ML18304A394

Issuance of Amendment Nos. 198 and 181, Revise Updated Final Safety Analysis Report to Incorporate Tornado Missile Risk Evaluator Methodology Into Licensing Basis

ML18304A394
Person / Time
Site:	Vogtle
Issue date:	01/11/2019
From:	Ellen Brown Special Projects and Process Branch
To:	Gayheart C Southern Nuclear Operating Co
Brown E, 415-2315
References
EPID L-2017-LLA-0350
Download: ML18304A394 (55)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 January 11, 2019 Ms. Cheryl A. Gayheart Regulatory Affairs Director Southern Nuclear Operating Company 3535 Colonnade Parkway Birmingham, AL 35243

SUBJECT:

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 - ISSUANCE OF AMENDMENTS TO UTILIZE THE TORNADO MISSILE RISK EVALUATOR TO ANALYZE TORNADO MISSILE PROTECTION NONCONFORMANCES (EPID L-2017-LLA-0350)

Dear Ms. Gayheart:

The U.S. Nuclear Regulatory Commission has issued the enclosed Amendment No. 198 to Renewed Facility Operating License NPF-68 and Amendment No. 181 to Renewed Facility Operating License NPF-81 for the Vogtle Electric Generating Plant (VEGP), Units 1 and 2, respectively. The amendments consist of changes to the Updated Final Safety Analysis Report (UFSAR) in response to your application dated October 11, 2017, as supplemented by letters dated July 26 and September 14, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML17284A348, ML18207A876, and ML18260A053, respectively).

The amendments incorporate the Tornado Missile Risk Evaluator methodology into the UFSAR for VEGP Units 1 and 2, and may be used to demonstrate whether an identified structure, system, and component is required to conform to the deterministic design and licensing requirements for protection against tornado missiles. The NRC staff notes that the TMRE methodology may only be applied to discovered conditions where tornado missile protection was required and not provided. This methodology does not provide a basis for modifications to remove existing tornado missile protection or to avoid providing tornado missile protection for new configurations. The methodology was provided as Enclosure 3 to Southern Nuclear Operating Company, lnc.'s (the licensee's) supplemental letter dated July 26, 2018 (NEI 17-02, Rev. 1A). On September 14, 2018, the licensee removed from its amendment request several changes described in the preface to Enclosure 2, "Red-Line Mark-up of NEI 17-02, Revision 1,"

of the licensee's letter dated July 26, 2018. This final methodology document (NEI 17-02, Rev. 1A) is intended to support future application of the TMRE methodology at VEGP Units 1 and 2 for identified nonconformances within the constraints identified in Sections 3.9 and 3.10 of this safety evaluation.

Additionally, the NRC's approval reflects a review by the NRC staff of the licensee's plant-specific request to implement the TMRE methodology at VEGP Units 1 and 2. The NRC staff is not generically approving NEI 17-02, Rev. 1, or Rev. 1A.

C. Gayheart A copy of the related Safety Evaluation is also enclosed. A Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerelyt

&.::n. S~~ :~j:t:~~ger Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-424 and 50-425

Enclosures:

1. Amendment No. 198 to NPF-68

2. Amendment No. 181 to NPF-81

3. Safety Evaluation cc: Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SOUTHERN NUCLEAR OPERATING COMPANY, INC.

GEORGIA POWER COMPANY OGLETHORPE POWER CORPORATION MUNICIPAL ELECTRIC AUTHORITY OF GEORGIA CITY OF DALTON, GEORGIA DOCKET NO. 50-424 VOGTLE ELECTRIC GENERATING PLANT, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 198 Renewed License No. NPF-68

1. The Nuclear Regulatory Commission (NRC, the Commission) has found that:

A. The application for amendment to the Vogtle Electric Generating Plant, Unit 1 (the facility) Renewed Facility Operating License No. NPF-68 filed by the Southern Nuclear Operating Company, Inc. (the licensee), acting for itself, Georgia Power Company, Oglethorpe Power Corporation, Municipal Electric Authority of Georgia, and City of Dalton, Georgia (the owners), dated October 11, 2017, as supplemented by letters dated July 26 and September 14, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, by Amendment No. 198, Renewed Facility Operating License No. NPF-68 is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR),

as set forth in the application dated October 11, 2017, as supplemented by letters dated July 26 and September 14, 2018. The licensee shall update the UFSAR to incorporate the plant-specific tornado missile risk evaluator methodology as described in the licensee's application dated October 11, 2017, as supplemented by letters dated July 26 and September 14, 2018, and the NRC staff's safety evaluation associated with this amendment, and shall submit the revised description authorized by this amendment with the next update of the UFSAR.

3. This license amendment is effective as of its date of issuance and shall be implemented within 90 days from the date of issuance. The UFSAR changes shall be implemented in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e).

FOR THE NUCLEAR REGULATORY COMMISSION

~ --Z:A-?

Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: January 11, 201 9

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SOUTHERN NUCLEAR OPERATING COMPANY, INC.

GEORGIA POWER COMPANY OGLETHORPE POWER CORPORATION MUNICIPAL ELECTRIC AUTHORITY OF GEORGIA CITY OF DALTON, GEORGIA DOCKET NO. 50-425 VOGTLE ELECTRIC GENERATING PLANT, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 181 Renewed License No. NPF-81

1. The Nuclear Regulatory Commission (NRC, the Commission) has found that:

A. The application for amendment to the Vogtle Electric Generating Plant, Unit 2 (the facility) Renewed Facility Operating License No. NPF-81 filed by the Southern Nuclear Operating Company, Inc. (the licensee), acting for itself, Georgia Power Company Oglethorpe Power Corporation, Municipal Electric Authority of Georgia, and City of Dalton, Georgia (the owners), dated October 11, 2017, as supplemented by letters dated July 26 and September 14, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations as set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 2

2. Accordingly, by Amendment No. 181, Renewed Facility Operating License No. NPF-81 is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR),

as set forth in the application dated October 11, 2017, as supplemented by letters dated July 26 and September 14, 2018. The licensee shall update the UFSAR to incorporate the plant-specific tornado missile risk evaluator methodology as described in the licensee's application dated October 11, 2017, as supplemented by letters dated July 26 and September 14, 2018, and the NRC staff's safety evaluation associated with this amendment, and shall submit the revised description authorized by this amendment with the next update of the UFSAR.

3. This license amendment is effective as of its date of issuance and shall be implemented within 90 days from the date of issuance. The UFSAR changes shall be implemented in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e).

FOR THE NUCLEAR REGULATORY COMMISSION

~ --;.,,H~

Michael T. Markley, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: January 11, 201 9

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 198 TO RENEWED FACILITY OPERATING LICENSE NPF-68 AND AMENDMENT NO. 181 TO RENEWED FACILITY OPERATING LICENSE NPF-81 SOUTHERN NUCLEAR OPERATING COMPANY, INC.

VOGTLE ELECTRIC GENERATING PLANT, UNITS 1 AND 2 DOCKET NOS. 50-424 AND 50-425

1.0 INTRODUCTION

By application dated October 11, 2017 (the submittal), as supplemented by letters dated July 26 and September 14, 2018 (References 1, 2, and 3, respectively), Southern Nuclear Operating Company, Inc. (SNC; the licensee), submitted a license amendment request to incorporate the Tornado Missile Risk Evaluator (TMRE) methodology into the Vogtle Electric Generating Plant (Vogtle, VEGP), Units 1 and 2 Updated Final Safety Analysis Report (UFSAR), Revision 21.

By letter dated August 30, 2018 (Reference 4), the U.S. Nuclear Regulatory Commission (NRC) staff notified SNC that additional changes included in the July 26, 2018, request for additional information response were beyond the scope of the original license amendment request as noticed in the Federal Register on March 27, 2018 (83 FR 13150). By letter dated September 14, 2018, SNC removed those additional changes from its request. Therefore, the supplemental letters dated July 26 and September 14, 2018, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staff's original proposed no significant hazards consideration determination as published in the Federal Register.

1.1 Purpose of Proposed Change The NRC issued Regulatory Issue Summary (RIS) 2015-06, "Tornado Missile Protection," on June 10, 2015 (Reference 5), to (1) remind licensees of the need to conform their facility to the current, site-specific licensing basis for tornado-generated missile protection; (2) provide examples of failure to conform with a plant's tornado-generated missile licensing basis; and (3) remind licensees of the NRC staff's positon that the licensee's systematic evaluation program or individual plant examination of external events results do not constitute regulatory Enclosure 3

requirements, and are not part of the plant-specific tornado-generated missile licensing basis, unless the NRC or licensee took action to specifically amend the operating license.

In response to RIS 2015-06, the licensee performed walkdowns at VEGP Units 1 and 2 to identify potential vulnerabilities with the current licensing basis (CLB) for tornado missile protection. Specifically, the licensee identified plant configurations in which structures, systems, and components (SSCs) should have been protected from tornado-generated missiles based on the CLB but were not resulting in noncompliance with design and licensing bases. These nonconforming conditions were identified on various SSCs including:

• Main steam safety valve exhausts;

• Atmospheric relief valve (loop 2);

• Atmospheric relief valve exhaust stacks;

• Turbine driven auxiliary feed water pump exhaust; and

• Condensate storage tank vents.

The licensee's request is to allow use of the TMRE methodology, which was developed by the Nuclear Energy Institute (NEI), to demonstrate that the risk associated with the nonconforming SSCs is acceptably low.

2.0 REGULATORY EVALUATION

2.1 Description of Proposed License Change The licensee proposed to change its licensing and design basis to incorporate the TMRE methodology to address identified nonconformances related to tornado missile protection. The TMRE is a risk-informed methodology, which is intended for application by SNC for VEGP Units 1 and 2 to resolve nonconforming conditions associated with the tornado missile protection requirements of their CLB. On September 21, 2017, NEI submitted NEI 17-02, Revision 1, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document" (the TMRE methodology) (NEI 17-02, Rev. 1) (Reference 6), in support of three proposed pilot implementations of the unapproved methodology. It is intended to provide guidance for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles and guidance for resolving discrepancies against licensing basis requirements. In addition, it provides guidance for assessing the risk posed by tornado missiles to determine whether physical protection of the noncompliant SSCs was warranted.

The methodology provided was Enclosure 3 to the licensee's supplemental letter dated July 26, 2018 (NEI 17-02, Rev. 1A). On September 14, 2018, the licensee removed from its amendment request the five changes described in the preface to Enclosure 2, "Red-Line Mark-up of NEI 17-02, Revision 1," of the SNC letter dated July 26, 2018. This final methodology document (henceforth called "NEI 17-02, Rev. 1A") is intended to support future application of the TMRE methodology at VEGP Units 1 and 2 for identified nonconformances within the constraints identified in Sections 3.9 and 3.10 of this safety evaluation.

The submittal defined the proposed change in three parts. In the first part, the licensee identified those aspects of the plant's licensing basis affected by the change including rules as well as regulations and the VEGP Units 1 and 2 UFSAR. In the second part, the licensee identified all SSCs, procedures, and activities affected by the change. In the third part, the licensee identified the engineering studies, codes, probabilistic risk assessment (PRA) findings, and analysis results relevant to the proposed licensing change.

In Section 2.4 of the October 11, 2017, submittal (Reference 1), the licensee stated that it was requesting NRC approval of the following:

... a new methodology to be described [incorporated by reference] in the VEGP UFSAR to assess the risk significance of conditions that do not conform to the tornado missile protection [licensing basis], and ... a conclusion that conditions with a risk significance meeting the criteria of the methodology are insufficiently important to safety, such that an accept-as-is disposition is acceptable to meet the guidance of [General Design Criterion (GDC)] 2 and GDC 4.

More specifically, the licensee proposed to revise UFSAR Sections 1.9.117.2, "VEGP Position,"

by stating that the nonconforming SSCs identified do not need missile protection. Additionally, the licensee proposed to revise UFSAR Section 3.5.3, "Barrier Design Procedures," to support reflecting the ability of the licensee to use NEI 17-02, Rev. 1A within the limitations outlined in this safety evaluation.

2.2 Tornado Missile Protection Licensing Basis Vogtle was designed to meet the General Design Criteria (GDC) in Appendix A, "General Design Criteria for Nuclear Power Plants," to Title 10 of the Code of Federal Regulations (10 CFR) Part 50. The CLB for tornado missile protection is contained in Section 3.1.1, "Overall Requirements," of the VEGP Units 1 and 2 UFSAR, "Criterion 2 - Design Bases for Protection against Natural Phenomena," and "Criterion 4 - Environmental and Missile Design Bases." The licensing basis for tornado missile protection, described in UFSAR Section 3.1.1, states, in part:

Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornados ... without loss of capability to perform their safety functions ... These structures, systems, and components shall be appropriately protected against dynamic effects, including the effects of missiles ... from events and conditions outside the nuclear power unit.

The SSCs important to safety are designed either to withstand the effects of natural phenomena without loss of the capability to perform their safety functions, or are designed such that their response or failure will be in a safe condition. Those SSCs vital to the shutdown capability of the reactor are designed to withstand the maximum probable natural phenomena at the site, determined from recorded data for the site vicinity, with appropriate margin to account for uncertainties in historical data. Appropriate combinations of structural loadings from normal, accident, and natural phenomena are considered in the plant design.

The credible missiles at Vogtle created by natural phenomena are those generated by tornadoes. The design parameters applicable to the design basis tornado are for NRC tornado Region I and are found in UFSAR Section 3.3.2, "Tornado Loadings." Seismic Category I structures, housing safety-related equipment, systems, and components are designed to withstand the effects due to the design basis tornado. Section 1.9, "Conformance to NRC Regulatory Guides," of the UFSAR discusses Vogtle's conformance to regulatory guides related to tornado protection.

The typical method used to meet the GDC is to provide positive (i.e., physical) protection features such as locating required equipment in structures designed for tornado missiles and

providing barriers designed for tornado missiles. The licensee requested a change to Vogtle's licensing bases to allow not protecting certain components from tornado missiles using a risk-informed approach.

2.3 Applicable Requirements General Design Criterion 2, "Design bases for protection against natural phenomena," in Appendix A to 10 CFR Part 50 establishes requirements regarding the ability of SSCs important to safety to withstand the effects of natural phenomena without the loss of capability to perform their safety functions. Protection from the missile spectrum set forth in Regulatory Guide (RG) 1. 76, Revision 1, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants,"

March 2007 (Reference 7), provides assurance that necessary SSCs will be available to perform their safety functions during and following a tornado.

General Design Criterion 4, "Environmental and dynamic effects design bases," establishes requirements regarding the ability of SSCs important to safety to be protected from dynamic effects, including the effects of missiles, from events and conditions outside the nuclear unit.

Protection from a spectrum of missiles with the critical characteristics set forth in RG 1. 76 provides assurance that the necessary SSCs will be available to mitigate the potential effects of extreme winds and missiles associated with such winds on plant SSCs important to safety.

2.4 Applicable Regulatory Guidance and Review Plans Section 3.5.1.4, Revision 3, "Missiles Generated by Tornadoes and Extreme Winds," and Section 3.5.2, Revision 3, "Structures, Systems, and Components to be Protected from Externally-Generated Missiles," of NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants" (SRP) (References 8 and 9, respectively),

specify that the SSCs important to safety be provided with sufficient, positive tornado missile protection (i.e., barriers) to withstand the maximum credible tornado threat. The appendix to Regulatory Guide (RG) 1.117, Revision 2, "Protection Against Extreme Wind Events and Missiles for Nuclear Power Plants," July 2016 (Reference 10), lists the types of SSCs that should be protected from design basis tornadoes. In addition to physical design methods, the NRC allows the use of probabilistic analysis to demonstrate that the probability of a tornado-generated missile striking safety-related equipment is sufficiently low such that no additional protective measures are required.

Regulatory Guide 1. 76, Revision 1, provides a method to select design-basis tornado and design-basis tornado-generated missiles that a nuclear power plant should be designed to withstand to prevent undue risk to the health and safety of the public.

Regulatory Guide 1.117, Revision 2, provides an approach for identifying those SSCs of light-water-cooled reactors that should be protected from the effects of the worst case extreme winds (tornadoes and hurricanes) and wind-generated missiles, such that they remain functional.

Section 19.1, Revision 3, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load," of NUREG-0800 (Reference 11) provides the NRC staff with guidance for evaluating the acceptability of a licensee's PRA results when used to request risk-informed changes to the licensing basis.

Section 19.2, Revision 0, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance," of NUREG-0800 (Reference 12), provides the NRC staff with guidance for evaluating the risk information used by a licensee to support permanent risk-informed changes to the licensing basis.

Regulatory Guide 1.174, Reference 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," May 2011 (Reference 13), describes an acceptable approach for developing risk-informed applications for a licensing basis change that considers engineering issues and applies risk insights. It provides general guidance concerning analysis of the risk associated with proposed changes in plant design and operation.

Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," March 2009 (Reference 14),

describes an acceptable approach for determining whether the PRA, in total or the parts that are used to support an application, is acceptable for use in regulatory decisionmaking for light-water reactors.

The American Society for Mechanical Engineers/American Nuclear Society (ASME/ANS)-RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," February 2009 (Reference 15), is referenced and NRC staff positions are endorsed in support of RG 1.200. This industrial standard sets forth requirements for PRAs used to support risk-informed decisionmaking for commercial nuclear power plants, and describes a method for applying these requirements for specific applications.

The guidance in NUREG/CR-4461, Revision 2, "Tornado Climatology of the Contiguous United States," February 2007 (Reference 16), examines the implications of switching from the Fujita Scale to the Enhanced Fujita (EF) Scale on design wind speed estimates for tornadoes.

Existing current NRC guidance on tornado characteristics for consideration in the design of nuclear power plants is found in Regulatory Guide 1.76 (AEC 1974). This guidance is based on a summary of information from a variety of sources called WASH-1300, "Technical Basis for Interim Regional Tornado Criteria," May 1974 (Reference 17). The initial version of NUREG/CR-4461 summarized data on tornadoes that occurred from January 1954 through December 1983 and were listed in a tornado database maintained by the National Severe Storms Forecast Center. Revision 1 of NUREG/CR-4461 updates the 1986 report using tornado data collected from January 1, 1950, through August 2003. It contains statistics on tornado dimensions and wind speeds by region of the country, and estimates of strike probabilities and design wind speeds by boxes with sides of 1 degree, 2 degree, and 4 degree of latitude and longitude.

The TMRE methodology uses data and examples from the Electric Power Research Institute (EPRI) topical report EPRI NP-768, "Tornado Missile Risk Analysis," May 1978 (Reference 18),

to determine the number of hits per targets. These values are used in support of determining the missile impact parameter (MIP). In a memorandum dated October 26, 1983 (Reference 19),

the NRC concluded that the EPRI methodology contained in EPRI NP-768 and EPRI NP-769, "Tornado Missile Risk Analysis Appendixes," May 1978 (Reference 20), can be utilized when assessing the need for positive tornado protection for specific safety-related plant features.

Topical Report PWROG-14001-P/NP, Revision 1, "PRA Model for the Generation Ill Westinghouse Shutdown Seal, Risk Management Committee, PA-RMSC-0499R2," dated

July 3, 2014 (Reference 21), as approved by the NRC in a letter dated August 23, 2017 (Reference 22), provides the technical basis for the PRA model for the Generation Ill Shutdown Seal.

3.0 TECHNICAL EVALUATION

In its October 11, 2017, submittal, the licensee described the tornado missile risk evaluation performed at Vogtle to demonstrate the acceptability of the risk associated with SSCs that do not conform to deterministic design and licensing requirements for protection against tornado missiles. The NRC staff's review focused on (1) evaluating the acceptability of the NEI guidance process, as used by the licensee, for assessing the risk of SSCs that do not conform to plant-specific licensing basis related to tornado-missile protection; (2) validating the acceptability of the licensee's PRA for use for the pilot implementation of the methodology; (3) confirmation that the risk associated with not physically protecting the identified nonconforming SSCs according to the tornado missile protection licensing basis is sufficiently small; and (4) the proposed change ensures SSCs important to safety are designed to perform their safety functions during and following a tornado at VEGP Units 1 and 2, where their design and operation reflects the importance of the safety functions to be performed.

3.1 Tornado Missile Risk Evaluation Methodology As described in the submittal, the licensee's evaluation of risk associated with tornado-missile nonconforming conditions used the Vogtle internal events PRA model to develop the TMRE PRA model. The TMRE PRA model included targets that were vulnerable to tornadoes and tornado-generated missiles and considered generic or site-specific information related to tornado-generated missiles (i.e., number and types of tornado-generated missiles), tornado initiating event frequencies, parameters that relate the likelihood of a missile striking a target based on the tornado intensity, and characteristics of targets.

3.1.1 Identification of Vulnerable SSCs Sections 3.1, "Vulnerable SSC Walkdown Preparation," and 3.2, "Vulnerable SSC Walkdown,"

of NEI 17-02, Rev. 1 (Reference 6) describe the preparations and walkdown for vulnerable SSCs. According to the guidance, the walkdowns were used (1) to review previously identified nonconforming SSCs, (2) to collect and verify any data needed for the TMRE model, and (3) to locate and evaluate unprotected SSCs credited in the TMRE PRA model.

The licensee used walkdowns to gather physical data associated with known vulnerable and nonconforming SSCs and to identify other SSCs modeled in the internal events PRA that are not protected from tornadoes and tornado missiles. Sections 3.3.1, "High Winds Equipment List," and 3.3.2, "Target Walkdowns," of Enclosure 1 to the submittal described the licensee process for SSC (target) identification. Consistent with NEI 17-02, Rev. 1, specific configurations of interest observed during the walkdowns include:

• Active (e.g., pumps or compressors) or passive (e.g., tanks, piping) components that were directly exposed to tornado winds whether inside or outside,

• Components inside non-Category I structures,

• Components adjacent to non-Category structures, and

• Components subject to failure, due to secondary effects.

The licensee's process included development of a high winds equipment list (HWEL), which incorporated unprotected SSCs that were modeled in their internal events PRA and their locations. Section 3.1 of NEI 17-02, Rev. 1 provides recommendations on the development of the HWEL. Section 3.3.1 and 3.3.2 of Enclosure 1 to the submittal provided details about the licensee's implementation of the guidance to develop its site-specific HWEL and perform walkdowns supporting the development of its TMRE PRA model.

The NEI guidance recommends refinement of the HWEL using certain screening criteria including:

• Screening out SSCs that were located inside Category I structures and that were located away from vulnerable openings or features such as ventilation louvers and roll-up doors, and

• Screening SSCs that were dependent on offsite power because the TMRE methodology assumed there would be a nonrecoverable loss of offsite power (LOOP) due to the tornado event.

The licensee stated in Section 3.3.1 of Enclosure 1 to the submittal that the items screened from inclusion in the HWEL based on their being in Category I structures were reviewed for the presence of potential missile paths. The NRC staff expressed concern that sufficient justification for using the selected area as the screening criterion, for the application of the screening criterion (e.g., single penetration area and/or combined penetration area), and for excluding "De Minimis" penetrations from the risk analysis had not been justified sufficiently. In its July 26, 2018, supplement, the licensee clarified that no penetrations were screened for the Vogtle TMRE PRA model using the "De Minimis" criterion (i.e., based on the small area of penetrations). The licensee further clarified that such criterion is no longer included in the TMRE methodology, as provided in NEI 17-02, Rev. 1A. Given that (1) the licensee has not nor will it in the future use any criterion to screen out SSCs for its TMRE PRA model based on the area of penetrations; (2) Category I structures were required to be designed to withstand the effects of tornado missiles; and (3) that the licensee reviewed the existence of potential paths that could result in tornado missile impact on SSCs within Category I structures, the NRC staff finds that the licensee's approach for screening SSCs in Category I structures acceptable.

3.1.2 Failure Modes Section 3.2.3, "SSC Failure Modes," of NEI 17-02, Rev. 1 includes consideration of secondary failure modes. It states that flooding and combustion motor intake effects caused by tornado missile failures of fluid-filled tanks and pipes should be considered as viable secondary failure modes considered in the development of the TMRE PRA. The NRC staff expressed concern that the submittal did not sufficiently describe how secondary effects that may result from failure of nonconforming conditions were considered for identification of the initiating events and failure modes in the licensee's TMRE development. In the July 26, 2018, supplement, the licensee described that Vogtle considered secondary effects from tornado missile strikes on nonconforming conditions during walkdowns. Specifically, the licensee considered effects of flooding from nonconforming tanks or pipes as well as potential combustion motor intake effects such as the loss of oxygen due to nonconforming gas tank rupture or exhaust redirection. The licensee concluded that the possibility of a secondary failure as a result of a tornado missile strike to a nonconforming SSC did not exist for Vogtle. As a result, Section 6.5.2, "Secondary

Effects," of NEI 17-02, Rev. 1A includes a description of the treatment of identified and documented cases of secondary failures in the TMRE PRA model.

The NRC staff finds the licensee's approach for considering secondary failures acceptable, because the licensee considered the most important secondary failure modes for nonconforming SSCs and adequately captured the impact of such failures on both the nonconforming SSCs as well as other SSCs in the TMRE PRA model.

3.1.3 Characterization of Tornado-Generated Missiles Tornado-generated missiles are defined in RG 1. 76, Revision 1 as objects moving under the action of the aerodynamic forces induced by the tornado wind. Wind velocities in excess of 75 miles per hour (mph) are capable of generating missiles from objects lying within the path of the tornado wind and from the debris of nearby damaged structures.

Section 3.4, "Tornado Missile Identification and Classification," of NEI 17-02, Rev. 1 provides guidance on the expertise needed to perform tornado missile walkdown, verifying total number of missiles through TMRE walkdown for nonstructural, structural missiles, and temporary missiles, hereafter referred to as nonpermanent missiles.

The personnel recommendations for the Tornado Missile Walkdown are discussed in Section 3.4.1 of NEI 17-02. Section 3.4.1, "Tornado Missile Walkdown Personnel," of NEI 17-02, Rev. 1 (and Rev. 1A), states:

Personnel performing the Tornado Missile Walkdown do not require PRA expertise or knowledge, and structural engineering experience is not required.

The personnel only need to be trained on the methods for identifying and counting potential missiles. This section and Section 4.3 of EPRI 3002008092

["Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants"] provide adequate information to support training Tornado Missile Walkdown personnel.

Based on personnel's familiarity with plant layout and drawings allowing personnel to properly define the missiles and classify/group missiles accordingly, the NRC staff finds the means used to qualify walkdown personnel at VEGP acceptable.

3.1.3.1 Structural and Nonstructural Missiles Structural missile counts should include, as a minimum, buildings that are expected to experience tornado and tornado missile failure, such as warehouses, trailers, and other marginally engineered buildings. These buildings typically will not withstand tornado winds greater than about 100 mph and their destruction would generate additional missiles that should be accounted for in the TMRE. Sections 3.4.4, "Structural Missiles," and C.4, "Debris from Damaged Structures," of Appendix C, "Bases for Target Robustness and Missile Characteristics," of NEI 17-02, Rev. 1 contain guidance, including lists showing the type and size of a few structures, for determining the number of missiles generated by building deconstruction. The guidance for building deconstruction was based on typical construction practices and an assumption of moderately stacked warehouse.

The NRC staff was concerned that the licensee had not conducted walkdowns to count the potential missiles a non-Category I building contains inside the structure or to count missiles that would be generated by the deconstruction of the structure itself.

In the July 26, 2018, supplement, the licensee explained how it considered building contents (i.e., materials that are not part of the building itself but available to become missiles if the building is hit) as part of the missile walkdown. The licensee stated that it performed walkdowns to verify that the overall estimate of nonstructural missiles within buildings was reasonable.

Given that the licensee verified that the missile counts used are sufficiency representative of its site, the NRC staff finds the licensee's approach for determining the number of missiles resulting from the deconstruction of missiles acceptable for VEGP Units 1 and 2.

Section 3.4.2 of NEI 17-02, Rev. 1 provides guidance on the process for counting nonstructural missile inventory to verify bounding values of plant nonstructural missiles. Due to the large diversity of objects to consider in the missile count, the NEI guidance recommends grouping missiles of similar size and type into various zones around plant. While not all-inclusive, Table 3-2, "Potential Tornado Missile Type," of NEI 17-02, Rev. 1 provides examples of missiles to consider while performing a walkdown. The NEI guidance also stated that in the case of targets greater than 1,500 feet (ft.) from the reference point, a qualitative evaluation of the missile inventory within 2,500 ft. of the outlying targets should be performed.

The licensee indicated that the missile inventory was counted from the missile survey out to 2,500 ft. from the reference point.

The NRC staff noted that the 2,500 ft. missile source distance is a typical value used to support site-specific tornado missile count for applications, and was derived from a case study discussed in Section 2.3.3, "Off-Site Missile Assessment," of EPRI NP-769. For nonstructural missile count, the NRC staff finds counting missiles to a distance of approximately 2,500 ft. is acceptable because it is consistent with typical counting practice and the EPRI studies used as the basis for the TMRE methodology.

The licensee provided information that suggests a majority of the hits would occur from tornado missiles within 600 ft. of the target. As such the selection of 1500 ft. ensures that relevant missile inventory is used for the TMRE. Therefore, the NRC staff finds the licensee's approach for considering missiles around targets that are farther from the reference point acceptable.

The NRC staff finds the approach for determining the missile inventory from building deconstruction in NEI 17-02, Rev. 1 to be acceptable for VEGP Units 1 and 2, because the approach (1) considers different building types, (2) is based on typical construction practices and representative warehouse inventory, and (3) conservatively assumes that the entire building deconstructs resulting in its construction constituents as well as the inventory within being available as missiles.

3.1.3.2 Nonpermanent Missiles - Construction and Outage Related Section 3.4.3 of NEI 17-02, Rev. 1 provides guidance on the consideration of nonpermanent missiles, such as those present during outages and construction periods. This section of NEI guidance states that it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory. The guidance further states that outages are of relatively short duration compared to the operational time at a nuclear power plant. The NRC

staff notes that duration of outages or other temporary activities that involve bringing additional equipment to the sites may be relatively long, specifically for a multi-unit site.

The NRC questioned how Vogtle addressed outage-related missiles as part of the estimate of the total number of missiles used for Vogtle TMRE implementation.

In the July 26, 2018, supplement, the licensee stated that some portions of its TMRE missile inventory walkdowns were conducted during the time that staging was done for an outage. The licensee further stated that many outage related missiles, if not staged during the walkdowns, would be counted as part of laydown areas or included in warehouse inventory, because most equipment used during outages was stored elsewhere on site during non-outage times.

The NRC staff concludes that the licensee's approach for considering outage-related missiles is acceptable for this application because many outage-related missiles were included in the licensee's missile inventory estimate either from the missile inventory walkdown or as part of warehouse inventory. The NRC staff also finds that many outage-related missiles would be included in the warehouse inventory during missile inventory walkdowns and, therefore, consideration of those missiles during walkdowns is not necessary for this application, as the approach ensures that the missile inventory is not underestimated.

The NRC staff questioned whether the licensee proposed to classify construction-related missiles as temporary missiles in VEG P's current and future implementation of the TMRE methodology.

In the July 26, 2018, supplement, the licensee addressed its classification of some construction-related missiles, due to the ongoing construction of Vogtle Units 3 and 4, as nonpermanent using qualitative factors and an analysis of the estimated change in (delta) core damage frequency (delta CDF) over time. Following the guidance in NEI 17-02, Rev. 1, the licensee classified the construction-related missiles into two categories: permanent post-construction missiles and nonpermanent missiles. Permanent missiles were included in the primary analysis. Both permanent and nonpermanent missiles were included in the sensitivity analysis.

As a result, Section 3.4.3 of NEI 17-02, Rev. 1A, now provides guidance for consideration of missiles during the period of construction at a licensee's site. The guidance differentiates between missiles during the construction period as "permanent post-construction missiles" and nonpermanent construction missiles. The "permanent post-construction missiles" are those that will be present at the site (e.g., through their incorporation in building construction) post-construction. The guidance recommends estimation of the expected missile inventory for the post-construction site, using walkdown results for the nonconstruction areas, information in Sections 3.4.2 and 3.4.4 of NEI 17-02, Rev. 1A, along with design and construction information and documentation of the basis and assumptions used for the estimation. According to the guidance, if the sum of the missiles currently present at the site and estimate of the "permanent post-construction" missiles is greater than the generic estimate used in the TMRE methodology then a site-specific bounding value should be developed, documented, and used.

The revised guidance also calls for a sensitivity analysis to evaluate the impact of the additional nonpermanent construction-related missiles and states that the total missile count for the sensitivity analysis should include the nonconstruction related missile inventory determined in accordance with Sections 3.4.2 and 3.4.4 of NEI 17-02, Rev. 1A and a reasonably bounding estimate of the number of all construction-related missiles within 2,500 ft. of a central reference

point. The guidance stated that the basis and assumptions used to determine the conservative construction missile estimate should be documented. The guidance also recommended the use of qualitative discussions, such as that of the proximity of the missiles to targets, to support the basis for exclusion of the nonpermanent missiles from the TMRE analysis.

• As the numbers and locations of missiles change continually as a result of construction activities, the licensee used an estimate for the number of missiles in those categories. The licensee counted the number of permanent missiles outside of the construction area and within the 2,500 ft. radius as 205,000. The licensee then doubled this number to account for permanent post-construction related missiles inside of the construction area and within the 2,500 ft. radius. Therefore, the licensee used a count of 410,000 missiles for the primary analysis.

Finally, the total number of missiles used for the primary analysis was doubled for the construction missile sensitivity analysis, resulting in an estimate of 410,000 additional nonpermanent construction-related missiles. The licensee stated that limited walkdowns in the construction area within the 2,500 ft. analysis range supported the reasonableness of 410,000 as a bounding number for the nonpermanent construction category of missiles. Therefore, a total of 820,000 missiles was used for the construction missile sensitivity, the results of which were provided in Section 3.3.9.2, "Temporary Construction Missile Sensitivity," of the submittal.

The NRC staff notes that many construction-related missiles (those currently considered nonpermanent) would be incorporated into Category I structures within VEGP Units 3 and 4 and, as such, would not be considered available for deconstruction, nor added into the nonpermanent construction related missile estimate.

The sensitivity results provided by the licensee for delta CDF and delta large early release frequency (LERF), as discussed in Section 3.6, are below the RG 1.174, Revision 2 acceptance guidelines for a "very small" risk change. Based on the sensitivity results showing a "very" small risk change and a sufficiently conservative estimate of the number of all construction-related missiles being included in the analysis, the NRC staff finds the licensee's approach for classifying construction and outage related missiles acceptable for this application.

3.1.3.3 Missile Inventory Values and Consideration of SSC Robustness Section 5.2, "Missile Inventories," of NEI 17-02, Rev. 1 provides guidance for missile counts when the total number of missiles at a site was not bounded by 240,000 and on the percentage of the total number of missiles that could impact robust targets. The number of missiles for each tornado category were provided in Table 5-1, "MIP Values and Missile Inventories for Use in the TMRE," of NEI 17-02, Rev. 1 with the expectation that the values would be bounding for most sites. The total number of missiles for each licensee required verification through the TMRE walkdown, to ensure that the missile inventories provided in NEI 17-02, Rev. 1 were appropriate and bounding for use in the plant-specific TMRE PRA model. The guidance stated in Section 5.2 of NEI 17-02, Rev. 1,. in part, that:

• If the site walkdown confirmed that 240,000 was bounding for the site, then the missile count used for the TMRE PRA model was equal to the values provided in Table 5-1 of NEI 17-02, Rev. 1 for targets not defined as robust. Robust target types were addressed separately, based on the type of missile and perspective impact on targets.

• If the site walkdown determined that the total missiles at the site exceeded 240,000, the number of missiles used in the TMRE PRA model (for targets that are not robust), would

be the total number of missiles counted on site, rounded up at least to the nearest 5,000 missiles.

The generic total number of missiles used in TMRE is 240,000. Section 5.1, "Missile Impact Parameter (MIP}," of NEI 17-02, Rev. 1 provides guidance on generic missile inventory values for different tornado intensities unless the site-specific missile inventory is not bounded by 240,000 missiles. In Section 3.3.3, "Missile Walkdowns," of the submittal, the licensee described that walkdowns were used to perform a missile count and establish whether the number of missiles on the site was bounded by the generic number of missiles used in the TMRE methodology. The licensee determined that the generic missile count would not be bounding for Vogtle and a more accurate count was obtained using the TMRE methodology as discussed above.

Robust targets are those (e.g., steel pipes and tanks) that can be damaged by only certain types of missiles and are subdivided into categories based on their characteristics such as the thickness of the steel or concrete used for the construction of the specific SSCs. In order to account for target robustness, NEI 17-02, Rev. 1, depending on the target's category of robustness, provides for a certain fraction of the total missile inventory to be used in the Exposed Equipment Failure Probability (EEFP) calculations for that target. Originally, nine categories of robust targets were defined in Table 5-2, "Missile Inventories for EEFP Calculations," of NEI 17-02, Rev. 1 to adjust missile counts from 1 percent (very robust target, such as reinforced concrete of at least 8 inches in thickness) to 55 percent (less robust target, such as steel pipe of at least 16 inches in diameter and thickness less than 3/8-inch).

The NRC staff notes that the categories were revised to 12 in NEI 17-02, Rev. 1A.

The NRC staff finds that the additional categories provided sufficient detail and did not adversely affect the categorization of robust targets. Other targets not belonging to any of those 12 categories were considered to be not robust, and any missile hit was assumed to fail the target (i.e., the missile count is 100 percent for these targets). An example of missile inventory adjustments to account for target robustness is presented in Table 5-3, "Example Missile Inventories for Different Targets (For F'6 Tornado EEFP Calculations)," of NEI 17-02, Rev. 1.

The basis for the identification of certain SSCs as robust and the determination of the fraction of missile inventory that can damage each such SSC was provided in Section C.3, "Approach," of Appendix C of NEI 17-02, Rev. 1. The NRC staff finds the licensee's approach acceptable, as addressed in NEI 17-02, Rev. 1, for the identification of certain SSCs as robust because the characterization appropriately captures the varying level of damage that may be caused by a tornado missile hit.

Table 3.3.6-1, "Primary Conservatisms in Model Development," in Enclosure 1 to the submittal stated that robustness of targets with respect to certain missile types was not considered anywhere in quantification and that any missile was considered to be able to fail any target.

Section 8.6, "Missiles Affecting Robust Targets," of NEI 17-01, Rev. 1 stated that the number of missiles used in the EEFP calculation could be adjusted to account for the population of missiles that could damage an SSC and provided the percentage of the total missile inventory for each type of robust target. These percentages depended on specific missile type counts taken from two plant missile inventories as shown in Tables 8-15, "Unrestrained Missile Inventories," 8-16, "Restrained Missile Inventories," and 8-17, "Average Missile Type Inventory,"

of NEI 17-01, Rev. 1.

The NRC staff questioned how the number of missiles for robust targets would be adjusted to ensure that the contribution of each missile type to the overall missile population is representative of the contribution of each missile type to the overall missile population at VEGP.

In the July 26, 2018, supplement, the licensee stated that Vogtle may choose to adjust the number of missiles for robust targets, using the additional generic values provided in Table 5-2, "Missile Inventories for EEFP Calculations," of the revised methodology provided in NEI 17-02, Rev. 1A. Furthermore, the licensee compared missile percentages based on the total data from ten sites (including Vogtle) with the NEI 17-02, Rev. 1 and Vogtle-specific robust missile percentages. The licensee noted that for most robust missile categories, the percentages from the ten sites and Vogtle were lower than the values provided in Table 5-2, which addresses missile inventories for the EEFP calculations. The licensee further stated that the site missile data represented a diverse set of nuclear plants throughout the country, including different utilities, multi-unit and single-unit sites as well as various vintages and types of reactor designs and construction. The licensee noted that only a few sites had percentages larger than the Table 5-2 values.

The NRC staff concludes that the licensee's approach for adjusting the number of missiles for robust targets by using the robust missile data in Table 5-2 of NEI 17-02, Rev. 1A is acceptable for this application, because ( 1) the licensee demonstrated, using data from a diverse set of nuclear plants, that the percentages from the ten sites and Vogtle are lower than the values provided in Table 5-2 of NEI 17-02, Rev. 1A for most robust missile categories; (2) there is an insignificant difference between the values in Table 5-2 and the data for those cases that percentages are larger in Table 5-2; and (3) the conservatism in developing the robust missile adjustment factors. The NRC staff further concludes that additional comparison of site-specific missile type inventories is not necessary for this application.

In summary, the NRC staff finds the licensee's approach for characterizing tornado missiles in TMRE acceptable because (1) the licensee's process for performing missile counts considered structural and nonstructural missiles, (2) the licensee process is based on the relevant industry guidance, and (3) more realistic missile counts were used as the generic missile count in the TMRE methodology was determined to not be bounding for the licensee.

3.1.4 Determination of Site Tornado Frequency The licensee developed site-specific tornado frequencies for each category of the tornadoes, classified using the F'- scale (Fujita prime). Section 4, "Determine Site Tornado Hazard Frequency," of NEI 17-02, Rev. 1 provides guidance on the development of the site-specific tornado initiator frequencies.

The TMRE methodology uses the tornado data found in NUREG/CR-4461 for the approach to develop the site-specific tornado frequencies to be used in the TMRE PRA model. The NUREG provides for each U.S. nuclear plant site, tornado wind speeds associated with 10-5, 10-s, and 1o-7/year occurrence frequencies for a tornado strike. Additionally, the total tornado strike frequency is also provided for all locations in the continental United States. Using data from NUREG/CR-4461, Rev. 2 and the approach detailed in Section 4 of NEI 17-02, Rev. 1, a site-specific tornado frequency curve (hazard curve) was developed for the licensee's site. That site-specific hazard curve was then used to derive the frequency of all tornadoes considered in the TMRE methodology (F'2 through F'6).

For the purposes of the TMRE methodology, the F'-scale was used to classify tornado wind speed. This scale is different from the original Fujita Scale (F-scale) and the Enhanced Fujita

Scale (EF-scale) typically used. Section 4.2 of NEI 17-02, Rev. 1 stated that for the TMRE application, the F'-scale was chosen because the MIP values were derived based on simulations that used the F'-scale to categorize the tornadoes. Because F'-scale occurrence frequencies were not directly available from NUREG/CR-4461, Rev. 2, those frequencies were derived from the site-specific Fujita scale data. As noted in Section 4.2 of NEI 17-02, Rev. 1, using the Fujita scale data instead of the Enhanced Fujita Scale data resulted in higher and, therefore, more conservative strike frequencies. Although the TMRE methodology uses F'-scale for consistency in MIP derivation, RG 1.76, Revision 1 uses EF-scale and, therefore, the use of the F'-scale is limited to this application.

The licensee described its process for determining tornado initiating event frequencies in Section 3.3.4, "Tornado Hazard Frequency," of Enclosure 1 to the submittal. As stated in that section, the TMRE methodology and NUREG/CR-4461, Revision 2 data were used to determine the tornado initiating event frequencies for the Vogtle TMRE PRA model. Site-specific tornado frequencies for applicable tornadoes were developed as a result of this effort. Using guidance in the TMRE methodology and plotting the Vogtle data points in a XY scatter chart with a logarithmic trend line, the licensee derived the hazard curve used to calculate tornado initiating event frequencies for each tornado intensity.

The NRC staff questioned how the exceedance probabilities influence on the initiating event frequencies were determined.

In the July 26, 2018, supplement, the licensee described the process where the F-scale wind speed estimates for the licensee's site for tornadoes of frequency 1o*5/year, 10-6/year, and 1o*7/year were determined from a review of NUREG/CR-4461, Revision 2. A trendline was established and the resulting equation was used to calculate a frequency for all tornado wind speeds from 40 mph to 300 mph. Using the F'-scale tornado intensity wind speed ranges, exceedance frequencies were determined for each tornado intensity F'2 through F'6. Then, interval frequencies were developed for each range by subtracting the exceedance value of the next higher intensity from the previous intensity exceedance value. These interval frequencies were then used as the initiating event frequencies for each tornado category in the licensee's TMRE PRA model.

The NRC staff finds that the licensee's process for generating tornado initiator frequency is consistent with guidance in NEI 17-02, Rev. 1 and technically acceptable for this application, as it uses the most current NRG-endorsed source of tornado data (i.e., NUREG/CR-4461, Revision 2). The NRC staff's finding is based on the licensee's (1) use of the most recent data from NUREG/CR-4461, Revision 2, which includes tornadoes reported in the contiguous United States from January 1950 through August 2003; (2) acceptable results in the derivation of a site-specific tornado frequency curve (hazard curve); and (3) use a technically sound approach to determining the frequency of each tornado category for use in the TMRE PRA model.

3.1.5 Evaluation of Missile Impact on Targets The TMRE methodology defines and provides the technical basis for using EEFP to calculate the failure probability of targets. Section 3.3.5, "Target Evaluation," of Enclosure 1 to the submittal stated that the failure probability of targets was calculated using the EEFP with the exception of the turbine and associated support equipment used for turbine trip. The licensee explained that for the turbine and associated support equipment to enable turbine trip, the turbine trip basic event was conservatively set to be successful in the compliant case and to fail in the degraded case, as defined in Section 2.4 of NEI 17-02, Rev. 1. Therefore, an EEFP was

not calculated for this target. Table 3.3.5-1, "EEFP Calculations," in Enclosure 1 to the submittal provided the EEFP evaluation results.

3.1.5.1 Missile Impact Parameter To calculate the failure probabilities for exposed SSCs, the TMRE methodology uses a parameter called MIP as the basis to compute the likelihood of a missile hitting a target, conditional on a tornado strike to the facility of a given intensity. Section 5.1, "Missile Impact Parameter (MIP)," of NEI 17-02, Rev. 1A defines MIP as "[t]he probability of a tornado-driven missile hit on a target, per target unit surface area, per missile, per tornado". Generic MIP values were provided as part of the TMRE methodology and the technical basis for those values was described in NEI 17-02, Rev. 1A, Section 5.1 and Appendix B, "Bases for MIP and Missile Inventories.

The TMRE methodology relies on data from EPRI NP-768 to calculate the MIP values used in the TMRE methodology, as described in the following section.

Background on Use of EPRI NP-768 The TMRE methodology uses EPRI NP-768 (Reference 18) data to derive the generic MIP values. Multiple scenarios of tornadoes striking a site were considered as part of the NRC reviewed and approved EPRI NP-768. Tornadoes were considered to take multiple alternative paths and be of different intensity. To explore the effect on missile-hit frequencies of sites located in different places in the country, average tornado frequency of three NRC tornado regions (Regions I, II, and Ill, numbered in decreasing order of tornado occurrence frequencies) were used as input to the calculations in EPRI NP-768. The calculations also explored effects of different missile types, different initial missile insertion heights, different initial locations of missiles through the site, and different configurations of buildings in the nuclear power plant. To study the different alternatives, the EPRI NP-768 analysis used a Monte Carlo approach that sampled and addressed uncertainties of parameters such as wind speeds, initial missile locations, and insertion heights. The EPRI NP-768 report examined statistical convergence on target hit frequencies, to select a sufficiently large sample of tornado paths and .intensities (measured in the F'-scale) and missile trajectories.

The EPRI report analyzed effects of different configurations of buildings and missiles at nuclear power plants, by considering two hypothetical nuclear power plants, referred to as Plants A and B. The targets selected for the computation of hit frequencies were the buildings of Plants A and B. Plant A was a single-unit plant with seven buildings. Plant B was a two-unit plant with 16 buildings. Plant B was analyzed in two configurations: Configuration B1 postulated that all Unit 2 buildings were under construction when the tornado struck (with construction material providing a source of missiles), and Configuration B2 postulated both units as being operational at the time of the tornado strike. The types of missiles considered included wood beams, pipes, steel rods, utility poles, plates, and automobile vehicles ( cars and trucks). At Plant A, the missiles were assumed to be distributed uniformly over an enclosing area spanning 4,640 ft. x 5,000 ft. (= 2.32 x10 7 ft 2 ). For Plant B, the distribution of missiles was non-uniform in the B1 and B2 configurations, including different assumptions on insertion heights and the initial location of missile types (e.g., vehicles were predominantly located in parking lots).

Missile trajectories were simulated and the characteristics of the hits on the different buildings or targets were recorded (such as impact speeds and scabbing damage) using the EPRI methodology. The EPRI methodology employs Monte Carlo techniques in order to propagate

the transport of tornado-generated missiles and to assess the probability of missile strikes causing damage to unprotected SSCs. Statistics were derived to quantify the number of hits per target, the number of hits per missile, the number of hits with specific features (including whether a threshold velocity was exceeded or whether a given amount of damage was caused by the hit), and associated hit frequencies.

Derivation of MIP Values and Dependencies The TMRE methodology relies on aspects of EPRI NP-768 analyses by defining a MIP based on the hit frequencies per missile, tornado frequencies, and target dimensions that can be derived from the data reported in EPRI NP-768. Moreover, although the targets evaluated in EPRI NP-768 were large buildings, the TMRE methodology uses an area-scaling approach in order to estimate the number of hits and hit frequency on all targets of interest, including small area targets such as exhaust stacks, cable vaults, access doors, and tanks.

To derive MIP values, the TMRE methodology relies on missile hit frequencies calculated for specific EPRI NP-768 targets (buildings of hypothetical nuclear power plants, Plants A and B) as function of the NRC tornado region frequency, the specific target, and the F' tornado scale.

Section B.1.1 in NEI 17-02, Rev. 1 uses the following equation to calculate MIP values for a target:

MIP = Probability of missile impact/ missile/ target area I tornado (1)

Because MIP values were proposed for evaluation of tornado missile risk at any nuclear power plant, the NRC staff examined the dependencies of MIP values and the appropriateness of the proposed scaling approach. The dependencies that were examined included the tornado region (tornado frequency), building configurations, tornado intensity, and missile location as well as height The targets examined in EPRI NP-768 were buildings such as the containment, diesel generator, waste processing, service water intake, auxiliary, and tanks enclosure buildings.

Appendix B to NEI 17-02, Rev. 1 examined two approaches to define the target area. In the first approach, the area was the vertical-wall area (excluding the building roof, except for a small target called Target 6). In a second approach, the area included the walls and roof. The average MIP values computed with the smaller area (i.e., exposed area of only the vertical walls) were selected to define the reference MIP values for targets located at less than 30 ft.

above a reference level (near-ground targets) in EPRI NP-768. The average MIP values computed with the larger area (walls and roofs) were selected to define the reference MIP values for targets located higher than 30 ft. above the reference level (elevated targets) in EPRI NP-768.

The TMRE methodology notes that the majority of the tornado generated missile hits in the EPRI NP-768 analysis affect the vertical walls, with few hits on the building roofs. Based on that observation, the guidance selects the vertical wall exposed area only to define the MIP for near-ground targets for use in the TMRE methodology. The exception in the selection of areas was for the target referred to as Target 6 (service water intake structure), which was 20 ft. in height. For Target 6, the total building area (walls and roof) was selected for estimating MIP values for both near-ground and elevated targets, on the basis that it was a short building with expected missile hits to the roof. Table B-3, "Plant 'A' Tornado Missile Impact Parameters for Near Ground Targets," in the TMRE methodology provides average values of the MIP values over all building targets for the three NRC tornado regions. The average value for each tornado

intensity interval was computed as a weighted average using the target areas (building wall areas, with the previously stated exception of Target 6) as the weights. This area-weighted average is equivalent to adding missile hit frequencies for all targets, and then dividing by the total reference area as well as the tornado frequency for the F' tornado intensity category under consideration.

Section B.3.2, "Selection of Conservative Tornado Region MIP," of the TMRE methodology asserts that differences in MIP values between the NRC tornado regions were unexpected and that no specific discussion is provided in EPRI NP-768 to explain those differences. To address the possible uncertainty, the maximum average of the three NRC tornado regions for each F' tornado intensity category was selected to define reference MIP values. The TMRE methodology further states that lack of convergence might have caused the numerical differences in the NRC tornado regions and postulates the transition height between near-ground and elevated targets as 30 ft. above the reference. Depending on the location of the target (the location is expected to be measured with respect to the target center), the guidance provided different MIP values.

Evaluation of MIP The NRC staff examined the NEI 17-02, Rev. 1 approach for computing the MIP values from EPRI NP-768 data and performed confirmatory analysis to verify the MIP values presented.

The NRC staff determined that the licensee appropriately calculated MIP values for the seven targets in Plant A studied in EPRI NP-768 and that the MIP average values in Tables B-3, "Plant 'A' Tornado Missile Impact Parameters for Near Ground Targets," and B-5, "MIP Values for Use in the TMRE," of NEI 17-02, Rev. 1 were acceptable. The NRC staff also compared the MIP values for each target in EPRI NP-768 to the average MIP values in NEI 17-02, Rev. 1.

The targets in the EPRI NP-768 analysis were buildings that shielded each other against tornado-generated missiles. The reference MIP values in NEI 17-02, Rev. 1 were averages from multiple targets (each target had a different level of exposure to tornado missiles). In an as-built as-operated nuclear power plant, specific targets may be more exposed and have higher MIP values than the generic MIP values proposed in NEI 17-02, Rev. 1. Section A.5 of NEI 17-02, Rev. 1 presents results of a benchmark analysis, comparing results from using the average MIP values to site-specific high winds PRA results, and concluded that the average MIP values and the associated EEFP tended to overestimate (in several cases, depending on the F' tornado category, by orders of magnitude) SSC failure probabilities. The NEI guidance states that the technical acceptability of high winds PRA models used to benchmark the TMRE methodology were consistent with the guidance in RG 1.200. The NRC staff did not review the technical acceptability of the high winds PRA models used in this benchmark. The NRC staff used the results of those high winds PRA models to provide an order of magnitude estimation of SSC failure probabilities for this application, primarily for benchmarking purposes.

The tables in Section A.5, "Benchmark Results," of Appendix A of NEI 17-02, Rev. 1 identify only few exceptions to the overestimation. The order of magnitude of the TMRE probabilities was similar to that for the probabilities calculated using the high winds PRA models for the exceptions. Although the number of examples in the benchmark in Section A.5 is limited, the benchmark supports the use of average MIP values as a defensible approach to estimate the EEFP for use in the TMRE PRA model. The information in Appendix A of NEI 17-02, Rev. 1 demonstrates that the average MIP values would in general, not result in an underestimation of the failure probability of SSCs due to tornado missiles.

The NRC staff evaluation confirmed unexpected variation of MIP values among the NRC tornado regions using the EPRI NP-768 data. The differences in MIP values between Regions I and II occurred mostly at the F'5 intensity and at the F'4 intensity between Regions I and Ill.

Although the reasons for those differences are unclear, occurrence of those differences at the high F' intensities may be caused by the lack of convergence in some simulations, as asserted by the NEI 17-02, Rev. 1.

In the EPRI NP-768 simulations, the containment building experienced few hits on average and had the least contribution to the total hit probability compared to other targets.

The NRC staff examined the possibility of underestimation of MIP values due to the consideration of the licensee's containment building (Target 1, Plant A) in deriving the average MIP values in NEI 17-02, Rev. 1. The containment building in EPRI NP-768 analysis was 230 ft. in height and was shielded in the lower part by other buildings. The missile hits to the Plant A containment building occurred at least 60 ft. above the ground.

The NRC staff questioned including Target 1 (containment building) of Plant A in EPRI NP-768 in computation of the average MIP for targets less than 30 ft above grade, given that the containment building is shielded by other buildings and is not impacted by near-ground missiles.

In the July 26, 2018, supplement, the licensee computed an alternative average MIP value excluding the containment building and concluded an increase in MIP values for near-ground targets of approximately 30 percent. The NRC staff determined that the 30 percent increase was consistent with EPRI NP-768. Additionally, the licensee asserted that a 30 percent change was insignificant, and it did not affect the conclusions of very low risk. Specifically, the contributions by the two nonconforming SSCs that could be considered to be near-ground targets to the delta CDF were computed to be 4 x 10-a and 9 x 10-10/year, respectively, which were appreciably below the acceptance guideline of 1o-6/year ("very small" risk) in RG 1.174, Revision 2. An increase of 30 percent was not enough to change the conclusion of very small risk.

The NRC staff concludes that including the containment building in the computation of the reference MIP values for near-ground structures introduced, at most, a small difference for this application, which would not change the licensee conclusions of the overall analysis.

The NRC staff questioned including Target 1 (containment building) of Plant A in EPRI NP-768 in computation of the average MIP for targets less than 30 ft. above grade. On the basis of alternative calculations by the licensee in its July 26, 2018, response, the NRC staff concludes that uncertainty due to the consideration of Target 1 (containment building) that biases the MIP values towards lower values would not change the licensee conclusions of very small risk.

The proposed MIP values derived from EPRI NP-768 in NEI 17-02, Rev. 1 are not acceptable for future use by VEGP because the method biases the MIP towards lower values.

As stated by the licensee, alternative MIP values derived excluding the Plant A containment building were 30 percent higher. Higher MIP values would affect the EEFP of every near-ground SSC potentially affected by missile hits. For example, the licensee indicated that doubling the missile count, which would double the EEFP (i.e., 100 percent increase), increased delta CDF and delta LERF by a factor of 10 (Section 3.3.9.2 of the submittal). Accordingly, a generic 30 percent increase in the EEFP (due to a corresponding increase in MIP) could result in a sizable change in delta CDF and delta LERF.

Section B.4, "MIP Values for Use in the TMRE," of NEI 17-02, Rev. 1A provided two sets of MIP values, one for elevated targets and one for near-ground targets. As previously noted, the demarcation between near-ground and elevated targets was 30 ft. above the primary missile source for a target. The EPRI NP-768 data supported the assumption of decrease in hit frequency with target height. For example, the MIP value of Target 1, which was only impacted at heights above 60 ft., was one order of magnitude less than the MIP value of other targets. As noted in Table B-2a, "Elevated and Near Ground Missile Impact Parameter Comparisons," of NEI 17-02, Rev. 1A, the guidance proposed MIP (elevated ground)= 0.54 x MIP (near-ground).

The NRC staff questioned the relationship between the numerical results shown in Appendix E and whether the Appendix E results are generally consistent with the ratio of elevated to near-ground MIPs calculated in Appendix B, "Bases for MIP and Missile Inventories." In the July 26, 2018, supplement, the licensee described the relationship between the numerical results shown in Appendix E. Based on information in the sensitivity analysis in Appendix E of NEI 17-02, Rev. 1, the licensee supported the selection of 0.54 factor as a reasonable decrease factor to adjust the MIP values for elevated targets. Figure 12, "Plant A North Wall Hit Probability for all EFs," in Appendix E shows a marginal change in MIP values as the target elevation increased; however, the licensee explained this to be an artifact of the target location in high ground and protected by near-ground buildings. In general, the majority of the target elevation sensitivity results in Appendix E supported the assumption that the MIP decreased with increasing target elevation and that a decrease by a factor of 0.54, when the elevation changes by 30 ft., was reasonable.

The NRC staff notes that Target 1 (containment building) in the Plant A EPRI NP-768 configuration was only impacted by missiles above 60 ft. As noted previously, the containment building was shielded in the lower part by other buildings and the missile hits to the containment building occurred at least 60 ft. above the ground. The MIP value for Target 1 was more than one order of magnitude less than the average MIP values at all Ftornado intensity categories.

Thus, a reduction factor on the order of 0.1 or less could be justifiable for very elevated targets (for example placed at more than 60 ft.). Table 1, "MIP Decrease Factors from the NEI 17-02 Appendix E Elevation Sensitivity Study," of this safety evaluation summarizes selected relative changes in MIP values associated with changes in target elevation from Appendix E. The information in Table 1 suggests that an average decrease by a factor 0.54 when the change in target elevation is 30 ft. would be a reasonable assumption for this application. As previously stated, the TMRE methodology explained the anomaly (no or minimal change in the MIP values with increasing elevation) to be due to the relative ground elevation (affecting the target absolute elevation). Therefore, the NRC staff concludes that implementing a decrease factor for

the MIP values of elevated targets (as shown in MIP for elevated targets provided in Table 5-1 of NEI 17-02, Rev. 1) is reasonable.

Table 1. MIP Decrease Factors from the NEI 17-02 Appendix E Elevation Sensitivity Study Height change MIP change factor Figure in NEI 17-02 Appendix E 8 to 38 ft. 0.635 Figure 9 5 to 55 ft. 0.647 Figure 10 5 to 35 ft. 1.042 Figure 11 6 to 41 ft. 0.52 Figure 13 6 to 31 ft. 0.57 Figure 14 8.5 to 53.5 ft. 0.216 Figure 15 The NRC staff questioned the technical basis for the 30 ft. demarcation between near-ground and elevated targets.

In the July 26, 2018, supplement, the licensee stated that Section B.3.4 was added to NEI 17-02, Rev. 1 to provide the bases for the 30 ft. demarcation. The section states that the demarcation elevation of 30 ft. was decoupled from the EPRI NP-768 data, because the EPRI NP-768 data did not provide quantifiable insights into missile hit probability at different elevations. The licensee further stated that an assumed demarcation elevation was qualitatively justified based on regulatory documents associated with tornado missiles (i.e., RG 1.76, Revision 1 and SRP Section 3.5.1.4). Those regulatory documents included the 30 ft.

demarcation for heavier missiles, such as automobiles.

The NRC staff considered insights from target elevation sensitivity study in Appendix E, to examine the appropriateness of the change in MIP values for elevated targets and the transition elevation of 30 ft. The NRC staff concludes that assuming 30 ft. as a transition distance to consider a lower value of the MIP is acceptable for this application because it is generally consistent with insights obtained from the EPRI NP-768 data. The NRC staff emphasizes that any use of such transition distances or reduction factors outside the scope of the TMRE methodology is not approved as part of this review.

Conclusion The NRC staff concludes that selection of only the exposed vertical wall area to calculate MIP values for near-ground targets is justified because the majority of the missile hits in EPRI NP-768 analysis occurred near the ground and on the vertical walls. The EPRI NP-768 data and the NEI 17-02, Rev. 1 sensitivity analyses consistently showed that elevated targets have fewer hits and, therefore, using smaller MIP values for elevated targets is acceptable.

Using different MIP values for each tornado intensity is acceptable and supported by EPRI NP-768 data. The airborne missile paths are longer and cause more target hits for more intense tornadoes and, therefore, the average MIP values monotonically increase with increasing tornado intensity.

The reference MIP values derived in NEI 17-02, Rev. 1 are averaged over all examined targets (weighted by the exposed vertical wall area). The NRC staff concludes that computing the MIP values as an average of the examined targets is reasonable. The average value takes credit for

mutual shielding of the buildings (i.e., the average MIP values correspond to a target that is neither the most exposed nor the least exposed) and mutual shielding is a more realistic representation of actual nuclear power plant configurations. The NEI 17-02, Rev. 1 guidance includes a benchmark comparison supporting the conclusion that use of average MIP values do not underestimate, in general, the EEFP with respect to site-specific failure probability of SSCs calculated using high winds PRA models.

The average MIP values in the TMRE methodology include the containment building, the inclusion of which is technically questionable for future TMRE methodology implementation at VEGP Units 1 and 2. Excluding the containment building in the computation of the MIP values increased the average MIP by approximately 30 percent. The NRC staff finds that corrections to MIP values from alternative averages (i.e., excluding the containment building) do not appear to significantly affect risk estimates for Vogtle. In case of highly exposed targets, the licensee examined using a separate uncertainty factor (equal to 2.75) to increase the MIP values. This uncertainty factor is evaluated below.

In summary, the NRC staff concludes that the use of alternative average MIP values that do not include the containment building of the EPRI NP-768 Plant A is acceptable for this application.

Although the generic MIP values in NEI 17-02, Rev. 1 moderately increase (by approximately 30 percent) when this building was excluded from the computation of the average, the licensee provided an example showing that moderate changes affecting the computation of the EEFP for all SSCs may have a significant effect in risk estimates.

3.1.5.2 Target Exposed Area The target exposed area is defined as the area of the target exposed to potential missile hits.

Section 5.3, "Target Exposed Area," of NEI 17-02, Rev. 1 provides a method for calculating the target exposed area of an SSC susceptible to tornado missile hits for various types and configurations of SSCs. To simplify the method of calculating exposed area, NEI 17-02, Rev. 1 recommends the use of polyhedrons encompassing the target. With adequate justification, cumulative sum of sub-components exposed areas could be an alternate approach to represent exposed SSCs. According to the TMRE methodology, any such approach or reduction to the effective surface area must be documented along with the engineering judgment used as part of the approach. Section 5.3.1, "Types of Targets and Calculations," of NEI 17-02, Rev. 1 included recommendations for calculating exposed areas for tanks, pipes, pumps, and valves. Certain aspects of analysis, such as accounting for vertical missiles, depend on the plant-specific licensing basis. The NRC staff finds the approach for estimating target exposed area by considering the surface area of polyhedron with dimensions bounding the component to be conservative and acceptable. The licensee calculated effective surface area for use as the target exposed area of each specific individual target or correlated group, as shown in Table 3.3.5-1 of the submittal.

The guidance in NEI 17-02, Rev. 1 allows flexibility to consider shielding of structures, thus reducing the exposed area, as only a portion of the target may be within the missile path.

Section 5.3.2, "Target Shielding," of NEI 17-02, Rev. 1 contains discussion of target shielding based on exposed SSC configuration. Further, the guidance calls for considering targets strikes in all directions, but allows for considering shielding from tornado missiles in specific directions.

With adequate justification, SSCs or other intermediate barriers blocking missile paths to a target can be considered as shields or barriers. The basis for crediting shielding in reducing target surface area or providing equivalence to other robust targets/barriers should be justified and documented on a plant-specific as well as target-specific basis. As noted in Table 3.3.6-1,

"Primary Conservatisms in Model Development," of the submittal, Vogtle considered shielding for certain SSCs in its TMRE analysis. As clarified in Section 3.3.2 of this safety evaluation, the scope of the walkdown included consideration of barriers as well as shielding and their impact to missile paths.

Targets inside Seismic Category I reinforced concrete structures may be vulnerable to missile hits through openings in the structure or certain roofs. The TMRE methodology recommends selecting the target area as the minimum of the calculated target area and area of the building opening. For roof missile paths, NEI 17-02, Rev. 1 recommends defining the target area as the projected area of the target along the plane of the roof. The NRC staff finds the use of the area of the opening and the projected area, as applicable, to be acceptable because ( 1) it is reasonable for the EEFP of an SSC to be proportional to the cross-section in the path of a missile and (2) for targets vulnerable to missiles through the roof, the target area projected vertically captures the dominant direction of the missile impact on those SSCs.

For tall targets, NEI 17-02, Rev. 1 recommends splitting the target at the 30 ft. elevation from the reference level and examine the single target as two equivalent targets, with the near-ground MIP values applied to the lower portion of the target (i.e., below 30 ft. elevation),

and elevated MIP values applied to the upper portion of the target. The NRC staff finds the approach of splitting the target at the 30 ft. elevation to be acceptable because (1) the approach is equivalent to using a unique area-weighted MIP, which lies between the near-ground MIP and the elevated-target MIP (thus, the associated EEFP will be between the two extremes computed by assuming the target to be either entirely near-ground or elevated) and (2) the area-weighted MIP values (combining near-ground and elevated target portions) will be close to the MIP values of the dominant target segment (e.g., it is closer to the near-ground MIP values if the lower target segment is of much greater area than the upper target segment).

The TMRE methodology defines an approach to treat physically close targets as "correlated,"

and recommends defining a single polyhedron enclosing two or more proximal targets. The enclosed SSCs are assumed to be simultaneously hit and failed if the enclosing polyhedron were postulated to be hit by a missile. The TMRE methodology further allows for engineering judgement in the selection of enclosing polyhedra to avoid overly conservative prediction of simultaneous failure and provided illustrative examples. The NRC staff finds the approach to treat some SSCs as correlated depending on physical proximity to be acceptable, because such an approach is conservative and addresses uncertainties related to the likelihood of simultaneous impact of tornado missiles on such SSCs. The NRC staff also finds the special treatment of some targets, based on adequately justified engineering judgment, as independent to be acceptable because of the variety of SSC configurations available at a nuclear plant.

As indicated in Section 2.1.2, "Vulnerable SSC Walkdown," of NEI 17-02, Rev. 1, the vulnerable SSC walkdown would gather information on HWEL SSCs that are exposed to tornado missiles.

The walkdown determines which SSCs were vulnerable to tornadoes and tornado missiles and would be used to collect data, such as the exposed SSC "target" location, elevation, surface area, and construction details, and the type and location of any local structures that may provide a shielding effect. Section 3.3.2, "Target Walkdowns," of Enclosure 1 to the submittal provided the scope of TMRE walkdowns. Items 2 and 4 of Section 3.3.2 of Enclosure 1 to the submittal state that the scope of TMRE walkdowns include documenting and describing barriers that could prevent or limit exposure of the SSC to tornado missiles as well as determining the dimensions of the target SSCs, including any subcomponents or support systems.

Item 3 of Section 3.3.2 included identification of directions from which tornado missiles could strike the target in the scope of walkdowns. When calculating surface area, some components (e.g., tanks, ultimate heat sink fans, etc.) were susceptible to potential missiles in the vertical direction that could result in additional exposed area. The NRC's review found that the TMRE methodology does not appear to differentiate between horizontal and vertical missiles. The NRC staff notes the vertical missiles were a consideration in the VEGP Units 1 and 2 UFSAR.

Considering that tornado missiles could strike from all directions, the NRC staff questioned how the TMRE methodology addressed vertical missiles and the related directional aspects. In its July 26, 2018, supplement (Reference 2), the licensee stated that during the walkdown, missiles were considered as capable of striking from all directions. The licensee further explained that vertical missiles were included except in situations where the target was shielded from vertical missiles. The licensee's approach considered all directions for evaluating the impact of tornado-generated missiles, therefore the NRC staff finds that the licensee adequately considered vertical missiles and directional aspects in its analysis.

3.1.5.3 Using Exposed Equipment Failure Probability in TMRE Background on the Use of EEFP The TMRE methodology calculates the failure probability of exposed SSCs using EEFP.

Section 5, "Evaluate Target and Missile Characteristics," of NEI 17-02, Rev. 1 defines EEFP as the conditional probability that an exposed SSC was hit and failed by a tornado missile, given a tornado of a certain magnitude. For every applicable SSC, the following equation is used to calculate five EEFP values, one each for tornado categories F'2 through F'6:

EEFP = (MIP) x (number of missiles) x (target exposed area) x fragility (2)

Where the number of missiles is surveyed in an area of radius 2,500 ft. and fragility is a factor to take credit for the strength of a target against a missile hit. The fragility factor used in the EEFP determination is the conditional probability of the SSC failing to perform its function given that it is hit by a tornado missile. For the purposes of the TMRE methodology, the SSCs were assumed always failed if hit by a tornado missile (i.e., the factor is assumed to be 1). However, as discussed previously, the TMRE methodology, defines adjustment factors on the missile inventory to account for levels of target robustness to withstand missile impacts.

Acceptability of Using EEFP in TMRE As discussed previously, the EEFP is fundamental to the TMRE, because it provides the likelihood of an SSC being failed by a tornado missile. According to EPRI NP-768, the quantity MIP x M x Ar x F (M = number of missiles, Ar= target area, F = fragility factor) is the average number of missile hits given a tornado strike. In general, this average number of hits could be greater than one. The Poisson distribution expresses the probability of a given number of events occurring in a fixed interval of time or space. Assuming a Poisson distribution for the

missile hits over the duration of the tornado, the NRC staff determined that the probability for a target being hit by n missiles is e-µ µn P(n) = n.1 (3) where µ = MI P x M x Ar x F. The probability for a target being hit by one or more missiles is P(hits > 0) = 1- P(O) = 1- exp[-MIP X M X Ar X F] (4)

M/P X M x Ar x F Therefore, the EEFP computed as the product MI P x M x Ar x F is properly interpreted (for cases of small value of the product) as the probability of a target to be hit by at least one missile. Therefore, the NRC staff finds computing the EEFP using equation (2) to be technically sound for this application.

The NRC staff also finds that the licensee's process for determination of the impact of tornado missiles on targets by determining EEFPs is acceptable (i.e., evaluating the risk associated with the lack of tornado missile protection for nonconforming SSCs) because ( 1) the approach is consistent with the derivation of the MIP values and, therefore, uses the MIP values appropriately; (2) the approach to defining missile inventories based on a reference radius (2,500 ft.) is consistent with the original analysis in EPRI NP-768; (3) adjusting inventories to account for robustness levels is adequately justified and an acceptable first order approximation in lieu of detailed fragility analyses for this application, as targets are expected to have different levels of resilience to missile hits; and (4) the approach to estimating exposed areas, in general, tends to overestimate the area in the path of missiles, therefore, it is appropriate for risk evaluations performed to support this application. The NRC staff's conclusion on the acceptability of the using EEFPs in risk evaluations is limited only to address the tornado missile protection nonconforming conditions within the scope of the TMRE methodology as described in other sections of this safety evaluation.

3.1.6 Development of TMRE PRA Model Section 6, "Develop TMRE PRA Model," of NEI 17-02, Rev. 1 provides the guidance for developing the TMRE PRA Model. This process included the following elements:

• Selecting the event trees and fault trees appropriate for modeling a tornado event from the Internal Events Model of Record;

• Replacing the initiating events with tornado initiating events (F'2 - F'6);

• Removing recovery and repair logic (or set failure probability to 1.0);

• Developing compliant case and degraded case logic or models;

• Adding tornado wind and missile failure modes to vulnerable SSCs, as appropriate, in the fault tree logic; and

• Setting human error probabilities (HEPs) to 1.0, for certain short term actions outside the main control room (MCR) and reviewing transit paths for other operator actions outside the MCR.

Section 6.1, "Event Tree/Fault Tree Selection," of NEI 17-02, Rev. 1 states that one or more of the internal events PRA LOOP event trees and respective accident sequence logic are expected to represent the tornado initiating events in the TMRE PRA. The TMRE methodology further states that the other internal initiating events from the internal events PRA model of record should be reviewed to ensure that either (1) a tornado event cannot cause another initiating event, or (2) the impact of the initiating event can be represented in the logic selected to represent the tornado initiating event.

The licensee's process for developing its TMRE PRA model was described in Section 3.3.6, "Model Development," of Enclosure 1 to the submittal. It starts with the licensee's current peer reviewed at-power internal events PRA model. The licensee used the LOOP event tree portion of the internal events PRA as the basis for the TMRE PRA model. The NRC staff confirmed that the licensee, using the walkdown information, examined the internal events PRA for other event trees that might be needed to capture all tornado missile scenarios. The licensee further stated that the LOOP initiating event accident sequence addressed the expected tornado damage states based on a review of the vulnerable equipment and that the tornado initiating events for TMRE were added to the model at the LOOP initiating event location in the fault tree by modifying the initiating event frequency.

Section 3.3.1, "High Winds Equipment List," of Enclosure 1 to the submittal states that the TMRE model used the LOOP sequences with no offsite power recovery and, therefore, PRA components and associated logic that did not support mitigation of a LOOP, were screened out.

The NRC staff concludes that the licensee's approach as discussed in NEI 17-02, Rev. 1 for developing the TMRE PRA model from the internal events PRA model of record is acceptable because it ( 1) appropriately considers the most likely impact of a tornado event on the plant via the assumption of LOOP, (2) appropriately captures the low likelihood of recovering off-site power after a tornado event by not assuming such recovery, and (3) ensures that initiating events caused by a tornado event other than LOOP are considered and, as applicable, represented in the TMRE PRA model.

Section 6.3, "Compliant Case and Degraded Case," in NEI 17-02, Rev. 1 provides the guidance for creating two configurations, referred to as compliant and degraded cases, which were to be used to evaluate the change in risk associated with not providing tornado missile protection for the nonconforming SSCs. As described in Section 6.3 of NEI 17-02, Rev. 1:

• The compliant case represented the plant in full compliance with its tornado missile protection CLB. Therefore, all nonconforming SSCs that were required to be protected against missiles were assumed to be so protected, even when reality determined the SSCs were not protected. In the compliant case, nonconforming SSCs were assumed to have no additional failure modes beyond those normally considered in the internal events PRA; and,

• The degraded case represented the current configuration of the plant (i.e., configuration with nonconforming conditions with respect to the tornado missile protection CLB). As such, the TMRE PRA model would include additional tornado-induced failure modes for all nonconforming SSCs. The failure probabilities for those additional tornado-induced failure modes were based on EEFP calculations.

Therefore, the primary difference between the compliant and degraded cases was the treatment of the nonconforming SSCs. The NRC staff finds that the licensee's approach for creating

compliant and degraded cases is acceptable because this approach appropriately modifies the failure probabilities of affected SSCs for estimating the risk associated with the proposed change.

Section 3.3.5, "Target Evaluation," and Table 3.3.5-1, "EEFP Calculations," of Enclosure 1 to the submittal described that for vulnerable SSCs, the licensee used EEFPs for both compliant and degraded cases. The submittal identified SSCs for which EEFPs were not calculated individually, but the components were included as a portion of a larger correlated target. Finally, this section stated that for the turbine and associated support equipment to enable turbine trip, the turbine trip basic event was set to always be successful in the compliant case and to always fail in the degraded case. Therefore, an EEFP was not calculated for this target.

The NRC staff questioned how this approach accounts for failures of SSCs within the turbine building. In the July 26, 2018, supplement, the licensee described that the turbine trip function was considered failed in the degraded case for all tornado events because of the complexity of modeling the turbine trip system. The licensee also assumed successful turbine trip (i.e., set the failure probability to 0.0) in the compliant case.

The licensee did not calculate EEFPs for the turbine trip system based on the area of the exposed SSCs consistent with Section 6.6, "Non-Category I Structures and Other NSR SSCs,"

of NEI 17-02, Rev. 1. Nevertheless, the NRC staff finds the licensee's approach for developing compliant and degraded cases acceptable because ( 1) it is performed consistent with the guidance; and (2) assuming failure of turbine trip function in the degraded case is conservative, along with the assumption of success of turbine trip function in the compliant case, the approach ensures that the potential conservatism in assuming a turbine trip failure does not result in a nonconservative change in risk calculation.

As discussed above, Section 6.5, "Target Failures and Secondary Effects," of NEI 17-02, Rev. 1A was added to provide guidance on the consideration and treatment of additional tornado and tornado missile induced failure modes for all nonconforming SSCs in the TMRE PRA model. Guidance was provided on functional failures of SSCs as well as the impact of secondary effects. The NRC staff finds that the licensee's approach as discussed in Section 6.5 of NEI 17-02, Rev. 1A adequately captures the important tornado and tornado missile induced failure modes for SSCs as well as their treatment in the TMRE PRA model. The NRC staff further finds that the direct impact on exposed SSCs is the dominant failure mode for this application compared to more complex failure modes (e.g., spurious closure or opening).

The NRC staff questioned when and to what extent failure modes not previously included in the internal events system models should be considered. In the July 26, 2018, supplement, the licensee described the failure modes of SSCs and how those failure modes were implemented in the licensee's TMRE PRA model. The licensee's approach for treating various failure modes of the SSCs in its TMRE PRA model adequately identifies, as well as considers, all applicable failure modes that may be used in future implementation of the methodology. The NRC staff notes that because of conservatisms in the TMRE methodology and the margin to acceptance guidelines, the failure modes could be limited to functional failures and secondary effects occurring from the direct impact of tornadoes and tornado missiles on exposed SSCs.

Table 3.3.5-1 of Enclosure 1 to the submittal provided MIP values, missile counts, and EEFPs, for the nominal and sensitivity cases, for both nonconforming and vulnerable SSCs. The NRC staff reviewed the derivation of EEFPs for those SSCs and concludes that the licensee's

approach adequately identified and added basic events for SSCs that were not protected against tornadoes or tornado missile induced failures in addition to the nonconforming SSCs.

Section 6.1 of the TMRE methodology assumes that the tornado-induced LOOP cannot be recovered. This assumption indicates that offsite power remains unavailable following the event for the duration of the PRA mission time considered for this application. Furthermore, Section 3.1 of the TMRE methodology states that SSCs that were dependent on offsite power were screened from HWEL, because of the nonrecoverable LOOP assumption. The NRC determined that that assumption of a nonrecoverable LOOP may result in nonconservative change-in-risk evaluation. Section 3.3.9, "Sensitivities," of Enclosure 1 to the submittal provided the results of a bounding sensitivity assessment that was performed to ensure conservative modeling treatments in the compliant case did not affect the risk assessment conclusions. The licensee's bounding sensitivity was performed by setting the risk from the compliant case to zero. The NRC staff finds that the sensitivity analysis performed by the licensee in Section 3.3.9.1, "Conservative Risk Treatments Masking Sensitivity," of Enclosure 1 to the submittal bounds the potential nonconservatisms associated with the assumption of nonrecoverable LOOP.

Furthermore, Section A.2.1.1, "Non-recoverable Loss of Offsite Power (LOOP) Assumption," in NEI 17-02, Rev. 1 discusses the basis for the assumption of nonrecovery. This section states that the assumption is consistent with current high winds PRA models. The NRC staff finds the assumption of nonrecovery of the offsite power acceptable for this application, because of insights from operating experience related to LOOP events caused by tornadoes and high winds. Therefore, screening SSCs that are dependent on the offsite power is acceptable for the TMRE methodology at VEGP Units 1 and 2.

The NRC staff questioned how future sensitivity analysis will be performed to assess the impact of conservatisms associated with modeling the equipment failures in the compliant case. In the July 26, 2018, supplement, the licensee described how any future sensitivity analysis would address the conservativism associated with modeling equipment failures in the compliant case.

The licensee stated that the evaluation of compliant case conservatisms was limited to the assumption that certain SSC (e.g., exposed nonsafety-related components) whose failure probabilities were set to 1.0. Similarly, the licensee also considered the assumption that offsite power was lost and not recovered following a tornado event to be a reasonable assumption, which was consistent with current high wind PRA practices.

Furthermore, in response to additional NRC staff concerns related to ensuring conservative modeling treatments in the compliant case do not affect the risk assessment conclusions, the licensee explained that the assumption that certain operator actions within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the event were assumed to fail was considered to be a reasonable assumption for tornado events and therefore, not a compliant case conservatism. The NRC staff concludes that sensitivity analyses related to potential conservatisms by assuming failure of operator actions within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of tornado events nonrecovery of offsite power are not needed because those assumptions are reasonable for this application. Section 7.2.3, "Compliant Case Conservatisms," of NEI 17-02, Rev. 1 provides guidance for performing sensitivities to address the impact of potential complaint case conservatisms. This section stated that the licensee would identify conservatisms related to equipment failures only. The guidance further stated that sensitivity analyses would be performed to address supporting requirement (SRs) identified in Appendix D, "Technical Basis for TMRE Methodology," of the NEI guidance. The licensee stated that it would follow the NEI guidance for addressing complaint case conservatisms. The NRC staff concludes that the licensee's approach for considering conservatism associated with modeling

equipment failures in future implementation of the TMRE methodology acceptable because the licensee's approach addresses relevant SRs consistent with RG 1.200.

Sections 3.3, "Ex-Control Room Action Feasibility," and 6.4, "Impacts on Operator Action Human Error Probabilities," of NEI 17-02, Rev. 1A provides guidance on modeling HEPs in the TMRE PRA model. The guidance stated that no credit for operator action should be taken for actions performed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of a tornado event outside a Category I structure or which required the operator to transit outside a Category I structure to get to the location to perform the action, but could be credited after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The guidance further states that operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> could be impacted by such environmental conditions as debris that blocks access paths and should be considered by taking into account whether equipment will be accessible and whether the time required to perform the action will be impacted. Section 3.3 of the guidance states that the results of the operator interviews and the walkdown notes should be reviewed by a Human Reliability Analyst. Finally, Section 6.4 of the guidance states that the feasibility of actions involving transit or operation outside Category I structures more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the tornado event should be assessed and documented. The NRC staff finds that consistent with RG 1.200 the operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> outside Category I structures should be evaluated to consider the effect of timing and environmental impacts on HEPs.

Section 3.3.1, "High Winds Equipment List," of Enclosure 1 to the submittal states that operator actions are assessed based on the TMRE methodology and that the internal events PRA was used to perform the assessment of operator actions. It further states that a licensed operator is provided a list of operator actions to verify that operator actions outside robust buildings that would require operator exposure during or in the immediate aftermath of the tornado are not being credited in the TMRE PRA.

The NRC staff expressed concerned that measures needed to ensure that environmental conditions would not affect operator actions that are credited after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. In the July 26, 2018, supplement, the licensee described that operator actions in the PRA model were reviewed using documents, which supported the development of the current Vogtle PRA. Additionally, the licensee interviewed a Senior Reactor Operator and System Operator from Vogtle to gain confidence in the assessment of operator action feasibility. Following the review, the licensee determined that there was a challenging path inside the building for one operator action and modeled that action as infeasible instead of adjusting the shaping factors of the HEP for that action. Finally, the licensee stated that the results of the review showed that only two actions performed outside the main control room were credited in its TMRE PRA model. Those actions are performed approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the event and the operator has clear access paths.

Therefore, the licensee did not change the HEP associated with those two actions. The NRC staff finds the licensee's approach for assessing the effect of environmental conditions on operator actions credited after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> in the licensee's TMRE PRA model is acceptable for this application, because the effect of timing and environmental conditions on performance shaping factors associated with all operator actions were considered and HEPs were adjusted, consistent with RG 1.200.

The licensee provided a list of conservatisms in its TMRE PRA model development in Table 3.3.6-1, "Primary Conservatisms in Model Development," of Enclosure 1 to the submittal.

The NRC staff review found that the Vogtle TMRE PRA model contains some conservatisms such as assuming correlated failure of the main steam safety valve exhaust stacks. The assumption results in the failure of the function of the main steam safety valves from a single tornado missile strike.

3.2 Review Methodology Consistent with SRP Section 19.1, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests after Initial Fuel Load" (Reference 11 ), the NRC staff reviewed this risk-informed LAR to determine whether the proposed changes will have minimal impact on the continued safe operation and safe shutdown capability of the plant.

With respect to the risk from not providing positive protection for nonconforming SSCs against tornado missiles by incorporating the TMRE methodology in the UFSAR, the NRC staff reviewed the submittal in accordance with the five key principles of risk-informed decision making, as delineated in RG 1.174, Revision 2 to determine whether:

• The proposed change meets the current regulations, unless it explicitly relates to a requested exemption;

• The proposed change is consistent with a defense-in-depth philosophy;

• The proposed change maintains sufficient safety margins;

• When proposed changes result in an increase in CDF or risk, the increases is small and consistent with the intent of the Commission's Safety Goal Policy Statement; and

• The impact of the proposed change is monitored using performance measurement strategies.

3.3 Key Principle 1: Compliance with Current Regulations As a key principle of risk-informed integrated decisionmaking, Regulatory Position 1 in RG 1.174, Revision 2 states that the licensee should affirm that the proposed licensing basis change meets the current regulations unless the proposed change is explicitly related to a requested exemption (i.e., a specific exemption under 10 CFR 50.12).

The licensee stated in Section 4.1, "Applicable Regulatory Requirements/Criteria," of to the submittal that RG 1.174 establishes criteria to quantify the "sufficiently small" frequency of damage discussed in SRP Section 3.5.1.4 (Reference 8) that allows for a probabilistic basis for relaxation of deterministic criteria for tornado missile protection of SSCs.

However, the cited SRP sections discuss the probability of occurrence of events and not the change in CDF and LERF. In other words, the use of probabilistic criteria in SRP Section 3.5.1.4 (i.e., the probability of damage to unprotected safety-related features) is not directly comparable to RG 1.174 acceptance guidelines for demonstrating whether the change meets the current regulations. Therefore, the NRC staff questioned how the proposed methodology will continue to provide reasonable assurance that the SSCs important to safety will continue to withstand the effects of missiles from tornadoes or other external events without loss of capability to perform their safety function. In the July 26, 2018, supplement, the licensee stated that the use of the TMRE methodology does not alter any input assumptions or the results of the accident analysis. The licensee further stated that the types of accidents, accident precursors, failure mechanisms, and accident initiators already evaluated in the UFSAR as well as the controlling numerical values for parameters in the safety analysis remained unaltered.

The licensee explained that the use of the methodology does not result nor require any physical changes to the facility and, therefore, new types of malfunctions or accidents were not created.

Based on its review of the submittals and supplements, the NRC staff finds th.at the proposed change continues to meet the regulations because the design basis for the SSCs impacted by the proposed change will reflect the importance of the safety functions to be performed by those SSCs in accordance with the GDC, and, therefore, there is reasonable assurance that, subsequent to the proposed change, necessary safety related SSCs will continue to be available to perform their safety functions, as reflected in UFSAR Section 3.5, during and following a tornado event at VEGP Units 1 and 2.

The NRC staff notes that exemption from applicable regulations was neither requested by the licensee in the application nor is granted by the NRC staff. Therefore, key principle 1 in risk-informed decisionmaking is satisfied. Additional details of the impact of the methodology on the licensee's safety analyses are discussed below.

3.4 Key Principle 2: Evaluation of Defense-in-Depth Defense-in-depth is an approach to designing and operating nuclear facilities involving multiple independent and redundant layers of defense to compensate for human and system failures.

Regulatory Position 2.1.1 in RG 1.174, Revision 2 states that defense-in-depth consists of a number of elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

• A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation;

• Over-reliance on programmatic activities as compensatory measures associated with the change in the license basis is avoided;

• System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties;

• Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed;

• Independence of barriers is not degraded;

• Defenses against human errors are preserved; and,

• The intent of the plant's design criteria is maintained.

In Section 3.2.1, "Defense-In-Depth," of Enclosure 1 to the submittal, the licensee provided a discussion of how its risk-informed assessment was consistent with the philosophy of defense-in-depth. The following sections provide an evaluation of each of the seven considerations.

3.4.1 A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

The proposed change does not introduce new accidents or transients as compared to those present in the licensee's internal events PRA and those analyzed during the safety analyses. In Section 3.2.1 of Enclosure 1 to the submittal, the licensee stated that the total number of

nonconforming SSCs was low compared to the number of SSCs that were protected within Category I structures. The licensee also explained that no conditions were discovered within the scope of the proposed change that would affect containment integrity during a tornado event and that the containment would continue to provide its function as a key fission product barrier.

The NRC staff notes that none of the identified nonconforming conditions impacted by the proposed change affects LERF, which is an indication that there was no significant impact on prevention of containment failure. As the proposed change does not significantly affect the availability and reliability of SSCs that mitigate accident conditions, nor significantly reduce the effectiveness of the licensee's emergency preparedness program. Therefore, the NRC staff finds that the proposed change continues to preserve a reasonable balance between prevention of core damage, prevention of containment failure, and consequence mitigation.

3.4.2 Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

The implementation of the proposed change does not require compensatory measures and does not change the licensee's existing operating procedures. The proposed change does not rely upon proceduralized operator actions within an hour of a tornado passing that would require operators to travel into areas that are not protected from the effects of the tornado or tornado missiles. The NRC staff expressed concern that operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> could be impacted by such environmental conditions such as debris that blocks access paths, and whether the time required to perform the action could be impacted. In its June 26, 2018, supplement, the licensee stated that only two operator actions that were performed outside the main control room were credited in the licensee's risk assessment supporting the proposed change and those actions occurred approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the occurrence of the tornado event. The NRC staff notes that no new operator actions developed specifically in response to the proposed change were included in the licensee's risk assessment supporting the proposed change. The NRC staff finds that the proposed change avoids an over-reliance on programmatic activities because the proposed change does not result in human actions or compensatory measures.

3.4.3 System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

In Section 3.2.1 of the submittal, the licensee explained that the redundancy associated with the functions of the nonconforming SSCs was unchanged. In Enclosure 1 of the July 26, 2018, supplement, the licensee stated that the proposed change did not modify the redundancy, independence, or diversity of systems described in its UFSAR and that no single tornado missile would affect both redundant trains of a system. The licensee further stated that the availability and reliability of SSCs that could either initiate or mitigate events was not changed, except for the tornado missile protection of the identified nonconforming SSCs, which was evaluated in the application. Based on the review of the submittal as well as the supplemental information, the NRC staff finds that system redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

3.4.4 Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

Tornado events and missiles generated by such events represent a common-cause initiating event, which can impact multiple SSCs. The licensee's risk assessment supporting the proposed change captures such impacts. In Enclosure 1 of the July 26, 2018, supplement, the licensee explained that the nonconforming conditions included in the proposed change were spatially distributed about the licensee's site with differing orientation and elevation. Therefore, it would be highly unlikely for a single missile to impact different distinct nonconforming SSCs.

The licensee correlated the tornado missile impact based failure of nonconforming conditions that had an appreciable likelihood of being struck by the same missile in the risk assessment supporting the proposed change. The NRC staff concludes that the licensee has adequately assessed the potential for the introduction of new common-cause failure mechanisms because the proposed change does not degrade defenses against potential common-cause failures and directly considers the impact of the common-cause initiator.

3.4.5 Independence of barriers is not degraded.

In Section 3.2.1 of Enclosure 1 to the submittal, the licensee stated that none of the three primary fission product barriers - the reactor fuel cladding, the reactor coolant system pressure boundary, and the containment structure - had deficiencies identified that increased the exposure of the barrier to the effects of tornado missiles. The NRC staff notes that the proposed change does not significantly increase the likelihood or consequence of an event that challenges multiple barriers, and does not introduce a new event, which would challenge multiple barriers. The NRC staff finds that the proposed change does not affect the independence of the fission product barriers and, therefore, the independence of those barriers is not degraded.

3.4.6 Defenses against human errors are preserved.

In Section 3.2.1 of Enclosure 1 to the submittal, the licensee stated that no new opportunities for human errors were introduced by the proposed changes. As noted previously, no new operator actions developed specifically in response to the proposed change were included in the licensee's risk assessment supporting the proposed change. The licensee stated that it has two procedures, which include actions to be taken by plant staff to prepare for a possible tornado event on site. Those procedures require inspection of the site for missiles and equipment that could become a missile. Therefore, the NRC staff concludes that the proposed change preserves defenses against human error and does not introduce new human error mechanisms.

3.4.7 The intent of the plant's design criteria is maintained.

In Enclosure 1 of the July 26, 2018, supplement, the licensee stated that the intent of the plant's design criteria for tornado missiles, which is to provide reasonable assurance of achieving and maintaining safe shutdown in the event of a tornado, was maintained by the proposed change because the proposed change only affected a very small fraction of plant systems and their associated exposure to such missiles. The licensee explained that in lieu of protection for the identified nonconforming SSCs, it had analyzed the likelihood of damage of those SSCs from tornado missiles, and the consequent effect on CDF and LERF. The licensee further explained that while there was slight reduction in protection, the impact was known, and was considered acceptable per NRC staff guidance. The licensee also stated that the methodology utilized to

support the proposed change could not be used in the modification process for a future plant change to avoid providing tornado missile protection. Therefore, the NRC staff finds that the intent of the plant's design criteria is maintained by the proposed change.

In summary, the NRC staff finds that the proposed change does not significantly affect the seven considerations for defense-in-depth and the proposed change preserves defense-in-depth commensurate with the expected frequency and consequence of challenges to the system resulting from the proposed change.

3.5 Key Principle 3: Evaluation of Safety Margins Regulatory Position 2.1.2 in RG 1.174, Revision 2 discusses two specific criteria that should be addressed when considering the impact of the proposed changes on safety margin:

• Codes and standards or their alternatives accepted for use by the NRC are met.

• Safety analyses acceptance criteria in the [licensing basis (LB)] (e.g., [Final Safety Analysis Report (FSAR)], supporting analyses) are met or proposed revisions provide sufficient margin to account for analysis and data uncertainty.

Section 3.2.2 of Enclosure 1 of the submittal discussed the impact of the proposed change on the safety margin. The licensee stated that Codes and Standards (e.g., ASME, Institute of Electrical and Electronic Engineers (IEEE)) or alternatives approved by the NRC continue to be met and that the proposed change was not in conflict with approved Codes and Standards relevant to the SSCs impacted by the change. The NRC staff questioned how the license can conclude that the safety analysis acceptance criteria in the licensee's safety analysis were not impacted by the proposed change. In Enclosure 1 to the September 14, 2018, supplement (Reference 3), the licensee stated that the safety analysis acceptance criteria described in Vogtle UFSAR Chapters 6.0, "Engineered Safety Features," and 15.0, "Accident Analyses,"

were not altered by the proposed change and the acceptance criteria would continue to be met.

The licensee explained that the safety analyses did not assume the occurrence of a tornado coincident with a design-basis accident, except to the extent that a tornado may have the potential to initiate some of the design-basis accidents. The licensee further stated that the assumption of failure of one train of a safety system (i.e., single failure assumption) was explicit in the accident analysis and since only a very small fraction of the equipment assumed to mitigate an accident was not protected from the effects of tornado missiles, there was reasonable assurance that a separate train would be available to provide the safety function even if one train was unavailable.

Section 2.3, "Evaluate Target and Missile Characteristics," Section 5, "Evaluate Target and Missile Characteristics," and Section 6.5, 'Target Failures and Secondary Effects," of NEI 17-02, Rev. 1A stated that tornado missile failures did not need to be considered for SSCs protected by 18-inch reinforced concrete walls, 12-inch reinforced concrete roofs, or 1-inch steel plate. The guidance did not require analysis for evaluating the risk of nonconforming conditions that were protected as described in Section 2.3 of NEI 17-02, Rev. 1 and implied that protection against the tornado-generated missiles was not needed for those SSCs. The NRC staff questioned whether the safety analysis acceptance criteria in the licensing basis would continue to be met if nonconforming conditions were (or if identified in the future, would be) screened from Vogtle TMRE analysis using the criteria in Section 2.3 of NEI 17-02, Rev. 1. In the July 26, 2018, supplement, the licensee stated that screening of SSCs from the list of nonconforming conditions using the criteria in Section 2.3 of NEI 17-02, Rev. 1 was not performed for the

proposed change in the licensee's application. The licensee further stated that screening based on the above-mentioned criteria may be used in the future implementation of its proposed TMRE methodology. The licensee has not performed any screening of nonconforming SSCs using the criteria in the guidance; the NRC staff notes that this approach is conservative and is, therefore, acceptable.

The NRC staff concludes that the proposed change maintains sufficient safety margin because Codes and Standards or their alternatives accepted for use by the NRC will continue to be met and the safety analysis acceptance criteria remain unaffected by the proposed change.

3.6 Key Principle 4: Change in Risk Consistent with the Commission's Safety Goal Policy Statement 3.6.1 PRA Acceptability The objective of the PRA acceptability review is to determine whether the plant-specific PRA used in evaluating the submittal as supplemented is of sufficient scope, level of detail, and technical elements for the application. The NRC staff evaluated the PRA acceptability information provided by the licensee in its tornado-missile risk evaluation submittal and supplements, including industry peer-review results against the criteria discussed in RG 1.200, Revision 2.

3.6.1.1 Internal Events PRA Model For each supporting requirement in the ASME/ANS RA-Sa-2009 (2009 ASME/ANS Standard),

there are three possible degrees of "satisfaction referred to as capability categories (CC) (i.e.,

CC-I, CC-II, and CC-Ill), with CC-I being the minimum, CC-II considered widely acceptable, and CC-Ill indicating the maximum achievable level of detail, plant specificity, and realism. For many SRs, the CCs are combined (e.g., the requirement for meeting CC-I is combined with CC-II) or the requirement is the same across all CCs so that the requirement is simply met or not met. For each supporting requirement, the peer review team designates one of the CCs or indicates that the SR is met or not met. According to Section 2.1, "Consensus PRA Standards,"

of RG 1.200, Revision 2, CC-II is the level of detail that is adequate for the majority of risk-informed applications. Therefore, in general, facts and observations (F&Os) are written for any SR that is determined not to be met or does not fully satisfy CC-II of the 2009 ASME/ANS Standard, consistent with RG 1.200, Revision 2.

The NRC staff reviewed the results of the peer review process for the internal events PRA presented in Enclosure 3 to the submittal. The licensee's internal events PRA model was subject to a number of industry peer reviews and self-assessments. The most recent peer review was performed in May 2009, which, as clarified in Vogtle's May 17, 2013, supplement (Reference 23) to its 10 CFR 50.69 submittal dated August 31, 2012 (Reference 24), was a full scope peer review against Revision 1 of RG 1.200 (Reference 25). The licensee submitted a list of finding-level F&Os from the 2009 peer review and provided a disposition of each item in Table 3, "Resolution of the VEGP Internal Events PRA Peer Review Findings," of Enclosure 3 to the submittal. Table 4, "Comparison of RG 1.200 Revision 1 and Rev. 2 Supporting Requirements," to Enclosure 3 to the submittal, identified differences between Revisions 1 and 2 of RG 1.200 and integrated these differences into the findings from the previous peer review. Therefore, the NRC staff finds that the licensee's internal events PRA has been assessed against the currently applicable revision (Revision 2) of RG 1.200.

The NRC staff reviewed the licensee's resolution of all the peer review finding-level F&Os and assessed the potential impact of the findings on this application. The NRC staff also reviewed the December 17, 2014, safety evaluation related to Vogtle's 10 CFR 50.69 submittal (Reference 26), and evaluated the licensee's responses to NRC staff questions for Vogtle's 10 CFR 50.69 submittal related to resolution of Vogtle internal events PRA finding-level F&Os.

Based on its review, the NRC staff finds that the internal events finding level F&Os have either been satisfactorily resolved in the context of this application or the resolutions have minimal impact on this application.

Section 4.3, "2015 Internal Events Update," of Enclosure 3 to the submittal discussed the 2015 internal events update and stated that the major change during the update was the addition of reactor coolant pump (RCP) shutdown seal modeling. The discussion proceeded to state that a peer review was not required for those revisions. The NRC staff questioned why the incorporation of Generation Ill Westinghouse shutdown seal model in that PRA model does not qualify as a PRA upgrade. In the July 26, 2018, supplement, the licensee explained that the peer-reviewed Vogtle internal events PRA model did not include the Westinghouse Generation Ill low leakage (shutdown) seals. However, the peer-reviewed PRA model included the Westinghouse Owners Group (WOG) 2000 RCP seal leakage model (Reference 27) to assess the plant's response to events that result from a total loss of cooling to the RCP seals.

The licensee cited the definition of a PRA upgrade in the 2009 ASME/ANS Standard (i.e., a new methodology, or a change in scope or change in capability that impacts the significant accident sequences or the significant accident progression sequences) to support its claim that the inclusion of the shutdown seals model did not constitute a PRA upgrade. The licensee's response stated, in part, that:

The change in the seal leakage model is not a new methodology because the new seal leakage model is simply an expansion of the current peer-reviewed model with different failure probabilities and associated human actions. There is no change in the model scope because the equipment, dependencies, and types of accident sequences remain the same. Finally, there is no change in PRA modeling capability, i.e., the peer reviewed PRA model can still evaluate the risk associated with station blackout and total loss of cooling events related to RCP seal failures.

The licensee further stated that although the lower seal failure rates, due to the inclusion of the shutdown seal model, would affect the ordering of the associated accident sequences, and reduce the CDF and LERF overall, the associated sequences were not significantly changed, and new sequences that had not already been modeled in the PRA and peer reviewed would not be generated.

Furthermore, the licensee stated that the RCP shutdown seals were modeled in the licensee's internal events PRA by adding events and operator actions with corresponding HEPs consistent with Topical Report PWROG-14001-P, Revision 1 (Reference 21) and the associated NRC safety evaluation dated August 23, 2017 (Reference 22), including the limitations and conditions (L&Cs) in that safety evaluation. The licensee provided an explanation of how the applicable L&Cs were implemented. The licensee stated in L&C 2 that an analysis should be performed to confirm that the maximum allowable cold-leg temperature is not exceeded for all accidents or transients for which the shutdown seals are credited for controlling the leakage through the RCP seals to the relevant leakage amount. The licensee stated that analysis showed that following actuation of the RCP shutdown seals and tripping of the RCPs, for some scenarios with

asymmetric reactor coolant system cooling resulting from steam generator dryout on one or more steam generators, cold-leg temperatures could reach the maximum allowable temperature in approximately 45 minutes if no actions were taken to cool down. The licensee explained that, under such conditions, its emergency operating procedures would direct operators to initiate a cooldown to hot shutdown, well before 45 minutes, which would prevent cold-leg temperatures from reaching the maximum allowable temperature. Since the reactor coolant system cooldown action in response to asymmetric cooling scenarios was not explicitly included in the licensee's internal events PRA model, which formed the basis for the TMRE PRA model, the licensee performed a sensitivity study to determine the impact of the failure to perform the emergency operating procedure actions to cool down in the above described scenarios on this application.

The licensee performed the sensitivity in combination with that for the nonpermanent construction-related missile sensitivity and the missile distribution. The licensee provided the results of the sensitivity study that showed that delta CDF and delta LERF increased but remained below the RG 1.174, Revision 2 "very small" risk change thresholds. The licensee further stated that additional modeling conducted in the future for asymmetric cooling will be incorporated through the use of the most current internal events PRA model available at the time for TMRE analysis updates.

After reviewing the information regarding the modeling of the shutdown seals in the licensee's internal events PRA model that forms the base for the TMRE PRA model, the NRC staff concludes that the licensee has demonstrated that the modeling of the shutdown seal model was performed in accordance with the August 23, 2007, safety evaluation for PWROG-14001-P, Revision 1 (Reference 22), and that the applicable L&Cs therein were either addressed or shown to have an insignificant impact on this application. However, the licensee should not infer that the same conclusion would be reached as a result of the NRC staff's review of other applications.

Because of its review of the submittal and supplemental information, the NRC staff concludes that that the licensee has demonstrated that the internal events PRA meets the guidance in RG 1.200, Revision 2, that it is reviewed against the applicable SRs in ASME/ANS-RA-Sa-2009, and that it is technically acceptable for this application. The NRC staff has reviewed all finding-level F&Os developed by the peer reviewers and determined that the either the resolutions of those F&Os support the determination that the quantitative results are adequate or have no significant impact on the TMRE PRA. Accordingly, the NRC staff finds that the licensee's internal events PRA model provides an adequate basis for, the development of its TMRE PRA model.

3.6.1.2 Tornado Missile PRA Model In addition to the internal events technical elements, the details of the conversion process from the internal events PRA to the TMRE PRA was reviewed to determine that it followed industry guidance in NEI 17-02, Rev. 1 and to determine whether the conversion process was acceptable for this application.

Appendix D, "Technical Bases for TMRE Methodology," to NEI 17-02, Rev. 1 includes SRs at CC-II from Part 2 (internal events PRA) of the 2009 ASME/ANS PRA Standard that have been selected specifically by the NRC staff for the application of the TMRE PRA model in assessing tornado missile protection nonconformance risk. The selected SRs required specific consideration during the development of the TMRE model from the internal events model. The licensee listed its conformance with the SRs in Appendix D of NEI 17-02, Rev. 1 in Table 5 of to the submittal. The NRC staff finds that the licensee has conformed to the

above-mentioned SRs because it has adequately considered them in the development of the TMRE PRA model from the internal events model.

Section 3.3.2, "Assessment of Assumptions and Approximations," of RG 1.200, Revision 2 states that for each application that calls upon the guide, the applicant identifies the key assumptions and approximations relevant to that application. Those assumptions and approximation were used to identify sensitivity studies as input to the decisionmaking associated with the application. Rev. 2 of RG 1.200 defines the terms "key assumption" and "key source of uncertainty" in the same section of the guidance. In Enclosure 1 to the supplement dated June 26, 2018, the licensee described the key assumptions and sources of uncertainty identified from a review of the licensee's internal events PRA model that were applicable to the TMRE analysis supporting this application. The licensee also discussed the disposition of each of the identified key assumptions and sources of uncertainty. The licensee's dispositions demonstrated that the identified key assumptions and sources of uncertainty did not affect this application. The NRC staff concludes that the licensee has identified key assumptions and sources of uncertainty consistent with the guidance in RG 1.200, Revision 2 and has adequately addressed them for this application.

As a result of its review of the submittal, as supplemented, the NRC staff concludes that the Vogtle TMRE PRA is acceptable for this application because ( 1) the internal events model which is the base for the TMRE PRA is technically acceptable, (2) the licensee has appropriately considered specific SRs that were identified as being important to the TMRE PRA development, and (3) the licensee appropriately identified key assumptions and addressed for this application. Therefore, quantitative results obtained from the Vogtle TMRE PRA model along with appropriate sensitivity studies can be used to demonstrate that the incremental risk due to the SSCs that are unprotected from tornado-generated missiles per the licensee's CLB meets the acceptance guidelines in RG 1.174, Revision 2.

3.6.2 Comparison of PRA Results with Acceptance Guidelines The licensee presented the change in risk between the degraded case (i.e., current plant) in which nonconforming SSCs are modeled as vulnerable to a tornado missile and the compliant plant case in which the plant is in full compliance with its design basis tornado-generated missile protection requirements. The approach for calculation of the change in risk captures the incremental risk from leaving the nonconforming SSCs unprotected (i.e. in the current as-is condition). The licensee presented the quantification results from its TMRE PRA in Section 3.3.7, "Model Quantification," of Enclosure 1 to the submittal. Based on the information in that section of the submittal the complaint case CDF and LERF were 1.98 x 1o-s/year and 2.27 x 10-11 /year, respectively. The corresponding metrics for the degraded case were 6.34 x 1o-s/year and 8. 78 x 10-10/year, respectively. Consequently, the licensee reported the change in risk from the tornado missile nonconformances as 4.36 x 1o-8/year for CDF and 8.78 x 10-10/year for LERF. Those results meet the guidelines for "very small" change in risk (i.e., Region Ill) in RG 1.174, Revision 2. Per the guidance in RG 1.174, Revision 2, the total base CDF and LERF need not be reported for "very small" increases in risk.

3.6.3 Uncertainty and Sensitivity Analyses Regulatory Position 2 in RG 1.174, Revision 2 states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings. Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after

considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

Section 7.2.1, "TMRE Missile Distribution Sensitivity," of NEI 17-02, Rev. 1A identified certain sensitivity studies and provided guidance on their performance. Section 3.3.9, "Conservative Risk Treatments Masking Sensitivity," of Enclosure 1 to the submittal described the sensitivity studies performed by the licensee to support this application. The guidance provided in Appendix A of NEI 17-02, Rev. 1 indicated that the sensitivity studies should be performed by changing the EEFP in the model representing the degraded case.

Section 3.3.9 of Enclosure 1 to the submittal provided discussions on the sensitivities performed by the licensee in support of the application. The licensee evaluated the impact of conservatism in the assumptions in the compliant case on the change-in-risk quantification and the impact of higher missile count to account for temporary construction missiles near the licensee's site. The sensitivity to address the impact of conservatism in the compliant case used a bounding approach that set the results of the compliant case to zero, which resulted in the change-in-risk being equal to the quantified risk of the degraded case. The sensitivity to determine the impact of the temporary construction missiles doubled the missile count for both the complaint and degraded cases compared to the corresponding base cases. The licensee demonstrated that the change-in-risk between the degraded case and the compliant plant case for each sensitivity case was within the thresholds for "very small" change per the acceptance guidelines in RG 1.174, Revision 2.

The NRC staff requested that the licensee identify the nonconforming conditions and vulnerabilities that met all the characteristics of a "highly exposed" SSC. In the July 26, 2018, supplement, the licensee provided a list of nonconforming conditions and vulnerabilities modeled in the licensee's TMRE PRA that met all the characteristics of a "highly exposed" SSC per the criteria in Sect.ion 7.2.1 of NEI 17-02, Rev. 1A. The list also provided the basis for SSCs that were not "highly exposed." The NRC staff finds that the list provided by the licensee is comprehensive and correctly identifies SSCs as "highly exposed" per the criteria in Section 7.2.1, "TMRE Missile Distribution Sensitivity," of NEI 17-02, Rev. 1A.

The NRC questioned how uncertainties associated with the impact of the missile distribution on the licensee's target hit probability are handled. In the July 26, 2018, supplement, the licensee stated that the sensitivity to address the uncertainties associated with the impact of missile distribution on the MIP values was updated. In the updated approach provided in Enclosure 3 to the July 26, 2018, supplement, the basic event failure probabilities of SSCs with a tornado missile failure basic event Risk Achievement Worth (RAW) importance measure greater than 2 would be multiplied by 2.75 for tornado categories F'4, F'5, and F'6. In addition, an MIP multiplier, to determine a target-specific MIP, would also be calculated if a large number of missiles were close to such targets.

In Enclosure 3 to the July 26, 2018, supplement, the licensee provided an updated version of NEI 17-02, Rev. 1, which defined a large number of missiles as greater than 1,100 missiles within 100 ft. of the target. According to Section A.7.6 of NEI 17-02, Rev. 1A, the selection of 100 ft. as the region of consideration is based on judgement and choice of 1,100 missiles was based on an approximate missile density of 2. 75 times the average missile density based on 240,000 missiles, the generic total number of missiles used in TMRE, within a 2,500 ft. radius.

Section 7.2.1 of NEI 17-02, Rev. 1A provides the method for calculating the target-specific MIP.

The licensee stated that the reason for introducing the consideration of nearby missiles was that the risk associated with a highly exposed and risk-significant target with a large concentration of

nearby missiles may be underestimated using the multiplier of 2.75. The sensitivity would be performed by applying either the generic MIP multiplier of 2. 75 or the target-specific MIP multiplier to the appropriate basic events, recalculating the LiCDF and LiLERF, and comparing the results to the RG 1.174 acceptance criteria.

The NRC staff finds that the approach to calculating the thresholds for the large number of missiles and the close proximity to SSCs to be acceptable for this application, because an assessment of EPRI NP-768 data by the NRC staff shows that the most missile impacts comes from missiles that are within 100 ft. of a target. Therefore, the NRC staff concludes that the licensee's revised approach to perform the sensitivity to address the uncertainties associated with the impact of missile distribution on the MIP values is acceptable because it accounts for plant-specific variations in missile populations in the vicinity of SSCs.

The NRC staff notes that Section 7.2.1 of NEI 17-02, Rev. 1A includes qualitative factors that could be used to justify not applying a higher target-specific MIP. The licensee has not used such qualitative factors, including the examples in Section 7.2.1 of NEI 17-02, Rev. 1A, and therefore, the NRC staff has not reviewed the acceptability of the qualitative factors for application in the TMRE methodology for VEGP Units 1 and 2.

The NRC staff questioned how the importance measures are determined from the TMRE PRA model in the context of the 'binning' approach for the tornado categories employed in the model.

In the July 26, 2018, supplement, the licensee stated that since a given SSC had a separate tornado missile basic event for each tornado intensity, the basic events for a given SSC were mutually exclusive and provided the approach for calculating the RAW importance measure.

The approach used by the licensee and described in Section 7.2.1 of NEI 17-02, Rev. 1 determines the cumulative RAW of an SSC for the F'4 through F'6 tornado intensities, but does not consider the RAW importance of that SSC from the F'2 and F'3 intensities.

Section 7.2.1 of NEI 17-02, Rev. 1A excludes the RAW importance of SSCs from the F'2 and F'3 intensities in the determination of risk-significant SSCs for the sensitivity analyses. In the licensee's responses in the supplements dated July 26 and September 14, 2018, the licensee stated that those tornado intensities are not affected by the sensitivity calculation. The NRC staff finds the aggregation approach used in NEI 17-02, Rev. 1A to combine the RAW importance from F'4 to F'6 is conservative because it accounts for cumulative importance of SSCs from those intensities. In addition the sensitivity analyses are performed for any of the SSC with a RAW greater than or equal to 2 for F'4 to F'6. Because of the conservatism in the aggregation approach and the sensitivity analyses performed for SSCs with a RAW greater than or equal to 2 for F'4 to F'6, excluding the RAW importance of SSCs from the F'2 and F'3 intensities is not expected to potentially overlook risk significant SSCs from consideration in the sensitivity analyses. The NRC staff finds that performing the sensitivity for the F'4 through F'6 tornado categories is appropriate for VEGP Units 1 and 2, because of the higher likelihood of failure of SSCs at those categories.

The NRC staff questioned the key difference between the two TMRE sensitivities to be performed per Section 7.2.1.A, "Zonal vs. Uniform Missile Distribution," and Section 7.2.1.B, "Missile Impact Parameter," in NEI 17-02, Rev. 1. The licensee indicated in the July 26, 2018, supplement that the "Missile Impact Parameter" sensitivity is focused on SSCs that are "highly exposed," and the criteria for determining a "highly exposed" target is provided in Section 7.2.1 of NEI 17-02, Rev. 1A. The licensee stated that the revised sensitivity approach for the "Zonal vs. Uniform Missile Distribution," included the criteria for the "highly exposed" SSCs thereby obviating the need for aggregating the two sensitivities. The NRC staff concludes that the

licensee's revised approach for the "Zonal vs. Uniform Missile Distribution," as discussed above, captures the uncertainty associate with the MIP values for "highly exposed" SSCs and therefore, a separate sensitivity for that parameter is not required for this application.

The NRC staff questioned if the change in risk from a future TMRE revision by the licensee, or any of the required sensitivity studies, exceeded the acceptance guidelines of RG 1.174, Revision 2 for "very small" change in risk, whether the methodology would require prior NRC approval. The licensee indicated that prior NRC approval would be required if the licensee could not reduce the change-in-risk with refinements. The NRC staff notes that according to Section 7 .3 of NEI 17-02, Rev. 1, the TMRE analysis inputs may be refined within the scope of the TMRE methodology in cases where the "very small" change acceptance guidelines in RG 1.174, Revision 2 were exceeded. In the July 26, 2018, supplement, the licensee clarified that the refinements that may be pursued include TMRE model inputs (e.g., correlation modeling, shielding, and robust missile percentages) and PRA model updates (e.g., refined system modeling and data updates). The NRC staff finds the licensee's approach acceptable because it ( 1) relies on refinements that are within the scope of the licensee's PRA model configuration control process consistent with the RG 1.174 guidelines, and (2) will result in NRC staff review for cases where the refinements are unsuccessful.

The NRC staff finds that the incremental risk from not protecting the nonconforming SSCs against tornado missile damage is "very small" per the acceptance guidelines in RG 1.174, Revision 2. Further, the NRC staff finds that the results are robust relative to the uncertainties involved because sensitivity studies have demonstrated that the NRC staff's decision would not be changed due to the uncertainties. Therefore, principle 4 of risk-informed decisionmaking is met.

3. 7 Key Principle 5: Performance Measurement Strategies - Implementation and Monitoring Program Regulatory Position 3 in RG 1.174, Revision 2 states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. This regulatory position further states that an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This will ensure that the conclusions that have been drawn from the evaluation remain valid.

The NRC staff finds that changes over time to the plant and to the PRA can potentially affect the conclusions of risk-informed applications even though the PRA quality and level of detail has been shown to be adequate. As described in the submittal, the licensee has administrative controls in place to ensure that the PRA models support the application and reflect the as-built, as-operated, and as-maintained plant over time. The process includes provisions for monitoring issues affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience), for assessing the risk effect of unincorporated changes, and for controlling the model and associated computer files. The process also includes reevaluating the tornado missile risk of nonconforming SSCs previously calculated to ensure the continued validity of the results.

Section 8.1, "Plant Configuration Changes," of NEI 17-02, Rev. 1 states that design control programs meeting 10 CFR Part 50 Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," are used to ensure subsequent plant configuration

changes were evaluated for their impact on nonconforming SSC risk using TMRE. Section 8.1 also states that licensees should ensure that they have sufficient mechanisms to assure that plant changes that increase the site missile "burden" are evaluated for impact to the TMRE analysis results. Section 4.1, "Applicable Regulatory Requirements/Criteria," of Enclosure 1 to the submittal states that the licensee has confirmed that sufficient mechanisms to assure that any significant permanent changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site design control program. The licensee further stated that permanent changes that increased the site missile burden within the 2,500-ft missile radius established for TMRE would be reviewed for impact on the TMRE analysis.

The NRC staff questioned the mechanism(s) and approach(s) that would be followed by the licensee to determine whether a particular change to the facility is "significant" for evaluation of the impact to the TMRE basis. In its July 26, 2018, supplement, the licensee described the approach that the licensee would follow to determine whether a particular change to the facility is "significant" for evaluation of the impact to the TMRE basis. The licensee stated that design change activities in accordance with the licensee's procedures required completion of a design attribute review where PRA was a stakeholder. Impact reviews verified that affected items, such as procedures, equipment, and programs, as well as interfaces have been identified. The licensee stated that a design change that affected the parameters of TMRE would have to be evaluated with TMRE prior to being implemented. In Enclosure 1 to its supplement dated September 14, 2018, the licensee further clarified that changes to previous nonconforming SSCs that would increase the target EEFP (e.g., effect the target exposed area by increasing the exposed exhaust pipe height, effect a robust missile percentage by changing pipe material or thickness) were not allowed under TMRE and only changes that result in increased site missile burden required an updated TMRE analysis.

The NRC staff questioned those mechanisms necessary to assure that temporary and permanent changes to site missile sources will be properly evaluated. The licensee explained in its June 26, 2018, supplement that the procedure IP-ENG-001 captured the impact of temporary and permanent changes to site missile sources. The NRC staff finds the licensee's procedures for determining significant changes and assuring temporary as well as permanent changes are evaluated to be acceptable, because the procedure identifies and evaluates the impact of such changes and because the licensee will, per guidance, include permanent changes that increase the site missile burden within the 2,500 ft. missile radius in the TMRE analysis.

The NRC staff questioned the process(s) intended to ensure changes that could affect VEGP TMRE results (e.g., plant design changes, changes made to the licensee's base internal events PRA model and new information about the tornado hazard at the plant) were considered in future implementation of the licensee's TMRE. In its June 26, 2018, supplement, the licensee stated that changes that could affect its TMRE results (e.g., plant design changes, changes made to the licensee's base internal events PRA model, and new information about the tornado hazard at the plant) would be considered in future implementation and that its internal procedures would be updated to reflect that. Section 8.1, "Plant Configuration Changes," in NEI 17-02, Rev. 1A states that if the approved TMRE analysis is updated as a result of a design change that increased the site missile burden, the following three items below should be used in updating the TMRE analysis: (1) the most current PRA Internal Events model of record should be used for the analysis; (2) the most recent approved revision of NUREG/CR-4461 should be used to ensure the tornado initiating event frequencies reflect the site tornado hazard; and (3) the treatment of previously identified nonconforming conditions in the TMRE model will continue

to modeled as nonconforming conditions in the degraded case. The NRC staff finds that the approach in Section 8.1 of NEI 17-02, Rev. 1A is acceptable because it results in the most recent internal events PRA model and site-specific tornado hazard information being used for future TMRE analysis updates. The NRC staff also finds the licensee's approach to be acceptable because it follows the guidance for considering the changes to the internal events PRA model and the site-specific tornado hazard.

The NRC questioned the treatment of the currently identified nonconforming conditions in future uses of the licensee's TMRE PRA model. In the June 26, 2018, supplement, the licensee described the treatment of the currently identified nonconforming conditions in future uses of the licensee's TMRE PRA model. The licensee stated that the targets that were treated as nonconforming in the initial application of the TMRE would continue to be considered nonconforming in future revisions of the TMRE model. The licensee explained that there may be exceptions to the above-mentioned approach for the following cases where the targets:

• Have been physically protected in such a way that they would no longer be considered nonconforming at the time of the revision and can be removed from the TMRE analysis;

• Were conservatively treated as nonconforming in the initial analysis but had not been identified as nonconforming during discovery walkdowns; or

• Would not otherwise be considered nonconforming at the time of the revision because engineering calculations have demonstrated that they are conforming.

Section 8.0 of NEI 17-02, Rev. 1 included the first and third approaches for possible exceptions from considering targets that were treated as nonconforming in the initial application of the TMRE as nonconforming in future revisions of the TMRE model. The NRC staff finds the treatment of nonconforming SSCs in the initial application of the TMRE as nonconforming in future revisions of the TMRE model to be acceptable because it continues to capture the incremental risk from those SSCs, which will be nonprotected due to assessment that the SSC was not among those SSCs required to be protected. The NRC staff finds the exceptions in Section 8.0 of NEI 17-02, Rev. 1A to be acceptable because they represent appropriate approaches to negate the previously identified nonconformance of an SSC. The NRC staff notes that the engineering calculations to demonstrate conformance of a previously nonconforming SSC must be consistent with the licensee's CLB and regulations governing the extent of changes to the licensing bases independent of staff approval (e.g., 10 CFR 50.59 or other applicable 10 CFR change processes).

Additionally, the NRC staff questioned how the cumulative risk associated with unprotected SSCs evaluated under TMRE will be considered in future decisionmaking (e.g., 10 CFR 50.59 criteria as well as in future risk-informed submittals). In the July 26, 2018, supplement, the licensee described how the cumulative risk associated with unprotected SSCs evaluated under TMRE would be considered in future decisionmaking (e.g., 10 CFR 50.59 criteria, other applicable 10 CFR change processes, as well as in future risk-informed submittals). The licensee stated that the change in risk calculated from the TMRE methodology was intended to be an estimate that reasonably bounds the risk from tornado missiles due to nonconforming SSCs, for the purpose of decisionmaking related to those SSCs. The licensee explained that once incorporated into the license, it may continue to be used to evaluate additional nonconforming SSCs in accordance with corresponding guidance. The licensee stated that any further use of the TMRE model was beyond the scope of the guidance. The NRC staff notes that Section 8.3 of NEI 17-02, Rev. 1A, infers that use of the results in other regulatory or risk

applications may mask risk insights from other hazards. As the licensee demonstrated that the cumulative risk should be appropriately bounding, the NRC staff review did not include Section 8.3 of the revised guidance. Additionally, as discussed in the July 26, 2018, supplement, the TMRE must not to be used for nonconforming conditions created as a result of future modifications without a separate review and approval by NRC. Therefore, the NRC staff concludes that the licensee's application-specific approach for considering cumulative risk in future decisionmaking to be acceptable.

The licensee described its approach if performance-monitoring programs indicated that the risk acceptance guidelines for "very small" change-in-risk in RG 1.174, Revision 2 were exceeded in the July 26, 2018, supplement. As the licensee indicated that prior NRC approval would be required should the acceptance guidelines be exceeded, the NRC staff concludes that the licensee's PRA maintenance program and monitoring program appears sufficient to track the as-built, as-operated condition of the plant and the performance of equipment such that when the equipment is degraded, the programs can acceptably affect the conclusions of the licensee's risk evaluation and integrated decisionmaking that support the change to the licensing basis.

3.8 Methodology Conclusion The NRC staff has reviewed the licensee's evaluation of the risk from tornado missiles for those identified nonconforming SSCs. The licensee's process is consistent with the guidance in NEI 17-02, Rev. 1A, except as indicated in Section 3.9, "Deviations from the TMRE Methodology," of this safety evaluation, and under the limits in Section 3.10, "Scope and Limitations of Application of the TMRE Methodology," of this safety evaluation. Specifically, the NRC staff has found that the licensee's risk evaluation:

• Is based on an acceptable internal events PRA which has been subjected to a peer review process assessed against the PRA standard and is based on a TMRE PRA that has been acceptably developed;

• Determines tornado missile risk of nonconforming SSCs that results in an integrated, systematic process that reasonably reflects the current plant configuration and operating practices, and applicable plant and industry operational experience;

• Maintains defense-in-depth and safety margins;

• Includes evaluations that provide reasonable confidence that the risk of nonconforming tornado missile protection is maintained and that any potential increases in CDF and LERF resulting from uncertainty in treatment are small; and

• Includes provisions for future sensitivity studies and the periodic reviews of the tornado missile risk of nonconforming SSCs to ensure the risk remains acceptably low.

Therefore, the NRC staff concludes that the licensee's process and evaluation demonstrates that the tornado missile risk from nonconforming SSCs is acceptably low as it meets the risk acceptance guidelines of RG 1.174.

The licensee's results for tornado missile risk demonstrates that these nonconforming conditions should not prevent the availability of necessary SSCs to mitigate the potential effects of extreme winds and missiles associated with such winds on plant SSCs. Based on its review

summarized in this safety evaluation, the NRC staff finds the SSCs identified in the submittal that do not currently conform to the tornado missile protection licensing basis can remain in as-built conditions. Further, the licensee has demonstrated that those necessary SSCs important to safety will be capable of performing their safety functions during and following a tornado.

3.9 Deviations from the TMRE Methodology Several issues, which were addressed acceptably by the licensee, resulted in deviations from the guidance in NEI 17-02, Rev. 1A. The NRC staff notes that the licensee's approaches in addressing the following issues, which constitute deviations from the corresponding approaches in NEI 17-02, Rev. 1A were important to the NRC staff's safety decision for this application and apply to the future use of the TMRE methodology at VEGP Units 1 and 2, specifically:

• The licensee provided results of analyses using the alternative average MIP values determined by excluding the containment building (i.e., Target 1) of the EPRI NP-768 Plant A to calculate the EEFP and demonstrated insignificant impact of the exclusion of Target 1 on this application.

• While Section 3.3, "Ex-Control Room Action Feasibility," of NEI 17-02, Rev. 1A recommends only a feasibility evaluation, the licensee performed a more detailed evaluation of operator actions performed after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the occurrence of the tornado that are outside Category I structures or require transit outside Category I structures to reach the location of the action. The licensee also assumed failure of operator actions that were affected by timing and environmental conditions.

• As the licensee did not use the qualitative factors in Section 7.2.1, "TMRE Missile Distribution Sensitivity," of NEI 17-02, Rev. 1A to justify not applying a higher target-specific MIP, the NRC staff did not review the acceptability of those factors as part of this application. Therefore, use of the qualitative factors is not considered as part of the TMRE approval for VEGP Units 1 and 2.

• Guidance in RG 1.174, Revision 2 for submission of risk-informed applications discusses the importance of representing the as-built, as-operated plant. Although not explicitly addressed in the TMRE methodology, the NRC staff finds that the total risk, from the determination that certain SSCs are not required to be protected, needs to be addressed in future risk-informed site-specific applications for amendments.

3.10 Scope and Limitations of Application of the TMRE Methodology As discussed above, Section 8.3 of NEI 17-02, Rev. 1A cannot be used by VEGP Units 1 and 2.

Section 3.4, "Technical Evaluation Conclusion," of Enclosure 1 to the submittal states that the TMRE methodology could be used to resolve those nonconforming conditions by revising the current CLB under 10 CFR 50.59, "Changes, tests and experiments," provided the acceptance criteria are satisfied and conditions stipulated by the NRC staff in the safety evaluation approving the requested amendment are met. The plant-specific approved methodology can only be applied when legacy conditions are discovered where tornado missile protection was required and not provided. The methodology cannot be used either to remove existing tornado missile protection or to avoid providing tornado missile protection in the plant modification

process. Therefore, future changes to the facility requiring physical tornado missile protection must not be evaluated using the TMRE methodology.

As discussed in Section 8.2 of NEI 17-02, Rev. 1A, the licensee will need prior NRC approval should the ~CDF and ~LERF values during subsequent implementation by the licensee for legacy nonconforming SSCs, or any of the required sensitivity studies in NEI 17-02, Rev. 1A exceed the acceptance guidelines for Region Ill ("very small change") of RG 1.174, if the apparent change in risk cannot be reduced with refinements within the scope of the approved VEGP TMRE methodology.

The NRC staff notes that all proposed changes not within the scope of this plant-specific approved methodology as described in this safety evaluation are expected to be reviewed consistent with the criteria in 10 CFR 50.59, another governing change process identified in 10 CFR or the VEGP licensing basis. With the exception of omitting protection for new configurations and removing existing protection, nonconforming conditions are allowed to be evaluated using the VEGP TMRE methodology and should the results meet the defined TMRE acceptance criteria, additional prior NRC approval is not required to be sought, nor reviewed in accordance with 10 CFR 50.59. However, such changes are still required to be reported under the appropriate reporting requirements in accordance with the applicable sections of 10 CFR 50.

Additionally, it should be noted that the review of NEI 17-02, Rev. 1A reflects a review by the NRC staff of the applicability to and implementation of TMRE methodology for VEGP Units 1 and 2 only.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Georgia State official was notified of the proposed issuance of the amendments on December 14, 2018. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change a requirement with respect to the installation or use of facility components located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding (83 FR 13150; March 27, 2018). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the

amendments will not be inimical to the common defense and security or to the health and safety of the public.

7.0 REFERENCES

1. Hutto, J.J., Southern Nuclear Operating Company, Inc., letter to U.S. Nuclear Regulatory Commission, "Vogtle Electric Generating Plant Units 1 and 2, License Amendment Request for Approval to Utilize the Tornado Missile Risk Evaluator (TMRE) to Analyze Tornado Missile Protection Non-Conformances," dated October 11, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17284A348).

2. Gayheart, Cheryl A., Southern Nuclear Operating Company, Inc., letter to U.S. Nuclear Regulatory Commission, "Vogtle Electric Generating Plant - Unit 1 and 2, Tornado Missile Risk Evaluator, SNC Response to NRC Request for Additional Information,"

dated July 26, 2018; includes NEI 17-02, Rev. 1A, "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," July 2018 (ADAMS Accession No. ML18207A876).

3. Gayheart, Cheryl A., Southern Nuclear Operating Company, Inc., letter to U.S. Nuclear Regulatory Commission, "Vogtle Electric Generating Plant - Unit 1 and 2, Tornado Missile Risk Evaluator, SNC Supplemental Response to NRC Request for Additional Information," dated September 14, 2018 (ADAMS Accession No. ML18260A053).

4. Brock, Kathryn M., U.S. Nuclear Regulatory Commission, letter to Cheryl A. Gayheart, Southern Nuclear Operating Company, Inc., "Vogtle Electric Generating Plant, Units 1 and 2 - Review of Response to Request for Additional Information Re: License Amendment Request for Approval to Utilize the Tornado Missile Risk Evaluator to Analyze Tornado Missile Protection Non-Conformances (EPID L-2017-LLA-0350), dated August 30, 2018 (ADAMS Accession No. ML18236A445).

5. U.S. Nuclear Regulatory Commission, Regulatory Issue Summary 2015-06, "Tornado Missile Protection," dated June 10, 2015 (ADAMS Accession No. ML15020A419).

6. Nuclear Energy Institute, NEI 17-02, Rev. 1, "Tornado Missile Risk Evaluator (TMRE)

Industry Guidance Document," dated September 21, 2017 (ADAMS Accession No. ML17268A036).

7. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.76, Revision 1, "Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants," March 2007 (ADAMS Accession No. ML070360253).

8. NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," Section 3.5.1.4, Revision 3, "Missiles Generated by Tornadoes and Extreme Winds," March 2007 (ADAMS Accession No. ML070380174).

9. NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," Section 3.5.2, Revision 3, "Structures, Systems, and Components to be Protected From Externally-Generated Missiles," March 2007 (ADAMS Accession No. ML070460362).

10. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.117, Revision 2, "Protection Against Extreme Wind Events and Missiles for Nuclear Power Plants," July 2016 (ADAMS Accession No. ML15356A213).

11. NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," Section 19.1, Revision 3, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load," September 2012 (ADAMS Accession No. ML12193A107).

12. NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," Section 19.2, Revision 0, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis:

General Guidance," June 2007 (ADAMS Accession No. ML071700658).

13. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," May 2011 (ADAMS Accession No. ML100910006).

14. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," March 2009 (ADAMS Accession No. ML090410014).

15. American Society for Mechanical Engineers/American Nuclear Society, ASME/ANS RA-Sa-2009, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications," Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

16. U.S. Nuclear Regulatory Commission, NUREG/CR-4461, Rev. 2, "Tornado Climatology of the Contiguous United States," February 2007 (ADAMS Accession No. ML070810400).

17. U.S. Atomic Energy Commission, WASH-1300, "Technical Basis for Interim Regional Tornado Criteria," May 1974 (ADAMS Accession No. ML13073A158).

18. Electric Power Research Institute, EPRI NP-768, "Tornado Missile Risk Analysis,"

May 1978.

19. Wermiel, J. S., memorandum to Public Document Room, U.S. Nuclear Regulatory Commission, "Electric Power Research Institute (EPRI Reports (EPRI N-768, 769, and 2005, Volumes 1 and 2) Concerning Tornado Missile Probabilistic Risk Assessment (PRA) Methodology and Corresponding Safety Evaluation Report," dated November 29, 1983 (ADAMS Legacy Accession No. 8312140192).

20. Electric Power Research Institute, EPRI NP-769, "Tornado Missile Risk Analysis Appendixes," May 1978.

21. Stringfellow, J., PWR Owners Group, letter to U.S. Nuclear Regulatory Commission, "Submittal of PWROG-14001-P/NP Revision 1, 'PRA Model for the Generation Ill Westinghouse Shutdown Seal,' PA-PMSC-0499R2," dated July 3, 2014 (ADAMS Accession Nos. ML14190A331 and ML14190A332).

22. Morey, Dennis C., U.S. Nuclear Regulatory Commission, letter to W. Anthony Nowinowski, PWR Owners Group, "Final Safety Evaluation for Pressurized Water Reactor Owners Group Topical Report PWROG-14001-P, Revision 1, 'PRA Model for the Generation Ill Westinghouse Shutdown Seal,"' dated August 23, 2017 (ADAMS Accession No. ML17200A116).

23. Pierce, Charles R., Southern Nuclear Operating Company, Inc., letter to U.S. Nuclear Regulatory Commission, "Vogtle Electric Generating Plant, Pilot 10 CFR 50.69 License Amendment Request, Response to Request for Additional Information," dated May 17, 2013 (ADAMS Accession No. ML13137A480).

24. Ajluni, Mark J., Southern Nuclear Operating Company, Inc., "Vogtle Electric Generating Plant, Pilot 10 CFR 50.69 License Amendment Request," dated August 31, 2012 (ADAMS Accession No. ML12248A035).

25. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, Revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," January 2007 (ADAMS Accession No. ML070240001 ).

26. Martin, Robert, U.S. Nuclear Regulatory Commission, letter to C. R. Pierce, Southern Nuclear Operating Company, Inc., "Vogtle Electric Generating Plant, Units 1 and 2 -

Issuance of Amendments Re: Use of 10 CFR 50.69 (TAC Nos. ME9472 and ME9473),"

dated December 17, 2014 (ADAMS Accession No. ML14237A034).

27. Berkow, Herbert N., U.S. Nuclear Regulatory Commission, letter to Robert H. Bryan, Westinghouse Owners Group, "Safety Evaluation of Topical Report WCAP-15603, Revision 1, 'WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs (TAC No. MB1714),"' dated May 20, 2003 (ADAMS Accession No. ML031400376).

28. Pensado, Osvaldo, Southwest Research Institute, "Analysis of Missile Impact Probability for Generic Tornado Hazard Assessment," dated July 29, 2016 (ADAMS Accession No. ML16223A954).

Principal Contributors: M. Reisi Fard S. Vasavada G. Curran Date: January 11, 201 9

ML18304A394 **safet evaluation memo dated *via email OFFICE NRR/DORL/LSPB/PM NRR/DORL/LSPB/LA NRR/DSS/SCPB/BC** NRR/DRA/APLB/BC**

NAME EBrown JBurkhardt SAnderson GCasto (MReisifard for)

DATE 12/21/18 1/10/19 9/28/18 9/28/18 OFFICE OGC (NLO}* NRR/DORL/LSPB/PM NRR/DORL/LPL2-1/BC NAME DRoth DBroaddus MMarkley DATE 12/19/18 1/10/19 1/11/19