ML18187A329

Request for Additional Information, Request to Revise Updated Final Safety Analysis Report to Incorporate Tornado Missile Risk Evaluator Methodology Into Licensing Basis

ML18187A329
Person / Time
Site:	Grand Gulf
Issue date:	07/20/2018
From:	Ellen Brown Special Projects and Process Branch
To:	Entergy Operations
Brown E, 301-415-2315
References
EPID L-2017-LLA-0371
Download: ML18187A329 (21)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 July 20, 2018 Vice President, Operations Entergy Operations, Inc.

Grand Gulf Nuclear Station P.O. Box 756 Port Gibson, MS 39150

SUBJECT:

GRAND GULF NUCLEAR STATION, UNIT 1 - REQUEST FOR ADDITIONAL INFORMATION RELATED TO REQUEST TO INCORPORATE THE TORNADO MISSILE RISK EVALUATOR INTO LICENSING BASIS (EPID L-2017-LLA-0371)

Dear Sir or Madam:

By letter dated November 3, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17307A440), as supplemented by letters dated December 6, 2017, and January 22, 2018 (ADAMS Accession Nos. ML173408025 and ML18022A598, respectively), Entergy Operations, Inc. (the licensee), submitted a pilot license amendment request for Grand Gulf Nuclear Station, Unit 1. By reference, the submittal incorporated Nuclear Energy Institute (NEI) topical report NEI 17-02, Revision 1, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," September 2017, which contains the TMRE methodology (ADAMS Accession No. ML17268A023). The proposed amendment would modify the licensing and design bases as described in the Updated Final Safety Analysis Report to include a new methodology based on NEI 17-02, Revision 1, for determining the structures, systems, and components that require protection from tornado-generated missiles.

As a result of our review of your docketed license amendment request, the U.S. Nuclear Regulatory Commission (NRC) staff finds that additional information is needed as set forth in the Enclosure to this letter. Your staff has indicated that a response to these questions can be provided by September 24, 2018. The NRC staff further notes that the fee waiver approved for this activity on July 3, 2017 (ADAMS Accession No. ML17130A742), will expire on November 3, 2018. At that point, all subsequent NRC staff efforts associated with the review will be billed at the full rate.

If you have any questions, please contact me at 301-415-2315 or via e-mail at Eva.Brown@nrc.gov.

Sincerely, fl~

Eva A. Brown, Senior Project Manager Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-416

Enclosure:

Request for Additional Information cc: Listserv

REQUEST FOR ADDITIONAL INFORMATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION ENTERGY OPERATIONS, INC.

GRAND GULF NUCLEAR STATION, UNIT 1 DOCKET NO. 50-416 Regulatory Position 2.3.3, "Probabilistic Risk Assessment Technical Adequacy," in Regulatory Guide (RG) 1.174, Revision 2, "An Approach For Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," May 2011 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML100910006), states that the technical adequacy of the probabilistic risk assessment (PRA) to support an application is determined by the adequacy of the actual modeling and the reasonableness of the assumptions and approximations. The following questions are related to reasonableness of the assumptions and approximations in the tornado missile risk evaluator (TMRE) PRA.

1. Section B.2.3, "Selection of Target Missile Hit Probabilities (P) For Developing MIP

[Missile Hit Probabilities]," of Nuclear Energy Institute (NEI) topical report NEI 17-02, Revision 1, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document,"

September 2017, which contains the TMRE methodology (ADAMS Accession No. ML17268A023), states, in part:

Choosing the most conservative target MIP from NP-768[11 (Target 4) would lead to overly conservative results for many targets at a NPP

[nuclear power plant]. Therefore, the normalized tornado missile impact probability from "All Targets" in NP-768 (from Table 3-15) is proposed for use in the TMRE. This results in a MIP that is based on the combined hits on all modeled surfaces in NP-768, Plant A.

The derivation of the MIP includes the containment building (Target 1). As stated in NEI 17-02, Revision 1, Section B.2.3, in part:

[t]he containment building is surrounded by other buildings ... so only the upper part of the containment is exposed to tornado missiles.

Additionally, the elevation of the exposed upper part of the containment is different from the elevation of other targets included in the calculation of near ground missiles.

Due to the overall height and the large surface area of the containment building, many missiles may be unable to reach upper portions of the containment building, which reduces the overall density of missile strikes and could become unrepresentative of other shorter plant buildings.

1 Electric Power Research Institute, Topical Report EPRI NP-768, "Tornado Missile Risk Analysis," May 1978. https://www.epri.com/#/paqes/product/NP-768/

Enclosure

Section 3.2.3.2, "Missile Impact and Damage Probability Estimates," of the Electric Power Research Institute (EPRI) topical report NP-768, "Tornado Missile Risk Analysis,"

May 1978, states, in part:

[t]he individual target contributions to the total hit probability is generally greater for the larger targets but least for the containment structure (7.65 x 10-10 , Table 3-8) which is shielded from impact for the first 60 feet

[(ft.)] above ground elevation.

Justify including Target 1 (containment building) of Plant A in EPRI NP-768 in computing the average MIP for targets less than 30 ft. above grade, given that the containment building is shielded by other buildings and is not impacted by near ground missiles.

Discuss how inclusion of Plant A containment building in computation of the average MIP for targets less than 30 ft. above grade impacts this application.

2. Section 8.4, "MIP Values for Use in the TMRE," of NEI 17-02, Revision 1, provides two sets of MIP values, one for elevated targets and one for near ground targets. The demarcation between near ground and elevated targets is 30 ft. above the primary missile source for a target. For targets near the ground, the MIP appears to be derived using the target areas listed in Table B-2 of NEI 17-02, Revision 1, which generally excludes the area of the roof (with an exception for Target 6, which includes the area of the roof). For the elevated MIP value, the area used to derive the MIP includes all the areas listed in Table B-1 of NEI 17-02, Revision 1, which includes roof areas.

a. The EPRI topical report NP-768 Plant A targets vary in height from 20 to 230 ft.

With the exception of the Target 1 (containment building), the buildings range in height from 20 to 80 ft. The weighted average (weighted by the wall area) height of all targets is 94 ft. The weighted average (weighted by the wall area) height of the targets is 56 ft. if Target 1 is excluded.

Provide the basis for the 30 ft. demarcation between near ground and elevated targets, given that EPRI NP-768 Plant A buildings range in height from 20 to 230 ft.

b. The MIPs calculated for elevated targets in Section B.4 are about 54 percent of the MIPs calculated for near ground targets. This percentage seems to reflect the assumptions with respect to areas included in calculation of MIPs for elevated and near ground targets. The difference in area appears to be the only factor that determined the difference between MIPs for elevated and near ground targets. One of the sensitivity analyses in Appendix E of NEI 17-02, Revision 1, examines the impact of target elevation on target hit probabilities. Revision 1 of NEI 17-02 states that the results of this sensitivity analysis show that in general as target elevation increases, hit probability decreases.

Describe the relationship between the numerical results shown in Appendix E and address whether the Appendix E results are generally consistent with the ratio of elevated to near ground MIPs calculated in Appendix B, "Bases for MIP and Missile Inventories." If Appendix E numerical results are not consistent with the ratio calculated in Appendix B, provide a justification.

3. Section 5, "Evaluate Target and Missile Characteristics," of NEI 17-02, Revision 1, states, in part, that:

[t]he <30 ft. MIP value can be used in cases where it is difficult to determine if the target is >30 ft. above all missile sources.

Table 5-1 in NEI 17-02, Revision 1, refers to targets that are 30 ft. above or below "grade," and Note 2 to the table explains:

[t]he term grade here is meant to refer to the elevation at which a majority of the missiles that can affect the target is located. Typically, this is plant grade, although for some targets it may be different.

The above discussions in Sections 5 and 5.1 of NEI 17-02, Revision 1, seem to provide different guidance regarding how to determine elevated targets (for which the MIP values are different). The U.S. Nuclear Regulatory Commission (NRC) staff notes that missiles may exist at elevations above some nominal plant grade or that targets exist at elevations that are above and below the nominal plant grade.

a. Describe the process that Grand Gulf Nuclear Station (GGNS) has used for determining near ground and elevated targets considering various elevations of targets and missiles. The description should include how this process ensures proper consideration of missile source applicability for each target relative to the demarcation height.

b. The hit frequency in EPRI NP-768 is a function of the insertion height of the missiles. In EPRI NP-768, the missiles were assumed inserted from heights ranging from 5 to 50 ft., except for cars, which were assumed inserted from 5 to 10 ft.

Address whether the range of cited insertion heights underestimates the hit probabilities.

4. Section 3.3.1 of the submittal states, in part, that "PRA logic and components that do not support mitigating a [LOOP (loss of offsite power)] can be screened" since the TMRE model uses non-recoverable LOOP sequences. Section 6.1, "Event Tree/Fault Tree Selection," of NEI 17-02, Revision 1, states that in addition to LOOP event trees, other internal initiating events should also be reviewed to ensure that either (1) a tornado event cannot cause another initiating event or (2) the impact of the initiating event can be represented in the logic selected to represent the tornado-initiating event. It was not clear whether the review discussed in Section 6.1 of NEI 17-02 was performed by Entergy Operations, Inc. (the licensee) to support this submittal. For example, the standby service water cooling tower (SSW CT) fans are an identified vulnerability which, according to Section 3.3.9 of the Enclosure to the submittal, "are important in that they support the operation of the emergency diesel generators and the [emergency core cooling] ECCS systems." The SSW CT fans do not appear to have been reviewed as initiators or as support system losses that need to be included in the sequences. The walkdowns also appear to have been performed with a focus on the LOOP mitigation and other initiators or support system failures do not appear to have been considered during the walkdowns.

Describe whether a review was performed to ensure that a tornado event cannot cause another initiating event or the impact of the initiating event can be represented in the logic selected to represent the tornado-initiating event. Provide the results of this review including a discussion of any potential impact on and from walkdowns.

5. Section 3.2.3, "SSC [Structures, Systems, and Components] Failure Modes," of NEI 17-02, Revision 1, references consequential failures and describes treatment of identified and documented cases to be addressed in Section 6, "Develop TMRE PRA Model," of NEI 17-02, Revision 1. Specifically, the first bullet in Section 3.2.3 characterizes tanks and piping as "passive" components.

Section 3.2.3 does not appear to include guidance on consideration of secondary effects. Such effects include consideration for fluid-filled tanks and pipes, combustion motor intake effects (loss of oxygen from inert gas tank rupture or exhaust re-direction scenarios), and other potential secondary effects to the SSCs' function.

Describe how secondary effects that may result from failure of non-conforming conditions were considered for identification of the initiating events and failure modes in the licensee's TMRE development.

6. Section 3.4.3, "Temporary Missiles," of NEI 17-02, Revision 1, states that the expected missile inventory for the post-construction site should be estimated, using walkdown results for the non-construction areas information in Sections 3.4.2, "Non-Structural Missile Inventory," and 3.4.4, "Structural Missiles," along with design and construction information. The section states that the basis and assumptions used for the estimated number of post-construction missiles will be documented. The November 3, 2017 license amendment request (LAR) (ADAMS Accession No. ML17307A440), does not appear to provide a basis for the adequacy of missile counts for post-construction site.

Section 3.4.3 of NEI 17-02, Revision 1, states the total missile count for the sensitivity analysis should include the non-construction related missile inventory determined in accordance with Sections 3.4.2 and 3.4.4, and a conservative estimate of the number of all construction-related missiles. The NEI guidance further states that the basis and assumptions used to determine the conservative construction missile estimate should be documented. The LAR does not appear to provide a basis for the adequacy of construction-related missile counts.

a. Describe and justify the approach that will be used for the classification of the construction-related missiles in GGNS's future implementation of the TMRE methodology.

b. Section 3.4.3 of NEI 17-02, Revision 1, states that it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory.

The guidance further states that outages are of relatively short duration compared to the operational time at a nuclear power plant. The NRC staff notes that duration of outages or other temporary activities that involve bringing additional equipment to the sites may be relatively long, specifically for a multi-unit site. It does not appear that GGNS has considered additional equipment (such as outage conditions) in estimating the number of missiles.

Clarify whether GGNS outage-related missiles were considered in the total number of missiles used for GGNS TMRE implementation. Provide a justification if those missiles are not considered in estimating the total number of missiles at the site.

c. Section 3.4, "Tornado Missile Identification and Classification," of NEI 17-02, Revision 1, provides guidance for verifying the number of missiles resulting from the deconstruction of various types of buildings through the TMRE walkdown.

The guidance does not appear to involve walkdowns to count the potential missiles a non-Category I building contains inside the structure or to count missiles that would be generated by the deconstruction of the structure itself.

The guidance should ensure that the missile inventories from building deconstruction are not under predicted for a specific plant.

i. For each type of building addressed in NEI 17-02, Revision 1, explain how GGNS missile count considers building contents (i.e., materials that are not part of the building itself but available to become missiles if the building is hit).

ii. For those types of buildings where the NEI 17-02, Revision 1, methodology was applied, verify that the overall estimate of non-structural missiles within buildings is representative or bounding.

7. Section 3.3.5, "Target Evaluation," and the notes to Table 3-3 of the Enclosure to the submittal implies that robustness of targets with respect to certain missile types is not considered anywhere in quantification and that any missile is considered to fail any target completely. The submittal indicates that this methodology is intended to be applied to future discoveries or as-built non-conforming conditions, but does not describe how this provision will be applied.

Sections 5.2, "Missile Inventories," and 5.2.1, "Missile Inventory Example," of NEI 17-02, Revision 1, explain that a bounding inventory of missiles was developed from a survey of five plants along with a generic distribution of missile types. These sections explain that the missile types and target robustness categories are used to determine if a target fails.

Section 5.2 explains that in using the TMRE approach, the missiles at a specific plant should be counted to ensure that the missile inventory at the plant is bounded by the inventory used in the TMRE methodology based on the survey. Finally, Section B.6, "Missiles Affecting Robust Targets," of NEI 17-01, Revision 1, states that the number of missiles used in the Exposed Equipment Failure Probability (EEFP) calculation can be adjusted to account for the population of missiles that can damage an SSC and provides the percentage of the total missile inventory for each type of robust target. These percentages appear to depend on specific missile type counts taken from two plant missile inventories as shown in Tables B-15, B-16, and B-17.

The sections of NEI 17-02, Revision 1, cited above do not appear to provide guidance for adjusting the relative contribution of each missile type based on plant-specific information. A skewed distribution of missile types at a specific plant site could have an impact on the risk results of the TMRE PRA, because certain missiles (from certain missile robustness categories) can fail a greater number of SSCs than missiles from lesser robustness categories.

Describe how any future use of the TMRE guidance for adjusting the number of missiles for robust targets at GGNS will be performed to ensure GGNS evaluation will ensure that the contribution of each missile type to the overall missile population in NEI 17-02, Revision 1, is representative of the contribution of each missile type to the overall missile population at GGNS.

8. Section 5.3, "Target Exposed Area," of NEI 17-02, Revision 1, provides the method for calculating the area of an SSC that is exposed to being struck by a tornado missile for various types of SSCs and how their target exposed area should be calculated for the EEFP. When calculating surface area, some components (e.g., tanks, ultimate heat sink fans, etc.) are susceptible to potential missiles in the vertical direction that could result in additional exposed area. The GGNS licensing basis defines parameters for missile velocities in both horizontal and vertical directions in the GGNS UFSAR, Table 3.5.1-6, "Tornado Missiles Considered in the GGNS Design."

Section 3.3.2, "Target Walkdowns," of the Enclosure to the submittal provides the scope of TMRE walkdowns. The third bullet of Section 3.3.2 includes identifications of "directions from which tornado missiles could strike the target" in the scope of walkdowns. It does not appear to differentiate between horizontal and vertical missiles consistent with the GGNS licensing basis.

Considering that tornado missiles could strike from all directions, describe how the above bulleted item in Section 3.3.2 of the Enclosure to the submittal was performed and how vertical missiles and directional aspects are included in the GGNS TMRE.

Principles of Risk-Informed Decision-Making

9. One of the key principles in RG 1.174, Revision 2 states that the proposed change meets the current regulations unless it is explicitly related to a requested exemption.

Section 2.2, "Current Licensing Basis (CLB)," of the Enclosure to the submittal states that GGNS was designed to meet General Design Criterion (GDC) 2, "Design bases for protection against natural phenomena," and GDC 4, "Environmental and dynamic effects design bases," in Appendix A to Part 50 of Title 10 of the Code of Federal Regulations (10 CFR). GDC 2 states that SSCs important to safety be designed to withstand the effects of natural phenomena such as tornadoes without loss of capability to perform their safety functions. GDC 4 states that SSCs important to safety be designed to accommodate the effects of missiles that may result from events and conditions outside the nuclear power unit, which includes tornadoes.

Section 4.1, "Applicable Regulatory Requirements/Criteria," of the Enclosure to the submittal states that Section 3.5.1.4, "Missiles Generated by Tornadoes and Extreme Winds," of NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants" (SRP), allows for a probabilistic basis for "relaxation of deterministic criteria" for tornado missile protection of SSCs. The submittal further states that "RG 1.174 establishes criteria to quantify the 'sufficiently small' frequency of damage" discussed in the SRP. However, the cited SRP sections discuss the probability of occurrence of events and not the change in core damage frequency (CDF) and large early release frequency (LERF). The probabilistic criteria in SRP 3.5.1.4 (i.e., the

probability of damage to unprotected safety-related features) is not directly comparable to RG 1.174 acceptance guidelines.

Address how the proposed methodology will continue to provide reasonable assurance that the SSCs important to safety will continue to withstand the effects of missiles from tornados or other external events without loss of capability to perform their safety function.

10. Regulatory Position 2.1.1, "Defense-in-Depth," in RG 1.174, Revision 2, discusses defense-in-depth as one of the key principles of risk-informed integrated decision-making. This regulatory position states that the engineering evaluation should evaluate whether the impact of the proposed licensing basis change (individually and cumulatively) is consistent with the defense-in-depth philosophy. Section 3.2.1 of the Enclosure to the submittal discusses licensee's assessment of defense-in-depth considerations for this application.

One of the items listed in support of the conclusion that "defenses against human errors are preserved" in Section 3.2, "Traditional Engineering Considerations," of the Enclosure to the submittal refers to a licensee procedure that includes "post-tornado walkdowns for tornado missile vulnerable SSCs." It is further stated that the procedure "includes a table of plant vulnerabilities to tornado-generated missiles and recovery actions that reduce the impact of a tornado missile affecting the identified SSCs."

Discuss whether any vulnerabilities were identified during the licensee's TMRE PRA development that were not present in the procedure cited by the licensee and any changes to the procedure resulting from the licensee's TMRE PRA development.

11. Regulatory Position 2.1.1 in RG 1.174, Revision 2, discusses defense-in-depth as one of the key principles of risk-informed integrated decision-making. This regulatory position states that one of the consideration in the assessment of whether the proposed change meets the defense-in-depth philosophy is to determine whether over-reliance on programmatic activities as compensatory measures associated with the proposed change is avoided.

Diverse and Flexible Coping Strategies (FLEX) equipment is cited as a defense-in-depth feature in Section 3.2 of the Enclosure to the submittal. It is stated that "critical equipment is stored in structures that would prevent it from being impacted by a tornado or tornado missile."

For each non-conforming condition, describe how the FLEX equipment will provide additional defense-in-depth in the context of the assumptions used for the TMRE PRA including the lack of credit for operator actions outside protected structures and the potential for staged equipment becoming missiles.

12. Regulatory Position 2.1.1 in RG 1.174, Revision 2, discusses defense-in-depth as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states that the engineering evaluation should evaluate whether the impact of the proposed licensing basis change (individually and cumulatively) is consistent with the defense-in-depth philosophy. Section 3.2 of the Enclosure to the submittal discusses the licensee's assessment of defense-in-depth considerations for this application. The

assessment does not appear to fully address all seven defense-in-depth considerations discussed in Regulatory Position 2.1.1.

Provide an evaluation of the impact of the proposed changes, individually and cumulatively, on the following defense-in-depth considerations contained in RG 1.174:

• System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

• Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

• The intent of the plant's design criteria is maintained.

13. Regulatory Position 2.1.2, "Safety Margin," in RG 1.174, Revision 2, discusses safety margin as one of the key principles of risk-informed integrated decision-making. This Regulatory Position states, in part, that with sufficient safety margin, the safety analysis acceptance criteria in the licensing basis (e.g., final safety analysis report (FSAR),

supporting analyses) are met or proposed revisions provide sufficient margin to account for analysis and data uncertainty. Section 7.5, "Defense-in-Depth and Safety Margin," of NEI 17-02, Revision 1, explains that engineering evaluation should be performed to assess whether the proposed licensing basis change maintains safety margin and identify conservatisms in the risk assessment to show that safety margin is maintained.

Section 3.2, "Traditional Engineering Considerations, "of the Enclosure to the submittal discusses defense-in-depth and safety margin and states, in part, that "safety analysis acceptance criteria in the licensing basis are unaffected by the proposed change" but provides no basis for that statement.

Section 2.3, "Evaluate Target and Missile Characteristics," of NEI 17-02, Revision 1, states that tornado missile failures do not need to be considered for SSCs protected by 18-inch reinforced concrete walls, 12-inch reinforced concrete roofs, and/or 1-inch steel plate. The guidance requires no analysis for evaluating the risk of non-conforming conditions that are protected as described in Section 2.3 of NEI 17-02, Revision 1, and implies that no protection against the tornado-generated missiles is needed for those SSCs. Revision 1 of NEI 17-02 provides similar guidance in Sections 5 and 6.5.

a. Describe the basis for the conclusion that the safety analysis acceptance criteria in the licensee's safety analysis are not impacted by the proposed change.

b. Discuss any non-conforming conditions that were (or if identified in the future, will be) screened from GGNS TMRE analysis using the criteria in Section 2.3 of NEI 17-02, Revision 1. For those non-conforming conditions, demonstrate that the safety analysis acceptance criteria in the licensing basis are met or that proposed revisions provide sufficient margin to account for analysis and data uncertainty.

14. Regulatory Position 2.4, "Acceptance Guidelines," in RG 1.174, Revision 2, discusses the risk acceptance guidelines. Section 7.3, "Comparison to Risk Metric Thresholds," of NEI 17-02, Revision 1, indicates that the delta risk between the compliant case and the

degraded case PRA results should be evaluated against the "very small" change in risk acceptance guidelines given in RG 1.174, Revision 2 (change in CDF of smaller than 10-6 per year and change in LERF of smaller than 10-7 per year), and states, in part, that:

[i]t is possible that some licensees may exceed these thresholds, in which case, additional discussion on defense-in-depth and safety margins may be warranted in the LAR.

Section 2.5, "Quantify Risk, Perform Sensitivity Analyses, and Compare to Thresholds,"

of NEI 17-02, Revision 1, states, in part, that:

[i]f flCDF or flLERF are close to or exceed the thresholds of RG 1.174, refinements to the Compliant and/or Degraded Case PRAs may be appropriate.

And

[i]f further reductions to llCDF and flLERF are not possible [by refining the analysis], the licensee will need to decide whether physical modifications should be made and to which SSCs.

Section 7 .3 of NEI 17-02, Revision 1, appears to allow providing more information about defense-in-depth if the change-in-risk thresholds of RG 1.174 are exceeded, whereas Section 2.5 appears to allow analysis refinement and plant modification if the thresholds are exceeded.

Describe the licensee's approach if performance-monitoring programs indicate that the risk acceptance guidelines for "very small" change-in-risk in RG 1.174, Revision 2, are exceeded. Clarify whether any additional refinements beyond the guidance in NEI 17-02, Revision 1, will be made if acceptance guidelines are exceeded.

15. Regulatory Position 3, "Element 3: Define Implementation and Monitoring Program," in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. Section 8.1, "Plant Configuration Changes," of NEI 17-02, Revision 1, states that design control programs meeting 10 CFR Part 50 Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," will ensure subsequent plant configuration changes are evaluated for their impact on non-conforming SSC risk using TMRE. Section 8.1 also states, in part, that:

[l]icensees should ensure that they have sufficient mechanisms to assure that any significant changes to site missile sources, such as a new building, warehouse, or laydown area are evaluated for impact to the TMRE basis, even if not in the purview of the site Design Control program.

Section '4.1, "Applicable Regulatory Requirements/Criteria," of the Enclosure to the submittal states that the licensee has confirmed that sufficient mechanisms to assure that any significant permanent changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site design control program. Permanent changes that increase the

site missile burden within the 2500-ft. missile radius established for TMRE should be reviewed for impact on the TMRE analysis.

a. Describe the mechanism(s) and approach(es) that will be followed by the licensee to determine whether a particular change to the facility is "significant" for evaluation of the impact to the TMRE basis.

b. Describe the licensee's mechanisms that assure temporary and permanent changes to site missile sources will be evaluated.

c. Describe the process(es) that ensure changes that could affect GGNS TMRE results (e.g., plant design changes, changes made to the licensee's base internal events PRA model and new information about the tornado hazard at the plant) are considered in future implementation of the licensee's TMRE.

d. Describe, with justification, the treatment of the currently identified non-conforming conditions in future uses of the licensee's TMRE PRA model.

e. Describe, with justification, how the cumulative risk associated with unprotected SSCs evaluated under TMRE will be considered in future decision making (e.g.,

10 CFR 50.59 criteria as well as in future risk-informed submittals).

TMRE PRA Model and Results

16. Regulatory Position 2.3.2, "Level of Detail Required to Support an Application," in RG 1.174, Revision 2, states that the level of detail required of the PRA is that which is sufficient to model the impact of the proposed change. This Regulatory Position further states that the characterization of the problem should include establishing a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated.

Section 6.5, "Target Impact Probability Basic Events," of NEI 17-02, Revision 1, states, in part, that:

SSC failures from tornado missiles may need to be considered for failure modes not previously included in the internal events system models.

Section 6.5 then provides four relevant examples (i.e., flow diversion and/or leaks, tank vent failures, valve position transfer - spurious actuations, and ventilation damper failures). The section does not appear to provide guidance about when and to what extent such failure modes should be considered.

Describe how the potential failure modes stated in Section 6.5 of NEI 17-02, Revision 1, were considered by the licensee during the TMRE walkdown, identified, and included in the licensee's TMRE PRA model used to support this application.

17. Section 3.3, "Ex-Control Room Action Feasibility," of NEI 17-02, Revision 1, states that no credit for operator action should be taken for actions performed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of a tornado event outside a Category I structure (in a location for which the operator must travel outside a Category I structure), but can be considered in the PRA after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

Guidance in this section states that operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> could be impacted by such environmental conditions as debris that blocks access paths and should be

considered by taking into account whether equipment will be accessible and whether the time required to perform the action will be impacted.

Discuss, with justification, the assessments performed to ensure that environmental conditions will not affect operator actions that are credited after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in the licensee's TMRE PRA model used to support this application.

18. Section 4.6, "Calculate Exceedance Probabilities," of NEI 17-02, Revision 1, states that exceedance probabilities should be generated for "the upper ranges for each F' [Fujita prime] category," F'2 through F'6, using the trendline equation. The figure provided in Section 4.6 suggests that the largest exceedance probability for each F' category, which corresponds to the lowest tornado speed for each F' category, is used.

Describe how the exceedance probabilities influence on the initiating event frequencies were determined using the guidance in Section 4.6 of NEI 17-02, Revision 1 in the TMRE methodology.

19. Tables 2-2 and 3-3 of the Enclosure to the submittal lists the "non-conforming (safety related) SSC vulnerabilities" used for the licensee's TMRE evaluation. The list in the above-mentioned tables in the submittal does not appear to include the SSCs presented in the pre-submittal meeting slides (ADAMS Accession No. ML17283A412). One of the items listed in Section 3.2 of the Enclosure to the submittal refers to a licensee procedure that includes "post-tornado walkdowns for tornado missile vulnerable SSCs."

It is further stated that the procedure "includes a table of plant vulnerabilities to tornado-generated missiles and recovery actions that reduce the impact of a tornado missile affecting the identified SSCs." Further, Attachment 1 of the Enclosure to the submittal provides the proposed changes to the licensee's Updated Final Safety Analysis Report (UFSAR) where several of the vulnerabilities that were listed in the pre-submittal meeting slides are included in the proposed revision to UFSAR Table 3.5-8 "Safety Related Components Located Outside," and are categorized using terms such as "exposed" and "partially shielded".

a. Explain, with justification, the rationale for not including several of the vulnerabilities listed in the pre-submittal meeting slides in the proposed revision to UFSAR Table 3.5-8 or Table 3.5.1-14a given that the vulnerabilities are "safety related" and found to be "exposed" and/or "partially shielded". Section 5.3.2, "Target Shielding," of NEI 17-02, Revision 1 provides guidance for partial shielding. Provide additional detail on whether partial shielding is credited in in TMRE assessment.

b. Provide a list of all non-conformances and vulnerabilities modeled in the licensee's TMRE model. Include the surface area, robust target credit, number of missiles, MIP, and EEFP for each item identified in the list and cite the source for any robust target credit used.

c. Discuss whether plant vulnerabilities identified in the table in the cited procedure were considered and included in the licensee's TMRE PRA and provide the rationale for any exclusions.

d. Provide mark-up of all UFSAR section that have proposed changes. Section 2.4 of the LAR specifies changes in UFSAR Section 3.5.1.4; however, Attachment 1 of the Enclosure to the LAR does not reflect any markup to that UFSAR section.

e. According to Table 3.5-8 in Attachment 1 of the Enclosure to the submittal, eighty one (81) six inch diameter openings exist on the north face of the Control Building exterior wall and those openings are exposed due to the partially complete Unit 2 auxiliary building. The submittal seems to be missing any discussion or screening criteria for acceptability of leaving 81 6-inch control room penetrations (partially exposed) unprotected. If the penetrations are included in the licensee's TMRE, describe the approach used for their modeling and inclusion. If the penetrations are not included in the licensee's TMRE, justify their exclusion.

20. Regulatory Position 1, "A Technical Acceptable PRA," of RG 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," March 2009 (ADAMS Accession No. ML090410014), addresses the technical acceptability of a PRA. Regulatory Position 2, "Consensus PRA Standards and Industry PRA Programs," further states that one acceptable approach to demonstrate conformance with Regulatory Position 1 is to use a national consensus PRA standard or standards that address the scope of the PRA used in the decision-making and that a peer review is needed to determine if the intent of the requirements in the standard is met. Regulatory Position 3.3, "Demonstration of Technical Adequacy of the PRA," in RG 1.200, Revision 2, states that one of the aspects to demonstrating the technical adequacy of the pieces of the PRA supporting an application is assurance that those pieces have been performed in a technically correct manner.

Table J.10 in Attachment L of the Enclosure to the submittal provides the finding level facts and observations (F&Os) from the 2015 full-scope peer-review that was performed against the 2009 version of the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) PRA Standard.

a. Facts and Observations 5-9(F), related to SRs SC-81 and SC-82, notes the lack of an analytical basis for the assuming successful emergency core cooling system (ECCS) pump operation with availability of suppression pool make up (SPMU) and recommended including the assumption as a source of modeling uncertainty. The resolution of the F&O does not provide an analytical basis, but states that availability of injection from the condensate storage tank (CST} or other external source will preclude the need for SPMU and that "SPMU is determined not to be required for any additional initiators other than the previously required [medium break loss-of-coolant accident] MLOCA and [large break LOCA] LLOCA." Further, with regard to high pressure core spray (HPCS) operation, the resolution states that "injection of CST volume will increase level and the potential for trip is eliminated in the majority of cases." Section 3.3.8 of the Enclosure to the submittal states that the dominant contributor to the degraded and compliant TMRE cases was the CST. As a result, it appears that the assumption in the resolution of F&O 5-9(F) can be impacted which 1n turn can impact the results of the licensee's TMRE model. In the context of the cited F&O, discuss, with justification, the impact of the dominant contribution of the CST failure in the licensee's TMRE model on this application.

Section J.4.2 of Attachment 2 to the Enclosure to the LAR states that the current GGNS internal events model-of-record (MOR), "GGNS Rev 4a PRA", includes "FLEX capabilities" and the same were added to the PRA model subsequent to the 2015 full-scope peer-review.

b. Clarify whether any FLEX equipment is modeled and credited in the TMRE PRA model used to support this application.

c. If such equipment is credited in the TMRE PRA model used to support this application:

i. Clarify whether incorporation of mitigating strategies in GGNS internal events PRA model has been peer-reviewed. If the incorporation of mitigating strategies has not peer-reviewed, justify why the addition of mitigating strategies is not considered a PRA upgrade. If this change qualifies as an upgrade, provide the results from the focused-scope peer review including the associated F&Os and their resolution.

ii. Identify the equipment including whether it is portable or permanently installed.

iii. Describe, with justification, the failure rates used for each credited FLEX equipment and their associated human error probabilities (HEPs).

Describe whether and how these HEPs consider environmental conditions, training and procedures relevant to this application.

Alternatively, demonstrate the impact of the credited FLEX equipment on the TMRE PRA analysis using a sensitivity study that removes such credit.

iv. Describe the approach for future use of FLEX equipment in the licensee's TMRE PRA model considering (i) the NRC staff's comments from the assessment of NEI 16-06 (ADAMS Accession No. ML17031A269) including the post-license amendment use of FLEX equipment in a PRA model, and (ii) the identification of FLEX equipment as a defense-in-depth measure in Section 3.2 of the Enclosure to the submittal.

21. Regulatory Position 1 of RG 1.200, Revision 2, addresses the technical acceptability of a PRA. Regulatory Position 2 further states that one acceptable approach to demonstrate conformance with Regulatory Position 1 is to use a national consensus PRA standard or standards that address the scope of the PRA used in the decision-making and that a peer review is needed to determine if the intent of the requirements in the standard is met.

Table J.9 of Attachment 2 to the Enclosure to the LAR provides the licensee's evaluation of specific SRs from the ASME/ANS PRA Standard that have been identified in the NEI 17-02. Additional comments from the licensee on SRs QU-E2 and QU-E4 refer to Section 3 of the Enclosure to the LAR.

Table J.10 provides the finding level F&Os from the 2015 peer-review of the licensee's internal events and internal flooding PRA models. Facts and observations 5-22 (F)

related to SR LE-GS states that the analysis should "identify how any simplifying assumptions can impact applications."

Discuss the examination performed to identify how the simplifying assumptions for the LERF analysis impact the base internal events PRA model, as stated in F&O 5-22, as well as this application.

22. The licensee's evaluation of SR AS-A10 in Table J.9 of Attachment 2 to the Enclosure to the submittal states that the diesel-driven firewater pumps are credited in the TMRE PRA model. Based on the licensee's evaluation of SR AS-B3 in the same table, it appears that the diesel-driven firewater pumps are not located in a Category I structure.

Several SRs with unique TMRE considerations require inclusion of the impacts on tornado events on the system operability and success criteria (e.g. SRs AS-A3 through AS-AS, AS-B3, and SY-A4 ). Section 3.2.3 of NEI 17-02, Revision 1, provides guidance on such considerations during the walkdown. Sections 6.3 and 6.6 in NEI 17-02, Revision 1, provide guidance on the model changes needed to account for non-Category I structures and non-safety related SSCs therein. Section 3.3 of NEI 17-02, Revision 1, provides guidance on the feasibility of human actions outside of Category I structures.

In light of the above,

a. Describe how the guidance in NEI 17-02, Revision 1, was implemented for the inclusion and credit for the diesel-driven firewater pumps in the TMRE PRA including details from the corresponding walkdown.

b. Clarify whether any operator actions are necessary and have been modeled for the diesel-driven firewater pumps. If such actions have been modeled, describe how the guidance in NEI 17-02, Revision 1, and unique TMRE considerations for the human reliability analysis (HRA) related SRs were implemented for those actions.

23. Regulatory Position 1 of RG 1.200, Revision 2, addresses the technical acceptability of a PRA and Regulatory Position 1.1 states that the scope of a PRA is defined by the challenges included in the analysis and the level of analysis performed. Regulatory Position 3.2 of RG 1.200, Revision 2, states that the licensee needs to identify the pieces of the PRA for each hazard group required to support a specific application.

Based on Attachment 2 to the Enclosure it appears that the licensee's internal events PRA model, which is the base for the TMRE PRA model, includes multiple loss-of-offsite power {LOOP or LOSP) initiators. Examples include "transient LOOP", "consequential" LOOP "as a result of transient initiator", and "loss of preferred offsite initiator."

a. Identify the different LOOP initiators in the licensee's internal events PRA model and clarify which LOOP initiator(s) was considered for the licensee's TMRE PRA model.

b. Clarify which LOOP initiator was used to develop licensee's TMRE PRA model and justify use of the selected LOOP initiator. An ideal response will discuss whether all LOOP initiators in the licensee's internal events PRA model have the same event tree, credit the same systems for mitigation and the differences between LOOP initiators.

Uncertainties and Sensitivity Analyses

24. Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings.

Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

Regulatory Position 3 in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. This Regulatory Position further states that an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This will ensure that the conclusions that have been drawn from the evaluation remain valid.

Section 7.2, "Sensitivity Analysis," of NEI 17-02, Revision 1, address the steps that should be taken if the change in CDF and LERF from the sensitivity analyses exceed 1o-6 per year and 10-7 per year, respectively.

a. Describe the GGNS process if change-in-risk estimates from sensitivity analyses exceed the RG 1.174, Revision 2, acceptance guidelines for "very small" change in risk in implementation of TMRE methodology.

b. Describe how the importance measures are determined from the TMRE PRA model in the context of the 'binning' approach for the tornado categories employed in the model. Describe whether and how the same basic events, which were discretized by binning during the development of the TMRE PRA model, are combined to develop representative importance measures. For same basic events that are not combined, provide a justification that includes discussion of any impact on the results.

c. Identify the non-conforming conditions and vulnerabilities that met all the characteristics of a "highly exposed" SSC per Section 7.2.1, "TMRE Sensitivities," of NEI 17-02, Revision 1.

The discussions in Section 7 .2 of NEI 17-02, Revision 1, do not address whether sensitivity analyses will be aggregated in future implementations of the TMRE methodology. For example, it is unclear whether the licensee will combine the sensitivity analyses related to any future open PRA facts and observations (F&Os), sensitivities that address compliant case conservatism and TMRE sensitivity analyses.

d. Describe, with justification, whether sensitivity analyses in Section 7.2 of NEI 17-02, Revision 1, will be aggregated in future implementation of the TMRE methodology.

The discussion in Section 7.2.3, "Compliant Case Conservatisms," and Section A.2.1.3, "Non-Category I Structures and Exposed Non-Safety Related SSCs," of NEI 17-02, Revision 1, recognizes that the TMRE .PRA could produce non-conservative

change-in-risk results if conservatively assumed failures in the Compliant Case mask change-in-risk. Accordingly, Section 7 .2.3 of NEI 17-02, Revision 1, states, in part, that:

[the] licensee should review cutsets in the top 90% of the TMRE compliant case to identify conservatisms related to equipment failure (opposed to offsite power recovery or operator actions) that could impact results.

Section 7 .2.3 of NEI 17-02, Revision 1, also explains that the licensee should perform sensitivity studies associated with these conservatisms as directed in Appendix D of the TMRE guideline for PRA standard supporting requirements (SRs) AS-A10, LE-C3, and SY-B7 to address equipment failures in the compliant case that may be masking change-in-risk but does not provide guidance on how such a sensitivity can be performed.

Section 3.3.10 "Sensitivities and Uncertainties", of the Enclosure to the submittal describes a sensitivity assessment performed to ensure conservative modeling treatments in the compliant case do not affect the risk assessment conclusions.

e. Describe any future sensitivity analysis that will be performed to assess the impact of conservatisms associated with modeling the equipment failures in the compliant case of the TMRE PRA model.

Modeling operator actions, could contribute to underestimating the change-in-risk calculation associated with non-conforming SSCs. Appendix D, "Technical Basis for TMRE Methodology," of NEI 17-02, Revision 1, does not appear to address the concern described above could also apply to conservative human reliability analysis modeling (e.g., SR HR-G3 and HR-G7).

f. Describe how GGNS will address the potential impact of TMRE assumptions related to certain human error probabilities within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the accident on the compliant case.

25. Regulatory Position 2 in RG 1.174, Revision 2, states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings.

Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

The discussion in Section A.7, "Zonal vs. Uniform (Z vs U) Sensitivity," of Appendix A, "Technical Basis for TMRE Methodology," to NEI 17-02, Revision 1, recognizes differences between zonal and uniform missile distributions without justification. Targets were categorized in Appendix A to separate intuitive from non-intuitive trends and an adjustment factor is proposed to account for zonal distribution of missiles.

Describe, with justification, how uncertainties associated with the impact of the missile distribution on the licensee's target hit probability are handled in the GGNS TMRE methodology.

26. Regulatory Position 1 of RG 1.200, Revision 2, addresses the technical acceptability of a PRA. Regulatory Position 2 further states that one acceptable approach to demonstrate

conformance with regulatory position 1 is to use a national consensus PRA standard or standards that address the scope of the PRA used in the decision-making and that a peer review is needed to determine if the intent of the requirements in the standard is met.

Section 3.3. 7, "Model Quantification," of the Enclosure to the submittal provides the quantification results for the licensee's TMRE model and discusses the truncation used for the model quantification. Comparison against corresponding values provided in the pre-submittal meeting slides (ADAMS Accession No. ML17283A412) shows a marked difference in the 'compliant case' results.

The truncation used for the licensee's TMRE model quantification is stated to be "consistent with the GGNS base model." However, the licensee's TMRE model quantification results are substantially lower than the base internal events model. Use of an inappropriate truncation level can adversely impact the risk insights and quantification. Supporting requirement QU-B3 in the 2009 ASME/ANS PRA Standard provides the requirements for truncation limits and provides an example of sufficient convergence as being when successive reductions in truncation value of one decade result in decreasing changes in CDF or LERF, and the final change is less than 5 percent.

Section 3.3.8, "Results," of the Enclosure to the submittal provides a discussion of the results and states that the dominant contributor for the 'compliant' and 'degraded' cases is the CST. However, the CST does not appear in Tables 2-2 and 3-3 of the Enclosure to the submittal which list the non-conformances included in the licensee's TMRE evaluation.

a. Justify the truncation level used for the licensee's TMRE model quantification and explain how the selected truncation level meets the SRs, such as QU-B3 and QU-F2, in Part 2 of the ASME/ANS PRA Standard as endorsed by RG 1.200, Revision 2.

b. Explain, with justification, the change in the quantification of the licensee's TMRE model presented in Table 3-4 of the Enclosure to the LAR, especially the change in the 'compliant' case, as compared to that provided in the pre-submittal meeting slides.

c. Explain the rationale for the CST being a dominant contributor to the risk based on the licensee's TMRE model considering that CST is not identified as a vulnerability or non-conforming condition.

27. Section 7.2.1, "TMRE Sensitivities," of NEI 17-02, Revision 1, identifies certain sensitivity studies and provides guidance on their performance. Section 3.3.10, "Sensitivities and Uncertainties," of the Enclosure to the submittal describes the sensitivity studies performed by the licensee to support this application. It appears that the sensitivity studies in Section 3.3.10 of the Enclosure to the submittal were performed by multiplying both the compliant and degraded case which will impact the vulnerabilities in both cases.

The guidance provided in Section A.6.2 of Appendix A of NEI 17-02, Revision 1, states that "the sensitivity will be performed by recalculating target EEFPs by multiplying the nominal values calculated for the Degraded Case." Similarly, the procedure for performing the sensitivities in Section 7.2.1 of NEI 17-02, Revision 1, states that "[f]or

SSCs with a tornado missile failure basic event multiply the basic event failure probability."

a. Describe the implementation of the guidance in NEI 17-02, Revision 1, on vulnerabilities when performing sensitivity analyses, especially the zonal versus uniform missile distribution sensitivity ("Sensitivity 1") and the missile impact parameter sensitivity ("Sensitivity 2"). If applicable, describe and provide the results of any updated sensitivity analyses considering the response to separate information requests on the basis for the MIP and the sensitivities (information requests 1, 4, and 24).

b. Describe the implementation of the guidance in NEI 17-02, Revision 1, on vulnerabilities when performing sensitivity analyses in future use of the licensee's TMRE PRA model.

28. Section 3.3.2, "Assessment of Assumptions and Approximations," of RG 1.200, Revision 2, states, in part, that:

[f]or each application that calls upon this regulatory guide, the applicant identifies the key assumptions and approximations relevant to that application. This will be used to identify sensitivity studies as input to the decision-making associated with the application.

Further, Section 4.2, "Licensee Submittal Documentation," of RG 1.200, Revision 2, states, in part, that:

[t]hese assessments provide information to the NRC staff in their determination of whether the use of these assumptions and approximations is appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate.

RG 1.200, Revision 2, defines the terms "key assumption" and "key source of uncertainty" in Section 3.3.2, "Assessment of Assumptions and Approximations."

Section JS of Attachment J of the Enclosure to the submittal states, in part, that assumptions and approximations used in the development of the GGNS internal events PRA which forms the basis for the TMRE PRA "have been reviewed and are appropriate for this application." The submittal does not appear to describe the key assumptions and key sources of uncertainties that were identified in GGNS internal events PRA model and how those assumptions and uncertainties were addressed.

a. Describe the key assumptions and key sources of uncertainties in GGNS internal events PRA that may impact this application.

b. Describe how each key assumption and key source of uncertainty was dispositioned for this application.

ML18187A329 OFFICE NRR/DORL/LSPB/PM NRR/DORL/LSPB/LA N RR/DSS/SC PB/BC NAME EBrown JBurkhardt Sanderson (NKaripineni for)

DATE 7/20/18 7/9/18 6/20/18 OFFICE NRR/DRA/APLB/BC NRR/DORL/LSPB/BC NAME GCasto DBroaddus (GMiller for)

DATE 6/19/18 7/20/18