ML18347A385

Issuance of Amendment No. 169, Revise Updated Final Safety Analysis Report to Incorporate Tornado Missile Risk Evaluator Methodology Into Licensing Basis

ML18347A385
Person / Time
Site:	Harris
Issue date:	03/29/2019
From:	Geoffrey Miller Special Projects and Process Branch
To:	Hamilton T Duke Energy Progress
Brown E
References
EPID L-2017-LLA-0355
Download: ML18347A385 (48)

Text

March 29, 2019 Ms. Tanya M. Hamilton Site Vice President Shearon Harris Nuclear Power Plant Duke Energy Progress, LLC 5413 Shearon Harris Road M/C HNP01 New Hill, NC 27562-0165

SUBJECT:

SHEARON HARRIS NUCLEAR POWER PLANT, UNIT 1 - ISSUANCE OF AMENDMENT TO UTILIZE THE TORNADO MISSILE RISK EVALUATOR TO ANALYZE TORNADO MISSILE PROTECTION NONCONFORMANCES (EPID L-2017-LLA-0355)

Dear Ms. Hamilton:

The U.S. Nuclear Regulatory Commission (NRC, the Commission) has issued the enclosed Amendment No. 169 to Renewed Facility Operating License No. NPF-63 for the Shearon Harris Nuclear Power Plant, Unit 1 (Harris). The amendment consists of changes to the Updated Final Safety Analysis Report (UFSAR) in response to your application dated October 19, 2017, as supplemented by letters dated January 11 and September 19, 2018 (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML17292B648, ML18011A911, and ML18262A328, respectively).

The amendment incorporates the Tornado Missile Risk Evaluator (TMRE) methodology into the Harris UFSAR. The approved methodology may be used to demonstrate whether an identified structure, system, and component is required to conform to the current licensing basis (CLB) requirements for protection against tornado missiles at Harris. The NRC staff notes that the TMRE methodology may only be applied to discovered conditions where tornado-missile protection was required by the plants CLB and not provided. Further, the NRCs approval of this license amendment is based, in part, on the NRC staffs review of specific items included in your application. Accordingly, the methodology approved for this amendment must not be used either to remove existing tornado-missile protection, or to avoid providing tornado-missile protection during reviews done in support of the plant modification process at Harris.

The methodology provided as Enclosure 3 to the licensees supplemental letter dated September 19, 2018 (Nuclear Energy Institute (NEI) 17-02, Revision (Rev.) 1B), was incorporated by reference into the licensees submittal, serves as an update to NEI 17-02, Rev. 1, and reflects all necessary updates and revisions to the TMRE methodology for use by Harris at this time. This final methodology document is intended to support future application of the TMRE methodology at Harris for identified nonconformances within the constraints identified in Sections 3.9 and 3.10 of the enclosed safety evaluation.

T. Hamilton Additionally, the NRCs approval of NEI 17-02, Rev. 1B reflects a review by the NRC staff of the licensees plant-specific request to implement the TMRE methodology for Harris Unit 1. The NRC staffs approval of the use of that methodology at Harris does not signify that the NRC staff is generically approving NEI 17-02, Rev. 1, or Rev. 1B.

A copy of the related Safety Evaluation is also enclosed. A notice of issuance will be included in the Commissions regular biweekly Federal Register notice.

Sincerely,

/RA/

G. Edward Miller, Project Manager Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-400

Enclosures:

1. Amendment No. 169 to NPF-63

2. Safety Evaluation cc: Listserv

ML18347A385 *via email OFFICE NRR/DORL/LSPB/PM NRR/DORL/LSPB/LA NRR/DSS/SCPB/BC NAME GEMiller JBurkhardt Sanderson*

DATE 3/29/19 1/29/19 2/11/19 OFFICE NRR/DRA/APLB/BC OGC NRR/DORL/LPL2-1/BC NAME GCasto* NLO as revised, S. Turk* MMarkley DATE 2/11/19 3/20/19 3/29/19

DUKE ENERGY PROGRESS, LLC DOCKET NO. 50-400 SHEARON HARRIS NUCLEAR POWER PLANT, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 169 Renewed License No. NPF-63

1. The U.S. Nuclear Regulatory Commission (NRC, the Commission) has found that:

A. The application for amendment by Duke Energy Progress, LLC (the licensee),

dated October 19, 2017, as supplemented by letters dated January 11 and September 19, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, by Amendment No. 169, Renewed Facility Operating License No. NPF-63 is amended to authorize revision to the Updated Final Safety Analysis Report (UFSAR),

as set forth in the application dated October 19, 2017, as supplemented by letters dated January 11 and September 19, 2018. The licensee shall update the UFSAR to incorporate the plant-specific tornado missile risk evaluator methodology as described in the licensees application dated October 19, 2017, as supplemented by letters dated January 11 and September 19, 2018, and the NRC staffs safety evaluation associated with this amendment, and shall submit the revised description authorized by this amendment with the next update of the UFSAR.

3. This license amendment is effective as of the date of its issuance and shall be implemented within 90 days of issuance. The UFSAR changes shall be implemented in the next periodic update to the UFSAR in accordance with 10 CFR 50.71(e).

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

Michael T. Markley, Chief Plant Licensing Branch II-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: March 29, 2019

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 169 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-63 DUKE ENERGY PROGRESS, LLC SHEARON HARRIS NUCLEAR POWER PLANT, UNIT 1 DOCKET NO. 50-400

1.0 INTRODUCTION

By application dated October 19, 2017 (Reference 1; the submittal), as supplemented by letters dated January 11 and September 19, 2018 (References 2 and 3, respectively), Duke Energy Progress, LLC (the licensee), submitted a license amendment request (LAR) to incorporate the Tornado Missile Risk Evaluator (TMRE) methodology into the Shearon Harris Nuclear Power Plant, Unit 1 (Harris), Updated Final Safety Analysis Report (UFSAR), Amendment 61.

The supplemental letters dated January 11 and September 19, 2018, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the U.S. Nuclear Regulatory Commission (NRC) staffs original determination of no significant hazards consideration published in the Federal Register on February 13, 2018 (83 FR 6221).

1.1 Purpose of Proposed Change The NRC issued Regulatory Issue Summary (RIS) 2015-06, Tornado Missile Protection, on June 10, 2015 (Reference 4), to (1) remind licensees of the need to conform their facility to the current, site-specific licensing basis for tornado-generated missile protection, (2) provide examples of failures to conform with a plants tornado-generated missile licensing basis, and (3) remind licensees of the NRC staffs position that systematic evaluation program or individual plant examination of external events results do not constitute regulatory requirements, and are not part of the plant-specific tornado-generated missile licensing basis, unless the NRC or licensee took action to specifically amend the licensing basis.

In response to RIS 2015-06, the licensee performed walkdowns at Harris to identify potential vulnerabilities within the current licensing basis (CLB) for tornado-missile protection.

Specifically, the licensee identified plant configurations in which structures, systems, and components (SSCs) should have been protected from tornado-generated missiles based on the Enclosure 2

CLB, although they did comply with NRC regulations. These nonconforming conditions were identified on various SSCs including:

the turbine-driven auxiliary feedwater pump exhaust pipe; diesel fuel oil supply line train A to the day tank in the diesel generator building; electrical conduits in the diesel generator building (three locations);

inverted-neck vent lines on the diesel generator building roof; emergency diesel generator fuel oil return lines (trains A and B);

electrical conduits in the emergency service water system (three locations);

emergency service water traveling screens; battery room ventilation exhaust plenums (two locations);

three valves in the main steam system; main steam safety relief valve vent pipes/stacks and the main steam power operated relief valve vent pipes/stacks; electrical conduits in the main steam tunnel air intake pillboxes (two locations);

essential services chilled water system expansion tanks and connecting pipes (two locations);

reactor auxiliary building roof heating ventilation and air conditioning exhaust stack; reactor auxiliary building outdoor ambient air pressure sensing instrument tubing trains A and B; emergency service water intake structure outdoor air temperature elements and electrical conduit; fuel handling building ventilation outdoor ambient air pressure sensing instrument tubing; and diesel generator building ventilation outdoor air temperature elements.

The licensees request is to allow use of the TMRE methodology, which was developed by the Nuclear Energy Institute (NEI) to demonstrate that the risk associated with SSCs that do not conform to the CLB is acceptably low.

2.0 REGULATORY EVALUATION

2.1 Description of Proposed License Change The licensee proposed to change its licensing and design basis to incorporate the TMRE methodology to address identified nonconformances related to tornado-missile protection. The

TMRE is a risk-informed methodology, which is intended for application by Duke Energy Progress for Harris to resolve nonconforming conditions associated with the tornado-missile protection requirements of its CLB. On September 21, 2017, NEI submitted NEI 17-02, Revision 1, Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document (the TMRE methodology) (NEI 17-02, Rev. 1) (Reference 5), in support of three proposed pilot implementations of the methodology. NEI 17-02, Rev. 1 was intended to provide guidance for identifying and evaluating the safety significance associated with SSCs that are exposed to potential tornado-generated missiles, and guidance for resolving discrepancies against licensing basis requirements. In addition, it provides guidance for assessing the risk posed by tornado missiles to determine whether physical protection of the noncompliant SSCs is warranted. The methodology provided was in Enclosure 3 to the licensees supplement dated September 19, 2018 (NEI 17-02, Rev. 1B). Several aspects of the licensees TMRE methodology are similar to those in the methodology presented for NRC review by Southern Nuclear Operating Company, Inc. (SNC), for its Vogtle Electric Generating Station, Units 1 and 2 (Vogtle), which the NRC staff approved on January 11, 2019 (Reference 6). Therefore, several aspects of the licensees TMRE methodology are adopted from the methodology submitted by SNC in its July 26 and September 14, 2018, supplements (References 7 and 8, respectively; hereafter referred to as SNC responses). The licensees final methodology document, NEI 17-02, Rev. 1B, is intended to support application of the TMRE methodology at Harris for future identified nonconformances within the constraints identified in Sections 3.9 and 3.10 of this safety evaluation.

The submittal defined the proposed change in three parts. In the first part, the licensee identified those aspects of the plants licensing basis affected by the change including the Harris UFSAR. In the second part, the licensee identified all SSCs, procedures, and activities affected by the change. In the third part, the licensee identified the engineering studies, codes, probabilistic risk assessment (PRA) findings, and analysis results relevant to the proposed licensing change.

In Section 2.4 of the October 19, 2017, submittal, the licensee stated that it was requesting NRC approval of the revision to UFSAR Section 3.5.1.4, Missiles Generated by Natural Phenomena. UFSAR Table 3.5.1-2 would be revised to reflect the ability to use TMRE for discovered conditions, and to reference the addition of Table 3.5.1-2a. The addition of Table 3.5.1-2a incorporates the identified nonconforming SSCs that will not need tornado-missile protection based on implementation of the TMRE methodology for Harris.

2.2 Tornado-Missile Protection Licensing Basis Harris was designed to meet the General Design Criteria (GDC) in Appendix A, General Design Criteria for Nuclear Power Plants, to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, including GDC 2 (Design bases for protection against natural phenomena).

The CLB for tornado-missile protection is contained in Sections 3.5.1, Missile Protection Methods, and 3.5.2, Structures, Systems, and Components to be Protected from Externally Generated Missiles, of the Harris UFSAR. The licensing basis for tornado-missile protection, described in UFSAR Sections 3.1.2 and 3.1.4, states, in part:

Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena. . . without loss of capability to perform their safety functions. . . . Structures, systems, and components essential to the safe shutdown of the plant are designed to withstand the effects of the most severe natural phenomena, including floods, hurricanes, tornadoes or the SSE [safe-shutdown earthquake], as appropriate.

Structures, systems, and components are designed, arranged, or protected such that the external missiles will not cause an accident which could result in the release of significant amounts of radioactivity or prevent safe plant shutdown.

The SSCs important to safety are designed either to withstand the effects of natural phenomena without loss of the capability to perform their safety functions or are designed such that upon response or failure they will be in a safe condition. In accordance with NRC regulations and the plants principal design criteria (PDC), SSCs vital to the shutdown capability of the reactor are designed to withstand the maximum probable natural phenomena at the site, determined from recorded data for the site vicinity, with appropriate margin to account for uncertainties in historical data. Appropriate combinations of structural loadings from normal, accident, and natural phenomena are considered in the plant design.

The credible missiles at Harris created by natural phenomena are those generated by tornadoes. The design parameters applicable to the design basis tornado are for NRC tornado intensity Region I, per RG 1.76, and are found in UFSAR Section 2.3, Meteorology. Seismic Category I structures, housing safety-related equipment, systems, and components are designed to withstand the effects due to the design-basis tornado. Section 1.8, Conformance to NRC Regulatory Guides, of the UFSAR discusses the licensees conformance to regulatory guides related to tornado protection.

The typical method used to meet the GDC is to provide positive (i.e., physical) protection features such as locating required equipment in structures designed for tornado missiles and providing barriers designed for tornado missiles, however, it is also possible to use other approaches (e.g., a risk-informed approach) to determine compliance with the GDC by considering the safety significance of damage from a missile strike to the equipment under consideration. The licensee requested a change to Harris licensing bases to allow not protecting the identified nonconforming SSCs from tornado missiles using a risk-informed approach.

2.3 Applicable Requirements General Design Criterion 2, Design bases for protection against natural phenomena, in Appendix A of 10 CFR Part 50 establishes requirements regarding the ability of SSCs important to safety to withstand the effects of natural phenomena without the loss of capability to perform their safety functions. Protection from the missile spectrum set forth in Regulatory Guide (RG) 1.76, Revision 1, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, issued March 2007 (Reference 9), provides assurance that necessary SSCs will be available to perform their safety functions during and following a tornado.

General Design Criterion 4, Environmental and dynamic effects design bases, establishes requirements regarding the ability of SSCs important to safety to be protected from dynamic effects, including the effects of missiles, from events and conditions outside the nuclear power unit. Protection from a spectrum of missiles with the critical characteristics set forth in RG 1.76 provides assurance that the necessary SSCs will be available to mitigate the potential effects of extreme winds and missiles associated with such winds on plant SSCs important to safety.

2.4 Applicable Regulatory Guidance and Review Plans Section 3.5.1.4, Revision 4, Missiles Generated by Extreme Winds, issued March 2015, and Section 3.5.2, Revision 3, Structures, Systems, and Components to be Protected from Externally-Generated Missiles, issued March 2007, of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants (SRP) (References 10 and 11, respectively), contain the current acceptance criteria governing tornado-missile protection.

These criteria generally specify that SSCs that are important to safety be provided with sufficient, positive tornado-missile protection (i.e., barriers) to withstand the maximum credible tornado threat. As discussed in Section 3.0 below, the appendix to Regulatory Guide (RG) 1.117, Revision 2, Protection against Extreme Wind Events and Missiles for Nuclear Power Plants, issued July 2016 (Reference 12), lists the types of SSCs that should be protected from design-basis tornadoes. Further, as discussed in Section 3.3 below, in addition to physical design methods, the NRC allows the use of probabilistic analysis to demonstrate that the probability of a tornado-generated missile striking safety-related equipment is sufficiently low such that no additional protective measures are required.

Regulatory Guide 1.174, Revision 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, issued May 2011 (Reference 13), describes an acceptable approach for developing risk-informed applications for a licensing basis change that considers engineering issues and applies risk insights. It provides general guidance concerning analysis of the risk associated with proposed changes in plant design and operation.

Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, issued March 2009 (Reference 14), describes an acceptable approach for determining whether the PRA, in total or the parts that are used to support an application, is acceptable for use in regulatory decisionmaking for light-water reactors.

Regulatory Guide 1.76, Revision 1, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, issued March 2007, provides a method to define design-basis tornado and design-basis tornado-generated missiles that a nuclear power plant should be designed to withstand to prevent undue risk to the health and safety of the public.

Regulatory Guide 1.117, Revision 2, provides an approach for identifying those SSCs of light-water-cooled reactors that should be protected from the effects of the worst case extreme winds (tornadoes and hurricanes) and wind-generated missiles, such that they remain functional.

Section 19.1, Revision 3, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load, of NUREG-0800, issued September 2012 (Reference 15), provides the NRC staff with guidance for evaluating the acceptability of a licensees PRA results when used to request risk-informed changes to the licensing basis.

Section 19.2, Revision 0, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, of NUREG-0800, issued June 2007 (Reference 16), provides the NRC staff with guidance for evaluating the risk information used by a licensee to support permanent risk-informed changes to the licensing basis.

The American Society for Mechanical Engineers/American Nuclear Society (ASME/ANS) RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, issued February 2009 (Reference 17), is referenced and endorsed in support of RG 1.200. This industrial standard sets forth requirements for PRAs used to support risk-informed decisionmaking for commercial nuclear power plants and describes a method for applying these requirements for specific applications.

The guidance in NUREG/CR-4461, Revision 2, Tornado Climatology of the Contiguous United States February 2007 (Reference 18), examines the implications of switching from the Fujita Scale to the Enhanced Fujita (EF) Scale on design wind speed estimates for tornadoes.

Existing current NRC guidance on tornado characteristics for consideration in the design of nuclear power plants is found in Regulatory Guide 1.76 (AEC 1974). This guidance is based on a summary of information from a variety of sources called WASH-1300, Technical Basis for Interim Regional Tornado Criteria," May 1974 (Reference 19). The initial version of NUREG/CR-4461 summarized data on tornadoes that occurred from January 1954 through December 1983 and were listed in a tornado database maintained by the National Severe Storms Forecast Center. Revision 1 of NUREG/CR-4461 updates the 1986 report using tornado data collected from January 1, 1950, through August 2003. It contains statistics on tornado dimensions and wind speeds by region of the country, and estimates of strike probabilities and design wind speeds by boxes with sides of 1 degree, 2 degree, and 4 degree of latitude and longitude.

The TMRE methodology uses data and examples from the Electric Power Research Institute (EPRI) topical report EPRI NP-768, Tornado Missile Risk Analysis," May 1978 (Reference 20),

to determine the number of hits per targets. These values are used in support of determining the missile impact parameter (MIP). In a memorandum dated November 29, 1983 (Reference 21), the NRC concluded that the EPRI methodology contained in EPRI NP-768 and EPRI NP-769, Tornado Missile Risk Analysis Appendixes, issued May 1978 (Reference 22),

can be utilized when assessing the need for positive tornado protection for specific safety-related plant features.

3.0 TECHNICAL EVALUATION

In its October 19, 2017, submittal, the licensee described the tornado-missile risk evaluation performed at Harris to demonstrate the acceptability of the risk associated with SSCs that do not conform to the plants current design and licensing bases for protection against tornado missiles. The NRC staffs review focused on (1) evaluating the acceptability of the NEI guidance process, as used by the licensee, for assessing the risk of SSCs that do not conform to the plant-specific licensing basis related to tornado-missile protection; (2) validating the acceptability of the licensees PRA for use in the pilot implementation of the methodology; (3) confirming that the risk associated with not physically protecting the identified nonconforming SSCs according to the tornado-missile protection licensing basis is sufficiently small; and (4) confirming that the proposed change ensures that SSCs important to safety are designed to withstand the effects of tornadoes without loss of capability to perform their safety functions, and that their design reflects the importance of the safety functions to be performed.

3.1 Tornado Missile Risk Evaluation Methodology As described in the submittal dated October 19, 2017, the licensees evaluation of risk associated with tornado-missile nonconforming conditions used the Harris internal events PRA model to develop the TMRE PRA model. The TMRE PRA model included targets that were vulnerable to tornadoes and tornado-generated missiles and considered generic or site-specific information related to tornado-generated missiles (i.e., number and types of tornado-generated missiles), tornado-initiating event frequencies, parameters that relate the likelihood of a missile striking a target based on the tornado intensity, and characteristics of targets.

3.1.1 Identification of Vulnerable SSCs Sections 3.1, Vulnerable SSC Walkdown Preparation, and 3.2, Vulnerable SSC Walkdown, of NEI 17-02, Rev. 1, describe the preparations and walkdown for vulnerable SSCs. According to the guidance, the walkdowns were used (1) to review previously identified nonconforming SSCs, (2) to collect and verify any data needed for the TMRE model, and (3) to locate and evaluate unprotected SSCs credited in the TMRE PRA model.

The licensee used walkdowns to gather physical data associated with known vulnerable and nonconforming SSCs and to identify other SSCs modeled in the internal events PRA that are not protected from tornadoes and tornado missiles. Sections 3.3.1, High Winds Equipment List and 3.3.2, Target Walkdowns, of the enclosure to the October 19, 2017, submittal described the licensees process for SSC (target) identification. Consistent with NEI 17-02, Rev. 1, specific configurations of interest observed during the walkdowns include:

Active (e.g., pumps or compressors) or passive (e.g., tanks, piping) components that were directly exposed to tornado winds whether inside or outside Components inside non-Category I structures Components adjacent to non-Category I structures Components subject to failure, due to secondary effects The licensees process included development of a high winds equipment list (HWEL), which incorporated unprotected SSCs that were modeled in their internal events PRA and their locations. Section 3.1 of NEI 17-02, Rev. 1, provides recommendations on the development of the HWEL. Section 3.3.1 and 3.3.2 of the enclosure to the submittal provided details about the licensees implementation of the guidance to develop its site-specific HWEL and perform walkdowns supporting the development of its TMRE PRA model.

The NEI guidance recommends refinement of the HWEL using certain screening criteria, including:

Screening out SSCs that were located inside Category I structures and that were located away from vulnerable openings or features such as ventilation louvers and roll-up doors, and

Screening out SSCs that were dependent on offsite power because the TMRE methodology assumed there would be a non-recoverable loss of offsite power (LOOP) due to the tornado event.1 The licensee stated in Section 3.3.1 of the enclosure to the October 19, 2017, submittal that the items screened from inclusion in the HWEL based on their being in Category I structures, were reviewed for the presence of potential missile paths. The NRC staff requested justification for using the selected area as the screening criterion, for the application of the screening criterion (e.g., single penetration area and/or combined penetration area) and for excluding "de minimis" penetrations from the risk analysis had not been justified sufficiently. In its supplement dated January 11, 2018, the licensee clarified that three penetrations at the A emergency service water intake structure had been screened out of the TMRE evaluation based on the combined area of the penetrations (i.e., using the de minimis approach). The licensee also cited the sensitivity analysis performed in Section 3.3.9.2, De Minimis Penetration Sensitivity, of the enclosure to the submittal, which demonstrated a negligible impact of adding the targets screened out using the de minimis approach back into the TMRE model. The licensee further clarified that such a screening criterion was withdrawn from its TMRE methodology and would not be applied for future implementation of the licensees TMRE methodology. The NRC staff notes that the penetration-area-based screening approach is no longer included in the TMRE methodology now described in NEI 17-02, Rev. 1B. Further, the September 19, 2018, supplement provided the revised results from the licensees TMRE model that did not screen out any SSCs based on the area of the penetrations. Given that (1) the licensee has not nor will it in the future use any criterion to screen out SSCs for its TMRE PRA model based on the area of penetrations; (2) the licensee has provided results without screening out any SSCs based on the area of the penetrations, and (3) Category I structures were required to be designed to withstand the effects of tornado missiles, the NRC staff finds that the licensees approach for screening SSCs in Category I structures acceptable.

3.1.2 Failure Modes The TMRE guidance includes consideration of secondary failure modes in Section 3.2.3, SSC Failure Modes. It states that flooding and combustion motor intake effects caused by tornado-missile failures of fluid-filled tanks and pipes should be considered as viable secondary failure modes considered in the development of the TMRE PRA. The NRC staff noted that the submittal did not sufficiently describe how secondary effects that may result from failure of nonconforming conditions were considered for identification of the initiating events and failure modes in the licensees TMRE development. In its supplement dated September 19, 2018, the licensee described that Harris considered secondary effects from tornado-missile strikes on nonconforming conditions during walkdowns. Specifically, the licensee considered effects of flooding from nonconforming tanks or pipes as well as potential combustion motor intake effects such as the loss of oxygen due to nonconforming gas tank rupture or exhaust redirection. The licensee concluded that the possibility of a secondary failure as a result of a tornado-missile strike to a nonconforming SSC did not exist for Harris.

The NRC staff finds the licensees approach for considering secondary failures acceptable, because the licensee (1) considered the most important secondary failure modes for nonconforming SSCs, (2) adequately captured the impact of such failures on both the 1 The NRC staff notes that acronym for loss of offsite power is referred to as LOSP at Harris. This safety evaluation will refer to the event as LOOP for ease of comparison.

nonconforming SSCs as well as other SSCs in the TMRE PRA model, and (3) considered the most important secondary failure modes in its walkdown supporting its TMRE PRA model development.

3.1.3 Characterization of Tornado-Generated Missiles Tornado-generated missiles are defined in RG 1.76, Revision 1, as objects moving under the action of the aerodynamic forces induced by the tornado wind. Wind velocities in excess of 75 miles per hour (mph) are capable of generating missiles from objects lying within the path of the tornado wind and from the debris of nearby damaged structures.

Section 3.4, Tornado Missile Identification and Classification, of NEI 17-02, Rev. 1B provides guidance on the expertise needed to perform a tornado missile walkdown, which includes the ability to verify the total number of missiles through a TMRE walkdown for nonstructural and structural missiles, and consider the potential for nonpermanent missiles (such as those present only during outages and construction periods).

Section 3.4.1, Tornado Missile Walkdown Personnel, of NEI 17-02, Rev. 1, provides expectations on the qualifications of personnel performing the tornado-missile inventory walkdown to support the TMRE PRA development. The qualification expectations do not require specialized engineering or PRA expertise or knowledge, and structural engineering experience is not required. The personnel only need to be trained on the methods for identifying and counting potential missiles. This section and Section 4.3 of EPRI 3002008092

["Process for High Winds Walkdown and Vulnerability Assessments at Nuclear Power Plants"]

provide adequate information to support training Tornado Missile Walkdown personnel.

Based on plant personnels familiarity with plant layout and drawings allowing the personnel to properly define the missiles and classify/group missiles accordingly, the NRC staff finds the means used to qualify walkdown personnel at Harris acceptable.

3.1.3.1 Structural and Nonstructural Missiles Structural missile counts should include, as a minimum, buildings that are expected to experience tornado and tornado-missile failure, such as warehouses, trailers, and other marginally engineered buildings. These buildings typically will not withstand tornado winds greater than about 100 mph and their destruction would generate additional missiles that should be accounted for in the TMRE. Section 3.4.4, Structural Missiles, and Section C.4, Debris from Damaged Structures, of Appendix C, Bases for Target Robustness and Missile Characteristics, of NEI 17-02, Rev. 1 contain guidance, including lists showing the type and size of a few structures, for determining the number of missiles generated by building deconstruction. The guidance for building deconstruction was based on typical construction practices and an assumption of a moderately stacked warehouse, which was confirmed as part of the guidance via a walkdown of a warehouse at a nuclear power plant. The NRC staff finds the approach for determining the missile inventory from building deconstruction in NEI 17-02, Rev. 1, to be acceptable because (1) it considers different building types, (2) it is based on typical construction practices and representative warehouse inventory, and (3) the approach conservatively assumes that the entire building deconstructs resulting in its construction constituents as well as the inventory within being available as missiles. Section C.4 also includes an example evaluation of the guidance to determine the number of missiles from building deconstruction. Because of the availability of guidance as well as an example for the implementation of the guidance to determine missile inventory from building deconstruction, the

NRC staff finds that extensive structural engineering experience is not deemed necessary for personnel performing the tornado-missile inventory walkdown.

In the supplement dated September 19, 2018, the licensee explained how it considered building contents (i.e., materials that are not part of the building itself but are available to become missiles if the building is hit) as part of the missile walkdown. The licensee stated that it performed walkdowns to survey the overall estimate of nonstructural missiles within buildings.

The licensee further stated that counts of the actual missile inventories and the missile numbers developed from the NEI 17-02, Rev. 1 methodology were conservatively summed for the site missile count. The NRC staff finds the licensees approach for determining the number of missiles resulting from the deconstruction of buildings to be acceptable for this application, because summing the numbers of missiles surveyed in the buildings with the numbers in NEI 17-02, Rev. 1 provides a conservative estimate of that component of the total missile inventory and is, therefore, acceptable.

Section 3.4.2, Non-Structural Missile Inventory, of NEI 17-02, Rev. 1, provides guidance on the process for counting nonstructural missile inventory to verify bounding values of plant nonstructural missiles. Due to the large diversity of objects to consider in the missile count, the NEI guidance recommends grouping missiles of similar size and type into various zones around plant. While not all-inclusive, Table 3-2, Potential Tornado Missile Type, of NEI 17-02, Rev. 1, provides examples of missiles to consider while performing a walkdown. Missile inventory was counted from the missile survey out to 2,500 feet (ft) from the reference point. The NRC staff noted that the 2,500 ft missile source distance is a typical value used to support site-specific tornado-missile count for applications and was derived from a case study discussed in Section 2.3.3, Off-Site Missile Assessment, of EPRI NP-769, Tornado Missile Risk Analysis Appendixes. For nonstructural missile count, the NRC staff finds counting missiles to a distance of approximately 2,500 ft is acceptable, because it is consistent with typical counting practice and the EPRI studies used as the basis for the TMRE methodology. The TMRE guidance also states that in the case of targets greater than 1,500 ft from the reference point, a qualitative evaluation of the missile inventory within 2,500 ft of the outlying targets should be performed. Therefore, the NRC staff finds the licensees approach for considering missiles around targets that are farther (up to 2,500 ft) from the reference point, acceptable.

The NRC staff finds the approach for determining the missile inventory from building deconstruction in NEI 17-02, Rev. 1 to be acceptable for Harris, because the approach (1) considers different building types, (2) is based on typical construction practices and representative warehouse inventory, and (3) conservatively assumes that the entire building deconstructs resulting in its construction constituents as well as the inventory within being available as missiles.

3.1.3.2 Non-Permanent Missiles - Construction and Outage-Related Section 3.4.3, Non-Permanent Missiles, of NEI 17-02, Rev. 1, provides guidance on the consideration of nonpermanent missiles, such as those present only during outages and construction periods. This section of NEI guidance states that it is not necessary to explicitly account for the additional outage-related missiles in the TMRE missile inventory. The guidance further states that outages are of relatively short duration compared to the operational time at a nuclear power plant. The NRC staff notes, however, that the duration of outages or other temporary activities that involve bringing additional equipment to the sites may be relatively long. Accordingly, the NRC staff sought further clarification from the licensee regarding this issue, as discussed below.

For Harris, the licensee used the generic missile count from NEI 17-02, Rev. 1, of 240,000 missiles for its TMRE analysis. The NRC staff requested that the licensee clarify whether Harris outage-related missiles were considered in the total number of missiles used for Harris TMRE implementation or were considered in estimating the total number of missiles. In the supplement dated September 19, 2018, the licensee stated that Section 3.4.3 of NEI 17-02, Rev. 1 was revised in NEI 17-02, Rev. 1B. Section 3.4.3 of NEI 17-02, Rev. 1B states that many outage-related missiles, if not staged during the walkdowns, would be counted as part of laydown areas or included in warehouse inventory, because most equipment used during outages was stored elsewhere on site during non-outage times. Further, the revised section states that sites that develop a missile count less than 240,000 have margin in their missile count that can account for potential increases in missile counts during outage preparation and staging. The licensee further stated that it did not estimate the impact of outages on the missile inventory, but in the future, the missile inventory will be monitored to ensure that changes due to outages will be managed in accordance with NEI 17-02, Rev. 1.

The NRC staff concludes that the licensees approach for considering outage-related missiles is acceptable for this application because outage-related missiles were included in the licensees missile inventory estimate as part of warehouse inventory, and the licensees actual missile count was appreciably lower than the generic missile count in NEI 17-02, Rev. 1 that was used by the licensee for its analysis, which provides indirect consideration of outage related missiles.

The NRC staff also finds that many outage-related missiles are generally included in the warehouse inventory during missile inventory walkdowns. As such, sites that develop a missile count less than 240,000 have margin in their missile count that can account for potential increases in missile counts during outage preparation and staging. As a result of this conservatism, the NRC staff finds the NEI guidance for considering missiles associated with outages acceptable and additional consideration of those missiles during walkdowns is not necessary for future implementation of the TMRE methodology at Harris, in accordance with NEI 17-02, Rev. 1.

The NRC staff questioned the approach that will be used in future implementation of the Harris TMRE methodology to classify construction-related missiles as temporary missiles. In the supplement dated September 19, 2018, the licensee stated that Sections 3.4.3 and 7.4, Missile Margin Assessment, of NEI 17-02, Rev. 1 had been revised in NEI 17-02, Rev. 1B to clarify how the impact of nonpermanent construction missiles would be addressed. Section 3.4.3 of NEI 17-02, Rev. 1B, provides guidance for consideration of missiles during the period of construction at a licensees site. The guidance differentiates between missiles during the construction period as permanent post-construction missiles and nonpermanent construction missiles. The permanent post-construction missiles are those that will be present at the site (e.g., through their incorporation in building construction) post-construction. The guidance recommends estimation of the expected missile inventory for the post-construction site, using walkdown results for the non-construction areas, information in Sections 3.4.2 and 3.4.4 of NEI 17-02, Rev. 1B, along with design and construction information and documentation of the basis and assumptions used for the estimation. According to the guidance, if the sum of the missiles currently present at the site and the estimate of permanent post-construction missiles is greater than the generic estimate used in the TMRE methodology, then a site-specific bounding value should be developed, documented, and used.

Section 7.4 of NEI 17-02, Rev. 1B provides guidance for evaluation of the impact of additional nonpermanent construction-related missiles. The section states that if a proposed construction activity would cause the site missile inventory to increase above the missile count used in the

TMRE analysis, it would need to be assessed to determine whether the assessment meets the risk metric thresholds in NEI 17-02, Rev. 1. As discussed in the licensees September 19, 2018, supplement, if the risk metric is not met, the licensee would obtain NRC approval prior to utilizing the TMRE methodology.

For Harris, the site missile inventory is bounded by the generic assumptions of NEI 17-02, Rev. 1B. In the future, as discussed in the licensees September 19, 2018, supplement, should the result of a proposed change exceed the missile estimates based on those assumptions, implementation of the methodology using the other approach discussed in NEI 17-02 will need to be submitted to the NRC for review and approval. Given that Harris has demonstrated that construction and outage missiles are adequately represented in the conservative assumption of 240,000 missiles, the NRC staff finds the licensees approach for the treatment of nonpermanent construction missiles at Harris to be acceptable, limited to the scope of this LAR.

3.1.3.3 Missile Inventory Values and Consideration of SSC Robustness The generic total number of missiles used in NEI 17-02, Rev. 1 is 240,000. Section 5.1, Missile Impact Parameter (MIP), of NEI 17-02, Rev. 1, provides guidance on generic missile inventory values for different tornado intensities unless the site-specific missile inventory is not bounded by 240,000 missiles. The licensee described, in Section 3.3.3, Missile Walkdowns, of the enclosure to the submittal that walkdowns were used to perform a missile count and establish that the number of missiles on the site was bounded by the generic number of missiles used in the TMRE methodology.

Consistent with the guidance in Section 3.4 of NEI 17-02, Rev. 1, the licensee counted missiles in a 2,500 ft radius around a point central to the Harris containment structures. As discussed in Section 3.1.3.1 of this safety evaluation, the NRC staff evaluated the licensees analysis, including its description of the plant areas that were included in its survey, and finds the licensee covered an acceptable area of the plant for counting tornado missiles.

The number of missiles for each tornado category were provided in Table 5-1, MIP Values and Missile Inventories for Use in the TMRE, of NEI 17-02, Rev. 1, with the expectation that the values would be bounding for most sites. The total number of missiles for each licensee required verification through a TMRE walkdown, to ensure that the missile inventories provided in NEI 17-02, Rev. 1 were appropriate and bounding for use in the plant-specific TMRE PRA model:

If the site walkdown confirmed that 240,000 was bounding for the site, then the missile count used for the TMRE PRA model was equal to the values provided in Table 5-1 of NEI 17-02, Rev. 1B, for targets not defined as robust. Robust target types were addressed separately, based on the type of missile and perspective impact on targets.

If the site walkdown determined that the total missiles at the site exceeded 240,000, the number of missiles used in the TMRE PRA model (for targets that are not robust), would be the total number of missiles counted on site, rounded up at least to the nearest 5,000 missiles.

As discussed in Section 3.3.3 of the enclosure to the submittal, walkdowns performed by the licensee determined that the generic missile count in the TMRE methodology was bounding.

Therefore, the licensee used the generic missile count in the TMRE methodology for its TMRE

analysis. The NRC staff finds the generic missile count of 240,000 to be reasonable, based on comparable missile counts estimated in previous TORMIS computer code submittals derived from similar 2,500 ft radius counts, and because the licensee verified that the TMRE generic missile count is bounding for the site. The NRC staff also finds the proposed approach to set increasing fractions for structural missiles as function of the tornado intensity, for different structure types, acceptable because the likelihood and extent of building deconstruction is expected to increase progressively with increasing tornado intensity.

Section 5, Evaluate Target and Missile Characteristics, of NEI 17-02, Rev. 1, includes guidance for the consideration of robust targets. Robust targets are those (e.g., steel pipes and tanks) that can be damaged by only certain types of missiles. Robust targets are subdivided into categories based on their characteristics such as the thickness of the steel or concrete used for the construction of the specific SSCs. In order to account for target robustness, NEI 17-02, Rev. 1, provides a certain fraction of the total missile inventory to be used in calculation of the exposed equipment failure probability (EEFP) for that target, depending on the targets category of robustness.

Originally, nine categories of robust targets were defined in Table 5-2, Missile Inventories for EEFP Calculations, to adjust missile counts from 1 percent (very robust target, such as a reinforced-concrete roof of at least 8 inches in thickness) to 55 percent (less robust target, such as a steel pipe of at least 16 inches in diameter and less than 3/8-inch thickness). The NRC staff notes that the categories were revised to 12 categories in NEI 17-02, Rev. 1B. The NRC staff finds that the additional categories provided additional detail in the categorization of target robustness. Other targets not belonging to any of those 12 categories were considered to be not robust, and any missile hit was assumed to fail the target (i.e., the missile count is 100 percent for these targets). An example of missile inventory adjustments to account for target robustness is presented in Table 5-3, Example Missile Inventories for Different Targets (For F6 Tornado EEFP Calculations), of NEI 17-02, Rev. 1. The basis for the identification of certain SSCs as robust and the determination of the fraction of missile inventory that can damage each such SSC was provided in Section C.3, Approach, of Appendix C of NEI 17-02, Rev. 1. The NRC staff finds the approach for the identification of certain SSCs as robust to be acceptable for this application because the characterization appropriately captures the varying levels of damage that may be caused by a tornado missile hit.

Section B.6, Missiles Affecting Robust Targets, of NEI 17-02, Rev. 1 stated that the number of missiles used in the EEFP calculation could be adjusted to account for the population of missiles that could damage an SSC and provided the percentage of the total missile inventory for each type of robust target. These percentages depended on specific missile type counts taken from two plant missile inventories as shown in Tables B-15, Unrestrained Missile Inventories, B-16, Restrained Missile Inventories, and B-17, Average Missile Type Inventory, of NEI 17-02, Rev. 1. In accordance with NEI 17-02, Rev. 1 (Table 5-2), Harris has incorporated robustness values in its EEFP calculations. As discussed in its supplement dated September 19, 2018, the robustness values in NEI 17-02, Rev. 1, which were consistent with those in NEI 17-02, Rev. 1B, were used. The NRC staff questioned how the licensee intended to adjust the number of missiles for robust targets to ensure that the contribution of each missile type to the overall missile population is representative of the contribution of each missile type to the overall missile population during future use. In its supplement dated September 19, 2018, the licensee stated that for future use Harris will follow NEI 17-02, Rev. 1B for adjusting the number of missiles for robust targets, using the generic values provided in Table 5-2.

The NRC staff concludes that the licensees approach for adjusting the number of missiles for robust targets in the future by using the robust missile data in Table 5-2 of NEI 17-02, Rev. 1B is acceptable for this application. That table has been reviewed and determined by the staff to develop conservative robust missile adjustment factors. The NRC staff further concludes that additional comparison of site-specific missile type inventories is not necessary for this application.

In summary, the NRC staff finds the licensees approach for characterizing tornado missiles in its TMRE methodology is acceptable because (1) the licensees process for performing missile counts considered structural and nonstructural missiles, and (2) the licensees process is based on the relevant industry guidance, which the staff determined to be acceptable for this application, and (3) the TMRE methodology was determined to be bounding for Harris.

3.1.4 Determination of Site Tornado Frequency The licensee developed site-specific tornado frequencies for each category of tornadoes, which it classified using the Fujita-prime scale (F-scale). Section 4, Determine Site Tornado Hazard Frequency, of NEI 17-02, Rev. 1, provides guidance on the development of site-specific tornado initiator frequencies.

The TMRE methodology uses the tornado data found in NUREG/CR-4461 to develop the site-specific tornado frequencies to be used in the TMRE PRA model. NUREG/CR-4461 provides, for each U.S. nuclear plant site, tornado wind speeds associated with 10-5, 10-6, and 10-7/year occurrence frequencies for a tornado strike. Additionally, the total tornado strike frequency is provided for all locations in the continental United States. Using data from NUREG/CR-4461, Rev. 2, and the approach detailed in Section 4 of NEI 17-02, Rev. 1, the licensee developed a site-specific tornado frequency curve (hazard curve) for the licensees site. The site-specific hazard curve was then used to derive the frequency of all tornadoes considered in the TMRE methodology (F2 through F6).

For the purposes of the TMRE methodology, NEI used the Fscale to classify tornado wind speed. This scale is different from the original Fujita Scale (Fscale) and the Enhanced Fujita Scale (EF-scale) that is typically used. Section 4.2 of NEI 17-02, Rev. 1, stated that for the TMRE application, the F-scale was chosen because the MIP values were derived based on simulations that used the F-scale to categorize the tornadoes. Because F-scale occurrence frequencies were not directly available from NUREG/CR-4461, Rev. 2, those frequencies were derived from the site-specific Fujita scale data. As noted in Section 4.2 of NEI 17-02, Rev. 1, using the Fujita scale data instead of the Enhanced Fujita Scale data resulted in higher and, therefore, more conservative strike frequencies. Although the TMRE methodology uses F-scale for consistency in MIP derivation, RG 1.76, Revision 1, uses EF-scale and, therefore, the use of the F-scale is limited to this application.

The licensee described its process for determining tornado-initiating event frequencies in Section 3.3.4, Tornado Hazard Frequency, of the enclosure to its submittal dated October 19, 2017. As stated in that section, the TMRE methodology and NUREG/CR-4461, Revision 2, data were used to determine the tornado-initiating event frequencies for the Harris TMRE PRA model. Site-specific tornado frequencies for applicable tornadoes were developed as a result of this effort. Using guidance in the TMRE methodology and plotting the Harris data points in an XY scatter chart with a logarithmic trend line, the licensee derived the hazard curve used to calculate tornado-initiating event frequencies for each tornado intensity.

The NRC staff questioned how the exceedance probabilities influence on the initiating event frequencies were determined. In its supplement dated September 19, 2018, the licensee described the position taken by SNC for the Vogtle plant, in response to a similar question.

Following the Vogtle approach, the licensees process determined the F-scale wind speed estimates for the licensees site for tornadoes of frequency 10-5/year, 10-6/year, and 10-7/year, consistent with NUREG/CR-4461, Revision 2. A trendline was established and the resulting equation was used to calculate a frequency for all tornado wind speeds from 40 mph to 300 mph. Using the F-scale tornado intensity wind speed ranges, exceedance frequencies were determined for each tornado intensity F2 through F6. Then, interval frequencies were developed for each range by subtracting the exceedance value of the next higher intensity from the previous intensity exceedance value. These interval frequencies were then used as the initiating event frequencies for each tornado category in the licensees TMRE PRA model.

The NRC staff finds that the licensees process for generating tornado initiator frequency is consistent with guidance in NEI 17-02, Rev. 1 and is technically acceptable for this application.

The NRC staffs finding is based on the licensees (1) use of the most recent data from NUREG/CR-4461, Revision 2, which has been endorsed by the staff and includes tornadoes reported in the contiguous United States from January 1950 through August 2003, (2) demonstration of acceptable results in the derivation of a site-specific tornado frequency curve (hazard curve), and (3) use of a technically sound approach to determining the frequency of each tornado category for use in the TMRE PRA model.

3.1.5 Evaluation of Missile Impact on Targets The TMRE methodology defines and provides the technical basis for using EEFP to calculate the failure probability of targets. Section 3.3.5, Target Evaluation, of the enclosure to its submittal dated October 19, 2017, stated that the failure probability of targets was calculated using the EEFP. The TMRE EEFP results are listed in Table 3.3.5, located in Attachment 1 of the enclosure to the submittal.

3.1.5.1 Missile Impact Parameter To calculate the failure probabilities for exposed SSCs, the TMRE methodology uses MIP as the basis to compute the likelihood of a missile hitting a target, conditional on a tornado strike to the facility of a given intensity. Section 5.1, Missile Impact Parameter (MIP), of NEI 17-02, Rev. 1B defines MIP as [t]he probability of a tornado-missile hit on a target, per target unit surface area, per missile, per tornado. Generic MIP values are provided as part of the TMRE methodology and the technical basis for those values was described in Section 5.1 of NEI 17-02, Rev. 1B and Appendix B, Bases for MIP and Missile Inventories.

The TMRE methodology relies on data from EPRI NP-768 to calculate the MIP values used in the TMRE methodology, as described in the following section.

Background on Use of EPRI NP-768 The TMRE methodology uses EPRI NP-768 data to derive generic MIP values. Multiple scenarios of tornadoes striking a site were considered as part of the NRC-reviewed and approved EPRI NP-768 report. Tornadoes were considered to take multiple alternative paths and be of different intensity. To explore the effect on missile-hit frequencies of sites located in different places in the country, the average tornado frequency of three NRC tornado regions (Regions I, II, and III, numbered in decreasing order of tornado occurrence frequencies) were

used as input to the calculations in EPRI NP-768. The calculations also explored the effects of different missile types, different initial missile insertion heights, different initial locations of missiles through the site, and different configurations of buildings at the nuclear power plant. To study the different alternatives, the EPRI NP-768 analysis used a Monte Carlo approach that sampled and addressed uncertainties of parameters such as wind speeds, initial missile locations, and insertion heights. The EPRI NP-768 report examined statistical convergence on target hit frequencies, to select a sufficiently large sample of tornado paths and intensities (measured in the F-scale) and missile trajectories.

The EPRI report analyzed the effects of different configurations of buildings and missiles at nuclear power plants, by considering two hypothetical nuclear power plants, referred to as Plants A and B. The targets selected for the computation of hit frequencies were the buildings of Plants A and B. Plant A was a single-unit plant with seven buildings. Plant B was a two-unit plant with 16 buildings. Plant B was analyzed in two configurations: Configuration B1 postulated that all Unit 2 buildings were under construction when the tornado struck (with construction material providing a source of missiles), and Configuration B2 postulated both units as being operational at the time of the tornado strike. The types of missiles considered included wood beams, pipes, steel rods, utility poles, plates, and vehicles (cars and trucks). At Plant A, the missiles were assumed to be distributed uniformly over an enclosing area spanning 4,640 ft x 5,000 ft (= 2.32 x107 ft2). For Plant B, the distribution of missiles was non-uniform in the B1 and B2 configurations, including different assumptions on insertion heights and the initial location of missile types (e.g., vehicles were predominantly located in parking lots).

Missile trajectories were simulated and the characteristics of the hits on the different buildings or targets were recorded (such as impact speeds and scabbing damage) using the EPRI methodology. The EPRI methodology employs Monte Carlo techniques to propagate the transport of tornado-generated missiles and to assess the probability of missile strikes causing damage to unprotected SSCs. Statistics were derived to quantify the number of hits per target, the number of hits per missile, the number of hits with specific features (including whether a threshold velocity was exceeded or whether a given amount of damage was caused by the hit) and associated hit frequencies.

Derivation of MIP Values and Dependencies The TMRE methodology relies on aspects of the EPRI NP-768 analyses by defining a MIP based on the hit frequencies per missile, tornado frequencies, and target dimensions that can be derived from the data reported in EPRI NP-768. Moreover, although the targets evaluated in EPRI NP-768 were large buildings, the TMRE methodology uses an area-scaling approach in order to estimate the number of hits and hit frequency on all targets of interest, including small area targets such as exhaust stacks, cable vaults, access doors, and tanks.

To derive MIP values, the TMRE methodology relies on missile-hit frequencies calculated for specific EPRI NP-768 targets (buildings of hypothetical nuclear power plants, Plants A and B) as a function of the NRC tornado region frequency, the specific target, and the Fujita-prime tornado scale. Section B.1.1, Definition of Missile Impact Parameter (MIP), in NEI 17-02, Rev. 1, uses the following equation to calculate MIP values for a target:

MIP = Number of hits per target / missile / target area / tornado (1)

The NRC staffs evaluation of the MIP values in NEI 17-02, Rev. 1 examined the dependencies of MIP values and the appropriateness of the proposed scaling approach. The dependencies

that were examined included the tornado region (tornado frequency), building configurations, tornado intensity, missile location, and height.

The targets examined in EPRI NP-768 were buildings such as the containment, diesel generator, waste processing, service water intake, auxiliary, and tank enclosure buildings.

Appendix B to NEI 17-02, Rev. 1B, examined two approaches to define the target area. In the first approach, the area was that of the vertical wall (excluding the building roof, except for a small target called Target 6). In a second approach, the area included the walls and roof. The average MIP values computed with the smaller area (i.e., exposed area of only the vertical walls) were selected to define the reference MIP values for targets located at less than 30 ft above a reference level (near-ground targets) in EPRI NP-768. The average MIP values computed with the larger area (walls and roofs) were selected to define the reference MIP values for targets located higher than 30 ft above the reference level (elevated targets) in EPRI NP-768.

The TMRE methodology notes that the majority of the tornado-generated missile hits in the EPRI NP-768 analysis affected the vertical walls, with few hits on the building roofs. Based on that observation, the guidance selected the vertical wall exposed area only to define the MIP for near-ground targets for use in the TMRE methodology. The exception in the selection of areas was for the target referred to as Target 6 (service water intake structure), which was 20 ft in height. For Target 6, the total building area (walls and roof) was selected for estimating MIP values for both near-ground and elevated targets, on the basis that it was a short building with expected missile hits to the roof. Table B-3, Plant A Tornado Missile Impact Parameters for Near Ground Targets, in NEI 17-02, Rev. 1B, provides average values of the MIP values over all building targets for the three NRC tornado regions. The average value for each tornado intensity interval was computed as a weighted average using the target areas (building wall areas, with the previously stated exception of Target 6) as the weighting factors. This area-weighted average is equivalent to adding missile-hit frequencies for all targets, and then dividing by the total reference area as well as the tornado frequency for the F tornado intensity category under consideration.

Section B.3.2, Selection of Conservative Tornado Region MIP, of the TMRE methodology asserts that differences in MIP values between the NRC tornado regions were unexpected and that no specific discussion is provided in EPRI NP-768 to explain those differences. To address the possible uncertainty, NEI 17-02, Rev. 1 selected the maximum average of the three NRC tornado regions for each F tornado intensity category to define reference MIP values. The TMRE methodology further states that lack of convergence might have caused the numerical differences in the NRC tornado regions and postulates a transition height between near-ground and elevated targets as 30 ft above the reference. Depending on the location of the target (the location was measured with respect to the target center), the guidance provides different MIP values.

Evaluation of MIP The NRC staff examined the NEI 17-02, Rev. 1, approach for computing the MIP values from EPRI NP-768 data. The NRC staff determined that the licensee appropriately calculated MIP values for the seven targets in Plant A that were studied in EPRI NP-768 and that the MIP average values in Tables B-3 and B-5 of NEI 17-02, Rev. 1B were acceptable. The NRC staff also compared the MIP values for each target in EPRI NP-768 to the average MIP values in NEI 17-02, Rev. 1B, which would be used as part of the TMRE methodology.

The targets in the EPRI NP-768 analysis were buildings that shielded each other against tornado-generated missiles. The reference MIP values in NEI 17-02, Rev. 1, were averages from multiple targets (each target had a different level of exposure to tornado missiles). In any particular nuclear power plant, specific targets may be more exposed and have higher MIP values than the generic MIP values proposed in NEI 17-02, Rev. 1. Section A.5, Benchmark Results, of NEI 17-02, Rev. 1, presented the results of a benchmark analysis, comparing results from using the average MIP values to site-specific high winds PRA results, and concluded that the average MIP values and the associated EEFP tended to overestimate (in several cases, depending on the F tornado category, by orders of magnitude) SSC failure probabilities. The NEI guidance states that the high wind PRA models used to benchmark the TMRE methodology were peer-reviewed against the guidance in RG 1.200. The NRC staff did not review the technical acceptability of the high winds PRA models used in this benchmark.

The NRC staff used the results of those high winds PRA models to provide an order of magnitude estimation of SSC failure probabilities for this application, primarily for benchmarking purposes.

The tables in Section A.5, Benchmark Results, of Appendix A, Technical Basis for TMRE Methodology, of NEI 17-02, Rev. 1, identified only a few exceptions to the overestimation. The order of magnitude of the TMRE probabilities was similar to that for the probabilities calculated using the high winds PRA models for the exceptions. Although the number of examples in the benchmark in Section A.5 was limited, the benchmark supported the use of average MIP values as a defensible approach to estimate the EEFP for use in the TMRE PRA model. The information in Appendix A of NEI 17-02, Rev. 1, demonstrated that the average MIP values would, in general, not result in an underestimation of the failure probability of SSCs due to tornado missile strikes.

The NRC staff noted an unexpected variation of MIP values among the NRC tornado regions using the EPRI NP-768 data. The differences in MIP values between Regions I and II occurred mostly at the F5 intensity, and at the F4 intensity, between Regions I and III. Although the reasons for those differences are unclear, the occurrence of those differences at high F intensities may be caused by the lack of convergence in some simulations, as asserted by the NEI 17-02, Rev. 1.

In the EPRI NP-768 simulations, the containment building experienced few hits on average and had the least contribution to the total hit probability as compared to other targets. The NRC staff examined the possibility of underestimation of MIP values due to the consideration of the licensees containment building (Target 1, Plant A) in deriving the average MIP values in NEI 17-02, Rev. 1. The containment building in the EPRI NP-768 analysis was 230 ft in height and was shielded in the lower elevations by other buildings. The missile hits to the Plant A containment building in EPRIs simulations occurred at least 60 ft above the ground.

The NRC staff questioned the inclusion of the containment building of Plant A in EPRI NP-768 in computing the average MIP values for targets less than 30 ft above a reference level, given that the containment building was shielded by other buildings up to 60 ft above ground elevation and was not impacted by near-ground missiles. In its supplement dated September 19, 2018, the licensee revised its computation of MIP to remove the containment building from the near-ground MIP calculation. The licensee also updated several sections of NEI 17-02, Rev. 1B that were identified in its response, to remove the containment building from the near-ground MIP calculations. Therefore, NEI 17-02, Rev. 1B, does not include the containment building for the near-ground MIP calculations. The licensee also applied the robust missile fractions from the TMRE methodology. The net result of the updates in its supplement dated

September 19, 2018, was insignificant (less than five percent), and did not affect the conclusions in the licensees supplement dated October 19, 2017.

The NRC staff concludes that the licensees approach of excluding the containment building in the computation of the reference MIP values for near-ground structures in its TMRE methodology is acceptable, because it eliminates the impact of the containment building on the near-ground MIP values.

Section B.4, MIP Values for Use in the TMRE, of NEI 17-02, Rev. 1B, provides two sets of MIP values: one for elevated targets and one for near-ground targets. As previously noted, the demarcation between near-ground and elevated targets was 30 ft above the primary missile source for a target. The EPRI NP-768 data supported the assumption of a decrease in hit frequency with target height. For example, the MIP value of Target 1, which was only impacted at heights above 60 ft, was one order of magnitude less than the MIP value of other targets. Based on these results, as noted in Table B-2a, Elevated and Near Ground Missile Impact Parameter Comparisons, of NEI 17-02, Rev. 1B, the guidance proposed a ratio whereby MIP (elevated ground) = 0.43 x MIP (near-ground).

The NRC staff questioned (1) the relationship between the numerical results shown in Appendix E, TMRE Methodology Sensitivity Studies, and Appendix B, and (2) whether the NEI 17-02, Rev. 1B, Appendix E results are generally consistent with the ratio of elevated to near-ground MIPs calculated in NEI 17-02, Rev. 1B, Appendix B, Bases for MIP and Missile Inventories. In its supplement dated September 19, 2018, the licensee adopted the position taken by SNC in response to a similar question regarding the Vogtle TMRE analysis.

Consequently, based on information in the sensitivity analysis in Appendix E of NEI 17-02, Rev. 1, the licensee supported the selection of the 0.43 factor as a reasonable decrease factor to adjust the MIP values for elevated targets. Figure 12, Plant A North Wall Hit Probability for all EFs, in Appendix E showed a marginal change in MIP values as the target elevation increased; however, the licensee explained this to be an artifact of the target location in high ground and protected by near-ground buildings. In general, the majority of the target elevation sensitivity results in Appendix E supported the assumption that the MIP decreased with increasing target elevation and that a decrease by a factor of 0.43, when the elevation changes by 30 ft., was reasonable.

The MIP value for Target 1 was more than one order of magnitude less than the average MIP values at all F tornado intensity categories. Thus, a reduction factor on the order of 0.1 or less could be justifiable for very elevated targets (for example placed at more than 60 ft). Table 1, MIP Decrease Factors from the NEI 17-02 Appendix E Elevation Sensitivity Study, below, summarizes selected relative changes in MIP values associated with changes in target elevation from Appendix E. The information in Table 1 further supports the conclusion that an average decrease by a factor 0.43 when the change in target elevation is 30 ft would be a reasonable assumption for this application. Therefore, the NRC staff concludes that

implementing a decrease factor for the MIP values of elevated targets (as shown in the MIP for elevated targets in Table 5-1 of NEI 17-02, Rev. 1) is reasonable for this application.

Table 1. MIP Decrease Factors from the NEI 17-02 Appendix E Elevation Sensitivity Study.

Height change MIP change factor Figure in NEI 17-02 Appendix E 8 to 38 ft 0.635 Figure 9 5 to 55 ft 0.647 Figure 10 5 to 35 ft 1.042 Figure 11 6 to 41 ft 0.52 Figure 13 6 to 31 ft 0.57 Figure 14 8.5 to 53.5 ft 0.216 Figure 15 The NRC staff questioned the technical basis for the 30 ft demarcation between near-ground and elevated targets. The licensee adopted the position taken by SNC in response to a similar question regarding the Vogtle plant. The licensee added Section B.3.4, Basis for Target Elevation Demarcation, to NEI 17-02, Rev. 1, to provide a basis for the 30 ft demarcation.

Section B.3.4 of NEI 17-02, Rev. 1B states that the demarcation elevation of 30 ft was decoupled from the EPRI NP-768 data, because the EPRI NP-768 data did not provide quantifiable insights into missile hit probability at different elevations. The licensee further stated that an assumed demarcation elevation was qualitatively justified based on regulatory documents associated with tornado missiles (i.e., RG 1.76, Revision 1, and SRP Section 3.5.1.4). Those regulatory documents included the 30 ft demarcation for heavier missiles, such as automobiles.

The NRC staff considered insights from target elevation sensitivity study in Appendix E of NEI 17-02, Rev. 1, to examine the appropriateness of the change in MIP values for elevated targets and the transition elevation of 30 ft. The NRC staff concludes that assuming 30 ft as a transition distance to consider a lower value of the MIP is acceptable for this application because it is generally consistent with the EPRI NP-768 data and the Appendix E sensitivity analyses. The NRC staff emphasizes, however, that any use of such transition distances or reduction factors is not approved for other applications through the granting of this amendment request, as the staffs evaluation here is limited to this plant-specific LAR.

The NRC staff questioned whether the range of insertion heights underestimated the hit probabilities. In its supplement dated September 19, 2018, the licensee indicated that Section B.3.4, which was an addition to NEI 17-02, Rev. 1, provided the basis for the use of the insertion heights in the TMRE methodology. In that section, missile elevation data from several sites was determined based on actual missile surveys at a set of plants and compared the data with the missile insertion heights from EPRI NP-768. Based on the comparison, on average, approximately 66 percent of site missiles were close to the ground (within 15 ft of grade), as compared to only 22 percent of the EPRI NP-768 missile insertion heights. The NRC staff finds that the MIPs in NEI 17-02, Rev. 1B, do not appear to underestimate the hit probability based on insertion height for this application, because data from plant missile surveys showed a significantly higher proportion of missiles being close to ground, which bounds the injection heights used in EPRI NP-768 because higher missile injection heights lead to higher hit probabilities since such missiles are expected to travel farther leading to a higher likelihood of encountering a target.

Conclusion The NRC staff concludes that the selection of only the exposed vertical wall area to calculate MIP values for near-ground targets is justified because the majority of the missile hits in EPRI NP-768 analysis occurred near the ground and on the vertical walls. The EPRI NP-768 data and the NEI 17-02, Rev. 1 sensitivity analyses consistently showed that elevated targets have fewer hits and, therefore, using smaller MIP values for elevated targets is acceptable.

Using different MIP values for each tornado intensity is acceptable and supported by EPRI NP-768 data. The airborne missile paths are longer and cause more target hits for more intense tornadoes and, therefore, the average MIP values monotonically increase with increasing tornado intensity.

The reference MIP values derived in NEI 17-02, Rev. 1B, were averaged over all examined targets (weighted by the exposed vertical wall area) with the exception of the EPRI NP-768 Plant A containment building. The NRC staff concludes that computing the MIP values as an average of the examined targets is reasonable. The average value takes credit for mutual shielding of the buildings (i.e., the average MIP values correspond to a target that is neither the most exposed nor the least exposed) and mutual shielding is a more realistic representation of actual nuclear power plant configurations. The NEI 17-02, Rev. 1, guidance includes a benchmark comparison supporting the conclusion that use of average MIP values do not underestimate, in general, the EEFP with respect to the site-specific failure probability of SSCs calculated using high wind PRA models.

In summary, the NRC staff concludes that the use of average MIP values in NEI 17-02, Rev. 1B, that do not include the containment building of the EPRI NP-768 Plant A, are acceptable for this plant-specific application.

3.1.5.2 Target Exposed Area The target exposed area is defined as the area of the target exposed to potential missile hits.

Section 5.3, Target Exposed Area, of NEI 17-02, Rev. 1, provides a method for calculating the target exposed area of an SSC susceptible to tornado-missile hits for various types and configurations of SSCs. To simplify the method of calculating exposed area, NEI 17-02, Rev. 1, recommends the use of polyhedrons encompassing the target. With adequate justification, a cumulative sum of sub-component exposed areas could be an alternate approach to represent exposed SSCs. According to the TMRE methodology, any such approach or reduction to the effective surface area must be documented along with the engineering judgment used as part of the approach. Section 5.3.1, Types of Targets and Calculations, of NEI 17-02, Rev. 1 included recommendations for calculating exposed areas for tanks, pipes, pumps, and valves. Certain aspects of analysis, such as accounting for vertical missiles, depend on the plant-specific licensing basis. The licensee calculated effective surface area for use as the target exposed area of each specific individual target or correlated group, as shown in Table 3.3.5 and Table 3.3.7-2 in Attachment 1 of the enclosure to the submittal dated October 19, 2017. The NRC staff finds this approach for estimating target exposed area by considering the surface area of a polyhedron with dimensions bounding the component to be conservative and is, therefore, acceptable.

The guidance in NEI 17-02, Rev. 1, allows flexibility to consider shielding of structures, thus reducing the exposed area, as only a portion of the target may be within the missile path.

Section 5.3.2, Target Shielding, of NEI 17-02, Rev. 1, contained a discussion of target

shielding based on the exposed SSC configuration. The guidance called for considering target strikes in all directions but allowed consideration of shielding from tornado missiles in specific directions. The guidance further states that with adequate justification, SSCs or other intermediate barriers blocking missile paths to a target can be considered as shields or barriers.

The guidance indicates that the basis for crediting shielding in reducing target surface area or providing equivalence to other robust targets/barriers should be justified and documented on a plant-specific as well as target-specific basis. As discussed in this safety evaluation, the scope of the licensees walkdown included consideration of barriers as well as shielding and their impact to missile paths, thus satisfying the guidance.

Targets inside Seismic Category I reinforced concrete structures may be vulnerable to missile hits through openings in the structure or through certain roofs. NEI 17-02, Rev. 1, recommends selecting the target area as the minimum of the calculated target area and area of the building opening. For roof missile paths, NEI 17-02, Rev. 1, recommends defining the target area as the projected area of the target along the plane of the roof. The NRC staff finds the use of the area of the opening and the projected target area, as applicable, to be acceptable because (1) it is reasonable for the EEFP of an SSC to be proportional to the cross-section in the path of a missile and (2) for targets vulnerable to missiles through the roof, the target area projected vertically captures the dominant direction of the missile impact on those SSCs.

For tall targets, NEI 17-02, Rev. 1, recommends splitting the target at the 30 ft elevation from the reference level and examining the single target as two equivalent targets, with the near-ground MIP values applied to the lower portion of the target (i.e., below 30 ft elevation),

and elevated MIP values applied to the upper portion of the target. The NRC staff finds the approach of splitting the target at the 30 ft elevation to be acceptable because (1) the approach is equivalent to using a unique area-weighted MIP, which lies between the near-ground MIP and the elevated-target MIP (thus, the associated EEFP will be between the two extremes computed by assuming the target to be either entirely near-ground or elevated) and (2) the area-weighted MIP values (combining near-ground and elevated-target portions) will be close to the MIP values of the dominant target segment (e.g., it is closer to the near-ground MIP values if the lower target segment is of much greater area than the upper target segment).

The TMRE methodology defines an approach to treat physically close targets as correlated,"

and recommends defining a single polyhedron enclosing two or more proximal targets. The enclosed SSCs are assumed to be simultaneously hit and failed if the enclosing polyhedron were postulated to be hit by a missile. The TMRE methodology further allows for engineering judgment in the selection of enclosing polyhedral, to avoid an overly conservative prediction of simultaneous failure, and it provides examples to illustrate how this allowance can be utilized.

The NRC staff finds the approach to treat some SSCs as correlated depending on physical proximity to be acceptable, because such an approach continues to be conservative and addresses uncertainties related to the likelihood of simultaneous impact of tornado missiles on such SSCs. The NRC staff also finds the treatment of some targets as independent from adjacent targets, based on adequately justified engineering judgment, to be acceptable because of the variety of SSC configurations present at a nuclear plant.

As indicated in Section 2.1.2, Vulnerable SSC Walkdown, of NEI 17-02, Rev. 1, the vulnerable SSC walkdown would gather information on HWEL SSCs that are potentially exposed to tornado missiles. The walkdown determines which SSCs are vulnerable to tornadoes and tornado missiles and would be used to collect data, such as the exposed SSC target location, elevation, surface area, and construction details, and the type and location of any local structures that may provide a shielding effect. Section 3.3.2, Target Walkdowns, of the

enclosure to the licensees submittal dated October 19, 2017, provided the scope of TMRE walkdowns. Items 2 and 4 of Section 3.3.2 of the enclosure states that the scope of TMRE walkdowns included documenting and describing barriers that could prevent or limit exposure of the SSC to tornado missiles as well as determining the dimensions of the target SSCs, including any subcomponents or support systems.

Item 3 of Section 3.3.2 of the enclosure to the licensees submittal included identification of directions from which tornado missiles could strike targets within scope of the walkdowns.

When calculating surface area, some components (e.g., tanks, ultimate heat sink fans, etc.)

were susceptible to potential missiles in the vertical direction that could result in additional exposed area. The NRC staffs review found that the TMRE methodology does not appear to differentiate between horizontal and vertical missiles. Considering that tornado missiles could strike from all directions, the NRC staff questioned how the TMRE methodology addressed directional aspects. In the September 19, 2018, supplement, the licensee described how directional aspects of missile trajectory are included in the TMRE. The licensee stated that target walkdowns evaluated the possible directions from which a missile could strike a particular target, it documented shielding that could physically prevent missiles from hitting a target in some directions, and the effective area was adjusted to reflect that condition. The NRC staff finds that the licensee adequately considered directional aspects in its analysis, because the licensees approach, including the walkdown, considered all possible missile strike directions for evaluating the impact of tornado-generated missiles on SSCs within the scope of the TMRE methodology.

3.1.5.3 Using Exposed Equipment Failure Probability in TMRE Background on the Use of EEFP The TMRE methodology calculates the failure probability of exposed SSCs using EEFP.

Section 5, Evaluate Target and Missile Characteristics, of NEI 17-02, Rev. 1, defines EEFP as the conditional probability that an exposed SSC is hit and failed by a tornado missile, given a tornado of a certain magnitude. For every applicable SSC, the following equation was used to calculate five EEFP values, one each for tornado categories F2 through F6:

EEFP = (MIP) x (Number of Missiles) x (Target Exposed Area) x Fragility (2) where the number of missiles is surveyed within a radius of 2,500 ft. and fragility is a factor to take credit for the strength of a target against a missile hit.

The fragility factor used in the EEFP determination is the conditional probability of the SSC failing to perform its function given that it is hit by a tornado missile. For purposes of the TMRE methodology, the SSCs were assumed to always fail if hit by a tornado missile (i.e., the factor is assumed to be 1). However, as discussed previously, the TMRE methodology defines adjustment factors on the missile inventory to account for levels of target robustness to withstand missile impacts.

Acceptability of Using EEFP in TMRE As discussed previously, the EEFP is fundamental to the TMRE, because it provides the likelihood of an SSC being failed by a tornado missile. According to EPRI NP-768, the quantity (M = number of missiles, AT = target area, F = fragility factor) is the average number of missile hits given a tornado strike. In general, this average number of hits could be

greater than one. The Poisson distribution expresses the probability of a given number of events occurring in a fixed interval of time or space. Assuming a Poisson distribution for the missile hits over the duration of the tornado, the probability for a target being hit by n missiles is (3) where . The probability for a target being hit by one or more missiles is 0 1 0 1 (4)

The EEFP computed as the product is properly interpreted (for cases of small value of the product) as the probability of a target being hit by at least one missile.

Therefore, the NRC staff finds computing the EEFP using equation (2) to be technically sound for this application.

The NRC staff also finds that the licensees process for determination of the impact of tornado missiles on targets by determining EEFPs is acceptable (i.e., evaluating the risk associated with the lack of tornado-missile protection for nonconforming SSCs) because (1) the approach is consistent with the derivation of the MIP values and therefore, uses the MIP values appropriately; (2) the approach to defining missile inventories based on a reference radius (2,500 ft) is consistent with the original analysis in EPRI NP-768; (3) adjusting inventories to account for robustness levels is adequately justified and an acceptable first order approximation in lieu of detailed fragility analyses for this application, as targets are expected to have different levels of resilience to missile hits; and (4) the approach to estimating exposed areas, in general, tends to overestimate the area in the path of missiles; therefore, it is appropriate for risk evaluations performed to support this application. The NRC staffs conclusion on the acceptability of the using EEFPs in risk evaluations is limited to tornado-missile protection nonconforming conditions within the scope of the TMRE methodology as described in this safety evaluation.

Submerged Targets and EEFP The licensee identified several components that required protection from tornado-generated missiles while submerged. These are all located in the main or auxiliary emergency service water intake structures. In Enclosure 4 to its supplement dated September 19, 2018, the licensee provided the basis for screening out each of these targets from further review. The licensee discussed several qualitative factors that apply to all missiles that could strike submerged targets and support screening them out from further evaluation. These qualitative factors are: (1) missile shape, (2) missile integrity (to survive impact with water and to remain intact while traveling through the water), and (3) requisite kinetic energy, alignment, and angular momentum at the point of entering the water. For a missile to penetrate the water, travel through the water to reach the target, and retain sufficient energy to do damage, all of these factors must be favorable to a strike.

In Enclosure 4 to its supplement dated September 19, 2018, the licensee stated that the following insights applied to all the submerged targets at Harris:

Only a subset of all potential missiles had the shape needed to effectively travel through water and maintain forward momentum. Those missiles would also need to maintain sufficient structural integrity upon entering the water.

The potential subset of missiles that are shaped to travel effectively through water would also need to be aligned in a manner to penetrate the water and maintain substantial kinetic energy.

The missiles penetrating the water must have minimal rotational momentum upon entry into the water. All missile energy would need to be in alignment with the optimal water entry alignment.

None of the identified targets are susceptible to direct vertical missiles.

Due to the angular entry of missile in the water, a fraction of missiles would not penetrate the water surface significantly.

Only missiles with sufficient air speed possess the necessary kinetic energy to travel through the water and damage submerged targets.

Submerged targets are below grade and have limited exposure path to missiles; the missile trajectories needed to strike submerged targets are a very small subset of possible trajectories.

The licensee evaluated each kind of target individually and described specific considerations that apply to the corresponding target. In addition, the licensee performed a sensitivity study in which EEFP values were developed for the main and auxiliary reservoir traveling screens and emergency service water pump trains.

Due to the highly constrained paths that a damaging missile would have to take and the highly unlikely combination of characteristics that such a missile would require to reach an exposed but submerged target at Harris, the NRC staff finds that the cumulative contribution to risk of these submerged, nonconforming (i.e., not missile-protected), targets is negligible. The NRC staff notes that this conclusion is based upon the licensees plant-specific analysis and applies only to Harris.

3.1.6 Development of TMRE PRA Model Section 6, Develop TMRE PRA Model, of NEI 17-02, Rev. 1, provides guidance for developing the TMRE PRA model. This process included the following elements:

Selecting the event trees and fault trees appropriate for modeling a tornado event from the Internal Events Model of Record; Replacing the initiating events with tornado-initiating events (F2 - F6);

Removing recovery and repair logic (or set failure probability to 1.0);

Developing compliant-case and degraded-case logic or models; Adding tornado wind and missile failure modes to vulnerable SSCs, as appropriate, in the fault tree logic; and

Setting human error probabilities (HEPs) to 1.0, for certain short-term actions outside the main control room and reviewing transit paths for other operator actions outside the main control room.

Section 6.1, Event Tree/Fault Tree Selection, of NEI 17-02, Rev. 1 states that one or more of the internal events PRA LOOP event trees and respective accident sequence logic were expected to represent the tornado-initiating events in the TMRE PRA. The TMRE methodology further states that the other internal initiating events from the internal events PRA model of record should be reviewed to ensure that either (1) a tornado event cannot cause another initiating event, or (2) the impact of the initiating event can be represented in the logic selected to represent the tornado-initiating event.

The licensees process for developing its TMRE PRA model was described in Section 3.3.6, Model Development, of the enclosure to its submittal dated October 19, 2017. It started with the licensees current peer reviewed at-power internal events PRA model. The licensee used the LOOP event tree portion of the internal events PRA as the basis for the TMRE PRA model.

In its September 19, 2018, submittal, the licensee stated that the LOOP-initiating event accident sequence addressed the expected tornado damage states based on a review of the vulnerable equipment and that the tornado-initiating events for TMRE were added to the model at the LOOP-initiating event location in the fault tree by modifying the initiating event frequency.

Section 3.3.1, High Winds Equipment List, of the enclosure to its submittal dated October 19, 2017, states that the TMRE model used the LOOP sequences with no offsite power recovery and, therefore, PRA components and associated logic that did not support mitigation of a LOOP, were screened out. The NRC staff concludes that the licensees approach as discussed in NEI 17-02, Rev. 1, for developing the TMRE PRA model from the internal events PRA model of record is acceptable because it (1) appropriately considers the most likely impact of a tornado event on the plant via the assumption of LOOP, (2) appropriately captures the low likelihood of recovering off-site power after a tornado event by not assuming such recovery, and (3) ensures that initiating events caused by a tornado event other than LOOP are considered and, as applicable, represented in the TMRE PRA model.

Section 6.3, Compliant Case and Degraded Case, in NEI 17-02, Rev. 1 provides the guidance for creating two configurations, referred to as compliant and degraded cases, which were to be used to evaluate the change-in-risk associated with not providing tornado-missile protection for the nonconforming SSCs. As described in Section 6.3 of NEI 17-02, Rev. 1:

The compliant case represented the plant in full compliance with its tornado-missile protection CLB. Therefore, all nonconforming SSCs that were required to be protected against missiles were assumed to be so protected, even when reality determined the SSCs were not protected. In the compliant case, nonconforming SSCs were assumed to have no additional failure modes beyond those normally considered in the internal events PRA; and The degraded case represented the current configuration of the plant (i.e., configuration with nonconforming conditions with respect to the tornado-missile protection CLB). As such, the TMRE PRA model would include additional tornado-induced failure modes for all nonconforming SSCs. The failure probabilities for those additional tornado-induced failure modes were based on EEFP calculations.

Therefore, the primary difference between the compliant and degraded cases was the treatment of the nonconforming SSCs. The NRC staff finds that the licensees approach, incorporating the approach discussed in NEI 17-02, Rev. 1 for creating compliant and degraded cases is acceptable because this approach appropriately modifies the failure probabilities of affected SSCs for estimating the risk associated with the proposed change, and modifies the CLB by incorporating an acceptable methodology for the licensees evaluation of tornado missile risk for nonconforming targets.

Section 3.3.5, Target Evaluation, and Table 3.3.5-1, EEFP Calculation, of the enclosure to the October 19, 2017, submittal described the EEFP that was determined and used for vulnerable SSCs for both compliant and degraded cases. These EEFP values are listed in Table 3.3.5 of Attachment 1 to the enclosure. The licensee identified SSCs for which EEFPs were not calculated individually, but instead, the components were included as a portion of a larger correlated target. Because it appropriately captures the residual risk from the nonconforming conditions and vulnerabilities as well as the change in risk from the identified nonconforming conditions, the NRC staff finds the licensees approach for developing complaint and degraded cases acceptable.

As discussed above, Section 6.5, Target Failures and Secondary Effects, of NEI 17-02, Rev. 1B, was added to provide guidance on the consideration and treatment of additional tornado and tornado-missile-induced failure modes for all nonconforming SSCs in the TMRE PRA model. Guidance was provided on functional failures of SSCs as well as the impact of secondary effects on nonconforming SSCs considered with the TMRE model. The NRC staff finds that the guidance in Section 6.5 of NEI 17-02, Rev. 1B, adequately captures the important tornado and tornado-missile-induced failure modes for SSCs as well as their treatment in the TMRE PRA model. The NRC staff finds that the direct impact on exposed SSCs is the dominant failure mode for this application compared to more complex failure modes (e.g.,

spurious closure or opening).

The NRC staff questioned when and to what extent failure modes not previously included in the internal events system models should be considered. In its supplement dated September 19, 2018, the licensee referred to an SNC response to a similar question for Vogtle, to describe the failure modes of SSCs and how those failure modes were implemented in the licensees TMRE PRA model. The licensee stated that new basic events and flags were added to the model to address all the failure modes of the safety-related and non-safety-related system targets exposed to tornado missiles. The NRC staff finds that the licensees approach for treating various failure modes of the SSCs in its TMRE PRA model is acceptable because it adequately identifies and considers failure modes for this application. The NRC staff notes that because of conservatisms in the TMRE methodology and the margin to acceptance guidelines, the failure modes could be limited to functional failures and secondary effects occurring from the direct impact of tornadoes and tornado missiles on exposed SSCs.

Table 3.3.5 of the enclosure to the submittal dated October 19, 2017, provides MIP values, missile counts, and EEFPs for the nominal and sensitivity cases, for both nonconforming and vulnerable SSCs. The NRC staff reviewed the derivation of EEFPs for those SSCs and concludes that the licensees approach adequately identified and added basic events for SSCs that were not protected against tornadoes or tornado-missile-induced failures in addition to the nonconforming SSCs.

Section 6.1 of the TMRE methodology assumes that the tornado-induced LOOP cannot be recovered. This assumption indicates that offsite power remains unavailable following the event

for the duration of the PRA mission time considered for this application. Furthermore, Section 3.1 of the TMRE methodology states that SSCs that were dependent on offsite power were screened from HWEL, because of the non-recoverable LOOP assumption in the TMRE methodology. The NRC staff determined that assumption of a non-recoverable LOOP may result in non-conservative change-in-risk evaluation. Section 3.3.9, Sensitivities, of the enclosure to the submittal provided the results of a bounding sensitivity analysis that was performed to ensure that conservative modeling treatments in the compliant case did not affect the risk assessment conclusions. The licensees bounding sensitivity analysis was performed by setting the risk from the compliant case to zero. The NRC staff finds that the sensitivity analysis performed by the licensee in Section 3.3.9.1 of the enclosure to the submittal dated October 19, 2018, bounds the potential non-conservatisms associated with the assumption of non-recoverable LOOP.

Section A.2.1.1, Non-recoverable Loss of Offsite Power (LOOP) Assumption, in NEI 17-02, Rev. 1, discusses the basis for the assumption of non-recovery. This section states that the assumption is consistent with current high wind PRA models. The NRC staff finds the assumption of non-recovery of the offsite power acceptable for this application because of insights gained from operating experience related to LOOP events caused by tornadoes and high winds. Therefore, screening out SSCs that are dependent on offsite power is acceptable for the licensees proposed use of TMRE methodology.

The NRC staff questioned how the construction-related missiles would be considered for future applications of the TMRE methodology by the licensee. In its September 19, 2018, submittal, the licensee stated that Section 7.4, Missile Margin Assessment, was added to NEI 17-02, Rev. 1B, to document when a proposed construction activity would cause the site missile inventory to increase above the missile count used in the TMRE analysis. The NRC staffs approval is limited to the scope of the current LAR, as the staffs evaluation considered only the analysis and factors contained in the current application. The NRC staffs approval does not apply to any construction activity that does not meet the risk metric thresholds in Section 7.3, Comparison to Risk Metric Thresholds, of NEI 17-02, Rev. 1. The NRC staff finds the licensees approach for considering construction-related missiles for future applications of its TMRE methodology to be acceptable because it includes construction-related missiles in the sites missile count, assesses the impact of the construction-related missiles using the TMRE methodology, and indicates that the licensee will seek prior NRC approval if risk metric thresholds of the TMRE methodology are exceeded.

In response to additional NRC staff questions related to ensuring that conservative modeling treatments in the complaint case do not affect the risk assessment conclusions, the licensee explained that any future sensitivity analysis would address the conservativism associated with modeling equipment failures in the compliant case. The licensee stated that its evaluation of compliant-case conservatisms was limited to the assumption that failure probabilities of certain SSCs (e.g., exposed nonsafety-related components) were set to 1.0. Similarly, the licensee considered the assumption that offsite power was lost and not recovered following a tornado event to be reasonable, consistent with current high wind PRA practices. In addition, the assumption that certain operator actions within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the event were assumed to fail was considered to be a reasonable assumption for tornado events and, therefore, is not a compliant-case conservatism. The NRC staff concludes that sensitivity analyses related to potential conservatisms by assuming failure of operator actions within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of tornado events and non-recovery of offsite power are not needed because the licensees related assumptions are reasonable for this application.

Section 7.2.3, Compliant Case Conservatisms, of NEI 17-02, Rev. 1, provides guidance for performing sensitivity analyses to address the impact of potential compliant-case conservatisms. This section states that the licensee would identify conservatisms related to equipment failures only. The guidance further states that sensitivity analyses will be performed to address supporting requirements (SRs) identified in Appendix D, Technical Basis for TMRE Methodology, of NEI 17-02, Rev. 1. The licensee stated that it would follow NEI 17-02, Rev. 1 for addressing compliant-case conservatisms. Because the licensees approach addresses relevant SRs in the NRC-endorsed PRA Standard for performing this sensitivity analysis, the NRC staff concludes that the licensees approach for considering conservatism associated with modeling equipment failures in future implementation of the TMRE methodology acceptable, Sections 3.3, Ex-Control Room Action Feasibility, and 6.4, Impacts on Operator Action Human Error Probabilities, of NEI 17-02, Rev. 1B, provide guidance on modeling HEPs in the TMRE PRA model. The guidance stated that no credit for operator action should be taken for actions performed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of a tornado event outside a Category I structure or which required the operator to transit outside a Category I structure to get to the location to perform the action. The guidance further states that operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> could be impacted by such environmental conditions as debris that blocks access paths and should be considered by accounting for whether equipment will be accessible and whether the time required to perform the action will be impacted. Section 3.3 of the guidance states that the results of the operator interviews and the walkdown notes should be reviewed by a human reliability analyst.

Section 6.4 of the guidance states that the feasibility of actions involving transit or operation outside Category I structures more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the tornado event should be assessed and documented. The NRC staff finds that operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> outside Category I structures should be evaluated to consider the effect of timing and environmental impacts on HEPs, consistent with the relevant SRs in the NRC-endorsed PRA Standard.

Section A.2.1.2, Impact on Operator Actions, of NEI 17-02, Rev. 1B, provides considerations for not changing the HEP of actions involving transit or operation outside Category I structures more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the tornado event. Section 3.3.1 of the enclosure to the supplement dated October 19, 2017, states that the operator actions were assessed based on the TMRE methodology and that the internal events PRA were used to perform the assessment of operator actions. The NRC staff questioned what measures are needed to ensure that environmental conditions would not affect operator actions that are credited after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. In its supplement dated September 19, 2018, the licensee stated that an auxiliary operator with experience performing human actions was provided a list of operator actions to verify that operator actions outside Category I structures (operations that would require operator exposure during or in the immediate aftermath of the tornado) were not being credited in the licensees TMRE PRA. Only one operator action performed outside Category I structures was credited. The credited operator action was related to opening certain doors in the turbine building and had an estimate of 17 hours1.967593e-4 days <br />0.00472 hours <br />2.810847e-5 weeks <br />6.4685e-6 months <br /> to complete. The licensee stated that there was sufficient time to clear the doorways if there was a challenge to opening the doors. Because of the relatively long time available to complete this operator action, the NRC staff finds that there is sufficient time to clear the doorways. The environmental conditions will not significantly affect the HEP associated with the operator action. The NRC staff further finds the licensees approach for assessing the effect of environmental factors after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> following a tornado on operator actions involving transit or operation outside Category I structures acceptable for this application, because the effect of timing and environmental conditions and HEPs were adjusted, as applicable, consistent with RG 1.200.

3.2 Review Methodology Consistent with SRP Section 19.1, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk Informed License Amendment Requests after Initial Fuel Load, the NRC staff reviewed this risk-informed submittal to determine whether the proposed changes will have more than a minimal impact on the continued safe operation and safe shutdown capability of the plant.

With respect to the risk from not providing protection for nonconforming SSCs against tornado missiles by incorporating the TMRE methodology in the UFSAR, the NRC staff reviewed the submittal in accordance with the five key principles of risk-informed decisionmaking, as delineated in RG 1.174, Revision 2 to determine whether:

The proposed change meets the current regulations, unless it explicitly relates to a requested exemption; The proposed change is consistent with a defense-in-depth philosophy; The proposed change maintains sufficient safety margins; When proposed changes result in an increase in CDF or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement; and The impact of the proposed change should be monitored using performance measurement strategies.

3.3 Key Principle 1: Compliance with Current Regulations As a key principle of risk-informed integrated decisionmaking, Regulatory Position 1 in RG 1.174, Revision 2, states that the licensee should affirm that the proposed licensing basis change meets the current regulations unless the proposed change is explicitly related to a requested exemption (i.e., a specific exemption under 10 CFR 50.12).

Harris original approach to protecting SSCs from tornado missiles was to provide appropriate physical protection for all SSCs, as required by GDC 2 and 4. The licensee stated in Section 4.1, Applicable Regulatory Requirements/Criteria, of the enclosure to the submittal dated October 19, 2018, that RG 1.174 establishes criteria to quantify the sufficiently small frequency of damage discussed in SRP Section 3.5.1.4 that allows for a probabilistic basis for relaxation of deterministic criteria for tornado-missile protection of SSCs. However, the cited SRP sections discuss the probability of occurrence of events and not the change in core damage frequency (CDF) and large early release frequency (LERF). The probabilistic criteria in SRP Section 3.5.1.4 (i.e., the probability of damage to unprotected safety-related features) is not directly comparable to RG 1.174 acceptance guidelines. Therefore, the NRC staff questioned how the proposed methodology will continue to provide reasonable assurance that the SSCs important to safety will continue to withstand the effects of missiles from tornadoes or other external events without loss of capability to perform their safety function. In its supplement dated September 19, 2018, the licensee stated that the use of the TMRE methodology would not alter any input assumptions or the results of the accident analysis. The licensee further stated that the types of accidents, accident precursors, failure mechanisms, and accident initiators already evaluated in the UFSAR as well as the controlling numerical values

for parameters in the safety analysis remained unaltered. The licensee explained that the use of the methodology did not result or require any physical changes to the facility and therefore, new types of malfunctions or accidents were not created. No change to the safety analysis acceptance criteria were proposed.

Based on its review of the submittal dated October 19, 2017, and supplements, the NRC staff finds that the licensee will continue to meet the regulations, because the design basis for the SSCs impacted by the proposed change will reflect the importance of the safety functions to be performed by those SSCs in accordance with the GDC, and there is reasonable assurance that, subsequent to the proposed change, necessary safety-related SSCs will continue to be available to perform their safety functions, as reflected in UFSAR Section 3.5, during and following a tornado event at Harris.

The NRC staff notes that an exemption from the applicable regulations was neither requested by the licensee in the application, nor is granted by the NRC staff. All applicable design requirements remain. Therefore, key principle 1 in risk-informed decisionmaking is satisfied.

3.4 Key Principle 2: Evaluation of Defense in Depth Defense-in-depth is an approach to designing and operating nuclear facilities involving multiple independent and redundant layers of defense to compensate for human and system failures.

Regulatory Position 2.1.1 in RG 1.174, Revision 2, states that defense-in-depth consists of a number of elements, and consistency with the defense-in-depth philosophy is maintained if the following occurs:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation; Over-reliance on programmatic activities as compensatory measures associated with the change in the license basis is avoided; System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system and uncertainties; Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed; Independence of barriers is not degraded; Defenses against human errors are preserved; and The intent of the plants design criteria is maintained.

In Section 3.2 of the enclosure to the submittal dated October 19, 2017, the licensee provided a discussion of how its risk-informed assessment was consistent with the philosophy of defense in depth. The following sections provide an evaluation of each of the seven considerations.

3.4.1 A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

The proposed change does not introduce new accidents or transients as compared to those present in the licensees internal events PRA and those analyzed during the safety analyses. In Section 3.2 of the enclosure to the submittal dated October 19, 2017, the licensee stated that there are few nonconforming conditions. Moreover, most of each system that is important to safety is protected from tornado missiles. The licensee also explained that no conditions were discovered within the scope of the proposed change that would affect containment integrity during a tornado event and that the containment would continue to function as a key fission product barrier.

The NRC staff notes that none of the identified nonconforming conditions impacted by the proposed change only affects LERF, which is an indication that there was no significant impact on prevention of containment failure. The proposed change does not significantly affect the availability and reliability of SSCs that mitigate accident conditions, nor does it significantly reduce the effectiveness of the licensees emergency preparedness program. Therefore, the NRC staff finds that the proposed change continues to preserve a reasonable balance between prevention of core damage, prevention of containment failure, and consequence mitigation.

3.4.2 Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

The implementation of the proposed change does not require compensatory measures and does not change the licensees existing operating procedures. The proposed change does not rely upon proceduralized operator actions within an hour of a tornado passing that would require operators to travel into areas that are not protected from the effects of the tornado or tornado missiles. In the September 19, 2018, supplement, the licensee stated that only one operator action was credited outside Category I structures and that action is not required in the first hour after the occurrence of the tornado event. The NRC staff notes that no new operator actions developed specifically in response to the proposed change were included in the licensees risk assessment supporting the proposed change. Therefore, the NRC staff finds that the proposed change avoids an over-reliance on programmatic activities because the proposed change does not result in human actions or compensatory measures.

3.4.3 System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

In Section 3.2 of the enclosure to the submittal dated October 19, 2017, the licensee explained that the redundancy, independence, and diversity associated with the functions of the nonconforming SSCs are unchanged. The licensee further stated that the proposed change had no impact on the availability and reliability of SSCs that could either initiate or mitigate events, except for the tornado-missile protection of the identified nonconforming SSCs, which was evaluated in the application. The licensee further stated that the expected frequency of tornado strikes remains low. Additional equipment is available to mitigate the effect of tornado missile impact, stored in protective structures. Based on the review of the submittal as well as the supplemental information, the NRC staff finds that system redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

3.4.4 Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

Tornado events and missiles generated by such events represent a common-cause initiating event, which can impact multiple SSCs. The licensees risk assessment supporting the proposed change captures such impacts. In the enclosure to the October 19, 2017, submittal, the licensee explained that the nonconforming conditions included in the proposed change were physically distributed about the licensees site. Missiles affecting emergency diesel generators or emergency service water systems would not affect the alternate seal injection diesel, which is independent of the other two systems. Further, the seal injection diesel, while not protected from tornado missiles is in a location with limited exposure to tornado missiles due to it being below grade in a hole with reinforced concrete walls. Therefore, the NRC staff concludes that the licensee has adequately assessed the potential for the introduction of new common-cause failure mechanisms because the proposed change does not degrade defenses against potential common-cause failures and directly considers the impact of the common-cause initiator.

3.4.5 Independence of barriers is not degraded.

In Section 3.2 of the enclosure to the submittal dated October 19, 2017, the licensee stated that neither the reactor fuel cladding nor the reactor coolant system pressure boundary is directly exposed to tornado missiles, and the containment is a robust tornado missile barrier. The licensee stated that the proposed change does not significantly increase the likelihood or consequence of an event that challenges multiple barriers, and does not introduce a new event, which would challenge multiple barriers. The NRC staff finds that the proposed change does not affect the independence of the fission product barriers and therefore, the independence of those barriers is not degraded.

3.4.6 Defenses against human errors are preserved.

In Section 3.2 of the enclosure to the submittal dated October 19, 2017, the licensee stated that Harris has procedures that would be utilized in the event of a tornado watch or tornado warning and after a tornado has passed. Abnormal and emergency procedures include alternative actions if equipment is damaged by tornadoes. The proposed changes do not to create new human actions that are important to preserving the layers of defense or significantly increase mental or physical demand on individuals responding to a tornado. Therefore, the NRC staff concludes that the proposed change preserves defenses against human error and does not introduce new human error mechanisms.

3.4.7 The intent of the plants design criteria is maintained.

In the enclosure to the submittal dated October 19, 2017, the licensee stated that the proposed change only affects a very small fraction of the system areas of the plant. The licensee explained that in lieu of protection for the identified nonconforming SSCs, it had analyzed the actual exposure of the SSCs, the potential for impact by damaging tornado missiles, and the consequent effect on CDF and LERF. While there is some slight reduction in protection from a defense-in-depth perspective, the impact was determined by the licensee to be negligible. The licensee concluded that the intent of the plants design criteria is maintained. The licensee also states that the methodology utilized to support the proposed change will not be used in the modification process for a future plant change to avoid providing tornado-missile protection.

Therefore, the NRC staff finds that the intent of the plants design criteria is maintained by the proposed change.

In summary, the NRC staff finds that the proposed change does not significantly affect the seven considerations for defense-in-depth and the proposed change preserves defense-in-depth commensurate with the expected frequency and consequence of challenges to the system resulting from the proposed change.

3.5 Key Principle 3: Evaluation of Safety Margins Regulatory Position 2.1.2 in RG 1.174, Revision 2, discusses two specific criteria that should be addressed when considering the impact of the proposed changes on safety margin:

Codes and standards or their alternatives approved for use by the NRC are met, and Safety analysis acceptance criteria in the [licensing basis] (e.g., [final safety analysis report] supporting analyses) are met, or the proposed revisions provide sufficient margin to account for analysis and data uncertainty.

Section 3.2 of the enclosure to the submittal dated October 19, 2017, discussed the impact of the proposed change on the safety margin. The licensee stated that consensus codes and standards (e.g., ASME, Institute of Electrical and Electronic Engineers (IEEE), or alternatives approved by the NRC) continue to be met and that the proposed change was not in conflict with approved codes and standards relevant to the SSCs impacted by the change. The NRC staff questioned how the licensee can conclude that the safety analysis acceptance criteria in the licensees safety analysis were not impacted by the proposed change. In its supplement dated September 19, 2018, the licensee stated that the safety analysis acceptance criteria described in Harris UFSAR Chapters 6, Engineered Safety Features, and 15, Accident Analyses, were not impacted by the proposed change. The licensee stated that special considerations such as single failure criteria are not required. The licensee stated that only a very small fraction of available SSCs that could be used to accomplish the objective are not protected from the effects of tornado missiles, and the remaining unaffected components provide reasonable assurance the objective would be achieved. In the event exposed components of one train of safety-related equipment is affected by a tornado missile, there is reasonable assurance that opposite train equipment would be available to provide the safety function. In addition to the equipment credited in the safety analysis described in the UFSAR, on-site and near-site FLEX equipment is also available, which provides further assurance that the objective would be achieved.

Section 2.3, Evaluate Target and Missile Characteristics, Section 5, Evaluate Target and Missile Characteristics, and Section 6.5, Target Failures and Secondary Effects, of NEI 17-02, Rev. 1B stated that tornado missile failures did not need to be considered for SSCs protected by 18-inch reinforced concrete walls, 12-inch reinforced concrete roofs, or 1-inch steel plate. The guidance did not require analysis for evaluating the risk of nonconforming conditions that were protected as described in Section 2.3 of NEI 17-02, Rev. 1, and implied that protection against tornado-generated missiles was not needed for those SSCs. The NRC staff questioned whether the safety analysis acceptance criteria in the licensing basis would continue to be met if nonconforming conditions were (or if identified in the future, would be) screened out from the Harris TMRE analysis using the criteria in Section 2.3 of NEI 17-02, Rev. 1. The licensee stated that, in accordance with the methodology, screening out of SSCs from the list of nonconforming conditions using the criteria in Section 2.3 of NEI 17-02, Rev. 1 was not performed for the

proposed change in the licensees application. Accordingly, the NRC staff finds that the licensee has not performed any screening of nonconforming SSCs that were protected consistent with Section 2.3 of NEI 17-02, Rev. 1. The NRC staff finds this approach acceptable.

The NRC staff concludes that the proposed change maintains sufficient safety margin because the codes and standards or their alternatives accepted for use by the NRC will continue to be met and the safety analysis acceptance criteria remain unaffected by the proposed change.

3.6 Key Principle 4: Change in Risk Consistent with the Commissions Safety Goal Policy Statement 3.6.1 PRA Acceptability The objective of the NRC staffs PRA acceptability review is to determine whether the plant-specific PRA used in evaluating the submittal, as supplemented, is of sufficient scope and provides a sufficient level of detail and technical elements for the application. The NRC staff evaluated the PRA acceptability information provided by the licensee in its tornado-missile risk evaluation submittal and supplements, including industry peer-review results against the criteria discussed in RG 1.200, Revision 2. The staffs conclusions regarding the PRAs acceptability are provided below.

3.6.1.1 Internal Events PRA Model For each supporting requirement (SR) in the ASME/ANS RA-Sa-2009 (2009 ASME/ANS Standard),, there are three possible degrees of satisfaction referred to as capability categories (CC) (i.e., CC-I, CC-II, and CC-Ill), with CC-I being the minimum, CC-II considered widely acceptable, and CC-Ill indicating the maximum achievable level of detail, plant specificity, and realism. For many SRs, the CCs are combined (e.g., the requirement for meeting CC-I is combined with CC-II) or the requirement is the same across all CCs so that the requirement is simply met or not met. For each supporting requirement, the peer review team designates one of the CCs or indicates that the SR is met or not met. According to Section 2.1, Consensus PRA Standards, of RG 1.200, Revision 2, CC-II is the level of detail that is adequate for the majority of risk-informed applications. Therefore, in general, a fact and observation (F&O) is written for any SR that is determined not to be met or does not fully satisfy CC-II of the ASME Standard, consistent with RG 1.200, Revision 2.

The NRC staff reviewed the results of the peer review process for the internal events PRA presented in Attachment 2 to the enclosure to the submittal dated October 19, 2017. The licensees internal events PRA model was subject to a number of industry peer reviews and self-assessments. The most recent full-scope peer review was completed in 2002, following guidance in NEI 00-02, Industry Peer Review Process. A number of focused peer reviews have been performed since then, and the licensee reports that all findings for the Harris internal events model have been resolved and closed. The licensee stated that the Harris PRA was selected in 2017 for a pilot demonstration of the process for closeout of F&Os by independent assessment. The independent assessment process was accepted by the NRC (Reference 23).

The licensee stated that all the open internal events findings were reviewed and assessed by the independent assessment team and would be closed at CCII or greater. The licensee further stated that there are no upgrades to the internal events PRA that have not been peer reviewed and that a systematic review was performed of the SRs relative to the TMRE model development.

The NRC staff finds that the internal events F&Os have been satisfactorily resolved in the context of this application. Because the licensee used the peer-review process to review the internal events PRA against the applicable SRs in ASME/ANS-RA-Sa-2009 and satisfactorily resolved all internal events F&Os using an NRC-accepted process, the NRC staff concludes that that the licensee has demonstrated that the internal events PRA conforms to technical elements in RG 1.200, Revision 2, and therefore, is technically acceptable for this application and provides an adequate basis for the development of its TMRE PRA model.

3.6.1.2 Tornado-Missile PRA Model In addition to the internal events technical elements, the details of the conversion process from the internal events PRA to the TMRE PRA was reviewed to determine that it followed industry guidance in NEI 17-02, Rev. 1, and to determine whether the conversion process was acceptable for this application.

Appendix D, Technical Bases for TMRE Methodology, to NEI 17-02, Rev. 1, includes SRs at CC-II from Part 2 (internal events PRA) of the 2009 ASME/ANS PRA Standard that have been selected specifically by the NRC staff for the application of the TMRE PRA model in assessing tornado-missile protection nonconformance risk. The selected SRs required specific consideration during the development of the TMRE model from the internal events model. The licensee listed its conformance with the SRs in Appendix D of NEI 17-02, Rev. 1, in Table 1 of of the enclosure to the submittal. Because it has adequately considered them in the development of the TMRE PRA model from the internal events model, the NRC staff finds that the licensee has conformed to the above-mentioned SRs.

Section 3.3.2, Assessment of Assumptions and Approximations, of RG 1.200, Revision 2, states that for each application that calls upon the guide, the applicant identifies the key assumptions and approximations relevant to that application. Those assumptions and approximation were used to identify sensitivity studies as input to the decisionmaking associated with the application. RG 1.200, Revision 2, defines the terms key assumption and key source of uncertainty in the same section of the guidance. In Section 5.0 of Attachment 2 to the enclosure to the submittal, the licensee described the key assumptions and approximations, including principal sources of uncertainty identified from a review of the licensees internal events PRA. The NRC staff concludes that the licensee has identified key assumptions and sources of uncertainty consistent with the guidance in RG 1.200, Revision 2, and has adequately addressed them for this application.

As a result of its review of the submittal, as supplemented, the NRC staff concludes that the Harris TMRE PRA is acceptable for this application because (1) the internal events model which is the base for the TMRE PRA is technically acceptable, (2) the licensee has appropriately considered specific SRs that were identified as being important to the TMRE PRA development, and (3) the licensee has appropriately identified key assumptions and adequately addressed them for this application. Therefore, quantitative results obtained from the Harris TMRE PRA model along with appropriate sensitivity studies can be used to demonstrate that the incremental risk, due to SSCs that are unprotected from tornado-generated missiles per the licensees CLB, meets the acceptance guidelines in RG 1.174, Revision 2.

3.6.2 Comparison of PRA Results with Acceptance Guidelines The licensee presented the change in risk between the degraded case (i.e., current plant) in which nonconforming SSCs are modeled as vulnerable to a tornado missile and the compliant

plant case in which the plant is in full compliance with its design-basis tornado-generated missile protection requirements. The approach for calculation of the change in risk captures the incremental risk from leaving the nonconforming SSCs unprotected (i.e. in the current as-is condition). The licensee presented the quantification results from its TMRE PRA in the supplement dated September 19, 2018. Based on the information in that section of the submittal, the compliant-case CDF and LERF were 5.23 x 10-7/year and 5.55 x 10-8/year, respectively. The corresponding metrics for the degraded case were 5.46 x 10-7/year and 5.78 x 10-8/year, respectively. Consequently, the licensee reported the change in risk from the tornado-missile non-conformances as 2.3 x 10-8/year for CDF and 2.3 x 10-9/year for LERF.

Those results meet the guidelines for very small change in risk in RG 1.174, Revision 2 (i.e.,

Region III). Per the guidance in RG 1.174, Revision 2, the total base CDF and LERF need not be reported for very small increases in risk.

3.6.3 Uncertainty and Sensitivity Analyses Regulatory Position 2 in RG 1.174, Revision 2 states that the licensee should appropriately consider uncertainty in the analysis and interpretation of findings. Regulatory Position 3 states that decisions concerning the implementation of licensing basis changes should be made after considering the uncertainty associated with the results of the traditional and probabilistic engineering evaluations.

Section 7.2.1, TMRE Missile Distribution Sensitivity, of NEI 17-02, Rev. 1A identified certain sensitivity studies and provided guidance on their performance. Section 3.3.9, Conservative Risk Treatments Masking Sensitivity, of Enclosure 1 to the submittal described the sensitivity studies performed by the licensee to support this application. The guidance provided in Appendix A of NEI 17-02, Rev. 1 indicated that the sensitivity studies should be performed by changing the EEFP in the model representing the degraded case.

Section 3.3.9 of Enclosure 1 to the submittal provided discussions on the sensitivities performed by the licensee in support of the application. The licensee evaluated the impact of conservatism in the assumptions in the compliant case on the change in risk quantification and the impact of higher missile count to account for temporary construction missiles near the licensees site. The sensitivity to address the impact of conservatism in the compliant case used a bounding approach that set the results of the compliant case to zero, which resulted in the change in risk being equal to the quantified risk of the degraded case. The sensitivity to determine the impact of temporary construction missiles doubled the missile count for both the complaint and degraded cases compared to the corresponding base cases. The licensee demonstrated that the change in risk between the degraded case and the compliant plant case for each sensitivity assessment was within the thresholds for very small change per the acceptance guidelines in RG 1.174, Revision 2.

The NRC staff requested that the licensee identify the nonconforming conditions and vulnerabilities that met all the characteristics of a highly exposed SSC. In the supplement dated October 19, 2017, the licensee provided a list of nonconforming conditions and vulnerabilities modeled in the licensees TMRE PRA that met all the characteristics of a highly exposed SSC per the criteria in Section 7.2.1 of NEI 17-02, Rev. 1A. The list also provided the basis for SSCs that were not highly exposed. The NRC staff finds that the list provided by the licensee is comprehensive and correctly identifies SSCs as highly exposed per the criteria in Section 7.2.1, TMRE Missile Distribution Sensitivity, of NEI 17-02, Rev. 1A.

The NRC staff questioned how uncertainties associated with the impact of the missile distribution on the licensees target hit probability are handled. In the supplement dated October 19, 2017, the licensee stated that the sensitivity analysis used to address the uncertainties associated with the impact of missile distribution on the MIP values was updated.

In the updated approach provided in Enclosure 3 to the supplement dated September 19, 2018, the basic event failure probabilities of SSCs with a tornado missile failure basic event Risk Achievement Worth (RAW) importance measure greater than 2 would be multiplied by 2.75 for tornado categories F4, F5, and F6. In addition, an MIP multiplier, to determine a target specific MIP, would also be calculated if a large number of missiles were close to such targets.

In Enclosure 3 to the supplement dated September 19, 2018, the licensee provided an updated version of NEI 17-02, Rev. 1 (i.e., Rev. 1B), which defined a large number of missiles as greater than 1,100 missiles within 100 ft. of the target. According to Section A.7.6 of NEI 17-02, Rev.

1B, the selection of 100 ft. as the region of consideration is based on engineering judgement and the choice of 1,100 missiles was based on an approximate missile density of 2.75 times the average missile density based on 240,000 missiles, the generic total number of missiles used in TMRE, within a 2,500 ft. radius. Section 7.2.1 of NEI 17-02, Rev. 1B provides the method for calculating the target specific MIP. The licensee stated that the reason for introducing the consideration of nearby missiles was that the risk associated with a highly exposed and risk significant target with a large concentration of nearby missiles may be underestimated using the multiplier of 2.75. The sensitivity analysis would be performed by applying either the generic MIP multiplier of 2.75 or the target specific MIP multiplier to the appropriate basic events, recalculating the CDF and LERF, and comparing the results to the RG 1.174 acceptance criteria.

The NRC staff finds that the approach to calculating the thresholds for the large number of missiles and the close proximity to SSCs to be acceptable for this application, because an assessment of EPRI NP-768 data by the NRC staff shows that the most missile impacts come from missiles that are within 100 ft. of a target. Therefore, the NRC staff concludes that the licensees revised approach to perform a sensitivity analysis to address the uncertainties associated with the impact of missile distribution on the MIP values is acceptable, because it accounts for plant-specific variations in missile populations in the vicinity of target SSCs.

The NRC staff notes that Section 7.2.1 of NEI 17-02, Rev. 1A includes qualitative factors that could be used to justify not applying a higher target specific MIP. The licensee has not used such qualitative factors, including the examples in Section 7.2.1 of NEI 17- 02, Rev. 1A, and therefore, the NRC staff has not reviewed the acceptability of those qualitative factors for application in the TMRE methodology for Harris.

The NRC staff questioned how the importance measures are determined from the TMRE PRA model in the context of the binning approach for the tornado categories employed in the model.

In the September 19, 2018, supplement, the licensee stated that since a given SSC had a separate tornado missile basic event for each tornado intensity, the basic events for a given SSC were mutually exclusive, and it provided the approach for calculating the RAW importance measure. The approach used by the licensee and described in Section 7.2.1 of NEI 17-02, Rev.

1 determines the cumulative RAW of an SSC for the F4 through F6 tornado intensities, but does not consider the RAW importance of that SSC from the F2 and F3 intensities.

Section 7.2.1 of NEI 17-02, Rev. 1B excludes the RAW importance of SSCs from the F2 and F3 intensities in the determination of risk significant SSCs for the sensitivity analyses. In the licensees responses in the supplements dated January 11 and September 19, 2018, the

licensee stated that those tornado intensities are not affected by the sensitivity calculation. The NRC staff finds the aggregation approach used in NEI 17-02, Rev. 1A to combine the RAW importance from F4 to F6 is conservative because it accounts for cumulative importance of SSCs from those intensities. In addition, the sensitivity analyses are performed for any of the SSCs with a RAW greater than or equal to 2 for F4 to F6. Because of the conservatism in the aggregation approach and the sensitivity analyses performed for SSCs with a RAW greater than or equal to 2 for F4 to F6, excluding the RAW importance of SSCs from the F2 and F3 intensities is not expected to potentially overlook risk-significant SSCs from consideration in the sensitivity analyses. The NRC staff finds that performing the sensitivity analysis for the F4 through F6 tornado categories is appropriate for Harris, because of the higher likelihood of failure of SSCs at those categories.

The NRC staff questioned the key difference between the two TMRE sensitivities to be performed per Section 7.2.1.A, Zonal vs. Uniform Missile Distribution, and Section 7.2.1.B, Missile Impact Parameter, in NEI 17-02, Rev. 1. The licensee indicated in the supplement dated September 19, 2018, that the Missile Impact Parameter sensitivity is focused on SSCs that are highly exposed, and the criteria for determining a highly exposed target is provided in Section 7.2.1 of NEI 17-02, Rev. 1B. The licensee stated that the revised sensitivity approach for the Zonal vs. Uniform Missile Distribution, included the criteria for the highly exposed SSCs, thereby obviating the need for aggregating the two sensitivities. The NRC staff concludes that the licensees revised approach for the Zonal vs. Uniform Missile Distribution, as discussed above, captures the uncertainty associate with the MIP values for highly exposed SSCs and therefore, a separate sensitivity for that parameter is not required for this application.

The NRC staff questioned if the change in risk from a future TMRE revision by the licensee, or any of the required sensitivity studies, exceeded the acceptance guidelines of RG 1.174, Revision 2 for very small change in risk, whether the methodology would require prior NRC approval. The licensee indicated that prior NRC approval would be required if the licensee could not reduce the change in risk with refinements. The NRC staff notes that according to Section 7.3 of NEI 17-02, Rev. 1, the TMRE analysis inputs may be refined within the scope of the TMRE methodology in cases where the very small change acceptance guidelines in RG 1.174, Revision 2 were exceeded. In the submittal dated September 19, 2018, the licensee clarified that the refinements that may be pursued include TMRE model inputs (e.g., correlation modeling, shielding, and robust missile percentages) and PRA model updates (e.g., refined system modeling and data updates). The NRC staff finds the licensees approach acceptable because it (1) relies on refinements that are within the scope of the licensees PRA model configuration control process consistent with the RG 1.174 guidelines, and (2) will result in NRC staff review for cases where the refinements are unsuccessful, and prior NRC approval is required under the criteria in 10 CFR 50.59(c).

The NRC staff finds that the incremental risk from not protecting the nonconforming SSCs against tornado missile damage is very small per the acceptance guidelines in RG 1.174, Revision 2. Further, the NRC staff finds that the results are robust relative to the uncertainties involved because sensitivity studies have demonstrated that the LARs acceptability would not be changed due to the uncertainties. Therefore, principle 4 of risk-informed decisionmaking is met.

3.7 Key Principle 5: Performance Measurement Strategies - Implementation and Monitoring Program Regulatory Position 3 in RG 1.174, Revision 2, states that careful consideration should be given to implementation of the proposed change and the associated performance-monitoring strategies. This regulatory position further states that an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This will ensure that the conclusions that have been drawn from the evaluation remain valid.

The NRC staff finds that changes over time to the plant and to the PRA can potentially affect the conclusions of risk-informed applications even though the PRA quality and level of detail has been shown to be adequate. As described in the submittal, the licensee has administrative controls in place to ensure that the PRA models support the application and reflect the as-built, as-operated plant over time. The process includes provisions for monitoring issues affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operational experience), for assessing the risk effect of unincorporated changes, and for controlling the model and associated computer files. The process also includes reevaluating the tornado-missile risk of nonconforming SSCs previously calculated to ensure the continued validity of the results.

Section 8.1, Plant Configuration Changes, of NEI 17-02, Rev. 1B, states that design control programs meeting 10 CFR Part 50 Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, will ensure subsequent plant configuration changes were evaluated for their impact on nonconforming SSC risk using TMRE. Section 8.1 also states that licensees should ensure that they have sufficient mechanisms to assure that plant changes that increase the site missile burden are evaluated for impact to the TMRE analysis results.

Section 4.1, Applicable Regulatory Requirements/Criteria, of the enclosure to the submittal dated October 19, 2017, states that the licensee has confirmed that the risk-informed change process assures that any significant permanent changes to site missile sources, such as a new building, warehouse, or laydown area, are evaluated for impact to the TMRE basis, even if not in the purview of the site design control program.

The NRC staff questioned the mechanism(s) and approach(es) that would be followed by the licensee to determine whether a particular change to the facility is significant for evaluation of the impact to the TMRE basis. In the September 19, 2018, supplement, the licensee stated that changes that have the potential to increase the missile count above that considered in the current TMRE analysis are considered significant. The licensee also stated that such changes would be managed consistent with Section 8, Performance Monitoring, in NEI 17-02, Rev. 1B, which included clarifications to NEI 17-02, Rev. 1 in several parts of that section. The clarifications to Section 8 of NEI 17-02, Rev. 1B, state that the licensee will ensure, via applicable station procedures and processes, that plant changes that result in an increase to the site missile burden are evaluated for impact on the TMRE analysis results. Further, permanent changes within the 2500 ft missile radius that increase the site missile burden beyond that used for the TMRE analysis should be incorporated into the TMRE analysis prior to making the permanent change. In addition, Section 8.1, Plant Configuration Changes, clarified that changes to previous nonconforming SSCs that would increase the target EEFP (e.g., affect the target exposed area by increasing the exposed exhaust pipe height, or affect a robust missile percentage by changing the pipe material or thickness) were not allowed under TMRE.

The NRC staff questioned the mechanisms in place to ensure temporary and permanent changes to site missile sources will be evaluated. In the September 19, 2018, supplement, the licensee explained that its engineering procedures contain screening criteria to notify its PRA organization if a proposed change has the potential to affect any tornado-generated missile protection feature or create a source of tornado-generated missiles not bounded by existing analysis. The licensee indicated that upon notification of a change that may introduce the possibility of a new source of tornado-generated missiles that are not bounded by the existing analyses, the licensees PRA organization will manage the change in accordance with licensees approved TMRE methodology, which requires prior NRC approval to be sought should certain thresholds be exceeded, in accordance with 10 CFR 50.59(c)(2). The NRC staff finds the licensees procedures for determining significant changes and assuring temporary as well as permanent changes are evaluated to be acceptable.

Section 8.1, Plant Configuration Changes, in NEI 17-02, Rev. 1B, states that in case the TMRE analysis needs to be updated, the most recent internal events model would be used for the analysis and the most recent revision of NUREG/CR-4461 would be used for the tornado-initiating event frequencies. The NRC staff questioned the process(s) intended to ensure changes that could affect Harris TMRE results (e.g., plant design changes, changes made to the licensees base internal events PRA model, and new information about the tornado hazard at the plant) will be considered in future implementation of the licensees TMRE. In the supplement dated September 19, 2018, the licensee stated that changes that could affect its TMRE results (e.g., plant design changes, changes made to the licensees base internal events PRA model, and new information about the tornado hazard at the plant) would be considered in future implementation of the licensees TMRE in accordance with the guidance in NEI 17-02, Rev. 1B. The NRC staff finds that the licensees plant-specific use of the guidance in Section 8.1 of NEI 17-02, Rev. 1B is acceptable. The most recent internal events PRA model and site-specific tornado hazard information would be used for future TMRE analysis updates.

The NRC staff questioned the licensee about the treatment of the currently identified nonconforming conditions in future uses of the licensees TMRE PRA model. In the supplement dated September 19, 2018, the licensee indicated that targets treated as nonconforming in the initial application of the TMRE would continue to be considered nonconforming in future revisions of the TMRE model by the licensee. The licensee further indicated that exceptions to this approach may be taken where the targets:

Have been physically protected in such a way that they would no longer be considered nonconforming at the time of the revision and can be removed from the TMRE analysis; or Were conservatively treated as nonconforming in the initial analysis but had not been identified as nonconforming during walkdowns; or Would not otherwise be considered nonconforming at the time of the revision because engineering calculations have demonstrated that they are conforming.

Section 8.1 of NEI 17-02, Rev. 1B, includes the first and third of these possible exceptions from considering targets that were treated as nonconforming in the initial application of the TMRE as nonconforming in future revisions of the TMRE model. The NRC staff finds the licensees treatment of nonconforming SSCs in the initial application of the TMRE as nonconforming in future revisions of the TMRE model to be acceptable because it continues to capture the incremental risk from those SSCs, which will be non-protected due to the use of the TMRE

methodology. The NRC also staff finds the licensees proposed use of exceptions in Section 8.1 of NEI 17-02, Rev. 1B, to be acceptable because they represent appropriate plant-specific approaches to negate the previously identified nonconformance of an SSC. The NRC staff notes that the engineering calculations to demonstrate conformance of a previously nonconforming SSC must be consistent with the licensees CLB and regulations governing the extent of permitted changes to the licensing bases without prior NRC approval (e.g.,

10 CFR 50.59).

Additionally, the NRC staff questioned how the cumulative risk associated with unprotected SSCs evaluated under TMRE will be considered in future decisionmaking (e.g., 10 CFR 50.59 criteria as well as in future risk-informed submittals). In the supplement dated September 19, 2018, the licensee indicated that Section 8.3, TMRE Results and Cumulative Risk, was revised in NEI 17-02, Rev. 1B, to clarify how the risk associated with unprotected SSCs evaluated under TMRE would be considered in future decisionmaking (e.g.,

10 CFR 50.59 criteria as well as in future risk-informed submittals). The revised version of Section 8.3 in NEI 17-02, Rev. 1B, includes a statement that licensees may need to consider, as appropriate, the risk associated with previous nonconforming conditions that remain unprotected against tornado missile impacts in future risk-informed decisionmaking activities.

As discussed above, the licensee described its approach if performance-monitoring programs indicate that the risk acceptance guidelines for very small change in risk in RG 1.174, Revision 2, were exceeded, in its September 19, 2018, supplement. As further discussed above, the NRC staff reviewed the licensees approach and found it to be acceptable. The NRC staff concludes that the cumulative risk associated with previous nonconforming conditions that remain unprotected against tornado missile need to be considered by the licensee in future decision making and in accordance with 10 CFR 50.59, and prior NRC approval would be required where appropriate under 10 CFR 50.59(c).

The NRC staff concludes that the licensees PRA maintenance and monitoring program is sufficient to track the as-built, as-operated condition of the plant and the performance of equipment that when degraded can affect the conclusions of the licensees risk evaluation and integrated decisionmaking that support the change to the licensing basis. The NRC staff notes that the licensee stated that the TMRE will not be used for nonconforming conditions created as a result of future modifications without separate review and approval by the NRC. The NRC staff considers this commitment to be appropriate, subject to the evaluation criteria set forth in 10 CFR 50.59(c).

3.8 Methodology Conclusion The NRC staff has reviewed the licensees evaluation of the risk from tornado missiles to identified nonconforming SSCs. The licensees process is consistent with the guidance in NEI 17-02, Rev. 1B. The licensees results for tornado-missile risk from nonconforming SSCs meet the risk acceptance guidelines of RG 1.174. The NRC staff finds the SSCs that do not conform to the current tornado-missile protection licensing basis can potentially remain in as-built conditions. Specifically, the NRC staff has found that the licensees risk evaluation Is based on an acceptable internal events PRA which has been subjected to a peer review process assessed against the PRA standard and is based on a TMRE PRA that has been acceptably developed;

Determines risk from tornado-missiles for nonconforming SSCs that results in an integrated, systematic process that reasonably reflects the current plant configuration and operating practices, and applicable plant and industry operational experience; Maintains defense-in-depth and safety margins; Includes evaluations that provide reasonable confidence that the risk of accepting currently nonconforming tornado-missile protection is acceptable and that any potential increases in CDF and LERF resulting from uncertainty in treatment are small; and Includes provisions for future sensitivity studies and the periodic reviews of the tornado-missile risk of nonconforming SSCs to ensure the risk remains acceptably low.

Therefore, the NRC staff concludes that the licensees evaluation demonstrates that the tornado-missile risk from nonconforming SSCs is acceptably low as it meets the risk acceptance guidelines of RG 1.174.

The NRC staff finds that the SSCs identified in the licensees submittal (as summarized in Section 1.1 of this SE), which do not currently conform to the tornado-missile protection licensing basis, can remain in their as-built condition. The licensee has demonstrated that these nonconforming conditions are not likely to adversely affect the ability of SSCs important to safety to withstand the potential effects of extreme winds and missiles associated with such winds on plant SSCs important to safety. Further, the licensee has demonstrated that SSCs important to safety will likely be capable of performing their safety functions during and following a tornado. Accordingly, the current condition of these nonconforming SSCs does not affect the NRC staffs finding of reasonable assurance that SSCs important to safety will be capable of performing their safety functions during and following a tornado.

3.9 Deviations from the TMRE Methodology The NRC staff found that the licensees proposed plant-specific implementation of the TMRE methodology is acceptable to justify not providing physical tornado-missile protection to nonconforming SSCs (i.e., SSCs that should have such protection according to the plant-specific licensing basis but, in reality, do not). The NRC staff notes that the licensees approaches in addressing the following issues, which constitute deviations from the corresponding approaches in NEI 17-02, Rev. 1B, were important to the NRC staffs evaluation of this application and will apply to the future use of the TMRE methodology at Harris, specifically:

While Section 3.3, Ex-Control Room Action Feasibility, of NEI 17-02, Rev. 1B recommends only a feasibility evaluation, the licensee performed a more detailed evaluation of operator actions after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of the occurrence of the tornado outside Category I structures or require transit outside Category I structures to reach the location of the action. The licensee credited only one action outside Category I structures or requiring transit outside Category I structures, which had an extended time for completion. Therefore, the licensee did not use the considerations for not changing the HEP of actions involving transit or operation outside Category I structures more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the tornado event from Section A.2.1.2 of NEI 17-02, Rev. 1B.

While NEI 17-02, Rev. 1B, provided qualitative considerations and two examples of situations where qualitative factors could preclude the need to apply a higher

target-specific MIP, the licensee chose not use those considerations. The NRC staff did not review the acceptability of those factors as part of this application. Therefore, use of the qualitative considerations and examples is not considered as part of the TMRE approval for Harris.

The licensee did not request to implement the approach in NEI 17-02, Rev. 1B, to calculate the RAW importance measure to determine the SSCs for inclusion in the sensitivities described in Section 7.2.1 of NEI 17-02, Rev. 1B. As such, the licensee did not provide a justification to determine the acceptability of that approach for this application; therefore, approval of that NEI approach is not considered as part of the NRC staffs TMRE approval for Harris.

3.10 Scope and Limitations of Application of the TMRE Methodology The NRC staff notes that its approval of the TMRE methodology for Harris applies only to discovered conditions where tornado-missile protection was required by the CLB and was not provided, as set forth in the licensees LAR. Accordingly, this methodology cannot be used to remove existing tornado-missile protection, or to avoid providing tornado-missile protection during reviews done in support of future plant modifications, as any such actions are beyond the scope of the application reviewed and evaluated by the staff.

Section 3.4, Technical Evaluation Conclusion, of the enclosure to the licensees October 19, 2017 submittal states that the TMRE methodology could be used to resolve those nonconforming conditions by revising the CLB under 10 CFR 50.59, Changes, tests and experiments, provided the acceptance criteria are satisfied and conditions stipulated by the NRC staff in the safety evaluation approving the requested amendment are met. In this regard, the NRC staff notes that the TMRE methodology can only be applied when conditions are discovered where tornado-missile protection was required by the CLB and not provided. It cannot be used to avoid providing tornado-missile protection to remove existing tornado missile protection or in the plant modification process. Therefore, future changes to the facility that affect physical tornado-missile protection must not be evaluated using the TMRE methodology, without performing the appropriate safety analysis and/or obtaining prior NRC approval, as required by 10 CFR 50.59(c).

As described in the licensees September 19, 2018, supplement, for future implementation of this methodology, unless the apparent change in risk cannot be reduced with refinements within the scope of the licensees approved TMRE methodology, the licensee will need to perform an appropriate analysis under 10 CFR 50.59 or obtain prior NRC approval should the delta CDF or delta LERF values or any of the required sensitivity studies in NEI 17-02, Rev. 1B, exceed the acceptance guidelines for Region III (very small change) of RG 1.174.

The NRC staff notes that all proposed changes not within the scope of this plant-specific approved methodology as described in this safety evaluation must be evaluated in accordance with the criteria in 10 CFR 50.59.

Additionally, it should be noted that the NRC staffs review of NEI 17-02, Rev. 1B reflects a review of the applicability and implementation of TMRE methodology for Shearon Harris Nuclear Power Plant, Unit 1, only.

4.0 STATE CONSULTATION

In accordance with the Commissions regulations, the State of North Carolina official was notified of the proposed issuance of the amendment on January 25, 2019. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendment changes a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendment involves no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment on such finding (83 FR 6221; February 13, 2018). Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

7.0 REFERENCES

1. Jones, Bentley K., Duke Energy Process, LLC, letter to U.S. Nuclear Regulatory Commission, License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis, dated October 19, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17292B648).

2. Jones, Bentley K., Duke Energy Process, LLC, letter to U.S. Nuclear Regulatory Commission, License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis - Supplement Regarding De Minimis Penetrations (EPID L-2017-LLA-0355), dated January 11, 2018 (ADAMS Accession No. ML18011A911).

3. Jones, Bentley K., Duke Energy Process, LLC, letter to U.S. Nuclear Regulatory Commission, License Amendment Request to Incorporate Tornado Missile Risk Evaluator into Licensing Basis - Supplement and Request for Additional Information Response (EPID L-2017-LLA-0355), dated September 19, 2018 (ADAMS Accession Nos. ML18262A328).

4. U.S. Nuclear Regulatory Commission, Regulatory Issue Summary 2015-06, Tornado Missile Protection, dated June 10, 2015 (ADAMS Accession No. ML15020A419).

5. Nuclear Energy Institute, NEI 17-02, Rev. 1, Tornado Missile Risk Evaluator (TMRE)

Industry Guidance Document, dated September 21, 2017 (ADAMS Accession No. ML17268A036).

6. Brown, Eva A., U.S. Nuclear Regulatory Commission, letter to Cheryl A. Gayheart, Southern Nuclear Operating Company, Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments to Utilize the Tornado Missile Risk Evaluator to Analyze Tornado Missile Protection Nonconformances, dated January 11, 2019 (ADAMS Accession No. ML18304A394).

7. Gayheart, Cheryl A., Southern Nuclear Operating Company, Inc., letter to U.S. Nuclear Regulatory Commission, Vogtle Electric Generating Plant - Unit 1 and 2, Tornado Missile Risk Evaluator, SNC Response to NRC Request for Additional Information, dated July 26, 2018; includes NEI 17-02, Rev. 1A, Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document, July 2018 (ADAMS Accession No. ML18207A876).

8. Gayheart, Cheryl A., Southern Nuclear Operating Company, Inc., letter to U.S. Nuclear Regulatory Commission, Vogtle Electric Generating Plant - Unit 1 and 2, Tornado Missile Risk Evaluator, SNC Response to NRC Request for Additional Information, dated September 14, 2018 (ADAMS Accession No. ML18260A053).

9. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.76, Revision 1, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, March 2007 (ADAMS Accession No. ML070360253).

10. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 3.5.1.4, Revision 4, Missiles Generated by Extreme Winds, March 2015 (ADAMS Accession No. ML14190A180).

11. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 3.5.2, Revision 3, Structures, Systems, and Components to be Protected from Externally-Generated Missiles, March 2007 (ADAMS Accession No. ML070460362).

12. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.117, Revision 2, Protection against Extreme Wind Events and Missiles for Nuclear Power Plants, July 2016 (ADAMS Accession No. ML15356A213).

13. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, Revision 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, May 2011 (ADAMS Accession No. ML100910006).

14. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, March 2009 (ADAMS Accession No. ML090410014).

15. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 19.1, Revision 3, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load, September 2012 (ADAMS Accession No. ML12193A107).

16. NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 19.2, Revision 0, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis:

General Guidance, June 2007 (ADAMS Accession No. ML071700658).

17. American Society for Mechanical Engineers/American Nuclear Society, ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008, ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, February 2009.

18. U.S. Nuclear Regulatory Commission, NUREG/CR-4461, Revision 2, Tornado Climatology of the Contiguous United States, February 2007 (ADAMS Accession No. ML070810400).

19. Markee, E. H., Jr., J. G. Beckerley, and K. E. Sanders. 1974. Technical Basis for Interim Regional Tornado Criteria. WASH-1300, U.S. Atomic Energy Commission, Washington, D.C.

20. Electric Power Research Institute, EPRI NP-768, Tornado Missile Risk Analysis, May 1978 (ADAMS Accession No. ML13073A158).

21. Wermiel, J. S., memorandum to Public Document Room, U.S. Nuclear Regulatory Commission, Electric Power Research Institute (EPRI Reports (EPRI N-768, 769, and 2005, Volumes 1 and 2) Concerning Tornado Missile Probabilistic Risk Assessment (PRA) Methodology and Corresponding Safety Evaluation Report, dated November 29, 1983 (ADAMS Legacy Accession No. 8312140192).

22. Electric Power Research Institute, EPRI NP-769, Tornado Missile Risk Analysis Appendixes, May 1978.

23. Rosenberg, S. L., Memorandum to Risk Informed Steering Committee, U.S. Nuclear Regulatory Commission, U.S. Nuclear Regulatory Commission Staff Expectations for an Industry Facts and Observations Independent Assessment Process, dated May 1, 2017 (ADAMS Accession No. ML17121A271).

24. Pensado, Osvaldo, Southwest Research Institute, Analysis of Missile Impact Probability for Generic Tornado Hazard Assessment, dated July 29, 2016 (ADAMS Accession No. ML16223A954).

Principal Contributors: M. Reisi-Fard S. Vasavada G. Curran Date: March 29, 2019