**NRC INSPECTION MANUAL**	IQVB

AIRCRAFT IMPACT ASSESSMENT

Effective Date:  03/23/2020

PROGRAM APPLICABILITY:  IMC 2502 and IMC 2508

37804-01	INSPECTION OBJECTIVE

To verify that applicants for new nuclear power reactors, as defined in Title 10, Section 50.150, “Aircraft Impact Assessment,” of the Code of Federal Regulations (10 CFR 50.150(a)(3)), have effectively implemented the Nuclear Regulatory Commission (NRC) aircraft impact regulations such that, with reduced use of operator action, their design can withstand the effects of a large commercial aircraft impact.

37804-02	INSPECTION REQUIREMENTS

The NRC staff will evaluate the aircraft impact assessments (AIAs) and supporting documentation developed by applicants subject to the requirements of 10 CFR 50.150, to verify that design specific, realistic analyses were used to identify and incorporate design features and functional capabilities that provide additional inherent protection to withstand the effects of a beyond-design-basis large commercial aircraft impact.

02.01	Verify that the applicant identified and incorporated into the design all the necessary design features and functional capabilities to show that, with reduced use of operator actions, the reactor core remains cooled or the containment remains intact, and spent fuel cooling or spent fuel pool integrity is maintained.

02.02	Verify that the AIA is a realistic, design-specific assessment of the physical, fire, shock, and specific plant system-loss effects from the impact of a large, commercial aircraft used for long distance flights in the United States, with aviation fuel loading typically used in such flights, and an impact speed and angle of impact considering the ability of both experienced and inexperienced pilots to control large, commercial aircraft at the low altitude representative of a nuclear power plant's low profile.

02.03	Verify that the AIA is being documented and maintained consistent with the requirements of the rule.

Issue Date:  03/23/20	1	37804

37804-03	INSPECTION GUIDANCE

General Guidance.  The NRC staff will inspect each AIA methodology, implementation, and results to verify regulatory compliance, technical accuracy and completeness, independent of the NRC licensing review and approval process for the relevant application.

The NRC inspection will verify that the AIA meets the requirements of 10 CFR 50.150(a). Draft Regulatory Guide 1176 (DG-1176), “Guidance for the Assessment of Beyond-Design-Basis Aircraft Impacts,” which endorsed NEI 07-13, “Methodology for Performing Aircraft Impact Assessments for New Plant Designs,” Revision 8, May 2009, provides an acceptable method to meet the requirements of 10 CFR 50.150.

The NRC inspection will evaluate any deviation from the approach described in

DG-1176 on a case-by-case basis to ensure compliance with the rule and to verify the accuracy and completeness of the AIA. Documentation of each deviation from the methodology in DG-1176 and the results of the inspection team’s evaluation of each deviation will be documented in the inspection report.

03.01	The NRC inspection will, at a minimum, address the following technical elements:

(1) aircraft impact characteristics, (2) plant functions, structures, systems, components, and locations to be assessed, (3) damage mechanisms (structural, shock and vibration, and fire assessments) and (4) consideration of potential responsive actions and strategies in identifying design features and functional capabilities.

a. Verify that the AIA is sufficiently rigorous and realistically evaluates a design- specific structural damage analysis of the effects of the impact of a large, commercial aircraft on the facility consistent with the requirements of 10 CFR 50.150 and the guidance in Appendix A, “Structural Inspection Guidance.”

b. Verify that the AIA adequately assesses fire-damage consistent with the requirements of 10 CFR 50.150 and the guidance in Appendix B, “Fire Damage Inspection Guidance.”  Ensure that plant structures and layouts maintain key safety functions (core cooling, containment, spent fuel cooling, and spent fuel pool integrity) by assessing fire-related damage caused by the spread of jet fuel and the deflagration-induced pressure wave due to the penetration of the aircraft into the structure.

c. Verify that the AIA evaluates system-loss and the plant’s capability to achieve the requirements of 10 CFR 50.150 and the guidance in Appendix C, “Specific Systems-Loss Inspection Guidance.”  Ensure that the AIA includes an adequate system-loss assessment to verify the plant’s capability to achieve and maintain safe shutdown of the reactor, provide adequate cooling of the reactor and spent fuel pool, and maintain an intact containment with reduced operator action.

03.02	Verify that AIA quality related activities and record retention activities are being properly implemented.

a. Verify that the Quality Plan used by the applicant in the development of the AIA is sufficiently complete to support a thorough assessment and commensurate with quality standards applied to beyond-design-basis assessments.

b. Verify that the AIA and supporting information that forms the basis for the relevant  application are retained consistent with paragraph (b) of 10 CFR 52.0,   “Scope; applicability of 10 CFR Chapter I provisions,”

10 CFR 50.70, “Inspections,” and 10 CFR 50.71, “Maintenance of records, making of reports.”

c. The following materials are examples of the information the inspection team review to verify each applicant’s compliance with their Quality Plan for the development of the AIA and the record retention requirements of the rule:

1. Final Safety Analysis Report (FSAR) as it applies to the AIA

2. AIA report(s)

3. Applicant engineering and design control procedures

4. Quality Plan procedures for preparing, revising, recording and controlling of the supporting information

5. 	Other engineering information:

(a) AIA criteria and assumptions

(b) Safety system functions and operation descriptions, component data, instrumentation requirements and support system requirements applicable to AIA

(c) System flow diagrams showing flow paths and calculated flows, temperatures, and pressures for various conditions of operation

(d) Detailed description of damage footprint and basis

(e) Piping and instrumentation diagrams (P&ID) for applicable primary and support systems

(f) Equipment and I&C location drawings

(g) List of AIA calculations and analyses

(h) Other AIA supporting information 

37804-04 RESOURCE ESTIMATE

This inspection procedure is estimated to use approximately 1200 inspection hours (~0.8 FTE), and approximately 328 hours of contractor support.

Issue Date:  03/23/20	2	37804

37804-05 SCHEDULING

Advance planning is required to ensure that AIA inspections are conducted after the AIA and supporting technical bases are sufficiently complete to perform a thorough assessment but as early in the licensing review process as practical.  Accordingly, AIA inspections should be conducted within a timeframe that allows applicants to consider the impact of the inspection results on their overall AIA and on the information submitted to the NRC pursuant to 50.150(b) requirements.

37804-06 REFERENCES

10 CFR 50.150, “Aircraft impact assessment”

NRC Final Rule, “Consideration of Aircraft Impacts for New Nuclear Power Reactors,” (June 12, 2009; 74 FR 28111)

IMC 2508, “Construction Inspection Program:  Design Certification”

IMC 2502, “Construction Inspection Program:  Pre-Combined License (Pre-COL) Phase”

IMC 0617, “Vendor Inspection Reports”

Draft Regulatory Guide 1176 (DG-1176), “Guidance for the Assessment of Beyond- Design-Basis Aircraft Impacts”, July 2009

NEI 07-13, “Methodology for Performing Aircraft Impact Assessments for New Plant Designs,” Revision 8, May 2009.

10 CFR 50.70, “Inspections,”

10 CFR 50.71, “Maintenance of records, making of reports.” 

37804-07 PROCEDURE COMPLETION

This inspection procedure is completed when the inspection objectives as defined in this procedure have been achieved and the inspection activities have been documented in an approved inspection report.

END

Appendices:

A -	STRUCTURAL INSPECTION GUIDANCE 

B -	FIRE-DAMAGE INSPECTION GUIDANCE

C -	SPECIFIC SYSTEMS-LOSS INSPECTION GUIDANCE

Attachment:

1. Revision History Sheet for IP 37804

Issue Date:  03/23/20	1	37804

APPENDIX A:  STRUCTURAL INSPECTION GUIDANCE

37804A-01	PURPOSE

The purpose is to provide guidance to the Nuclear Regulatory Commission (NRC) staff inspection teams to verify that the applicant has performed an adequate structural damage analysis of the effects of the impact of a large, commercial aircraft on the facility and the spent fuel pool integrity.

37804A-02    GENERAL GUIDANCE

Adequate plant documentation is required to complete this stage of the inspection, including plant arrangement drawings that display the locations of major system equipment, and plant elevation drawings that document the relative heights of various buildings.  Civil-structural drawings will also be required to obtain information on wall thicknesses and reinforcement details, as well as material specifications, if not called out on drawings. Photographs of the plant, including aerial photographs, will provide additional important information.

The NRC inspectors should verify that the applicant has determined the effects of and damage resulting from global loading arising from aircraft impact using one of the following methods of analytical evaluation:  (1) the Force Time-History Analysis Method, or (2) the Missile-Target Interaction Analysis Method.

The following are a set of general items that should be inspected and verified:

a. Verify if the scope of the assessment, the major assumptions in the assessment process, and the basis for the sufficiency of the selected aircraft impact scenarios is clearly described and justified.

b. Verify if the bases and assumptions considered for defining the damage footprint for the physical, fire, and shock damage assessment are clearly described and justified.

c. Verify that the computer code used in the analysis has been developed and controlled under the provisions of the applicant’s quality assurance program and verified and validated (V&V’d) for this class of problems.  Confirm that this V&V is adequately documented.

d. Verify that any impact or transient analysis performed for a non linear large deformation event is performed by a structural analyst.  Verify that the experience level of the responsible structural analyst performing the analyses is appropriate and adequately documented.

e. Verify that structural analysis assumptions and limitations have been adequately documented and justified for each analysis.

Issue Date:  03/23/20	AppA-2	37804

f. Verify that the adequacy of the type of finite elements used in each analysis has been justified and documented.

g. Verify, using the civil-structural drawings, that the boundary conditions for the structure being modeled have been documented and justified for each analysis. Verify that the boundary conditions are at a sufficient distance from the area of impact to remain unchanged during the event.

h. Verify, for each analysis, that the initial conditions imposed on the structure are adequate and are consistent with the specified loading conditions.

i. Verify that material models within the computer analysis code used for the various analyses are sufficiently documented to determine the adequacy of modeling actual material behavior; including possible documentation of stress path tests that assess/evaluate the behavior of the entire portion of the structure that is anticipated to be engaged in the structural response.  Also verify that the material models used in the assessment are consistent with the material models used to benchmark the code against test results.

j. Verify that for each analysis, the model had sufficient refinement, e.g., nodal spacing, time steps, or effects of strain hardening, to correctly capture the anticipated behavior of the structure modeled and that the effects of varying these parameters on the analysis results have been adequately documented.  Also, were there instances where it was determined, after the analysis, that additional refinement would have been beneficial?  Verify that there is adequate documentation to justify why additional refinement was not used and how additional refinement may have influenced the analysis results.

k. Verify that the time-duration of the analysis (simulation time) is sufficiently long to adequately capture anticipated important structural response features and  that this has been adequately documented.

l. Verify that all potential scenarios have been considered.

m. Verify that the NRC-supplied forcing function was used in the analysis.

n. Verify that approved failure criteria were used and interpreted correctly.

37804A-03	SPECIFIC TECHNICAL GUIDANCE

a. Detailed Structural Analysis.  Specific items of interest related to the analysis of containment structures and spent fuel pools that need to be inspected and verified are detailed in NEI 07-13.  The following items identified in Chapter 2, “Containment Structures and Spent Fuel Pools,” of NEI 07-13 should be inspected and verified:

Issue Date:  03/23/20	AppA-2	37804

1. Local Loading (NEI 07-13, Section 2.1):

(a) Verify that there is adequate documentation of the aircraft engine parameters used in the analysis to cross-check against NRC- specified parameters (NEI 07-13, Subsection 2.1.2).

(b) Verify that there is adequate documentation to confirm how the various local loading formulas in Subsection 2.1.2 were used to arrive at degree of local damage.

(c) Verify the sensitivity of the formulas above to small changes in parameters.  Verify that this sensitivity has been assessed and documented.

(d) Verify that the formulas used are the formulas cited in NEI 07-13 and approved by the NRC.

2. Global Loading (NEI 07-13, Section 2.2):

(a) Verify, when the Force Time-History Analysis Method is used, that there is adequate documentation of the method’s application to cross-check against the NRC- specified force time-history (in NEI 07-13, Subsection 2.2.1, two analysis methods are described, the Force Time-History Analysis Method and the Missile-Target Interaction Analysis Method).

(b) Verify, for the case when the Missile-Target Interaction Analysis Method is used, that there is adequate documentation of the method’s application to cross-check its equivalency against the NRC-specified force time-history.  Verify that the Missile-Target Interaction model is consistent with 10CFR50.150(a)(2) that requires the assessment to “be based on the beyond-design-basis impact of a large, commercial aircraft used for long distance flights in the U.S., with aviation fuel loading typically used in such flights, and an impact speed and angle of impact considering the ability of both experienced and inexperienced pilots to control large, commercial aircraft at the low altitude representative of a nuclear power plant's low profile.”

(c) Verify that the analysis accurately captures the mass distribution of the missile when using a “reverse-engineering” approach to determine the missile-target interaction from the force-time history.

(d) Verify that the NRC-specified spatial distribution of the impact force was used in the analysis if the Force Time-History Analysis Method was used, and that it is adequately documented (NEI 07-13, Subsection 2.2.4).

Issue Date:  03/23/20	 AppA-2	37804

3. Material Characterization and Failure Criteria Summary (NEI 07-13, Section 2.3):

(a) Verify that the material properties and the constitutive equations used to model the nonlinear behavior of both steel and reinforced concrete materials used in the analyses are consistent with the material properties and constitutive equations documented in Section 2.3 of NEI 07-13.  The inspector should verify that these parameters have been appropriately used and adequately documented in the specific plant assessment.

(b) Verify that the dynamic increase factors specified in Subsection

2.3.1 of NEI 07-13 have been used for the various materials in the analysis.

(c) Verify that the ductile strain limits specified for steel in Subsection

2.3.2 of NEI 07-13 have been used in the analysis.

(d) Verify that the concrete structural failure criteria used in the analysis are appropriate and as specified in Subsection 2.3.3 of NEI 07-13 and that their use in the analysis is adequately justified and documented.

(e) Verify that the material models specified in Subsection 2.3.4 of NEI 07-13 have been used in the analysis.

(f) Verify that structural integrity failure criteria used are appropriate and as specified in Subsection 2.3.5 of NEI 07-13 and are adequately justified and documented.

4. Major Assumptions (NEI 07-13, Section 2.4):

(a) Verify that, if used, the missile interaction model assumes the aircraft impact is perpendicular to the centerline of the containment (NEI 07-13, Subsection 2.4.1).

(b) Verify that, if the missile interaction model is used, it assumes the aircraft is at a takeoff weight such that the missile-interaction model is equivalent to the NRC- specified force time-history (NEI 07-13, Subsection 2.4.1).

(c) Verify, if the missile interaction model is used, that the analysis is performed assuming a strike location at the mid-height or spring- line, or that the strike location used is based on limitations on airplane glide slope that have been determined based on the aircraft rule and plant-specific design considerations (NEI 07-13, Subsection 2.4.1).

Issue Date:  03/23/20	AppA-2	37804

(d) Verify that new plant design features have been subject to experimentally verified analytical evaluations (NEI 07-13, Subsection 2.4.1).

(e) Verify that regions of the containment that contain potentially critical penetrations have been considered (NEI 07-13, Subsection 2.4.1).

(f) Verify that the analysis is performed assuming both the engine and the aircraft fuselage strike at the mid-point of the pool wall.  Also verify that aircraft impact at other locations that could result in  greater consequences have been assessed (NEI 07-13, Subsection 2.4.2).

(g) Verify that both the engine and the aircraft fuselage strike perpendicular to the pool wall (NEI 07-13, Subsection 2.4.2).

(h) Verify, if credit is taken for pool water inventory in the analyses, that the added mass of the water is modeled conservatively (NEI 07-13, Subsection 2.4.2).

(i) Verify that potential damage from wall motion on adjacent fuel assemblies have been evaluated (NEI 07-13, Subsection 2.4.2).

(j) Verify that, per assumption, no credit is taken for energy dissipation in external walls, if the force time history analysis method (Riera function) is used (NEI 07-13, Subsection 2.4.2).

5. Sufficiency Criteria (NEI 07-13, Section 2.5):

(a) Verify that if the containment is concluded to be intact, the sufficiency criteria of Section 2.5.1 are satisfied.

(b) Verify that if the spent fuel pool is concluded to be intact, the sufficiency criteria of Section 2.5.2 are satisfied

(c) Verify that an assessment for an impact below the spent fuel pool as specified in NEI 07-13 has been performed and is adequately documented.

b. Structural Damage Footprint Assessment.  Specific items of interest related to the damage rule sets that need to be verified are detailed in NEI 07-13.  The following items identified in Chapter 3, “Heat Removal Capability,” of NEI 07-13 should be verified:

1. Specifics to Damage Rule Sets:

(a) Verify that the structures of concern that contain systems, structures, and components (SSCs) are retained for additional analysis.

(b) Verify that a systematic evaluation of portions of all buildings that may be susceptible to damage has been carried out and that those portions have been identified and the process is documented.  This evaluation should take into account adjacent structures, intervening structures, and intervening terrain that might prevent a direct strike, per guidance provided in NEI 07-13, Subsections 3.2.1 - 3.2.2.2.

(c) Verify, for those elevations that have faces of buildings/structures that are not screened by adjacent or intervening objects, that the potential for damage is evaluated based on the structural characteristics of the external and internal walls and that this evaluation is adequately documented.

(d) Verify that the key assumptions for use in determining elevations of concern have been addressed in the evaluations and adequately documented.  If any assumptions have not been addressed, note these for inclusion in the inspection report (NEI 07-13, Table 3-1).

(e) Verify that each unscreened external face of each building is assessed, as further detailed below, with building damage effects divided into two categories:  (1) hittable portions of containment structures, and (2) other reinforced concrete buildings such as reactor buildings, auxiliary buildings, intake structures, etc.

2. Damage Rule Sets for Containment Structures (NEI 07-13, Subsection

3.3.1 and Figure 3-9):

(a) Verify that the damage rule sets for containment structures are satisfied in accordance with NEI 07-13, Section 3.3.1 and Figure 3- 9.

(b) Verify that damage to the containment polar crane has been considered and that adequate documentation of this evaluation is provided.

(c) Verify that the effects of fire and debris on buildings without concrete roofs, adjacent to and below the area of impact on the containment, have been considered and that adequate documentation of this evaluation is provided.

(d) Verify that shock damage to any fragile SSCs from the impact of an aircraft on the containment structure has been considered and that this is adequately documented.

3. Damage Rule Sets for Reinforced Concrete Buildings (NEI 07-13, Subsection 3.3.2 and Figure 3-10):

(a) Verify that various impact points have been investigated per NEI 07-13 in order to define the damage footprint, and that adequate documentation of this evaluation is provided.

(b) Verify, if structural parameters are different from those provided in NEI 07-13, Table 3-2, that design-specific rule sets were developed per guidance found in Subsection 3.3.2 of NEI 07-13, “Physical Damage Rules,” and that this is adequately documented. Per NEI 7-13, the physical damage rule sets were derived based on studies of structures with typical reinforced concrete walls representative of existing plant design.  The rule sets regarding the number of walls required to stop perforation only apply to structures that are similar to current plant structures, as described by parameters provided in Table 3-2 of NEI 07-13.  Design-specific rule sets will, therefore,  need to be developed for structures that vary significantly from those described in Table 3-2.

(c) Verify, if the physical damage footprint has been extended through any opening that has an area greater than the area of a typical single personnel access door.  Openings smaller than this size are not considered to provide a substantial debris pathway and need not be considered in the assessment.

(d) Verify that the effects of a crane drop on floor loading or on any SSCs needed for fuel cooling has been assessed.  Major components of the reactor building, or auxiliary building gantry crane can also become large internal missiles.  Verify if the trajectory of these missiles for realistic strike pathways has been assessed for potential impact on SSCs needed for fuel cooling.  Physical damage can also cause a gantry crane to drop on the floor below.

(e) Verify that the shock effects on supports of heavy equipment components located in Shield buildings (as applicable in some new plant designs) above the structures they are shielding have been assessed to ensure the supports remain intact or that the effects of dropping these components are effectively considered in the  assessment.

(f) Verify that shock damage is evaluated in the damage footprint and that this evaluation is adequately documented.

(g) Verify, for purposes of defining the shock damage footprint, that the rules in Table 3-3 of NEI 07-13 have been addressed and that this is adequately documented.

Issue Date:  03/23/20	AppA-2	37804

(h) Verify, as discussed in NEI 07-13, that the issue of seismic separation between buildings, in terms of distance from center of initial impact and then along a structural pathway to the affected equipment, has been addressed and that this evaluation is adequately documented.

(i) Verify that when NSSS vendors choose not to use the values for SD1 through SD6 contained in NEI 07-13, Appendix A, that they develop shock distances based on acceleration values filtered at  200 Hz for specific strike locations.

(j) Verify where applicable, shock damage to large concrete tanks filled with water has been assessed.

Note:  An exception to the structural pathway exists if the shock damage profile intersects a large concrete tank filled with water.  In this case, shock can travel directly through the water and possibly result in a shorter pathway to important SSCs than the pathway through structural concrete.

37804A-04	STRUCTURAL INSPECTION CHECKLIST

This inspection checklist should be used to summarize the findings of the structural inspection.  If there are aspects of the inspection that are incomplete, the specific nature of the incomplete item should be described in detail in a summary inspection report.

Issue Date:	A-2	37804

Issue Date:  03/23/20	AppA-12					37084

Issue Date:  03/23/20	AppA-2	37804

APPENDIX B:  FIRE-DAMAGE INSPECTION GUIDANCE

A. PURPOSE

The purpose is to provide guidance to the Nuclear Regulatory Commission (NRC) staff inspection teams to verify that the applicant has completed an adequate fire-damage assessment utilizing the fire damage rule set within the aircraft impact assessment review.

B. GENERAL GUIDANCE

This guidance relates to each applicant’s impact scenario, the inspection team is to verify that the applicant’s assessment is consistent with the fire damage rule set laid out in NEI 07-13, Section 3.3.2.

The impact scenarios will be inspected.  The NRC inspection team will verify that for each scenario with a structural damage footprint there is a corresponding fire damage footprint. Beginning at the region of initial structural damage, the fire analysis should identify the relevant penetrations and spread pathways (both pressure wave and liquid fuels) that lead to subsequent damage due to the fire.  There may be scenarios where similar impacts scenarios result in analogous fire damage footprints.  In these cases, specific fire damage footprints for each scenario might not exist but rather reference another scenario’s fire damage footprint. This is potentially an acceptable method of analysis.  The assumptions for determining such analogies should be documented in the analysis documentation, and the inspection team should examine the rules and methods for potential non-conservatisms.  Any assumptions with questionable conservatism should be noted for inclusion in the inspection report.

Confirm that the applicant’s fire-damage assessment consists of two components:

1. Determination of the damage footprint by:

(a) Identification of the spread of fire damage through new compartment connections due to overpressure, and

(b) Identification of the spread fire damage through existing connected compartments

2. Determination of the SSCs to be considered damaged and no longer credited.

Completed structural analysis results are a prerequisite for performing the fire analysis assessment.  Adequate plant documentation is needed to complete this stage of the inspection, including plant layout diagrams that display the locations of fire areas including wall and door ratings, SSC locations including cable routing.  If available, a plant probabilistic risk assessment (PRA), internal fire analysis, and internal flood analysis may aid the inspector in determining an adequate list of damaged equipment.

Issue Date:  03/23/20	AppB-2	37804

C. SPECIFIC TECHINCAL GUIDANCE

1. Damage Footprint Assessment.  Verify that the footprints are consistent with NEI 07-13 which involves the following rule set:

Step 1:  Identify Potential New Fire Area Connections Due to Physical Damage:  

· All openings that are at the perimeter of the physical damage (i.e.,

interface boundary) fail and permit overpressure fire to enter the

adjoining fire area(s)

Step 2:  Spread Fire Damage through Connected Fire Areas (see NEI 07-13, Figure 3-11):

   One Barrier Option: A single 3-hour rated fire barrier rated at least 5 psid beyond the physical damage perimeter stops further propagation, or

   Two Barrier Option: Two 3-hour rated fire barriers (rated below 5 psid) beyond the physical damage perimeter are needed to stop further propagation

   Within a rated fire area, fire damage spreads up, down and laterally through openings such that the entire fire area is exposed to fire damage.

Step 3:  Spread Fire Damage through HVAC Ducting (see NEI 07-13, Figures 3- 12 and 3-13):

   Sheet metal HVAC ducting in the interface boundary is torn and provides a pathway for pressurized fire to propagate to the adjacent fire area(s).

   Sheet metal HVAC ducting exposed to the fireball overpressure collapses and provides a pathway for unpressurized fire to propagate to the adjacent fire area(s).

The interface boundary is the line between the end of the physical damage footprint and the beginning of the extension of the fire damage footprint.  The term “fire barrier” is the complete assembly that separates one fire area from another, and includes the walls, floors, ceilings, doors, penetrations, blowout panels, etc.  When applying the “Two Barrier Option,” a minimum volume of 2000 ft3 is sufficient for the fire area between the two barriers.

Although a plant design may not be complete at the time of the AIA inspection, each applicant should have all required features identified that are relevant to the propagation of the fire.

Regions with large equipment invariably are designed with access methods to facilitate replacement of the equipment when it is inoperable.  Walk-ways, stairs, entrances, cabling and piping penetrations should be adequately accounted for in the  analysis.  Penetration features should be adequately described in the

Issue Date:  03/23/20	AppB-1	37804

analysis.  Fire suppression equipment is not to be credited within the NEI 07-13 fire damage rule set.  Severed pipes and floor drain within the fire damage foot print will be analyzed under the flood damage assessment.

2. Fire Damage Affects on SSCs. Verify that all the SSCs within the fire damage footprints is considered failed at 5 minutes consistent with the guidance provided in NEI 07-13.  SSCs include electrical equipment, mechanical equipment, cables, pipes, etc.  Determination of the state of the plant after identifying the damaged equipment is not within the scope of this section.

D. INSPECTION CHECKLIST

Below is an inspection checklist that should be used to summarize the findings of the fire inspection.

Issue Date:  03/23/20	AppB-1	37804

Issue Date:  03/23/20	AppB-3	37804

APPENDIX C:  SPECIFIC SYSTEMS-LOSS INSPECTION GUIDANCE

A. PURPOSE

The purpose is to provide guidance to the Nuclear Regulatory Commission (NRC) staff inspection teams to verify that the applicant has completed an adequate system-loss assessment within the aircraft impact assessment review to determine the plant’s capability to achieve and maintain safe shutdown of the reactor, provide adequate cooling of the reactor and spent fuel pool, and maintain an intact containment based on the characteristics of damage footprints and spatial dependencies of systems and components.

B. GENERAL GUIDANCE

The inspectors should verify that the System Loss Assessment performed by the applicant includes four major activities for each aircraft impact scenario evaluated1:

1. Determination of the location of key systems, structures and components (SSCs) that could be in success paths for core cooling, spent fuel pool cooling, or containment isolation, and could be impacted by damage caused by the aircraft impact.

2. Given the established structural, shock and fire damage footprints and the rule sets and assumptions in NEI 07-13, determination of whether or not the SSCs would be capable of performing their intended function.

3. Determination of whether damage has resulted in accident initiators such as breaches of the reactor coolant system or failure of the reactor to trip.

4. Determination of whether success paths for core cooling, spent fuel pool cooling and containment isolation exist.

Guidance to the applicant for performing these activities is provided in Section 3 of the industry guidance document, NEI 07-13.

C. SPECIFIC TECHNICAL GUIDANCE

1. Establishing SSCs for Consideration. Verify that the applicant has determined, given the completeness of the plant design, the spatial configuration of SSCs needed to prevent or mitigate fuel damage in the core or spent fuel pool, and loss of reactor containment, and which SSCs, may lie within the damage footprint previously established.

This includes:

· the locations of all system piping that are essential for a SSC to successfully perform its function

   the locations of all power cabling essential for successful operation of the SSC

   the locations of all command and control cabling essential for successful operation of the SSC

· the locations of any other SSCs that the target SSC depends on to function

1 It is not necessary for the applicant to perform these steps in regard to spent fuel pooling if design features have been included to maintain structural integrity of the fuel pool.

Issue Date:  03/23/20	AppC-1	37804

In accordance with NEI 07-13, the applicant will use information from the probabilistic risk assessment (PRA) studies of the design to identify the scope of key systems and components that must be considered.  This information may include a listing of all systems and components modeled in the PRA, including fire and external events PRAs, if they have been completed.  The applicant may also use lists of equipment covered under the Design Reliability Assurance Program (D-RAP).  The applicant may use building layout drawings, system design drawings and information from fire, flood and seismic hazards analyses (e.g., fire area drawings) to identify system and component locations.

The inspector should sample risk-significant SSCs identified in the PRA or from the D-RAP to gain confidence that the applicant’s process is identifying important SSCs.  The inspector should also pick two or three frontline systems or components and verify that supporting equipment necessary for the system or component to perform its intended function is being considered, i.e., that important dependencies are being addressed.  Attention should also be given to the treatment of field-routed equipment (e.g., pipe runs and cables).  Verify that the applicant’s treatment is consistent with the rules and guidelines specified in NEI -7-13.

The inspector should verify that documentation used by the applicant to develop and identify spatial information (e.g., internal events PRA, internal flooding analysis, internal fire analysis and/or building layout diagrams) is current.

2. Determining State of SSCs in Aircraft Impact Scenarios.  Verify that the applicant is correctly applying the rules and assumptions given in NEI 07-13 for the loss of SSCs. The NRC inspection team will select a sample of SSCs that the applicant has identified as remaining functional in one or more scenarios and verify that these SSCs appropriately survived the conditions created by the aircraft impact, consistent with the rules and assumptions given in NEI 07-13.  If an error occurs, the inspection team should increase the sample size to determine if the identified error was an isolated occurrence.  In most cases the state of SSCs will be determined using rule-sets pertaining to fire, shock and structural damage.  This part of the system-loss inspection should be coordinated closely with the fire protection and structural damage inspections.

Issue Date:  03/23/20	AppC-1	37804

The inspector should verify the completeness of the failures identified and the timing of those failures for the SSCs located outside the damage footprints.  Time-delays associated with system and component failures should consider, for example, the following causes:

(a) Loss of Heating, Ventilation, and Air Conditioning (HVAC)

(b) Loss of instrument air to air accumulators, air receivers

(c) Battery depletion

(d) Loss of external cooling to pump seals or bearings

Where the applicant has taken credit for time delay of a failure, verify that supporting evaluations or calculations that provide the basis for this time delay have been adequately inspected per the applicant’s QA program.

Verify that the following rules and assumptions in NEI 07-13 were applied to determine the functionality of SSCs within the damage footprints.

(a) If the polar crane is supported from the outer containment wall in a hittable region, or is mounted on parallel tracks (as opposed to a circular rail around the containment), then it should be considered susceptible to falling. In these cases, any exposed primary system piping and exposed SSCs should be considered damaged2.

(b) The impact of an aircraft on the containment structure has the potential to cause shock damage to any fragile SSCs attached to the outer containment wall near the assumed point of impact. SSCs considered fragile include electrical components such as containment fan coolers, switchgear, instrumentation, etc. In evaluating this scenario, any such SSCs should be considered immediately damaged and incapable of performing their intended function.

(c) Physical impact damage to SSCs is determined by defining a damage path of fixed width and length. Within the damage path, the following assumptions should be applied:

(1) Immediate failure of all active equipment function(s)

(2) Immediate failure of all cables

(3) Piping immediately adjacent to impacted walls is severed

(4) Other piping in the impact area will sustain varying levels of damage from (1) none to (2) crushing without leakage to (3) crushing and tearing with leakage to (4) severing. Because it is impossible to predict how individual pipes will be affected, a value of 1⁄2 the diameter of pipes was selected through expert elicitation as a reasonable value for estimating the flow of fluids from the pipe(s) for evaluating flooding effects.

(d) Ventilation ductwork in the physical damage footprint is expected to be severely crushed and torn.

(e) Off-site AC power may be assumed to be available unless the damage footprint specifically fails it on-site.

(f) All SSCs in the physical damage footprint are assumed lost immediately. In compartments affected by fire spread beyond the physical damage footprint, all cables and electrical equipment is assumed to have failed within five minutes.

(g) If cable information is not available for SSCs that are necessary for a success 

___________________

2 The term “damaged” is synonymous with failed beyond repair or recovery, unless stated otherwise.

Issue Date:  03/23/20	AppC-1	37804

(h) path, the cables should be assumed to be damaged unless there is evidence that they would not be within the damage footprint (e.g., if both the SSC and the power supplies are located in a different building/area and there is no reason to believe that the cables would have been run through the damage footprint).

(i) Ventilation systems in areas affected by fire spread are expected to be lost because quickly rising temperatures will cause fusible links in dampers to actuate. Additionally, ventilation fans in the affected areas will also be lost as cables and electrical motors fail within 5 minutes due to fire exposure.

(j) All equipment within the shock damage footprint is assumed to fail at the time of impact. Shock damage for various categories of SSCs is assessed in accordance with the rule set given in Table 3-3 of NEI 07-13.

(k) Containment penetrations should be evaluated to assure that physical damage does not lead to containment failure.  If cable locations are not available for containment isolation valves, the valves will be assumed to go to the position they would take due to loss of power.  Penetrations may be excluded from further assessment based on the following criteria:

(1) Penetrations that are not connected directly to either the Reactor Coolant System (RCS) or the containment atmosphere

(2) Penetrations that are only open less than 1% of the time

(3) Penetrations where there are check valves inside containment that serve the containment isolation function

(4) Penetrations that have at least one motor-operated damper inside containment that is normally closed

(5) Penetrations connected to a closed loop system inside containment

(6) Penetrations containing at least one manual valve inside containment that is normally closed

(7) Penetrations containing air-operated valves (AOVs) or motor-operated valves (MOVs) inside containment that are normally closed and remain closed on loss of either air pressure or power

(8) AOVs inside containment that are normally open and fail closed on loss of either air pressure or power

(l) The assessment should also consider that containment isolation is not manually performed prior to damage.  Isolation of the containment should be considered an important function for scenarios involving loss of fuel cooling or a loss of coolant accident.

3. Determination of Accident Conditions.  Verify that the applicant has correctly applied the rules and assumptions for accident conditions consistent with the guidance provide in NEI 07-13 for such conditions as Loss of Coolant Accident (LOCA), Anticipated Transient Without Scram (ATWS), flooding, containment bypass, loss of spent fuel pool cooling and shutdown.  The NRC inspection team should select at least one impact scenario and confirm that the applicant has properly evaluated it in accordance with the guidance and assumptions in NEI 07-13.  If an error is identified, the inspector should determine if it is an isolated instance or if the applicant incorrectly applied any of the NEI 07-13 rules and assumptions for determining accident conditions.  In addition, the NRC inspection team should confirm that the documented approach is consistent with the rules and assumptions in NEI 07-13.  In performing this inspection, the  following specific items should be verified:

(a) Verify that the applicant’s success criteria (and the scenario analysis) address initial plant states of 100% power and cold shutdown

(b) Verify that the analysis assumes offsite AC power is available unless the damage footprint specifically fails it on-site

(c) Verify that for shutdown cooling scenarios, the applicant assumes that the non-operating loop of shutdown cooling is out of service for maintenance, the reactor vessel is vented, water level is at or near the reactor vessel head flange, and the reactor has been shut down for 7 days

(d) Verify that the applicant has considered the possibility of an ATWS for those damage footprints that include equipment essential to reactor scram and equipment associated with ATWS mitigating systems, including equipment necessary for manually scramming the reactor following impact should it not have been shutdown manually prior to impact

(e) Verify that the applicant has considered the influence of containment status  on the operability of other equipment (e.g., pumps that draw suction water from the containment sump)

(f) Verify that the applicant has searched for instances where a containment bypass LOCA may occur

Some of the aircraft impact scenarios considered by the applicant may result in plant conditions that result in the loss of specific safety functions.  These conditions include:

(a) LOCA inside containment

(b) LOCA outside containment

(c) ATWS

(d) Flooding

(e) Loss of Decay Heat removal

Verify that the treatment of these conditions is consistent with Chapter 3 of NEI 07-13 (summarized below):

(a) NEI 07-13 Treatment of LOCA.  NEI 07-13 requires that applicants assume piping immediately adjacent to impacted walls is severed, and that other piping in the impact area will sustain varying levels of damage.  Because it is impossible to predict how individual pipes will be affected, a range of pipe breaks should be explored as follows for assessing LOCAs:

(1) The lesser of an area of half the diameter of the pipe or 64 square inches

(2) An area of 3 square inches.

LOCAs may be induced by means other than a pipe rupture.  For example, LOCAs may be induced from loss of seal cooling to primary coolant system 

pumps or the spurious opening of a primary system relief valve.  These mechanisms should be considered in the evaluation.

(b) NEI 07-13 Treatment of Flooding. A value of 1⁄2 the diameter is to be assumed as a reasonable value for estimating the flow of fluids from the pipe(s) for evaluating flooding effects.

The potential effects on SSCs of internal flooding which may occur due to piping damage should be considered in the assessment.  Flooding from limited sources is assumed to be bounded by the effect of the fire and explosion and existing pipe break flooding analyses.  In the case of damage to systems that are supplied by large quantity sources (i.e., open loop systems drawing from lakes, rivers, oceans, cooling tower basins, etc.), the effect of a flood could be much more widespread.  These effects should be evaluated as an overlay on the identified damage footprint (i.e., the assessment will look at the damage footprint with and without consideration of flooding from large sources).

(c) NEI 07-13 Treatment of Reactor Scram.  The baseline assumption in the applicant’s evaluation will be successful reactor scram prior to damage. However, an assessment will be made of the potential for damage to prevent a scram when reviewing damage footprints in areas with equipment essential to reactor scram.  For designs (some passive designs) where a scram MUST occur for decay heat removal systems to perform their fuel cooling function, both physical damage to equipment and damage to the control room, remote shutdown panel, egress pathways to the remote shutdown pathway and survivability of the operators should be considered.

For active designs, it may be assumed that the loss of internal power distribution results in a scram unless physical damage prevents movement of the control rods.

(d) NEI 07-13 Treatment of Containment Bypass.  The analysis should address scenarios where the plant is initially at 100% power and scenarios where the plant is in a shutdown condition.  Also, full power scenarios should evaluate the potential for containment bypass based on the damage footprint and its effect on containment systems (e.g., rupture of a piping segment that penetrates containment could lead to containment bypass).  Unless isolated, a containment bypass LOCA may also lead to loss of reactor coolant system inventory that would otherwise be available for recirculation from the containment sump. Instances where a containment bypass LOCA occurs should be identified, along with any corresponding success criteria.  Flow rates for bypass scenarios should be assessed based on the degree of damage assumed and plant-specific design features.

As discussed in Table 3-4 of NEI 07-13, containment penetrations should be evaluated to assure that physical damage does not lead to containment failure. If the containment has not been isolated prior to the event, damage associated with the impact may prevent isolation.  The analysis should consider the possibility that containment isolation is not manually performed prior to core damage.  Where cable data are not available for containment isolation valves 

(CIVs), post-impact positions of individual CIVs should be based on the position that each valve would take on loss of power.

(e) NEI 07-13 Treatment of Shutdown Operation. An evaluation will be made of the potential damage that might occur if the strike were to occur when the plant is shutdown and the shutdown cooling system is operating.  The focus here is on the potential to cause core damage and containment bypass3 due to damage to the shutdown cooling piping.  For the evaluation of shutdown cooling scenarios, consider cases where each shutdown cooling loop is in operation.  Include the following assumptions about plant configuration:

(1) Equipment in the division of the non-operating loop is out of service for maintenance

(2) The reactor vessel is vented (i.e., large vent)

(3) Water level is at or near the reactor vessel head flange

(4) Reactor has been shutdown for 7 days

(5) NEI 07-13 Treatment of Loss of Spent Fuel Pool Cooling

The fuel in the spent fuel pool is assumed to contain a routine core off-load roughly 30 days after reactor shutdown.

4. Identification of Success Paths.  In previous steps of the evaluation the applicant has defined, for each impact scenario, those key safety functions that are challenged and the status (availability) of SSCs that can mitigate those challenges.  In this step, the applicant uses these results and the success criteria from the design or plant-specific PRA to determine if a success path for preventing fuel damage or, in the case were fuel damage has been shown to occur, maintaining the containment intact exists. A success path constitutes a sequence of actions involving functional SSCs that has been previously established in the PRA, Design Certification Document or FSAR to successfully keep fuel in the core from being damaged, or in the case of a damaged core, the containment intact, or fuel in the spent fuel pool from being damaged. However, it must be clear that these actions will either occur automatically or can be initiated from areas outside the damage footprint (e.g., control room, remote shutdown panel or locally) in sufficient time to be effective.

PRA success criteria reflect realistic best-estimate conditions (versus conservative design basis conditions) and credit both safety-related and non-safety-related SSCs. In situations where core damage cannot be prevented, the containment boundary represents the final barrier to release of radioactivity to the environment.  In these cases, the applicant must demonstrate that a containment bypass condition has not been created during impact and that the containment ultimate pressure capability, given a core damage event, would not be exceeded before effective mitigation strategies can be implemented.  Effective mitigation strategies are those that, for an indefinite period of time, provide sufficient cooling to the damaged core or containment to limit temperature and pressure challenges below the ultimate pressure capability of the containment as defined in DCD/FSAR Chapter 19.  The containment ultimate 

pressure capability described in DCD/FSAR Chapter 19 is appropriate for use provided there is no structural damage to the containment structure.  If structural damage has occurred to the containment structure, a revised ultimate pressure

capability considering the damaged condition must be determined. In assessing the

3 In order to satisfy the requirements of 10CFR 50.150, design enhancement(s) would be necessary to address such a condition.

condition of the containment boundary, it is important to evaluate the status of the containment penetrations.

Issue Date:  03/23/20	AppC-1	37804

Effective mitigation strategies may include features of the plant designed specifically to prevent containment failure following an accident involving core damage.  These features may be credited by the applicant if they are described in DCD/FSAR Chapter 19.  For BWRs, actuation of the wetwell vent line is acceptable as this is a designed, scrubbed release.

It is expected that applicants will search for success paths by mapping the set of functional and failed systems onto appropriate fault tree(s) and event tree(s) from the PRA.  The selection of the appropriate event tree should be based on the plant conditions created by the event.  If a small LOCA is created directly as a result of the event, then the corresponding small LOCA event tree would be appropriate.

For non-LOCA events, a corresponding transient event tree (e.g., loss of heat removal capability) would be appropriate. Use of ATWS event trees would be appropriate in situations where it must be assumed that damage has prevented reactor scram.

The inspector should verify that the applicant has used the PRA which serves as the basis for the information documented in Chapter 19 of the Design Certification Document, Design Approval Document or FSAR, considering the type of applicant being inspected.

The inspector should review a sample of at least one of the applicant’s scenarios and verify that the applicant is using the appropriate fault trees, event trees, and success criteria.

Close attention should be paid to cases where the applicant has credited human actions in a success path. In many cases, credit for human actions may not be justified.  For example, if the control building is damaged, controls or other equipment needed to initiate and maintain mitigation measures may be damaged and the availability of trained operators may be severely limited.  In addition, damage to electrical circuits, cables, and sensors in the plant has the potential to affect process information available to operators, such that the instrumentation data provided may be misleading, conflicting, and/or unavailable.  At the same time, numerous alarms may be generated and communication pathways may be disrupted, including intra-plant communication systems. In all cases the level of operator stress will be very high, given the nature of aircraft impact scenarios.  Credit should not be given in success paths for recovering equipment that had been determined to be failed due to the effects of the aircraft impact (i.e., structural, fire and shock damage).

5.  Systems-Loss Inspection Guidance Checklist

Below is an inspection checklist that should be used to summarize the findings of the systems-loss inspection. In the event that there are aspects of the inspection that are incomplete, the specific nature of the incomplete item should be described in detail in a summary inspection report.

Issue Date:	AppC-1	37804

Issue Date:  03/23/20	AppC-14	37804

Attachment 1 - Revision History for IP 37804

Issue Date:  03/23/20	Att1-1	37804

# image2.png

# image3.png