portions of the service water piping shown on the far right side of Figure 5-3 could be considered partially shielded from missile originating from below or behind the piping (the pipe is very low to the ground and close to a solid wall behind it). This could be used to reduce the area of the pipe in the EEFP calculation.

Targets may be shielded from tornado missiles from specific directions, based on the location of the target with respect to other SSCs and barriers. The effect of shielding can be accounted for by use of the robust missile factors in Table 5-2 or by reducing the effective target surface area.

SSCs or other intermediate barriers blocking missile paths to a target can be considered as shielding or barriers, by considering the equivalent steel or concrete thickness. For the shielded portion of the target only, this would allow for a reduction in effective missiles. For example,

• Heat exchangers could provide the equivalent thickness of a steel door (category G in Table 5-2, which is equivalent to 0.1 of steel).

• Reinforced concrete walls or columns that are 12 thick could provide the equivalent thickness of 4 thickness roof (Category I of Table 5-2) for F2 intensity only (wind speed below that used for vertical missile impact to roofs in Appendix C

• The sum of multiple intervening roof, floor, or wall thickness can be considered when screening a target or using of robust percentages (such as a 12 and 6 wall protecting a target is equivalent to an 18 wall)

SSCs may be shielded from missile strikes from certain directions, reducing the effective target area by excluding target surfaces or portions of surfaces. For example,

• A target located near large Class I structures that would preclude missiles from striking the targets from certain directions (e.g., piping or conduit mounted on a wall, exhaust stack located next to parapet wall, tank adjacent to a Class I building). In this case, the portion of the target shielded by the Class I structure would not be included in the target area calculation.

• Piping and supports could reduce the effective area of an opening or penetration, if the piping and support thickness is at least 1 of steel.

The basis for crediting shielding in reducing target surface area or providing equivalence to other robust targets/barriers should be justified and documented on a target-specific basis.

5.3.3 TARGET ELEVATION Different MIP values are provided for Near Ground and Elevated targets in Table 5-1; the differences in MIP values due to target elevation are described in Section 5.1. For targets located completely above or below 30, the use of the correct MIP value will account for the likelihood that elevated targets are less likely to be hit by tornado missiles.

However, some tall targets, such as tanks, can span both elevation regions. For example, the tank in Figure 5-2 is approximately 36 tall. Therefore, approximately 17% of the tank is above 30 and the EEFP calculation can account for this by using the Near Ground MIP for the first 30 of the tank and the Elevated MIP for the last 6. This will reduce the EEFP as compared to assuming that the entire tank area Page 56 of 226

September 21, 17 NEI 17-02, [Rev 1]

is associated with the Near Ground MIP, which is approximately a factor of 2 lower in the F2 to F4 range.

5.4 TARGET FRAGILITIES For the purposes of the EEFP, the fragility of an SSC is the conditional probability of the SSC failing, given that it is hit by a tornado missile. For the TMRE, all target fragilities are assumed to be 1.0. This is one of the factors that results in conservative EEFP calculations, as compared to the missile-induced failure probability of an SSC calculated in a HW PRA. This is especially true for more rugged SSCs at lower tornado intensities, where the expected failure probability is lower than at higher tornado intensities.

However, some accounting for robust target fragilities is implied in the use of lower missile populations for robust targets.

5.5 EXPOSED EQUIPMENT FAILURE PROBABILITY (EEFP) EXAMPLES Recall that the EEFP is defined as:

EEFP = (MIP) x (# of Missiles) x (Target Exposed Area) x Fragility The Missile Impact Parameters (MIP) are provided in Table 5-1. There are separate MIP values for each tornado category F2 through F6, and the MIP value also depends on the target elevation.

Bounding values for # of Missiles are provided in Table 5-1, with different values for each tornado category F2 through F6. The missile inventories in Table 5-1 are total missiles, used for non-robust targets. For robust targets, a fraction or percentage of the total missiles that can damage each category of robust targets is provided in Table 5-2. The different categories are based on the target characteristics (e.g., thickness of steel). If the bounding values in Table 5-1 are not applicable to the plant, Section 5.2 provides instruction on how to use a site-specific inventory.

Target Exposed Area is determined for each target based on the guidance provided in Section 5.3.

Fragility is equal to 1.0.

Each SSC will have a separate EEFP for each tornado category F2 through F6. How this is accomplished depends on the method by which tornado missile failures are incorporated into the PRA model, as discussed in Section 6.5. The only difference between the EEFP values for the different tornado categories will be the MIP values and the number of missiles, the exposed area and fragility will be constant between tornado categories.

As described in Section 5.3, an SSC failure probability for a given tornado category may be the sum of multiple EEFPs, based on the complexity of the target area calculation. For example, a tank may include sections above and below 30 elevation. Another example would be an exposed pump that has an exposed motor controller, which is not adjacent to the pump.

The examples provided in this section include configurations that require multiple EEFP calculations for an SSC, per tornado category.

Example 1: Condensate Storage Tank from Figure 5-2. Calculate EEFP for F2 tornadoes Page 57 of 226

September 21, 17 NEI 17-02, [Rev 1]

This is a steel tank with the following dimensions: Diameter (d) = 40; Wall Thickness = 3/8 at the bottom, tapering to 1/4 at the top; Height above grade (h) = 36; Height of Water at Minimum Required Water Level (above grade) = 24.

The components and subcomponents associated with the CST are:

Steel Pipe: 6 diameter, 3/8 thick, 8 long with a manual valve. This will be modeled as a rectangular polyhedron (blue box) in Figure 7-8.

Sample connection with heat tracing (highlighted by red outline in Figure 5-2). This is a very small target protruding less than 6 from the tank and the sample line is only 1/2; if the tank were struck by a damaging missile in this area, the tank would be considered failed. Since it will add an inconsequential area to the tank if modeled and will not necessarily cause tank failure, it is excluded for simplicity.

Drain Valves (highlighted by green outline in Figure 5-2). These are also small targets, but they are larger than the sample connection protruding out from the tank by about 2; they will result in significant water loss if they are sheared off by a tornado missile. The drain valves will be modeled as a rectangular polyhedron (green polyhedron) in Figure 5-8.

Page 58 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-8: Simplified View of CST EEFP1: Lower portion of the tank, from grade to 30 above grade.

Use Near to Ground MIP (< 30) and missile inventories based on Table 5-1 and Category C from Table 5-2.

Area1 = dh = *40*30 = 3770 ft2 EEFP1(F2) = 1.1E-10*(40%*155,000)*3770 = 2.6E-2/tornado EEFP2: Upper portion of the tank (30 - 36).

Use Elevated MIP (>30) and 25,000 missile inventories based on Table 5-1 and Category C from Table 5-2.

Area2 = dh = *(40)*(36-30) = 754 ft2 EEFP2(F2) = 5.8E-11*(40%*155,000)*754 = 2.7E-3/tornado EEFP3: Piping extending out from tank (blue box).

Use Near to Ground MIP (< 30) and missile inventories based on Table 5-1 and Category F from Table 5-2. Manual valve is robust, assume the same level of robustness as the pipe. Bound pipe with a polyhedron with length(l) = 8, width(w) = 4 and height(h) = 4.

Area3 = 2lh+wh+lw = 2*8*4 + 4*4 + 8*4 = 112 ft2 EEFP3(F2) = 1.1E-10*(50%*155,000)*112 = 9.5E-4/tornado Page 59 of 226

September 21, 17 NEI 17-02, [Rev 1]

EEFP4: Drain Valves (green box).

Use Near to Ground MIP (< 30) and missile inventories based on Table 5-1 and Category F from Table 5-2. Manual valves are robust, equivalent to the pipe size (4 diameter x 3/8 thick). Pipe and valves bounded by box with length(l) = 2, width(w) = 1 and height(h) = 1.

Area4 = = 2lh+wh+lw = 2*2*1 + 1*1 + 2*1 = 7 ft2 EEFP4(F2) = 1.1E-10*(50%*155,000)*7 = 6.0E-5/tornado Therefore, the total failure probability of the CST for an F2 tornado is:

EEFP(F2) = EEFP1(F2) + EEFP2(F2) + EEFP3(F2) + EEFP4(F2) = 3.0E-2/tornado The bottom 30 of the tank is the primary contributor to the total EEFP (nearly 90%), due to the area of the tank. The EEFP for the piping protruding from the tank is about 1/2 the EEFP for the upper part of the tank, even though the upper part of the tank is nearly 6x the area. However, the EEFP for the upper part of the tank makes use of a lower MIP (due to elevation) and lower missile count (tank more robust than the piping). Finally, the drain valves contribute less than 0.5% to the total EEFP. This validates the decision to not include the sample connection in the total EEFP calculation.

Since the tank only needs to be filled to 24 above grade to provide adequate water supply, the tank area could be reduced by assuming that only the first 24 of the tank elevation above grade will result in failure if struck by a tornado missile. This would reduce EEFP1 and eliminate the need for calculating EEFP2, reducing the total EEFP for F2 to 2.2E-2/tornado, a 25% reduction.

Example 2: Air Compressor from Figure 5-4. Calculate EEFP for F2 tornadoes In calculating the target exposed area for the air compressor in Figure 5-4, an assumption is made that if any part of the compressor, the motor, electrical support equipment (e.g., control panel, wiring), cooling water piping, or compressed air piping is struck by a tornado missile, the compressor will fail. A simple way to model the compressor and its subcomponents would be to create a single rectangular polyhedron that encompasses the entire assembly, with additional areas to represent the cooling water and compressed air piping, as shown in Figure 5-9. The red box represents the compressor, motor, and attached subcomponents. The cooling water piping is the blue shape, the air inlet pipe is green, and the air discharge pipe is yellow.

Drawings were consulted and field measurements were taken; the dimensions of the objects are:

Compressor/motor/etc. (red): 10 width x 7 depth x 6 height Service water pipe (blue): 2 width x 1 depth x 6 height Air inlet pipe (green): 6 diameter x 6 height Air discharge. pipe (yellow): 6 diameter x 6 height Note that the views of the compressor in Figure 5-4 are from the direction of the roll-up door. Hence, the back of the compressor would not be exposed to missiles coming through the opening. Both sides of Page 60 of 226

September 21, 17 NEI 17-02, [Rev 1]

the compressor assembly and the top are exposed to missiles. Additionally, the back of the service water pipe, inlet air pipe, and air discharge pipe would not be exposed to missiles. Since the inlet and discharge pipes are treated as cylinders, the entire area of the cylinder (less the top and bottom ends) is used as a simplification. This simplification has minimal impact on the total area (see calculations below).

Figure 5-9: Simplified Representation of Compressor and Support Components The total area of the individual targets in Figure 5-9 are:

Red: 1 x 10 x 6 + 2 x 7 x 6 + 1 x 7 x 10 = 214 ft2 Blue: 1 x 2 x 6 + 2 x 1 x 6 = 24 ft2 Green: x 0.5 x 6 = 9.4 ft2 Yellow: x 0.5 x 6 = 9.4 ft2 Therefore, the total area of the target is: 256.8 ft2 Although the pipe targets associated with the compressor could potentially be considered robust, they are small contributors to the overall area. Therefore, the entire target is considered not robust, although this could be revisited if the target were determined to be risk significant. The entire target is located at less than 30 elevation. Therefore:

EEFP(F2) = 1.1E-10*155,000*256.8 = 4.4E-3/F2 tornado Note that the area of the opening, through which missiles could travel to strike the compressor, is 288 ft2. This is about 10% larger than the calculated target area, but it could be used for the target area and Page 61 of 226

September 21, 17 NEI 17-02, [Rev 1]

is a simpler calculation. However, the purpose of this example was to provide a complex configuration for the purposes of illustrating the area calculations.

Example 3: Service Water SSCs from Figure 5-7. Calculate EEFP for all tornadoes (F2 - F6)

The service water piping and pumps in the pump house (partially represented in Figure 5-7) are vulnerable to missiles coming through the rollup door, as shown by the red lines in that figure. They are also vulnerable to vertical missiles striking and penetrating the roof above the SSCs.

Figure 5-10 shows areas outlined in red that are selected to represent targets in the pump house.

These targets were chosen based on the system success criteria, which requires 3 service water pumps and one service water header, taking into account the ability to cross-tie headers. A rectangle bounding the SSCs is used to represent the target on the pump house roof. If that target is hit, the SSCs enclosed by the rectangle in Figure 5-10 are assumed to be hit. The headers (Targets A and C), the cross-tie (Target B) and the 2 sets of pumps (Targets D and E) are each modeled separately in the PRA.

From Figure 5-7, the header represented by Target A and three service water pumps represented by Target D can be hit from missiles coming through the roll-up door, in addition to those penetrating the roof. The area of the roll-up door is used as the target area (as opposed to the area of the header or pumps); the EEFP calculated based on the door area is assigned to both Target A and D.

EEFPs for Targets B, C and E are calculated based on missile strikes on the roof, only.

Page 62 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-10: Target Areas Encompassing Service Water Pumps and Piping The elevation of the roof (not of the ultimate target SSCs) is used to choose the MIP (between near ground and elevated). The roof elevation is where the missile initially strikes, so the MIP appropriate to the roof elevation should be used. In this example, the roof is only 18 above grade, so the near ground MIP would be used, regardless.

The areas measured for these targets are:

A (roof): 750 ft2 / (door): 45 ft2 B: 568 ft2 C: 750 ft2 D (roof): 568 ft2 / (door): 45 ft2 E: 471 ft2 In this example, the roof is constructed of 5 thick reinforced concrete. As such, only 20% of the total missiles can penetrate the roof (Category I from Table 5-2).

Missiles striking the rollup door can result in failure to Targets A and D, as described above. Since Target A is 16 service water piping, 35% of the total missiles (Category E from Table 5-2) could potentially be used in the EEFP calculation. However, there are motor and valve controls, as well as other support systems in the area that are not robust. Therefore, without further investigation, the total number of missiles from Table 5-1 will be used for the missiles hitting the roll-up door and ultimately damaging Target A. Since pumps are considered non-robust (see Section 5.3.1), the total missile inventories are used for Target D EEFP calculations.

The EEFPs for each target and F-scale tornado are shown in Table 5-4. Note that the Target A EEFP from the roll-up door is about 30% of the EEFP from the roof. Even though the door target is relatively small, the fact that the total missile inventory is being used makes a difference.

Page 63 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table 5-4: Pump House Target EEFP Values Target Target Target Target Target Target Target Target A A D B C D (door) E (roof) (door) (roof)

Target 750 45 568 750 568 45 471 Area (ft2)

% of 20% 100% 20% 20% 20% 100% 20%

Missiles Total Near Tornado Number Ground Category of MIP Missiles F'2 1.1E-10 155,000 2.6E-03 7.7E-04 1.9E-03 2.6E-03 1.9E-03 7.7E-04 1.6E-03 F'3 3.6E-10 155,000 8.4E-03 2.5E-03 6.3E-03 8.4E-03 6.3E-03 2.5E-03 5.3E-03 F'4 6.3E-10 205,000 1.9E-02 5.8E-03 1.5E-02 1.9E-02 1.5E-02 5.8E-03 1.2E-02 F'5 1.6E-09 240,000 5.8E-02 1.7E-02 4.4E-02 5.8E-02 4.4E-02 1.7E-02 3.6E-02 F'6 2.4E-09 240,000 8.6E-02 2.6E-02 6.5E-02 8.6E-02 6.5E-02 2.6E-02 5.4E-02 5.6 CORRELATION BETWEEN TARGETS In some situations, two or more vulnerable SSCs may be physically situated in such a way that they may be considered correlated. A correlated vulnerable target is susceptible to common mode failure.

Correlated targets are typically located close together, such that a single missile is capable of striking and damaging more than one target, simultaneously. When considering the range of missiles capable of striking correlated targets, the full range should be initially considered. The list may be narrowed in scope based on other physical factors, such as elevation and shielding by buildings or other structures.

In the cases of correlated targets, there are different approaches available for calculating the effective surface area. Once correlated targets have been identified, the surface area can first be calculated coarsely, and then refined appropriately as needed.

5.6.1 CORRELATED TANKS EXAMPLE Figure 5-11 shows an example of two tanks that have instrumentation in between the tanks that are vulnerable to a single missile strike (i.e., correlated). The instrumentation for each tank is highlighted with a red box in the picture on the right. Although unlikely, it is possible that a single missile can damage both sets of instrumentation such that both tanks would be considered unavailable.

Page 64 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-11: Correlated Tanks with Instrumentation A very conservative approximation would be to consider both tanks fully correlated, such that a rectangular polyhedron is used to encompass both tanks and the instrumentation. This is shown in Figure 5-12. The Target Exposed Area that would be calculated for this object would be very large and not representative of the area that of concern, i.e., the target area for the correlated targets.

Furthermore, since the correlated targets are non-robust (instrumentation), the total missile inventory would be used in the EEFP calculation.

However, if this treatment provides acceptable risk calculations, it is conservative and can be easily justified. On the other hand, it is likely that the treatment will be too conservative, and another approach would need to be taken. Figure 5-13 provides an alternative and more realistic target configuration. In this figure, each tank is a separate target (in red), and the correlated target is the green box in between the two tanks. This treatment allows the tanks to be treated separately and as robust targets, thus allowing the use of lower missile counts. Furthermore, the common area that results in the failure of both tanks (in green) is much smaller and less likely to be risk significant.

Page 65 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-12: Single Target Model for Correlated Tanks Figure 5-13: Single Target Model for Correlated Tanks Page 66 of 226

September 21, 17 NEI 17-02, [Rev 1]

5.6.2 CORRELATED SAFETY VALVES EXAMPLE In this example, consider a 3 by 6 array of Main Steam Safety Valves (MSSVs), where the individual valves are in close physical proximity to each other in two dimensions. Valves may be modeled individually or in groups. These approaches for correlating shown in this example can also be used for other situations, such as closely co-located and correlated steam relief exhaust stacks that penetrate a reinforced concrete roof.

Similar the tank example in Section 5.6.1, all valves could be considered vulnerable to missiles from all directions. This is the starting point; to address target correlation, assuming each missile strike results in common mode failure of all targets (see Figure 5-14). This also assumes that the valves are close enough to each other that a single missile can indeed hit all the targets.

Figure 5-14: Correlation of Single Group of MSSVs It is possible that the results of the initial calculation will show that the combined SSC is a dominant contributor, and therefore further refinement would be appropriate. For PRA models having success criteria requiring an individual MSSV group (e.g., per SG) to fail, the approach can be refined such that the correlation takes place at the group level only. In Figure 5-15, this would utilize three separate basic events to represent each of the three groups. The outer groups would utilize only the surface area that fully exposes each valve, that is, the top and the outer side of the rectangular solid. The middle group is exposed only from the top. The ends are not used because a single missile will not be able to damage the entire group when approaching from that direction.

Page 67 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-15: Correlation of Three Separate Groups of MSSVs The surface area used for the middle group is the horizontal top surface area of a rectangular solid drawn around that group only.

More complex schemes and groupings are provided in Figures 5-16 and 5-17.

Page 68 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-16: Complex Correlation Between MSSVs For more complicated success criteria, for example, two of the six valves, the approaches can be combined. This requires creating multiple possible combinations of adjacent MSSVs using only the exposed top and side surface areas. As shown above, there can be five 5 groupings of two adjacent valves. The exposed surface top and side area is shown for one grouping.

Page 69 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5-17: Complex Correlation Between MSSVs For more complicated success criteria, for example, two of six valves, the approaches can be combined. This requires creating many possible combinations of adjacent MSSVs using only the exposed surface areas. Shown above are two combinations where vertical missiles could impact multiple groups.

Page 70 of 226

September 21, 17 NEI 17-02, [Rev 1]

6 DEVELOP TMRE PRA MODEL This section provides the detailed guidance for developing the TMRE PRA Model. The TMRE PRA Model is used to calculate the risk associated with the SSCs that are nonconforming with respect to the TMP licensing basis, and is the basis for a risk-informed license application that is to be submitted in accordance with RG 1.174 [Ref. 6.1]. The TMRE PRA Model should be developed from the plants peer reviewed internal events PRA model of record, since that model should contain the appropriate accident sequence logic and fault trees to be modified. Additionally, using a peer reviewed RG 1.200 PRA model will support adherence to the PRA technical adequacy requirements, after considering the self-assessment of the additional supporting requirements for the TMRE application provided in Section 6.8.

Figure 6-1 is the TMRE flowchart with the relevant actions highlighted for the TMRE PRA model development step of the process. The key elements of developing the TMRE PRA model are:

• Select the event trees and fault trees appropriate for modeling a tornado event from the Internal Events Model of Record (typically the Loss of Offsite Power (LOOP) accident sequence logic)

• Replace the LOOP initiating event with tornado initiating events (F2 - F6)

• Remove recovery and repair logic (or set failure probability to 1.0), as recovery and repair are not credited in the TMRE PRA

• Develop Compliant Case and Degraded Case logic or models

• Add tornado wind and missile failure modes to vulnerable SSCs, as appropriate, in the fault tree logic

• Set human error probabilities (HEP) to 1.0, for certain short term actions outside the main control room (MCR) and review transit paths for other ex-MRC operator actions.

6.1 EVENT TREE/FAULT TREE SELECTION One of the assumptions of the TMRE method is that a tornado event that creates tornado missiles will, at a minimum, cause a Loss of Offsite Power (LOOP) and reactor trip. Therefore, one or more of the internal events PRA LOOP event trees and respective accident sequence logic should reasonably be expected to represent the tornado initiating events in the TMRE PRA. The PRA analyst should review other internal initiating events from the PRA model of record being used to ensure that either (1) a tornado event cannot cause another initiating event or (2) the impact of the initiating event can be represented in the logic selected to represent the tornado initiating event. An example of the second case is a support system loss (e.g., service water loss due to vulnerable service water system piping); the impact of the consequential loss of service water should be included in the accident sequence/fault tree logic in the TMRE PRA model.

Page 71 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 6-1: TMRE Flowchart - Event Tree/Fault Tree Selection Page 72 of 226

September 21, 17 NEI 17-02, [Rev 1]

Another assumption of the TMRE method is that the tornado-induced LOOP cannot be recovered. That is, offsite power remains unavailable following the event for the duration of the mission time. This should be taken into account when selecting the event trees and model logic used to represent the tornado event; the logic must allow for the failure of recovery of offsite power and any repair events.

Additional consideration in the accident sequence model adapted for tornado events are:

• Mission times may need to be adjusted for some basic events, based on the fact that offsite power recovery is not credited.

• Some time-phased dependencies may be affected due to the tornado winds and missiles potentially affecting multiple SSCs, with no credit for recovery.

Once the appropriate model logic has been selected, unneeded logic can be removed at the discretion of the analyst. The only initiating events quantified in the TMRE model will be tornado initiating events, using the model logic chosen to represent them.

6.2 TORNADO INITIATING EVENTS The initiating events for the TMRE PRA model are five tornado events, one each representing the F-Scale tornado categories F2 through F6. These initiating events will replace the initiating events (e.g.,

LOOP) used in the selected event trees. For multi-unit sites, the tornado event should be assumed to result in a multi-unit LOOP event. Guidance for the development of the initiating event frequencies is contained in Section 4.

Page 73 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 6-2: TMRE Flowchart - Tornado Initiating Events Page 74 of 226

September 21, 17 NEI 17-02, [Rev 1]

6.3 COMPLIANT CASE AND DEGRADED CASE A RG 1.174 License Amendment Request (LAR) requires an evaluation of the change in risk (i.e., CDF and LERF) for different plant configurations. For the TMRE application, there are two configurations (cases) that need to be modeled and quantified before evaluating the change in risk associated with the TMP nonconforming SSCs. In this guidance, they are referred to as the Compliant Case and Degraded Case. Both the cases are based on the same LOOP event tree (and/or other event trees identified in Section 6.1), with certain modifications.

• The Compliant Case represents the plant in full compliance with its tornado missile protection current licensing basis. Therefore, all nonconforming SSCs that are required to be protected against missiles are assumed to be so protected, even when reality determines the SSCs are not protected. In the Compliant Case, nonconforming SSCs are assumed to have no additional failure modes beyond those normally considered in the internal events PRA.

• The Degraded Case represents the current configuration of the plant (i.e., configuration with nonconforming conditions with respect to the tornado missile protection current licensing basis). As such, the TMRE PRA model will include additional tornado induced failure modes for all nonconforming SSCs. The failure probabilities for those additional tornado induced failure modes are based on EEFP calculations, as described in Section 5.

Some of the internal events PRA model changes needed to create the TMRE PRA model will be applicable to both the Compliant and Degraded Cases. These common changes are:

• The internal events PRA event trees and fault trees chosen to represent the tornado initiating events (Section 6.1)

• The tornado initiating events and their frequencies (Section 6.2)

• Offsite power recovery and repairs are not credited (Section 6.1)

• Certain non-feasible operator action HEPs will be set to 1.0 (Section 6.4)

• Non-Category I structures incapable of withstanding the forces associated with tornado winds greater than 103 mph (i.e., the lower wind speed associated with F2 tornadoes) and exposed active NSR SSCs (e.g., pumps, compressors) are assumed to fail with a probability of 1.0 (Section 6.6).

• Turbine buildings and exposed passive NSR SSCs (e.g., tanks, pipes) should be evaluated to determine their capability to withstand tornado wind pressures. Failure probabilities for these structures will vary based on their strength (Section 6.6).

• Vulnerable but conforming components (i.e., those PRA modeled SSCs that are exposed to tornado missiles but are not nonconforming with respect to the TMP current licensing basis) will include tornado-missile induced failures based on EEFP calculations (Section 6.5)

Therefore, the primary difference between the Compliant and Degraded Cases is the treatment of nonconforming SSCs. In the Compliant Case, no changes are made in the fault trees for nonconforming Page 75 of 226

September 21, 17 NEI 17-02, [Rev 1]

SSCs (even if they are vulnerable to tornado missiles); in the Degraded Case, tornado missile-induced failure modes are added to the failure logic for nonconforming SSCs.

Table 6-1 provides a summary of the different treatments for various parts of the TMRE PRA models/cases.

Table 6-1: Compliant Case vs. Degraded Case Model Changes Type of SSC Failure Probability - Failure Probability -

Compliant Case Degraded Case

• Switchyard 1.0 with no recovery 1.0 with no recovery

• Non-Category I Buildings

• SSCs in Category I Buildings (6.6.1 and 6.6.2)(1)

• Short-term Operator Actions Outside MCR (6.4)

• Exposed active NSR SSCs (6.6.3)(1)

Exposed passive NSR SSCs

• EEFP for tornado

• EEFP for tornado (6.6.4)(1) categories below categories below calculated strength calculated strength

• 1.0 for tornado categories

• 1.0 for tornado at or above calculated categories at or above strength calculated strength Nonconformances No new failures EEFP Other Vulnerabilities EEFP EEFP Note (1): Although not designed as Category I, failures of turbine buildings and SSCs within them can be treated differently from other non-Category I buildings (see 6.6.2) 6.4 IMPACTS ON OPERATOR ACTION HUMAN ERROR PROBABILITIES Tornado events at a nuclear site are very unlikely to have any impact on Category I structures, due to their robust construction and design margin. Thus, equipment and personnel inside Category I structures are not expected to be affected in the TMRE PRA. However, certain operator actions may have to be performed outside Category I structures or require the operators to transit outside Category I structures in order to get to the location to perform the action. For short term actions (i.e., those that need to be executed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the initiating event), the TMRE method assumes that the actions cannot be performed and thus the HEPs for those actions are set to 1.0.

Page 76 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 6-3: TMRE Flowchart - Operator Actions Page 77 of 226

September 21, 17 NEI 17-02, [Rev 1]

The rationale for this assumption is that during and immediately following a tornado event on site, areas outside Category I structures may not be safe due to high winds and debris/missiles. It is not expected that operators will endanger themselves in such situations. Furthermore, in the short time period following the tornado strike (assumed to be 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in the TMRE method), there may be significant debris and damage to structures that could impede or prevent operators from transiting to and operating equipment outside Category I structures. Plant specific procedures may direct that personnel not exit Category I structures until a damage assessment is performed, which is assumed to take no longer than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following the tornado event. This introduces uncertainty into any detailed human reliability analysis of these actions. It is reasonable to apply a human error probability (HEP) of 1.0 to these short term actions in both the Compliant and Degraded Cases, because the aforementioned assumption is not overly conservative and the impact does not depend on tornado missile protection of SSCs.

The type of short term operator actions described above should have been identified as part of the HWEL development described in Section 3.

Operator actions performed inside the control room or other Category I structures are assumed to be unaffected by the tornado event. Short term actions that are taken in response to the loss of offsite power should already consider the additional stress the operators may be under due to weather-related LOOP events. Longer term actions should not be affected as the immediate impact of the tornado event on operator stress and distractions should no longer be a factor on operator response.

If necessary, operators should be interviewed to ensure that the operator actions used in the internal events PRA are applicable to tornado events. Talk-throughs and simulator exercises may be used if actions are expected to vary substantially.

Operator actions performed in non-Category I structures that would have failed during a tornado event (see Section 6.6), should also be assumed to fail. However, the failure of the SSC being operated or manipulated should ensure that credit is not taken for these actions. Operator recovery actions to restore functions, systems, or components should not be credited unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is documented.

It is possible that new operator action dependencies will be created as a result of the TMRE model changes or due to new cutsets or combinations of failures associated with tornado events. The analyst should ensure that new operator action dependencies are appropriately accounted for in the TMRE PRA model.

6.5 TARGET IMPACT PROBABILITY BASIC EVENTS Page 78 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 6-4: TMRE Flowchart - Target Impact Probabilities Page 79 of 226

September 21, 17 NEI 17-02, [Rev 1]

The PRA logic models need to be modified to include tornado missile-induced failures for exposed SSCs.

Tornado missile failures do not need to be considered for SSCs protected by 18 reinforced concrete walls, 12 reinforced concrete roofs, and/or 1 steel plate. The failure probability for a given SSC is determined using the EEFP calculation described in Section 5. Recall that the EEFP for each exposed SSC is calculated for each tornado category F2 through F6. The PRA model must be modified to ensure that the correct EEFP is used for an SSC based on the tornado category used for the initiating event. An example of how this can be accomplished in a CAFTA fault tree is shown in Figure 6-5.

SSC failures from tornado missiles may need to be considered for failure modes not previously included in the internal events system models (e.g., due to low failure probability or low impact on system failure probability). Examples include:

• Flow diversions and/or leakage

• Tank vent failures (e.g., tank vent pipe crimping)

• Valve position transfer (spurious closure or opening)

• Ventilation damper failures Figure 6-5: Example Fault Tree Logic for Tornado Missile Failures In this fault tree, a tornado missile failure basic event is added to the fault tree for each tornado category (only the F2 and F3 logic is shown here). The tornado missile failure basic event is placed under an AND gate with the appropriate category tornado initiating event. It is left to the analyst to determine the specific modeling method for incorporating tornado missile failures into their PRA models, and the level of detail of the tornado missile failure basic events. For example, one basic event Page 80 of 226

September 21, 17 NEI 17-02, [Rev 1]

could be used to represent all tornado missile failures of a given SSC or separate basic events could be included for the cause of each tornado missile failure of the SSC. Additionally, depending on the physical arrangement of the targets, multiple SSCs may sometimes be included under a single basic event (see Subsections 5.3.1 and 5.5 for examples).

Table 6-1 provides guidance for the Compliant Case and Degraded Case treatment of nonconforming SSCs and other vulnerable (but not nonconforming) SSCs.

6.6 NON-CATEGORY I STRUCTURES AND OTHER NSR SSCS Model changes are needed to account for the failure of non-Category I structures and other NSR SSCs that are not designed to withstand tornado wind pressures and atmospheric pressure changes. These changes are applicable to both the Compliant and Degraded Cases, as listed in Table 6-1.

1. Non-Category I structures and buildings that may house NSR SSCs, are often built to industrial or commercial building codes. As such, non-Category I buildings (with the exception of most turbine buildings) will generally not withstand wind pressure and atmospheric pressure changes associated with the tornado categories applicable to the TMRE. Therefore, these buildings and the SSCs inside the buildings should be considered to fail with a probability of 1.0 in the TMRE PRA.

2. Although turbine buildings are generally not Category I structures, their frames are typically designed to withstand significant forces. Turbine building siding is typically designed to become detached from the frame, to prevent failure of the structure from wind pressures (although it may expose SSCs inside the turbine building to tornado missiles). Therefore, failures of SSCs within a turbine building should follow the guidance for active and passive NSR SSCs provided in items 3 and 4, for tornado categories the turbine building structure can withstand.

3. Less robust, non-safety related SSCs (e.g., pumps, air compressors, generators, and other active components) located outside of structures or within turbine buildings, such that they are directly exposed to tornado wind pressures, should be failed in the TMRE PRA.

4. More robust SSCs (e.g., tanks, piping, passive valves, conduits) are generally sturdy enough to withstand tornado wind forces. This is especially true for steel tanks that are full, or mostly full, of liquid. Analyses should be done to verify that the SSCs are capable of withstanding tornado wind forces. Design calculations may be used to determine the wind speed at which such SSCs will fail.

Failure probabilities for such SSCs should be set to 1.0 in both the compliant and degraded cases for wind speeds (based on tornado category) higher than the calculated strength. Tornado missile failure modes (i.e., based on an EEFP) need to be included for such SSCs, for the tornado categories that do not cause guaranteed failure of the SSC.

6.7 PRA TECHNICAL ADEQUACY The assumption of the TMRE methodology is that the Internal Events model of record used as the basis for the TMRE model has been peer reviewed against the RG 1.200 [Ref. A.8] endorsed PRA standard.

Any open findings from the peer review that would impact the application of the model in the TMRE process should be addressed prior to submitting the TMRE-based license amendment request. This is all required to be documented in the LAR, consistent with the licensees process for risk-informed license amendment requests.

Page 81 of 226

September 21, 17 NEI 17-02, [Rev 1]

In addition to the internal events technical adequacy, the details of the conversion process from the Internal Events PRA to the TMRE PRA should be documented and reviewed. The process should follow this guideline, and any deviations from the guideline should be well documented.

The table in Appendix D includes supporting requirements (SR) from Part 2 of the ASME/ANS PRA Standard [Ref. A.9] that have been selected specifically by the NRC staff for the application of the TMRE PRA model in assessing tornado missile protection nonconformance risk. A cross-reference to the applicable section of this guidance document is provided for each of the SRs is also provided in Appendix D.

Page 82 of 226

September 21, 17 NEI 17-02, [Rev 1]

7 QUANTIFY RISK, PERFORM SENSITIVITY ANALYSES, AND COMPARE TO THRESHOLDS 7.1 CDF AND LERF QUANTIFICATION Per Regulatory Guide 1.174 [Ref. A.6], a risk-informed License Amendment Request (LAR) includes an evaluation of the change in risk (e.g., CDF). For the purposes of the TMRE, a licensee needs to calculate this change in risk by comparing two different configurations: the Compliant Case (configuration with the plant built per the required design/licensing bases), and the Degraded Case (current plant configuration, including potential nonconformances for tornado missile protection).

The CDF and LERF are simply calculated as follows:

CDF = CDFDegraded - CDFCompliant LERF = LERFDegraded - LERFCompliant The configuration-specific CDFs and LERFs are quantified like any other PRA, in alignment with the relevant quantification (QU) Supporting Requirements from the ASME/ANS PRA Standard (see Appendix D for additional detail).

7.2 SENSITIVITY ANALYSES In addition to the CDF and LERF results, a risk-informed LAR should include a discussion on the sensitivity of those results to key assumptions and parameters, such that the uncertainties are well characterized and understood. For the purposes of TRME, there are two types of sensitivity evaluations that may be relevant.

7.2.1 TMRE SENSITIVITIES Licensees may need to evaluate any assumptions that non-Category I structures are guaranteed to fail in the Compliant Case.

Two generic sensitivities have been identified during the development of the TMRE methodology through interaction with NRC. The pilot work may result in some additional sensitivity studies to consider.

Each sensitivity study described in Sections 7.2.1.1 and 7.2.1.2 should be performed and documented if the if the CDF or LERF between the compliant and the degraded case exceed 10-7/yr or 10-8/yr, respectively.

A ZONAL VS. UNIFORM MISSILE DISTRIBUTION This sensitivity addresses the NRC concern regarding the potential underestimation of target hit probability due to the missile distribution at the licensees site, as compared to the missile distribution for the EPRI NP-768 Plant A simulations.

Page 83 of 226

September 21, 17 NEI 17-02, [Rev 1]

Procedure: For SSCs with a tornado missile failure basic event RAW > 2, multiply the basic event failure probability by 2.75 and recalculate CDF and LERF. This only applies to tornado missile basic events for tornado categories F4 , F5, and F6. Basic events for F2 and F3 tornado missile failures are not considered in this sensitivity.

The basis for this sensitivity study procedure is provided in Appendix A.

B MISSILE IMPACT PARAMETER This sensitivity addresses the NRC concern regarding the potential underestimation of target hit probability due to target SSCs that are located or oriented in a way that exposes them to a higher missile impact probability than the average MIP derived using the average of all targets in EPRI NP-768 Plant A.

Procedure: For highly exposed SSCs with a tornado missile failure basic event RAW > 2, multiply the basic event failure probability by 2.5 and recalculate CDF and LERF. This only applies to tornado missile basic events for tornado categories F4, F5, and F6. Basic events for F2 and F3 tornado missile failures are not considered in this sensitivity.

For the purposes of this sensitivity study, the term highly exposed refers to an SSC for which all of the following characteristics apply:

• Is not located inside a Category I structure (i.e., they are outside or in a non-Category I structure)

• Is not protected against horizontal missiles

• Has an elevation less than 30 above grade The basis for this sensitivity study procedure is provided in Appendix A.

7.2.2 OPEN PRA F&OS If a licensee has open F&Os from their most recent internal events PRA peer review, these may impact the quantification. Licensees should perform sensitivity studies for open F&Os, as applicable and relevant to the TMRE.

7.2.3 COMPLIANT CASE CONSERVATISMS The licensee should review cutsets in the top 90% of the TMRE compliant case to identify conservatisms related to equipment failures (as opposed to offsite power recovery or operator actions) that could impact results and perform sensitivity studies to address AS-A10, LE-C3 and SY-B7 in Appendix D.

Specifically, consider that equipment failures in the compliant case may be masking changes in risk.

7.3 COMPARISON TO RISK METRIC THRESHOLDS The LAR should be evaluated against the very small change in risk thresholds given in Regulatory Guide 1.174 (CDF 10-6/yr and LERF 10-7/yr ). It is possible that some licensees may exceed these Page 84 of 226

September 21, 17 NEI 17-02, [Rev 1]

thresholds, in which case, additional discussion on defense-in-depth and safety margins may be warranted in the LAR. Prior to completing this comparison, the licensee should ensure that quantification is completed consistent with QU-D5 and QU-D7.

7.4 ADDRESSING RISK SIGNIFICANT TARGETS To address risk-significant targets, the licensee should first, identify which SSCs (targets) are contributing most significantly to the risk metrics, and second, identify what assumptions were made regarding the target. Once these identifications are made, the risk-significant targets can be addressed in a variety of manners.

• If the SSC is considered robust, the licensee may use fewer missiles.

• If all or part of the SSC is elevated (>30), the elevated MIP value may be lower.

• If part of the SSC is shielded or inconsequential, a smaller area could be used.

• Consider a plant modification to provide shielding A combination of these approaches can be used to ensure that defense-in-depth and safety margins, relative to the most risk-significant targets, are maintained.

7.5 DEFENSE-IN-DEPTH AND SAFETY MARGIN TMRE Defense-in-depth Defense-in-depth is an approach to designing and operating nuclear facilities that prevents and mitigates accidents that release radiation or hazardous materials. The key is creating multiple independent and redundant layers of defense to compensate for potential human and mechanical failures so that no single layer, no matter how robust, is exclusively relied upon.

The TMRE application should include a global discussion of defense-in-depth, including the use of access controls, physical barriers, redundant and diverse means of achieving key safety functions, and emergency response measures. The analysis should reflect the actual design, construction, and operational practices of the plant. Some examples of elements of defense-in-depth and means to meet them are shown below. Elements of Defense-in-depth examples:

1. A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

Demonstrate that no new accidents or transients are introduced with the change, and that the facility is still well protected from tornado missiles. Ensure that no fission product barriers or key safety functions are disproportionately impacted by potential tornado missile damage.

2. Over-reliance on programmatic activities as compensatory measures associated with the change in the license basis is avoided.

Existing or new programmatic activities that help to mitigate tornado impacts should be discussed.

However, it should be demonstrated that such activities are not necessary to maintain adequate defense-in-depth. For example, plants that have abnormal weather procedures with actions to secure tornado missiles should not depend on their ability to conduct such activities in tornado conditions; the design should be such that adequate defense-in-depth is maintained without it. Other examples of activities that may improve defense-in-depth for some plants are as follows: missile reduction, missile Page 85 of 226

September 21, 17 NEI 17-02, [Rev 1]

relocation, ongoing administrative control of missiles, and development of processes to conduct repair of key plant equipment that may be damaged during a tornado.

3. System redundancy, independence and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system and uncertainties.

While the expected frequency of tornado strikes is low and missile strike damage even lower, and while adherence to the single-failure criterion establishes an acceptable level of defense-in-depth, it is prudent to improve defense-in-depth to overcome uncertainties (tornado strike time and place, missile location and path, plant configuration, etc.) Such measures may include incorporation of flex equipment and strategies into severe weather procedures, ensuring access following a severe weather event, and planning maintenance of key equipment such that it does not occur during times of the year when occurrence of tornados is more likely. Licensees may consider using other risk-informed approaches for which they have been licensed such as a Surveillance Frequency Control Program to ensure optimum alignment of activities impacting key equipment.

4. Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

Potential common cause failures from tornado missile impacts and the impact to defense-in-depth should be analyzed to show that adequate defense-in-depth is maintained. In practice, common cause failures from missiles may sometimes be used for convenience in the PRA model; these types of failures should be discussed in the context of plant design features that provide defense against such failures.

5. Independence of barriers is not degraded.

Evaluate the design to ensure that no single failure from a tornado missile would introduce dependence between any two of the following: fuel cladding, reactor coolant system, or the containment.

6. Defenses against human errors are preserved.

Where available, discuss where automatic safety function features are maintained following tornado missile damage, decreasing the reliance on human actions. Where existing human actions may be required or where new human actions are introduced for the purpose of maintaining defense-in-depth, discuss the training, procedures, staging/briefing activities, and design features that will be used to successfully carry out such actions such that the tornado impacts will not significantly increase error likelihood.

7. The intent of the plants design criteria is maintained.

The analysis of non-conforming equipment should show that, following an LOSP, an impact to any single active or passive component from a tornado missile does not completely eliminate the ability to perform key safety functions. For example, a missile impact to a diesel generator exhaust stack in a plant with two trains of emergency AC power should not prevent both diesel generators from performing their function. Success criteria from the PRA may be used to demonstrate satisfaction of defense-in-depth where multiple redundant components are available to accomplish a safety function, but some are vulnerable to tornado missiles. Additionally, the application should address specific targets that comprise 10% of the risk analysis acceptance criteria.

Page 86 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE Adequate Safety Margin Engineering evaluation should assess whether the impact of the proposed LB change is consistent with the principle that sufficient safety margins are maintained. Given that the risk assessment has shown that the change is acceptable, the conservative approaches used in the assessment should also be discussed. Examples include conservative modeling of physical correlation, conservative non-use of target shielding, conservative use of generic missile counts, and conservative non-use of adjustments to missile counts for robust targets. Additionally, discuss instances where the target failure mode is unlikely to result in a loss of function for the SSC.

Page 87 of 226

September 21, 17 NEI 17-02, [Rev 1]

8 PLANT CONFIGURATION CHANGES Application of the TMRE is governed by the terms of the license amendment issued in response to the license amendment request (LAR) submitted to obtain approval of the methodology for the specific plant. Generally, this is expected to be a one-time amendment to identify and accept exposed SSCs required to be protected from tornado missiles. Application of the TMRE methodology provides a basis for concluding that the risk to the plant is sufficiently low for the specified SSCs that additional tornado missile protection need not be provided.

8.1 PLANT CONFIGURATION CHANGES The TMRE approach is to be used only to provide a basis to accept identified nonconforming configurations that exist at the time the TMRE license amendment is approved. Application of TMRE does not provide a basis for modifications to remove existing tornado missile protection or to omit protection for new configurations that otherwise require tornado missile protection according to the plant licensing basis.

Design Control programs that meet 10 CFR 50 Appendix B will ensure that subsequent configuration changes are evaluated for their impact on the TMRE risk basis for accepting the identified nonconforming conditions. Licensees should ensure that they have sufficient mechanisms to assure that any significant changes to site missile sources, such as a new building, warehouse, or laydown area are evaluated for impact to the TMRE basis, even if not in the purview of the site Design Control program.

Temporary additional missiles from construction activities shall be addressed in the TMRE analysis as indicated in section 3 above. Permanent changes that increase the site missile burden within the 2500' missile radius established for TMRE shall be included in the TMRE analysis.

8.2 FUTURE IDENTIFICATION OF NONCONFORMING CONDITIONS Additional legacy nonconforming conditions that were missed when the initial TMRE LAR was submitted, where tornado missile protection is required but not provided, may be resolved using TMRE, under certain conditions. If TMRE has been approved for the plant, it must be applied as specified in the amended license. The TMRE PRA model must be updated to reflect the newly identified conditions, and the additional conditions identified in the updated FSAR. As with all changes, 10 CFR 50.59 shall be applied to determine whether NRC approval is required. TMRE is not to be used for nonconforming conditions created as a result of future modifications without separate review and approval by NRC.

Page 88 of 226

September 21, 17 NEI 17-02, [Rev 1]

APPENDIX A: TECHNICAL BASIS FOR TMRE METHODOLOGY A.1. INTRODUCTION The Tornado Missile Risk Evaluator (TMRE) will be used to estimate the quantitative risk associated with tornado-generated missiles at U.S. nuclear power plants (NPP). It is built upon a plant-specific internal events Probabilistic Risk Assessment (PRA) model and is intended to support a RG 1.174 [Ref. A.6]

license amendment request (LAR). This appendix describes:

• The elements and basis of the TMRE methodology

• Technical considerations and conservatisms

• Results of benchmark studies at two sites, comparing the TMRE results with RG 1.200 High Winds (HW) PRA results

• The basis for two required sensitivity studies (described in Section 7.2)

A.2. ELEMENTS OF TMRE The major elements of the TMRE are:

• The internal events PRA model and the modifications made to it o The assumption of a non-recoverable Loss of Offsite Power o Accounting for impacts on operator actions o Accounting for failure of exposed non-safety related Structures, Systems or Components (SSCs)

• Use of a site-specific tornado frequency

• Addition of missile failure events for SSCs exposed to tornado missiles, using the Exposed Equipment Failure Probability (EEFP) o Missile Impact Parameter (MIP) o Exposed target Area o Missile inventory, including robust target considerations o Assumption of target failure (i.e., fragility = 1.0)

• Quantification and Comparison to Risk Metrics

• Sensitivity Analyses

• PRA Technical Adequacy Page 89 of 226

September 21, 17 NEI 17-02, [Rev 1]

A.2.1 MODIFICATIONS TO THE INTERNAL EVENTS PRA MODEL Section 6 provides details on how the plant-specific internal events PRA model is modified for use in the TMRE. The use of the internal events PRA model in the TMRE follows the current standard practice in developing HW PRA models.

A.2.1.1 NON-RECOVERABLE LOSS OF OFFSITE POWER (LOOP) ASSUMPTION The significant difference in the TMRE method is that a LOOP is always assumed to occur in the TMRE, as opposed to using fragilities or other data to determine the likelihood of a LOOP. This is a reasonable assumption, given the likelihood of a LOOP event as a result of a site tornado strike of F2 intensity or higher (i.e., greater than 103 mph). Figure A-1 shows the conditional LOOP probability (i.e., LOOP fragility) versus wind speed for a typical NPP [Ref. A.1]. Based on this curve, LOOP probability ranges from approximately 15% to 95% for F2 tornado wind speeds (103 - 135 mph). The LOOP probability at the mean wind speed for F2 (119 mph) is approximately 60%. Another study [Ref. A.2] showed that the probability of offsite failure approaches 1.0 at 112 mph.

FIGURE A-1: CONDITIONAL LOOP PROBABILITY Furthermore, offsite power is assumed to be non-recoverable. This is consistent with current HW PRA assumptions; given a LOOP, no credit is given for offsite power recovery (i.e. non-recovery probability =

1.0) [Ref. A.2]. Although the assumption is somewhat conservative, it is reasonable to expect that offsite power will not be recovered or have a very high non-recovery probability if a tornado strikes the site and results in a LOOP. Note that tornado strikes offsite, which result in a LOOP due to transmission line or grid failure, are not considered tornado events in TMRE or HW PRAs.

The assumption that a LOOP occurs and is non-recoverable applies to both the Compliant and Degraded cases (see Section 6.3 for a discussion on Compliant and Degraded cases). This assumption challenges the mitigation capabilities of the plant, in that emergency power must survive tornado effects and Page 90 of 226

September 21, 17 NEI 17-02, [Rev 1]

operate for the full mission time, adequate cooling water supplies (e.g., condensate storage tanks) must survive, and balance of plant equipment (e.g., feedwater) is not available and cannot be recovered.

A.2.1.2 IMPACT ON OPERATOR ACTIONS The TMRE method requires that operator actions performed outside Category I structures be evaluated to ensure that they can be performed following a tornado event. Actions that cannot be performed (e.g., due to damage to non-Category I structures or non-safety related components) are set to fail (see Section 6.4). Short term operator actions (defined as occurring within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the tornado event) that require transit or execution outside Category I structures are also assumed to fail in the TMRE method.

These are reasonable assumptions considering the uncertainty in the amount of damage and debris around the plant following the tornado event, and the need to conduct post-event damage and safety assessments prior to dispatching operators outside protected structures.

Human Error Probabilities (HEP) changes are not made to other operator actions, such as those performed inside the main control room. This is different from current practice in HW PRAs (which evaluates all operator actions and makes changes to some of them), but is adequate for the TMRE:

• Currently, there is no detailed industry guidance for high wind human reliability analysis (HRA).

The most relevant guidance document is the external events HRA EPRI guidance document [A.3]

which is useful but not detailed for high wind HRA. The lack of a standard methodology results in significant judgment on the part of the HRA analysts, which would result in inconsistent application in the TMRE.

• Long term actions, especially those performed inside the control room or other Category I structures, should generally not be affected significantly, due to the short time frame in which the tornado is directly affecting the site.

• Incremental changes to operator action HEPs as a result of degraded PSFs will typically be applicable to both the Compliant and Degraded Case, so the impact on the change in risk between the two cases should be insignificant.

A.2.1.3 NON-CATEGORY I STRUCTURES AND EXPOSED NON-SAFETY RELATED SSCS Section 6.6 provides guidance for addressing tornado wind impacts on SSCs that are not designed to withstand tornado wind pressures and atmospheric pressure changes.

It is reasonable to expect that non-Category I structures (i.e., those built to industrial or commercial building codes) will not withstand the wind pressures associated with F2 or greater tornadoes 7. While there is some likelihood that such a structure might withstand tornado wind pressures associated with an F2 tornado, even engineered structures are likely to fail at higher intensity tornadoes. Figure C-17 shows the missile release fraction for engineered and pre-engineered structures. This fraction is a surrogate for the amount of damage likely to occur to an engineered or pre-engineered structure. Based on Figure C-17, F3 tornadoes result in approximately 40% damage to such a structure, F4 results in 80%

damage, and F5 and F6 tornadoes result in greater than 90% damage. At 40% or greater damage, SSCs within the structure are exposed to tornado wind forces and may be directly damaged by structural 7

Turbine buildings are typically not considered in this category, as the cladding or siding is designed to come off at a certain wind speed (e.g, 90 - 120 mph) to prevent structural failure of the building.

Page 91 of 226

September 21, 17 NEI 17-02, [Rev 1]

collapse or debris. SSCs adjacent to the structure are likely impacted by the failure of the structure (e.g.,

structural collapse or large structural component impact), and therefore are conservatively assumed to fail with a probability of 1.0.

The assumption that active SSCs (e.g., pumps, compressors) exposed to tornado wind effects will fail at tornado intensities at or above F2 is also reasonable. These types of components are not designed to withstand such forces; they may become misaligned, support systems (e.g., electrical cables, junction boxes,) may be dislodged or uncoupled, or lightweight debris may affect the equipment operation.

Most such SSCs of this type are considered to be failed in both the Compliant and Degraded cases. This should generally lead to conservative results, but the impact of these assumptions should be evaluated to ensure the conservative assumptions do not mask significant increases in risk between the Compliant and Degraded cases. Section 7.2.1 provides guidance on performing sensitivity studies that addresses this specific issue.

A.2.2 SITE-SPECIFIC TORNADO HAZARD Section 4 provides details on the calculation of the site-specific tornado frequencies to use in the TMRE model. NUREG/CR-4461 Revision 2 is recommended as the data source. This is the most recent public tornado hazard analysis performed by the NRC for the U.S NPPs., and includes tornado frequencies developed for each plant site.

A.2.3 THE EXPOSED EQUIPMENT FAILURE PROBABILITY Section 5 and Appendix B provide details on the basis of EEFP calculation, the derivation and bases of the factors associated with the EEFP, and methods to perform SSC-specific EEFP calculations. The variables and factors included in the EEFP were developed in an effort to provide a conservative estimate of SSC failure probability. Section A.5 provides the results of two benchmark studies, comparing the EEFP to TORMIS-based SSC missile failure probabilities; see Tables A-4, A-6 and A-7. The MIP values, missile inventories and the assumption that SSCs hit by tornado missiles will fail (i.e., fragility

= 1.0) were developed to be used together, and should not be modified. Although each variable may not be conservative by itself, the combination of variables used for different targets and tornado wind speeds provides a bounding estimate of the change in CDF associated with nonconforming SSCs (Section A.5 provides results of benchmark studies comparing TMRE results with the results of HW PRAs).

The details of the basis for each of the variables used in the EEFP calculation are provided in the guidance document:

• Section B.1 provides background and precedent for the use of a simplified analysis to determine a target missile hit probability. Appendix B describes additional details of the derivation of the Missile Impact Parameter (MIP) and Sections A.6 and A.7 of this appendix discuss sensitivities to address uncertainties associated with the MIP.

• Section 5.3 describes the process for determining the target exposed area, used in the EEFP calculation, and provides example calculations. The target exposed area calculation described in Section 7.3 is realistic.

• Section 5.2 describes the method for determining the missile inventory to use in the EEFP calculations. Appendix B describes the basis for the generic and bounding missile inventory.

Page 92 of 226

September 21, 17 NEI 17-02, [Rev 1]

Licensees are expected to validate the TMRE missile inventory is bounding; if this is not the case, a bounding site-specific missile inventory should be developed. The area surrounding the plant, which is used for the missile inventory, is consistent with the TORMIS simulations results in EPRI NP-768 [Ref. A.4] that are the basis for the MIP derivation.

• Target fragilities are assumed to be equal to 1.0; if a target is struck by a damaging missile, it is assumed to fail. Some consideration is given to robust targets, given that not all missiles included in the site missile inventory can damage certain targets (e.g., steel tanks and pipes, reinforced concrete roofs). The basis for the reduction of missile inventories for certain targets is provided in Appendices B and C.

A.2.4 QUANTIFICATION AND COMPARISON TO RISK METRICS CDF and LERF quantification is performed on two versions of the TMRE model, the Compliant Case and the Degraded Case. The primary difference between the two cases is the treatment of non-conformances. In the Compliant Case, each non-conforming SSC is assumed to be protected, such that tornado missiles cannot strike or damage the SSC. In the Degraded Case, failure of the non-conforming SSCs due to tornado missiles is represented by the EEFP. Other SSCs that may be failed by either tornado missiles or tornado wind pressure are treated the same in both the Compliant and Degraded cases. This includes failure of unprotected (vulnerable) safety related SSCs that are in compliance with the licensing basis.

The difference between the Compliant and Degraded case CDF and LERF (i.e., CDF and LERF) is the risk associated with not providing missile protection for the non-conforming SSCs. CDF and LERF are compared to the thresholds in RG 1.174 to determine the acceptability of the risk increase associated with not protecting non-conforming SSCs. This process is a typical application of RG 1.174 for risk-informed license changes.

A.2.5 TMRE PRA TECHNICAL ADEQUACY The requirements for PRA technical adequacy, as applied to the TMRE PRA, are described in Section 6.7, Section 7.2 and Appendix D. The technical adequacy of the base internal events PRA must be addressed consistent with the ASME PRA Standard, the changes made to create the TMRE PRA must be evaluated against Appendix D, and the TMRE-specific calculations (e.g., EEFP) must be performed in accordance with this guidance document. Section 7.2 provides guidance on addressing open peer review Findings and Observations (F&Os) on the base internal events PRA.

A.3. SOUTHWEST RESEARCH INSTITUTE REVIEW During the development of the TMRE methodology, the NRC sponsored an independent evaluation of the TMRE method [Ref. A.5], specifically focusing on the derivation of MIP from EPRI NP-768 and the generic applicability of the TMRE MIP values to NPP sites in the U.S. The overall conclusions of the report state: In general, we considered the MIP concept defensible.

However, two issues were recommended for further analysis:

• additional work is necessary to address the problem of missile clusters of variable spread and variable distance to targets. This concern is addressed in the Zonal vs Uniform sensitivity required in Section 7.2.1, based on the analysis provided in Section A.7 of this appendix.

Page 93 of 226

September 21, 17 NEI 17-02, [Rev 1]

• Additional work is also needed to define MIP values that are independent of the building configuration. The Southwest Research Institute report suggests that Target 6 in Plant A (NP-768) may be isolated enough to not be affected by other buildings. MIP values were derived from the different target buildings in NP-768 Plant A, and Target 4 was determined to have the highest MIP values (higher than Target 6, except for F6). Therefore, Target 4 is used as the basis for the MIP sensitivity required in Section 7.2.1 and documented in Section A.6 of this appendix.

A.4. CONSERVATIVE ASPECTS OF TMRE Several conservative assumptions are discussed in Section A.2, with regards to the creation of the TMRE PRA model and the calculation of the EEFP. Some additional conservative aspects of the TMRE method are described here.

1. The MIP is derived from the single missile hit probability values in EPRI NP-768. Section B.2.1 describes how multiplying the single missile hit probability by the number of missiles (as is done in the EEFP) is likely conservative.

2. Separate MIP values are derived for elevated targets (nominally defined as 30 above grade).

Although the elevated MIP values are lower than the near ground MIP values, they are based on missile hit probabilities at all elevations, from the ground to the roof level of all targets in Plant A of NP-768.

3. Missile inventories for robust targets are conservative. Appendix C and Section B.6 describe the calculations used to determine the types of missiles that can damage robust targets. Two assumptions in the calculations used to determine missile damage to targets are:

a. The missile is travelling at design speed. This assumption ensures that the damage caused by a missile on a target is realistic only for the highest intensity tornadoes (e.g.,

F6) and is conservative for all lower intensity tornadoes. Since F2 and F3 tornadoes are much more frequent (e.g., by at least an order of magnitude) than higher intensity tornadoes, this conservatism can have a significant impact on the overall risk associated with missile hits on non-conforming targets.

b. The missile strikes the target directly at a normal orientation (i.e., an ideal impact). Due to the chaotic nature of tornado winds, it is unlikely that a missile will strike a target directly. Indirect strikes will impart less energy on the target than assumed in the Appendix C calculations, such that a smaller percentage of the assumed missiles are likely to damage a robust target.

Sensitivity studies are directed in Section 7.2.1 to address:

• The potential for non-conservative CDF and LERF calculations due to conservative assumptions in the Compliant Case

• Uncertainties in the derivation of the MIP values

[Sections A.6 and A.7 provide a basis for the sensitivities described in Section 7.2.1]

Page 94 of 226

September 21, 17 NEI 17-02, [Rev 1]

A.5. BENCHMARK RESULTS Benchmark studies were performed for two plants, to compare results using the TMRE methodology against the results associated with a peer reviewed TORMIS-based HW PRA. The following were compared:

• Total CDF/CDF

• Dominant accident sequence CDF/CDF contribution

• Individual SSC CDF/CDF contribution

• Failure probability of individual SSCs at five different tornado intensities (F2 through F6)

It should be noted that even though the TMRE resulted in conservative overall results and a majority of the target comparisons were conservative to the TORMIS-based failure probabilities, the TORMIS-based analyses are already conservative 8. Thus, the TMRE comparisons are being made to conservative benchmarks.

The two benchmark plants are denoted Plant X and Plant Y. Both plants showed conservative TMRE total CDF/CDF compared to the HW PRA results 9. Table A-1 provides a comparison of CDF/CDF for both plants. 10 TABLE A-1 Comparison of CDF and CDF for Benchmark Plants Plant TMRE HW PRA Difference Ratio X CDF = 8.6E-7/yr CDF = 1.6E-7/yr 7.0E-7/yr 5.4 Y CDF = 1.1E-5/yr CDF = 2.0E-6/yr 9.0E-6/yr 5.5 Comparisons of sequence- and target-level CDF/CDF contributions and target-level damage probabilities are provided in the subsections specific to each of the benchmark plants.

A.5.1 PLANT X Plant X is a dual unit PWR located in RG 1.76 [Ref. A.7] Region I. Only one unit is evaluated, since the units are more or less symmetric. Sequence level CDF comparisons are provided in Table A-2. The 8

Several conservatisms are described in TORMIS analyses used for design basis applications. These same conservatisms are typically maintained in TORMIS analyses used to support HW PRAs.

9 Plant X CDF results in Tables A-1 and A-2 are based on EEFPs calculated using NEI 17-02 Rev. 0 robust missile percentages.

10 Plant X computed the CDF between the degraded and compliant cases, whereas Plant Y computed only the degraded case CDF.

Page 95 of 226

September 21, 17 NEI 17-02, [Rev 1]

comparison shows that the CDF for the top 5 TMRE sequences are all conservative, when compared to the comparable HW PRA sequences. 11 TABLE A-2 Comparison of Sequence-Level CDF for Plant X TMRE RG RG TMRE CDF 1.200 TMRE/

Sequence Sequence Description 1.200 RANK CDF RG1.200 RANK (yr-1) (yr-1)

LOOP with Loss of Aux Feed and TI-004 1 6.6E-07 1 1.2E-07 5.4 F&B LOOP (SBO) - Loss of Aux Feed SBO-098 2 1.0E-07 4 6.4E-09 15.7 and Alternate Power Supply LOOP and Loss of Aux Feed, with TI-003 3 5.1E-08 3 1.4E-08 3.6 F&B success LIFTWAY Liftway Failure 4 4.7E-08 2 1.7E-08 2.8 LOOP with Consequential Small S2-022 5 5.1E-09 6 8.2E-10 6.2 LOCA Total CDF 8.6E-07 1.6E-07 5.4 Due to the method in which targets were grouped in the Plant X HW PRA, it is difficult to compare target-to-target damage probabilities for each of the targets; only a limited set of 6 targets (30 failure probabilities) could be readily compared directly. They are shown in Table A-3 12. Target comparisons for F2 and F3 tornadoes are highlighted, since the majority of the risk is from F2 and F3 tornadoes. In many cases, the F2 and F3 failure probability ratios for a given target are the highest, but this is not always the case; for some targets, the highest ratio may be in F4, F5, or F6 failure probabilities.

Of the 30 target failure probabilities compared, the TMRE failure probabilities were conservative to all but 3 of the TORMIS-based failure probabilities. Those failure probabilities are associated with F4 through F6 tornado missile failures of the turbine-driven AFW pump steam exhaust stack. If this SSC were determined to be risk significant, as defined in Section 7.2.1, performing either sensitivity study would increase the failure probabilities to above (or nearly equal, in the case of F6) to the HW PRA 11 Sequence 5 in the HW PRA is not modeled in the TMRE, since it was determined to not be modeled very conservatively and still not be significant to the HW PRA results.

12 Although Plant X CDF results are based on EEFPs calculated using NEI 17-02 Rev. 0 robust missile percentages, the TMRE failure probabilities in Table A-3 are based on robust missile percentages from Table 5-2 of this revision of NEI 17-02.

Page 96 of 226

September 21, 17 NEI 17-02, [Rev 1]

failure probabilities. [Note: The turbine-driven AFW pump steam exhaust stack contributes less than 1%

to the tornado missile risk.]

Page 97 of 226

September 21, 17 NEI 17-02, [Rev 1]

TABLE A-3 COMPARISON OF TARGET FAILURE PROBABILITIES FOR PLANT X TMRE RG 1.200 TMRE vs Target Failure Modes Size/Location F' scale Probability Probability RG 1.200 F'2 2.2E-02 4.6E-03 4.7 F'3 7.1E-02 2.0E-02 3.6 Condensate Area ~ 3200 sq ft Tank Perforation F'4 1.7E-01 1.1E-01 1.5 Storage Tanks Elevation <30 ft F'5 4.9E-01 3.9E-01 1.3 F'6 7.4E-01 6.9E-01 1.1 F'2 3.1E-03 1.3E-04 24 F'3 1.0E-02 3.7E-04 27 Area ~ 180 sq ft PAB Liftway Missile Hit F'4 2.3E-02 1.4E-03 17 Elevation <30 ft F'5 6.9E-02 3.4E-03 20 F'6 1.0E-01 4.9E-03 21 F'2 2.8E-03 1.5E-05 187 F'3 9.2E-03 3.1E-05 297 Central SW Area ~ 470 sq ft Pipe Perforation F'4 2.1E-02 9.2E-05 231 Header Elevation < 30 ft F'5 6.3E-02 2.1E-04 301 F'6 9.5E-02 3.8E-04 250 F'2 3.5E-04 3.5E-06 100 F'3 1.1E-03 3.0E-05 38 West SW Area ~ 60 sq ft Pipe Perforation F'4 2.6E-03 1.9E-04 14 Header Elevation < 30 ft F'5 7.9E-03 9.2E-04 8.5 F'6 1.2E-02 1.8E-03 6.6 North SW Roof F'2 2.6E-03 1.5E-05 171 Concrete Roof Area ~ 750 sq ft Page 98 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE RG 1.200 TMRE vs Target Failure Modes Size/Location F' scale Probability Probability RG 1.200 Perforation Elevation < 30 ft F'3 8.4E-03 2.9E-04 29 F'4 1.9E-02 7.7E-04 25 F'5 5.8E-02 1.5E-03 38 F'6 8.6E-02 2.3E-03 38 F'2 2.7E-03 9.1E-04 3.0 F'3 8.8E-03 5.8E-03 1.5 TD AFW Pump Exhaust Pipe Area ~ 315 sq ft F'4 2.0E-02 4.5E-02 0.5 Exhaust Stack Crushing Elevation < 30 ft F'5 6.1E-02 2.5E-01 0.2 F'6 9.1E-02 5.0E-01 0.2 A.5.2 PLANT Y Plant Y is a dual unit PWR, also located in RG 1. 76 Region I. Only one unit is compared, since the units are more or less symmetric. Sequence-level CDF comparisons are provided in Table A-4. The comparison shows that the TMRE CDF for 3 of the top 4 HW PRA sequences 13 are conservative, and one sequence is essentially the same (TMRE CDF for sequence TQX is 90% of the HW PRA CDF). Note that the absolute value of sequence TQX is less than 1E-8/yr.

TABLE A-4 COMPARISON OF SEQUENCE-LEVEL CDF FOR PLANT Y RG TMRE RG TMRE 1.200 TMRE/

SEQUENCE SEQUENCE DESCRIPTION CDF 1.200 RANK CDF RG1.200 (YR-1) RANK (YR-1)

Transient with a loss of TBU 1 1.0E-05 1 1.9E-06 5.3 SSHR and injection fails Transient LOCA with a TQU 2 1.2E-07 2 9.1E-08 1.3 failure of Injection 13 HW PRA Sequence 5 is not modeled in the TMRE PRA, due to its very low risk contribution (CDF less than 1E-10/yr).

Page 99 of 226

September 21, 17 NEI 17-02, [Rev 1]

Transient LOCA with a TQX 3 6.2E-09 4 6.9E-09 0.9 failure of recirculation Transient with a loss of TBX 4 3.7E-09 3 6.9E-10 5.4 SSHR and recirculation fails Not in ATWS ATWS Sequence NA NA 5 5.4E-11 TMRE Total CDF 1.1E-05 2.0E-06 5.5 Table A-5 compares the SSC contribution to CDF between the TMRE and HW PRA results, based on the combined Fussel-Vesely importance values across all five tornado intensities (F2 through F6).

Truncation for CDF was set to 1E-11/yr; only the 8 SSCs shown in Table A-6 were included in the CDF cutsets. The TMRE CDF contributions for all 8 SSCs are conservative to the HW PRA CDF contributions.

TABLE A-5 COMPARISON OF SSC CONTRIBUTION TO CDF FOR PLANT Y TMRE CDF RG 1.200 TMRE/

TARGET TARGET DESCRIPTION (YR-1) CDF (YR-1) RG1.200 MAIN STEAM LINES NEAR EDG AIR INTAKE 7.7E-06 2.3E-08 335 MSLINE MAIN FEEDWATER LINES NEAR EDG AIR FWLINE 2.8E-06 1.8E-06 1.6 INTAKE RWST REFUELING WATER STORAGE TANK 1.9E-08 1.4E-09 14 EDG B EMERGENCY DIESEL GENERATOR TRAIN B 3.1E-09 4.6E-10 6.7 EDG A EMERGENCY DIESEL GENERATOR TRAIN A 2.8E-09 4.4E-10 6.4 BACKUP SERVICE WATER SUPPLY OUTDOOR BSW 2.4E-09 5.2E-11 46 VALVE IN A VALVE PIT IA DC FAILURE OF BACKUP IA HEADER 1.8E-09 1.4E-09 1.3 TURBINE DRIVEN PUMP STEAM EXHAUST TDPEX NA(1) NA(1) NA LINE NOTES: (1) TRUNCATED IN TMRE AND RG 1.200 HW PRA Page 100 of 226

September 21, 17 NEI 17-02, [Rev 1]

Tables A-6 and A-7 compare the TMRE target damage probabilities of 29 targets for five tornado intensities (145 failure probabilities) with the HW PRA target failure probabilities (based on TORMIS analyses). The top targets in Table A-6 are the same as those listed in Table A-5, i.e., the targets that contribute to tornado missile risk at Plant Y. Failures for the other SSCs (listed in Table A-7) are truncated in the CDF cutsets, i.e., they do not contribute to tornado missile risk. The targets in Table A-7 are provided here to compare failure probabilities only.

TMRE failure probabilities for the 7 targets (35 failure probabilities) in Table A-5 are conservative to the HW PRA failure probabilities; this is expected, given the CDF contribution comparisons in Table A-5. Of the remaining 110 failure probability comparisons (in Table A-7), 14 TMRE target failure probabilities are not conservative when compared to the TORMIS-based probabilities. These targets (which have negligible risk impact) are characterized as follows:

• F2 4 SG PORVs with TORMIS failure probabilities ~1E-3

• F3 4 SG PORVs with TORMIS failure probabilities ~2E-3

• F4 SG PORV with TORMIS failure probability ~3 E-3 Transformer/Load Center with TORMIS failure probability ~0.3

• F5 Vent pipe with TORMIS failure probability ~7E-4 Transformer/Load Center with TORMIS failure probability ~0.3

• F6 Vent pipe with TORMIS failure probability ~1E-3 Transformer/Load Center with TORMIS failure probability ~0.4 A review of these targets was performed; it is noted that most of these targets are within a factor of 2 of the TORMIS-based failure probabilities, and some are very close (within 10% - 20%). Since these are not important targets in the HW PRA, it is unlikely that much, if any, effort was made to reduce the fragilities or failure rates for these SSCs. This may be the reason why the HW PRA failure probabilities are higher than the TMRE failure probabilities.

If these targets were determined to be risk significant per Section 7.2.1, sensitivity studies would be performed. However, none of the targets with TMRE lower failure probabilities are significant to CDF in either the TMRE or HW PRA results (they do not contribute to CDF at a truncation of 1E-11/yr).

Page 101 of 226

September 21, 17 NEI 17-02, [Rev 1]

TABLE A-6 COMPARISON OF TARGET FAILURE PROBABILITIES FOR PLANT Y FAILURE F' TMRE RG 1.200 TMRE/ RG TARGET MODES SIZE/LOCATION SCALE PROBABILITY PROBABILITY 1.200 F'2 4.5E-02 2.2E-07 209,620 F'3 1.5E-01 1.2E-04 1,220 Main Steam Area ~ 7600 Piping Pipe sq ft F'4 3.4E-01 1.9E-03 181 Perforation Elevation < 30

[MSLINE] ft F'5 1.0E+00 4.9E-03 206 F'6 1.0E+00 1.2E-02 82 F'2 1.7E-02 9.8E-07 16,982 F'3 5.4E-02 3.9E-05 1,384 Main FW Area ~ 2800 Piping Pipe sq ft F'4 1.3E-01 6.1E-04 204 Perforation Elevation < 30

[FWLINE] ft F'5 3.7E-01 1.8E-03 205 F'6 5.6E-01 4.3E-03 131 F'2 2.6E-02 7.0E-04 37 Refueling F'3 8.4E-02 3.0E-03 28 Area ~ 3800 Water Tank sq ft Storage Tank F'4 1.9E-01 2.5E-02 7.9 Perforation Elevation < 30 ft

[RWST] F'5 5.8E-01 5.7E-02 10 F'6 8.7E-01 9.8E-02 8.9 F'2 1.1E-03 2.0E-05 55 EDG B F'3 3.6E-03 2.5E-04 14 Area ~ 150 sq (Exhaust and Penetrate ft Intake) Missile F'4 8.4E-03 1.9E-03 4.4 Elevation < 30 Barriers ft

[EDG B] F'5 2.5E-02 3.5E-03 7.3 F'6 3.8E-02 6.2E-03 6.1 Page 102 of 226

September 21, 17 NEI 17-02, [Rev 1]

FAILURE F' TMRE RG 1.200 TMRE/ RG TARGET MODES SIZE/LOCATION SCALE PROBABILITY PROBABILITY 1.200 F'2 1.1E-03 2.6E-05 43 EDG A F'3 3.6E-03 2.5E-04 15 Area ~ 150 sq (Exhaust and Penetrate ft Intake) Missile F'4 8.4E-03 1.8E-03 4.6 Elevation < 30 Barriers ft

[EDG A] F'5 2.5E-02 3.8E-03 6.6 F'6 3.8E-02 6.2E-03 6.0 F'2 2.1E-04 5.0E-07 414 Service F'3 6.8E-04 6.6E-06 103 Water Piping Pipe and Area ~ 35 sq ft and Valve (in Valve Elevation < 30 F'4 1.6E-03 8.7E-05 18 Valve Pit)

Perforation ft F'5 4.7E-03 1.6E-04 30

[BSW]

F'6 7.1E-03 1.7E-04 42 F'2 2.1E-02 1.2E-03 18 Diesel-driven F'3 6.8E-02 6.4E-03 11 Air Area ~ 1200 Compresso Compressors sq ft r and F'4 1.6E-01 4.2E-02 3.7 and Piping Elevation < 30 Pipe Hit ft F'5 4.7E-01 7.8E-02 6.0

[IA DC]

F'6 7.0E-01 1.2E-01 6.0 Page 103 of 226

September 21, 17 NEI 17-02, [Rev 1]

TABLE A-7 COMPARISON OF NON-RISK SIGNIFICANT TARGET FAILURE PROBABILITIES FOR PLANT Y FAILURE TMRE RG 1.200 TMRE/ RG TARGET SIZE/LOCATION MODES F' SCALE PROBABILITY PROBABILITY 1.200 F'2 7.6E-05 0.0E+00 NA TD AFW F'3 2.6E-04 3.4E-06 76 Area ~ 170 sq Pump Exhaust ft Exhaust Stack Pipe F'4 5.9E-04 3.3E-05 18 Elevation > 30 Crushing ft

[TDPEX] F'5 1.8E-03 1.8E-04 10 F'6 2.6E-03 3.3E-04 8 F'2 3.5E-04 1.4E-03 0.3 F'3 1.2E-03 2.5E-03 0.5 SG A PORV Valve Hit Area ~ 65 sq ft and Exhaust and Elevation > 30 F'4 2.7E-03 3.4E-03 0.8 Stack Pipe Crush ft F'5 8.1E-03 4.6E-03 1.8 F'6 1.2E-02 6.4E-03 1.9 F'2 3.5E-04 8.4E-04 0.4 F'3 1.2E-03 1.6E-03 0.8 SG B PORV Valve Hit Area ~ 65 sq ft and Exhaust and Elevation > 30 F'4 2.7E-03 2.6E-03 1.1 Stack Pipe Crush ft F'5 8.1E-03 3.6E-03 2.2 F'6 1.2E-02 4.0E-03 3.0 F'2 3.5E-04 6.5E-04 0.5 F'3 1.2E-03 1.2E-03 1.0 SG C PORV Valve Hit Area ~ 65 sq ft and Exhaust and Elevation > 30 F'4 2.7E-03 2.0E-03 1.4 Stack Pipe Crush ft F'5 8.1E-03 2.8E-03 2.8 F'6 1.2E-02 3.0E-03 4.1 F'2 3.5E-04 1.0E-03 0.3 SG D PORV Valve Hit Area ~ 65 sq ft Page 104 of 226

September 21, 17 NEI 17-02, [Rev 1]

FAILURE TMRE RG 1.200 TMRE/ RG TARGET SIZE/LOCATION MODES F' SCALE PROBABILITY PROBABILITY 1.200 and Exhaust and Elevation > 30 F'3 1.2E-03 1.6E-03 0.8 Stack Pipe Crush ft F'4 2.7E-03 2.0E-03 1.3 F'5 8.1E-03 2.8E-03 2.9 F'6 1.2E-02 4.1E-03 2.9 F'2 3.0E-04 1.4E-04 2.2 F'3 1.0E-03 2.5E-04 4.2 SG A PORV Valve Hit Area ~ 65 sq ft Block Valve and Elevation > 30 F'4 2.4E-03 5.8E-04 4.1 and Piping to Pipe ft PORV Perforation F'5 7.1E-03 1.3E-03 5.4 F'6 1.1E-02 2.4E-03 4.3 F'2 3.0E-04 2.3E-04 1.3 F'3 1.0E-03 4.4E-04 2.4 SG B PORV Valve Hit Area ~ 65 sq ft Block Valve and Elevation > 30 F'4 2.4E-03 6.7E-04 3.5 and Piping to Pipe ft PORV Perforation F'5 7.1E-03 9.4E-04 8.0 F'6 1.1E-02 1.4E-03 8.0 F'2 3.0E-04 2.9E-04 1.1 F'3 1.0E-03 4.3E-04 2.4 SG C PORV Valve Hit Area ~ 65 sq ft Block Valve and Elevation > 30 F'4 2.4E-03 4.4E-04 5.3 and Piping to Pipe ft PORV Perforation F'5 7.1E-03 6.1E-04 12 F'6 1.1E-02 8.0E-04 13 F'2 3.0E-04 2.7E-04 1.1 SG D PORV Valve Hit Area ~ 65 sq ft Block Valve and Elevation > 30 F'3 1.0E-03 5.2E-04 2.0 and Piping to Pipe ft PORV Perforation F'4 2.4E-03 6.6E-04 3.6 Page 105 of 226

September 21, 17 NEI 17-02, [Rev 1]

FAILURE TMRE RG 1.200 TMRE/ RG TARGET SIZE/LOCATION MODES F' SCALE PROBABILITY PROBABILITY 1.200 F'5 7.1E-03 1.0E-03 7.1 F'6 1.1E-02 2.0E-03 5.2 F'2 2.3E-04 0.0E+00 NA F'3 7.8E-04 0.0E+00 NA Area ~ 30 sq ft MSSV Train A Pipe Elevation > 30 F'4 1.8E-03 4.9E-06 360 Piping Perforation ft F'5 5.3E-03 2.1E-06 2,506 F'6 7.9E-03 1.5E-06 5,385 F'2 2.3E-04 0.0E+00 NA F'3 7.8E-04 8.6E-07 905 Area ~ 50 sq ft MSSV Train B Pipe Elevation > 30 F'4 1.8E-03 5.4E-06 327 Piping Perforation ft F'5 5.3E-03 3.1E-07 16,811 F'6 7.9E-03 3.3E-05 238 F'2 1.5E-04 0.0E+00 NA F'3 5.0E-04 0.0E+00 NA Area ~ 30 sq ft MSSV Train C Pipe Elevation > 30 F'4 1.1E-03 2.5E-06 455 Piping Perforation ft F'5 3.4E-03 3.2E-06 1,070 F'6 5.1E-03 4.8E-06 1,049 F'2 1.5E-04 0.0E+00 NA F'3 5.0E-04 0.0E+00 NA Area ~ 50 sq ft MSSV Train D Pipe Elevation > 30 F'4 1.1E-03 0.0E+00 NA Piping Perforation ft F'5 3.4E-03 2.7E-05 127 F'6 5.1E-03 3.3E-06 1,550 Page 106 of 226

September 21, 17 NEI 17-02, [Rev 1]

FAILURE TMRE RG 1.200 TMRE/ RG TARGET SIZE/LOCATION MODES F' SCALE PROBABILITY PROBABILITY 1.200 F'2 8.5E-04 0.0E+00 NA F'3 2.9E-03 2.7E-07 10,914 Area ~ 190 sq Air Supply ft MSIV A Piping F'4 6.6E-03 2.5E-07 26,419 Elevation > 30 Crushing ft F'5 2.0E-02 2.2E-07 88,811 F'6 2.9E-02 1.5E-06 20,088 F'2 8.5E-04 0.0E+00 NA F'3 2.9E-03 0.0E+00 NA Area ~ 190 sq Air Supply ft MSIV B Piping F'4 6.6E-03 2.4E-06 2,741 Elevation > 30 Crushing ft F'5 2.0E-02 2.8E-06 7,060 F'6 2.9E-02 3.6E-06 8,147 F'2 6.3E-04 0.0E+00 NA F'3 2.2E-03 0.0E+00 NA Area ~ 140 sq Air Supply ft MSIV C Piping F'4 4.9E-03 0.0E+00 NA Elevation > 30 Crushing ft F'5 1.5E-02 1.0E-06 14,689 F'6 2.2E-02 4.9E-06 4,448 F'2 6.3E-04 0.0E+00 NA F'3 2.2E-03 4.0E-07 5,494 Area ~ 140 sq Air Supply ft MSIV D Piping F'4 4.9E-03 3.9E-07 12,575 Elevation > 30 Crushing ft F'5 1.5E-02 3.8E-07 38,769 F'6 2.2E-02 3.6E-07 60,331 F'2 2.5E-03 4.0E-04 6.2 Steam Dump Valve Hit Area ~ 270 sq Valves and and ft F'3 8.1E-03 1.9E-03 4.3 Piping to Pipe Elevation < 30 Page 107 of 226

September 21, 17 NEI 17-02, [Rev 1]

FAILURE TMRE RG 1.200 TMRE/ RG TARGET SIZE/LOCATION MODES F' SCALE PROBABILITY PROBABILITY 1.200 Condenser Perforation ft F'4 1.9E-02 1.2E-02 1.6 F'5 5.6E-02 2.2E-02 2.6 F'6 8.4E-02 2.9E-02 2.9 F'2 2.5E-02 6.0E-05 409 F'3 8.5E-02 3.7E-04 230 Condensate Area ~ 7000 sq Tank and Storage Tank ft Pipe F'4 1.9E-01 1.3E-02 15 and Exposed Elevation Perforation Piping varies F'5 5.7E-01 4.2E-02 14 F'6 8.5E-01 9.2E-02 9.3 F'2 1.1E-03 0.0E+00 NA F'3 3.7E-03 5.0E-07 7,545 Area ~ 170 sq Condenser Steel Plate ft Hotwell (Barrier) F'4 8.7E-03 1.1E-05 775 Elevation < 30 Sumps Penetration ft F'5 2.6E-02 3.6E-05 727 F'6 3.9E-02 1.4E-04 275 F'2 3.2E-05 1.7E-05 1.9 F'3 1.1E-04 5.7E-05 1.8 (Buried)

Area ~ 2 sq ft Diesel Fuel Vent Pipe Elevation < 30 F'4 2.4E-04 2.2E-04 1.1 Oil Tank Crushing ft Vent F'5 7.2E-04 7.3E-04 1.0 F'6 1.1E-03 1.3E-03 0.8 F'2 1.0E-02 1.5E-03 6.8 Transformer Area ~ 600 sq and Load F'3 3.3E-02 1.9E-02 1.7 ft Center in Missile Hit Elevation < 30 Turbine F'4 7.6E-02 2.6E-01 0.3 ft Building F'5 2.3E-01 3.4E-01 0.7 Page 108 of 226

September 21, 17 NEI 17-02, [Rev 1]

FAILURE TMRE RG 1.200 TMRE/ RG TARGET SIZE/LOCATION MODES F' SCALE PROBABILITY PROBABILITY 1.200 F'6 3.4E-01 3.7E-01 0.9 A.6 TARGET EXPOSURE MIP SENSITIVITY Comparing individual targets normalized hit probabilities (i.e., the MIP) in NP-768 Plant A to the average Plant A MIP (taken across all 7 targets), one specific target (#4) shows a significantly larger hit probability across most tornado intensities. The MIP could have been derived from this target, which would provide for the highest MIP value from all the NP-768 Plant A data. However, choosing the most conservative target hit probability was judged to be too conservative for application in the TMRE. Therefore, the average values were used. However, using an MIP derived from average hit probabilities could result in low EEFPs for certain highly exposed targets at a given site. Therefore, a sensitivity analysis is required to account for the uncertainty in the MIP application to all targets.

A.6.1. TARGET 4 The exposure of Target 4 to tornado missiles is very high, based on its orientation with respect to the most prevalent tornado path, which results in a very high missile flux against the south wall of Target 4

(~70% of the total area of Target 4). Since an average hit probability was used to derive the MIP, consideration for highly exposed targets at individual sites is accounted for in sensitivity studies.

A factor is applied in the recommended sensitivity study to account for high exposed targets. The factor is based on the increased MIP values, if derived from Target 4 only, compared to the TMRE MIP values derived from the average of Plant A targets. Table A-8 provides the derived MIP values for Target 4 only (less than 30 elevation), for F4 - F6 tornadoes.

TABLE A-8 TARGET 4 TORNADO MISSILE IMPACT PARAMETER (PER MISSILE PER FT2 PER TORNADO INTERVAL FREQUENCY)

TORNADO NRC REGION I NRC REGION II NRC REGION IIII INTENSITY F4 1.6E-09 1.6E-09 1.8E-09 F5 2.9E-09 4.1E-09 N/ A F6 4.7E-09 N/ A N/ A The ratios between the Target 4 derived MIP values in Table A-8 and the TMRE MIP values for near ground targets (i.e., less than 30 elevation) are 2.9, 2.6, and 2.0 (for F4, F5, and F6 tornadoes, respectively). The average of these ratios is 2.5, which is the multiplier for the purpose of this MIP sensitivity.

Page 109 of 226

September 21, 17 NEI 17-02, [Rev 1]

A.6.2 TARGET EXPOSURE SENSITIVITY CONCLUSIONS Therefore, for high exposed targets (described below), the sensitivity will be performed by recalculating target EEFPs by multiplying the nominal values calculated for the Degraded Case by 2.5. The modified EEFPs are calculated for F4 through F6 tornadoes only. For many targets, the TMRE based EEFPs are significantly greater than the TORMIS-based failure probabilities, as seen in Tables A-3, A-6 and A-7. This is likely due to the conservative assumption of the 1.0 failure probability for a missile hit at lower tornado intensities. This conservatism associated with this assumption is more pronounced at lower tornado intensities, because the likelihood of failure given a missile hit is much lower at low tornado intensities. Even for robust targets, where missile inventories are reduced to account for the fact that only certain missiles can fail a target, the basis for these calculations was missiles travelling at design speeds. Therefore, it is judged that the conservatism involved in applying an increased MIP across all tornado intensities would result in overly conservative results.

A.7 ZONAL VS. UNIFORM (Z VS U) SENSITIVITY In addition to the TORMIS sensitivity studies documented in Appendix E, additional TORMIS simulations were performed to investigate the impact of missile distribution at a site on missile strike probability.

Specifically, the sensitivity evaluated the impact of a zonal missile distribution versus a uniform missile distribution (referred to here as Z vs U).

A.7.1. ZONAL AND UNIFORM MISSILE DISTRIBUTIONS AS PREVIOUSLY DISCUSSED (SEE APPENDIX B) THE TMRE MIP VALUES WERE DERIVED FROM MISSILE HIT PROBABILITIES in TORMIS simulations for Plant A in EPRI NP-768. For the simulations, missiles were assumed to be distributed uniformly throughout the area in and around Plant A. That is, the missiles were assumed to be distributed so that the missile density was constant across the entire area for missile origination. In reality, missiles are not distributed uniformly at a plant site; there are areas of high and low missile density.

The missile distribution at a given site may have an impact on the probability that a specific target is hit by a missile, all else being equal (this probability is represented by MIP). A set of TORMIS simulations was performed at the same two plants described in Appendix E. In this Z vs U study, two sets of simulations were run for each plant.

• Zonal Distribution - Missile hit frequencies were determined based on the actual missile distribution at the plants, when the missiles were inventoried there. As can be seen in Figures A-2 and A-3, the missiles are assigned to a zone around the plant; each plant contains approximately 20 zones. For this case, the number of missiles in each zone is represented by the red number (the first number) below the missile zone identifier. TORMIS simulations were performed at five tornado intensities, EF1 through EF5 14, and the target hit frequencies were determined.

14 EF-scale tornado simulations were used in the sensitivity studies, since the TORMIS models were based on the EF-scale. Since the sensitivity studies are comparing the effect of missile distributions, using the F-scale (which is similar to the EF-scale) shouldnt have an impact on the overall results and conclusions of the sensitivity studies.

Page 110 of 226

September 21, 17 NEI 17-02, [Rev 1]

• Uniform Distribution - The total missile population from the zonal distribution case was redistributed for this sensitivity, so that the missile density (i.e., missiles per ft2) was constant in all zones. This was done to represent a missile distribution analogous to that in Plant A of NP-768. The uniform missile counts for each zone are provided in Figures A-2 and A-3 as blue numbers, below the zonal missile counts. TORMIS simulations were performed at five tornado intensities, EF1 through EF5, and the target hit frequencies, for the same targets in the zonal simulation, were determined.

Page 111 of 226

September 21, 17 NEI 17-02, [Rev 1]

FIGURE A-2 PLANT A ZONAL AND UNIFORM MISSILE DISTRIBUTIONS Page 112 of 226

September 21, 17 NEI 17-02, [Rev 1]

FIGURE A-3 PLANT A ZONAL AND UNIFORM MISSILE DISTRIBUTIONS A.7.2. ZONAL VS UNIFORM SIMULATION RESULTS Ratios between zonal and uniform hit frequencies were calculated for each target, for each tornado intensity, as well as for each target across all tornado intensities. Several discrepancies were noted while reviewing the data, placing doubt on the efficacy of the simulations. On a macro scale, the simulations suggest that zonal missile distributions, as would be seen at an actual plant site, result in higher missile hit frequencies than uniform missile distributions. However, this was not the case for each target, and many of the simulation results provided conflicting data. The reason for the observed anomalies was not readily discerned, leading to a concern over use of the simulation results.

• A significant concern exists with targets that showed no missile hits in either zonal, uniform, or both sets of simulations. This results in ratios of 0 (if the zonal simulation recorded no hits) to undefined (if the uniform simulation recorded no hits). This phenomenon was more prevalent in Page 113 of 226

September 21, 17 NEI 17-02, [Rev 1]

the Plant B simulations, but it was inconsistent throughout all the simulations. Some targets had no hits for one EF-scale and missile distribution, but had hits for others.

• The trend of missile hit probabilities (i.e., hit frequency divided by tornado frequency) was inconsistent between EF-scales for individual targets. As seen in the NP-768 results and other current TORMIS analyses supporting high wind PRAs, missile hit probabilities on targets trend higher with higher intensity tornadoes. In very few cases this trend is not seen. However, many of the targets (again, more prevalent in the Plant B simulations) showed varying trends for increasing tornado intensities. This occurred for both uniform and zonal simulations, and often the trends were not consistent between the two missile distributions for the same target. This results in unpredictable trends in the ratio of zonal to uniform missile hit probabilities.

As noted previously, the high level results of the Z vs U sensitivity study suggest that a zonal missile distribution results in a higher missile hit frequency than a uniform distribution. This would further suggest that the MIPs derived from NP-768 may be different if a zonal missile distribution were simulated. However, MIPs derived from Plants B1 and B2 (which used a zonal distribution) are lower than those derived from Plant A (which used a uniform distribution).

The TORMIS sensitivity studies for Z vs U resulted in mixed and some unexplainable differences between zonal and uniform missile distributions. Further investigation (i.e., performing more or different simulations) may not have resolved the discrepancies. However, it was proposed that the simulation results could potentially be used to address the uncertainty associated with missile distributions, if the anomalous data (i.e., 0 missile hits or inconsistent trends, as described above) could be discarded and the remaining data proved meaningful.

A statistical analysis of the Z vs U target hit probability ratios was performed to evaluate whether the anomalous data could be discarded and the remaining data could be used to develop a Z vs U ratio suitable for application to the TMRE results. The ultimate goal is to decide what multiplier (if any) should be applied to the MIP values (and hence EEFP) for some targets.

The two primary concerns with the data were:

• Zero hit frequencies for some targets

• Inconsistent trends in hit probabilities for some targets A.7.4. TARGET CATEGORIZATION The simulation data for each target and each EF-scale was reviewed and assigned to the bins listed below. The data is screened in the order shown below, so that each target is only assigned to one category. An example of each category is shown in Table A-9.

• Zero - Any target with a 0.0 hit frequency for zonal or uniform missile distributions, for any EF-scale, was assigned to this category. [Target 1 in Table A-9]

• X - Any target that showed an inconsistent trend in hit probability for more than one EF-scale, for either zonal or uniform distributions, was assigned to this category. [Targets 2 and 3 in Table A-9]

Page 114 of 226

September 21, 17 NEI 17-02, [Rev 1]

• 1 - Any target that showed an inconsistent trend in hit probability for only one EF-scale, for either zonal or uniform distributions, was assigned to this category. [Target 4 in Table A-9]

• OK - If the target is not assigned to any of the previous categories, it is assigned to this category.

[Target 5 in Table A-9]

TABLE A-9 EXAMPLE TRENDS IN TARGET HIT PROBABILITY ID EF1 EF2 EF3 EF4 EF5 CATEGORY COMMENTS 1 1.4E-09 0.0E+00 1.8E-08 3.2E-07 7.6E-07 ZERO EF2 = 0 EF1-EF2 NEGATIVE TREND 2 1.2E-07 1.0E-07 3.4E-07 5.7E-06 2.1E-06 X EF4-EF5 NEGATIVE TREND EF1-EF2 NEGATIVE TREND 3 8.3E-08 6.6E-08 6.1E-07 2.5E-07 7.0E-08 X EF3-EF4 NEGATIVE TREND EF4-EF5 NEGATIVE TREND 4 1.9E-08 2.1E-08 5.2E-06 1.5E-06 3.2E-06 1 EF3-EF4 NEGATIVE TREND 5 2.0E-08 5.5E-08 7.5E-07 1.3E-06 1.4E-06 OK OK Data was collected for 116 total targets in the TORMIS models for plants A and B. Table A-10 provides a breakdown of the number of targets assigned to each category.

• Approximately 50% of all targets had either a zero hit probability or an inconsistent trend for more than one EF-scale. It should noted that many targets assigned to the Zero category had more than one negative trend and would otherwise be assigned to the X category. Additionally, many of the targets had more than one zero hit probability.

• Only 27% of the targets were categorized OK

• Approximately 50% of the targets had one or no inconsistent trends. The number of targets from each plant in this group (OK or 1) is relatively equal (27 in A, 31 in B).

Page 115 of 226

September 21, 17 NEI 17-02, [Rev 1]

TABLE A-10 TARGET CATEGORIES ZERO X 1 OK TOTAL PLANT A 5 14 13 14 46 PLANT B 21 18 14 17 70 PLANTS A & B 26 32 27 31 116 PERCENTAGE (A&B) 22% 28% 23% 27% 100%

Tables A-11 and A-12 provide the Plant A and B targets, the Z vs U ratio for each target for the sum of tornado categories EF1 through EF5, and the Target Category assigned (based on the discussion above).

TABLE A-11 PLANT A TARGET Z VS U RATIOS AND CATEGORIES Target # Target Type Surface Area (sq. ft) Ratio = Zonal / Uniform Category 1 Buried 2341 0.34 OK 2 Buried 883 2.49 1 3 Buried 1336 1.26 1 4 Buried 655 1.61 1 5 Buried 779 2.59 1 6 Buried 194 5.05 X 7 Buried 133 1.85 X 8 Buried 1587 1.75 1 9 Other-Horiz 81 2.50 X 10 Other-Horiz 25 1.23 X 11 Other-Horiz 45 1.72 X 12 Roof 25 0.34 Zero 13 Roof 25 1.27 Zero Page 116 of 226

September 21, 17 NEI 17-02, [Rev 1]

Target # Target Type Surface Area (sq. ft) Ratio = Zonal / Uniform Category 14 Roof 25 2.41 X 15 Roof 25 1.41 Zero 16 Roof 25 0.64 Zero 17 Roof 25 1.24 X 18 Roof 33 0.88 Zero 19 Roof 25 1.35 1 20 Roof 390 1.83 OK 21 Roof 25 1.99 X 22 Roof 25 0.68 X 23 Roof 25 0.89 1 24 Roof 25 4.13 X 25 Roof 25 2.60 X 26 Roof 30 2.11 X 27 Wall > 30' 91 2.28 OK 28 Wall > 30' 25 2.11 1 29 Wall > 30' 91 2.18 1 30 Wall > 30' 192 2.24 OK 31 Wall > 30' 25 0.81 X 32 Wall > 30' 25 1.31 OK 33 Wall > 30' 25 1.40 1 34 Wall > 30' 25 2.48 OK 35 Wall > 30' 25 2.59 1 36 Wall > 30' 25 1.94 OK Page 117 of 226

September 21, 17 NEI 17-02, [Rev 1]

Target # Target Type Surface Area (sq. ft) Ratio = Zonal / Uniform Category 37 Wall < 30' 25 2.23 1 38 Wall < 30' 25 1.41 X 39 Wall < 30' 110 2.23 OK 40 Wall < 30' 115 2.50 OK 41 Wall < 30' 25 1.55 OK 42 Wall < 30' 45 1.68 OK 43 Wall < 30' 95 4.33 OK 44 Wall < 30' 25 1.65 OK 45 Wall < 30' 25 1.80 OK 46 Wall < 30' 25 1.80 1 TABLE A-12 PLANT B TARGET Z VS U RATIOS AND CATEGORIES Target # Target Type Surface Area (sq. ft) Ratio = Zonal / Uniform Category 1 Roof 25 5.12 Zero 2 Roof 25 1.01 X 3 Roof 25 0.94 Zero 4 Roof 25 1.36 X 5 Roof 25 0.92 X 6 Roof 80 0.71 X 7 Roof 25 3.00 X 8 Roof 80 1.87 X 9 Roof 25 0.55 Zero 10 Roof 25 20.33 Zero Page 118 of 226

September 21, 17 NEI 17-02, [Rev 1]

Target # Target Type Surface Area (sq. ft) Ratio = Zonal / Uniform Category 11 Roof 207 1.97 1 12 Roof 207 1.92 OK 13 Roof 28 2.35 X 14 Roof 38 1.78 X 15 Roof 28 3.94 1 16 Roof 38 2.16 X 17 Roof 28 1.79 X 18 Roof 28 0.66 1 19 Wall > 30' 25 3.46 Zero 20 Wall > 30' 28 4.67 Zero 21 Wall > 30' 28 15.05 Zero 22 Wall > 30' 171 2.41 OK 23 Wall > 30' 25 8.49 Zero 24 Wall > 30' 30 3.05 Zero 25 Wall > 30' 28 1.64 X 26 Wall > 30' 437 2.35 OK 27 Wall > 30' 28 2.54 X 28 Wall > 30' 35 2.97 1 29 Wall > 30' 171 2.53 OK 30 Wall > 30' 28 5.00 OK 31 Wall > 30' 437 2.94 OK 32 Wall > 30' 25 4.86 1 33 Wall > 30' 437 2.30 OK Page 119 of 226

September 21, 17 NEI 17-02, [Rev 1]

Target # Target Type Surface Area (sq. ft) Ratio = Zonal / Uniform Category 34 Wall > 30' 171 2.58 OK 35 Wall > 30' 27 5.75 OK 36 Wall > 30' 25 4.00 1 37 Wall > 30' 28 2.24 X 38 Wall > 30' 171 2.44 OK 39 Wall > 30' 132 2.39 1 40 Wall > 30' 28 18.31 X 41 Wall > 30' 437 2.41 OK 42 Wall > 30' 132 2.92 OK 43 Wall > 30' 28 2.75 X 44 Wall < 30' 30 0.86 Zero 45 Wall < 30' 30 3.16 Zero 46 Wall < 30' 40 Note 2 Zero 47 Wall < 30' 40 Note 2 Zero 48 Wall < 30' 40 0.48 Zero 49 Wall < 30' 42 0.51 Zero 50 Wall < 30' 42 2.31 Zero 51 Wall < 30' 54 2.31 Zero 52 Wall < 30' 50 11.39 Zero 53 Wall < 30' 42 18.39 Zero 54 Wall < 30' 50 15.55 Zero 55 Wall < 30' 35 4.62 X 56 Wall < 30' 40 16.39 Zero Page 120 of 226

September 21, 17 NEI 17-02, [Rev 1]

Target # Target Type Surface Area (sq. ft) Ratio = Zonal / Uniform Category 57 Wall < 30' 28 1.68 X 58 Wall < 30' 35 1.75 1 59 Wall < 30' 60 3.40 1 60 Wall < 30' 123 3.00 OK 61 Wall < 30' 60 3.59 OK 62 Wall < 30' 25 3.29 OK 63 Wall < 30' 123 3.20 1 64 Wall < 30' 40 4.08 1 65 Wall < 30' 25 4.31 1 66 Wall < 30' 50 3.10 OK 67 Wall < 30' 25 6.45 OK 68 Wall < 30' 396 4.22 1 69 Wall < 30' 40 3.28 1 70 Wall < 30' 50 4.97 X Page 121 of 226

September 21, 17 NEI 17-02, [Rev 1]

A.7.5. STATISTICAL ANALYSIS OF SIMULATION RESULTS The following is a description of the statistical testing and results:

1. A 2-sample Kolomogorov-Smirnoff (KS) test with significance level =0.05 was performed for the following pairs of data subsets:

• OK and Zero/X

• OK/1 and Zero/X

2. The 2-sample KS-test has null hypothesis H0: The two data sets come from a common distribution. The alternative hypothesis H1: The two data sets do not come from a common distribution. The separation of data is based on the following:

a. The possibility that the TORMIS simulation was inadequate for the targets assigned to the Zero or X category. For example, the results may not have converged for those targets, resulting in erroneous trends and/or no hits.

b. The NP-768 data shows that several targets (1, 2, 4, and 5) have one negative trend as tornado intensities increase. Thus, this may be expected behavior for the TORMIS simulation.

c. Only considering the OK data may not provide sufficient data.

3. Comparing the OK and Zero/X subsets, the test statistic D, 0.27477, is greater than the critical value for =0.05 (0.273114). This implies that the p-value of the test-statistic is less than 0.05.

Thus, the null hypothesis is rejected in favor of the alternative. The two data sets (OK and Zero/X) are not from a common distribution.

4. Comparing the OK/1 and Zero/X subsets, the test statistic is slightly less than the critical value for =0.05. We fail to reject the null hypothesis although it is noted that the difference between the D-value 0.218596 and the critical value c = 0.273114 is very small (0.009966).

5. Additionally, an adaptive KS-Goodness of Fit test with =0.05 was performed for the following subsets of the data with null hypothesis H0: The data come from the fitted lognormal distribution. The alternative hypothesis is H1: The data do not come from the fitted lognormal distribution. The calculation was performed using the website:

http://nrcoe.inl.gov/radscalc/Pages/CurveFit.aspx

a. All data

b. All data without X

c. All data without Zero

d. All data without 1

e. All date without X and Zero (i.e., OK and 1 data)

Page 122 of 226

September 21, 17 NEI 17-02, [Rev 1]

f. All data without X and 1 (i.e., OK and Zero data)

g. All data without 1 and Zero (i.e., OK and X data)

h. All data without X, Zero and 1 (i.e., OK only)

6. For the case of ALL DATA, the null hypothesis is rejected (D-statistic = 0.1013 with critical value c=0.1004). The ALL DATA without 1 test also resulted in rejecting the null hypotheses (D-statistic

= 0.1196 with critical value c = 0.1150).

7. For all other combinations, we fail to reject the null hypothesis. It is noted that in all cases, the lognormal fit was the best fit with regards to the D-statistic among the available curves (normal, lognormal, exponential, gamma, Weibull).

8. Based on the 2-sample and Goodness of Fit KS-test, the Zero and X data do not fit with the OK data. Thus, we choose to exclude the Zero and X data.

The following references provide information on the KS test statistics:

[1] https://onlinecourses.science.psu.edu/stat464/node/54

[2] http://www.itl.nist.gov/div898/software/dataplot/refman1/auxillar/ks2samp.htm

[3] http://sparky.rice.edu/astr360/kstest.pdf

[4] Romeau, Jorge Luis. Kolomogorov-Smirnov: A Goodness of Fit Test for Small Samples. START (Selected Topics in Assurance Related Technologies) Volume 10 Number 6.

Based on the results of the statistical testing described above, the Z vs U ratios for targets categorized as Zero or X will be discarded.

• The data categorized as OK (i.e., from test 5.h. above) could be used to determine the change in hit probabilities (and thus change in MIP) due to zonal missile distributions. The Z vs U ratio using only the OK data is 2.73. Figure A-4 and Table A-13 provide the curve fit results for this dataset.

• Although the null hypothesis that OK/1 and Zero/X were from different distributions was rejected, the difference between the D-value and the critical value were very small (see 4.

above). In fact, the Z vs U ratio using the OK/1 data (from test 5.e. above) is similar to the OK data only; the mean is slightly smaller at 2.67. Figure A-5 and Table A-14 provide the curve fit results for this dataset.

• For information purposes, the all data (i.e., test 5.a. above) lognormal distribution curve fit results are provided in Figure A-6 and Table A-15. As can be seen, the mean is higher when considering all the data, although the variance and standard distribution are disproportionally larger. As noted the, Zero and X data are discarded, based on the results of the KS tests.

Therefore, a value of 2.75 is recommended for the Z vs U sensitivity. This is based on rounding up the mean from the OK dataset lognormal distribution (2.73).

Page 123 of 226

September 21, 17 NEI 17-02, [Rev 1]

FIGURE A-4 LOGNORMAL DISTRIBUTION FOR Z VS U RATIOS (OK CATEGORY)

Page 124 of 226

September 21, 17 NEI 17-02, [Rev 1]

TABLE A-13 LOGNORMAL PARAMETERS FOR Z VS U RATIOS (OK CATEGORY)

Parameter Input Values Fitted Values Mean 2.68 2.73 Median 2.41 2.40 Variance 1.54 2.20 Std. Deviation 1.24 1.48 Skewness -- 1.79 5th Percentile -- 1.04 95th Percentile -- 5.54 FIGURE A-5 LOGNORMAL DISTRIBUTION FOR Z VS U RATIOS (OK/1 CATEGORIES)

Page 125 of 226

September 21, 17 NEI 17-02, [Rev 1]

TABLE A-14 LOGNORMAL PARAMETERS FOR Z VS U RATIOS (OK/1 CATEGORIES)

Parameter Input Values Fitted Values Mean 2.63 2.67 Median 2.41 2.36 Variance 1.41 2.02 Std. Deviation 1.19 1.42 Skewness 1.75 5th Percentile 1.04 95th Percentile 5.36 FIGURE A-6 LOGNORMAL DISTRIBUTION FOR Z VS U RATIOS (ALL DATA)

Page 126 of 226

September 21, 17 NEI 17-02, [Rev 1]

TABLE A-15 LOGNORMAL PARAMETERS FOR Z VS U RATIOS (ALL DATA)

Parameter Input Values Fitted Values Mean 3.29 3.16 Median 2.31 2.33 Variance 13.6 8.37 Std. Deviation 3.69 2.89 Skewness 3.519 5th Percentile 0.64 95th Percentile 8.40 A.8 REFERENCES

[A.1] Mironenko, A. and Lovelace, N., High Wind PRA Development and Lessons Learned from Implementation, PSA 2015 Paper 12074, April 27, 2015.

[A.2] Twisdale, L., Vickery, P., Sciaudone, J., Banik, S., and Mizzen, D., Advances in Wind Hazard and Fragility Methodologies for HW PRAs PSA 2015 Paper, April 2015.

[A.3] A Preliminary Approach to Human Reliability Analysis for External Events with a Focus on Seismic, EPRI, Palo Alto, CA: 2012. 1025294.

[A.4] EPRI NP-768, Tornado Missile Risk Analysis, May 1978

[A.5] Analysis of Missile Impact Probability for Generic Tornado Hazard Assessments, Southwest Research Institute Center for Nuclear Waste Regulatory Analyses, July 29, 2016

[A.6] Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-informed Decisions on Plant Specific Changes to the Licensing Basis, Revision 2, May 2011

[A.7] Regulatory Guide 1.76, Design-basis Tornado and Tornado Missiles for Nuclear Power Plants, Revision 1, March 2007.

[A.8] Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-informed Activities, Revision 2, March 2009.

[A.9] ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

Page 127 of 226

September 21, 17 NEI 17-02, [Rev 1]

Page 128 of 226

September 21, 17 NEI 17-02, [Rev 1]

APPENDIX B: BASES FOR MIP AND MISSILE INVENTORIES The purpose of the Tornado Missile Risk Evaluator (TMRE) is to provide a methodology that can be used at any U.S. nuclear power plant (NPP) to estimate the risk associated with SSCs exposed to tornado missiles. The methodology is designed to be relatively simple, conservative, and applicable to all plants, precluding the need to perform detailed tornado missile simulations.

Data from EPRI NP-768 [Ref. B.1] was used for previous simplified tornado missile risk analyses used in the TAP A-45 program [Refs. B.2, B.3, B.4, B.6, B.6, B.7]. Specifically, the probability of tornado missiles impacting targets was based in part on the results of the TORMIS simulations documented in EPRI NP-768 and 769 [Ref. B.8]. A summary and explanation of the previous studies can be found in EPRI 3002003107, High Wind Risk Assessment Guidelines [Ref. B.9].

The TMRE methodology uses the same source information from EPRI NP-768 to derive the Missile Impact Parameter (MIP). This appendix describes how the information presented in EPRI NP-768 is used to determine the MIP values for the TMRE.

In order to simplify and standardize the TMRE Exposed Equipment Failure Probability (EEFP) calculations, values for total missile inventory are based on a survey of five US NPP missile walkdowns.

These walkdowns were performed to support previous TORMIS analyses at different sites in the U.S. The maximum values from these missile surveys are used in the TMRE, given that the site-specific walkdown performed in support of the TMRE validates that this generic missile inventory is bounding (see Section 5).

B.1 BACKGROUND INFORMATION ON MISSILE IMPACT PARAMETER (MIP)

The probability of a tornado missile hit on an exposed SSC is dependent upon several variables: the tornado intensity, the likelihood of a tornado strike, the surface area of the target, and the number and type of potential missiles (i.e. the missile inventory). The MIP reflects the probability of a tornado missile hit on an SSC given a tornado missile strike and the category of the tornado; the MIP it is normalized for target surface area and missile inventory.

EPRI NP-768 and NP-769 document the TORMIS computer simulation software developed by EPRI to perform missile hazard studies. Three plant configurations were used and numerous sensitivity cases were performed, such as varying missile population sizes and missile types, Monte Carlo sampling sizes, missile transport phenomena variables, and wall thickness. The methodology uses random variables to model the inherent variations in tornado incidence, wind field characteristics, missile position and orientation, missile aerodynamics, and the distribution of the potential missile population. The TORMIS methodology uses missile time-history simulations to predict the response of the postulated missiles to the tornado as it passes through the plant area (see Figure B-1).

The performance of a detailed, plant-specific TORMIS study can be a resource intensive analysis, which may not be warranted for relatively insignificant risk contributors, such as small exposed SSCs [Refs.

B.10, B.11]. Previous studies [Refs. B.2, B.3, B.4, B.5, B.6, B.7] used the TORMIS results presented in EPRI NP-768 to derive a normalized missile impact parameter that could be used to estimate the likelihood of an exposed SSC being struck by a tornado missile.

Page 129 of 226

September 21, 17 NEI 17-02, [Rev 1]

The TMRE MIP is developed using similar principles and assumptions as the previous work. However, there are several refinements and improvements in the development of the MIP. The calculations and rationale used to derive the TMRE MIP values are presented here.

B.1.1 DEFINITION OF MISSILE IMPACT PARAMETER (MIP)

MIP is defined as the probability of a missile impact on an exposed SSC, per missile, per target area, per tornado:

MIP = Probability of missile impact / missile / target area / tornado Using MIP, the conditional probability of a missile impact on a target during a given tornado can be estimated if the number of available missiles and the exposed surface area of the target are known.

Based on a review of the NP-768 tornado missile hit probabilities, it is apparent that the hit probability varies by the tornado intensity. A higher intensity tornado will cause more missile hits on a target, all other variables being equal (e.g., target size and location, number of missiles). Thus, separate MIPs must be derived to account for tornado intensity.

The probability that a target is hit by a tornado-generated missile will approach unity as the size of the target increases, the number of missile increase, and the tornado intensity increases. A target strike probability calculated using MIP will reflect the likelihood that a target is struck by one or more missiles.

A given target may be struck by many missiles during a single tornado event, but this probability does not specify the number of discrete missile hits experienced by a target.

Figure B-1: Illustration of EPRI TORMIS Tornado Missile Time-History Simulation [Ref. B.1]

B.2 USING EPRI NP-768 DATA TO DETERMINE MISSILE IMPACT PARAMETER (MIP)

The results of the EPRI TORMIS studies documented in NP-768 contain missile impact frequencies and associated damage frequencies for various targets, missile population sizes, and assumed plant locations, including results from various sensitivity studies. The EPRI results compiled tens of thousands Page 130 of 226

September 21, 17 NEI 17-02, [Rev 1]

of missile history simulations to generate average probability densities. Target missile impact probability, missile damage probability, and other associated probabilities are provided in the EPRI studies for different tornado hazards (i.e., thus simulating different assumed plant locations) for three different plant configurations. For the purpose of MIP derivation, only the target impact/strike frequencies and probabilities are needed. The damage likelihood is accounted for separately in the TMRE methodology.

The normalized tornado missile impact probability is conditional upon a tornado strike at the site and should not be affected by the tornado hazard curve for the site. As described, the normalized tornado missile impact probability differs as a function of tornado wind speed (i.e., the tornado category), but the tornado frequency does not impact the conditional impact probability. From the results in NP-768, there are some numerical differences in the derived MIP values depending on the tornado region; the differences are the result of Monte Carlo sampling and associated modeling, and are not due to the tornado hazard frequency input. The resolution of the differences is described in Sections B.3.2 and B.4.

B.2.1 NORMALIZING EPRI NP-768 MISSILE HIT PROBABILITY Recall from Section B.1.1 that MIP is the probability of missile hit per missile, per tornado, per ft2. MIP is defined in this way to allow it to be applied universally for different size targets at different U.S. NPP sites that have different missile populations and tornado frequencies. This is similar to the rationale behind the normalized missile parameter developed in for the TAP A-45 tornado missile risk assessments [Refs. B.2 through B.7].

EPRI NP-768 provides hit frequencies for various targets based on TORMIS simulation runs. The variable of interest, from which MIP can be derived, is the TORMIS parameter H, which is defined as Impact Event Defined as Missile Hitting the Barrier [Ref. B.1]. Two values are provided for H in the NP-768 results, P and PN. P is the single missile hit frequency for a target and PN is defined as the multiple missile hit frequency; PN accounts for the number of missiles in the simulation. MIP needs to be normalized based on the number of missiles, to allow for it to be used at sites with different populations. Thus, the single missile hit probability, P, is the parameter that is used to derive MIP.

EPRI NP-768 discusses the approach of multiplying a missile strike parameter (i.e., P) by the missile population, but notes that it is likely a conservative estimate:

The results from both case studies suggest that probability estimates for the assumed multiple missile threat can be conservatively calculated by multiplying the single missile values by the assumed number of missiles in the sampling population. For the first case study with a hypothetical multiple threat of 6000 available missiles, the degree of conservatism is a factor of two. [Ref. B.1]

The reason for this is that the TORMIS sampling process integrates over a variety of missile types and locations; whereas, using a normalized tornado missile impact probability multiplied by a population of missiles assumes all missiles have the same entrainment and flight potential. Therefore, using P to derive MIP, and in turn multiplying the MIP by the number of missile on site (as part of the EEFP calculation) is conservative, with respect to this aspect of MIP.

In order to further normalize the NP-768 hit frequency to obtain MIP, the tornado frequency and the target area need to be accounted for. The tornado frequencies used in the TORMIS simulations are Page 131 of 226

September 21, 17 NEI 17-02, [Rev 1]

provided in NP-768 Table 3-4; the target dimensions, from which target areas can be determined, are also provided in NP-768.

B.2.2 REVIEW OF SINGLE MISSILE HIT PROBABILITIES (H-VALUE P) FOR PLANTS A AND B In order to provide a conservative bias to the MIP, the simulations from NP-768 which resulted in the highest values for MIP (after normalizing P to tornado frequency and target area) were chosen. As previously noted, NP-768 simulations were performed for three plant configurations, Plant A, Plant B1, and Plant B2.

The tables in NP-768 which contain TORMIS simulation hit frequencies are:

Plant A: Tables 3-8 through 3-14 provide data for individual targets and Table 3-15 provides data for all targets combined (i.e., the sum of the probabilities for all targets at Plant A).

Plant B1: Table 3-23 provides data for individual targets and Table 3-24 provides data for all targets combined. Unlike Plant A, the individual target hit probabilities for Plant B1 are not broken down by tornado category. One combined hit probability for all tornado categories is provided for each target. Only the Plant B1 all target data in Table 3-24 has separate hit probabilities for each tornado category.

Plant B2: Table 3-25 provides data for individual targets and Table 3-26 provides data for all targets combined. Unlike Plant A, the individual target hit probabilities for Plant B2 are not broken down by tornado category. One combined hit probability for all tornado categories is provided for each target. Only the Plant B1 all target data in Table 3-26 has separate hit probabilities for each tornado category.

After deriving MIP from the single missile hit probabilities for each of these simulations, it was determined that Plant A resulted in higher overall MIP values. Therefore, Plant A data was chosen as the basis for MIP.

One potentially important difference between Plant A and Plants B1/B2 is the distribution of missiles used in the TORMIS simulations. Plant A simulations were performed with uniformly distributed missiles, i.e., the missile density is constant across the area of the site. Plant B missiles were distributed unevenly, so that some zones contained higher densities than other zones; this is described as a zonal missile distribution).

The impact of the different distributions (zonal versus uniform) was investigated in a sensitivity study documented in Appendix E. Based on this study, there is indication that unevenly distributed missile densities will affect the hit probabilities of certain targets. However, no direct correlation could be discerned from the data as to how a specific missile distribution would affect the hit probability of a specific target. In order to account for the uncertainties associated with the missile distribution at a site, the TMRE method directs that sensitivity calculations be performed to account for potentially higher hit probabilities on certain SSCs. Section 7.2.1 provides details of this sensitivity study and the criteria under which it is to be performed.

B.2.3 SELECTION OF TARGET MISSILE HIT PROBABILITIES (P) FOR DEVELOPING MIP Plant A MIP values derived from individual target (i.e., Targets 1 through 7) hit frequencies in NP-768 vary significantly for the same tornado intensity. Although a derived MIP is normalized to target size, Page 132 of 226

September 21, 17 NEI 17-02, [Rev 1]

missile inventory, and tornado category, there are other factors that affect the hit probability from which MIP is derived. Factors include the location and orientation of the target with respect to the dominant tornado path, the variation in the degree of shielding from other targets/buildings, and different target elevations 15. All these factors are expected to have an impact on the target hit probability. For example:

In Plant A simulations from NP-768, the MIP derived for Target 1 (Containment Building) is the lowest. The containment building is surrounded by other buildings (see plant layout in Figure B-2),

so only the upper part of the containment is exposed to tornado missiles. Since fewer missiles are present at higher elevations, the normalized tornado missile impact probabilities are lower in comparison to other targets.

In Plant A simulations, Target 6 is the lowest elevation building and is unprotected by any other buildings. Target 6 would be expected to have a higher normalized tornado missile impact probability than most other targets, which it does. The target with the highest derived MIP value in NP-768 Plant A is Target 4.

Development of separate MIP values for different targets, based on individual NP-768 targets, would not be practical for application of the TMRE at a given NPP. Alternately, choosing the most conservative target MIP from NP-768 (Target 4) would lead to overly conservative results for many targets at a NPP.

Therefore, the normalized tornado missile impact probability from "All Targets in NP-768 (from Table 3-

15) is proposed for use in the TMRE. This results in a MIP that is based on the combined hits on all modeled surfaces in NP-768, Plant A. Using the All Targets hit probabilities as the basis for MIP will result in conservative hit probabilities for certain targets at each NPP, while conservatism in other aspects of the TMRE (e.g., fragility values) can compensate for potential underestimates of missile hit probabilities for other targets. Additionally, the TMRE method directs that sensitivity calculations be performed to account for higher hit probabilities on certain SSCs, when applicable. Section 7.2.1 provides details of this sensitivity study and the criteria under which it is to be performed.

B.3 DERIVATION AND CALCULATION OF THE MISSILE IMPACT PARAMETER (MIP)

The mean H-values for single missiles (P) for all targets are obtained from NP-768, Table 3-15; these values include the missile hit probabilities for all Plant A targets. Therefore, the selected hit values represent the various configurations and arrangements of the seven targets at Plant A. Sections B.2.3 and 7.2.1 discuss sensitivity calculations that may need to be performed to account for configurations that expose targets to higher missiles fluxes.

The MIP values are calculated by dividing the H-values in Table 3-15 of NP-768 by (a) the tornado frequencies in NP-768, Table 3-4, and (b) the total area for all Plant A targets. The derivation of the target areas are described in the Section B.3.1, and the resultant target areas are provided in Tables B-1 and B-2.

B.3.1 CALCULATION OF TARGET AREAS Plant A has seven targets as shown in Figure B-2; dimensions of the targets (buildings) are provided in Table 3-1 of NP-768.

15 Note that target size is not a factor that influences the MIP. Sensitivity studies documented in Appendix E were performed to validate this.

Page 133 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure B-2: Plant A Layout for TORMIS Simulation [Ref. B.1]

The surface area exposed to tornado missiles for each of the targets was calculated based on the dimensions provided in Table 3-1 of NP-768; the targets, their calculated areas, and notes regarding the calculations are provided in in Table B-1. The areas provided in Table B-1 include the building roofs. The total area for all Plant A targets is 341,078 ft2.

Page 134 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table B-1: NP-768 Plant A Total Target Areas Exposed Target Target Surface Area

1. Description (ft2) Notes 1 Containment 70,372 See Figure B-2.

The Area is equal to the portions of the containment cylindrical wall that are exposed (i.e., not covered by adjacent building) plus the containment dome (a half-sphere).

The height of the exposed wall is equal to the height of the containment minus the radius of containment (the dome is assumed to be a half-sphere, so the height of the dome above the cylinder is equal to the radius) minus the height of the adjacent targets (2 and 3, which are of different heights).

2 Auxiliary 80,503 See Figure B-2.

Building The Area is equal to the area of two full walls (north and east), the exposed area of the west wall (subtracting the Target 1 and 3 areas), the area of the south wall not covered by Target 4, and the area of the roof.

The area of the roof does not include the portion occupied by the containment semicircle on the west end.

3 Fuel Handling 40,203 See Figure B-2.

Building The Area is equal to the area of three full walls (north, south and west) and the area of the roof. The east wall is not exposed, since Targets 1 and 2 are higher than Target 3.

The area of the roof does not include the portion occupied by the containment semicircle on the east end.

4 Diesel 22,000 The area includes three walls (east, south and west)

Generator and the roof. The north wall against Target 2 is not Building exposed.

5 Waste 95,600 This target is a standalone rectangular building. The Processing area includes all four walls and the roof.

Building 6 SW Intake 8,000 This target is a standalone rectangular building. The Structure area includes all four walls and the roof.

Page 135 of 226

September 21, 17 NEI 17-02, [Rev 1]

Exposed Target Target Surface Area

1. Description (ft2) Notes 7 Tanks 24,400 This target is a standalone rectangular building. The Enclosure area includes all four walls and the roof.

Total All Targets 341,078 Sum of areas for Targets 1 through 7 (including roof area).

As noted, the target areas in Table B-1 include vertical wall and horizontal roof areas. Roofs tend to have fewer missile hits per square foot than a vertical wall, since the roofs are elevated and require missile trajectories that are higher than the roof in order to eventually strike it as a vertical missile. The data in NP-768 does not distinguish which surface of a target is struck.

Since the roofs can be a substantial portion of the building surface area, considering the entire target area when deriving MIP may tend to underestimate MIP, especially for targets that are near to the ground. To compensate for this, a second set of target areas were calculated that exclude the area of the roof. Table B-2 provides areas for the same seven targets as Table B-1, but does not include the roof areas, with one exception (Target 6). The total area for all Plant A targets, excluding roof areas, is 185,984 ft2. The use of these different target areas (i.e., with and without the roof area) in deriving the MIP is described in Section B.4.

Table B-2: NP-768 Plant A Target Areas Excluding Roofs Exposed Target Target Surface Area

1. Description (ft2) Notes 1 Containment 39,584 Without the dome (a half-sphere) 2 Auxiliary Bldg. 44,200 Without the roof 3 Fuel Handling 25,800 Without the roof Bldg.

4 Diesel 14,000 Without the roof Generator Bldg.

5 Waste 38,400 Without the roof Processing Bldg.

6 SW Intake 8,000 Includes the roof, since the building is only 20 Structure feet high 7 Tanks Enclosure 16,000 Without the roof Total All Targets 185,984 Sum of areas for Targets 1 through 7 (without roofs).

B.3.2 SELECTION OF CONSERVATIVE TORNADO REGION MIP Ideally, the MIP should not differ between NRC Tornado Regions I, II, and III, since the only difference between the regions is the tornado frequency. The MIP is normalized by tornado frequency, so it should be consistent from one tornado region to the other. Since P is provided for each NRC Tornado Regions in NP-768 Table 3-15, MIP was derived for each region for each tornado category and compared. For F2 and F3 tornadoes, the derived MIP was consistent across NRC Tornado Regions. However, for F4 through F6, there were differences between derived MIPs. There is no specific discussion in NP-768 as Page 136 of 226

September 21, 17 NEI 17-02, [Rev 1]

to why the hit probability per missile/area/tornado would vary from one tornado region to another; the differences are believed to be the result of Monte Carlo sampling and associated modeling.

Nonetheless, in order to account for the uncertainty associated with these results, the highest derived MIP value for each F-scale tornado across the three regions was selected for the TMRE.

B.3.3 SEPARATE MIP DERIVATION FOR ELEVATED TARGETS AND NEAR GROUND TARGETS Two factors are responsible for the decision to derive MIP values for different target elevations (near ground versus elevated):

• Elevated targets are less likely to be hit by a tornado missile compared to near the ground (where most missiles originate).

• The hit probability data in NP-768 includes hits on any target surface, including the roof.

Knowing that missile hit probability is less at a higher elevation than at a lower elevation, MIP values derived from the target hit probability divided by the entire target area would be biased to a smaller value. The missile hit probability data in NP-768 cannot be separated by target surface. However, deriving MIP using the entire hit probability, but only the vertical wall area (and not the roof area),

would tend to bias MIP towards a larger value (since it would include all missile hits on a target but not the entire target area).

Calculating only one set of MIP values in this manner would result in conservative MIPs for elevated targets. Therefore, it was decided to derive two sets of MIPs, one for elevated targets and one for near ground targets. The different target areas in Tables B-1 and B-2 are used for the calculations.

B.4 MIP VALUES FOR USE IN THE TMRE MIP values were derived from NP-768 Plant A single-missile hit probabilities (the H-value P), based on the data provided in NP-768 Table 3-15. MIP values are provided for each F-scale tornado, from F2 through F6, for near ground and elevated targets.

The demarcation between near ground and elevated targets is 30 feet above the primary missile source for a target. This is typically plant grade, since most damaging missile at a NPP originate at or near grade.

B.4.1 NEAR GROUND TARGET MIP For TMRE targets near the ground (defined as less than 30 above grade), the MIP is derived using the target areas listed in Table B-2, which generally excludes the area of the roof. Since missile hits on roofs are expected to be a small percentage of the total missile hits, excluding the roof areas while still counting all hits on the target, will provide a higher value that should be more representative of the lower elevation targets. One exception is Target 6, for which the roof area is included, since it is only 20 feet above grade.

Table B-3 provides the derived MIP values for the three tornado regions for Near Ground targets. The bolded values represent the highest values.

Page 137 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table B-3: Plant "A" Tornado Missile Impact Parameters for Near Ground Targets MIP (per missile per ft2 per tornado interval frequency)

F Scale NRC Region I NRC Region II NRC Region III Category F2 1.1E-10 1.1E-10 1.1E-10 F3 3.6E-10 3.6E-10 3.6E-10 F4 4.2E-10 4.1E-10 6.3E-10 F5 1.6E-09 1.4E-09 N/A(1)

F6 2.4E-09 N/A(1) N/A(1)

(1)

No hit values are provided in NP-768 Table 3-15 for these combinations of tornado category and NRC region B.4.2 ELEVATED TARGET MIP For the elevated MIP value (i.e., for targets greater than 30), the area used to derive the MIP includes all the areas listed in Table B-1, which includes roof areas. Table B-4 provides the derived MIP values for the 3 tornado regions for Elevated targets. The bolded values represent the highest values.

Table B-4: Plant "A" Tornado Missile Impact Parameters for Elevated Targets MIP (per missile per ft2 per tornado interval frequency)

F Scale NRC Region I NRC Region II NRC Region III Category F2 5.8E-11 5.8E-11 5.8E-11 F3 2.0E-10 2.0E-10 2.0E-10 F4 2.3E-10 2.3E-10 3.4E-10 F5 8.7E-10 7.6E-10 N/A(1)

(1)

F6 1.3E-09 N/A N/A(1)

(1)

No hit values are provided in NP-768 Table 3-15 for these combinations of tornado category and NRC region B.4.3

SUMMARY

OF MIP VALUES Table B-5 lists the MIP values for all targets; the MIP values provided herein are the highest values from Tables B-3 and B-4.

Page 138 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table B-5: MIP Values for Use in the TMRE MIP (per missile per ft2 per tornado interval frequency)

Tornado Targets <30 above Targets >30 above grade(1)

Category grade(1)

F'2 5.8E-11 1.1E-10 F'3 2.0E-10 3.6E-10 F'4 3.4E-10 6.3E-10 F'5 8.7E-10 1.6E-09 F'6 1.3E-09 2.4E-09 (1)

The term grade here is meant to refer to the elevation at which a majority of the missiles that can affect the target is located. Typically, this is plant grade, although for some targets it may be different.

B.4.4 POTENTIAL FOR STATISTICAL CORRELATION BETWEEN TARGETS This section addresses statistical correlation between nearby targets. That is, for a given tornado strike on a site, nearby targets may be postulated to have a greater probability of being struck by separate missiles than the product of the two independent strike probabilities.

The consideration of correlated targets is not required as part of the TMRE method. Recent High Winds PRAs do not consider targets statistically correlated; all targets are considered independent unless they are so close to each other that they can be struck by the same missile. In those cases, the targets are grouped together as a single target. Therefore, it is reasonable that the TMRE does not consider statistical correlation between targets.

Correlation between nearby targets implies a greater probability for multiple targets to be struck by separate missiles, in the same tornado event, than the product of multiple independent strikes. That is, for two nearby targets A and B:

Pmissile(A*B) > Pmissile(A)

• Pmissile(B)

EPRI NP-768 [Ref. B.1] evaluated the probability of two adjacent targets (targets 6 and 8 in Plant B) being hit by separate missiles (i.e., the intersection probability PN(68)) and compared that to the probability of either target being hit by a missile (i.e., the union probability PN(6U8)). NP-768, Table 3-23 provides the values for PN(68) and PN(6U8) for Tornado Regions I - III.

The ratio of PN(68) / PN(6U8) represents the likelihood that both targets 6 and 8 will be hit by separate missiles given that either target 6 or 8 are hit. The value obtained for this ratio was 2.7E-3 for all three tornado regions (the fact that all three tornado regions have the same ratio is not unexpected). This Page 139 of 226

September 21, 17 NEI 17-02, [Rev 1]

ratio implies that, for the example in NP-768, the probability that statistically correlated missile strikes on two nearby targets is much less than 1% of the probability that either are hit. 16 B.5 MISSILE INVENTORIES The EPRI NP-768 tornado simulations indicate that, for wind-driven missiles of sufficient mass to damage NPP SSCs, the mean transport distance is less than 350 feet. Missile transport beyond 1000 feet is rare, and transport beyond 2000 feet is very unlikely. The NP-768 missile hazard study considered missiles within approximately 2500 feet of the targets. In order to be consistent with the derivation of MIP from the TORMIS simulation data, the missile inventories used in the TMRE must also include missiles within approximately 2500 of targets.

The TMRE process was developed to be as standardized as possible for application across the U.S. NPP fleet. To support this goal and facilitate review and approval of TMRE results, generic missile inventory values are provided. Data from five U.S. NPP TORMIS analyses were used to develop the generic TMRE missile inventories; missile count walkdowns were performed to support the TORMIS analyses at these five sites in the U.S. The maximum values from these missile surveys [Refs, B.12, B.13, B.14, B.15, B.16]

are used in the TMRE, given that the site-specific walkdown performed in support of the TMRE validates that this generic missile inventory is bounding (see Section 3). It is expected that the maximum values provided here will bound most sites.

Two general types of missiles are provided in each of the missile inventories: zonal and structure missiles.

In general, the zonal missiles are constant across the tornado intensity range. The difference in the ability of these types of missiles to become airborne and fly to the extent needed to hit and damage a target is accounted for in the MIP. The missile inventory data from the five plants show constant zonal missile inventories for all tornado categories.

The structure-based missiles are the result of weaker structures (steel- or wood-frame buildings constructed to standard building code requirements) deconstructing due to tornado winds. The amount of missiles created is dependent on the type of structure and the wind speeds associated with the tornado. Therefore, structure-based missile inventories tend to increase with increasing tornado intensity. The structure missile inventory data for three of the plants increase with tornado category, as expected. Structure missile data for two of the plants is constant; for these plants the maximum number of missiles associated with full structure deconstruction was used for all tornado categories.

Tables B-6 through B-10 provide the missile inventories from each of the five sites surveyed.

Table B-6: Missile Inventories for Plant 1 Tornado Zonal Structural Total Category Missiles Missiles Missiles 16 In a sensitivity study from a recent high winds PRA (that utilized TORMIS), two valves that were close to each other were evaluated for statistical correlation. The same ratio described here was calculated for these two targets and it varied from 1.3E-3 (EF1) to 2.9E-3 (EF5). This compares well with the correlation value determined from NP-768.

Page 140 of 226

September 21, 17 NEI 17-02, [Rev 1]

F'2 38,267 67,799 106,066 F'3 38,267 67,799 106,066 F'4 38,267 67,799 106,066 F'5 38,267 67,799 106,066 F'6 38,267 67,799 106,066 Table B-7: Missile Inventories for Plant 2 Tornado Zonal Structural Total Category Missiles Missiles Missiles F'2 67,134 85,876 153,010 F'3 67,134 85,876 153,010 F'4 67,134 85,876 153,010 F'5 67,134 85,876 153,010 F'6 67,134 85,876 153,010 Table B-8: Missile Inventories for Plant 3 Tornado Zonal Structural Total Category Missiles Missiles Missiles F'2 92,851 2,814 95,665 F'3 92,851 35,375 128,226 F'4 92,851 108,526 201,377 F'5 92,851 139,555 232,406 F'6 92,851 139,555 232,406 Table B-9: Missile Inventories for Plant 4 Tornado Zonal Structural Total Category Missiles Missiles Missiles F'2 37,751 13,534 51,285 F'3 37,751 81,826 119,577 F'4 37,751 162,821 200,572 F'5 37,751 201,123 238,874 F'6 37,751 201,123 238,874 Page 141 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table B-10: Missile Inventories for Plant 5 Tornado Zonal Structural Total Category Missiles Missiles Missiles F'2 75,369 4,636 80,005 F'3 75,369 33,095 108,464 F'4 75,369 101,511 176,880 F'5 75,369 127,734 203,103 F'6 75,369 127,734 203,103 Table B-11 lists the maximum number of missiles for each tornado category, F2 through F6, from Tables B-6 through B-10. The final column lists the total missile inventory for use in the TMRE, based on rounding up the highest value to the nearest 5,000 missiles.

Table B-11: Total Missile Inventories for Use in the TMRE Tornado Maximum Missiles TMRE Missile Category from Sample Inventory F'2 153,010 (Plant B) 155,000 F'3 153,010 (Plant B) 155,000 F'4 201,377 (Plant C) 205,000 F'5 238,874 (Plant D) 240,000 F'6 238,874 (Plant D) 240,000 B.6 MISSILES AFFECTING ROBUST TARGETS SSCs that are robust in nature are not affected by all potential tornado missiles. The number of missiles used in the EEFP calculation can be adjusted to account for the population of missiles that can damage an SSC. Targets considered robust for the purpose of the TMRE include steel tanks, steel pipes, reinforced concrete roofs, and metal doors. A set of robust targets were evaluated in Appendix C against the spectrum of missile types considered in the TMRE. The results of the calculations documented in Table C.6 were consolidated to determine the percentage of the total missile inventory for each type of robust target. The final values determined are listed in Table B-18. The process used to develop this table is described in this section. For SSCs not considered robust (i.e., that do not meet the descriptions in Table B-13), the full missile inventories listed in Table B-11 are used in the EEFP calculations.

Page 142 of 226

September 21, 17 NEI 17-02, [Rev 1]

B.6.1 CATEGORIZING ROBUST TARGETS A variety of SSCs with different characteristics were evaluated for different failure modes in Appendix C.

In order to simplify the results of the Appendix C calculations, some similar SSC types were binned together, using the characteristics of the least robust target type for that group. This consolidated the robust target types into nine categories designated Category A through I, defined in Table B-13. Table B-12 provides the grouping of target types from the results of Section C6.

Table B-12: Robust Target Descriptions Failure Diameter Thickness Assigned Description(1) Mode (inches) (inches) Category Crushing > 36 0.375 A Diesel Generator Exhaust Pipe 50%

Crushing > 16 0.50 A SG Steam Relief Valve Tailpipe 50%

Turbine Driven Feedwater Pump Crushing > 20 0.375 A Exhaust Piping 50%

Steam Generator Power Crushing > 18 0.375 A Operated RV Exh Pipe 50%

Diesel Generator Air intake Crushing > 16 0.125 B (small) 50%

Diesel Generator Air intake Crushing > 48 0.125 B (large) 50%

Crushing > 22 0.375 A Diesel Generator Exh Silencer 50%

Condensate Storage Tank Perforation NA 0.25 C (t=0.25") or Global Perforation NA 0.133 D Diesel Fuel Oil Tank (t=0.133") or Global Perforation NA 0.145 D Diesel Fuel Oil Tank (t=0.145") or Global Condensate Storage Tank Perforation NA 0.375 C (t=0.375") or Global Perforation 6 0.237 F Low Pressure Water Pipe or Global Perforation 10 0.237 F Low Pressure Water Pipe or Global Perforation 36 0.985 E Main Steam Piping (t=0.985") or Global Perforation NA 0.1 G Room Door (t=0.1")(2) or Global Perforation 18 0.375 E Low Pressure Water Pipe or Global Perforation 10 0.432 E High Pressure Water Pipe or Global Page 143 of 226

September 21, 17 NEI 17-02, [Rev 1]

Failure Diameter Thickness Assigned (1)

Description Mode (inches) (inches) Category Concrete roofs(3) 8" reinforced concrete roof(3) Perforation NA 8.0 H 4" reinforced concrete roof with Perforation NA 4.0 I steel decking(4)

Notes:

(1) All piping, tanks, and the room door are steel (2) Steel door is a standard 16 or 18 gauge door, with equivalent thickness of 0.1 steel.

Thicknesses based on SD-108 (each inside and outside face steel sheet varies between 0.042 (18 gauge) and 0.053 (16 gauge) [Ref. B-17].

(3) Only applies to roofs, not walls; reduced missile speeds (assuming vertical missiles) were used to calculate perforation.

Table B-13: Robust Target Descriptions Category Target Description Failure Mode A Steel Pipe - at least 16 diameter and Crushing/Crimping of >

3/8 thickness 50%

B Steel Pipe - at least 16 diameter and Crushing/Crimping of >

thickness less than 3/8 but at least 50%

0.125 C Steel Tank - at least 0.25 thickness Penetration or Global Failure D Steel Tank - less than 0.25 thickness Penetration or Global Failure E Steel Pipe - at least 10 diameter and Penetration or Global 3/8 thickness Failure F Steel Pipe - Less than 10 diameter or Penetration or Global 3/8 thickness Failure G Steel Door Penetration or Global Failure H Concrete Roof - Reinforced, at least Penetration or Global 8 thick Failure I Concrete Roof - Reinforced, at least Penetration or Global 4 thick Failure The table in Section C6 provides indication of the damage produced by each missile type for each target.

The missile set which causes failure for each of the robust target categories in Table B-13 is based on the most limiting case for each category. If a missile type causes damage to any of the targets in the category, it is assumed to cause damage for the whole category. Table B-14 provides a matrix of missile types that damage each target category. Filled cells in the matrix indicate that the missile type causes failure of the target category type.

Page 144 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table B-14: Robust Target Missile Matrix Robust Category Type Missile Type A B C D E F G H I 1 - Rebar 2 - Gas Cylinder 3 - Drum, tank 4 - Utility Pole 5 - Cable Reel 6 - 3 Pipe 7 - 6 Pipe 8 - 12 Pipe 9 - Storage bin 10 - Concrete Paver 11 - Concrete Block 12 - Wood Beam 13 - Wood Plank 14 - Metal Siding 15 - Plywood Sheet 16 - Wide Flange 17 - Channel Section 18 - Small Equipment 19 - Large Equipment 20 - Frame/Grating 21 - Large Steel Frame 22 - Vehicle 23 - Tree Indicates that missile type fails the target category B.6.2 MISSILE TYPE INVENTORIES In order to provide a simplified and consistent percentage of missile types for the TMRE application, generic missile inventories were developed. Specific missile type counts were taken from 2 plant missile inventories (from Plants 1 and 2), provided in Tables B-15 and B-16. Table B-15 provides the inventory of unrestrained (zonal) missiles and Table B-16 provides the restrained (structural) missile inventory 17; see Section B.5 for a discussion of these terms.

17 The missile inventory data for Plants 1 and 2, provided in Tables B-15 and B-16 were reported as unrestrained and restrained populations. These are equivalent to zonal and structural missiles, the terminology used in this guidance. Regardless, the total values for each missile type are used (Table B-17), so the delineation between restrained and unrestrained does not have an impact.

Page 145 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table B-15: Unrestrained Missile Inventories Missile Type Plant 1 Plant 2 1 - Rebar 15,707 23417 2 - Gas Cylinder 444 1149 3 - Drum, tank 369 448 4 - Utility Pole 50 0 5 - Cable Reel(1) 150 150 6 - 3 Pipe 4,404 4,754 7 - 6 Pipe 418 855 8 - 12 Pipe 278 25 9 - Storage bin(2) 250 250 10 - Concrete Paver 0 4,240 11 - Concrete Block(3) 5,000 5,000 12 - Wood Beam 557 260 13 - Wood Plank 4,400 19,990 14 - Metal Siding 2,270 261 15 - Plywood Sheet 5,561 8,655 16 - Wide Flange 219 249 17 - Channel Section 880 1,953 18 - Small Equipment(4) 200 200 19 - Large Equipment 450 329 20 - Frame/Grating 0 108 21 - Large Steel Frame(5) 150 150 22 - Vehicle 960 1,695 23 - Tree 1,300 0 TOTAL 44,017 74,138 Table B-16: Restrained Missile Inventories Missile Type Plant 1 Plant 2 1 - Rebar 1,545 2,271 2 - Gas Cylinder 0 0 3 - Drum, tank 0 0 4 - Utility Pole 37 226 (1) 5 - Cable Reel 600 600 6 - 3 Pipe 15,034 14,762 7 - 6 Pipe 354 456 8 - 12 Pipe 0 90 (2) 9 - Storage bin 2,500 2,500 (6) 10 - Concrete Paver 2,500 2,500 (3) 11 - Concrete Block 25,000 25,000 12 - Wood Beam 4,053 217 Page 146 of 226

September 21, 17 NEI 17-02, [Rev 1]

Missile Type Plant 1 Plant 2 13 - Wood Plank 75 1,192 14 - Metal Siding 24,867 30,650 15 - Plywood Sheet 2,975 9,247 16 - Wide Flange 200 285 17 - Channel Section 11,509 10,259 18 - Small Equipment(4) 1,500 1,500 19 - Large Equipment(7) 400 400 20 - Frame/Grating(8) 3,000 3,000 21 - Large Steel Frame(5) 700 700 22 - Vehicle 0 0 23 - Tree 7,150 14,738 TOTAL 103,999 120,593 Notes for Tables B-15 and B-16 18:

(1) No cable reels counted for either plant; assumed 150 for unrestrained and 600 for restrained, per plant.

(2) No storage bins counted for either plant; assumed 250 for unrestrained and 2,500 for restrained, per plant.

(3) No concrete blocks counted for either plant; assumed 5,000 for unrestrained and 25,000 for restrained, per plant.

(4) No small equipment counted for either plant; assumed 200 for unrestrained and 1,500 for restrained, per plant.

(5) No steel frames counted for either plant; assumed 150 for unrestrained and 700 for restrained, per plant.

(6) No structural concrete pavers for either plant; assumed 2,500 per plant (restrained only)

(7) No large equipment from structures for either plant; assumed 400 per plant (restrained only)

(8) No frame/grating from structures for either plant; assumed 700 per plant (restrained only)

In order to determine the generic percentage for each missile type, the totals for each missile type from the unrestrained and restrained missiles were combined and averaged (between the two plants). The averages were normalized to determine the percentage of each missile type, which is provided in Table B-17. Note: the sum of the values in Table B-17 is greater than 100% due to rounding.

Table B-17: Average Missile Type Inventory Missile Type Percentage 1 - Rebar 13%

2 - Gas Cylinder 0.5%

3 - Drum, tank 0.2%

18 No inventories for certain missile types were provided for Plants 1 and 2; estimates were made based on walkdown experience at other sites.

Page 147 of 226

September 21, 17 NEI 17-02, [Rev 1]

Missile Type Percentage 4 - Utility Pole 0.1%

5 - Cable Reel 0.4%

6 - 3 Pipe 11%

7 - 6 Pipe 0.6%

8 - 12 Pipe 0.1%

9 - Storage bin 1.6%

10 - Concrete Paver 2.7%

11 - Concrete Block 18%

12 - Wood Beam 1.5%

13 - Wood Plank 7.5%

14 - Metal Siding 17%

15 - Plywood Sheet 7.7%

16 - Wide Flange 0.3%

17 - Channel Section 7.2%

18 - Small Equipment 1.0%

19 - Large Equipment 0.5%

20 - Frame/Grating 1.8%

21 - Large Steel Frame 0.5%

22 - Vehicle 0.8%

23 - Tree 6.8%

TOTAL 100%

Combining the results from Table B-14 and Table B-17 provides the percentage of missiles that can damage each robust target category, as shown in Table B-18.

Table B-18 Missile Damage Capability Category Target Description Failure Mode Calculated Final Percentage Percentage A Steel Pipe - at least 16 Crushing/Crimping 5% 5%

diameter and 3/8 thickness of > 50%

B Steel Pipe - at least 16 Crushing/Crimping 53% 55%

diameter and thickness less of > 50%

than 3/8 but at least 0.125 C Steel Tank - at least 0.25 Penetration or 37% 40%

thickness Global Failure D Steel Tank - less than 0.25 Penetration or 46% 50%

thickness Global Failure E Steel Pipe - at least 10 Penetration or 34% 35%

diameter and 3/8 thickness Global Failure F Steel Pipe - Less than 10 Penetration or 46% 50%

diameter or 3/8 thickness Global Failure Page 148 of 226

September 21, 17 NEI 17-02, [Rev 1]

Category Target Description Failure Mode Calculated Final Percentage Percentage G Steel Door Penetration or 44% 45%

Global Failure H Concrete Roof - Reinforced, Penetration or 1% 1%

at least 8 thick Global Failure I Concrete Roof - Reinforced, Penetration or 17% 20%

at least 4 thick Global Failure B.7 REFERENCES

1. EPRI NP-768, Tornado Missile Risk Analysis, Final Report, May 1978.

2. NUREG/CR-4448, Shutdown Decay Heat Removal Analysis of a General Electric BWR3/Mark I, US Nuclear Regulatory Commission, March 1987.

3. NUREG/CR-4767, Shutdown Decay Heat Removal Analysis of a General Electric BWR4/Mark I, US Nuclear Regulatory Commission, July 1987.

4. NUREG/CR-4710, Shutdown Decay Heat Removal Analysis of a Combustion Engineering 2-Loop Pressurized Water Reactor, US Nuclear Regulatory Commission, August 1987.

5. NUREG/CR-4762, Shutdown Decay Heat Removal Analysis of a Westinghouse 3-Loop Pressurized Water Reactor, US Nuclear Regulatory Commission, March 1987.

6. NUREG/CR-4458, Shutdown Decay Heat Removal Analysis of a Westinghouse 2-Loop Pressurized Water Reactor, US Nuclear Regulatory Commission, March 1987.

7. NUREG/CR-4713, Shutdown Decay Heat Removal Analysis of a Babcock and Wilcox Pressurized Water Reactor, US Nuclear Regulatory Commission, March 1987.

8. EPRI NP-769, Tornado Missile Risk Analysis - Appendices, May 1978.

9. High-Wind Risk Assessment Guidelines. EPRI, Palo Alto, CA: 2015. 3002003107

10. Enforcement Guidance Memorandum 15-002, Revision 1: Enforcement Discretion for Tornado-generated Missile Protection Non-compliance, U.S. NRC, February 7, 2017.

11. Bounding Generic Risk Assessment for Selected Plant Systems, Portions of Which are not Protected from Tornado-generated Missiles, U.S. NRC, April 2014 (ADAMS Accession No. ML14114A556).

12. Exelon Nuclear Analysis No. IP-S-0246, Tornado Missile Hazard Analysis for Clinton Power Station (EC 366599 Rev. 0), 10/25/07.

13. Davis-Besse Nuclear Power Station Unit 1, Walkdown Report Potential Tornado Missile Population, Revision 0, 8/22/07 Page 149 of 226

September 21, 17 NEI 17-02, [Rev 1]

14. Data extracted from Southern Nuclear calculation SC-SNC346922-001 Version 1.0., regarding tornado missiles at Joseph M. Farley Nuclear Power Plant.

15. Exelon Nuclear RS-16-118, Letter to U.S. Nuclear Regulatory Commission, License Amendment Request to Utilize the TORMIS Computer Code Methodology (NRC Docket Nos. STN 50-454 and STN 50-455), October 7, 2016.

16. DTE Energy NRC-13-0002, Proposed License Amendment to Revise the Fermi 2 Licensing Bases for Protection from Tornado-Generated Missiles, January 11, 2013

17. Steel Door Institute, Recommended Selection and Usage Guide for Standard Steel Doors, Technical Data Series SDI 108-10, Reaffirmed 2014.

Page 150 of 226

September 21, 17 NEI 17-02, [Rev 1]

APPENDIX C: BASES FOR TARGET ROBUSTNESS AND MISSILE CHARACTERISTICS C.1 PURPOSE The purpose of this report appendix is to provide a summary of the technical approach for evaluating the robustness of typical Nuclear Power Plant (NPP) Structures, Systems, and Components (SSC) against the effects of wind-borne missile impacts. The range of SSCs, or targets, that was considered in this evaluation includes those that are commonly evaluated in high-wind risk evaluations, such as piping, liquid storage tanks, metal doors, and reinforced concrete roofs.

The spectrum of wind-borne missiles considered in this evaluation is based on the types of missiles described in Table 3-2 of this report. The missiles include a range of non-deformable and deformable wind projectiles: wood timbers, steel pipes, construction equipment, small trees, masonry units, pavers, and an automobile. The weights of these missiles ranged from 8 lbs. to 4,000 lbs.

The maximum horizontal missile impact velocity considered in this evaluation is 230 mph, which bounds most of the missile impact velocities described in the 1975 Standard Review Plan (SRP) Section 3.5.1.

The maximum vertical missile impact velocity is 153 mph (2/3 x 230 mph) for reinforced concrete roof impacts. A review of more recent regulatory guidance pertaining to wind-borne missiles, including RG 1.76 (2007)) and RG 1.221 (2011), finds that the 230 mph horizontal impact velocity is slightly conservative. The highest horizontal missile impact speed cited in the most current NRC guidance is 92 mph (RG 1.76) for tornado winds and 209 mph (RG 1.221) for hurricane winds.

The results of these analyses are used to estimate the number of missiles that could cause damage to pipe, tank, steel door, and concrete targets. A summary of the number of damaging missiles for each of these targets is shown in Figure 5-2 of this report.

C.2. BACKGROUND The design of nuclear power plant facilities includes the effects missile impacts on structures, systems, and components. SRP Section 3.5.3 [1] provides guidance and acceptance criteria for the evaluation of barrier design procedures to ensure conformance with 10 CFR 50, Appendix A, General Design Criteria 2 and 4. This SRP section provides acceptance criteria for the prediction of local damage and overall response of safety-significant missile barrier. SRP Section 3.5.3 also references the acceptable use of the empirical equations, such as the Ballistic Research Lab (BRL) equation(s), to estimate effects of missile penetration on steel and concrete structures. This SRP section also requires an evaluation of overall (or global) structural effects. Both local and global evaluations were done for each target evaluated.

The targets assumed in this evaluation were representative of piping, tanks, doors, and reinforced concrete roofs. The piping targets had diameters and thicknesses ranging from 6-48 inches and 0.10-0.98 inches, respectively. The range of tank wall thicknesses ranged from 0.125 to 0.378 inches. All steel targets were conservatively assumed to have a design yield strength of 30,000 psi. Reinforced concrete roofs were assumed to have thicknesses of 4 and 8 inches and corresponding spans were assumed to be 4-ft and 20-ft, respectively. Figure C-1 indicates examples of potential wind-borne missile targets.

Page 151 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-1. Representative targets 19: (a) condensate storage tank, (b) steam exhaust stacks, (c) diesel generator mufflers, and (d) steel composite concrete roof (interior view)

C.3. APPROACH The impact of a missile onto a target is a complex dynamic problem. The phenomena typically involve nonlinear material behavior and high strain rates for both the missile and target. The problem of wind-driven missiles is further complicated, because these missiles are not engineered to penetrate a hardened target (i.e., remain rigid). Rather, these missiles are typically deformable such that they are susceptible to fail by buckling or shattering before they can penetrate a target. Detailed nonlinear finite-element analysis methods can be utilized for evaluating missile impacts, but due to the complexity of this class of problem and lack of relevant experimental tests (for validation purposes), uncertainty in final results is not necessarily reduced. Nonetheless, as missile impact is considered in the design of nuclear power plant structures, NRC and industry guidance exist for developing approximate demands on structures without requiring sophisticated analysis methods. Standard practice methods include the use of single degree-of-freedom models for representing the target capacity (force-displacement) and the use of forcing functions to represent the missile impact.

As the number of EPRI missile and target combinations to be analyzed was more than 400 (~23 missiles x 19 targets), a pragmatic approach was developed for the TMRE to estimate target damage. The approach relies on an analytical approach that is consistent with the NRC SRP Section 3.5.3 [1]. The approach makes accounts for missile characteristics such as impact speed, missile mass, and target 19 Source: EPRI walkdown report [6]

Page 152 of 226

September 21, 17 NEI 17-02, [Rev 1]

characteristics such as stiffness, ultimate capacity, and mass. The analysis of pipe crimping was benchmarked to two relevant experiments.

While median material properties were assumed to develop a best-estimate of target capacity, conservative assumptions were made with respect to missile strike location and orientation. It was assumed that missile impacts are normal to the target surface and that the axis of the missile is parallel to the line of flight. For impacts on pipes, the effectiveness of the missile impact degrades significantly as the strike location is offset from the centerline of the pipe.

Target Response For the analysis of local effects (penetration/perforation) on the targets considered in this evaluation, the BRL equations were relied upon. Section C3.1 describes the approach for evaluating local effects.

For the evaluation of overall (or global) impact effects on NPP structures, each target was idealized as a single-degree-of-freedom (SDOF) lumped mass model. The relatively high-velocity impact scenarios

(>100 mph), were assumed to be plastic (consistent with SRP Section 3.5.4) resulting in the missile mass being included in the effective mass of the target. The initial condition of the SDOF equation-of-motion is initial velocity, which is derived based on the conservation of momentum between the missile and target. Numerical integration of the SDOF equation of motion is performed to estimate target displacement as a function of time. The subsequent target response (displacements, strains, etc.) can be compared to allowable limits. The lumped mass modeling approach is a common engineering dynamic analysis tool [12] and has been used in the design nuclear of power plants [7].

It is recognized that some design methods rely on idealizing the missile with a forcing function (force versus time) rather than estimating an initial target velocity. However, the forcing function approach, which relies on a rigid (non-moving) target, can provide overly conservative force estimates for compliant structures. For design purposes, members can be made sufficiently stiff to resist the assumed forcing function. For evaluating existing SSCs, which are likely compliant targets, the initial velocity approach is a reasonable alternative. A comparison of results between models making use of a forcing function or an initial velocity condition showed reasonable agreement in predicted displacements.

Modes of Failure The failure modes considered for the targets varied depending on target type (Table C-1). Steel pipe sections were evaluated for both local effects and global effects. Local effects relate to localized perforation (or punching shear) and is dependent on pipe (or wall) thickness, rather than structural response of a pipe, tank, or concrete panel. For this evaluation, these effects were assessed with the use of empirical equations. Global effects relate to the overall flexural response (or bending) of pipes, tanks, and concrete panels. These global modes are influenced by structural section properties (wall thickness, diameter, etc.) as well as member span and boundary conditions. Global effects also relate to pipe crushing and crimping, as both circumferential and longitudinal pipe response are factors.

For piping targets, the critical section was assumed to be the location of missile impact. As piping configurations and support conditions vary considerably, it was considered reasonable to idealize the pipe boundary conditions as being supported on one end by a fully clamped condition and on the opposite end as a pinned or simple support condition.

Page 153 of 226

September 21, 17 NEI 17-02, [Rev 1]

While the effect of a cantilevered pipe was also considered, it was judged that this boundary condition was not as limiting as the condition of a pipe supported at both ends. This conclusion is based on the following observations: (a) the significantly lower flexural rigidity of a cantilevered pipe (~16 times less than a pipe supported on both ends) will absorb more impact energy and result in lower deformations at the point of impact (i.e., less crushing), (b) the cantilevered pipe has a higher effective mass (and inertia) than a pipe supported at both ends, which helps to resist inertial forces caused by impact, and (c) dynamic analysis indicates that while some missiles may cause plastic deformation at the cantilevered pipe support, the support rotation remains with allowable limits [13]. While larger/heavier missiles may cause failure of the cantilevered pipe support, these same missiles also result in failure of the pipe supported at both ends.

Liquid-filled steel tanks were also evaluated for perforation and flexural failure of the shell in the vicinity of the missile impact (Section C3.3). The added mass of the tank fluid (water) was considered in the dynamic model, but the stiffening effect (incompressible fluid) is conservatively neglected. The tanks were conservatively modeled as ring structures, so the additional stiffness contributed from the top/bottom of the tanks were not considered.

Reinforced concrete roofs were evaluated for local perforation and overall slab response (Section C3.4).

Rotations at the slab supports were compared to ASCE allowable limits [13].

Table C Significant Evaluation Assumptions Target Type Relevant Failure Modes Assumptions Stacks and Exhaust Crimping/crushing at impact Impact at center span of pipe. Under Pipes location impact conditions, a pipe supported at Fluid/Steam Pipes Perforation and both ends is subjected to higher crushing crimping/crushing at impact forces (at point of impact) than at location cantilevered pipe.

Tanks Perforation and global* Impact at mid-height of tank shell. Added mass of fluid accounted for.

Doors Perforation and global** Impact at center of door. Sandwich panel idealized as isotropic plate.

RC Roofs Perforation and global*** Impact at center of roof slab. Supporting beams or bar joists not considered.

• Circumferential stiffness and flexural capacity of tank considered

• • Flexural stiffness and capacity of door panel considered

• • • Flexural and shear failure of roof panel considered C.3.1 PERFORATION EVALUATION The local effects of missile perforation were considered for all targets except for stacks and exhaust pipes. The functionality of stack and exhaust piping was judged to be more limited by crushing or crimping failure modes. Perforation effects on steel targets were assessed using the BRL equation:

2/3 MV 2 s

2 T=

672D T = steel plate thickness to just perforate (inches)

Page 154 of 226

September 21, 17 NEI 17-02, [Rev 1]

M = Mass of the missile (lb sec 2 /ft) ft Vs = striking velocity of the missile normal to target surface sec D = diameter of missile (in)

As perforation of a pipe or tank wall requires penetration of steel material, it was assumed that only missiles comprised of steel materials (pipes, beams, etc.) are capable of a perforation failure mode.

While deformable missiles are not likely to cause a perforation failure mode, these missiles were evaluated for their propensity to cause global structural damage (e.g., crushing/crimping).

For realistic analysis, missile impact velocity was assumed to be weight dependent, as described in NRC SRP (1975) Section 3.5.1.4 (Table C-2). This table indicates that as missile weight increases, horizontal impact velocity decreases. For this evaluation, a linear velocity-weight correlation was used (Figure C-3),

which conservatively bounded most of the SRP missile types.

Horizontal Velocity Horizontal Description (ft./sec) Velocity (mph) 4"x12" x 12 ft. long; 200 lb. 368 251 3" dia; Schedule 40, 15 ft. long; 115 lb. 268 183 1" dia; 3 ft. long, 8 lb. 259 177 6" dia; Schedule 40; 15 ft. long; 285 lb. 230 157 12" dia; Schedule 40; 30 ft. long; 1500 lb. 205 140 14" dia; 35 ft. long; 1500 lb. 241 164 Frontal area 20 ft2; 4000 lb. 100 68 Table C-2. SRP (1975) missile spectrum indicating variation of horizontal velocity with missile type.

Conversion to miles-per-hour (mph) also shown.

Page 155 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-3. Assumed missile impact velocity correlation used in this analysis (solid green line)

Concrete Perforation Perforation on concrete targets was assessed by the BRL formula [11]. For the concrete material, median values of compressive strength were assumed. Median strength, aging, and dynamic increase factors were assumed to be 1.15, 1.2, and 1.25, respectively [9]. For the reinforced concrete targets evaluated, concrete design strength was assumed to be 3,500 psi. Thus, for perforation calculations, a value of 6,037 psi was assumed (3,500 psi x 1.15 x 1.20 x 1.25 = 6,037 psi). In the case of deformable missiles, the limiting perforation thicknesses were reduced by 30% in accordance with DOE guidance

[11].

427 W Vs 1.33 T=

1.8 1,000 fc D T = thickness of concrete element to be just perforated (in)

W = weight of missile (lb)

D = diameter of missile (in) ft Vs = striking velocity of missile s

fc = compressive strength of concrete (psi)

Page 156 of 226

September 21, 17 NEI 17-02, [Rev 1]

C.3.2 PIPE CRUSHING AND CRIMPING All steel pipe sections where evaluated for local crushing and crimping effects. The pipe section was assumed to be fixed at one end and simple supported on the opposite end (Figure C-4). Pipe sections were assumed to be fixed at one end and simple-supported on the other. The pipe spans were assumed to be the maximum value of five pipe diameters or 120 inches. The 120-inch span corresponds to a realistic unsupported pipe length.

Figure C-4. Missile impact on a pipe target Pipe Impact Model When a missile impacts a target, significant forces are developed at the target interfaces. These forces decelerate the missile and accelerate the target. The impact scenarios considered in this evaluation and judged to result in plastic impact, where the missile remains in contact with the target.

A simplified pipe impact model was developed to evaluate the radial deflection of a thin-walled pipe subjected to a concentrated force. The model assumes linear elastic properties for the pipe and accounts for nonlinear behavior through the use of bi-linear force-deflection curve. Viscous damping was assumed to account for energy dissipation due to the large-strains and deformations involved. The method was benchmarked to two physical experiments (discussed below) and reasonable results were obtained. The model does not account for the resisting effects of membrane tension under larger deformations. This is judged to be a conservative bias.

The pipe target is represented as a single-degree-of-freedom model with a bilinear spring and viscous damper (Figure C-5). The bilinear resistance function represents the radial stiffness of the pipe and the plastic moment capacity of the pipe section. The derivation of the linear stiffness and plastic moment Page 157 of 226

September 21, 17 NEI 17-02, [Rev 1]

capacity is shown in Section C7.0. To account for strain rate effects, a dynamic increase factor was applied to yield stress of the steel pipe material.

The equation of motion of the pipe target is solved as an initial velocity problem and numerically integrated using a 4th-order Runge Kutta method [5]. The velocity of the combined system after the collision is derived from conservation of momentum.

Mm Vm = (Mm + Mt ) Vo Mm Vm Vo =

Mm + Mt Mm = Missile mass Mt = Target mass Vm = Missile impact velocity Vo = Target velocity Impact velocities were assumed to be horizontal and the missile was assumed to impact normal to the target surface. For highly-deformable missiles (plywood, grating, siding, etc.), the weight was reduced to 30% of the total mass to account for energy absorbed to crushing, buckling, etc. (Table C-2). DOE guidance on aircraft impact [11] describes that for highly-deformable missiles (e.g., aircraft fuselage), a significant portion of impact energy is dissipated in deforming the missile. The effective mass will be significantly less than the total mass of the missile. DOE guidance limits the reduction to 30% of the total missile mass.

Table C Effective Mass Factor Missile Characterization Example Missiles Effective Mass factor Non-Deformable rebar, gas cylinder, steel pipe, steel beam, 0.9 (essentially rigid)

Deformable (higher toolbox, utility pole, tank drum, cable reel, 0.5 rigidity, but susceptible paver, concrete block, sawn lumber, small to crushing) motor, concrete mixer, steel grating, pallet rack, vehicle, concrete pipe Highly-Deformable (low Metal siding, plywood, 20 tree 0.3 rigidity and crush strength)

Page 158 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-5. Analytical model which utilizes a bi-linear resistance function The pipe radial stiffness, Kr, and ultimate capacity, Rur, is approximated below. Note that the details of their derivation are provided in Section C7.0.

9.28 E b t 3 Kr =

Dp 3 4 b t 2 Fy R ur =

Dp Based on the pipe support conditions, the longitudinal stiffness, Kl, and longitudinal flexural capacity, Rul, are derived using conventional beam relationships:

96 E I Kl =

L3 12 Fy I R ul =

Dp L K r = pipe radial stiffness lbin R ur = maximum pipe crush resistance (lb) lb E = pipe material elastic modulus 2 in Page 159 of 226

September 21, 17 NEI 17-02, [Rev 1]

lb Fy = pipe material yield stress in2 b = effective length of pipe (in); [assumed equal to pipe diameter]

t = pipe wall thickness (in)

Dp = mean pipe diameter (in)

I = pipe moment of inertia (in4 )

L = pipe span (in)

An equivalent pipe stiffness is derived by assuming the radial and longitudinal stiffnesses act in parallel:

1 1 1

= +

KE Kr Kl The equation-of-motion and initial conditions for the pipe system, shown in Figure C-5, is:

Me x + Cx + R(x) = 0 x(0) = 0 x (0) = Vt The system is solved as an initial velocity problem using a Runge-Kutta numerical integration method

[5]. The maximum displacement is estimated (Figure C-6.) and compared to an assumed limiting value. A displacement of more than 0.5 times the pipe diameter is considered failure of the pipe. A viscous damper was assumed in the model to represent the significant energy dissipation resulting from a highly nonlinear impact event. Critical damping values for both steel and concrete targets were assumed to be 15%, consistent with stress levels beyond yield and significant permanent deformation.

Pipe Displacement 12 10 Radial Displacement (in) 8 6

4 2

0 0 0.01 0.02 0.03 0.04 Time (sec)

Figure C-6. Example model displacement response.

Page 160 of 226

September 21, 17 NEI 17-02, [Rev 1]

Benchmarking To improve confidence in model predictions, comparisons of model results were made for two separate and relevant pipe impact experiments. The selected experiments involved the impact crush testing of thin steel tubes. The purpose of the experiments was to investigate offshore pipelines subjected to accidental loads, such as impacts from trawl gear or anchors. Due to the large radial deformations under impact conditions, it was judged that these experiments are relevant to problems involving wind-borne missile impacts on piping.

The first experiment involved drop testing of large weights (150 lbs) onto a 12-inch diameter steel pipe

[14]. This test series involved the measurement of impact forces and pipe displacements for Grade 60 steel pipes. These measured forces and displacements where compared to those predicted using the simplified modeling approach. Model predictions agreed reasonably well with the test (Figure C-7).

Based on a comparison of internal work (i.e., integral of the force-displacement curve), the model uncertainty is approximately 12%.

Figure C-7. Comparison of experiment and model results.

The second experiment involved pendulum impact tests on steel pipe sections [15] (Figures C-8 through C-10). The pipe sections were smaller in scale, but had thickness-to-diameter ratios comparable to exhaust pipes. The impactor was a heavy rigid steel anvil (weighing more than 3,000 lbs) attached to a trolley, which was capable of low impact speeds (less than 15 mph). Force and displacement transducers were used to measure impact force and pipe deformation, respectively. Some of the tested pipes had crush depths (or dents) greater than 50-percent of the pipe diameter. Six simplified analytical models were developed to represent each of the six test scenarios. Comparison of analytical model and experimental results is shown in Figure C-11. The estimated uncertainty in model results is approximately 25%, which is judged to be satisfactory, in light of the large pipe deformations involved.

Page 161 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-8. Pipe crimping experiment; impactor seen on the left side of the figure; source [15]

Figure C-9. Experimental setup; source [15]

Figure C-10. Dynamic impact test showing pipe crimping; source [15]

Page 162 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-11. Comparison of experiment and pipe crush model results Model Results Using the analytical model, various cases were run considering a wide range of missile types and pipes of various diameter and wall thicknesses. The results for the range of missile types and steel pipe targets considered in the TMRE are shown in Section C.8. In addition, the results are also shown in Figure C-12 below, which can be used to estimate pipe crush for wider range of impact scenarios. The green data points represent those cases that had pipe deformations less than 0.5 times the pipe diameter. The yellow data points represent threshold cases were the pipe deformation was greater than 0.5 times the pipe diameter but less than full crimping. The red data points represent cases where the pipe is estimated to be completely crushed/crimped.

Page 163 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-12. Pipe impact evaluation results (6 in < D < 48 in) and (0.10 in < t < 0.98 in); Nominal impact velocity = 230 mph C.3.3 EVALUATION OF LIQUID-FILLED STEEL TANKS Liquid-filled steel tanks were also evaluated for perforation and flexural failure of the shell in the vicinity of the missile impact (Table C-3). The added mass of the tank fluid (water) was considered in the dynamic model, but the stiffening effect (incompressible fluid) is conservatively neglected. The circular tank shells were modeled as ring structures and the additional stiffness contribution from the top enclosure and bottom foundation restraint were not considered. The exclusion of cylinder height in estimating tank stiffness is judged to be conservative.

Table C-3. Liquid-filled tank parameters Tank Description Tank Diameter (in) Tank Shell Thickness (in)

CST 576 0.375 CST 576 0.250 Diesel Fuel Oil Tank 120 0.250 Diesel Fuel Oil Tank 120 0.145 Diesel Fuel Oil Tank 120 0.133 Page 164 of 226

September 21, 17 NEI 17-02, [Rev 1]

The evaluation of tanks was performed using the same analytical model as described in Section C3.2.

The tank stiffness was approximated from the circumferential flexural shell frequency described by Den Hartog [8].

n(n2 1) EI n =

1 + n2 r 4 n = natural tank shell frequency n = number of full sine waves E = material modulus

= mass per unit length r = tank radius The mass of water was accounted for by smearing the water mass to the mass of the tank shell. The tank stiffness is estimated from:

k tank = meff n 2 meff = mtank shell + mwater The ultimate capacity of the tank shell was assumed to be:

R u_tank = 4Mp [7] ;

where Mp is the plastic moment capacity of the tank shell The effective mass of the tank was assumed to be 1/4 shell area for large tanks and 1/2 shell area for smaller tanks. The maximum displacement for the tank shell was assumed to be 3 times the elastic displacement (ductility ~3.0). This is judged to be conservative as ASCE standards allow for ductility ratios greater than 10.0 [13].

The results for the range of missile types and steel tank targets considered in the TMRE are shown in Section C.8. In addition, the results are also shown in Figure C-13 below, which can be used to estimate tank rupture for wider range of impact scenarios. The green data points represent cases where rupture is not likely (<1.0) and yellow data points represent threshold cases were rupture is not likely, but strain values are elevated (1.0<<3.0). The red data points represent cases were rupture may occur due to large displacements of the tank shell (>3.0).

Page 165 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-13. Steel tank results: (120 in < D < 576 in) and (0.133 in < t < 0.375 in, Nominal impact velocity = 230 mph)

C.3.4 EVALUATION OF REINFORCED CONCRETE ROOFS An evaluation of reinforced concrete roofs was performed using the same dynamic modeling approach as was utilized for the evaluation of pipes and tanks. Roof slab stiffnesses and load capacities were evaluated for two roof thickness (4 and 8-inches). These thicknesses were selected based on common roof construction observed in NPP designs. The respective spans for the 4 and 8 inch roofs were 4 ft. and 20 ft., respectively. The 4-inch thick roof is assumed to be composite steel construction with steel bar joists spaced at 48-inches. The assumed roof design parameters are shown in Table 4 below. As missile impact was assumed to strike mid-span of the slab, the bar joists were not explicitly considered. The 8-inch thick roof is assumed to be ordinary reinforced concrete. The roof spans were assumed to be designed as one-way members and impact was also assumed to occur at the mid-span location.

Empirical equations were used to evaluate perforation (Section C3.1). Scabbing (or spalling of concrete) was not evaluated, as most concrete roofs have metal decking on the underside of the slab. This decking confines the concrete cover over reinforcement and prevents the effects for scabbing.

Page 166 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table C-4. Assumed reinforced concrete roof parameters Parameter 4-inch RC Roof 8-inch RC Roof Span (ft.) 4 20 Design Live Load (psf) 50 50 Concrete compressive strength (psi) 4,000 4,000 Steel reinforcement strength (psi) 40,000 40,000 Steel reinforcement ratio 0.002 0.008 Results The results for the range of missile types and concrete roofs considered in the TMRE are shown in Table C-5, below. In addition, the results are also shown in Figure C-14 below, which can be used to estimate tank rupture for wider range of impact scenarios.

The green data points indicate cases where only moderate damage is expected (slight cracking) and the yellow data points indicate cases where heavy damage would be expected (significant cracking, but no structural failure. The red data points indicate cases where the roof slab is likely to fail structurally, resulting in hazardous debris into the space below.

In some cases, mostly where missile weights are much greater than 500 lbs, the 4-inch thick concrete roof slab is susceptible to failure. However, the 8 inch thick concrete roof slab is not susceptible to overall failure from most of the missiles analyzed. Despite the longer span of the 8-inch roof slab (20 ft.),

the mass of the roof contributes to a significant amount of inertia (keeping displacements small).

Page 167 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table C-5. Results for reinforced concrete roof impacts Minimum 4" Roof 8" Roof Perforation Slab Edge Slab Edge Thickness rotation rotation Missile (in) [2] [3] Evaluation

1. 8 Rebar 6.0 Perforation failure of 4" slab Gas Cyl (290 lb) 2.3 No failure of 4" or 8" slab Tank Drum (500 lb) 1.1 No failure of 4" or 8" slab Perforation failure of 4" slab; 8" slab OK as Utility Pole (1500 lb) 8.5 equation conservative for timber missiles Cable Reel (253 lb) 0.2 No failure of 4" or 8" slab Perforation failure of 4" slab not likely due 3" pipe (76 lb) 4.5 to low stiffness of pipe 6" pipe (284 lb) 5.0 Perforation failure of 4" slab 12" pipe (744 lb) 3.7 Panel (global) failure of 4" slab Tool bx (675 lb) 0.5 No failure of 4" or 8" slab Paver (88 lb) 1.2 No failure of 4" or 8" slab Conc blk (36 lb) 0.4 No failure of 4" or 8" slab 4x12 timber (200 lb) 2.6 No failure of 4" or 8" slab 2x12 plank (27 lb) 0.9 No failure of 4" or 8" slab Metal siding (125 lb) 0.3 No failure of 4" or 8" slab 7/8" plywood (84 lb) 1.2 No failure of 4" or 8" slab W14x26 (390 lb) 3.2 No failure of 4" or 8" slab Marginal for 4" slab; assume no failure as C6x13 (195 lb) 4.0 steel decking not credited small motor (388 lb) 0.3 No failure of 4" or 8" slab conc mixer (1,350 lb) 0.6 No failure of 4" or 8" slab steel grating (74 lb) 1.5 No failure of 4" or 8" slab pallet rack (1,040 lb) 0.2 No failure of 4" or 8" slab Panel (global) failure of 4" slab; 8" also vehicle (4,000 lb) 0.5 assumed to fail as a conservative measure Perforation failure of 4" slab not likely due 20' tree (700 lb) 8.0 to low stiffness of tree branches

• Green is max rotation < 0.345 radians [ASCE 59-11]

• Red is max rotation > 0.345 radians [ASCE 59-11]

[2] 4 ft span assumed for 4" slab

[3] 20 ft span assumed for 8" slab Page 168 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-14. Concrete roof results (48 in < L < 240 in) and (4.0 in < t < 8.0 in); Nominal impact velocity =

2/3 x 230 mph or 153 mph (vertical)

C.4 DEBRIS FROM DAMAGED STRUCTURES Wind pressures from tornadoes can be sufficiently high to cause structural damage to portions of building structures. Damage can range from localized (pieces of siding) to complete failure of the wall and roof systems. Debris from these damaged buildings can generate additional missile hazards. FEMA

[16] has developed wind pressure fragility functions for various building types (wood framed, manufactured, pre-engineered, and engineered). For each building type, FEMA assessed the likelihood of damage for key structural components (roof and walls) for a range of wind speeds (typically 60-200 mph).

As these types of buildings are found on power plant sites, an estimation of number of available missiles for each building type was performed. The number of available missiles was estimated from typical construction practices (e.g., wood framing at 16-inch centers for wood buildings, and plywood sheets measuring 32 square feet). Based on a representative building for each construction type, the total number of building components was approximated. For example, the numbers of wall studs, roof rafters, and floor joists, were estimated for wood offices and warehouses (Figure C-15). In addition, the contents of buildings were considered depending on building function. The quantities of desks and furniture were estimated for office buildings, and quantities of pallets, drums, and shelving were estimated for warehouses. The results for potential tornado missiles per building type are shown in Table C-6, below.

Page 169 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 15. Typical wood building construction The release fraction, or number of missiles released, for a range of wind speeds was estimated for each building type. The release fractions were based on the FEMA damage probabilities for building components subjected to high winds. As the number of wind-driven missiles should increase as the probability of building damage increases, it was assumed that release fraction correlated to the probability of damage for the most severe building damage state (e.g., complete roof or wall failure).

The estimated release fractions for wood framed, manufactured, and engineered building types are shown in Figures C-16 through C-18 below.

Table C-6. Potential Tornado Missile per Office Building, Wood-Framed Per 1,000 Per 1,000 Per 1,000 Missile ft2 floor ft2 wall ft2 roof Type area area area 1 14 0 0 2 0 0 0 3 0 0 0 4 0 0 0 5 0 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 0 0 0 10 0 0 0 Page 170 of 226

September 21, 17 NEI 17-02, [Rev 1]

11 4 2 9 12 69 31 76 13 0 0 25 14 31 31 0 15 2 0 0 16 0 0 0 17 1 1 0 18 0 1 0 19 0 0 0 20 0 0 0 21 0 0 0 22 0 0 0 Total 121 66 110 Table C-7. Potential Tornado Missile per Office Building, Manufactured (Pre-fab)

Per 1,000 Per 1,000 Per 1,000 Missile ft2 floor ft2 wall ft2 roof Type area area area 1 16 0 0 2 0 0 0 3 0 0 0 4 0 0 0 5 0 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 2 0 0 10 0 0 0 11 13 3 23 12 183 20 56 13 0 0 24 14 31 25 0 15 2 0 0 16 0 0 0 17 1 1 0 18 0 1 0 19 0 0 0 20 0 0 0 21 0 0 0 22 0 0 0 Total 248 50 103 Page 171 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table C-8. Potential Tornado Missile per Office Building, Engineered and Pre-Engineered Per 1,000 Per 1,000 Per 1,000 Missile ft2 floor ft2 wall ft2 roof Type area area area 1 33 0 0 2 0 0 0 3 0 0 0 4 0 0 0 5 0 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 2 0 0 10 0 0 0 11 0 0 0 12 80 0 0 13 0 25 24 14 15 0 0 15 0 8 4 16 0 16 7 17 1 1 0 18 0 1 0 19 0 0 0 20 0 0 0 21 0 0 0 22 0 0 0 Total 131 51 35 Table C-9. Potential Tornado Missile per Office Building, Construction Trailer Per 1,000 Per 1,000 Per 1,000 Missile ft2 floor ft2 wall ft2 roof Type area area area 1 0 0 0 2 1 0 0 3 2 0 0 4 0 0 0 5 4 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 4 0 0 Page 172 of 226

September 21, 17 NEI 17-02, [Rev 1]

10 0 0 0 11 12 6 14 12 151 12 96 13 0 25 24 14 31 0 0 15 0 0 0 16 0 0 0 17 1 1 0 18 0 1 0 19 0 0 0 20 0 0 0 21 0 0 0 22 0 0 0 Total 206 45 134 Table C-10. Potential Tornado Missile per Warehouse Building, Wood-Framed Per 1,000 Per 1,000 Per 1,000 Missile ft2 floor ft2 wall ft2 roof Type area area area 1 27 0 0 2 1 0 0 3 1 0 0 4 0 0 0 5 5 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 6 0 0 10 0 0 0 11 6 2 4 12 30 20 78 13 0 31 24 14 20 0 0 15 0 0 0 16 0 0 0 17 2 1 0 18 2 1 0 19 1 0 0 20 2 0 0 21 0 0 0 22 0 0 0 Total 103 55 106 Page 173 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table C-11. Potential Tornado Missiles per Warehouse Building, Engineered and Pre-Engineered Per 1,000 Per 1,000 Per 1,000 Missile ft2 floor ft2 wall ft2 roof Type area area area 1 18 0 0 2 1 0 0 3 1 0 0 4 0 0 0 5 5 0 0 6 0 0 0 7 0 0 0 8 0 0 0 9 6 0 0 10 0 0 0 11 0 0 0 12 16 0 0 13 0 25 25 14 12 0 0 15 0 5 4 16 5 16 8 17 2 1 0 18 2 1 0 19 1 0 0 20 2 0 0 21 0 0 0 22 0 0 0 Total 71 48 37 Page 174 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-16. Missile release fractions for wooden buildings Figure C-17. Missile release fractions for trailers and manufactured buildings Page 175 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure C-18. Missile release fractions for engineered and pre-engineered buildings C.5 DERIVATION OF PIPE RADIAL STIFFNESS AND ULTIMATE CAPACITY An analytical model was developed to approximate the radial stiffness and capacity of a typical pipe segment (Figure C-19).

Figure C-19. Assumed pipe boundary condition and free-body diagram to obtain internal member actions Page 176 of 226

September 21, 17 NEI 17-02, [Rev 1]

First step is to solve for radial displacement due to concentrated force, P U 2M M

= 2 R d P 0 EI P Figure 15 (c) depicts the internal resisting moment in the pipe section. Solving for M:

PR M= (1 cos ) MB 2

M R

= (1 cos )

P 2 U 2 2 PR R

= (1 cos ) MB (1 cos ) R d P EI 0 2 2 U 2 PR3 PR3 sin PR3 sin 2 MB R2 MB R2 sin

= + + + MB 2 P EI 4 2 4 2 4 2 2 0 Evaluating integral at 0 and /2, the radial displacement is:

U 2

= [0.088PR3 0.285 MB R2 ]

P EI Solve for unknown reaction moment, MB:

M 2 M M

=0= R d MB 0 EI MB PR M= (1 cos ) MB 2

M

= 1 MB U 2 PR

= 0 = (1 cos ) MB [1] R d P 0 2 U PR2 PR2 sin

=0= + MB R 2 P 2 2 0 Evaluating integral at 0 and /2, the resisting moment, MB, can be solved for:

0 = 0.285PR2 + 1.57MB R MB = 0.181PR Substitute MB into previous displacement equation:

U 2

= [0.088PR3 0.285(0.181PR) R2 ]

P EI U 0.072PR3

=

P EI 1

Substituting: 2R = D; I = b t3 12 The radial stiffness, Kr, can be solved for:

9.28 E b t 3 Kr =

D3 Page 177 of 226

September 21, 17 NEI 17-02, [Rev 1]

The principle of virtual work is used to estimate the plastic moment capacity of pipe section:

Figure C-20. Assumed locations of plastic moments and moment-virtual displacement relationship.

From virtual work, Figure 20(b):

P

= 4Mp 2

2

= R x 2 2

= R PR = 8Mp The critical concentrated pipe load is therefore:

16Mp P=

D The plastic moment of the pipe segment is estimated to be:

bt 2 Mp = F 4 y The critical concentrated pipe demand is alternatively expressed as:

4bt 2 P= Fy D

Page 178 of 226

September 21, 17 NEI 17-02, [Rev 1]

C.6 TARGET DAMAGE APPROXIMATIONS 3" pipe (schedule Gas Cylinder Tank Drum Utility Pole Cable Reel 40)

Description Rebar Diesel Generator Exhaust Pipe SG Power Operated Relief Valve Tailpipe Turbine Driven Feedwater pump exhaust piping Steam Generator Power Operated RV Exh Pipe Diesel Generator Air intake Diesel Generator Exh Silencer Condensate Storage Tank (t=0.25")

Diesel Fuel Oil Tank (t=0.133")

Diesel Fuel Oil Tank (t=0.145")

Condensate Storage Tank (t=0.375")

Well water piping (t=0.237")

Condensate Piping (t=0.237")

Main Steam Piping (t=0.985")

Diesel Fuel Oil Storage Tank (t=0.25")

Room Door (t=0.1")

Service Water Piping (t=0.375")

Aux Feedwater Piping (t=0.432")

Concrete roofs 8" reinforced 4" reinforced with steel decking Legend Less than or equal to 50% crushing Greater than 50% crushing 100% crushing Failure by perforation or crushing more than 50%

Concrete Perforation Page 179 of 226

September 21, 17 NEI 17-02, [Rev 1]

(schedule 6" pipe (schedule 40)

Storage Bin Concrete Paver Concrete block 4x12 timber 12" pipe Description 40)

Diesel Generator Exhaust Pipe SG Power Operated Relief Valve Tailpipe Turbine Driven Feedwater pump exhaust piping Steam Generator Power Operated RV Exh Pipe Diesel Generator Air intake Diesel Generator Exh Silencer Condensate Storage Tank (t=0.25")

Diesel Fuel Oil Tank (t=0.133")

Diesel Fuel Oil Tank (t=0.145")

Condensate Storage Tank (t=0.375")

Well water piping (t=0.237")

Condensate Piping (t=0.237")

Main Steam Piping (t=0.985")

Diesel Fuel Oil Storage Tank (t=0.25")

Room Door (t=0.1")

Service Water Piping (t=0.375")

Aux Feedwater Piping (t=0.432")

Concrete roofs 8" reinforced 4" reinforced with steel decking Legend Less than or equal to 50% crushing Greater than 50% crushing 100% crushing Failure by perforation or crushing more than 50%

Concrete Perforation Page 180 of 226

September 21, 17 NEI 17-02, [Rev 1]

Wide Flange (WF Section Metal siding 7/8" plywood Small equipment 14x26 Channel Description 2x12 C6x13 Diesel Generator Exhaust Pipe SG Power Operated Relief Valve Tailpipe Turbine Driven Feedwater pump exhaust piping Steam Generator Power Operated RV Exh Pipe Diesel Generator Air intake Diesel Generator Exh Silencer Condensate Storage Tank (t=0.25")

Diesel Fuel Oil Tank (t=0.133")

Diesel Fuel Oil Tank (t=0.145")

Condensate Storage Tank (t=0.375")

Well water piping (t=0.237")

Condensate Piping (t=0.237")

Main Steam Piping (t=0.985")

Diesel Fuel Oil Storage Tank (t=0.25")

Room Door (t=0.1")

Service Water Piping (t=0.375")

Aux Feedwater Piping (t=0.432")

Concrete roofs 8" reinforced 4" reinforced with steel decking Legend Less than or equal to 50% crushing Greater than 50% crushing 100% crushing Failure by perforation or crushing more than 50%

Concrete Perforation Page 181 of 226

September 21, 17 NEI 17-02, [Rev 1]

Large equipment Frame/steel grating Large steel frame Description Vehicle Tree Diesel Generator Exhaust Pipe SG Power Operated Relief Valve Tailpipe Turbine Driven Feedwater pump exhaust piping Steam Generator Power Operated RV Exh Pipe Diesel Generator Air intake Diesel Generator Exh Silencer Condensate Storage Tank (t=0.25")

Diesel Fuel Oil Tank (t=0.133")

Diesel Fuel Oil Tank (t=0.145")

Condensate Storage Tank (t=0.375")

Well water piping (t=0.237")

Condensate Piping (t=0.237")

Main Steam Piping (t=0.985")

Diesel Fuel Oil Storage Tank (t=0.25")

Room Door (t=0.1")

Service Water Piping (t=0.375")

Aux Feedwater Piping (t=0.432")

Concrete roofs 8" reinforced 4" reinforced with steel decking Legend Less than or equal to 50% crushing Greater than 50% crushing 100% crushing Failure by perforation or crushing more than 50%

Concrete Perforation Page 182 of 226

September 21, 17 NEI 17-02, [Rev 1]

C.7 CONCLUSIONS The impact of a missile onto a target is a complex dynamic problem. The phenomena typically involve nonlinear material behavior and high strain rates for both the missile and target. The problem of wind-driven missiles is further complicated, because these missiles are not engineered penetrators that are designed to penetrate a hardened target (i.e., remain rigid). In many cases, detailed finite element analysis are required to evaluate both missile and target response. However, such analyses are resource intensive and due to lack of experimental validation, these more detailed analysis may not significantly reduce uncertainty in results.

As the number of EPRI missile and target combinations to be analyzed was more than 400 (~23 missiles x 19 targets), a pragmatic approach was developed to evaluate target robustness. The approach relies on an analytical approach that is consistent with the NRC SRP Section 3.5.3 [1]. The approach makes accounts for missile characteristics such as impact speed, missile mass, and target characteristics such as stiffness, ultimate capacity, and mass. The analysis of pipe crimping was benchmarked to two relevant experiments.

While median material properties were assumed to develop a best-estimate of target response, the following conservative assumptions were made:

• The assumed maximum missile impact speed, of 230 mph, exceeds current SRP missile speeds.

The highest horizontal missile impact speed cited in the most current NRC guidance is 92 mph (RG 1.76) for tornado winds and 209 mph (RG 1.221) for hurricane winds.

• For piping scenarios, it was assumed that missile impacts are normal to the target surface and that the axis of the missile is parallel to the line of flight. For impacts on pipes, the effectiveness of the missile impact degrades significantly as the strike location is offset from the centerline of the pipe.

• For impacts on liquid-filled steel tanks, the tank stiffness did not credit the added contribution of the tank end-closure and foundation restraint. The stiffening effect of the entrained liquid was also not credited.

• For impacts on thinner concrete roofs (4-inches), the effect of the steel decking was not credited. Steel decking tends to limit concrete spalling, increase confinement, thereby improving resistance to impact scenarios. Impact was also assumed to be normal to the roof surface, rather than the more realistic case of having an angle of incidence.

C.8 REFERENCES

1. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, May 2013.

2. NRC Regulatory Guide (RG) 1.76, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, March 2007.

3. NRC Regulatory Guide (RG) 1.221, Design-Basis Hurricane and Hurricane Missiles for Nuclear Power Plants, October 2011.

Page 183 of 226

September 21, 17 NEI 17-02, [Rev 1]

4. ASME/ANS RA-SA-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, February 2009.

5. Burden R.L., Faires J., Numerical Analysis, 4th Edition, PWS-Kent Publishing, 1989.

6. EPRI 3002008092, High Winds Equipment List and Walkdown Guidance (Draft), November 2016.

7. Bechtel Topical Report, BC-TOP-9A, Revision 2, Design of Structures for Missile Impact, September 1974.

8. Den Hartog, J.P., Mechanical Vibrations, Dover Publications, Inc., 1985.

9. NEI 07-13, Revision 8P, Methodology for Performing Aircraft Impact Assessments for New Plant Designs, April 2011.

10. Stevenson, J.D., Structural Damping Values As a Function of Dynamic Response Stress and Deformation Levels, Nuclear Engineering and Design, No. 60, 1980.

11. DOE-STD-3014-2006, Accident Analysis for Aircraft Crash Into Hazardous Facilities, May 2006.

12. Biggs, J.M., Introduction to Structural Dynamics, McGraw-Hill, 1964.

13. ASCE 59-11, Blast Protection of Buildings, American Society of Civil Engineers, 2011.

14. Alexander, C., Assessing the Effects of Impact Forces on Subsea Flowlines and Pipelines, The 26th International Conference on Offshore Mechanics and Artic Engineering, June 10-15, 2007, San Diego, CA

15. Kristofferson, M. et. al., Impact Against X65 Steel Pipes- An Experimental Investigation, International Journal of Solids and Structures, No. 50 (2013).

16. Hazus-MH 2.1 Technical Manual, Multi-hazard Loss Estimation Methodology, Hurricane Model, FEMA Page 184 of 226

September 21, 17 NEI 17-02, [Rev 1]

APPENDIX D: TECHNICAL BASIS FOR TMRE METHODOLOGY TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR The initiating event analysis shall provide a reasonably IE-A complete identification of initiating events.

Tornado initiating events will TMRE process should ensure 4.3, 6.2 be consistent with the that the initiating events intervals defined in the TMRE caused by extreme winds that process. TMRE considers all give rise to significant tornadoes will result in a accident sequences and IE-A1 LOOP. Tornado initiating accurately capture the event frequencies will be additional risk of the based on a hazard curve that unprotected SSCs (that uses site specific data should be protected per the provided in Table 6.1 of CLB) are identified and used NUREG 4461 [IE-C1]. for this application.

For multi-unit sites with 6.2 shared systems, INCLUDE multi-unit site initiators (e.g.,

IE-A10 multi-unit LOOP events or total loss of service water) that may impact the model.

The initiating event analysis shall group the initiating events so that events in the same group have similar mitigation requirements (i.e.,

the requirements for most IE-B events in the group are less restrictive than the limiting mitigation requirements for the group) to facilitate an efficient but realistic estimation of CDF Page 185 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR DO NOT SUBSUME multi-unit 6.2 initiating events if they impact mitigation capability.

Two unit sites should consider IE-B5 proximity of each unit to each other, the footprint of potential tornadoes for the region, and the systems shared between each unit.

The initiating event analysis The tornado IEFs should be shall estimate the annual based on a hazard curve that IE-C frequency of each initiating uses site-specific data, such event or initiating event as found in NUREG-4461.

group.

Tornado initiating event 4.1 frequencies will be based on a IE-C1 hazard curve that uses site specific data provided in Table 6.1 of NUREG 4461 Do not credit recovery of Same comment as AS-A10 6.1, Appendix A IE-C3 offsite power.

CHARACTERIZE the 4.3 uncertainty in the tornado initiating event frequencies IE-C15 and PROVIDE mean values for use in the quantification of the PRA results. NUREG 4461, data includes uncertainty.

Utilize the accident sequences (typically LOOP) provided in the internal events model and AS-A adjust as necessary to consider the consequences of a tornado event.

Modify the internal events 6.1, 6.3, 6.4, 6.5 AS-A1 accident sequences in compliance with this SR Page 186 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR Review the FPIE success 6.1, 6.3, 6.4, 6.5 criteria and modify the associated system models as AS-A3 necessary to account for the tornado event and its consequences.

Review the FPIE success 6.4 criteria and modify the associated operator actions AS-A4 as necessary to account for the tornado event and its consequences.

Modify the FPIE accident 6.1, 6.3, 6.4, 6.5 sequence model in a manner that is consistent with the plant-specific: system design, EOPs, abnormal procedures, and plant transient response.

AS-A5 Account for system functions that, as a consequence of the tornado event, will not be operable or potentially degraded, and operator actions that will not be possible or impeded.

Page 187 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR Capability Category I. In In constructing the accident 6.3, 7.2.3, Appendix A modifying the accident sequence models, support sequence models, INCLUDE, system modeling, etc.

for each tornado initiating realistic criteria or event, INDIVIDUAL EVENTS IN assumptions should be used, THE ACCIDENT SEQUENCE unless a conservative SUFFICIENT TO BOUND approach can be justified.

SYSTEM OPERATION, TIMING, Use of conservative AND OPERATOR ACTIONS assumptions in the base NECESSARY FOR KEY SAFETY model can distort the results AS-A10 FUNCTIONS. and may not be conservative for delta CDF/LERF calculation. While use of conservative or bounding assumptions in PRA models is acceptable, a qualitative or quantitative assessment may be needed to show that those assumptions do not underestimate delta CDF/LERF estimates.

Dependencies that can impact the ability of the mitigating AS-B systems to operate and function shall be addressed.

For each tornado event, 6.1, 6.3, 6.5, 6.6 IDENTIFY mitigating systems impacted by the occurrence of the initiator and the extent of the impact. INCLUDE the AS-B1 impact of initiating events on mitigating systems in the accident progression either in the accident sequence models or in the system models.

Page 188 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR IDENTIFY the 5.6, 6.3, 6.4, 6.6 phenomenological conditions created by the accident progression. Also high winds and rains after the tornado AS-B3 event could result in hazardous conditions (e.g.

debris and structural instabilities) for actions outside the control room.

Review FPIE time phased 6.1 dependencies to identify model changes needed to address all the concurrent AS-B7 system functions failed by the tornado event; e.g. LOOP, instrument air, fire protectionetc. Do not model offsite recovery.

The overall success criteria for the PRA and the system, structure, component, and human action success criteria used in the PRA shall be SC-A defined and referenced, and shall be consistent with the features, procedures, and operating philosophy of the plant.

Consider impact on both units 6.1 for the same tornado SC-A4 including the mitigating systems that are shared.

Page 189 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR The systems analysis shall provide a reasonably complete treatment of the causes of system failure and SY-A unavailability modes represented in the initiating events analysis and sequence definition Capability Category II. Section 3 Walkdowns focusing on targets vulnerable to tornado missiles will be performed.

SY-A4 Walkdown will include a missile inventory and a review of pathways available to the operators for ex-control room actions.

New basic events will be 6.3, 6.5, 6.6 added to address all the failure modes of the system targets exposed to tornado SY-A11 missiles; safety-related and non-safety related.

The exclusions of SY-A15 do not apply for SSCs impacted by tornado missiles.

Page 190 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR DO NOT INCLUDE in a system 5.2 model component failures that would be beneficial to system operation, unless omission would distort the results. For example, do not assume a vent pipe will be sheered by a high energy missile verses crimped unless it can be shown this is true for SY-A12 all missiles at all speeds.

Exceptions would be components that are intentionally designed to "fail" favorably when struck by a missile; e.g. a frangible plastic pipe used as a vent is designed to break off and not crimp when struck by a missile.

Consider the targets 6.5 potential to cause a flow SY-A13 diversion when struck by a tornado missile.

Missile targets will be 6.5 assessed for all failure modes

- some new failure modes may be identified that are not SY-A14 in the FPIE model.

The exclusions of SY-A15 do not apply for SSCs impacted by tornado missiles.

Page 191 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR The failure of SSCs due to The failure by tornado 6.5 tornado missiles shall not use missiles should be included in the exclusions of SY-A15. the model for all unprotected targets that are supposed to be protected according to the CLB and any unprotected targets that are not in the CLB but are in the PRA model.

SY-A15 This is to facilitate sensitivity studies regarding possible correlation of tornado missile damage across systems. It is not expected that the number of basic events added to the model for this analysis will be so large that this screening is necessary.

Certain post initiator HFEs will 6.4 SY-A17 be modified to account for the tornado event.

The thermal/hydraulic, structural, and other supporting engineering bases shall be capable of providing success criteria and event timing sufficient for SY-B quantification of CDF and LERF, determination of the relative impact of success criteria on SSC and human actions, and the impact of uncertainty on this determination.

Page 192 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR Capability Category I. BASE Same comment as AS-A10 7.2.3 support system modeling on the use of CONSERVATIVE SUCCESS CRITERIA AND TIMING. Sensitivity studies SY-B7 will be performed to identify where conservative assumptions may be distorting risk and adjusted accordingly.

Consider spatial relationships 5.6 between components to identify correlated failures.

SY-B8 Where the same missile can impact targets that are in close proximity to each other.

Statistical correlation of The industry indicated in Appendix B.4.4 tornado missile damage earlier discussions that between redundant and information is available to spatially separated show that statistical components is NOT required. correlation of tornado missile damage for specially separated components is SY-B14 insignificant. Until that information is reviewed and accepted by the staff, this SR should be met (spans all capability categories) and dependent failures of multiple SSCs should be considered.

INCLUDE new operator 6.4 interface dependencies across SY-B15 systems or trains related to the tornado event, if applicable.

Page 193 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR A systematic review of the relevant procedures shall be used to identify the set of HR-E operator responses required for each of the tornado accident sequences Operators will be interviewed 6.4 (if necessary) to assess the HR-E3 need for changes to operator actions for the tornado initiating events.

Operators talk-throughs or 6.4 simulator observations will be conducted (if necessary) to assess the need for changes to operator actions for the tornado initiating events.

HR-E4 [Note: this applies to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone]

The assessment of the probabilities of the post-initiator HFEs shall be performed using a well-defined and self-consistent process that addresses the HR-G plant-specific and scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence.

Page 194 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR Operators will be interviewed 6.4 and simulator observations conducted (if necessary) to assess the need for changes to operator action timing as a result of the tornado event.

HR-G5 [Note: this applies to new sequences or failure combinations not accounted for in the internal events model. It is not intended that operator action timing needs be changed due to the tornado event alone]

For new operator action 6.4 dependencies identified as part of QU-C1, ASSESS the HR-G7 degree of dependence, and calculate a joint human error probability that reflects the dependence.

Recovery actions (at the cutset or scenario level) shall be modeled only if it has been demonstrated that the action is plausible and feasible for HR-H those scenarios to which they are applied. Estimates of probabilities of failure shall address dependency on prior human failures in the scenario.

Do not credit recovery actions 6.4 to restore functions, systems, or components unless an HR-explicit basis accounting for H1/H2 tornado impacts on the site and the SSCs of concern is provided.

Page 195 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR Each parameter shall be clearly defined in terms of the logic model, basic event DA-A boundary, and the model used to evaluate event probability.

Develop new basic events for 6.3, 6.5, 6.6 tornado missile targets (all DA-A1 failure modes) in accordance with this SR.

The level 1 quantification shall quantify core damage QU-A frequency and shall support the quantification of LERF.

Do not credit recovery actions 6.4 to restore functions, systems, or components unless an QU-A5 explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

Model quantification shall determine that all identified QU-C dependencies are addressed appropriately.

Identify new operator action 6.4 dependencies created as a result of the changes to the QU-C1 internal events PRA model or failures associated with tornado events.

Page 196 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR The quantification results shall be reviewed, and significant contributors to CDF (and LERF), such as initiating events, accident sequences, and basic events QU-D (equipment unavailabilities and human failure events),

shall be identified. The results shall be traceable to the inputs and assumptions made in the PRA.

Review nonsignificant cutset 7.3 QU-D5 or sequences to determine the sequences are valid Review BE importance to 7.3 QU-D7 make sure they make logical sense.

Uncertainties in the PRA results shall be characterized.

Sources of model uncertainty QU-E and related assumptions shall be identified, and their potential impact on the results understood.

Identify sources of uncertainty 7.1 QU-E1 related to MIP and missiles Also see Appendices A and B for bases.

Identify assumptions made Section 6 QU-E2 that are different than those in the internal events model Identify how the model 7.1, Appendix A uncertainty is affected by QU-E4 assumptions related to MIP and missiles Page 197 of 226

September 21, 17 NEI 17-02, [Rev 1]

TMRE - ASME PRA Standard Supporting NRC Comments NEI 17-02 Section Requirements Requiring Self-Assessment (No comments if blank) Addressing SR The accident progression 7.1, 7.3 analysis shall include LE-C identification of those sequences that would result in a large early release.

Do not credit recovery of Same comment as AS-A10 6.3, 7.2.3, Appendix A offsite power. Do not credit recovery actions to restore functions, systems, or LE-C3 components unless an explicit basis accounting for tornado impacts on the site and the SSCs of concern is provided.

Changes made for application Section 8 of the PRA to tornado missile impact risk determination such as those to initiating event analysis, accident sequences, systems analysis, human reliability analysis, and parameter estimation should be documented, as described in various documentation SRs for each Multiple HLR. The documentation SRs should be sufficient to understand basis and facilitate review. Examples of such SRs include IE-D1 through IE-D3, SY-C1 through SY-C3, and DA-E1 through DA-E3. It is recognized that the documentation of changes to the PRA and their basis will be captured in the template of the license amendment request.

Page 198 of 226

September 21, 17 NEI 17-02, [Rev 1]

APPENDIX E: TMRE METHODOLOGY SENSITVITY STUDIES E.1 OBJECTIVES The objective of this Appendix is to examine the sensitivity of MIP values to target size, target elevation, and the distribution of missiles inventory around the plant. The results are used to support the derivation of MIP values.

E.2 METHODOLOGY OVERVIEW The sensitivity studies are performed using TORMIS code for two operating power plants.. Missile hit probabilities for selected targets are post processed and compared for the sake of understanding the effects of target sizes, target elevations and missile inventory distribution on the MIP.

The following points provide a high level overview of the methodology used:

1. Two existing nuclear power plants models (Plant A and Plant B) are selected for this study. Plants models were developed previously and permission has been obtained from plant owners for their use. Plant A is located in NRC region 1 and EPRI region A. Plant B is located in NRC region 1and border of EPRI regions A and B.

2. All sensitivity studies used the Enhanced Fujita Scale EF1 through EF5. This is consistent with RG.

1.76 revision 1 and is in alignment of industry practices in recent TORMIS analyses submitted to the NRC. For each EF scale two thousands randomly generated tornados are simulated. For each tornado, two thousands five hundred missiles are sampled. It is acknowledged that in recent years the number of simulations are in the order of ten millions. However, for this study, the number of simulation for each EF scale is judged to be adequate as relative values are of interest not the actual hit probabilities. .

3. Statistical convergence is attained by performing multiple analysis sets for each EF scale. That is, seven sets of analyses for the study of zonal vs uniform distribution of missiles, four sets of analyses for the studies of target elevation and target sizes. Consequently, the total number of simulations for the zonal vs uniform study is seven hundred millions for plants A and B combined and is two hundred millions each for the studies of target elevation and target sizes. Total number of simulation is calculated as follows (5,000,000

• 5(EFs)

• 7(sets)

• 2(uniform and zonal)

• 2 (plants A and B) = 700,000,000.

4. Though a significant portion of Plants A and B missiles are restrained missiles, for simplification, this study assumes all missiles are free.

The Missile types have been given a missile type that is consistent with TORMIS list of missiles.

TORMIS missile sets (i.e. missile types defined in TORMIS code) are shown in Table 2-2 of Ref. (Np 768)

Page 199 of 226

September 21, 17 NEI 17-02, [Rev 1]

5. The results are based on TORMIS reported P (A) (i.e. single missile hit probability) for summation of events 2 and 7. Event 7 is Auto hit probability and Event 2 is hit probability for all other missiles.

E.3 DESCRIPTION OF PLANT MODELS Plant A Figure E-1 shows a 3D view of the TORMIS model for Plant A showing modeled power block structures.

The Model includes 22 missile zones and encompass an area of 5000X 5000. Missile population from missile survey is in excess of 100,000 missiles. Missile population includes missiles that are located on top of the buildings in access of 4,340 missiles. The zonal area of Plant A is 19,771,450 ft2.

Figure E-2 shows a plan view of missile zones along with number of missiles in each missile zone and missile building tops. The distribution of missiles in each zone is the actual distribution based on an actual plant walkdown.

Table E-1 lists missile description of plant A and the corresponding TORMIS missile types as designated by the walkdown personnel. Table E-2 list in a tabulated format the missile distribution shown in Figure E-2.

Page 200 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure E-1. 3D View of Plant A Page 201 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure E-2. Plant A missile zones and number of missiles in each zone Page 202 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table E-1. Missile description for Plant A Type No. Missile Description TORMIS Missile Set No.

1 1" steel rod L = 2' - 4' 1 2 1" steel rod, L = 10' - 20' 1 3 8" gas bottle, L = 5' 1 4 24" drums, L = 3' 1 5 8" wood post, L = 10' - 15' 2 6 14" wood post, L = 30' - 40' 2 7 1" steel pipe, L =10' - 20' 3 8 3" steel pipe, L = 8' - 12' 3 9 6" steel pipe, L = 10' - 20' 3 10 12" steel pipe, L = 10' - 20' 3 11 4"x4" wood post, L = 8' - 12' 6 12 6"x1" wood plank, L = 4' - 8' 9 13 12"x4" wood plank, L = 8' - 16' 9 14 4'x1" steel plate, L = 4' - 8' 10 15 4'x1" wood plate, L = 4' - 8' 11 16 4' x 20 ga steel plate, L = 10' - 20' 12 17 W8x10 steel wide flange, L = 10' - 20' 14 18 2x2x1/4 steel angle, L = 10' - 20' 15 19 C8x11.5 steel channel, L = 15' - 25' 16 20 Automobile 25 21 Trees, d = 8", L = 10' - 40' 26 Page 203 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table E-2. Missile Distribution for Plant A Missile Type Number Number Zone of Number Missiles 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 1 2487 0 8 0 0 3 6 681 0 0 0 0 0 0 0 678 0 0 11 0 1100 2 2141 0 16 0 4 32 30 33 658 0 0 0 0 0 0 0 707 0 0 61 0 600 3 1332 0 16 0 25 1 28 506 0 0 0 0 0 0 0 554 0 0 52 0 150 4 12099 3840 64 0 0 3 324 2153 11 0 50 180 50 100 2170 2363 0 10 661 120 0 5 1762 0 32 0 0 3 0 46 531 43 0 0 320 20 1 0 613 0 0 103 0 50 6 36080 7139 366 424 310 17 0 1860 4635 168 78 85 1640 2780 329 3671 9094 19 180 3170 65 50 7 1372 150 32 0 0 0 0 32 224 4 0 0 0 0 0 150 323 0 400 57 0 0 8 2685 0 64 0 0 5 0 102 977 2 0 0 0 0 0 0 1201 0 0 234 0 100 9 1030 0 0 0 0 10 0 0 260 0 0 0 0 0 0 260 0 0 0 500 0 10 200 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 200 11 1166 0 0 0 0 0 0 0 510 4 0 0 0 0 0 0 552 0 0 0 0 100 12 530 0 0 0 0 0 0 0 200 0 0 0 0 0 0 200 0 0 0 30 100 13 200 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 200 14 887 18 0 0 0 0 2 0 321 1 0 0 0 0 0 7 330 0 100 8 0 100 15 346 0 0 0 0 0 21 0 0 0 0 0 0 0 0 0 0 0 25 0 0 300 16 308 0 0 0 0 0 8 0 0 0 0 0 0 0 0 0 0 0 0 0 200 100 17 7610 1600 16 0 10 0 0 240 1021 2 0 0 0 0 0 1600 2626 0 0 470 25 0 18 5651 0 0 0 0 6 0 520 325 0 0 0 0 0 0 500 200 4000 0 0 100 19 1323 44 32 0 0 4 0 16 204 2 0 0 0 0 0 45 247 0 600 29 0 100 20 5120 0 0 0 0 12 0 0 0 0 0 0 0 0 0 0 0 0 8 0 0 5100 21 4295 738 48 0 0 0 0 70 378 10 0 0 0 1450 693 776 0 0 132 0 0 22 11703 20 2048 20 20 20 20 2207 407 200 200 2000 200 200 20 200 2855 200 200 646 20 0 Page 204 of 226

September 21, 17 NEI 17-02, [Rev 1]

Plant B Figure E-3 shows a 3D view of the TORMIS model for Plant B showing modeled power block structures.

The Model includes 18 missile zones and encompasses an area of 5000X5000. Missile population from missile survey is 141,944 missiles. Missile population includes missiles that are located on top of the buildings in access of 11,766 missiles. The zonal area of Plant B is 19,771,450 ft2.

Figure E-4 shows a plan view of missile zones along with number of missiles in each missile zone and missile building tops. The distribution of missiles in each zone is the actual distribution based on an actual plant walkdown.

Table E-3 lists missile description of plant B and the corresponding TORMIS missile type as designated by the walkdown personnel. Table E-3 lists in a tabulated format the missile distribution shown in Figure E-4.

Page 205 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure E-3. 3D View of Plant B Page 206 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure E-4. Plant B missile zones and number of missiles in each zone Page 207 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table E-3. Missile description for Plant B Type No. Missile Description TORMIS Missile Set No.

1 1" steel rod L = 2' - 4' 1 2 1" steel rod, L = 10' - 20' 1 3 8" gas bottle, L = 5' 1 4 24" drums, L = 3' 1 5 8" wood post, L = 10' - 15' 2 6 14" wood post, L = 30' - 40' 2 7 1" steel pipe, L =10' - 20' 3 8 3" steel pipe, L = 8' - 12' 3 9 6" steel pipe, L = 10' - 20' 3 10 12" steel pipe, L = 10' - 20' 3 11 4"x4" wood post, L = 8' - 12' 6 12 6"x1" wood plank, L = 4' - 8' 9 13 12"x4" wood plank, L = 8' - 16' 9 14 4'x1" steel plate, L = 4' - 8' 10 15 4'x1" wood plate, L = 4' - 8' 11 16 4' x 20 ga steel plate, L = 10' - 20' 12 17 W8x10 steel wide flange, L = 10' - 20' 14 18 2x2x1/4 steel angle, L = 10' - 20' 15 19 C8x11.5 steel channel, L = 15' - 25' 16 20 Gratting and ladders, L=15' - 25' 2"X1" thick 22 21 3" PVC pipe, L = 8' - 12' 3 22 12" 5 gallon plastic container, L = 18", W=32 lbs 2 23 1'-6" x 2" Concrete panels, L=2' - 3' 8 24 Automobile 25 25 Trees, d = 8", L = 10' - 40' 26 Page 208 of 226

September 21, 17 NEI 17-02, [Rev 1]

Table E-4. Missile distribution for Plant B Missile Type Number Number Zone of Number Missiles 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 1 11135 400 0 0 0 5 0 0 1266 20 0 0 0 0 0 0 824 273 378 0 129 0 0 0 0 7840 2 4560 0 0 0 0 10 0 0 400 0 0 0 0 0 0 0 400 0 0 0 0 0 0 0 0 3750 3 5395 0 32 0 0 3 0 184 283 160 0 0 750 70 0 120 302 100 0 72 101 0 0 0 0 3218 4 40032 6662 768 216 322 5 75 1170 3009 340 25 885 13160 55 110 2809 6206 67 1687 1331 105 25 600 100 250 50 5 37356 10984 48 0 0 20 50 464 3792 20 0 0 0 0 0 10984 8865 0 600 964 0 0 0 0 525 40 6 1360 50 0 0 0 10 0 0 150 100 50 0 0 0 0 0 0 0 900 0 0 0 0 0 0 100 7 1527 146 0 0 0 15 35 0 109 0 0 40 0 0 0 56 259 12 335 20 0 0 0 0 500 0 8 3839 0 16 15 82 0 21 566 720 0 0 200 575 50 100 100 304 0 0 590 0 110 0 240 150 0 9 5534 0 10 0 0 0 30 5 626 100 0 12 10 0 0 0 476 0 600 50 0 0 0 3600 15 0 10 2913 234 47 0 0 0 0 136 345 10 0 150 400 0 0 282 1040 10 0 259 0 0 0 0 0 0 11 1641 288 0 30 0 2 10 0 437 4 0 0 0 0 0 188 512 25 45 50 0 0 0 0 50 0 12 4123 606 73 30 11 0 4 592 439 0 0 0 30 5 0 296 1031 3 360 243 0 80 0 300 20 0 13 13265 3314 48 50 18 2 0 542 1232 450 0 55 2775 60 67 1634 1320 15 748 860 0 0 50 0 25 0 14 5868 276 74 100 15 0 1 189 740 91 40 0 2015 155 12 501 1191 25 140 251 2 0 50 0 0 0 15 916 110 62 8 0 0 0 67 65 2 0 20 105 0 40 20 185 4 3 59 0 6 0 0 160 0 16 505 0 0 0 0 5 0 0 190 0 0 0 0 0 0 0 190 0 0 0 0 0 0 0 0 120 17 235 0 0 0 0 5 0 0 0 10 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 220 18 1740 0 80 0 0 0 0 80 236 4 0 0 0 0 0 0 1007 0 0 233 0 0 0 0 0 100 Page 209 of 226

September 21, 17 NEI 17-02, [Rev 1]

Details of the Sensitivity Studies Target Elevation Study The objective of this study is to examine the impact of target elevation on targets hit probabilities. In this study both plants A and B models are used. The targets are created on an open wall with varied elevations without changing targets size.

For plant A four targets are considered on north, south, east and west walls of the plant, see Figure E-5.

For plant B, three targets are considered, one on each of the north south and west walls. The east wall of plant B is blocked by turbine building. Missile inventory in Tables E-2 and E-4 for plants A and B are used. All missiles are assumed to be free missiles (i.e. not restrained). The total number of simulation for this study for both plants is two hundred millions. Table E-5 shows the size and location for the targets considered. All targets have a width of 20 feet and a height of 10 feet. Target elevations are considered to be the horizontal center line of the targets with respect to the ground. Figure E-5 and E-6 show the 3D view of the target locations for plant A. Figure E-7 and E-8 show the 3D view of the target locations for plant B.

As expected the sensitivity results show that in general as target elevation increases, hit probability is decreases.

Table E-5. Target sizes and location for target elevation study Plant A Size Elev 1 Elev 2 Elev 3 East Wall 20'WX10'H 8' 38' 78' West Wall 20'WX10'H 5' 25' 55' North Wall 20'WX10'H 68' 78' 103' South Wall 20'WX10'H 5' 20' 35' Plant A Size Elev 1 Elev 2 Elev 3 East Wall N/A N/A N/A N/A West Wall 20'WX10'H 8.5' 23.5' 53.5' North Wall 20'WX10'H 6' 21' 41' South Wall 20'WX10'H 6' 31' 64' Page 210 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 5. Plant A East and South Wall Targets Figure 6. Plant A North and West Wall targets Page 211 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 7. Plant B South Wall Targets Figure 8. Plant B North and West Wall Targets Page 212 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 9. Plant A East Wall Hit Probability for all EFs Target Elevation, Plant A - ALL EFs, East Wall 1.20 Hit Probability - Normalized to Lowest Target 1.000 1.00 0.80 0.635 0.60 0.40 0.206 0.20 0.00 8 38 78 Centerline Elevation of Target above Ground (ft)

Figure 10. Plant A West Wall Hit Probability for all EFs Target Elevation, Plant A - ALL EFs, West Wall 1.20 Hit Probability - Normalized to Lowest 1.000 0.990 1.00 0.80 0.647 0.60 Target 0.40 0.20 0.00 5 25 55 Centerline Elevation of Target above Ground (ft)

Page 213 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 11. Plant A South Wall Hit Probability for all EFs Target Elevation , Plant A - ALL EFs, South Wall 1.20 1.106 Hit Probability - Normalized to Lowest Target 1.042 1.000 1.00 0.80 0.60 0.40 0.20 0.00 5 20 35 Centerline Elevation of Target above Ground (ft)

Figure 12. Plant A North Wall Hit Probability for all EFs Target Elevation, Plant A - ALL EFs, North Wall 1.20 Hit Probability - Normalized to Lowest Target 1.000 1.028 1.00 0.870 0.80 0.60 0.40 0.20 0.00 68 78 103 Centerline Elevation of Target above Ground (ft)

Page 214 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 13. Plant B North Wall Hit Probability for all EFs Target Elevation, Plant B - ALL EFs, North Wall 1.20 Hit Probability - Normalized to Lowest Target 1.000 0.986 1.00 0.80 0.60 0.520 0.40 0.20 0.00 6 21 41 Centerline Elevation of Target above Ground (ft)

Figure 14. Plant B South Wall Hit Probability for all EFs Target Elevation, Plant B - ALL EFs, South Wall 1.20 Hit Probability - Normalized to Lowest Target 1.000 1.00 0.80 0.569 0.60 0.397 0.40 0.20 0.00 6 31 64 Centerline Elevation of Target above Ground (ft)

Page 215 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 15. Plant B West Wall Hit Probability for all EFs Target Elevation, Plant B - ALL EFs, West Wall 1.20 Hit Probability - Normalized to Lowest Target 1.000 1.00 0.80 0.715 0.60 0.40 0.216 0.20 0.00 8.5 23.5 53.5 Centerline Elevation of Target above Ground (ft)

Page 216 of 226

September 21, 17 NEI 17-02, [Rev 1]

Target Size Study The objective of this study is to examine the impact of target size on targets hit probabilities. In this study, both plants A and B models are used. Targets are created with varying widths and preserving target heights and elevations. Eight targets are created for each of the plant models. ,

Missile inventory in Tables E-2 and E-4 for plants A and B are used. All missiles are assumed to be free missiles (i.e. not restrained). The total number of simulations for this study for both plants is two hundred millions. South wall targets for plant A has a constant height of 20 ft. The width was varied to produce targets with 40, 100, 600, 2400 ft2 respectively.

Targets on east wall for plant A has a constant height of 40 ft. The width was varied to produce targets with 60, 200, 2000, 4000 ft2 respectively. Targets on North wall for plant B has a constant height of 40 ft.

The width was varied to produce targets with 40, 120, 400, 2400 ft2 respectively. Targets on west wall for plant B has a constant height of 30 ft. The width was varied to produce targets with the following areas 30, 90, 300, 1500 ft2 respectively. Figures 16 and 17 show 3D view of targets for plant A. Figures 18 and 19 show 3D view of targets for plant B. Table 6 shows target sizes considered in this study. Results show that hit probability per unit area does not appreciably change with target size for targets with similar exposure, elevation, and height.

Table E-6. Target sizes and location for target elevation study Plant A Height (ft) Area 1 (ft2) Area 2 (ft2) Area 3 (ft2) Area 4 (ft2)

South Wall 20 40 100 600 2400 East Wall 40 60 200 2000 4000 Plant B North Wall 40 40 120 400 2400 West Wall 30 30 90 300 1500 Page 217 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 16. Plant A Targets showing variations in size Figure 17. Close-up plant A targets showing variations in size Page 218 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 18. Plant B Targets showing variations in size Figure 19. Close-up plant B targets showing variations in size Page 219 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 20. Normalized Plant A South Wall Hit Probability for all EFs Target Size - Plant A - ALL EFs, South Wall 1.20 Hit Probability per ft2 - Normalized to Mean of 1.049 1.016 1.005 1.00 0.929 0.80 0.60 all Targets 0.40 0.20 0.00 2400 600 100 40 Area of Target (ft2)

Figure 21. Normalized Plant A East Wall Hit Probability for all EFs Target Size, Plant A - ALL EFs, East Wall 1.20 Hit Probability per ft2 - Normalized to Mean 1.042 1.042 1.00 0.960 0.956 0.80 0.60 of all Targets 0.40 0.20 0.00 4000 2000 200 60 Area of Target (ft2)

Page 220 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 22. Normalized Plant B North Wall Hit Probability for all EFs Target Size, Plant B - ALL EFs, North Wall 1.20 Hit Probability per ft2 - Normalized to Mean of all 1.065 1.037 0.972 1.00 0.926 0.80 0.60 Targets 0.40 0.20 0.00 2400 400 120 40 Area of Target (ft2)

Figure 23. Normalized Plant B West Wall Hit Probability for all EFs Page 221 of 226

September 21, 17 NEI 17-02, [Rev 1]

Target Size, Plant B - ALL EFs, West Wall 1.20 Hit Probability per ft2 - Normalized to Mean of 1.030 1.062 1.00 0.962 0.947 0.80 0.60 all Targets 0.40 0.20 0.00 1500 300 90 30 Area of Target (ft2)

Page 222 of 226

September 21, 17 NEI 17-02, [Rev 1]

Missiles Distribution The objective of this study is to examine target hit probabilities sensitivity to missile distribution. Two distribution schemes are examined zonal and uniform.

Uniform missile distribution, means that all zones have a constant missile density. On the other hand, for zonal missile distribution each zone has a different number of missiles and the missile density varies.

For this study, no missile stratification is used since the use of stratification technique would negate the nature of uniform missile distribution. The zonal area of the plant A is 19,771,450 ft2 with a total of 100,327 missiles. The zonal area of the plant B is 31,360,000 ft2 with a total of 141,944 missiles. Missiles injected from top of buildings are excluded since uniform distribution of these missiles is unrealistic.

Zonal versus uniform missile and zones distribution for plants A and B are shown in Figures 24 and 25 respectively. Each zone has three designated numbers, the top number is the zone number, the middle number is the number of missiles in each zone (zonal distribution), and the bottom number is the number of missiles considering uniform distribution of missiles around the plant.

Results and conclusions of this study are discussed further in Appendix A.

Page 223 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 24. Plant A zonal versus uniform missile distribution Page 224 of 226

September 21, 17 NEI 17-02, [Rev 1]

Figure 25. Plant B zonal versus uniform missile distribution Page 225 of 226

September 21, 17 NEI 17-02, [Rev 1]

Page 226 of 226