MNS-17-026, Submittal of License Amendment Request Proposing to Revise the Bases for Protection from Tornado-Generated Missiles

Submittal of License Amendment Request Proposing to Revise the Bases for Protection from Tornado-Generated Missiles

ML17352A404
Person / Time
Site:	Mcguire, McGuire
Issue date:	12/08/2017
From:	Teresa Ray Duke Energy Carolinas
To:	Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML17352A364	List: MNS-17-026, Submittal of License Amendment Request Proposing to Revise the Bases for Protection from Tornado-Generated Missiles
References
MNS-17-026
Download: ML17352A404 (51)

Text

Thomas D. Ray, P.E.

(_~ DUKE Site Vice President ENERGY McGuire Nuclear Station Duke Energy MGOlVP I 12700 Hagers Ferry Road Huntersville, NC 28078 0: 980.875.4805 f: 980.875.4809 Tom. Ray@duke-energy.com Serial No. MNS-17-026 10 CFR 50.90 December 8, 2017 U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 ATTENTION : Document Control Desk Duke Energy Carolinas, LLC McGuire Nuclear Station, Units 1 and 2 Docket Nos. 50-369 and 50-370 Renewed License Nos. NPF-9 And NPF-17

Subject:

License Amendment Request Proposing to Revise the McGuire Licensing Bases for Protection from Tornado-Generated Missiles Pursuant to 10 CFR 50.90 , Duke Energy Carolinas , LLC (Duke Energy) hereby submits a license amendment request (LAR) for McGuire Nuclear Station (MNS), Units 1 and 2. This request for amendment proposes to revise the MNS Updated Final Safety Analysis Report (UFSAR) to describe the methodology and results of the analyses performed to evaluate the protection of the plant's structures, systems and components (SSCs) from tornado generated missiles. The analysis is consistent with the guidance provided in Regulatory Issue Summary (RIS) 2008-14, "Use of TORMIS Computer Code for Assessment of Tornado Missile Protection ."

Enclosure 1 provides an evaluation of the propos.ed change . Enclosure 2 provides marked up pages of the McGuire UFSAR, in order to reflect the proposed change . The UFSAR markups include a list of plant tornado missile targets considered in the analysis. Enclosure 3 provides a list of plant tornado missile targets excluded from the scope of the analyses . Enclosure 4 provides photographs of site features including the TORM IS targets . The proposed amendment does not involve a change to any Operating License Condition or Technical Specifications.

Enclosure 4 provides photographs of site features to support the LAR. Due to the security sensitive nature of the photographs, Duke Energy requests that Enclosure 4 be withheld from public disclosure pursuant to 10 CFR 2.390( d)( 1). Duke Energy classifies these photographs as Sensitive Unclassified Non-Safeguard Information (SUNSI). When Enclosure 4 is separated from the remainder of the LAR, this LAR is de-controlled. ;1 DD /

~t-f www.duke-energy.com

U.S. Nuclear Regulatory Commission MNS-17-026 Page 2 The proposed change has been evaluated in accordance with 10 CFR 50.91 (a)(1) using criteria in 10 CFR 50 .92(c), and it has been determined that the proposed change involves no significant hazards consideration . The bases for these determinations are included in .

NRC approval of this LAR is requested within one year of the date of acceptance of this submittal. Once approved , the LAR will be implemented within 120 days.

In accordance with 10 CFR 50.91, Duke Energy is notifying the State of North Carolina of this LAR by transmitting a copy of this letter and enclosures to the designated officials.

There are no new regulatory commitments contained in this letter.

Should you have any questions concerning this LAR, or require additional information, please contact Jeff Thomas at 980-875-4499.

I declare under penalty of perjury that the foregoing is true and correct. Executed on December 8, 2017.

Sincerely, Thomas D. Ray Vice President McGuire Nuclear Station

Enclosures:

1. Evaluation of the Proposed Change

2. UFSAR Proposed Changes

3. List of Targets Excluded

4. Photographs of Site Features including the TORMIS Targets

U.S. Nuclear Regulatory Commission MNS-17-038 Page 3 cc:

C. Haney Region II Administrator U.S. Nuclear Regulatory Commission Marquis One Tower 245 Peachtree Center Avenue NE, Suite 1200 Atlanta , GA 30303-1257 M. Mahoney Project Manager (MNS)

U.S. Nuclear Regulatory Commission 11555 Rockville Pike Mail Stop 8 G9A Rockville , MD 20852-2738 G.A. Hutto NRC Senior Resident Inspector McGuire Nuclear Station W.L. Cox, Ill Section Chief, North Carolina Department of Health and Human Services Division of Health Service Regulation Radiation Protection Section 1645 Mail Service Center Raleigh , NC 27699-1645

Enclosure 1 Evaluation of the Proposed Change

Subject:

License Amendment Request Proposing to Revise the McGuire Licensing Bases for Protection from Tornado-Generated Missiles

1.

SUMMARY

DESCRIPTION

2. DETAILED DESCRIPTION 2.1 Current Licensing Basis for Tornado Missile Protection 2.2 Condition Proposed Change is Intended to Resolve 2.3 Need for Proposed Change 2.4 Overview of the TORM IS Methodology and Analysis Results

3. TECHNICAL EVALUATION 3.1 TORMIS Methodology and Analysis Results 3.2 Five Points from 1983 TORMIS Safety Evaluation Report 3.3 Issues from RIS 2008-14 Regarding TORMIS Methodology

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria 4.2 Precedent 4.3 No Significant Hazards Consideration Determination 4.4 Conclusions

5. ENVIRONMENTAL CONSIDERATION

6. REFERENCES 1

Enclosure 1

1.

SUMMARY

DESCRIPTION The proposed changes would revise the McGuire Nuclear Station (MNS) Current Licensing Basis as reflected in the Updated Final Safety Analysis Report (UFSAR) to describe the methodology and results of the analysis performed to evaluate the protection of the plants' structures, systems and components (SSCs) from tornado generated missiles. The MNS analysis utilized a probabilistic approach implemented through the application of the TORM IS software program as described in Regulatory Issue Summary {RIS) 2008-14 (Reference 1).

There are no Technical Specifications changes associated with this request.

2. DETAILED DESCRIPTION This License Amendment Request (LAR) proposes to update the Current Licensing Basis (CLB) in the MNS UFSAR with an analysis performed using an updated version of the TORM IS computer code. The analysis was performed in accordance with the guidance provided in the 1983 TORMIS Safety Evaluation Report (SER) (Reference 2), as clarified by RIS 2008-14 (Reference 1). The results from the MNS TORM IS analysis will be used to credit equipment that does not fully comply with regulatory requirements for tornado missile protection.

2.1 Current Licensing Basis for Tornado Missile Protection The MNS CLB for tornado missile protection is presented in UFSAR Sections 3.5.1.3 and 3.5.2.8. These sections state in part; All Category 1 structures exposed to the probable tornado generated missiles tabulated in UFSAR Table 3-8 are designed to withstand their effect. The integrity of all Category 1 structures is not impaired by these missiles. This is accomplished by designing the exposed structure of steel reinforced concrete capable of withstanding the impact of tornado generated missiles. LAR Section 2.2 below describes site features that are not entirely tornado missile protected.

2.2 Conditions Proposed Change is Intended to Resolve Each MNS Reactor Building has two Main Steam Doghouses, an interior and exterior. Each Doghouse is a free-standing reinforced concrete structure composed of concrete frames, slabs, and walls. The Doghouses provide environmental shielding and missile protection for the main steam lines and safety valves (MSSV), steam generator power operated relief valves (PORVs),

main steam isolation valves (MSIV), Turbine Driven Auxiliary Feedwater (TD AFW) exhaust piping (TE), and the feedwater lines and isolation valves (CFIV). Each Doghouse has ventilation openings or windows on three sides under "gull wing walls" near the top . See Enclosure 4 for photographs of the Doghouses and TORM IS targets.

In September 2009, while preparing for the NRC Component Design Basis Inspection (CDBI), it was identified that the TD AFW TE piping projected slightly outside of the gull wing walls of the interior Doghouses. While investigating the design basis and requirements of the TE piping, Engineering discovered that there were other potential tornado missile targets in the Doghouse window openings (PORVs, MSSVs) and components located behind exterior doors. The components in the top of the Doghouses are somewhat protected from missiles by the heavy roof and gull wing walls. It was not obvious that the Doghouse window openings offer the desired protection from a horizontal tornado missile. A design basis search, including 2

Enclosure 1 calculations , correspondence , licenses basis documentation and specifications , did not lead to a firm position for the tornado missile protection acceptability of the current configuration . MNS determined the condition described above to be non-conforming with respect to 10 CFR 50, Appendix A, General Design Criterion (GDC) 2, "Design Basis for Protection Against Natural Phenomena .

The initial resolution plan to resolve the non-conformances was to install steel missile barriers in the Doghouse window openings up to the bottom of the gull wing walls, remove the portion of the TE piping that protrudes from the windows, and replace the exterior doors . The missile barrier modification was completed on the Unit 1 Exterior Doghouse window openings and the exterior doors on the Exterior Doghouses were replaced with missile doors (see Enclosure 4).

Due to significant cost overruns, design and installation issues, and schedule delays, the missile barrier modifications for the remaining three Doghouse windows were suspended.

The QA Condition 1 components in the Doghouse window openings that are currently unprotected from design bases horizontal tornado generated missiles are; the PORVs including upstream piping , downstream piping, and piping supports, MSSV downstream piping, and a portion of the TD AFW TE piping .

In light of the guidance provided by NRC Regulatory Issue Summary {RIS} 2015-06 (Reference 9), Duke Energy performed a walkdown of the MNS site to identify any additional tornado missile vulnerabilities . No targets were added based on the walkdown effort, however it was decided to add the Spent Fuel Pool Buildings and the Control Room Area Ventilation Air Intakes to the scope of the TORM IS analysis as discussed further below.

Summary of the Spent Fuel Pool Event Each MNS spent fuel pool is housed in a concrete and steel superstructure. The concrete superstructure encloses the spent fuel pool except for the North end of the structure, which is enclosed by a steel structure with siding . The concrete structure provides protection from turbine generator, tornado winds and tornado missiles. The North end of the spent fuel building does not provide tornado missile protection (See Enclosure 4).

As documented in the MNS UFSAR, a deterministic analysis was previously performed to determine the maximum damage to spent fuel elements and the dose consequences in the event of a postulated tornado missile entering the pool through the North end of the building .

The most critical missile is considered to be the utility pole , although not a CLB missile. The utility pole bounds each MNS CLB missile. It is assumed that the missile trajectory is unaltered until it contacts the pool floor or wall and that all fuel pins contained within the missile cross section are ruptured . With these assumptions, a maximum of thirty-eight fuel cells in Region 2 could be ruptured. The resulting doses at the EAB, LPZ, and Control Room are well within the 10 CFR 50.67 limits.

The Control Room Area Ventilation (VC/YC) System is assumed to be in service within 30 minutes of this event to limit dose to the Control Room Operators. Outside air is drawn in through the intakes and filtered .

The four VC/YC outside air intakes are located on top of the Auxiliary Building roof , two near the south end of the Unit 1 reactor building , and two near the south end of the Unit 2 reactor building (see Enclosure 4). The intakes are also susceptible to tornado missile damage. A deterministic analysis concluded that a tornado missile can only damage two outside air intakes 3

Enclosure 1 at one location based on the established travel path of tornadoes in the Southeast, the separation of the two pairs of intakes, and protection from adjacent buildings and structures.

The spent fuel pools and VC/YC outside air intakes are being added to the TORM IS analysis since they are not fully protected from CLB horizontal missiles.

2.3 Need for Proposed Change As identified above, MNS has identified existing plant SSCs that do not fully comply with the CLB for tornado missile protection and it would require costly modifications to bring the plants into compliance with the CLB. As such, a TORMIS analysis, using methodology approved by the NRC, has been performed to address the identified deficiencies.

As stated in Reference 1, the initial use of the TORM IS methodology requires a license amendment in accordance with 10 CFR 50.59(c)(2)(viii) and subsequent revision to the UFSAR because it represents a "departure from the method of evaluation."

2.4 Summary of the TORM IS Methodology and Analysis Results The tornado missile risk analysis for MNS is based on the TORMIS calculation methodology, which is defined by the TORMIS reports and computer code (References 3, 4, and 5). TORMIS uses a Monte Carlo simulation method that simulates tornado strikes on a plant. For each tornado strike, the tornado wind field is simulated , missiles are injected and flown, and missile impacts on structures and equipment are analyzed . These models are linked to form an integrated, time-history simulation methodology. By repeating these simulations, the frequencies of missiles impacting and damaging individual components (targets) and groups of targets are estimated . Statistical convergence of the results is achieved by performing multiple replications with different random number seeds. The statistical confidence bounds of the results can then be estimated using conventional methods.

Plant components identified as necessary to safely shutdown the plant and safely maintain a shutdown that are located in areas that are not fully protected by missile barriers designed to resist impact from the plant's design tornado missiles are designated as safety-related targets to be analyzed using TORMIS. The safety-related targets are identified in Section 2.2 above. This target list was modeled using 87 safety-related targets in the MNS TORMIS model. Table 2-1 summarizes the safety-related target list and the approach to modeling the targets in TORMIS.

4

Enclosure 1 Table 2-1: MNS Safety Related Unprotected Targets Number of Number of Target Type TORMIS Modeling Approach TORMIS Targets Targets PORV components , including piping upstream and downsteam from the valves and associated pipe supports, are included where they are exposed to horizontal missiles coming through the upper level 1

SG PORVs 8 (4 per unit) doghouse openings and above the roof. FEA is used 57 to determine missile impact criteria that causes plastic strains in PORV components that must remain operable .

MSSV exhausts are included where exposed to horizontal missiles coming through the upper level Piping 1 40 ( 5 exhausts doghouse openings and above the roof. FEA is used Downstream per train x 4 to determine missile impact criteria that failure of the of MSSVs 22 trains per unit MSSV exhaust supports that could allow the pipes to (aka x 2 units) either fall or swing into the MSSVs themselves, Exhausts) potentially causing an uncontrolled main steam leak.

TE System Pipes are included in the interior doghouses of each unit where exposed to horizontal Auxiliary missiles passing through the upper level doghouse Feedwater openings . These pipes are not exposed above the roof.

2 (1 per unit) 2 Pump Turbine FEA is used to determine missile impact criteria that Exhaust would either crimp the exhaust to an unacceptable extent or to cause failure of critical supports .

VC/YC Air Intakes are modeled for missile hit in TORMIS . Boolean logic is used to determine whether VC/YC Air 4 (2 per unit) the intakes for both units are impacted when damaging 4 Intakes missiles enter either spent fuel pool.

Spent Fuel Pools for each unit are modeled such that Spent Fuel missiles would have to enter from the North, metal 2 (1 per unit) 2 Pools clad , end of the Fuel Building.

Note 1: Interior components in the Unit 1 Exterior Doghouse are not modeled because these openings are protected from tornado missiles.

The resulting tornado missile hit and damage frequencies are presented below. Over 27.7 billion TORM IS tornado missile simulations have been performed for the MNS TORM IS model.

Each simulation consists of sampling and flying a missile for a simulated tornado strike on the plant. A total of 2.31 million tornado strikes on the plant were simulated in the TORMIS analysis .

Table 2-2 summarizes the damage frequencies per year for each of the target groups included in the MNS TORM IS analysis . The table also shows that the arithmetic sums of frequencies (in units of y( 1 ) for all targets affecting Unit 1 and for all targets affecting Unit 2.

5

Enclosure 1 Table 2-2: Mean Damage Frequency (yr _, ) for MNS Target Groups Target Group Unit 1 Damage Unit 2 Damage Frequency Frequency SG PORVs and MSSVs 2.42 E-07 7.13 E-07 TD AFW TE Piping 6.29 E-08 4.27 E-08 VC/YC Air Intakes and Spent Fuel Pools 5.41 E-08 Arithmetic Su m over all Target Groups 3.59 E-07 8.10 E-07 The aggregate damage frequency for each unit is within the threshold frequency of 1.0 E-06 yr _, established in the 1983 TORM IS SER (Reference 2).

3. TECHNICAL EVALUATION 3.1 TORMIS Methodology and Analysis Results 3.1.1 TORMIS Methodology Overview The TORM IS methodology was developed to estimate the frequency of tornado missile impact and damage to nuclear power plant structures and components . The TORMIS methodology has been reviewed and accepted for nuclear power plant tornado missile risk analyses , as discussed in the NRC Safety Evaluation Report (Reference 2). The NRC also issued a Regulatory Issue Summary (RIS 2008-14) in June 2008 (Reference 1) that provided additional guidance on the use of TORM IS for assessing nuclear power plant tornado missile protection.

There are four fundamental models in TORM IS: wind hazard , site facility, load effects , and systems model. These models are composed of several sub-models and require certain site, facility, and structure-specific inputs.

3.1.2 TORMIS Version Used for MNS Analysis TORM1S_ 15 was used to complete the MNS TORMIS analysis . This version of TORMIS was created to verify the functionality of and add options to the missile ricochet routine from EPRI NP-769 (Reference 4). The TORMIS_ 15 code has been verified to perform the missile ricochet analysis as documented in Reference 4 and to continue missile histories through failed barrier targets. The necessity of and details of these changes are discussed below.

The majority of the safety related targets are located inside the Doghouses and exposed to missiles through openings at the top level. These openings are bounded by large concrete columns and are partially protected by angled, "gull wing" type missile barriers. Missiles can ricochet off of these concrete surfaces and be directed towards the safety related targets inside the Doghouses.

6

Enclosure 1 In addition, the openings at the top of the Doghouses that provide a missile path to the safety related targets within are protected by Utility Port Barriers (UPBs) that consist of a welded mesh of 5/8" rebar spaced approximately 6" on center (see Enclosure 4). While these barriers cannot be qualified to resist the MNS design basis tornado missiles, they do offer considerable resistance to lightweight tornado missiles such as metal siding, wood planks, and plywood.

The unique configuration of the safety related targets within the Doghouses necessitated the use of the TORMIS ricochet routine to ensure conservatism in the TORM IS analysis. Missile ricochet has been an option in the TORMIS computer code dating back to EPRI NP-769 (References 4), however, it has not previously been used to perform a TORMIS analysis. As such, the ricochet routine was tested prior to completing this analysis to verify that it performs the ricochet analysis consistent with the original documentation . During the course of this verification, some minor adjustments to the code were required for the ricochet routine to operate properly.

The original TORMIS missile ricochet routine (References 3 and 4) redirects missiles that impact rigid surfaces with a reduced velocity. An additional code change was made to credit the ability of non-qualified barriers (such as the UPBs in the MNS Doghouses) to resist or slow down missiles impacting these barriers. This change uses the existing TORMIS structural response damage and ricochet routines to continue a missile history through a non-qualified barrier when the missile failure velocity of the barrier is exceeded . The reduced missile velocity for continuing missiles is calculated based on the expected change in kinetic energy of the missile as it passes through the barrier, which must be determined with an off-line deterministic analysis, such as a finite element analysis. This code change created a new target type called "Missile Pass Through" or "MPT" targets.

The missile pass through option was implemented without modifying the TORMIS physics engine in the IMPACT, HIT, or TRAJEC Subroutines. This approach improves the functionality of the ricochet routine to account for missiles that can get through non-qualified missile barriers.

This change allows for such barriers to be considered for their inherent missile resistance in a similar manner to safety related targets.

The final TORMIS_ 15 computer code was verified to operate consistently with the original TORMIS documentation and as designed for the missile pass through changes. This verification included benchmarking runs made showing that the code produces identical results for past projects completed with earlier versions of the code . The TORMIS_ 15 code was also run for the hypothetical plant model published in EPRI NP-2005 (Reference 5) and shown to produce results that are statistically consistent with published results .

3.1.3 Tornado Missile Risk Analysis Overview The MNS TORMIS analysis has been completed in accordance with NRC requirements and includes over 27.7 billion TORMIS tornado missile simulations. Each simulation consists of sampling and flying a missile for a simulated tornado strike on the plant. A total of 2.31 million tornado strikes on the plant were simulated in each of the TORM IS models. The details of the model development and execution are documented in a MNS calculation and include the following steps:

7

Enclosure 1

1. Site specific analysis to develop a tornado hazard curve for MNS based on data from the NOAA Storm Prediction Center. Further details of this analysis are provided in response to SER Point No.1 in Section 3.2.

2. Development of potential missile inventory based on results from missile survey walkdowns and review of plant drawing and aerial photographs. Further details are discussed in response to SER Point No.4 in Section 3.2.

3. Target inputs were developed from plant drawings, calculations , and specifications as well as from data gathered from multiple walkdowns .

4. Multiple TORM IS runs were made to develop advisory critical missile velocities for the MSSVs, PORVs, and TE system piping that would result in an aggregate risk of less than 1E-06 y( 1 for each unit. These advisory critical missile velocities were then verified with dynamic finite element analysis performed in Step 5.

5. Dynamic Finite Element Analysis (FEA) of the MSSVs, PORVs, and TE system piping was completed to confirm that the advisory missile velocities developed with TORMIS will not fail these targets . FEA was also completed to determine the missile speed at which common missile types begin to penetrate the UPBs in the doghouse openings.

FEA is also used to determine the relationship between the initial and residual velocities for missiles passing through the UPBs.

3.1.4 Target Hit and Damage Frequency TORM IS results are estimated frequencies of tornado missile hit and damage, and have the units of y( 1 . They represent the modeled output frequencies of tornado missile hit/damage to a target, or group of targets . Table 3-2 summarizes the final list of safety-related targets as modeled in TORMIS and the average missile hit and damage frequencies from 60 TORMIS replications Target missile hit frequencies are the frequency of at least one tornado missile hitting a target over a period of one year. For very large targets , tornado generated missiles are likely to hit the target for almost every tornado strike and hence the missile hit frequency may approach or be essentially equal to the tornado strike frequency for such targets. As the target size reduces , as the target is shielded by other structures, or if only one surface of the target is exposed, the missile hit frequency reduces accordingly. In general, tornado missile hit frequencies are dependent on many geometrical factors as well as missile types, numbers, and proximity. The degree to which the elevation of the target is above the elevation of the nearby missile sources can also be a critical factor.

The frequencies presented in Table 3-2 represent the average frequency produced over 60 replications representing all outage and non-outage conditions modeled . The missile hit frequencies range from 2.08E-08 to 1.50E-04 per year. The four targets with the highest hit frequencies are the VC/YC Air Intakes (targets 82-85) located outside of the Doghouses next to the Reactor Buildings. The smallest hit frequency corresponds to the PORV hangers in the 8

Enclosure 1 Unit 2 Exterior Doghouse (37-38 and 47-48). This is expected given that these are small targets with no exposure to the West, the predominant direction for tornadoes.

Figure 3-1 illustrates the missile hit and damage frequencies for all targets shown in Table 3-2.

The plot shows the effect of considering the damage potential of the missiles impacting the safety-related targets as opposed to simply considering the likelihood that a target is impacted by a missile. For targets where hit is taken as the damage criteria , the hit and damage frequencies are identical.

The damage frequencies in Table 3-2 and Figure 3-1 reflect the modeling of damage in TORM IS. For many targets there is a notable reduction in the damage frequency from the hit frequency. The term "target damage" is used in a general sense to mean any damage (or "loss of function") criteria caused by a tornado missile hitting the target. Target damage is not necessarily the same as target hit, but hit can equal damage for fragile equipment. In addition to missile hit, the critical missile velocity exceedance and pipe penetration pass through failure criteria were used to evaluate missile damage to targets. The critical impact velocities for each missile-target pair are developed using finite element analysis.

Damage velocities were also calculated and input to TORM IS for the UPBs. These failure velocities are used in TORM IS to determine whether missiles will or will not pass through the UPBs, and to determine the residual velocity of missiles that do pass through the UPBs.

Figure 3-1: Missile Hit and Damage Frequencies l .E-03 1.E-04 - --

-."' l .E-05 ~

I

.CII CII 1.E-06 ,_ *- - --

~

...>C CII

i 1.E-07 I

CT

~

l .E-08 J l .E-09 ~

l.E-10 I TORM IS Ta rget Number

• Missile Hit Frequency (yr- 1)

• Damage Frequency (yr -1) 9

Enclosure 1 Table 3-2: TORMIS Results by Individual Target Gro up TORM IS Miss ile Hit Damage Targe t Group TORM IS Targ e t De sc riptio n Failure Mode 1 1 Numbe r Targ e t # Freoue ncv (vr ) Fre oue ncv (vr )

I D - PORV ISV IAB Exhaust Above Roof V > Vda m l.32E-05 4.20E-07 4 U I D Steam Line 2 D - PORV ISVIAB Exhaust Above Roof -- PP Pioe Penetration l .86E-06 1.25E-08 3 A - PORV ISV l9AB Exhaust Above Roof V > Vda m l.90E-06 2.SSE-08 I Ul A Steam Line 4 A - PORV ISV l9AB Exhaust Above Roof -- PP Pioe Penetration 9.97E-07 5.78E-09 5 D - MSSV Ext DH Exhausts Above roof V > Vdam 2.50E-05 5.08E-07 4 Ul D Steam Line 6 D - MSSV 11 Ext DH Exhaust Above Roof -- PP Pioe Penetration 7.26E-06 l.35E-09 7 A - MSSV Ext DH Exhausts Above Roof V > Vda m 1.89E-05 5.46E-07 I U l A Stea m Line 8 A - MSS V in Ext DH Exhaust Above Roof -- PP Pioe Penetration 3.76E-06 1.66E-09 9 C - Class B Pioi1g to PORV ISV-7A BC Int DH V > Vda m l.89E-07 6.12E-08 10 C - Class B Pioi1g to PORV ISV-7ABC Int DH Pipe Hanger Missile Hit 4.6 1E-08 4.61E-08 II C- Pnuemati: PORV ISV7ABC - Int DH Missile Hit 2.20E-07 2.20E-07 12 C - PORV ISV7ABC Exhaust - Int DH V > Vda m 3.22E-07 4.61E-08 3 U I C Steam Line 13 C - PORV ISV7ABC Exhaust - Int DH -- North West sway strut -- lower V > Vdam 2.80E-07 l.46E-07 14 C - PORV ISV7ABC Exhaust - Int DH -- NorthEast sway strut -- lower V > Vdam 2.42E-07 l.lOE-07 15 C - PORV ISV7ABC Exhaust Above Roof - Int DH V > Vdam l.55E-05 3.67E-07 16 C - PORV ISV7ABC Exhaust Above Roof -- PP Pipe Penetration 1. 50E-06 4.61E-09 17 B - Class B Piping to PORV ISV- 13ABC - Int DH V > Vdam 7.04E-07 2.73E-07 18 B - Class B Piping to PORV ISV- 13ABC - Int DH Pipe Hanger Missile Hit 1.49E-07 1.49E-07 19 B - I" Schedule 80 Off Class B Pioa1g to B PORV Missile Hit l .90E-07 l.90E-07 20 B - Pnuematic PORV ISV l3AB - Int DH Missile Hit 1.93E-07 l.93E-07 2 U I B Steam Line 21 B - PORV ISV 13AB Exhaust - Int DH V > Vda m 2.97E-07 5.57E-08 22 B - PORV ISV l3AB Exhaust - Int DH -- SE Sway Strut -- Lower V > Vda m 2. 15E-07 l.08E-07 23 B - PORV ISV I3AB Exhaust - Int DH -- SW Sway Strut -- Lower V > Vda m 2.86E-07 l.64E-07 24 B - PORV ISV l3AB Exhaust Above Roof V > Vda m 2. 14E-06 3. 12E-08 25 B - PORV ISV l3AB Exhaust Above Roof -- PP Pioe Penetration l.16E-06 3. 15E-09 26 C - MSSV - Int DH Exhaust Pines Inside DH V > Vda m 7.27E-07 1.44E-07 3 U l C Steam Line 27 C - MSSV - Int DH Exhaust Pines Above Roof V > Vda m 2.20E-05 2.97E-07 28 C - MSSV - Int DH -- Exhaust Above Roof -- PP Pioe Penetration 6.44E-06 2.04E-09 29 B - MSSV - Int DH -- Exhaust Pioes Inside DH V > Vdam 1.23E-06 3.28E-07 2 U I B Steam Line 30 B - MSSV - Int DH Above Roof -- Exhaust Pipes V > Vda m l.95E-05 3.05E-07 31 B - MSSV Exhaust Above Roof -- PP Pine Penetration 4.30E-06 8.SOE- 10 NIA Unit I TE 32 TE Svstem Pine -- Ul Int DH V > Vda m 8.98E-07 6.29E-08 33 D - Class B piping to PORV ISVIAB -- U2 Ext DH V > Vda m 1.61E-07 7.35E-08 34 D - Class B piping to PORV ISVIAB -- Hanger Missile Hit 5.74E-08 5.74E-08 35 D - Pnuemati: PORV 2SV IAB above fuor Missile Hit 5.22E-08 5.22E-08 36 D - PORV 2SV IAB Exhaust V > Vda m l.OIE-07 l.64E-08 37 D - PORV 2SV IAB Exhaust -- West Hanger V > Vdam 2. IOE-08 5.70E-09 8 U2 D Steam Line 38 D - PORV 2SV IAB Exhaust -- East Hange r V > Vda m 2. 14E-08 5.37E-09 39 D - PORV 2SV IAB Exhaust -- Sway Strut SW - Lower V > Vdam 4.79E-08 l.64E-08 40 D - PORV 2SV IAB Exhaust -- Sway Strut SE - Lower V > Vdam 4.39E-08 2.25E-08 41 D - PORV 2SV IAB Exhaust Above Roof -- PP P ioe Penetration 9.59E-07 4.77E-09 42 D - PORV 2SVIAB Exhaust Above Roof V > Vdam 7.83E-06 2.49E-07 43 A - Class B Pioing to PORV 2SV l9AB -- U2 Ext DH V > Vda m 2.96E-07 l.26E-07 44 A - Class B Pioing to PORV 2SV l9AB -- U2 Ext DH Pipe Hanger Missile Hit I.OIE-07 1.0 IE-07 45 A- Pnuemati: PORV 2SV IAB -- Above Floor Missile Hit 9.97E-08 9.97E-08 46 A - PORV 2SV IAB Exhaust V > Vda m 1.91E-07 3.92E-08 47 A - PORV 2SVIAB Exhaust -- West Hange r V > Vdam 3.26E-08 4.82E-09 5 U2 A Steam Line 48 A - PORV 2SV IAB Exhaust -- East Haneer V > Vda m 2.08E-08 7.78E-09 49 A - PORV 2SV IAB Exhaust -- Sway Strut SW- Lower V > Vda m 7.48E-08 3.63E-08 50 A - PORV 2SV IAB Exhaust -- Sway Strut SE - Lower V > Vda m 8. 14E-08 4.37E-08 51 A - PORV 2SV l9AB Exhaust Above Roof -- PP Pioe Penetration 8.70E-07 2.67E-09 52 A - PORV 2SV l9AB Exhaust Above Roof V > Vda m 1.57E-06 l.14E-08 53 D - MSSV il Ext DH Exhaust Inside V > Vda m 5.74E-07 7.73E-08 8 U2 D Steam Line 54 D - MSSV in Ext DH Exhaus t Above Roof V > Vda m 2.0SE-05 2.95E-07 55 D - MSSV in Ext DH -- Exhaust Above Roof -- PP Pioe Penetration 5.12E-06 5.63E-10 56 A - MSSV il Ext DH Exhaust Inside V > Vda m l.15E-06 2.62E-07 5 U2 A Steam Li1e 57 A - MSSV in Ext DH Exhaust Above Roof V > Vda m 2. 14E-05 3.55E-07 58 A - MSSV Exhaust Above Roof -- PP Pioe Penetration 4.22E-06 7.88E-10 59 C - Class B Pinine to PORV 1SV-7ABC Int DH U2 V > Vda m 3.33E-07 l.36E-07 60 C - Class B Pining to PORV ISV-7ABC Pioe Hanger U2 Missile Hit 1.07E-07 l.07E-07 61 C - Pnuematic PORV ISV7ABC - Int DH U2 Missile Hit 4.90E-07 4.90E-07 62 C - PORV ISV7ABC Exhaust - Int DH U2 V > Vda m 9.SSE-07 1.48E-07 7 U2 C Steam Line 63 C - PORV ISV7ABC Exhaust - Int DH U2-- Sway Strut NW Lower V > Vdam 9.26E-07 5.03E-07 64 C - PORV ISV7ABC Exhaust - Int DH U2 -- Sway Strut NE Lower V > Vda m 8.82E-07 4.28E-07 65 C - PORV ISV7ABC Exhaust Above Roof -- PP Pioe Penetration 2.93E-06 l.50E-08 66 C - PORV ISV7ABC Exhaust Above Roof V > Vda m 2.73E-05 7.45E-07 10

Enclosure 1 Table 3-2: TORMIS Results by Individual Target (cont.)

Group TORM IS Missile Hit Damage Target Group TORM IS Target De s cription Failure Mode 1 1 Nu mbe r Target # Freouencv rvr \ Fre quency (vr )

67 8 - Class 8 PipiJg to PORV 1SV-l3A8C Int DH U2 V > Vda m l.67E-06 7.76E-07 68 8 - Class 8 P inu1e to PORV ISV- 13A8C Pi,e Haneer U2 Missii:Hit 4.74E-07 4.74E-07 69 8 - Pnuemati:: PORV ISV 13AB - Int DH U2 Missile Hit 4. 17E-07 4.17E-07 70 8 - PORV ISVl3A8 Exhaust - Int DH U2 V > Vdam 9.68E-07 l.99E-07 6 U2 8 Steam Lu1e 71 8 - PORV ISV 13A8 Exhaust - Int DH U2-- Swav Strut SW Lower V > Vda m 8.72E-07 4.79E-07 72 8 - PORV ISV l3A8 Exhaust- Int DH U2-- Swav Strut SE Lower V > Vda m 7.39E-07 3.77E-07 73 8 - PORV ISV l3A8 Exhaust Above Roof -- PP Pi,e Penetration l.78E-06 8.85E-09 74 8 - POR V ISV I3A8 Exhaust Above Roof V > Vdam l.78E-05 5.94E-07 75 C - MSSV - Int DH Exhaust Inside DH V > Vda m 3.28E-06 5.60E-07 7 U2 C Steam Line 76 C - MSSV - Int DH Exhaust Above Roof V > Vdam 3.88E-05 5.07E-07 77 C - MSSV Exha ust Above Roof -- PP Pioe Penetration l.27E-05 2.20E-09 78 8 - MSSV - Int DH Exhaust Inside DH V > Vda m 3.89E-06 l.03E-06 6 U2 8 Steam Line 79 8 - MSSV - Int DH Exhaust Above Roof V > Vda m 2.97E-05 5.19E-07 80 8 - MSSV Exhaust Above Roof -- PP Pipe Pe netration 7.08E-06 l .30E-09 NIA Unit2TE 81 TE System Pipe -- U I Int DH V > Vdam 3.57E-06 4.27E-08 82 VC/YC Air Intake IA and 18 -- Verti::al Pipe Missii: Hit 1.17E-04 1.1 7E-04 9 Unit I VC/YC 83 VC/YC Air Intake IA and 18 -- Horiz.onta l Pipe Missii:Hit 1.20E-04 l. 20E-04 84 VC/YC Air Intake 2A and 28 -- Verti::al Pipe Missii:Hit 1.42E-04 1.42E-04 IO Unit 2 VC/YC 85 VC/YC Air Intake 2A and 28 -- Horiz.onta l Pipe Missile Hit l.50E-04 l.50E-04 86 Unit I Spent Fuel Pool V > Vdam 7.37E-05 l.32E-08 II Spent Fuel Pools 87 Unit 2 Spent Fuel Pool V > Vdam 5.70E-05 l.28E-07 Preliminary analyses determined that the summation of damage frequencies for the individual targets in Table 3-2 approached or exceeded the 1.0E-06 per year threshold. However, these analyses did not consider any redundancies between the Main Steam lines or the VC/YC Air Intakes. Section 3.1 .5 below discusses the approach to the Boolean logic developed using the TORSCR code to account for the redundancies. TORSCR is a FORTRAN computer code that is used to post-process TORM IS output files. Its primary function is to compute Boolean combinations of target hit and damage probabilities over multiple targets . The TORSCR post-processing computer code and use of the Boolean Logic approach was previously reviewed and approved by the NRC for the Byron Station TORM IS License Amendment.

3.1 .5 Target Group Results and Boolean logic Boolean logic is applied to targets to account for redundancy in the structural or system design or TORM IS modeling of a component as multiple targets . With redundancy in the design, the system function could be met even with one or more individual targets damaged by postulated tornado missiles.

Missile hit and damage frequencies for groups of targets evaluated in TORM IS are commonly combined using Boolean operators (U and n). The union (U) operator means that if any one of the targets is damaged in a tornado , the system is assumed to fail. The intersection (n) operator means that all the intersected components must be damaged in a tornado strike for the system to fail. Combinations of union and intersection operators can be put together to describe multi-component system failure logic for plant systems and subsystems . For union groups, summation of the frequencies is often accurate for small frequencies .

The Boolean logic for the MNS Main Steam System is provided below:

The failure logic for redundancy of the Main steam lines related to missile damage to the PORVs and MSSVs, beyond acceptable criteria, is that the Unit can sustain damage to one Main steam fine, and it can be in multiple places (PORVs, MSSVs, or associated 11

Enclosure 1 components) on the same Main steam line. Damage, beyond acceptable criteria, on more than one line is to be considered a failure in TORMIS space.

However, numerous PORV failures are allowed under the following conditions:

1. Any type of damage to any or all components on one steam line (as stated above) .

2. MSSVs on all other steam lines remain undamaged.

3. One undamaged PORV on an intact steam line (required for coo/down and safe shutdown).

4. Damage to two remaining PORVs that doesn 't result in a steam leak on the associated steam line.

Implementing failure logic in TORM IS for simultaneous damage to two or more of the four Main Steam lines is straight forward. However, distinguishing between steam leak and non-steam leak damage to the PORVs is beyond the current capabilities of TORM IS and would require additional analysis regarding what would constitute an unacceptable steam leak. As a result of these complications , it was decided to conservatively assume that any missile failure of the PORVs or MSSVs wou ld lead to a steam line leak and failure of the associated main steam line.

This conservative failure logic for the Main Steam System was implemented in TORM IS by defining the four individual failure events defined in Table 3-3 below which separate the MSSV and PORV targets by unit and Main Steam line. The 16 possible combinations of these four independent failure events are shown in Table 3-4 along with the average failure frequency over the 60 TORMIS replications for each possible combination . Each combination in the table represents a Boolean intersection (n) of the events listed with O indicating no failure and 1 indicating failure. For example, combination number six is interpreted as "Event 1 fails AND Event 2 fai ls AND Event 3 survives AND Event 4 survives". Since components on both the A and B Main Steam lines fail in this combination , the overall system is assumed to have failed.

The overall failure probability for the system is then computed as the arithmetic sum of the event combinations that result in are labeled "Fail". This overall failure probability for each unit is shown in the final row of Table 3-4.

Table 3-3: Main Steam Boolean Logic Event # Failure l ogic Description (V I I U2) Unit I Unit 2 One or more components of A MS line is damaged, ~U~U~U%U~UQU~U~U I/ 5 3U4U7U 8 potentially leading to a stea m leak 51 U 52 U 56 U 57 U 58 2/ 6 One or more components of B MS line is damaged, 17 U 18 U 19 U 20 U 21 U 22 U 23 U 24 U ~u~u~umunununu~u potentially leading to a stea m leak 25 U 29 U 30 U 31 78 U 79 U 80 One or more components of C MS line is damaged, 9 U 10 U 11 U 12 U 13 U 14 U 15 U 16 U ~U~UfilU~U~U~U~U~U 3/7 potentially leading to a steam leak 26 U 27 U 28 75 U 76 77 One or more components of D MS line is damaged, 33 U 34 U 35 U 36 U 37 U 38 U 39 U 40 U 4/ 8 1U2U5U6 potentially leading to a steam leak 41 U 42 U 53 U 54 U 55 12

Enclosure 1 Table 3-4: Failure Combinations for Main Steam System Combination MS System Frequencv (vr *1)

A MS Failure B MS Failure CMS Failure D MS Failure Number Survive or Fail Unit 1 Unit 2 1 0 0 0 0 Survive 6.44E-04 6.40E-04 2 I 0 0 0 Survive 5. 14E-07 8.72E-07 3 0 1 0 0 Survive 1. 52E-06 3.95E-06 4 0 0 I 0 Survive 1.23E-06 2.87£-06 5 0 0 0 I Survive 8.36E-07 6.76E-07 6 I I 0 0 Fail 1.37E-08 4.42E-08 7 1 0 I 0 Fail 1.09E-08 4.04E-08 8 I 0 0 1 Fail 3.7 1£ -08 6.42E-08 9 0 I 1 0 Fail 1.24 E-07 4.45£-07 10 0 1 0 I Fail 2.97E-08 4.34£-08 11 0 0 I I Fail 1.60E-08 3.94E- 08 12 I I 1 0 Fail 2.70E-09 1.23£-08 13 I I 0 I Fail l .27E-09 4.96£-09 14 I 0 I I Fail 1.04£-09 5.46E-09 15 0 I I I Fail 4.70E-09 1.12E-08 16 I I I I Fail 5.95E- 10 2.23£-09 Main Ste am Sys te m Failure Fre que ncy 2.42E-07 7.13E-07 The Boolean logic for the Unit 1 and 2 Spent Fuel Pools and the Unit 1 and 2 VC/YC Air Intakes is that fai lure is defined as both VC/YC Air Intakes failing by wind missile and missile damage to fuel assemblies in either of the Spent Fuel Pools. The three main pieces of this logic can then be expressed as the following independent failure events:

1. Missile impacts any part of the Unit 1 VC/YC Air Intakes (82 U 83).

2. Missile impacts any part of the Unit 2 VC/YC Air Intakes (84 U 85).

3. Missile that can damage fuel assemblies gets into the Unit 1 and/or Unit 2 Spent Fuel Pools (86 U 87).

The overall damage probability for this system is the Boolean Intersection (n) of these three failure events that can be expressed as:

(82 u 83) n (84 u 85) n (86 u 87)

This logic was implemented in TORM IS and the resultant damage frequency for missiles hitting both VC/YC Air Intakes and damaging missiles entering at least one of the spent fuel pools is 5.41 E-08 y( 1 . Note that this failure frequency applies to both units.

3.1.6 TORMIS Modeling Conservatisms There are many conservatisms in the TORMIS modeling to offset the simplification and limitation of TORM IS. The TORM IS MNS analysis is conservative for the following reasons :

1. The TORM IS methodology has been judged by the NRC to be conservative with respect to missile risk analysis, provided "the tornado wind velocity ranges assumed in the calculations are defensible given the present state of the art" and "the assumptions concerning the locations and numbers of potential missiles present at the site are 13

Enclosure 1 plausible ." The first NRC comment has been addressed by developing a site-specific tornado wind hazard curve, which considers both local and regional variations in tornado risk. A series of conservative adjustments were then made to the tornado data, consistent with the TORMIS methodology. The second NRC comment has been met by performing a detailed site survey, and conservatively applying the results of that survey to all future operating periods . The site survey was conducted during a plant outage ,

which increased the numbers of potential missiles at the site.

2. In TORMIS, the effects of local obstructions, buildings, and structures are neglected in simulating the tornado winds. Thus, for example, tornado winds flow through the Turbine Building without consideration of either terrain/site roughness or blockage/interference of the reinforced concrete and heavy steel frame structures.

3. The tornado wind field parameters in TORMIS were adjusted to increase the wind profile in the lowest 10 meters over the original profile in TORM IS. Hence, the adjustment used in this study provides additional conservatism, as required by the NRC SER

4. All the postulated missiles at MNS were treated as minimally restrained in which each sampled missile is injected near the peak aerodynamic force , thus maximizing the transport range and impact speed and, consequently, the missile hit and damage frequency.

5. A 100% missile inventory method was used for structure-origin and zone-origin missiles.

The approach for structure-origin missiles conservatively assumes that all the structural missiles become minimally restrained for high intensity tornadoes. A maximum number of 320,361 missiles are simulated for the EF 1-5 tornadoes. The missile density considers all missile sources to a distance of 2,500 feet and covers all land areas around the target.

6. Outage related increases in missile populations were estimated through observation of outage missiles during the walkdowns information regarding the staging of outage related equipment and materials. These outage related missile populations were included in the analysis using a temporal averaging approach. A conservative 5%

increase in the mean surveyed missile population was used for all zone and structure origin missiles.

7. The missile injection heights used in the study were chosen conservatively to encourage missiles to be able to fly. For example, missiles located on the ground are assumed to be at least one foot off the ground. All missiles that originate from structures are injected into the tornado wind field at an appropriate height above grade.

8. The TORMIS transport model produces missile trajectories and missile impact speeds that are conservative when compared to ballistic (drag only) trajectory models. The highest missile speeds attained in TORMIS exceed the missile speeds adopted by the NRC for deterministic design.

9. Advisory failure velocities developed using TORM IS for the MSSVs, PORVs, and TE system piping were increased by a factor of 1.11 (i.e. 1/0.9) before being verified using FEA.

a. Missile types other than Wood Planks , Wood Beams, Metal Siding , Plywood Sheets, and Channels are assumed to fail the safety-related targets regardless of impact velocity.

10. The effect of the UPBs on the upper openings of the Doghouses to stop or slow down tornado missiles is treated conservatively. Missile failure velocities are developed 14

Enclosure 1 conservatively. These calculations are used to support the conservative selection of missile failure velocities for the UPBs by basing the velocities used on worst case missile impact conditions and orientations.

a. Missile types other than Wood Planks, Wood Beams, Metal Siding , and Plywood Sheets are assumed to fly through the UPBs regardless of impact velocity.

11. Using FEA to confirm that advisory velocities do not damage the targets is conservative because the advisory velocities may not be the same as the critical missile velocities required to cause damage. In some cases, the advisory velocities may be well below the actual critical velocities. Further, confirmation of the advisory missile velocities for each target with FEA are developed using a conservative approach that assumes:

a. Normal , collinear impacts of un-deformed missiles.

b. Failure of vertical or horizontal support for the MSSV exhaust pipes will cause the pipe to impact the MSSV and cause a steam leak.

c. Any plastic strain in critical components of a PORV will render the valve inoperable.

12. The pipe penetration targets were modeled with a conservative geometric approach that included:

a. Missiles with diameters up to 10% larger than the penetration diameter were considered as potential missiles that could pass through the opening.

b. Conservative modeling factors of 1.1 on the missile velocity vector and missile axis impact angle were used in the screening criteria for missile entrance into the opening .

c. Missile rotation velocity at impact is neglected.

d. If a missile is aligned with an opening , it is assumed to pass through the opening and not "stick" in the opening due to frictional and side forces resulting from impact.

e. Assumes that every missile that is aligned to pass through the opening actually hits a safety related target inside the opening. In most cases , there is no safety related component directly behind the opening.

13. Boolean failure logic for the Main Steam System conservatively assumes that any tornado missile damage to the MSSVs or PORVs results in an unrecoverable steam leak on that steam line.

The degree of conservatism associated with all of these items considered together has not been quantified . However, the effect of eliminating or reducing these conservatisms is expected to be a notable reduction in the TORMIS methodology estimated tornado missile damage frequencies for MNS.

15

Enclosure 1 3.1.7 Summary of the TORMIS Analysis Results The MNS TORMIS analysis has been completed in accordance with NRC requirements and the resulting tornado missile hit and damage frequencies are presented below. Over 27.7 billion TORMIS tornado missile simulations have been performed for the MNS TORMIS model. Each simulation consists of sampling and flying a missile for a simulated tornado strike on the plant.

A total of 2.31 million tornado strikes on the plant were simulated in the TORM IS analysis.

The table below summarizes the damage frequencies per year for each of the target groups included in the MNS TORMIS analysis . The table also shows that the arithmetic sums of frequencies (in units of y( 1 ) for all targets affecting Unit 1 and for all targets affecting Unit 2.

Table 3-5: Mean Damage Frequency ( yr *1 ) for MNS Target Groups Target Group Unit 1 Damage Unit 2 Damage Frequency Frequency SG PORVs and MSSVs 2.42 E-07 7.13 E-07 TD AFW TE Piping 6.29 E-08 4.27 E-08 VC/YC Air Intakes and Spent Fuel Pools 5.41 E-08 Arithmetic Sum over all Target Groups 3.59 E-07 8.10E-07 The aggregate damage frequency for each unit is within the threshold frequency of 1.0 E-06 yr *1established in the 1983 TORM IS SER (Reference 2).

3.2 Five Points from 1983 TORMIS Safety Evaluation Report The NRC stated in Reference 2 (TORMIS SER) that applications using the EPRI methodology are to consider five points and provide appropriate information. Each attribute is listed and discussed in this Section. Reference 2 established the following requ ired attributes:

1. Data on tornado characteristics should be employed for both broad regions and small areas around the site. The most conservative values should be used in the risk analysis or justification provided for those values selected.

Tornado data from the NOAA Storm Prediction Center (SPC) for both large regions and small areas around the site were considered in the development of the site specific tornado characteristics for MNS. One hundred and twenty one (121) 1.4° latitude-longitude blocks were analyzed to determine a homogeneous sub-region and to assess variation of risk within the sub-region . A broad 15.4° x 15.4° latitude longitude square was used as the starting region. This large area covered 581,423 square miles of land and included 16,288 tornadoes from the NWS SPC tornado data set for the years 1950 to 2016 (67 years ).

16

Enclosure 1 Within this broad region, the tornado risk was quantified for 1°, 1.4 °, and 2° cells. A statistical method, termed Clusfer Analysis, was used to determine how the distinct cells group into similar clusters of tornado risk. These procedures were performed separately for the 1°, 1.4°, and 2°

• grids. The final selected sub-region covers a broad area which includes several high risk tornado areas surrounding the site. The sub-region contains 73,377 square miles of land and contained 2,029 tornadoes in the 67 year period, producing an average of 30.28 per year.

The mean unadjusted occurrence rate is 4.13 E-04 tornadoes per square mile per year.

A correction for annual reporting trend is part of the TORM IS methodology. The trend adjusted occurrence rate to reflect MNS sub-region reporting trends is 7.99 E-04 tornadoes per square mile per year.

2. The EPRI study proposes a modified tornado classification, F'-scale, for which the velocity ranges are lower by as much as 25% than the velocity ranges originally proposed in the Fujita, F-scale. Insufficient documentation was provided in the studies in support of the reduced F'-scale. The F-scale tornado classification should therefore be used in order to obtain conservative results.

The 1983 TORM IS SER calls for the use of the F-Scale of tornado intensity in terms of assigning tornado wind speeds to each intensity category (F1-F5). However, the NRC has adopted the EF-Scale and confirmed in previous discussions on TORMIS that the EF-Scale could be used in place of the F-Scale. The use of the EF-Scale is consistent with the recently endorsed positions of NRC Reg . Guide 1.76 (Reference 7) that are based on NUREG/CR-4461 (Reference 6).

3. Reductions in tornado wind speed near the ground due to surface friction effects are not sufficiently documented in the EPRI study. Such reductions were not consistently accounted for when estimating tornado wind speeds at 33 feet above grade on the basis of observed damage at lower elevations. Therefore, users should calculate the effect of assuming velocity profiles with ratios V0 (speed at ground level)IV33 (speed at 33 feet elevation) higher than that in the EPRI study. Discussion of sensitivity of the results to changes in the modeling of the tornado wind speed profile near the ground should be provided.

The TORMIS simulations were performed with the TORMIS rotational velocity Profile 3, which has increased near ground wind speeds over Profile 5, which was used in the 1981 EPRI TORM IS reports . Hence, the MNS runs were made with higher near ground wind speeds than in the EPRI study. A sensitivity study was conducted by running the original EPRI profile 5 and comparing the results to the analysis results run with Profile 3.

The comparison shows that differences in results were negligible for missile hit. Some sensitivity was observed for targets with very low damage frequencies ( <10 E-08), however, differences were negligible when aggregated over the target groups . Hence, the TORMIS results are concluded to not be sensitive to using Profile 3 instead of Profile 5.

4. The assumptions concerning the locations and numbers of potential missiles presented at a specific site are not well established in the EPRI studies. However, the EPRI methodology allows site specific information on tornado missile availability to be incorporated in the risk calculation. Therefore, users should provide sufficient 17

Enclosure 1 information to justify the assumed missile density based on site specific missile sources and dominant tornado paths of travel.

Applied Research Associates, Inc. (ARA) performed a plant walkdown of MNS to characterize the missile sources and to obtain plant information. A follow-up walkdown was completed during a refueling outage to quantify the number of outage missiles. The missile survey walkdowns were completed using a systematic, documented process to provide inputs on the type, quantity, and elevation of missiles in each missile source zone and structure. This information was developed into the plant modeling inputs for the TORM IS analysis.

The plant site is described by specifying the geometry, location , and material properties of the structures/components and the location of potential missile sources. Missile sources (buildings, houses, storage areas, vehicles , etc.) are modeled to a distance of approximately 2,500 feet.

This process includes the development of missile origin zones around the plant and surveying the types and quantities of missiles in each zone . The MNS missiles include the standard TORMIS missiles in EPRI NP-769 (Reference 4), including structural sections, pipes, wood members, other construction materials, and an automobile category. For each set, the cross-sectional geometry and the missile aspect ratio (Ud) are deterministic.

The missile survey produced the following number of modeled potential missiles at MNS:

1. Zone Missile: 75,708

2. Structure Origin Missiles: 229,288

3. Total: 304,996 The structure-origin missiles represent the maximum number of missiles produced given destruction of the buildings. The actual number of structure-origin missiles produced depends upon the EF-Scale.

A stochastic missile modeling approach was used to model the numbers of potential missiles at the plant during outage and non-outage conditions . The maximum number of potential missiles simulated for EF5 tornadoes was 320,361 , including structural failure missile sources. This number also includes additional missiles in several zones to conservatively account for elevated missile counts during refueling outages. A summary table of the total missile populations used in TORMIS is provided below.

Table 3-6 : Total TORMIS Simulated Missiles (Stochastic Model)

Zone Origin Structure Origin Total (All Sources)

EF Scale Min Mean Max Min Mean Max Min Mean Max EF 1 73,373 84,090 100,777 999 1,030 1,071 74,414 85,120 101,826 EF2 73,373 84,090 100,777 4,800 5,238 5,655 78,748 89,327 106,029 EF 3 73,373 84,090 100,777 31,032 33,795 36,408 106,909 11 7,884 135,121 EF4 73,373 84,090 100,777 129,514 140,241 149,339 205,391 224,33 1 240,891 EF 5 73,373 84,090 100,777 198,633 214,766 229,141 274,510 298,856 320,361 The number of missiles produced from this total inventory depends on the wind speeds experienced by the building . For example, light damage might be expected in 100 mph winds ,

18

Enclosure 1 while catastrophic failure might occur in 200 mph winds . Research performed in the development of the HAZUS wind model is used to determine the number of missiles available for each building type for each wind speed level considered in the TORMIS runs. When specific wind fragilities of building components are known , the calculated building fragil ities are used to produce the number of available missiles in place of the HAZUS functions .

The HAZUS vulnerability models are based on detailed 3-D modeling of buildings and simulated hurricane winds . For each simulated storm , the wind pressures are estimated over the building envelope. The wind load is then computed for each component and compared to the component resistance . Component failures occur when the load exceeds the resistance . This simulation process is repeated for all components as the storm is tracked by the building for each time step. Internal pressurization of the structure is modeled when the envelope is breached by a missile or a failed opening (window or door).

The damage state of the building at the end of the storm therefore considers the damage if all building envelope components . The HAZUS Hurricane Technical Manual (Reference 8) contains detailed descriptions of the model and validation against damage data. The HAZUS appendices contain damage state functions that can be used to estimate building damage versus peak gust wind speed .

Table 3-7 below summarizes the wind speed missile functions , defined at the wind speeds for which TORMIS is typically run to produce missile fragilities in support of License Amendment Requests with the Enhanced Fujita scale wind speeds, from the HAZUS research .

The damage state for each building type was selected based on sufficient fa ilure to produce structural component missiles . This criteria corresponds to "Damage State 4-Destruction" for all building types except manufactured buildings, where Damage State 3 was determined to be sufficient to produce significant structural missiles.

This analysis provides a rational , engineering-based approach to quantify the number of available missiles by building category. These results are conservative considering that all components are assumed to fail and become unrestrained potential missiles, whereas , in reality, a large portion of the structural components will generally remain connected to one another or attached to the foundation .

Table 3-7: HAZUS Damage State Exceedence Probabilities for EF-Scale Mid-Point Wind Speeds Enlta11ced Wi11d Speed (mph)

B11ildi11g Type Hazard Damage State EFO EFJ EF2 EF3 EF4 EF5 65-85 86-1 JO lll-135 136-165 166-200 200-230 Trailer, Manufactured Bldg 3 0.0 1 0.03 0.54 0.96 1.00 1.00 Wood Frame/ Modular 4 0.00 0.0 1 0. 12 0.75 0.99 1.00 Masonry Fram e 4 0.00 0.0 1 0.03 0.35 1.00 1.00 Pre E11gr Steel Frame 4 0.00 0.00 0.02 0.32 0.85 0.98 E11gi11eered Frame 4 0.00 0.00 0.00 0.03 0.50 0.90 19

Enclosure 1

5. Once the EPRI methodology has been chosen, justification should be provided for any deviations from the calculational approach.

The MNS TORMIS analysis was performed by Applied Research Associates, Inc. (ARA) using TORMIS_15, and updated version of the EPRI NP-2005 code (Reference 5).

The TORMIS code is a legacy FORTRAN computer code that has been ported to modern computers and compilers and has had bug fixes and other enhancements since 1981 . The updates and enhancements made to TORMIS since 1981 are documented in ARA TORMIS reports and Code Manuals, and are retained at ARA Offices in Raleigh, N.C. These changes include: porting the legacy code from mainframe to minicomputer to PC computers; post processing data routines; updates to the random number generation ; ensure aerodynamic function of box/beam for Cit greater than 4 to match Figure 3-8 of Reference 4, and replace the exponential tip loss function with an equivalent polynomial (i.e., replaced the exponential function in Equation 3.10 in Reference 4 with the Hoerner suggested polynomial); enhanced output options; and addressing compiler differences and numerical round-off issues in various functions from the legacy code. All code changes have been checked and verified through comparisons to the preceding version.

Also included in the updates were the replacement of the original mainframe based random number generator with a machine-independent algorithm and re-dimensioning of the code to allow larger numbers of targets and missiles.

An enhanced method for evaluating missiles passing through openings, such as pipe penetrations in reinforced concrete walls was used for the MNS analysis. This method uses a screening of missile impact conditions to screen-out missile impacts that can obviously not pass through an opening . The screening is done in the processing of the missile impact data without modifying the TORMIS physics engine in the IMPACT subroutine. This calculation approach for pipe penetration type targets was introduced as an option in previous versions of TORM IS and was used in several analyses prior to the MNS analysis. Both the TORMIS hit probability and the pipe penetration probability is reported for all such targets where this screening approach is used. These results for individual targets are given in Table 3-2.

All of the aforementioned TORM IS updates were made prior to the development of TORMIS_ 15 and were used in the Fermi and Byron TORMIS analyses that have previously been accepted by the NRC.

The MNS TORMIS analysis uses the new "Missile Path Through" option in TORMIS_15 that is described in Section 3.1.2. This option allows missile trajectories to be continued through targets that are impacted by missiles with velocities greater than their failure velocities. This change was implemented within the missile ricochet routine without modifying the TORMIS physics engine in the IMPACT, HIT, or TRAJEC Subroutines. This approach does not deviate from the EPRI methodology, but improves the functionality of the ricochet routine to account for missiles that can get through non-qualified missile barriers such as the Utility Port Barriers (UPBs) in the upper openings of the MNS Doghouses. The ability of the UPBs to resist and slow down missiles was quantified using the same deterministic dynamic finite element modeling approach that is used to determine the missile resistance capacity of the MSSVs, PORVs, and TE system piping .

20

Enclosure 1 The TORMIS code verification includes duplications and comparison to each preceding TORMIS version as well as the original TORMIS Sample Problem in EPRI NP 2005. Statistical comparisons show that the basic TORMIS code calculational approach has not deviated from the original version .

3.3 Issues from RIS 2008-14 Regarding TORMIS Methodology Subsequent to the original NRC TORMIS SER (Reference 2), the NRC issued Regulatory Issue Summary 2008-14 (Reference 1) to inform licensees of the NRC's experience with shortcomings identified in submitted licensee TORMIS analyses. The RIS specifically identified items licensees should address to confirm the TORMIS methodology and computer code have been properly applied and implemented. This issues identified in the RIS are presented below.

1. Licensees did not fully satisfy the first four points identified in the SER approving the TORMIS methodology (identified above). Examples include the following:

a. not providing adequate justification that the analysis used the most conservative value for tornado frequency The MNS TORMIS analysis complies with this RIS comment in that conservative adjustments were made to the tornado frequencies. As part of the tornado hazard analysis, wind speed versus probability of exceedance curves were developed for MNS and compared to the tornado frequency data in NUREG/CR-4461 (Reference 6). This comparison is given in Figure 3-2 below. The TORRISK and TORMIS produced hazard curves are more conservative (lies above) than the NUREG/CR-4461 hazard curve for MNS for exceedance frequencies greater than about 1 E-07 per year. For example, in the center of the curves (at 150 mph), the TORM IS curve is about a factor of three more than the NU REG curve.

Figure 3-2 below shows the MNS tornado hazard curves. The NUREG/CR-4461, Revision 2 (Reference 6) EF wind speed exceedance curve is also shown. It can be seen that the NUREG EF curve is below the TORRISK 200 x 200 curve until 180 mph, where they intersect. The plant safety envelope curve (labeled "MNS DH EF Plant") is above or equal to the NUREG curve until about 200 mph wind speed . The plant safety envelope wind speed exceedance frequencies are used for tornado missile analysis in TORM IS.

21

Enclosure 1 MNS Tornado Hazard Curves

,,m 1- I 1.E-04 I

~

I

~

"' 1.E-05 E:

~ ~ MNS DH EF Pl ant i

E

.a - - MNS DH EF 200x200 e

0..

--NUREG EF MNS

"'u C:

{l 1.E-06 + ~

"'"'u X

I 1.E-07 t

1.E-08 0 50 100 150 200 250 Peak Gust Windspeed (mph)

Figure 3-2: Tornado Hazard Curves The tornado frequency value conservatively considers regions around the plant and corrects for reporting trend and tornado classification error and random encounter errors, per the TORM IS methodology. Additional tornado frequency details are provided in the response to SER Point No. 1 in Section 3.2.

b. not including the entire missile spectrum defined for use in the TORMIS computer code as appropriate for the plant The MNS study included the missile spectrum (26 missile aerodynamic subsets) developed for use in TORMIS . A total of 23 missiles were used for MNS, including two plant specific missiles.

The additional missiles are precast concrete roof pavers (24 inches by 24 inches by 1.25 inches thick) found on roof of the Auxiliary Building and the Diesel Generator Buildings. The existing metal siding missile was also modified to be plant specific based on the characteristics of the metal siding on the exterior of the MNS Turbine Building .

c. not providing adequate explanation for the number and adequacy of tornado simulations and histories 22

Enclosure 1 A replication approach was used for the simulations. A total of 60 complete TORM IS replications were run with different random number seeds and missile populations. A total of 462 million missile simulations were performed for each replication , for a total of 27.72 billion missile simulations over all 60 replications. The standard deviations (cr) of these replications were computed and the standard error (E) in the aggregate mean probability (µ) was computed from £ = al..Jn. The 95% confidence bounds in the mean probability were conservatively approximated by µ +/- 2*£.

The 95% two-sided confidence bounds are illustrated in Figure 3-3 below to demonstrate that reasonable statistical convergence had been obtained with 60 replications . Figure 3-4 below plots the two-sided 95% confidence intervals .

Hit Convergence Over All Replications Da mage Convergence Ove r All Replications 1 00(.{ll

"""°'

'"""' I UX>£ -O.S

'i-i.

l.(Xl( .()6

• ~ . ... '*

!.ooc01 t . . . ..

o un<lll ' ~ *, t I 1.00(.()9 1.00( 10 TORMtS Jteplludon Nllffltler lO w TOfl MISRepllatlonNumbet"

. 50 .

• O POftV2SVIAB~l - lwr'lnUlgMun - Me~ 2StdEfr - ~.H1*2StdErr Figure 3-3: Convergence Plot Target Gro up Confidence Int ervals for Missile Hit Target Group Confidence Inte rvals for Damage 100(04 *

'i' I .OOCOS I.OOE-06

_; 100<06

.,, 11 ' II 1 I

. 100Eo1

...**... .* : .. I 1 11 i"

• • It 1,

'! f "'""" 1'1 ,, I I ', I .11/ I I I 9G5TatJ*t Group

q I "i I I I

~-,n

• C'°"terlirw

• Me*n 2'StdEn a Me;a,n*2'5UfErr Figure 3-4: Confidence Intervals 23

Enclosure 1

d. not providing sufficient information regarding the development and use of area ratios In regard to the RIS concern , no area ratios have been used as a method to adjust the TORMIS outputs for small targets, based on a ratio of hit probabilities from a large target or surface. A variance reduction approach is available in TORMIS and was used for MNS that allows for increasing the volume of size of small targets explicitly within the code . TORMIS applies the input variance reduction weight (ka) in the TORMIS scoring equation . These adjustments are used within TORM IS for the single missile impact probability. They are not used to "ratio down" the multiple missile impact probabilities following a TORMIS simulation . Ratioing down the results at the end of TORM IS is not technically acceptable and can lead to an underestimation of the multiple missile risk.

2. Licensees did not fully address the fifth point identified in the SER and explain how the methodology was implemented when the parameters used differed from those specified in the TORMIS methodology. Examples include the following:

a. inappropriately limiting the number of targets modeled Plant components identified as necessary to safely shutdown the plant and safely maintain a shutdown that are located in areas that are not fully protected by missile barriers designed to resist impact from the plant's design tornado missiles are designated as safety-related targets to be analyzed using TORMIS. The safety-related targets were identified in Section 2.2. This target list was modeled using 87 safety-related targets in the MNS TORMIS model. Table 3-8 summarizes the safety-related target list and the approach to modeling the targets in TORMIS.

24

Enclosure 1 Table 3-8: MNS Safety Related Unprotected Targets Number of Number of Target Type TORMIS Modeling Approach TORMIS Targets Targets PORV components , including piping upstream and downsteam from the valves and associated pipe supports, are included where they are exposed to horizontal missiles coming through the upper level SG PORVs 8 (4 per unit) 57 doghouse openings 1 and above the roof. FEA is used to determine missile impact criteria that causes plastic strains in PORV components that must remain operable .

MSSV exhausts are included where exposed to Piping horizontal missiles coming through the upper level 40 (5 exhausts 1 Downstream doghouse openings and above the roof. FEA is used per train x 4 of MSSVs to determine missile impact criteria that failure of the 22 trains per unit (aka MSSV exhaust supports that could allow the pipes to x 2 units)

Exhausts) either fall or swing into the MSSVs themselves ,

potentially causinq an uncontrolled main steam leak.

TE System Pipes are included in the interior doghouses of each unit where exposed to horizontal Auxiliary missiles passing through the upper level doghouse Feedwater 2 (1 per unit) openings. These pipes are not exposed above the roof. 2 Pump Turbine FEA is used to determine missile impact criteria that Exhaust wou ld either crimp the exhaust to an unacceptable extent or to cause failure of critical supports .

VC/YC Air Intakes are modeled for missile hit in VC/YC Air TORM IS . Boolean logic is used to determine whether 4 (2 per unit) 4 Intakes the intakes for both units are impacted when damaging missiles enter either spent fuel pool.

Spent Fuel Pools for each unit are modeled such that Spent Fuel 2 (1 per unit) missiles would have to enter from the North, metal 2 Pools clad , end of the Fuel Buildinq.

Note 1: Interior components in the Unit 1 Exterior Doghouse are not modeled because these openings are protected from tornado missiles .

In addition to the known unprotected targets identified above, MNS staff conducted site tornado hazard walkdowns as part of the NRC RIS 2015-06 (Reference 9) response . The walkdowns were performed in order to identify any potential systems, structures, or components (SSCs) that may have been vulnerable to a tornado missile strike. Each SSC was then investigated to see if the potential tornado missile vulnerability was credible. Vulnerability for each SSC was then dispositioned in one of several ways, which included : reference to a calculation which shows the SSC is designed for a tornado missile strike, protection from a QA 1 structure which conforms to the UFSAR minimum barrier thickness , identification of significant structures or components in the missile path, or identification that the SSC is not safety related or not required for safe shutdown and therefore does not require protection. These evaluations are documented in a site calculation. No additional SSCs were identified that needed to be included in the TORMIS analysis. Enclosure 3 tabulates the balance of SSCs considered above that were excluded from the TORMIS analysis including the basis for exclusion .

25

Enclosure 1

b. failing to address missile tumbling when modeling targets All targets were modeled to allow for tumbling missile hits (offset hits) per the TORM IS technical reports (References 3, 4 and 5). Pipe penetration targets were not increased in size to reflect tumbling missiles since offset missiles cannot result in penetration of a small opening in a concrete wall.

Section 4.3.2 of the EPRI Report NP-769 (Reference 4) discusses consideration of finite missile size in modeling targets. Since TORM IS tracks the missile as a point, missiles that just miss a target are actually likely to have hit the target by virtue of an "offset" hit. The analysis in Reference 4 shows that each safety target dimension should be increased by L/8 for each free face or direction, where L is the mean length of the missiles. Each shielding target can be increased by L/4 in each free direction. Thus, if a safety target has two free faces in the X direction , its actual X dimension would be increased by L/8 x 2. This increase in target size accounts for the potential near misses (which are actually "offset" hits) that are not treated in TORMIS.

The determination of the appropriate offset hit dimension is an iterative process because a TORMIS model of a given plant needs to be run with its plant description and actual missile inventory. This was accomplished for MNS by creating a TORM IS model of the plant with an offset hit dimension of 1.5 feet per free edge. An analysis of the missile-by-missile output from an initial run showed that the average length of a missile striking a safety-related target was 13.8 feet. This translates to an offset hit dimension for safety-related targets (L/8) of 1.73 feet.

However, it was also observed that over 80% of the missiles hitting safety-related targets were 15 foot long metal siding panels. These thin metal panels are likely to bend and fold in on themselves as they are ripped from their structures. This behavior effectively reduces the actual length of the siding panels before impacting safety-related targets. As such, the average missile length was re-calculated using only 75% of the 15 foot length of the metal siding panels as 10.48 feet. This translates to an offset hit dimension of 1.31 feet.

Since the calculated value for the offset hit dimension (1.31 feet) was less than the value used in creating the preliminary TORM IS model (1 .5 feet), no further adjustments were made to the dimensions of the safety-related targets.

Similarly, a 1 foot offset hit dimension was also applied to the concrete missile shielding targets around the openings in the Doghouses. This was done to account for the fact that tumbling and poorly oriented missiles passing close to the openings will be prevented from entering the doghouses. However, note that the use of a smaller offset hit dimension for these missile shielding targets does retain conservatism in the analysis.

c. failing to properly consider and use the variance reduction techniques and parameters specified by TORMIS The MNS analyses used the following variance reduction techniques :

1. Missile Zone Population

2. Target Size (ka by target surface) 26

Enclosure 1 Due to the very large simulation/replication sizes, no variance reduction techniques were used for tornado wind speed, tornado offset, tornado direction, tornado orientation, missile type, missile injection height, missile impact orientation , or trajectory termination.

d. taking credit for nonstructural members The Utility Port Barriers in the openings at the top of the MNS Doghouses are credited for their ability to resist or slow down missiles impacting them (see Enclosure 4).

The Utility Port Barriers (UPBs) consist of vertical and horizontal 5/8 inch diameter (No.5) rebar spaced at 5 inch to 6 inch on center. They are welded together at rebar intersection points and are welded to a structural steel angle frame which is either anchor bolted to Doghouse concrete or welded to steel plates embedded in the Doghouse concrete (see Enclosure 4).

The crediting of the UPBs is performed consistently with the deterministic finite element analysis methods used for the safety-related MSSVs, PORVs and TD AFW TE piping . This analysis only credits resistance to metal siding , wood plank, wood beam , and plywood missiles and assumes that all other missile types will pass through the UPBs unimpeded.

The TORMIS_ 15 "Missile Pass Through" option was used to credit the ability of the UPBs to resist or slow down missiles entering the Doghouses. This option uses the existing damage failure and ricochet routines to continue a missile history through a non-qualified barrier such as the UPBs. It works by allowing a missile history to continue with a reduced velocity if the missile impacts the UPB with a velocity greater than the critical velocity for the barrier. The reduced velocity is calculated based on the expected change in kinetic energy of the missile as it passes through the barrier from the FEA conducted for the UPBs. A total of 63 MPT targets are included in the MNS TORMIS model to represent the UPBs located in the openings in the Unit 1 interior, and Unit 2 interior and exterior Doghouses.

Note that the MNS TORM IS analysis includes evaluation of the effects of all TORM IS missile types and does not limit the number of safety-related targets or potential missiles as a result of including the UPBs in the analysis.

e. failing to consider risk-significant, non-safety-related equipment MNS staff conducted site tornado hazard vulnerability walkdowns as part of the NRC RIS 2015-06 (Ref. 9) response . The walkdowns were performed in order to identify any potential systems, structures, or components (SSCs) that may have been vulnerable to a tornado missile strike.

Safety related and non-safety related targets were considered . Additional details are provided in the response to item 2.a. above.

27

Enclosure 1

3. Licensees used the TORMIS methodology to address situations for which the methodology was not approved. Examples include the following:

a. proposing the elimination of existing tornado barriers TORM IS is not being used to propose the elim ination of tornado missile barriers at MNS.

b. proposing technical specification (TS) changes TORMIS is not being not been used to propose changes to the MNS Technical Specifications .

c. proposing plant modifications TORM IS is not being used as justification to modify plant features to reduce or eliminate or otherwise engineer the design of existing or new tornado missile protection features .

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria 10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants In accordance with the requirements of General Design Criterion (GDC) 2, "Design bases for protection against natural phenomena ," the NRC requires that nuclear power plants be designed to withstand the effects of tornado and high-wind-generated missiles so as not to adversely impact the health and safety of the public. Primarily, MNS complies with this criterion by providing positive protection features . However, Duke Energy is requesting a change to the MNS licensing basis to allow certain SSCs to not be protected from tornado missiles based on probabilistic analysis utilizing the TORMIS computer code .

NUREG-0800 Sections 3.5.1.4 and 3.5.2 of NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," contain the current acceptance criteria governing tornado missile protection . These criteria generally specify that SSCs that are important to safety be provided with sufficient, positive tornado missile protection (e.g., barriers) to withstand the maximum credible tornado threat. However, Section 3.5.1.4 of NUREG-0800 permits relaxation of the above deterministic criteria if it can be demonstrated that the probability of damage to unprotected essential safety-related features is sufficiently small. To use this probabilistic criterion , the EPRI developed the tornado missile probabilistic methodology described in References 3, 4 and 5. These topical reports document the TORMIS computer code methodology. The EPRI methodology employs Monte Carlo techniques to assess the probability that tornado missile strikes will cause unacceptable damage to safety-related plant features . By utilizing the EPRI topical reports and the TORMIS computer code methodology, MNS satisfies the regulatory criteria in the NUREG-0800 sections.

28

Enclosure 1 TORMIS Safety Evaluation Report The NRC staff concluded in Reference 2 that the EPRI TORM IS methodology can be used in lieu of the deterministic methodology when assessing the need for positive tornado missile protection for specific safety-related plant features in accordance with the criteria of NUREG-0800 Section 3.5.1.4. Reference 2 further stated that the use of the EPRI methodology, or any tornado missile probabilistic study, should be limited to the evaluation of specific plant features that involve additional costly tornado missile protective barriers or alternative systems. The conditions that led to the use of TORM IS is discussed in Section 2.2 of this LAR. A discussion of the five points from Reference 2 is provided in Section 3.2 of this LAR.

Regulatory Issue Summary (RIS) 2008-14 Reference 1 addresses: ( 1) the NRC staff position on the use of the TORM IS computer code for assessing nuclear power plant tornado missile protection , (2) issues identified in previous license amendment requests to use the TORMIS computer code , and (3) information needed in license amendment applications using the TORMIS computer code. The RIS also raises a number of questions the NRC staff had regarding the application of the TORM IS methodology and implementation of the TORM IS computer code. Duke Energy addresses each of these questions in Section 3.3 of this LAR.

4.2 Precedents The NRC has previously approved changes similar to the proposed change in this LAR.

Fermi 2: Application dated January 11 , 2013 (ADAMS Accession No. ML13011A377);

Supplement dated September 27, 2013 (ADAMS Accession No. ML13273A467); NRC Safety Evaluation dated March 10, 2014 (ADAMS Accession No. ML14016A487).

Byron Station Units 1 and 2: Application dated October 7, 2016 (ADAMS Accession No. ML16281A174); Supplement dated March 20, 2017 (ADAMS Accession No. ML17079A130).

NRC Safety Evaluation dated August 10, 2017 (ADAMS Accession No. ML17188A155).

The MNS proposed change is similar to the above license amendments issued above.

Specifically, the Duke Energy proposed change for MNS utilizes the same EPRI topical reports and TORMIS computer code methodology that was considered by Fermi and Byron . Also , the same NUREG-0800 acceptance criterion that was used for Fermi and Byron was also used for MNS. Finally, a similar discussion to the one in the Fermi and Byron applications regarding the five points from the 1983 TORMIS SER and the questions from RIS 2008-14 is also provided in this Duke Energy application .

4.3 No Significant Hazards Consideration Determination Duke Energy is requesting an amendment to change the Updated Final Safety Analysis Report (UFSAR) for McGuire Nuclear Station (MNS), Units 1 and 2. Specifically, Duke Energy is requesting an amendment to revise the UFSAR to describe the methodology and results of the analysis performed to evaluate the protection of the plants' structures, systems and components (SSCs) from tornado generated missiles. The analysis utilized a probabilistic approach implemented through the application of the TORM IS software program as described in NRC Regulatory Issue Summary (RIS) 2008-14.

29

Enclosure 1 Duke Energy has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed changes to the MNS UFSAR constitutes a license amendment to incorporate use of a Nuclear Regulatory Commission (NRC) approved probabilistic methodology to assess the need for additional positive (physical) tornado missile protection of specific features at the MNS site. The UFSAR changes will reflect use of the Electric Power Research Institute (EPRI) Topical Report "Tornado Missile Risk Evaluation Methodology" (EPRI NP-2005), Volumes I and II. As noted in the NRC Safety Evaluation Report on this topic dated October 26, 1983, the current licensing criteria governing tornado missile protection are contained in NUREG-0800, Sections 3.5.1.4 and 3.5.2. These criteria generally specify that safety-related systems, structures and components be provided positive tornado missile protection (barriers) from the maximum credible tornado threat. However, NUREG-0800 includes acceptance criteria permitting relaxation of the above deterministic guidance, if it can be demonstrated that the probability of damage to unprotected essential safety-related features is sufficiently small.

As permitted in NUREG-0800 sections, the combined probability will be maintained below an allowable level, i.e., an acceptance criterion threshold, which reflects an extremely low probability of occurrence. The approach assumes that if the sum of the individual probabilities calculated for tornado missiles striking and damaging portions of important systems, structures or components is greater than or equal to 1x10-6 per year per unit, then installation of unique missile barriers would be needed to lower the total cumulative probability below the acceptance criterion of 1x10-5 per year per unit.

With respect to the probability of occurrence or the consequences of an accident previously evaluated in the UFSAR, the possibility of a tornado reaching the site and causing damage to plant structures, systems and components is considered in the MNS UFSAR.

The change being proposed does not affect the probability that the natural phenomenon (a tornado) will reach the plant, but from a licensing basis perspective, the change does affect the probability that missiles generated by the winds of the tornado might strike and damage certain plant structures, systems and components. There are a limited number of safety-related components that could theoretically be struck and damaged by tornado-generated missiles. The probability of tornado-generated missile strikes on important to safety structures, systems and components is what was analyzed using the probabilistic methods discussed above. The combined probability of damage will be maintained below an extremely low acceptance criterion to ensure overall plant safety. The proposed change is not considered to constitute a significant increase in the probability of occurrence or the consequences of an accident, due to the extremely low probability of damage due to tornado-generated missiles and thus an extremely low probability of a radiological release.

The results of the analysis documented in this LAR are below the acceptance criterion of 1x10-5 per year per unit. Therefore, the proposed change does not involve a significant 30

Enclosure 1 increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed changes to the MNS UFSAR incorporate use of a NRC approved probabilistic methodology to assess the need for additional positive (physical) tornado missile protection for specific features . This will not change the design function or operation of any structure, system or component. This proposed change does not involve any plant modifications. There are no new credible failure mechanisms, malfunctions or accident initiators not considered in the design and licensing bases for MNS. The proposed change involves an already established tornado design basis event and the tornado event is explicitly considered in the MNS UFSAR.

Therefore , the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The existing licensing basis for MNS for protecting safety-related, safe shutdown equipment from tornado generated missiles is to provide positive missile barriers for all safety-related structures , systems and components. The proposed change recognizes that there is an extremely low probability, below an established acceptance limit, that a limited subset of the safety-related, safe shutdown structures , systems and components could be struck and consequently damaged. The change from requiring protection of all safety-related, safety shutdown structures, systems and components from tornado-generated missiles, to only a subset of equipment, is not considered to constitute a significant decrease in the margin of safety due to that extremely low probability of occurrence of tornado-generated missile strikes and consequential damage.

Therefore , the proposed change does not involve a significant reduction in a margin of safety.

Based on the above , Duke Energy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified .

4.4 Conclusions In conclusion , based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

31

Enclosure 1

5. ENVIRONMENTAL CONSIDERATION The proposed amendment does not involve a significant hazards consideration , a significant change in the types of any effluents that may be released offsite, a significant increase in the amount of any effluents that may be released offsite or a significant increase in the individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22( c )(9). Therefore, pursuant to 10 CFR 51 .22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6. REFERENCES

1. NRC Regulatory Issue Summary 2008-14, Use of TORMIS Computer Code for Assessment of Tornado Missile Protection, U.S. Nuclear Regulatory Commission, June 2008.

2. NRC memorandum, Safety Evaluation Report - Electric Power Research Institute (EPRI)

Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRA)

Methodology, October 1983 (ADAMS Accession No. ML080870291 ).

3. EPRI NP-768, Tornado Missile Risk Analysis, Electric Power Research Institute, May 1978.

4. EPRI NP-769, Tornado Missile Risk Analysis -Appendixes, Electric Power Research Institute, May 1978.

5. EPRI NP-2005 Volumes 1 and 2, Tornado Missile Simulation and Design Methodology, Electric Power Research Institute, August 1981 .

6. NUREG/CR-4461, Revision 2, Tornado Climatology of the Contiguous United States, J.V.

Ramsdell, Jr. and J.P. Rishel for the U.S. Nuclear Regulatory Commission, February 2007.

7. NRC Regulatory Guide 1.76, Revision 1, Design-Basis Tornado and Tornado Missiles for Nuclear Power Plants, U.S. Nuclear Regulatory Commission, March 2007 .

8. HAZUS-MH MR3, Multi-hazard Loss Estimation Methodology - Hurricane Model, Technical Manual, Federal Emergency Management Agency.

9. NRC Regulatory Issue Summary 2015-06, Tornado Missile Protection, U.S. Nuclear Regulatory Commission, June 2015.

32

ENCLOSURE 2 UFSAR PROPOSED CHANGES

UFSAR Chapter 2 McGuire Nuclear Station Spring, summer and autumn storms, phenomena of widespread consequence, are the major bearers of severe weather. For the area of North Carolina, South Carolina and their coastal waters, an average of one tropical storm per year and one hurricane every other year has been computed based on a period of record of 63 years (1901-1963). Within this period, seven years were void of any activity while nine years produced a combined total of three storms per year. Highest winds over the area are 110 miles per hour (fastest mile, Cape Hatteras, N.C., September, 1944) along the coast and 80 miles per hour (fastest mile for inland maxima, Wilmington, N.C., October, 1954). Maximum 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> rainfalls, again higher for coastal stations, have been recorded near 15 inches along the coast (Cape Hatteras, N.C., June, 1949) to near 9 inches inland (Wilmington, N.C., September, 1938). Figure 2-37 relates tornado frequency to two degree squares for the period 1916-1955. For the site area a total of 50 tomados are shown per two degree square (square area about 125 miles by 125 miles). To put in terms of probability for a point (nuclear station), such a translation predicts a recurrence interval of 4405 years. Thunderstorms with greater frequencies during the summer occur 45-50 days per year (from Charlotte, N .C., period of record 73 years). Associated hail can be expected about one day per year in coastal areas and one or more days per year over inland areas from the period of record 1955-1967 (Reference J).

The tornado parameters and tornado frequency values used in the probabilistic tornado risk analysis (TORMIS) described in Section 3.5.2.8.1 are found in Reference 5.

e eoro og1ca con 1hons assume o loadings and in Section 3.8.1.4 for general wind and snow loadings. Criteria for design tomados include a rotational speed of 300 mph, a translational speed of 60 mph and a vacuum pressure differential of 3 psi in 3 seconds. Design speed for general wind loading is 95 mph (fastest mile). Snow loading for design purposes is 20 pounds per square foot.

Air pollution over the Carolinas is of greatest potential during the fall. An average of ten episode - days per year has been computed for a period of five years (from upper air observations at area Weather Service Stations, i.e., Athens, Georgia; Greensboro, N.C. ; Cape Hatteras, N.C. and Charleston, S.C.).

2.3.2 Local Meteorology 2.3.2.1 Data Sources Climatic Atlas of the United States, United States Department of Commerce, Environmental Science Services Administration, Environmental Data Service, June, 1968.

Climate of the States, North Carolina, Climatography of the United States, No. 60-31 , United States Department of Commerce, Weather Bureau, February, 1960.

Local Climatological Data, Annual Summary with Comparative Data, North Carolina, United States Department of Commerce, National Oceanic and Atmospheric Administration, Environmental Data Service, 1971.

2.3.2.2 Normal and Extreme Values of Meteorological Parameters Table 2-9 depicts normal and extreme values for the following parameters: temperature, rain, sleet and snow, fog, relative humidity, dew point and wind direction and speed.

Thunderstorm occurrence by season is: 11 for spring (March-May), 29 for summer (June-August), 5 for fall (September-November) and 1 for winter (December-February). (Reference 1) 2.3.2.3 Potential Influence of the Plant and Its Facilities on Local Meteorology Consideration has been given to possible environmental effects associated with heat dissipation from the cooling pond (Lake Norman, vicinity of McGuire Nuclear Station). A review of the literature and operating experience to date would suggest that effects of fogging and icing are minimal for the properly 1

McGuire Nuclear Station UFSAR Chapter 3 the basis for judging the representativeness of data for the year October 17, 1970 - October 16, 1971, with regard to long-term conditions (e.g., five year period). Consideration of wind speed by stability type for the two periods shows a lower speed in general for the period October 17, 1970 October 16, 1971; the occurrence of calms and winds less than 4 knots are up four percentage points from 15% for the period January, 1969 - December, 1973. A slight shift in stability frequencies is noted for the period October 17, 1970 - October 16, 1971: "G" increases, "F" and "E" decrease, "D" increases and "C ", "B ", and "A " decrease.

Some change in wind direction frequencies, also minor, is noted for the period October 17, 1970 - October 16, 1971 : easterly, westerly and southwesterly directions increase while southerly, northerly and northeasterly directions decrease. On balance, the period is taken as reasonably representative of long-term conditions in the vicinity of the site with some conservatism with respect to accident relative concentration estimates as indexed by the joint distribution of wind direction and speed by stability type.

An additional year of onsite data have been collected using a measurement system which conforms to the recommendations of Regulatory Guide 1.23. The location of instrumentation is shown in Figure 2-41 marked permanent meteorological facility. Other discussion relating to instrument accuracy and sensitivity at this facility is included in Section 2.3.3. Dispersion estimates have been developed from this data base and are presented in the following summary.

Table 2-14 displays the joint frequencies of wind direction and speed by atmospheric stability type as they were observed on site for the period February, 1976 - January, 1977. Figure 2-49 represents the distribution of hourly dispersion factors at the Exclusion Area Boundary (2500 feet). Frequencies result from cumulative summation of percentage values in Table 2-14 in decreasing order of relative concentration computed for selected wind speed class intervals.

All calm wind occurrences are considered in the distribution. Data recovery for this period was 94% of total observations.

Annual average dispersion factors were also calculated for the period of record using the calculational model in Section 2.3.5. The resulting areal distribution of annual average relative concentration is portrayed in Table 2-15.

2.3.7 References

1. Meteorology and Atomic Energy, 1968, United States Atomic Energy Commission, Division of Technical Information, July, 1968.

2. Workbook of Atmospheric Dispersion Estimates, D. Bruce Turner, United States Department of Health, Education and Welfare, 1969.

3. "Severe Local Storm Occurrence, 1955-1967", US. Weather Bureau Technical Memorandum WBTM-FCST#l2, September, 1969.

4. Mean Number of Thunderstorm Days in the United States, US. Department of Commerce, Weather Bureau, Technical Paper #19, September, l ~~- - - - - -

MCC-1139.01-00-0298, "MNS Tornado Missile TORMIS Analysis".

THIS IS THE LAST PAGE OF THE TEXT SECTION 2.3.

2

McGuire Nuclear Station UFSAR Chapter 3 Table of Contents (cont'd) 3.5.2.5.2 3.5.2.5 .3 Pressurizer Heaters 3.5.2.5.4 Systems Connected to the Reactor Coolant System 3.5 .2.6 Pressurizer 3.5 .2.7 Turbine-Generator Missiles 3.5.2.8 Tornado Generated Missiles 3.5.2.8.1 Probabilistic Tornado Missile Risk Analysis 3.5.2 .9 Diesel Generator Missiles 3.5.3 Selected Missiles 3.5.4 Barrier Design Procedure 3.5.4.1 Protection of Containment Function 3.5.4.2 Penetration Depth Estimates 3.5.5 Missile Barrier Features 3.5.6 References 3.6 Protection Against Dynamic Effects Associated with the Postulated Rupture of Piping 3.6.1 Systems in which Design Basis Piping Breaks Occur 3.6.1.1 Reactor Coolant System 3.6 .1.2 All Other Mechanical Piping Systems 3.6.2 Design Basis Piping Break Criteria 3.6.2. l Postulated Piping Break Location Criteria for the Reactor Coolant System 3.6.2.1.1 Postulated Piping Break Locations and Orientations 3.6.2.1.2 Postulated Piping Break Sizes 3.6.2.l.3 Line Size Considerations for Postulated Piping Breaks 3.6.2.2 General Design Criteria for Postulated Piping Breaks Other Than Reactor Coolant System 3.6.2.2.1 Postulated Piping Break Locations and Orientations 3.6.2.2.2 Postulated Piping Break Sizes 3.6.2.2.3 Line Size Considerations for Postulated Piping Breaks 3.6.2.3 Analysis and Results 3.6.3 Design Loading Combinations 3.6 .3.1 Reactor Coolant System Design Loading Combinations 3.6.3 .2 All Other Mechanical Piping Systems Design Loading Combinations 3.6.4 Dynamic Analysis 3.6.4.1 Reactor Coolant System Dynamic Analysis 3.6.4.l.l Westinghouse Methodology 3.6.4.1.2 Stearn Generator Replacement Methodology 3 .6.4.2 All Other Mechanical Piping Systems Dynamic Analysis 3.6.4.3 Structural Analysis of Postulated Piping Breaks 3.6 .5 Protective Measures 3.6.5. l Reactor Coolant System 3.6.5 .1.1 Postulated Pipe Break Restraint Design Criteria for Reactor Coolant System 3.6.5.1.2 Protective Provisions for Vital Equipment 3.6.5.l.3 Criteria for Separation of Redundant Features 3.6.5.1.4 Separation of Piping 3.6.5.2 All Other Mechanical Piping Systems 3.6.5.3 Main Steam and Feedwater System Design 3.6.5.4 Control Room Protection from Postulated Piping Breaks 3.6.5.5 Postulated Pipe Break Restraint Design Criteria for All Other Mechanical Piping Systems 3.6.5 .5.1 Typical Pipe Whip Restraints 3.6.6 References 3.7 Seismic Design 3.7. l Seismic Input 3.7.1.1 Design Response Spectra 3 3-2

McGuire Nuclear Station UFSAR Chapter 3 List of Tables (cont'd)

Table 3-50. Stress Criteria For Supports, Restraints, and Anchors Duke Classes B, C, and F Table 3-51 . Stress Criteria For Safety Class 2 and 3 Cylindrical Shell Type Equipment and Components And Their Supports Table 3-52. Westinghouse Design Criteria for ASME Class 2 and 3 Components Table 3-53. Guard Pipe Designs Relying on ASME Code Case 1606 Table 3-54. Comparison of Predicted PWHIP Response - Inelastic Pipe Element. (Example Problem:

Figure3-117)

Table 3-55 . Comparison of Predicted PWHIP Response - Inelastic Yield Element. (Example Problem:

Figure 3-118)

Table 3-56. Comparison of Predicted PWHIP Response - Inelastic Yield Element. (Example Problem:

Figure 3-120)

Table 3-57. HVAC Design Codes Table 3-58. Maximum Deflections for Reactor Internals Under Blowdown and Seismic Excitation (1-Millisecond Double-Ended Break)

Table 3-59. Maximum Stress Intensities for Reactor Internals (I-Millisecond Pipe Break and Seismics)

Table 3-60. Electrical Systems & Components Seismic Criteria Table 3-61 . Post-Accident Equipment (Inside Containment) Operational Requirements Table 3-62. Control Complex Areas Ventilation Systems Analysis Results Table 3-63. Structures, Systems and Components Included in TORMIS Analysis Not Designed fo Design Basis Tornado Generated Missiles 4

3-9

McGuire Nuclear Station UFSAR Chapter 3 3.5 Missile Protection 3.5.1 Missile Barriers and Loadings 3.5.1.1 Internal Missiles The interior structural elements of all Category 1 structures, except those structural elements shielded from internal missiles are designed to withstand the internal missiles effect. For internal missiles characteristics refer to Section 3.5.2.9 3.5.1.2 Turbine-Generator Missiles All Category 1 structures, with the exception of the New Fuel Storage Vault exposed to these missiles are designed to withstand their effect and meet Regulatory Guide 1. 11 5, Rev. 1. The credible turbine-generator missiles are low trajectory and the associated properties are given in Section 3.5.2.

3.5.1.3 Tornado Generated Missiles All Category 1 structures exposed to these design basis missiles are designed to withstand their effect with the exception of those Structures Systems and Components included in the TORMIS probabilistic tornado risk analysis listed in Table 3-63 and as discussed in Section 3.5.2.8.1.1.

tabulation of the design basis tornado generated missiles is given in Table 3-8 .

3.5.1 .4 Site Proximity Missiles For the McGuire Station, aircrafts are not considered as credible missiles due to the established flying patterns close to the station.

Table 3-9 provides a summary of the major Category 1 structures that are designed for missile protection, along with the types of missiles they are protected against.

3.5.1.5 Diesel Generator Missiles Each Diesel Generator shall be protected against missiles produced by the adjacent diesel generator by the appropriate section of the block wall separating Diesel Generator rooms A from B. The credible diesel generator missiles are given in Section 3.5.2.9.

3.5.2 Missile Selection The specific missiles and the basis for selection as credible missiles are discussed in this Section. Some missiles which are not credible are pointed out and justified as prescribed below.

3.5.2.1 Reactor Coolant Pump Flywheel The following precautionary measures, taken to preclude missile formation from the reactor coolant pump flywheel, assure that the flywheel will not produce missiles under any anticipated accident conditions .

1. The flywheel is fabricated from rolled, vacuum-degassed, ASME SA-533.

2. Flywheel blanks are flame-cut from the plate, with allowance for exclusion of flame-affected metal.

3. A minimum of three Charpy tests are made from each plate parallel and normal to the rolling direction to determine that each blank satisfies design requirements .

4. An NDTT less than 10°F is specified.

5. The finished flywheel is subjected to 100 percent volumetric ultrasonic inspection.

5

McGuire Nuclear Station UFSAR Chapter 3 valves in the relief line, the air operated relief valves, the air operated spray valves, instrumentation assemblies and associated piping.

Supports for these lines should be capable of restraining movement of components and piping, under action of reaction and jet forces from circumferential pipe rupture, in accordance with the criteria of Section 3.6.2.

Characteristics of valve bonnet missiles are given in Table 3-14. Pressurizer instrumentation assembly missile characteristics are included in Section 3.5.2.5 .

3.5.2.7 Turbine-Generator Missiles Turbine missiles can be generated by a turbine overspeed. The credible low-trajectory turbine missiles and the associated properties are defined in Table 3-15 and Figure 3-4. Basis for selecting these missiles is given in Section 10.2.3.

3.5.2.8 Tornado Generated Missiles Table 3-8 provides a summary of the design basis tornado-generated missiles . The integrity of all Category 1 structures is not impaired by these missiles. This is accomplished either deterministically by designing the exposed structure of steel reinforced concrete capable of withstanding the impact of tornado-generated missiles, or probabilistically by showing that the structure will not be impacted or will not be damaged beyond an acceptable criteria if impacted as discussed in Section 3.5.2.8.1.3 .

NOT REQUIRED BE REVISED)

The fo llowing was added as part of a NRC request for additional information in order to perform a comparability review. The request was to determine penetration velocities for 2 missiles which were not part of the design basis missiles used during the Construction Permit (CP) stage (Iable 3-8). The requested velocities are for category 1 structures with wall or roofs less than 2 feet thick.

In order to assess the degree of comparability of protection against tornado missiles provided in the CP stage with that presently under review by the NRC, an additional investigation has been p erformed to evaluate the fo llowing missiles:

1. Steel rods, one inch diameter by three feet long, weight eight pounds.

2. Utility pole, 13-1 /2 inch diameter, 35 feet long, weight 1490 pounds.

Structural concrete barriers designed to provide missile protection having thicknesses less than two feet are as follows:

1. Slabs - None

2. Walls:

a. 1 '- O" thick located on column line AA between column lines 53 to 59 constructed to elevation 782 feet.

b. 1 '- 6 thick, location on column lines 49 and 63 between column line AA (Turbine Building) and 11 Reactor Building shield building constructed to elevation 782 feet.

The maximum horizontal velocities required to penetrate the barrier or generate secondary missiles within the wall elevations are as follows:

6

1 186 232 2 184 229 The horizontal velocity (ft./sec) required for p enetration or generation of secondary missiles is based upon a constructed thickness equal to three times the p enetration depth.

Separation of redundant components is not considered in the design of barriers for tornado missiles.

3.5.2.8.1 Probabilistic Tornado Missile Risk Analysis

~e'-N section A probabilistic tornado missile risk analysis (Reference 7) was completed using the TORMIS computer code which is based on the NRC approved methodology detailed in References 8, 9, and

10. The TORMIS analysis was performed in accordance with the guidance described in NRC TORMIS Safety Evaluation Report (Reference 11) and as clarified by Regulatory Issue Summary (RIS) 2008-14 (Reference 12).

3.5.2.8.1 .1 Scope Ne'-N section The TORMIS analysis (Reference 7) includes plant components identified as necessary to safely shutdown the plant and maintain a shutdown condition that are located in areas not fully protected by missile barriers designed to resist impact from design basis tornado generated missiles. The plant components (also referred to as, targets) included in the analysis are listed in Table 3-63 and additional details regarding these targets (i.e. specific identification, description, location, and portion) are included in Reference 7, Volume 3.

3.5.2.8.1 .2 TORMIS Computer Code

""section The TORMIS (TORnado MISsile Risk Analysis Methodology) computer code uses a Monte Carlo

~e simulation method that simulates tornado strikes on a plant. For each tornado strike the tornado field is simulated; missiles are injected and flown; and the missile impacts on structures, systems, and components (SSCs) are analyzed. These models are linked to form an integrated time history simulation methodology. By repeating these simulations, the frequencies of missiles impacting and damaging individual plant components (targets) and groups of targets are estimated.

Statistical convergence of the results is achieved by performing multiple replications with different random number seeds.

3.5.2.8.1.3 Analysis The TORMIS results show that the arithmetic sum of damage frequencies for all target groups section 1e'-N affecting the individual Units are lower than the acceptable threshold frequency of 1.0E-06 per year per Unit as established in Reference 13.

The following limiting inputs and assumptions were used in the analysis (Reference 7):

a. A site specific tornado hazard curve and data set for McGuire was developed using statistical analysis of the NOAA/National Weather Service Storm Prediction Center tornado data for the years 1950 through 2016. The analysis utilizes the Enhanced Fujita (EF) Scale wind speeds in the TORMIS simulations.

b. The missile characteristics and locations are based on plant walk down surveys and plant drawings. The plant walk downs were conducted during both non-outage and outage periods to capture both conditions. A stochastic (time dependent) model of the missile population is implemented in TORMIS. The stochastic approach to the missile population varies the missile populations in each of the TORMIS replications to account for 7

predictable changes in plant conditions (i.e. increased missiles during outages) and the randomness inherent in the total number of missiles present at the plant at any given time.

c. Finite element analysis calculations were performed to determine the missile damage threshold velocity for tornado generated missiles that would cause unacceptable damage to selected targets which is then used as an input in the TORMIS model.

d. Boolean combinations of targets were developed, and the logic was applied to targets or target groups to account for redundancies in the system design or for the TORMIS modeling of a component as multiple targets. The failure logic for redundancy of the MainSteam lines when missile damage to the PORVs and MSSVs is beyond acceptable criteria, is that the Unit can sustain damage to one of four MainSteam line and the damage can be in multiple places on the same MainSteam line (PORVs, MSSVs, or associated components). Damage, beyond the acceptable criteria, on more than one line is considered a failure in TORMIS space. The failure logic for the Control Room Air Ventilation System (CRAVS) Intakes (VCNC Air Intakes) and Spent Fuel Pools (SPF) is simultaneous tornado generated missile impacts to all the Unit 1 and Unit 2 VCNC Air Intakes AND the entry of a tornado generated missile into either the Unit 1 or Unit 2 SFP that would impact any Spent Fuel assemblies above acceptable critical velocities.

e. Any tornado generated missile strikes to the VCNC Air Intakes were conservatively assumed to crimp the Intakes closed.

f. The Utility Port Barriers in the Doghouse Upper Openings are conservatively taken into account for their resistance to a conservative selection of tornado generated missiles entering the Doghouse Upper Openings.

g. All tornado generated missiles are conservatively assumed to strike with an end-on, co-linear impact.

8

3.5.6 References

1. Ernest L. Robinson, "Bursting Tests of Steam-Turbine Disc Wheels," Transactions of the ASME, July, 1944.

2. A. Amirikan, "Design of Protective Structures,"NAVDOCKS P-51, Bureau of Yards and Docks, Department of the Navy, Washington, D. C., August, 1950.

3. R. C. Gwaltney, "Missile Generation and Protection in Light-Water-Cooled Power Reactor Plants,"

USAEC Report ORNL-NSIC-22, Oak Ridge National Laboratory, September, 1968 .

4. Westinghouse Report No. 296/281 - B of December 1973, Revised April 1974, "The Effects of a High Pressure Turbine Rotor Fracture and Low Pressure Turbine Disc Fracture at Design Overspeed."

5. R . A. Wiliamson and R. R. Alvy, "Impact Effects of Fragments Striking Structural Elements,"

Holmes and Narver, Inc., Anahelm, California Revised January 1975.

6. NRC Letter to Duquesne Light Company, September 12, 1996, "Acceptance for Referencing of Topical Report WCAP-14535, Topical Report on Reactor Coolant Pump Flywheel Inspection Elimination."

7. MCC-1139.01-00-0298, "MNS Tornado Missile TORMIS Analysis".

8. Electric Power Research Institute Report, EPRI NP-768, "Tornado Missile Risk Analysis", May 1978.

9. Electric Power Research Institute Report, EPRI NP-769, "Tornado Missile Risk Analysis -

Appendices", May 1978.

10. Electric Power Research Institute Report, EPRI NP-2005, Volumes 1 and 2, "Tornado Missile Risk Evaluation Methodology", August 1981.

11. NRC Safety Evaluation Report, "Electric Power Research Institute (EPRI) Topical Reports Concerning Tornado Missile Probabilistic Risk Assessment (PRA) Methodology", October 26, 1983 (Adams ML080870291)

12. NRC Regulatory Issue Summary 2008-14, "Use of TORMIS Computer Code for Assessment of Tornado Missile Protection", June 16, 2008 (Adams ML080230578)

13. Memorandum from Harold Denton, NRR Director, to Victor Stello, Deputy Executive Director for Regional Operations and Generic Requirements, "Position of use of Probabilistic Risk Assessment in Tornado Licensing Action," dated November 7, 1983 (Adams ML030020331).

THIS IS THE LAST PAGE OF THE TEXT SECTION 3.5 9

Table 3-63. Structures, Systems and Components Included in TORMIS Analysis Not Designed for Design Basis Tornado Generated Missiles 3 Category 1 SSC Unit 1 & 2 Main Steam Safety Valves (MSSVs) Exhaust Piping and associated supports' 2 Unit 1 & 2 Steam Generator Power Operated Relief Valves (PORVs) and associated piping and supports' 2 Unit 1 & 2 Turbine Driven Auxiliary Feedwater (TD AFW) Exhaust (TE) Pipe2 Unit 1 & 2 Control Room Air Ventilation System (CRAVS) Intakes (VC/YC Intakes) 2 Unit 1 & 2 Spent Fuel Building (north facing wall)

Notes:

1. The SSCs located in the Unit 1 Exterior Doghouse are not included as they have positive tornado missile protection.

2. Only the portion of the Structure that is not protected from the Design Basis tornado generated missiles are included. The Design Basis tornado generated missiles have a horizontal only projection.

3. Additional details and target areas can be found in Section 3.5.6 Reference 7.

10

ENCLOSURE 3 LIST OF TARGETS EXCLUDED

Enclosure 3: Targets Excluded from the TORMIS Analysis The following table provides the balance of targets that were excluded from the TORMIS analysis based on site walkdowns in response to NRC RIS 2015-06. The MNS criteria for exclusion consists of:

• Fully protected safety related targets .

• Unprotected safety related targets not needed for safe shutdown .

• Safety related targets already specifically licensed as not requiring additional tornado missile protection.

• Analysis completed that shows a tornado missile impact will not result in a loss of safe shutdown function.

• Non-safety related targets not needed for safe shutdown .

SSC Basis for Exclusion Standby Nuclear Service The SSC is under water and the concrete barrier thickness exceeds Water Pond (SNSWP) UFSAR Table 3-16 (min. barrier thickness) . The SNSWP Intake Temperature Transmitter is a non-safety transmitter used to meet TS SR 3.7.8.2.

SNSWP Discharge The concrete barrier thickness exceeds UFSAR Table 3-16 (min.

barrier thickness).

SNSWP Overflow The concrete barrier thickness exceeds UFSAR Table 3-16 (min.

barrier thickness). The SNSWP Level Transmitter is a non-safety transmitter on the overflow used to meet TS SR 3.7.8.1.

SNSW Underground RN The concrete barrier thickness exceeds UFSAR Table 3-16 (min.

Vent Pipe and Manway barrier thickness).

Covers SNSWP Dam A tornado or tornado missile has no adverse effect on the earthen dam as determined per an existing calculation.

1

Enclosure 3: Targets Excluded from the TORMIS Analysis Refueling Water Storage Docketed correspondence , dated February 11, 1980, from Duke Tank Power Company to the NRC stated that in order "to provide assurance a minimum quantity of water will be available for mitigating a main steam line break accident under postulated tornado conditions, a wall will be built around the lower part of the RWST. This wall will provide tornado missile protection to the lower part of the tank and will assure the availability of sufficient water from mitigating a postulated main steam line break. This wall is a Category I structure."

The concrete barrier thickness exceeds UFSAR Table 3-16 (min.

barrier thickness) . The openings in walls are covered by 1" plate and meet UFSAR Table 3-16 (equivalent metal plate thickness). Existing calculations also ensure adequate water volume if the tank is damaged by a vertical missile below the concrete wall.

Vent pipe crimping on the Refueling Water Storage Tanks is addressed in an existing calculation and is shown to not degrade the tank's ability to perform its design function. Tornado missiles that can penetrate the upper (unprotected) portion of the tanks are also addressed in an existing calculation that shows these missiles will not prevent the tank from performing its design function .

Makeup Water Storage This SSC meets UFSAR Table 3-1 requirements . No tornado missile Tank protection is required .

RWST Pipe Trench The concrete barrier thickness exceeds UFSAR Table 3-16 (min .

barrier thickness).

Diesel Generator (D/G) The concrete barrier thickness exceeds UFSAR Table 3-16 (min.

Underground Fuel Tank barrier thickness) .

D/G Fuel Tank Vent Pipes Concrete barriers were added to protect the vents below break away (FD System) connections . The concrete missile barriers for these vent pipes are 1O" high. The maximum design basis flood level on site is at EL.

760.375' (4.5" of water per UFSAR Section 2.4.10). Therefore, the height of these concrete missile barriers protects these pipes and tanks from any design basis flooding event, including the PMP event, even if a tornado missile were to strike the top portion of the vent pipe.

D/G Diesel Fuel Oil Fill and Protection was added to shield the pipes from breaks below PMP Recirculation Pipes Above water levels. All lines going underground from the fuel loading pad are Grade (FD System) protected with a concrete barrier.

D/G Diesel Fuel Oil The concrete barrier thickness exceeds UFSAR Table 3-16 (min.

Isolation Valve Pit (FD barrier thickness). Remote reach rods were installed which are System) attached to valves FD-67, FD-74, 2FD-67, and 2FD-74 via a slip connection. If a missile hits the reach rod , there is no adverse effect to the manual isolation valves .

2

Enclosure 3: Targets Excluded from the TORMIS Analysis DIG Intake Existing calculations evaluate a missile going into the intake plenum and pressure drawdown, and it was determined to be insignificant.

0/G Exhaust and Diesel The concrete barrier thickness exceeds UFSAR Table 3-16 (min.

Room Exhaust barrier thickness). An additional steel beam was added to close a gap found in the opening.

Diesel Crankcase Vacuum There are 8" openings for the ZD Crankcase Blower Exhaust. Per the Crankcase Blower Exhaust ZD 080, "If the vacuum blower is inoperable, then the operability of (ZD System) the associated diesel generator is not degraded although an emergency work request shall be written . Whenever the vacuum blower is inoperable, the responsibility of mitigating a crankcase explosion belongs to the diesel explosion relief valves, therefore these relief valves shall be operable." From this statement, it is shown that these openings are not a vulnerability to the safe operation of the plant.

Auxiliary Building AA Wall All openings in the AA wall are either below grade level, protected by and Turbine/Service barriers meeting the required thickness of UFSAR Table 3-16 , or they Buildings are protected from missiles by the Turbine and Service Build ing structures.

Doors on North End of No safety related SSCs can be struck behind the doors due to the Auxiliary Building at the QQ building geometry and the doors are also protected from missile Line strikes by other structures.

Auxiliary Building EL. 767' Two 6" penetrations are on each unit, and are filled completely with and 784' Exterior Walls into non- safety related cables . Either no safety-related SSCs are located the CROM Rooms within a direct missile path through the penetrations, or there is a tortuous path due to the existing cables and hole size which does not allow a tornado missile to enter the rooms .

Spent Fuel Pool Ventilation The VF System is not required for safe shutdown . Two RV pipes are Supply Roof Intake (VF beneath the Unit 2 intake opening , however they are class G, non-System) safety related pipes. No safety related SSCs can be hit underneath the roof slab , through the penetration . The VF System is not credited to mitigate (filtration) a fuel handling accident nor dose from the fuel building tornado strike accident.

The VF System was credited for a drop of the TN-32 spent fuel cask in the fuel building . TN-32s are no longer being loaded . This would only be applicable if a TN-32 was returned to the fuel building for repair or unloading .

Procedure RP/O/A/5700/006 - "Natural Disasters", requires fuel handling activities to be secured and VF shutdown if a tornado is on site.

3

Enclosure 3: Targets Excluded from the TORMIS Analysis Auxiliary Building The VA Filtered Exhaust is not required for safe shutdown . No safety Ventilation Filtered Roof related SSCs can be hit underneath the roof slab, through the Intake (VA System) penetration . The filtered exhaust outside air intake dampers remain closed to ensure filter exhaust units maintain a negative pressure in the ECCS pump rooms .

Auxi liary Building Supply The VA Supply Intake is non-safety related and is not required for Roof Intake (VA System) safe shutdown. No safety related SSCs can be hit underneath the roof slab, through the penetration.

Duct Enclosures Over This is a non-safety related area of the plant with no safety systems Health Physics impacted in these rooms .

and Counting Room Unit Vents UFSAR Table 3-1 indicates the Unit Vents are not required to be missile protected. No safety related equipment is located under the roof openings.

Main Steam (SM) and See UFSAR Table 3-1 . Isolation and relief valves are inside the Feedwater (CF) Supports, interior and exterior doghouses. The concrete barrier meets UFSAR through Isolation Valve and Table 3-16 (min. barrier thickness). The pipe class goes to Class F, First Support Outside of the non-safety related , outside of the exterior and interior doghouses.

Reactor Building The rupture restraints outside of the doghouses are for the large, high energy line breaks inside the doghouses and they can withstand a missile hit and still restrain the normal loads.

Feedwater Tempering Lines The CF System Tempering Lines on the roof are Class F, non-safety 1CF-197 and 2CF-197 (CF related , pipe.

System)

New Fuel Vault Structure The concrete barrier thickness exceeds UFSAR Table 3-16 (min.

barrier thickness).

Reactor Building Roof Drain The Reactor Building Roof Drain is non-safety related and the pipe is embedded in concrete where it exits the bui lding .

Nuclear Service Water (RN An existing calculation defends the missile protection and licensing System) Normal Supply basis. Lake Norman is not McGuire's ultimate heat sink and McGuire from Non-Safety Cowans swaps to the assured source, which is the SNSW Pond , if Lake Ford Intake Norman is lost during a seism ic or missile event.

4