ML21210A027

Evaluation of the Proposed Change

ML21210A027
Person / Time
Site:	Callaway
Issue date:	07/29/2021
From:	Ameren Missouri, Union Electric Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML21210A025	List: ML21210A027 ML21210A028 ULNRC-06678, Supplemental Information for Application to Adopt 10 CFR 50.69, Risk-Informed Categorzation and Treatment of Structures, Systems and Components for Nuclear Power Reactors
References
ULNRC-06678
Download: ML21210A027 (127)

Text

Enclosure 1 to ULNRC-06678 Evaluation of the Proposed Change (126 pages) to ULNRC-06678 Page 1 of 30 Enclosure 1 Evaluation of the Proposed Change Table Of Contents 1

SUMMARY

DESCRIPTION ...................................................................................... 3 2 DETAILED DESCRIPTION ....................................................................................... 3 2.1 CURRENT REGULATORY REQUIREMENTS .......................................................3 2.2 REASON FOR PROPOSED CHANGE .....................................................................4

2.3 DESCRIPTION

OF THE PROPOSED CHANGE...................................................5 3 TECHNICAL EVALUATION ...................................................................................... 6 3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i)) .6 3.1.1 Overall Categorization Process .............................................................6 3.1.2 Passive Categorization Process ..........................................................12 3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii)) ..........13 3.2.1 Internal Events and Internal Flooding .............................................13 3.2.2 Fire Hazards ...............................................................................................13 3.2.3 Seismic Hazards........................................................................................14 3.2.4 High Winds Hazards ................................................................................14 3.2.5 Other External Hazards .........................................................................14 3.2.6 Low Power & Shutdown ........................................................................15 3.2.7 PRA Maintenance and Updates ...........................................................15 3.2.8 PRA Uncertainty Evaluations ...............................................................16 3.2.9 Modeling of Flex .......................................................................................17 3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii)) ..................20 3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv)) ...........................................23 3.5 FEEDBACK AND ADJUSTMENT PROCESS .......................................................24 3.6 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA .........................24 3.7 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS .....................25

3.8 CONCLUSION

S .........................................................................................................27 4 ENVIRONMENTAL CONSIDERATION ................................................................. 27 5 REFERENCES ........................................................................................................... 27 to ULNRC-06678 Page 2 of 30 LIST OF ATTACHMENTS : List of Categorization Prerequisites : Description of PRA Models Used in Categorization : Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items : External Hazards Screening : Progressive Screening Approach for Addressing External Hazards : Key Assumptions and Sources of Uncertainty : Comparison of RG 1.200 Revision 1 and Revision 2 SRs Applicable to CC-I/II, CC-II/III, and CC-I/II/III : LAR Supplement to Address Audit Discussion Points and Potential RAIs Summarized in NRC Letter Dated June 9, 2021 (ML21139A022) to ULNRC-06678 Page 3 of 30 1

SUMMARY

DESCRIPTION The proposed license amendment modifies the licensing basis to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance, resulting in improved plant safety.

2 DETAILED DESCRIPTION 2.1 CURRENT REGULATORY REQUIREMENTS The U.S. Nuclear Regulatory Commission (NRC) has established a set of regulatory requirements for commercial nuclear reactors to ensure that a reactor facility does not impose an undue risk to the health and safety of the public, thereby providing reasonable assurance of adequate protection to public health and safety. The current body of NRC regulations and their implementation are largely based on a "deterministic" approach.

This deterministic approach establishes requirements for engineering margin and quality assurance in design, manufacture, and construction. In addition, it assumes that adverse conditions can exist (e.g., equipment failures and human errors) and establishes a specific set of design basis events (DBEs). The deterministic approach then requires that the facility include safety systems capable of preventing or mitigating the consequences of those DBEs to protect public health and safety. The Structures, Systems and Components (SSCs) necessary to defend against the DBEs are defined as "safety-related." These SSCs are the subject of many regulatory requirements, herein referred to as "special treatments," and are designed to ensure that they are of high quality and high reliability and have the capability to perform during postulated design basis conditions. Treatment includes, but is not limited to, quality assurance, testing, inspection, condition monitoring, assessment, evaluation, and resolution of deviations.

The distinction between "treatment" and "special treatment" is the degree of NRC specification as to what must be implemented for particular SSCs or for particular conditions. Typically, the regulations establish the scope of SSCs that receive special treatment using one of three different terms: "safety-related," "important to safety," or "basic component." The terms "safety-related" and "basic component" are defined in to ULNRC-06678 Page 4 of 30 the regulations, while "important to safety," used principally in the general design criteria of Appendix A to 10 CFR Part 50, is not explicitly defined.

2.2 REASON FOR PROPOSED CHANGE A probabilistic approach to regulation enhances and extends the traditional deterministic approach by allowing consideration of a broader set of potential challenges to safety, providing a logical means for prioritizing these challenges based on safety significance, and allowing consideration of a broader set of resources to defend against these challenges. In contrast to the deterministic approach, Probabilistic Risk Assessments (PRAs) address credible initiating events by assessing the event frequency. Mitigating system reliability is then assessed, including the potential for common cause failures. The probabilistic approach to regulation is an extension and enhancement of traditional regulation by considering risk in a comprehensive manner.

To take advantage of the safety enhancements available through the use of PRA, in 2004 the NRC published a new regulation, 10 CFR 50.69. The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with the regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance resulting in improved plant safety.

The rule contains requirements on how a licensee categorizes SSCs using a risk-informed process, adjusts treatment requirements consistent with the relative significance of the SSC, and manages the process over the lifetime of the plant. A risk-informed categorization process is employed to determine the safety significance of SSCs and place the SSCs into one of four risk-informed safety class (RISC) categories.

The determination of safety significance is performed by an integrated decision-making process, as described by Nuclear Energy Institute (NEI) 00-04, "10 CFR 50.69 SSC Categorization Guideline" (Reference 1), which uses both risk insights and traditional engineering insights. The safety functions include the design basis functions, as well as functions credited for severe accidents (including external events). Special or alternative treatment for the SSCs is applied as necessary to maintain functionality and reliability and is a function of the SSC categorization results and associated bases.

Finally, periodic assessment activities are conducted to make adjustments to the categorization and/or treatment processes as needed so that SSCs continue to meet all applicable requirements.

The rule does not allow for the elimination of SSC functional requirements or allow equipment that is required by the deterministic design basis to be removed from the facility. Instead, the rule enables licensees to focus their resources on SSCs that make to ULNRC-06678 Page 5 of 30 a significant contribution to plant safety. For SSCs that are categorized as high safety significant, existing treatment requirements are maintained or enhanced. Conversely, for SSCs that do not significantly contribute to plant safety on an individual basis, the rule allows an alternative risk-informed approach to treatment that provides a reasonable, though reduced, level of confidence that these SSCs will satisfy functional requirements.

Implementation of 10 CFR 50.69 will allow Ameren Missouri to improve focus on equipment that has safety significance, thus resulting in improved plant safety.

2.3 DESCRIPTION

OF THE PROPOSED CHANGE Ameren Missouri proposes the addition of the following license condition to the renewed operating license of Callaway Plant, Unit No. 1, to document the NRC's approval of the use 10 CFR 50.69.

Ameren Missouri is approved to implement 10 CFR 50.69 using the processes for categorization of Risk Informed Safety Class (RISC)-1, RISC-2, RISC-3, and RISC-4 SSCs using: Probabilistic Risk Assessment (PRA) models to evaluate risk associated with internal events, including internal flooding, internal fire, high winds, and seismic risk; the shutdown safety assessment process to assess shutdown risk; the Arkansas Nuclear One, Unit 2 (ANO-2) passive categorization method to assess passive component risk for Class 2 and Class 3 SSCs and their associated supports; and the results of non-PRA evaluations that are based on a screening of other external hazards updated using the external hazard screening significance process identified in American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard RA-Sa-2009; as specified in License Amendment No. [XXX] dated [Date].

The above License Condition is proposed to be incorporated as License Condition 2.(C).19 of the Callaway Operating License (OL). As noted in the cover letter of this LAR, a mark-up of the affected OL page is provided in Enclosure 2. Additionally, a "clean" copy of the affected OL page reflecting incorporation of proposed License Condition 2.(C).(19) is provided as Enclosure 3.

Prior NRC approval, under 10 CFR 50.90, is required for implementation of the categorization process specified above, including approval of the proposed license condition. Upon approval of the above-described 10 CFR 50.69 process for Callaway, any future change to the categorization process described above would require NRC approval under 10 CFR 50.69.

to ULNRC-06678 Page 6 of 30 3 TECHNICAL EVALUATION 10 CFR 50.69 specifies the information to be provided by a licensee requesting adoption of the regulation. This request conforms to the requirements of 10 CFR 50.69(b)(2),

which states:

A licensee voluntarily choosing to implement this section shall submit an application for license amendment under § 50.90 that contains the following information:

(i) A description of the process for categorization of RISC-1, RISC-2, RISC-3 and RISC-4 SSCs.

(ii) A description of the measures taken to assure that the quality and level of detail of the systematic processes that evaluate the plant for internal and external events during normal operation, low power, and shutdown (including the plant-specific probabilistic risk assessment (PRA), margins-type approaches, or other systematic evaluation techniques used to evaluate severe accident vulnerabilities) are adequate for the categorization of SSCs.

(iii) Results of the PRA review process conducted to meet § 50.69(c)(1)(i).

(iv) A description of, and basis for acceptability of, the evaluations to be conducted to satisfy § 50.69(c)(1)(iv). The evaluations must include the effects of common cause interaction susceptibility, and the potential impacts from known degradation mechanisms for both active and passive functions and address internally and externally initiated events and plant operating modes (e.g., full power and shutdown conditions).

Each of these submittal requirements are addressed in the following sections.

3.1 CATEGORIZATION PROCESS DESCRIPTION (10 CFR 50.69(b)(2)(i))

3.1.1 Overall Categorization Process Ameren Missouri will implement the risk categorization process in accordance with NEI 00-04, Revision 0, as endorsed by Regulatory Guide (RG) 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance" (Reference 2). NEI 00-04 Section 1.5 states, "Due to the varying levels of uncertainty and degrees of conservatism in the spectrum of risk contributors, the risk significance of SSCs is assessed separately from each of five risk perspectives and used to identify SSCs that are potentially safety-significant."

Separate evaluations are appropriate to avoid reliance on a combined result that may mask the results of individual risk contributors.

to ULNRC-06678 Page 7 of 30 The process to categorize each system will be consistent with the guidance in NEI 00-04, as endorsed by RG 1.201. RG 1.201 states that "the implementation of all processes described in NEI 00-04 (i.e., Sections 2 through 12) is integral to providing reasonable confidence" and that "all aspects of NEI 00-04 must be followed to achieve reasonable confidence in the evaluations required by §50.69(c)(1)(iv)." However, neither RG 1.201 nor NEI 00-04 prescribe a particular sequence or order for each of the elements to be completed. Therefore, the order in which each of the elements of the categorization process (listed below) is completed is flexible, and as long as they are all completed, they may even be performed in parallel. Note that NEI 00-04 only requires Item 3 to be completed for components/functions categorized as Low Safety Significant (LSS) by all other elements. Similarly, NEI 00-04 only requires Item 4 to be completed for safety related active components/functions categorized as LSS by all other elements.

1. PRA-Based Evaluations (e.g., the internal events, internal flooding, fire, seismic, and high winds PRAs)

2. Non-PRA Approaches (e.g., other external events screening, and shutdown assessment)

3. Seven Qualitative Criteria in Section 9.2 of NEI 00-04

4. The Defense-in-Depth Assessment

5. The Passive Categorization Methodology Categorization of SSCs will be completed per the NEI 00-04 process, as endorsed by RG 1.201, which includes the determination of safety significance through the various elements identified above. The results of these elements are used as inputs to arrive at a preliminary component categorization (i.e., High Safety Significant [HSS] or Low Safety Significant) that is presented to the Integrated Decision-Making Panel (IDP).

Note: the term "preliminary HSS or LSS" is synonymous with the NEI 00-04 term "candidate HSS or LSS." A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Table 3-1 below. The safety significance determination of each element identified above is independent of the others, and therefore, the sequence of the elements does not impact the resulting preliminary categorization of each component or function. Consistent with NEI 00-04, the categorization of a component or function will only be "preliminary" until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final RISC category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04 Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS; however, the ability to change component to ULNRC-06678 Page 8 of 30 categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04 and endorsed by RG 1.201.

Table 3-1 summarizes these IDP limitations described in NEI 00-04. The steps of the process are performed at either the function level, component level, or both, as also summarized in Table 3-1. A component is assigned its final RISC category upon approval by the IDP.

Table 3-1: Categorization Evaluation Summary IDP Categorization Drives Evaluation Change Element Step - NEI 00-04 Associated Level HSS to Section Functions LSS Internal Events (including Internal Not Yes Flooding) Base Allowed Case - Section 5.1 Internal Fire, Seismic, and High Risk (PRA Allowable No Winds Events Base Component Modeled) Case PRA Sensitivity Allowable No Studies Integral PRA Not Assessment - Yes Allowed Section 5.6 Other External Not Hazards - Component No Risk (Non- Allowed Section 5.4 modeled)

Shutdown - Function/ Not No Section 5.5 Component Allowed Core Damage - Function/ Not Yes Defense- Section 6.1 Component Allowed in-Depth Containment - Not Component Yes Section 6.2 Allowed Qualitative Considerations -

Function Allowable1 N/A Criteria Section 9.2 Segment/ Not Passive Passive - Section 4 No Component Allowed to ULNRC-06678 Page 9 of 30 Table Notes:

1 The assessments of the qualitative considerations are agreed upon by the IDP in accordance with Section 9.2. In some cases, a 50.69 categorization team may provide preliminary assessments of the seven considerations for the IDPs consideration, however the final assessments of the seven considerations are the direct responsibility of the IDP.

The seven considerations are addressed preliminarily by the 50.69 categorization team for at least the system functions that are not found to be HSS due to any other categorization step. Each of the seven considerations requires a supporting justification for confirming (true response) or not confirming (false response) the consideration. If the 50.69 categorization team determines that one or more of the seven considerations cannot be confirmed, then that function is presented to the IDP as preliminary HSS.

Conversely, if all the seven considerations are confirmed, then the function is presented to the IDP as preliminary LSS.

The System Categorization Document, including the justifications provided for the qualitative considerations, is reviewed by the IDP. The IDP is responsible for reviewing the preliminary assessment to the same level of detail as the 50.69 team (i.e., all considerations for all functions are reviewed). The IDP may confirm the preliminary function risk and associated justification or may direct that it be changed based upon their expert knowledge. Because the Qualitative Criteria are the direct responsibility of the IDP, changes may be made from preliminary HSS to LSS or from preliminary LSS to HSS at the discretion of the IDP. If the IDP determines any of the seven considerations cannot be confirmed (false response) for a function, then the final categorization of that function is HSS.

The mapping of components to system functions is used in some categorization process steps to facilitate preliminary categorization of components. Specifically, functions with mapped components that are determined to be HSS by the PRA-based assessment (i.e., internal events PRA or integral PRA assessment) or defense-in-depth evaluation will be initially treated as HSS. However, NEI 00-04 Section 10.2 allows detailed categorization which can result in some components mapped to HSS functions being treated as LSS, and Section 4.0 discusses additional functions that may be identified (e.g., fill and drain) to group and consider potentially LSS components that may have been initially associated with an HSS function but which do not support the critical attributes of that HSS function. Note that certain steps of the categorization process are performed at a component level (e.g., Passive, non-PRA-modeled hazards, as shown on Table 3-1). These components from the component level assessments will remain HSS (IDP cannot override) regardless of the significance of the functions to which they are mapped. Therefore, if an HSS component is mapped to an LSS function, that component will remain HSS. If an LSS component is mapped to an HSS function, that component may be driven to HSS based on Table 3-1 above, or it may remain LSS.

The following are clarifications to be applied to the NEI 00-04 categorization process:

The IDP will be composed of a group of at least five experts who collectively have expertise in plant operation, design (mechanical and electrical) engineering, system engineering, safety analysis, and probabilistic risk assessment. At least three members of the IDP will have a minimum of five years of experience at the plant, to ULNRC-06678 Page 10 of 30 and there will be at least one member of the IDP who has a minimum of three years of experience in the modeling and updating of the plant-specific PRA.

The IDP will be trained in the specific technical aspects and requirements related to the categorization process. Training will address at a minimum the purpose of the categorization; present treatment requirements for SSCs, including requirements for design basis events; PRA fundamentals; details of the plant-specific PRA including the modeling, scope, and assumptions, the interpretation of risk importance measures, and the role of sensitivity studies and the change-in-risk evaluations; and the defense-in-depth philosophy and requirements to maintain this philosophy.

The decision criteria for the IDP for categorizing SSCs as safety significant or low safety-significant pursuant to § 50.69(f)(1) will be documented in Ameren Missouri procedures. Decisions of the IDP will be arrived at by consensus. Differing opinions will be documented and resolved, if possible. However, a simple majority of the panel is sufficient for final decisions regarding HSS and LSS.

Passive characterization will be performed using the processes described in Section 3.1.2 of this enclosure. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

An unreliability factor of 3 will be used for the sensitivity studies described in Section 8 of NEI 00-04. The factor of 3 was chosen because it is representative of the typical error factor of basic events used in the PRA model.

NEI 00-04 Section 7 requires assigning the safety significance of a function to be preliminary HSS if it is supported by an SSC determined to be HSS from the PRA-based assessment in Section 5, but it does not require this for SSCs determined to be HSS from non-PRA-based, deterministic assessments in Section 5.

This requirement is further clarified in the Vogtle SER (Reference 8) which states, "if any SSC is identified as HSS from either the integrated PRA component safety significance assessment (Section 5 of NEI 00-04) or the defense-in-depth assessment (Section 6), the associated system function(s) would be identified as HSS."

Once a system function is identified as HSS, then all the components that support that function are preliminary HSS. The IDP must intervene to assign any of these HSS Function components to LSS.

With regard to the criteria that considers whether the active function is called out or relied upon in the plant Emergency/Abnormal Operating Procedures, Ameren Missouri will not take credit for alternate means unless the alternate means are proceduralized and included in Licensed Operator training.

The risk analysis to be implemented for each hazard is described below.

to ULNRC-06678 Page 11 of 30 PRA models of record (MOR) that are current at the time of categorization will be used to perform the risk analysis. The current MOR include the following:

Internal Event Risks: Internal events including internal flooding PRA model, Update 9.01.

Fire Risks: Fire PRA model, Update 9.01.

Seismic Risks: Seismic PRA model, Update 9.01.

High Winds Risks: High Winds PRA model, Update 9.01.

Other External Risks (e.g., external floods): PRA-OEH-ANALYSIS, "Other External Hazards: Screening Assessment Notebook." The results of non-PRA evaluations are based on the screening of other external hazards updated using the external hazard screening significance process identified in American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard RA-Sa-2009, as formally endorsed in RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

Revision 2 and 3 (References 12 and 36).

Low Power and Shutdown Risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management" (Reference 7), which provides guidance for assessing and enhancing safety during shutdown operations.

A change to the categorization process that is outside the bounds specified above will not be used without prior NRC approval. The SSC categorization process documentation will include the following elements:

1. Program procedures used in the categorization

2. System functions, identified and categorized with the associated bases

3. Mapping of components to support function(s)

4. PRA model results, including sensitivity studies

5. Hazards analyses, as applicable

6. Passive categorization results and bases

7. Categorization results including all associated bases and RISC classifications

8. Component critical attributes for HSS SSCs to ULNRC-06678 Page 12 of 30

9. Results of periodic reviews and SSC performance evaluations

10. IDP meeting minutes and qualification/training records for the IDP members 3.1.2 Passive Categorization Process For the purposes of 10 CFR 50.69 categorization, passive components are those components that have a pressure retaining function. Passive components and the passive function of active components will be evaluated using the Arkansas Nuclear One (ANO) Risk-Informed Repair/Replacement Activities (RI-RRA) methodology contained in Reference 9 (ML090930246) consistent with the related Safety Evaluation (SE) issued by the Office of Nuclear Reactor Regulation.

The RI-RRA methodology is a risk-informed safety classification and treatment program for repair/replacement activities (RI-RRA methodology) for pressure retaining items and their associated supports. In this method, the component failure is assumed with a probability of 1.0 and only the consequence evaluation is performed. It additionally applies deterministic considerations (e.g., DID, safety margins) in determining safety significance. Consistent with the Reference 9 ANO-2 Safety Evaluation, pipe supports were not required to be in the scope of the evaluation but may be included in the scope at the licensees discretion. Component supports, if categorized, are assigned the same safety significance as the highest passively ranked component within the bounds of the associated analytical pipe stress model. Consistent with NEI 00-04, an HSS determination by the passive categorization process cannot be changed by the IDP.

The RI-RRA method was also approved to be used for a 10 CFR 50.69 application as documented in the NRC's final Safety Evaluation for Vogtle, dated December 17, 2014 (Reference 8). The RI-RRA method as approved for use at Vogtle for 10 CFR 50.69 does not have any plant specific aspects and is generic. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures.

Safety significance is generally measured by the frequency and the consequence of the event. However, this RI-RRA process categorizes components solely based on consequence, which measures the safety significance of the passive component given that it ruptures. This approach is conservative compared to including the rupture frequency in the categorization, as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment.

The passive categorization process is intended to apply the same risk-informed process accepted by the NRC in the Reference 9 ANO2-R&R-004 document for the passive categorization of Class 2, 3, and non-class components. This is the same passive SSC scope the NRC has conditionally endorsed in ASME Code Cases N-660 and N-662 as published in Regulatory Guide 1.147, Revision 15. Both code cases employ a similar risk-informed safety classification of SSCs in order to change the repair/replacement requirements of the affected LSS components. All ASME Code Class 1 SSCs with a pressure retaining function, as well as supports, will be assigned high safety-to ULNRC-06678 Page 13 of 30 significant, HSS, for passive categorization, which will result in HSS for its risk-informed safety classification and cannot be changed by the IDP. Therefore, it is proposed that this methodology and scope for passive categorization is acceptable and appropriate for use at Callaway Plant, Unit No. 1, for 10 CFR 50.69 SSC categorization.

3.2 TECHNICAL ADEQUACY EVALUATION (10 CFR 50.69(b)(2)(ii))

The following sections demonstrate that the quality and level of detail of the processes used in categorization of SSCs are adequate. The PRA models described below have been peer reviewed, and there is neither a PRA upgrade nor a Newly Developed Method (NDM) that has not been peer reviewed.

3.2.1 Internal Events and Internal Flooding The Callaway Plant, Unit No. 1 categorization process for the internal events and flooding hazard will use the peer reviewed plant-specific PRA model. The Callaway Plant, Unit No. 1 risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant.

Related to the technical adequacy of the internal events model, the Internal Events discussion under Section 3.3 describes implementation of the methodology provided in PWROG-18027-NP (Reference 32) for assessing the loss of room cooling in PRA modeling. Following, but unrelated to, implementation of the method provided in PWROG-18027-NP into the Callaway PRA, this method was chosen by the PWROG and NEI to pilot the Newly Developed Methods (NDM) peer review process established in NEI 17-07 (Reference 33). The NEI 17-07 process was successfully completed with all applicable NDM attributes met at capability category (CC) CC I/II and no open peer review Findings against the method in PWROG-18027-NP. In addition, an implementation peer review and associated F&O closure review have been completed using NRC-approved processes, with no open Findings identified against implementation of the method. While the NEI 17-07 process was completed successfully, it is recognized that this process was not an endorsed process until RG 1.200, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 3 was issued in December 2020. As a result, the NRC staff may decide to independently review the method in PWROG-18027-NP for technical adequacy. The PWROG-18027-NP report contains the technical basis for the acceptability of the method and is available for NRC audit. of this enclosure identifies the applicable internal events (including internal flooding) PRA models.

3.2.2 Fire Hazards The Callaway Plant, Unit No. 1 categorization process for fire hazards will use a peer reviewed plant-specific fire PRA model. The internal fire PRA model was developed consistent with NUREG/CR-6850 and only utilizes methods previously accepted by the to ULNRC-06678 Page 14 of 30 NRC. Callaway Plant, Unit No. 1 was approved to implement NFPA-805 in January 2014, and since that time, there have been numerous updates to the approved methods through the issuance of fire PRA frequently asked questions and new or revised guidance documents. New or revised guidance is specifically addressed through the PRA maintenance and update process. The Ameren Missouri risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for the Callaway Plant, Unit No. 1.

It should also be noted that, as part of transition to NFPA-805, there were several committed modifications and implementation items as documented in NFPA-805 LAR Attachment S, "Plant Modifications and Items to be Completed during Implementation," which described the Callaway plant modifications necessary to implement the NFPA 805 licensing basis. All NFPA-805 LAR Attachment S items have been implemented; therefore, there are no NFPA-805 open items impacting this application. of this enclosure identifies the applicable fire PRA model.

3.2.3 Seismic Hazards The Callaway Plant, Unit No. 1 categorization process for seismic hazards will use a peer-reviewed plant-specific seismic PRA model. The Ameren Missouri risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for the Callaway Plant, Unit No. 1. Industry standard methods were utilized in the development of the seismic hazards for the seismic PRA. of this enclosure identifies the applicable seismic PRA model.

3.2.4 High Winds Hazards The Callaway Plant, Unit No. 1 categorization process for the high winds hazard will use a peer-reviewed plant-specific high winds PRA model. The Ameren Missouri risk management process ensures that the PRA model used in this application reflects the as-built and as-operated plant for the Callaway Plant, Unit No. 1. Attachment 2 of this enclosure identifies the applicable high winds PRA model.

3.2.5 Other External Hazards All other external hazards were screened for applicability to Callaway Plant, Unit No. 1, per a plant-specific evaluation using the external hazard screening significance process identified in American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard RA-Sa-2009. Attachment 4 of this enclosure provides a summary of the other external hazards screening results. Attachment 5 provides a summary of the progressive screening approach for external hazards.

to ULNRC-06678 Page 15 of 30 All remaining hazards not explicitly modeled were screened from applicability and considered insignificant for every SSC not credited to screen the related hazard.

Therefore, they will not be considered during the categorization process. The guidance of NEI 00-04, Figure 5-6, will be applied for SSCs being credited in screening an external hazard at the time of categorizing an SSC.

3.2.6 Low Power & Shutdown Consistent with NEI 00-04, the Callaway Plant, Unit No. 1, categorization process will use the shutdown safety management plan described in NUMARC 91-06 for evaluation of safety significance related to low power and shutdown conditions. The overall process for addressing shutdown risk is illustrated in Figure 5-7 of NEI 00-04.

NUMARC 91-06 specifies that a defense-in-depth approach should be used with respect to each defined shutdown key safety function. The key safety functions defined in NUMARC 91-06 are evaluated for categorization of SSCs.

SSCs that meet either of the two criteria (i.e., considered part of a "primary shutdown safety system" or a failure would initiate an event during shutdown conditions) described in Section 5.5 NEI 00-04 will be considered preliminary HSS.

3.2.7 PRA Maintenance and Updates The Ameren Missouri risk management process ensures that the applicable PRA models used in this application continue to reflect the as-built and as-operated plant for the Callaway Plant, Unit No. 1. The process delineates the responsibilities and guidelines for updating the PRA models, and includes criteria for both regularly scheduled and interim PRA model updates. The process includes provisions for monitoring potential areas affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, and industry operational experience) for assessing the risk impact of unincorporated changes, and for controlling the model and associated computer files. The process will assess the impact of these changes on the plant PRA model in a timely manner but no longer than once every two refueling outages. If there is a significant impact on the PRA model, the SSC categorization will be re-evaluated.

In addition, Ameren Missouri will implement a process that addresses the requirements in NEI 00-04, Section 11, "Program Documentation and Change Control." The process will review the results of periodic and interim updates of the plant PRA that may affect the results of the categorization process. If the results are affected, adjustments will be made as necessary to the categorization or treatment processes to maintain the validity of the processes. In addition, any PRA model upgrades will be peer reviewed prior to implementing those changes in the PRA model used for categorization, including the use of newly developed methods which will follow the review process established in NEI 17-07 (Reference 33).

to ULNRC-06678 Page 16 of 30 3.2.8 PRA Uncertainty Evaluations Uncertainty evaluations associated with any applicable baseline PRA models used in this application were evaluated during the assessment of PRA technical adequacy and confirmed through the peer review process as discussed in Section 3.3 of this enclosure.

Uncertainty evaluations associated with the risk categorization process are addressed using the process discussed in Section 8 of NEI 00-04 and in the prescribed sensitivity studies discussed in Section 5 of NEI 00-04.

In the overall risk sensitivity studies, Callaway Plant, Unit No. 1 will utilize a factor of 3 to increase the unavailability or unreliability of LSS components, consistent with that approved for Vogtle (Reference 9). Consistent with the NEI 00-04 guidance, Callaway Plant, Unit No. 1 will perform both an initial sensitivity study and a cumulative sensitivity study. The sensitivity studies are performed to ensure that assumptions and sources of uncertainty (e.g., human error, common cause failure, and maintenance probabilities) do not mask the importance of the SSC(s).

The initial sensitivity study applies to the system that is being categorized. In the cumulative sensitivity study, the failure probabilities (unreliability and unavailability, as appropriate) of all LSS components modeled in all identified PRA models for all systems that have been categorized are increased by a factor of 3. This sensitivity study together with the periodic review process assures that the potential cumulative risk increase from the categorization is maintained acceptably low. The performance monitoring process monitors the component performance to ensure that potential increases in failure rates of categorized components are detected and addressed before reaching the rate assumed in the sensitivity study.

The detailed process of identifying, characterizing, and performing qualitative screening of model uncertainties is found in Section 5.3 of NUREG-1855 (Revision 1) and in Section 3.1.1 of EPRI TR-1016737 (Reference 14). The process described in these references was mostly developed to evaluate the uncertainties associated with the internal events PRA model; however, the approach can be applied to other types of hazard groups.

The list of assumptions and sources of uncertainty were reviewed to identify those that would be significant for the evaluation of this application. If the Callaway Plant, Unit No. 1 PRA model used a non-conservative treatment or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application. To identify these assumptions and sources of uncertainty, both plant-specific and generic sources of uncertainty (as identified in EPRI TR-1016737) were considered. All PRA notebooks were reviewed, and sources of uncertainty were

Enclosure 1 to ULNRC-06678 Page 17 of 30 compiled and characterized. The identification and characterization of the sources of uncertainty was performed consistent with the requirements of the ASME/ANS PRA Standard (ASME/ANS RA-Sa-2009). This evaluation meets the intent of steps C-1 and E-1 of NUREG-1855, Revision 1.

To assess the impact of sources of uncertainties on 10 CFR 50.69 system categorizations, a review of the base case sources of uncertainty for the Callaway Plant, Unit No. 1 PRA models was performed. Each identified uncertainty was evaluated with respect to its potential to significantly impact the risk ranking evaluations that will be performed to support the categorization effort. This evaluation meets the intent of the screening portion for steps C-2 and E-2 of NUREG-1855, Revision 1.

Callaway Plant, Unit No. 1 PRA model specific assumptions and sources of uncertainty for this application were identified and dispositioned. Attachment 6, "Key Assumptions and Sources of Uncertainty," (provided with this enclosure) documents the conclusion of this review, which found that no additional sensitivity analyses are required to address the Callaway Plant, Unit No. 1 model specific assumptions or sources of uncertainty.

At the time of this submittal, all Finding-level facts and observations (F&Os) on the Callaway Plant, Unit No. 1 Internal Events, Internal Flood, Fire, High Winds and Seismic PRA models have been closed using the process documented in Appendix X to NEI 05-04, NEI 07-12, and NEI 12-13 as accepted by the NRC (per Reference 18). The results of these independent assessments have been documented and are available for NRC audit; therefore, no additional sensitivities are required to address open Finding F&Os against the Callaway Plant, Unit No. 1 PRA models.

As discussed under the Fire PRA description in section 3.3, the resolution of Suggestion F&O FSS-B1-03 was determined to be an upgrade and has been reviewed and closed by an independent assessment. This addressed and closed Commitment 50437 discussed in the original LAR. Therefore, no additional sensitivities are required to address the previous upgrade in the Callaway Plant, Unit No. 1 Fire PRA model.

3.2.9 Modeling of Flex 3.2.9.1 Background The NRC has been issuing a "generic" Request for Additional Information (RAI) regarding crediting of FLEX equipment in PRA models. (See References 34 and 35 for more detail.) The Limerick RAI (Reference 34) is summarized below.

The NRC memorandum dated May 30, 2017, "Assessment of the Nuclear Energy Institute 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Guidance for Risk-Informed Changes to Plants Licensing Basis" (ADAMS Accession No. ML17031A269), provides the NRCs staff assessment of the challenges of incorporating diverse and flexible (FLEX) coping strategies to ULNRC-06678 Page 18 of 30 and equipment into a PRA model in support of risk-informed decision-making in accordance with the guidance of RG 1.200, Revision 2 (ADAMS Accession No. ML090410014). Docketed information does not indicate if [PLANT NAME] has credited FLEX equipment or actions in the

[PRA MODEL]. As such, please address the following:

a. Discuss whether [UTILITY] has credited FLEX equipment or mitigating actions into the

[PLANT NAME] [PRA MODEL]. If not incorporated or their inclusion is not expected to impact the PRA results used in the RICT program, no additional response is requested.

b. If FLEX equipment or operator actions have been credited in the PRA, address the following, separately for the internal events (including internal flooding), and other PRAs.

i. Summarize the supplemental equipment and compensatory actions, including FLEX strategies that have been quantitatively credited for each of the PRA models used to support this application. Include discussion of whether the credited FLEX equipment is portable or permanently installed equipment.

ii. Discuss whether the credited equipment (regardless of whether it is portable or permanently-installed) are like other plant equipment (i.e. SSCs with sufficient plant-specific or generic industry data) and whether the credited operator actions are similar to other operator actions evaluated using approaches consistent with the endorsed ASME/ANS RA-Sa-2009 PRA Standard.

iii. If any credited FLEX equipment is dissimilar to other plant equipment credited in the PRA (i.e., SSCs with sufficient plant-specific or generic industry data), discuss the data and failure probabilities used to support the modeling and provide the rationale for using the chosen data. Discuss whether the uncertainties associated with the parameter values are in accordance with the ASME/ANS PRA Standard as endorsed by RG 1.200, Revision 2.

iv. If any operator actions related to FLEX equipment are evaluated using approaches that are not consistent with the endorsed ASME/ANS RA-Sa-2009 PRA Standard (e.g. using surrogates), discuss the methodology used to assess human error probabilities for these operator actions. The discussion should include:

1. A summary of how the impact of the plant-specific human error probabilities and associated scenario-specific performance shaping factors listed in (a)-(j) of supporting requirement HR-G3 of the ASME/ANS RA-Sa-2009 PRA Standard were evaluated.

2.Whether maintenance procedures for the portable equipment were reviewed for possible pre-initiator human failures that renders the equipment unavailable during an event, and if the probabilities of the pre-initiator human failure events were assessed as described in HLR-HR-D of the ASME/ANS RA-Sa-2009 PRA Standard.

3.If the procedures governing the initiation or entry into mitigating strategies are ambiguous, vague, or not explicit, a discussion detailing the technical bases for probability of failure to initiate mitigating strategies.

c. The ASME/ANS RA-Sa-2009 PRA Standard defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences. Section 1-5 of Part 1 of ASME/ANS RA-Sa-2009 PRA Standard states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this Standard. Provide an

Enclosure 1 to ULNRC-06678 Page 19 of 30 evaluation of the model changes associated with incorporating mitigating strategies, which demonstrates that none of the following criteria is satisfied: (1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, and (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences.

d. Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties shall be considered in application of the PRA base model results to the RICT program. The NRC SE for NEI 06-09, Revision 0, states that this consideration is consistent with Section 2.3.5 of RG 1.177, Revision 1. NEI 06-09, Revision 0-A, further states that sensitivity studies should be performed on the base model prior to initial implementation of the RICT program on uncertainties which could potentially impact the results of a RICT calculation.

NRC staff notes that the impact of model uncertainty could vary based on the proposed RICTs. NEI 06-09, Revision 0-A, also states that the insights from the sensitivity studies should be used to develop appropriate compensatory RMAs including highlighting risk significant operator actions, confirming availability and operability of important standby equipment, and assessing the presence of severe or unusual environmental conditions.

Uncertainty exists in modeling FLEX equipment and actions related to assumptions regarding the failure probabilities for FLEX equipment used in the model, the corresponding operator actions, and pre-initiator failure probabilities. Therefore, FLEX modeling assumptions can be key assumptions and sources of uncertainty for RICTs proposed in this application. In light of these observations:

i. Describe the sensitivity studies that will be used to identify the RICTs proposed in this application for which FLEX equipment and/or operator actions are key assumptions and sources of uncertainty (e.g., use of generic industry data for non-safety related equipment). Explain and justify the approach (e.g., any multipliers for failure probabilities) used to perform the sensitivity studies.

ii. Described how the results of the sensitivity studies which identify FLEX equipment and/or operator actions as key assumptions and sources of uncertainty will be used to identify RMAs prior the implementation of the RICT program, consistent with the guidance in Section 2.3.4 of NEI 06-09, Revision 0-A.

iii. Demonstrate the approaches described in items (i) and (ii) above using an example sensitivity study for the nominal configuration of a proposed RICT where the FLEX equipment and/or operator actions are identified as key assumptions and sources of uncertainty.

Section 3.2.9.2 (below) provides responses, as applicable, to the above questions regarding modeling of FLEX equipment in the Callaway Plant, Unit 1 PRA models. The responses are provided in a consolidated form instead of individual responses to each question.

3.2.9.2 Discussion The hardened condensate storage tank (HCST) FLEX strategy is credited in PRA model update 9.01 for all hazards. This strategy realigns the turbine-driven AFW pump (TDAFP) recirculation from the condensate storage tank (CST) to the HCST and isolates MDAFP recirculation. This strategy involves permanently installed equipment.

to ULNRC-06678 Page 20 of 30 In addition to the normal supply to each auxiliary feedwater pump from the CST, the hardened condensate storage tank (HCST) serves as an additional back-up source of water. Swap-over to the HCST would provide an additional 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> of AFW supply.

For the safety-related AFW pumps, swap over to the HCST is automatic and is provided by a single air-operated, fail-open valve which is operated on low suction pressure. The HCST may also be aligned to the non-safety AFW pump, but this alignment requires a local manual operator action and is not currently credited in the PRA. The HCST swap over to the safety-related AFW pumps is credited in the IE PRA model (and therefore used in all other hazard models).

The incorporation of the FLEX strategies into the PRA model does not constitute a PRA model upgrade. Modeling inclusion of FLEX has been performed in a manner that:

• Is consistent with other modeling aspects used in the PRA model

• Is commensurate with the supporting requirements of the ASME/ANS PRA Standard

• Does not add any additional scope to the PRA

• Does not and any new capability of the PRA

• Does not significantly impact significant accident sequences or accident sequence progression 3.3 PRA REVIEW PROCESS RESULTS (10 CFR 50.69(b)(2)(iii))

Except for seismic, the PRA models described in Section 3.2 have been assessed against RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, including the clarifications included therein, consistent with NRC RIS 2007-06. The seismic PRA was assessed against the Code Case for ASME/ANS RA-Sb-2013, as amended by the Nuclear Regulatory Commission on March 12, 2018, and approved in RG 1.200, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 3. All F&O closure reviews were performed in accordance with the process documented in Appendix X to NEI 05-04, NEI 07-12, and NEI 12-13 as accepted by the NRC (Reference 18), including the NRC clarifications and specific documentation expectations, as well as the requirements published in the ASME/ANS PRA Standard (RA-Sa-2009).

INTERNAL EVENTS AND INTERNAL FLOOD PRA MODEL The information provided in this section demonstrates that the Callaway Plant, Unit 1 internal events PRA model (including internal flooding) meets the expectations for PRA scope and technical adequacy as presented in ASME/ANS RA-Sa-2009 and RG 1.200, Revision 2.

The Internal Events / Internal Flooding PRA was peer reviewed in April 2019. This peer review was a full-scope review of the technical elements of the internal events and internal flooding at-power PRA as documented in PWROG-19012-P (Reference 22). As a full scope review, it included those supporting requirements (SRs) specified in to ULNRC-06678 Page 21 of 30 PWROG-19020-NP for implementation of the methodology for loss of room cooling modeling provided in PWROG-18027-NP (Reference 32).

An Independent Assessment of F&Os was conducted in November 2019 and documented in PWROG-19034-P (Reference 24). The scope of the assessment included all Facts and Observations (F&Os) generated in the April 2019 peer review.

All F&Os except for one were closed. The remaining F&O was related to implementation of the methodology provided in PWROG-18027-NP (Reference 32) for assessing the loss of room cooling in PRA modeling. Following, but unrelated to, incorporation of the method provided in PWROG-18027-NP into the Callaway PRA, this method was chosen by the PWROG and NEI to pilot the Newly Developed Methods (NDM) peer review process established in NEI 17-07 (Reference 33). Despite the Callaway assessment, and acknowledgement by the PWROG, that the method provided in PWROG-18027-NP did not necessarily meet the definition of a NDM, Callaway decided to suspend resolution of the associated F&O until the NDM peer review and closure of any F&Os were completed using the process established in NEI 17-07. Also, during the November 2019 independent assessment, two F&O resolutions were determined to be upgrades to the Internal Events / Internal Flooding PRA. Thus, a focused-scope peer review was required. Based on this focused scope peer review, one new Internal Events F&O was generated.

During February and March 2020, a new peer review, following the guidance in NEI 17-07 Revision 2, was conducted on the method provided in PWROG-18027-NP and documented in PWROG-19020-NP (Reference 31). Based on the results of this review all applicable NDM attributes are met at CC I/II and there are no open peer review Findings against the method in PWROG-18027-NP.

In June 2020, an independent assessment of F&O resolution and a focused scope peer review, completing the review of PWROG-18027-NP implementation, were conducted on the Callaway Plant internal events and fire PRA models. The focused scope peer review determined that all of the SRs that were examined, including the SR associated with the F&O related to implementation of the method in PWROG-18027-NP, satisfy CC II, or higher, requirements as documented in AMN#PES00031-REPT-001 (Reference 29). The independent assessment of F&Os included an assessment of all remaining open F&O Findings. The results of this review are documented in AMN#PES00031-REPT-002 (Reference 30).

There are no open peer review Findings for the Internal Events / Internal Flooding PRA models.

HIGH WINDS PRA MODEL The High Winds PRA was peer reviewed in April 2019 and documented in PWROG-19022-P (Reference 23). The scope of this work was to review the Callaway External Hazards Screening Assessment and High Winds PRA against the technical elements in to ULNRC-06678 Page 22 of 30 Sections 6 and 7 of the ASME/ANS RA-Sa-2009 Standard, and in RG 1.200, Revision 2.

An Independent Assessment of F&O resolution was conducted in November 2019 and documented in PWROG-19034-P (Reference 24). The scope of the assessment included all F&Os generated in the April 2019 peer review. All F&Os were closed.

There are no open peer review Findings for the Other External Hazards Screening or the High Winds PRA model.

SEISMIC PRA MODEL The Seismic PRA was peer reviewed in June 2018 and documented in PWROG-18044-P (Reference 25). This peer review was conducted against the requirements of the Code Case for ASME/ANS RA-Sb-2013, as amended by the Nuclear Regulatory Commission on March 12, 2018. The Code Case is an approved alternative to Part 5 of ASME/ANS RA-Sb-2013 Addendum B, the American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS) Probabilistic Risk Assessment (PRA)

Standard.

An Independent Assessment of F&Os was conducted in March 2019. The scope of the assessment included all but two of the F&Os generated in the June 2018 peer review.

All in-scope F&Os were closed as documented in PWROG-19011-P (Reference 26).

Also in the March 2019 review documented in PWROG-19011-P, three SRs were the subject of a focused-scope peer review based on the closures of associated F&Os being assessed as upgrades. As a result of that peer review, the three SRs were determined to be met at CC II.

Subsequently, another Independent Assessment of F&Os was conducted in June 2020 and documented in AMN#PES00031-REPT-002 (Reference 30). The scope of the assessment included all remaining F&Os generated in the June 2018 peer review. All F&Os were closed.

There are no open peer review Findings for the Seismic PRA model.

FIRE PRA MODEL The Fire PRA was prepared using the methodology defined in NUREG/CR-6850, "Fire PRA Methodology for Nuclear Power Facilities," to support a transition to National Fire Protection Association (NFPA) Standard 805, "Performance Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants."

The Fire PRA was peer reviewed to ASME/ANS RA-Sa-2009 and RG 1.200 Revision 2 in October 2009. The review is documented in LTR-RAM-II-10-019 (Reference 27).

to ULNRC-06678 Page 23 of 30 An Independent Assessment of F&Os was conducted in July 2019 and documented in AMN#PES00021-REPT-001 (Reference 28).

In June 2020, an independent assessment of F&Os and a focused scope peer review were held for the Callaway Plant internal events and Fire PRA models. The focused scope peer review generated additional Fire PRA related F&Os as documented in AMN#PES00031-REPT-001 (Reference 29). The independent assessment of F&Os included an assessment of all remaining open F&O Findings. As documented in AMN#PES00031-REPT-002 (Reference 30), all Finding F&Os were closed, including the Fire PRA Findings identified in the Focused Scope peer review.

In fulfillment of Commitment 50437 in Enclosure 4 to ULNRC-06550 (ML20304A456) and associated with closure of NFPA 805 LAR Table S-3 Implementation Item 13-805-001, a focused scope peer review was conducted in November 2020, as documented in AMN#PES00031-REPT-003 (Reference 37), for the resolution of Fire PRA Suggestion F&O FSS-B1-03, which a July 2019 F&O closure review had determined to be an upgrade, as documented in AMN#PES00021-REPT-001 (Reference 28).

As documented in AMN#PES00042-REPT-002 (Reference 38), the F&Os from this focus scope peer review were closed during an F&O closure review in February 2021. The results of this review formally closed Commitment 50437.

There are no open peer review Findings for the Fire PRA model.

The discussion above, along with the referenced reports, demonstrates that the PRA is of sufficient quality and level of detail to support the categorization process, and has been subjected to a peer review process assessed against a standard or set of acceptance criteria that is endorsed by the NRC as required 10 CFR 50.69(c)(1)(i).

3.4 RISK EVALUATIONS (10 CFR 50.69(b)(2)(iv))

The Callaway Plant, Unit No. 1 10 CFR 50.69 categorization process will implement the guidance in NEI 00-04. The overall risk evaluation process described in the Nuclear Energy Institute guidance addresses both known degradation mechanisms and common cause interactions, and meets the requirements of §50.69(b)(2)(iv). Sensitivity studies described in NEI 00-04 Section 8 will be used to confirm that the categorization process results in acceptably small increases to core damage frequency and large early release frequency. The failure rates for equipment and initiating event frequencies used in the PRA include the quantifiable impacts from known degradation mechanisms, as well as other mechanisms (e.g., design errors, manufacturing deficiencies, and human errors).

Subsequent performance monitoring and PRA updates required by the rule will continue to capture this data and provide timely insights into the need to account for any important new degradation mechanisms.

to ULNRC-06678 Page 24 of 30 3.5 FEEDBACK AND ADJUSTMENT PROCESS If significant changes to the plant risk profile are identified, or if it is identified that a RISC-3 or RISC-4 SSC can (or actually did) prevent a safety significant function from being satisfied, an immediate evaluation and review will be performed prior to the normally scheduled periodic review. Otherwise, the assessment of potential equipment performance changes and new technical information will be performed during the normally scheduled periodic review cycle.

Scheduled periodic reviews, at a frequency of at least once every two refueling cycles, will evaluate new insights resulting from available risk information (i.e., PRA model or other analysis used in the categorization) changes, design changes, operational changes, and SSC performance. If it is determined that these changes have affected the risk information or other elements of the categorization process such that the categorization results are more than minimally affected, then the risk information and the categorization process will be updated. This review will include:

A review of plant modifications since the last review that could impact the SSC categorization A review of plant specific operating experience that could impact the SSC categorization A review of the impact of the updated risk information on the categorization process results A review of the importance measures used for screening in the categorization process An update of the risk sensitivity study performed for the categorization In addition to the normally scheduled periodic reviews, if a PRA model of interim update is issued in accordance with model maintenance procedures, a review of the SSC categorization will be performed.

3.6 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA The following NRC requirements and guidance documents are applicable to the proposed change.

The regulations in Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors."

to ULNRC-06678 Page 25 of 30 NRC Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance,"

Revision 1, May 2006.

Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"

Revision 2, April 2015.

Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, March 2009.

Regulatory Guide 1.200, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 3, December 2020.

The proposed change is consistent with the applicable regulations and regulatory guidance.

3.7 NO SIGNIFICANT HAZARDS CONSIDERATION ANALYSIS Ameren Missouri proposes to modify the licensing basis to allow for the voluntary implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors." The provisions of 10 CFR 50.69 allow adjustment of the scope of equipment subject to special treatment controls (e.g., quality assurance, testing, inspection, condition monitoring, assessment, and evaluation). For equipment determined to be of low safety significance, alternative treatment requirements can be implemented in accordance with this regulation. For equipment determined to be of high safety significance, requirements will not be changed or will be enhanced. This allows improved focus on equipment that has safety significance, resulting in improved plant safety.

Ameren Missouri has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations.

to ULNRC-06678 Page 26 of 30 The process used to evaluate SSCs for changes to NRC special treatment requirements and the use of alternative requirements ensures the ability of the SSCs to perform their design function. The potential change to special treatment requirements does not change the design and operation of the SSCs. As a result, the proposed change does not significantly affect any initiators to accidents previously evaluated or the ability to mitigate any accidents previously evaluated. The consequences of the accidents previously evaluated are not affected because the mitigation functions performed by the SSCs assumed in the safety analysis are not being modified. The SSCs required to safely shut down the reactor and maintain it in a safe shutdown condition following an accident will continue to perform their design functions.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations.

The proposed change does not change the functional requirements, configuration, or method of operation of any SSC. Under the proposed change, no additional plant equipment will be installed.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change will permit the use of a risk-informed categorization process to modify the scope of SSCs subject to NRC special treatment requirements and to implement alternative treatments per the regulations.

The proposed change does not affect any safety limits or operating parameters used to establish the safety margin. The safety margins included in analyses of accidents are not affected by the proposed change. The regulation requires that there be no significant effect on plant risk due to any change to the special treatment requirements for SSCs and that the SSCs continue to be capable of performing their design basis functions, as well as to ULNRC-06678 Page 27 of 30 to perform any beyond design basis functions consistent with the categorization process and results.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Ameren Missouri concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

3.8 CONCLUSION

S In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

4 ENVIRONMENTAL CONSIDERATION A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

5 REFERENCES

1. NEI 00-04, "10 CFR 50.69 SSC Categorization Guideline," Revision 0, Nuclear Energy Institute, July 2005

2. NRC Regulatory Guide 1.201, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance,"

Revision 1, May 2006

3. Internal Events (including Internal Flooding) PRA Model Update 9.01

4. Fire PRA Model Update 9.01 to ULNRC-06678 Page 28 of 30

5. Seismic PRA Model Update 9.01

6. High Winds PRA Model Update 9.01

7. NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," December 1991

8. NRC letter to Southern Nuclear Operating Company, "Issuance of Amendments Re:

Use of 10 CFR 50.69 (TAC Nos. ME9472 and ME9473)", dated December 17, 2014 (ADAMS Accession No. ML14237A034)

9. ANO SER Arkansas Nuclear One, Unit 2 - "Approval of Request for Alternative AN02-R&R-004, Revision 1, 'Request to Use Risk-Informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems,'" April 22, 2009 (TAC NO. MD5250) (ADAMS Accession No. ML090930246)

10. Callaway Energy Center Report PRA-OEH-ANALYSIS, "Other External Hazards:

Screening Assessment Notebook,"

11. Generic Letter 88-20, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4," USNRC, June 1991

12. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 2, March 2009

13. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," Revision 1, March 2017

14. EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," December 2008

15. EPRI TR-1026511, "Practical Guidance on the use of Probabilistic Risk Assessment in Risk Informed Applications with a Focus on the Treatment of Uncertainty,"

December 2012

16. ASME/ANS RA-Sa-2009, "Standard for Level l/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, Addendum A to RA-S-2008," ASME, New York, NY, American Nuclear Society, La Grange Park, Illinois, dated February 2009

17. NEI Letter to NRC, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-Out of Facts and Observations (F&Os)," February 21, 2017, (Accession No. ML17086A431) to ULNRC-06678 Page 29 of 30

18. NRC Letter to Mr. Greg Krueger (NEI), "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os)," May 3, 2017, (Accession No. ML17079A427)

19. NRC Letter to Mr. Oliver Martinez, "U.S. Nuclear Regulatory Commission (NRC)

Comments on Addenda to a Current ABS: ASME RA-SB - 20XX, 'Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications'".

20. NEI 12-13, "External Hazards PRA Peer Review Process Guidelines," Revision 0, Nuclear Energy Institute, August 2012

21. NRC Letter to Mr. Biff Bradley (NEI), "U.S. Nuclear Regulatory Commission Comments on Nuclear Energy Institute 12-13, External Hazards PRA Peer Review Process Guidelines, Dated August 2012," November 16, 2012, (Accession No. ML12321A280)

22. PWROG-19012-P, "Peer Review of the Callaway Internal Events and Internal Flood Probabilistic Risk Assessment," April 2019

23. PWROG-19022-P, "Peer Review of the Callaway External Hazard Screening Assessment and High Winds Probabilistic Risk Assessment," April 2019

24. PWROG-19034-P, "Independent Assessment of Facts & Observations Closure and Focused Scope Peer Review of the Callaway Probabilistic Risk Assessments,"

November 2019

25. PWROG-18044-P, "Peer Review of the Callaway Seismic Probabilistic Risk Assessment," June 2018

26. PWROG-19011-P, "Independent Assessment of Facts & Observations Closure and Focused Scope Peer Review of the Callaway Seismic Probabilistic Risk Assessment," March 2019

27. LTR-RAM-II-10-019, "Fire PRA Peer Review Against the Fire PRA Standard Supporting Requirements From Section 4 of the ASME/ANS Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessments for Nuclear Power Plant Applications for The Callaway Nuclear Plant Fire Probabilistic Risk Assessment," October 2009

28. AMN#PES00021-REPT-001, "Callaway Energy Center Fire Probabilistic Risk Assessment Peer Review F&Os Closure," July 2019

29. AMN#PES00031-REPT-001, "Callaway Energy Center Probabilistic Risk Assessment Focused Scope Peer Review," July 2020 to ULNRC-06678 Page 30 of 30

30. AMN#PES00031-REPT-002, "Callaway Energy Center Probabilistic Risk Assessment Peer Review F&Os Closure," July 2020

31. PWROG-19020-NP Revision 1, "Newly Developed Method Peer Review Pilot -

General Screening Criteria for Loss of Room Cooling in PRA Modeling," April 2020

32. PWROG-18027-NP Revision 0, "Loss of Room Cooling in PRA Modeling," April 2020.

33. NEI 17-07, Revision 2, "Performance of PRA Peer Reviews Using the ASME/ANS PRA Standard," July 2019 (ADAMS Accession No. ML19228A242)

34. ML19192A031, "2019/08/10 NRR E-mail Capture - Limerick-Request for Additional Information: Risk-Informed Completion Times TSTF-505, Revision 2, 'Provide Risk-Informed Completion Times - RITSTF Initiative 4B'" (EPID L-2018-LLA-0567)

35. ML20192A144, "2020/07/07 NRR E-mail Capture - RE: Request for Additional Information RE: Prairie Island License Amendment Request to Adopt TSTF-505" (EPID: L-2019-LLA-0283)

36. Regulatory Guide 1.200, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 3, December 2020

37. AMN#PES00031-REPT-003, "Callaway Energy Center Probabilistic Risk Assessment Focused Scope Peer Review," November 2020

38. AMN#PES00042-REPT-002, "Callaway Energy Center Fire Probabilistic Risk Assessment Peer Review F&Os Closure Review," February 2021 to ULNRC-06678 Page 1 of 2 Attachment 1: List of Categorization Prerequisites The PRA model to be used for categorization credits no modifications to achieve an overall core damage frequency (CDF) and large early release frequency (LERF) consistent with U.S. Nuclear Regulatory Commission Regulatory Guide 1.174 risk limits that were not adequately addressed in the PRAs proposed for application regarding the Callaway Plant, Unit No. 1 10 CFR 50.69 Program.

Ameren Missouri will establish a procedure(s) prior to the use of the categorization process on a plant system. The procedure(s) will contain the elements/steps listed below.

Integrated Decision-Making Panel (IDP) member qualification requirements.

Qualitative assessment of system functions. System functions are qualitatively categorized as preliminary High Safety Significant (HSS) or Low Safety Significant (LSS), based on the seven criteria in Section 9 of NEI 00-04. (See Section 3.2.) Any component supporting an HSS function is categorized as preliminary HSS. Components supporting an LSS function are categorized as preliminary LSS.

Component safety significance assessment. The safety significance of active components is assessed through a combination of probabilistic risk assessment (PRA) and non-PRA methods, covering all hazards. The safety significance of passive components is assessed using a methodology for passive components.

Assessment of defense-in-depth (DID) and safety margin. Safety-related components that are categorized as preliminary LSS are evaluated for their role in providing DID and safety margin, and if appropriate, are upgraded to HSS.

Review by the IDP. The categorization results are presented to the IDP for review and approval. The IDP reviews the categorization results and makes the final determination on the safety significance of system functions and components.

Risk sensitivity study. For PRA-modeled components, an overall risk sensitivity study is used to confirm that the population of preliminary LSS components results in acceptably small increases to CDF and LERF and meets the acceptance guidelines of Regulatory Guide 1.174.

to ULNRC-06678 Page 2 of 2 Periodic reviews are performed to ensure continued categorization validity and acceptable performance for those structures, systems, and components that have been categorized.

Documentation requirements per Section 3.1.1 of Enclosure 1.

to ULNRC-06678 Page 1 of 2 Attachment 2: Description of PRA Models Used in Categorization Baseline Baseline Unit Model 9.01 Comments CDF [/yr] LERF [/yr]

For Peer Review Report and Internal Events Associated F&O Closure (Excluding 1 4.46E-06 6.23E-08 Information, see References Internal 1, 3, 8, 9, and 10 on page 2 Flooding) PRA of this attachment.

For Peer Review Report and Associated F&O Closure Internal 1 6.52E-06 1.51E-08 Information, see References Flooding PRA 1 and 3 on page 2 of this attachment.

For Peer Review Report and Associated F&O Closure 1 Fire PRA 1.09E-05 4.63E-08 Information, see References 6, 7, 8, 9, 11, and 12 on page 2 of this attachment.

For Peer Review Report and Associated F&O Closure 1 Seismic PRA 4.01E-05 4.43E-06 Information, see References 4, 5, and 9 on page 2 of this attachment.

For Peer Review Report and Associated F&O Closure High Winds 1 5.40E-06 2.5E-07 Information, see References PRA 2 and 3 on page 2 of this attachment.

Total 6.74E-05 4.80E-06 Aggregate Risk to ULNRC-06678 Page 2 of 2 REFERENCES

1. PWROG-19012-P, "Peer Review of the Callaway Internal Events and Internal Flood Probabilistic Risk Assessment"

2. PWROG-19022-P, "Peer Review of the Callaway External Hazard Screening Assessment and High Winds Probabilistic Risk Assessment"

3. PWROG-19034-P, "Independent Assessment of Facts & Observations Closure and Focused Scope Peer Review of the Callaway Probabilistic Risk Assessments"

4. PWROG-18044-P, "Peer Review of the Callaway Seismic Probabilistic Risk Assessment"

5. PWROG-19011-P, "Independent Assessment of Facts & Observations Closure and Focused Scope Peer Review of the Callaway Seismic Probabilistic Risk Assessment"

6. LTR-RAM-II-10-019, "Fire PRA Peer Review Against the Fire PRA Standard Supporting Requirements From Section 4 of the ASME/ANS Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessments for Nuclear Power Plant Applications For The Callaway Nuclear Plant Fire Probabilistic Risk Assessment"

7. AMN#PES00021-REPT-001, "Callaway Energy Center Fire Probabilistic Risk Assessment Peer Review F&Os Closure"

8. AMN#PES00031-REPT-001, "Callaway Energy Center Probabilistic Risk Assessment Focused Scope Peer Review"

9. AMN#PES00031-REPT-002, "Callaway Energy Center Probabilistic Risk Assessment Peer Review F&Os Closure"

10. PWROG-19020-NP Revision 1, "Newly Developed Method Peer Review Pilot - General Screening Criteria for Loss of Room Cooling in PRA Modeling"

11. AMN#PES00031-REPT-003, "Callaway Energy Center Probabilistic Risk Assessment Focused Scope Peer Review"

12. AMN#PES00042-REPT-002, "Callaway Energy Center Fire Probabilistic Risk Assessment Peer Review F&Os Closure Review."

to ULNRC-06678 Page 1 of 1 Attachment 3: Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items There are no open Peer Review Findings for the Callaway Internal Events, Internal Flood, Fire, Seismic, and High Winds PRA models or for the screening of Other External Hazards.

to ULNRC-06678 Page 1 of 5 Attachment 4: External Hazards Screening Screening Result External Screening Hazard Screened?

Criterion Comment (Y/N)

(Note 1)

Airports, military installations, and flight corridors have been considered. There are three low-altitude airways and three high-Aircraft Impact Y PS4 altitude airways that pass near the plant. A bounding analysis of aircraft impact associated with these airways results in a CDF

< 1E-6/yr.

Not applicable to the site because of climate Avalanche Y C3 and topography.

Service Water and Essential Service Water systems include traveling water screens and Biological backwash strainers to prevent intake of Y C5 Event foreign matter. These design features would provide sufficient time to detect and mitigate the hazard.

The site is not in proximity to any ocean or Coastal Y C3 large body of water; therefore, costal erosion Erosion is not an applicable hazard.

Plant design eliminates drought as a concern.

Drought Y C1, C5 In addition, this event is slowly developing.

External flooding is incorporated into High Tide, Lake Level, or River Stage, Seiche, External Y C1, C3 Tsunami, Storm Surge, and Waves. Local Flooding Intense Precipitation (LIP) was analyzed and shown to be within the plant design basis.

Extreme Wind Callaway Plant, Unit No. 1 developed a High N None or Tornado Winds PRA that addresses this hazard.

Negligible impact on the plant. Implicitly Fog Y C4 included in air, land, and water transportation.

to ULNRC-06678 Page 2 of 5 Screening Result External Screening Hazard Screened?

Criterion Comment (Y/N)

(Note 1)

Limited occurrence and bounded by other events, primarily loss of offsite power (LOOP),

Forest or for which the plant is designed. Not Y C1, C3, C4 Range Fire applicable to site due to limited vegetation and inability of hazard to propagate into Protected Area.

Limited occurrence and bounded by other Frost Y C1, C4 events for which the plant is designed. Frost impacts covered under ice and snow hazards.

Limited occurrence and bounded by other events for which the plant is designed.

Consequences of this hazard are bounded by Hail Y C4 a loss of offsite power (LOOP), which is included in the Internal Events PRA weather-induced LOOP frequency.

Plant is designed for this hazard. Associated High Summer plant trips have not occurred and are not Y C1, C5 Temperature expected. In addition, this event is slowly developing.

The site is not in proximity to any oceans or High Tide, lakes, and is not susceptible to flooding by Lake Level, or Y C3 rivers. This hazard is not applicable due to River Stage the site location.

Covered under Extreme Wind or Tornado, Hurricane Y C4 Intense Precipitation, and Storm Surges.

Plant is designed for freezing temperatures, Ice Cover Y C1 which are infrequent and short in duration.

The only industrial or military facility within 5 miles of the site is Mertens Quarry, located 4.5 miles northwest of the site. The amount Industrial or of explosive material required to potentially Military Facility Y C3 damage the plant is significantly greater than Accident the amount that would ever be stored at a quarry. Therefore, industrial or military facility accidents cannot occur close enough to the plant to affect it.

to ULNRC-06678 Page 3 of 5 Screening Result External Screening Hazard Screened?

Criterion Comment (Y/N)

(Note 1)

Callaway Plant, Unit No. 1 developed an Internal N None Internal Flooding PRA that addresses this Flooding hazard.

Callaway Plant, Unit No. 1 developed an Internal Fire N None Internal Fire PRA that addresses this hazard.

The site is located on a plateau, and there is no significantly higher ground within 5 miles.

Landslide Y C3 The topography of the site precludes this hazard.

Lightning strikes causing loss of offsite power or turbine trip are contributors to the initiating event frequencies for these events. However, Lightning Y C1 other causes are also included. The impacts are no greater than already modeled in the internal events PRA.

Low Lake The plant is designed for such events, and Level or River Y C1, C5 their impacts are slow to develop.

Stage Extended freezing temperatures are rare, the Low Winter Y C1 plant is designed for such events, and their Temperature impacts are slow to develop.

The frequency of meteorites greater than Meteorite or 100 lb striking the plant is around 1E-8/y and Satellite Y PS4 corresponding satellite impacts is around Impact 2E-9/y.

There are no pipelines or tank farms within 5 Pipeline miles of the site. Pipelines are not close Y C3 Accident enough to significantly impact plant structures.

The plant is operated and designed for such Release of events. No control room habitability problems Chemicals in Y C1 from the potential release of hazardous Onsite Storage chemicals have been identified.

to ULNRC-06678 Page 4 of 5 Screening Result External Screening Hazard Screened?

Criterion Comment (Y/N)

(Note 1)

The Missouri River is strictly managed and highly regulated. It is extremely improbable that naturally occurring or man-made River Diversion Y C1, C5 diversions would be allowed to continue unchecked or uncontrolled. Even so, the plant is designed for such events, and their impacts are slow to develop.

There are no recorded instances of sandstorms affecting Callaway county or any Sand or Dust neighboring counties. The plant is designed Y C1, C3 Storm for such events. Also, a procedure instructs operators to replace filters before they become inoperable.

Site is not located near any bodies of water for which seiche flooding would apply. Onsite Seiche Y C3 reservoirs (spray ponds are not used at Callaway Plant, Unit No.1) are designed for seiches.

Seismic Callaway Plant, Unit No. 1 developed a N None Activity Seismic PRA that addresses this hazard.

The event damage potential is less than other events for which the plant is designed.

Consequences of this hazard are bounded by Snow Y C1 a loss of offsite power (LOOP), which is included in the Internal Events PRA weather-induced LOOP frequency. Potential flooding impacts covered under external flooding.

Soil The potential for this hazard is low at the site; Shrink-Swell Y C1 the plant design considers this hazard.

Consolidation The site is not located near any large bodies of water for which storm surge flooding would Storm Surge Y C3 apply. This hazard is not applicable to the site because of location.

Toxic gas covered under release of chemicals Toxic Gas Y C4 in onsite storage, industrial or military facility accident, and transportation accident.

to ULNRC-06678 Page 5 of 5 Screening Result External Screening Hazard Screened?

Criterion Comment (Y/N)

(Note 1)

Road and highway, railroad, and water transport cannot occur close enough to the plant to affect it. Water transport collisions with intake structure are of lesser potential Transportation C1, C3, C4, Y damage than the events for which the plant Accident C5 was designed, and would provide sufficient time to respond. Aviation and pipeline accidents covered under those specific categories.

The site is not located near any large bodies of water for which tsunami flooding would Tsunami Y C3 apply. This hazard is not applicable to the site because of location.

The event is of equal or lesser damage potential than the events for which the plant Turbine-has been designed, and the core damage Generated Y C1, PS4 frequency (calculated using a bounding or Missiles demonstrably conservative analysis) has a mean frequency <1E-6/yr.

The site is not located near any active Volcanic Y C3 volcano. This hazard is not applicable to the Activity site because of location.

The plant design considers this hazard. Water Waves Y C1 levels in the UHS retention pond after wave run-up do not reach the critical water level.

Note 1: See Attachment 5 for descriptions of the screening criteria.

A detailed description of the external events screening and evaluation process is presented in Callaway Plant, Unit No. 1 report PRA-OEH-ANALYSIS, "Other External Hazards: Screening Assessment Notebook."

to ULNRC-06678 Page 1 of 2 : Progressive Screening Approach for Addressing External Hazards Event Criterion Source Comments Analysis Initial C1. Event damage potential NUREG/CR-2300 and Preliminary is < events for which plant is ASME/ANS Standard Screening designed. RA-Sa-2009 C2. Event has lower mean NUREG/CR-2300 and frequency and no worse ASME/ANS Standard consequences than other RA-Sa-2009 events analyzed.

C3. Event cannot occur NUREG/CR-2300 and close enough to the plant to ASME/ANS Standard affect it. RA-Sa-2009 C4. Event is included in the NUREG/CR-2300 and Not used to screen.

definition of another event. ASME/ANS Standard Used only to include RA-Sa-2009 within another event.

C5. Event develops slowly, ASME/ANS Standard allowing adequate time to RA-Sa-2009 eliminate or mitigate the threat.

Progressive PS1. Design basis hazard ASME/ANS Standard Screening cannot cause a core damage RA-Sa-2009 accident.

PS2. Design basis for the NUREG-1407 and Not utilized herein event meets the criteria in the ASME/ANS Standard because NRC 1975 Standard Review RA-Sa-2009 conformance to the Plan (SRP). SRP does not guarantee that the CDF is less than 1x10-6 per year.

to ULNRC-06678 Page 2 of 2 Event Criterion Source Comments Analysis PS3. Design basis event NUREG-1407 as mean frequency is < 1E-5/y modified in and the mean conditional ASME/ANS Standard core damage probability is RA-Sa-2009

< 0.1.

PS4. Bounding mean CDF is NUREG-1407 and

< 1E-6/y. ASME/ANS Standard RA-Sa-2009 Detailed Screening not successful. NUREG-1407 and PRA PRA needs to meet ASME/ANS Standard requirements in the RA-Sa-2009 ASME/ANS PRA Standard.

A detailed description of the external events screening and evaluation process is presented in Callaway Plant, Unit No. 1 report PRA-OEH-ANALYSIS, "Other External Hazards: Screening Assessment Notebook."

to ULNRC-06678 Page 1 of 45 Attachment 6: Key Assumptions and Sources of Uncertainty 1.0 Introduction The Callaway Plant, Unit No. 1 list of assumptions and sources of uncertainty associated with Internal Events, Fire, Seismic, and High Winds PRA models were reviewed to identify those that would be significant for the evaluation of 10 CFR 50.69 application. If the Callaway Plant, Unit No. 1 PRA model used a non-conservative treatment or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.

To identify these assumptions and sources of uncertainty both plant-specific and generic sources of uncertainty (as identified in EPRI TR-1016737) were considered. All PRA notebooks were reviewed, and sources of uncertainty were compiled and characterized in the Callaway Plant, Unit No. 1 PRA Uncertainty Analysis Notebook (Reference 6 of this attachment). The identification and characterization of the sources of uncertainty was performed consistent with the requirements of the ASME/ANS PRA Standard (ASME/ANS RA-Sa-2009). This evaluation meets the intent of steps C-1 and E-1 of NUREG-1855, Revision 1.

To assess the impact of sources of uncertainties on 10 CFR 50.69 system categorizations, a review of the base case sources of uncertainty for the Callaway Plant, Unit No. 1 PRA models was performed. As documented in the Callaway Plant, Unit No. 1 PRA Uncertainty Analysis Notebook APP 6 (Reference 7), each identified uncertainty was evaluated with respect to its potential to significantly impact the risk ranking evaluations that will be performed to support the categorization effort. Only the sources of uncertainties and related assumptions with the potential to challenge the risk ranking evaluation guidelines are considered key. This evaluation meets the intent of the screening portion for steps C-2 and E-2 of NUREG-1855, Revision 1.

Regulatory Guide 1.174, Revision 3 (Reference 1) cites NUREG-1855, Revision 1, as related guidance. In Section B of RG 1.174, Revision 3, the guidance acknowledges specific revisions of NUREG-1855 to include changes associated with expanding the discussion of uncertainties, which is addressed in this attachment.

The guidance in NEI 00-04 specifies sensitivity studies to be conducted for each PRA model to address key sources of uncertainty. The sensitivity studies are performed to ensure that assumptions and sources of uncertainty (e.g., human to ULNRC-06678 Page 2 of 45 error, common cause failure (CCF), and maintenance probabilities) do not mask the SSC(s) importance. As part of the required 50.69 PRA categorization sensitivity cases directed by NEI 00-04, human error probabilities (HEPs) and common cause basic events are increased to their 95th percentile and also decreased to their 5th percentile values for all models applicable to this application. These results can drive a component and respective functions HSS, and therefore, the uncertainty of the PRA modeled HEPs and CCFs are accounted for in the 50.69 application. Furthermore, the sensitivity study where all LSS component failure rates are increased by a factor of three accounts not only for postulated increases due to the removal of special treatment requirements but also addresses uncertainty in component performance related to various sources of epistemic uncertainty.

Callaway Plant, Unit No. 1 PRA model specific assumptions and sources of uncertainty for this application were identified and dispositioned. The results of the evaluation of PRA model sources of uncertainty, as described above, are evaluated relative to the 50.69 application in PRA Uncertainty Analysis Notebook APP 6 (Reference 7). The evaluation found that no assumptions or sources of uncertainty challenged the risk ranking evaluation guidelines of the 50.69 application. Therefore, there are no additional sensitivity analyses required to address the Callaway Plant, Unit No. 1 model specific assumptions or sources of uncertainty.

In addition, at the time of this submittal, all open Finding level facts and observations (F&Os) on the Callaway Plant, Unit No. 1 Internal Events, Internal Flood, Fire, High Winds and Seismic PRA models have been closed using the process documented in Appendix X to NEI 05-04, NEI 07-12, and NEI 12-13 as accepted by the NRC (Reference 8). The results of these independent assessments have been documented and are available for NRC audit; therefore, no additional sensitivities are required to address open Finding F&Os against the Callaway Plant, Unit No. 1 PRA models.

Furthermore, as discussed under the Fire PRA description in section 3.3, the resolution of Suggestion F&O FSS-B1-03 was determined to be an upgrade and has been reviewed by an independent assessment. Therefore, no additional sensitivities are required to address the previous upgrade in the Callaway Plant, Unit No. 1 Fire PRA model.

2.0 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Impacts The Internal Events PRA model uncertainties were evaluated using the guidance in NUREG-1855 Revision 1 (Reference 2) and EPRI 1016737 (Reference 3) to to ULNRC-06678 Page 3 of 45 identify key sources of uncertainty. As described in NUREG-1855, sources of uncertainty include "parametric" uncertainties, "modeling" uncertainties, and "completeness" (or scope and level of detail) uncertainties.

Parametric uncertainty was addressed as part of the Callaway PRA model quantification. The parametric uncertainty evaluation for the Internal Events PRA model is documented in Section 5.1 of the PRA Uncertainty Analysis Notebook (Reference 6).

Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development to address a particular modeling uncertainty because there is not a single definitive approach. Plant-specific assumptions and modeling uncertainties for each of the Callaway Internal Events PRA technical elements are noted in the PRA Uncertainty Analysis Notebook (Reference 6).

The Internal Events PRA model uncertainties evaluation considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty and characterizing that uncertainty, as necessary. Electric Power Research Institute (EPRI) compiled a listing of generic sources of modeling uncertainty to be considered for each Internal Events PRA technical element (Reference 3), and the evaluation performed for Callaway considered each of the generic sources of modeling uncertainty as well as the plant-specific sources.

Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA but are only considered for their impact on a specific application. No specific issues of PRA completeness have been identified relative to the 10 CFR 50.69 application, based on the results of the Internal Events PRA peer reviews.

Additionally, an evaluation of Level 2 internal events PRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference 2) and Electric Power Research Institute (EPRI) 1026511 (Reference 4). The potential sources of model uncertainty in the Callaway PRA model were evaluated for the 32 Level 2 PRA topics outlined in EPRI 1026511.

A detailed review of the generic and plant-specific sources of internal events model uncertainties is discussed in Report PRA-IE-UNCERT (Reference 6) and is therefore not repeated in this enclosure. The purpose of this enclosure is to summarize the key sources of uncertainty that could potentially impact the 50.69 system categorization.

to ULNRC-06678 Page 4 of 45 Based on following the methodology in EPRI 1016737, as supplemented by EPRI 1026511, the impact of key sources of uncertainty in the Internal Events PRA model on the 50.69 application is summarized in Table E6-1. The key sources of uncertainty identified in Table E6-1 do not present a significant impact on the Callaway 50.69 categorizations and therefore, the Internal Events PRA model can produce accurate 50.69 categorizations.

to ULNRC-06678 Page 5 of 45 Table E6-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions Battery Life Calculations Station blackout events are important The batteries at Callaway will maintain The uncertainty/assumption contributors to baseline CDF at nearly output for four hours after loss of all represents a conservative bias in the every U.S. NPP. Battery life is an AC power; however, there are several PRA model, and removing the important factor in assessing a plant's evaluations that show that the identified conservative bias would not ability to cope with an SBO. Many batteries will last at least eight hours. have a significant impact on the 50.69 plants only have design basis This time is somewhat conservative categorization process. This is calculations for battery life. Other since it could reasonably be extended consistent with the guidance in plants have very plant/plant condition- with additional considerations (e.g., Section 3.1.1 of EPRI 1016737.

specific calculations of battery life. load shedding). The primary Failing to fully credit battery capability components in the PRA that rely on can overstate risks, and mask other the battery supply are for AFW control potential contributors and insights. or pressurizer power-operated relief Realistically assessing battery life can valve (PORV) operation during be complex. transients. The PORVs are not credited after battery depletion; therefore, sensitivity studies involving their continued operation are not to ULNRC-06678 Page 6 of 45 Table E6-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions warranted in the baseline PRA. Upon battery depletion, loss of all remote AFW flow control to the steam generators may lead to an overfill condition that could disable the TDAFW pump. Design and procedures at Callaway make this an unlikely occurrence, and an operator action is included in the model to locally control AFW flow to the steam generators after battery depletion.

Containment Sump/Strainer Performance All PWRs are improving ECCS sump Containment sump plugging is a A sensitivity was performed on the management practices, including concern with LOCAs of all sizes. The Callaway model where probabilities installation of new sump strainers at method employed to account for without limiting breaks were used in most plants. sump plugging is simplified in that it all cases (which minimizes the includes a single sump plugging impact), all non-LOCAs were given the to ULNRC-06678 Page 7 of 45 Table E6-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions probability per train (and includes same value, and both trains were CCF). An alternative method would modeled to fail by single events. No be to define LOCA size-based change was seen, which indicates that probabilities for sump plugging, using the existing method does not WCAP-16882-NP, which provides introduce undue optimism or event-dependent values. conservatism relative to other methods.

Core Melt Arrest In-Vessel Typically, the treatment of core melt The Callaway model does not credit The first sensitivity assumed that if arrest in-vessel has been limited. offsite power recovery after core power was recovered, equipment is However, recent NRC work has damage and prior to vessel breach able to be restored for injection in indicated that there may be more (The path to arresting core melt given order to cease core melt progression.

potential than previously credited. An a station blackout (SBO)). Recovering Two values were used for non-example is credit for CRD in BWRs. offsite power in the time window recovery probabilities (multipliers for between core damage and vessel not recovering power between core failure is not likely to have a great damage and vessel failure); one for effect in terms of mitigating the high RCS pressure and one for low to ULNRC-06678 Page 8 of 45 Table E6-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions progression. However, for the RCS pressure. Both values were purpose of quantifying the selected to be on the conservative assumption, two sensitivity cases were side of the available representative made for which representative values values. The LERF impact results were derived from the convolution method negligible.

for offsite power non-recoveries were used. For non-SBO sequences, the Callaway model gives limited credit to arresting core damage via cavity flooding to provide ex-vessel cooling. For this case, the event, VB was used as a surrogate, which was simply increased and decreased by a factor of two, and then set to TRUE to see the impact of not crediting core melt arrest. The results showed LERF increased by 1.4%.

Support System Initiating Events to ULNRC-06678 Page 9 of 45 Table E6-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions Support System Initiating Events - Explicit support system initiating event The uncertainty with the MTTR Increasing use of plant-specific (SSIE) models were developed for the implements a conservative bias in the models for support system initiators total loss of service water and PRA model that is the current state-(e.g., loss of SW, CCW, or IA, and loss component cooling water systems, in of-practice in PRA.

of AC or DC buses) have led to accordance with current industry inconsistencies in approaches across practice (as well as DC systems NK01 the industry. A number of challenges and NK04). For these events, a mean exist in modeling of support system time to repair is included in the model initiating events: (1) treatment of structure to account for the probability common cause failures and (2) that a train of equipment may be potential for recovery. restored prior to redundant train failure or administrative shutdown of the plant. MTTR for Callaway was calculated to be 19.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> but the model uses an MTTR of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> since it is bounding and facilitates ease of modeling through the use of existing basic events.

to ULNRC-06678 Page 10 of 45 Table E6-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions Default CCW Train Alignment The default operating CCW train The alternate CCW configurations are The uncertainty or assumption will alignment is for the Train A CCW to be modeled, and a sensitivity was have minimal impact on the PRA running. Alternate configurations are performed which shows the model is results and 50.69 categorization.

possible between SW, CCW, and ESW. not significantly sensitive to the alternate alignment.

Core Debris Contact with Containment In some plants, core debris can The WCAP method was used to To assess the impact of these event contact the containment shell (e.g., develop the Callaway LERF model values on LERF, surrogate values were some PWRs including free-standing provides two opportunities (early and used as calculated for a similar plant, steel containments). Molten core late) for intentional or unintentional for early depressurization and late, debris can challenge the integrity of RCS depressurization. The early separately. The impact on the model the containment boundary. Some depressurization is intended to avert is negligible. The uncertainty or analyses have demonstrated that core an induced tube rupture, while the assumption will have no impact on the debris can be cooled by overlying late depressurization is based on the PRA results.

water pools. relative likelihood of hot leg or surge to ULNRC-06678 Page 11 of 45 Table E6-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions line failure prior to vessel breach.

Other RCS boundary failures not credited in this model include a stuck open PORV/PSV after the core uncovers (which could potentially have a non-negligible probability), or an increased likelihood of an RCP seal LOCA after the seal package is introduced to superheated steam.

Both depressurization probabilities play a role in determining likelihood of early containment failure as well. So the uncertainty inherent in their values could impact several other calculations. These are modeled as split fractions in the Callaway model; however, the early split fraction has a value of 1.0 for both complementary to ULNRC-06678 Page 12 of 45 Table E6-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions events (i.e., they are treated as flags).

The success complement (RCS depressurized) is always ANDed with other events that are set to zero so the end result is effectively a split fraction with values of one and zero.

to ULNRC-06678 Page 13 of 45 3.0 Assessment of Supplementary Fire PRA Epistemic Uncertainty Impacts The following discussion addresses the epistemic uncertainty in the Callaway fire PRA. The Callaway fire PRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the fire PRA and because the state of knowledge in these elements continues to evolve. The development of the Callaway fire PRA was guided by NUREG/CR-6850 (Reference 9). The Callaway fire PRA model used consensus models described in NUREG/CR-6850.

Callaway used guidance provided in NUREG/CR-6850 and NUREG-1855 (Reference 2) to address uncertainties associated with fire PRA for the 50.69 categorization. As stated in Section 1.3 of NUREG-1855:

Although the guidance in this report does not currently address all sources of uncertainty, the guidance provided on the uncertainty identification and characterization process and on the process of factoring the results into the decision making is generic and independent of the specific source of uncertainty. Consequently, the guidance is applicable for sources of uncertainty in PRAs that address at-power and low power and shutdown operating conditions, and both internal and external hazards."

NUREG-1855 also describes an approach for addressing sources of model uncertainty and related assumptions. It defines:

A source of model uncertainty exists when (1) a credible assumption (decision or judgment) is made regarding the choice of the data, approach, or model used to address an issue because there is no consensus and (2) the choice of alternative data, approaches or models is known to have an impact on the PRA model and results. An impact on the PRA model could include the introduction of a new basic event, changes to basic event probabilities, change in success criteria, or introduction of a new initiating event. A credible assumption is one submitted by relevant experts and which has a sound technical basis.

Relevant experts include those individuals with explicit knowledge and experience for the given issue. An example of an assumption related to a source of model uncertainty is battery depletion time. In calculating the depletion time, the analyst may not have any data on the time required to shed loads and thus may assume (based on analyses) that the operator is able to shed certain electrical loads in a specified time."

to ULNRC-06678 Page 14 of 45 NUREG-1855 defines consensus model as:

A model that has a publicly available published basis and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the consensus model approach is one that NRG has utilized or accepted for the specific risk-informed application for which it is proposed."

The plant-specific assumptions in the Callaway fire PRA and the 71 generic sources of uncertainty identified in EPRI 1026511 (Reference 4) were evaluated for their potential impact on the 50.69 application (Reference 7). This guideline organizes the uncertainties in Topic Areas like those outlined in NUREG/CR-6850 and was used to evaluate the baseline fire PRA epistemic uncertainty and evaluate the impact of this uncertainty on 50.69 system categorization.

A detailed review of the generic and plant-specific sources of internal fire model uncertainties is discussed in Reference 10 and is therefore not repeated in this enclosure. The purpose of this enclosure is to summarize the key sources of uncertainty that could potentially impact the 50.69 categorizations.

Table E6-2 summarizes the review for key sources of uncertainty in the internal fire PRA model for the 50.69 application.

As noted above, the Callaway fire PRA was developed using consensus methods outlined in NUREG/CR-6850 and interpretations of technical approaches as required by NRC. Fire PRA methods were based on NUREG/CR-6850, other more recent NUREGs, (e.g., NUREG-7150 (Reference 11), and published "frequently asked questions" (FAQs) for the Fire PRA.

The key sources of uncertainty identified in Table E6-2 do not present a significant impact on the Callaway 50.69 categorizations and therefore, the internal fire PRA model can produce accurate 50.69 categorizations.

to ULNRC-06678 Page 15 of 45 Table E6-2 Assessment of Supplementary Fire PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions Treatment of unknown cable locations It is common to not know specifically This is a level of detail issue. As described in EPRI 1026511, the in a room where every cable is approach selected is based on the located. As a result, the fire PRA level of detail within the model. Cable assumes the cable is damaged for routing was not assumed for any every fire until the cable is traced in credited equipment. All components detail. and cables located in a Fire Area are assumed to be failed by the fire in that area as documented in the Individual Fire Area Notebook.

Scope and treatment of instrumentation, annunciators, and alarms The treatment of instrumentation is a Instrumentation may be included as As described in EPRI 1026511, specific potential source of model uncertainty. part of the requirements needed for instrumentation may be included in The standard requires the appropriate operator response in the the model as required for each identification of any single instruments PRA logic model. modeled operator action and integrated into the fire PRA model. A to ULNRC-06678 Page 16 of 45 Table E6-2 Assessment of Supplementary Fire PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions that are relied on for all credited HFEs Failures of systems may also be detailed review of HEPs and their in the fire PRA model. included if spurious indications could required instrumentation has been lead to failure of the system to meet performed. The Component Selection The standard also requires the its PRA credited function. Notebook lists all the instruments identification of potential spurious included in the fire PRA and identifies indications that could cause an which ones are subject to spurious undesired operator action related to actuation.

that portion of plant design credited in the analysis. The instruments used for information in the PRA (i.e., supporting operator actions) are listed in groups for functional indication (e.g., RCS pressure, containment sump level, etc.) meaning that the operator is not reliant on a single instrument for that indication.

Main control room abandonment scenarios to ULNRC-06678 Page 17 of 45 Table E6-2 Assessment of Supplementary Fire PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions Incorporation of NUREG-1921 Scenarios involving control room The Callaway Fire PRA model has Supplement 2, introduced a new abandonment and subsequent detailed analysis that considers control assumption and source of model response actions were evaluated as room abandonment and its impacts on uncertainty associated with the timing described in EPRI 1026511. This can operators ability to safely shutdown for the MCR abandonment due to loss be achieved by incorporating detailed the plant.

of control. sequence event tree and system fault tree modeling for executing safe shutdown procedures from the alternate shutdown panels or by using a screening approach based on CCDP.

Lack of Cable Data Exclusion of certain systems due to Lack of credit for some systems could As described in EPRI 1026511, the lack of cable data mask the risk associated with those approach selected is based on the systems in some applications. level of detail within the model. Cable Additionally, that same lack of credit routing was not performed for instrument air, main feedwater, or to ULNRC-06678 Page 18 of 45 Table E6-2 Assessment of Supplementary Fire PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions could overestimate the importance of condensate but all of those systems other credited systems. are assumed unavailable. A sensitivity was performed and showed a minimal impact to overall plant results and would not impact the 50.69 categorizations.

to ULNRC-06678 Page 19 of 45 4.0 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Impacts An assessment was conducted of the supplementary high winds PRA epistemic uncertainty impacts on the 50.69 system categorization application. Table E6-3 provides the results of the assessment. A detailed discussion of the sensitivity studies performed for the high winds PRA model is provided in Reference 12.

to ULNRC-06678 Page 20 of 45 Table E6-3 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions High Wind Missile and Grid Fragilities There is an inherent assumption of This is potentially non-conservative for The sensitivity case undertaken in the statistical independence between separately modeled opposite train HWPRA study demonstrated that this missile fragilities when they are components in close proximity whose assumption has only a very small implemented in the CAFTA model for missile fragilities may be positively impact on the PRA results; therefore, the HWPRA. correlated. To test the impact of this there would be no impact on the assumption, the TORMIS Monte Carlo 50.69 categorizations.

simulation results were used to determine the Boolean Intersection fragilities for selected opposite train components modeled in TORMIS. A sensitivity case in the HWPRA model was then undertaken using the Boolean intersection fragilities as the probabilities for new correlated wind missile failure events that were mapped to the components in both trains of equipment. The sensitivity to ULNRC-06678 Page 21 of 45 Table E6-3 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions case results showed only a very small impact on CDF.

High wind events occurring at the The probability of loss of offsite power The baseline grid fragility values plant are assumed to lead to either a at the time of the high wind event, assumed for the Callaway HWPRA are turbine trip or a loss of offsite power that is, the electrical grid fragility, is viewed as reasonable estimates; event sequence, with the electrical assigned based on the wind speed. however, grid fragility is recognized as grid fragility assigned based on the The same probabilities are used for an uncertainty significant to the wind speed. both straight winds and tornadoes. evaluation of wind Hazards. Analysis These probabilities are a pure of the likelihood of a loss of offsite assumption for the Callaway HWPRA power, and potential LOOP recovery, but are generally consistent with given high wind events is an area of values assumed in other studies. The ongoing investigation for the nuclear HWPRA documentation includes a industry.

sensitivity study to assess the impact of these assumed electrical grid The sensitivity cases used in the 50.69 fragilities on CDF. categorization process address these uncertainties by testing assumptions related to maintenance, common to ULNRC-06678 Page 22 of 45 Table E6-3 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions cause, and human error. Furthermore, the sensitivity study where all LSS component failure rates are increased by a factor of three accounts not only for postulated increases due to the removal of special treatment requirements but also addresses uncertainty in component performance based on different frequency and consequence levels of high wind events whose severity could result in increased component failures.

Additionally, one of the sensitivity cases for this issue in PRA-IE-UNCERT_APP4, High Wind Uncertainty Analysis and Sensitivities (Table 3, Case 1B) shows a 114% increase in CDF. This result is expected given the to ULNRC-06678 Page 23 of 45 Table E6-3 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions relative importance of the F1 wind speed initiating events, their high frequencies of occurrence (particularly for F1-1 straight winds), and the many dominant CDF cutsets that involve F1 winds combined with LOOP due to electrical grid fragility. It is widely recognized that assuming grid failure with certainty at lower wind speeds can lead to over-conservatism in the results. The baseline grid fragility values assumed for the Callaway Energy Center (CEC, licensed as Callaway Plant, Unit No. 1) HWPRA are viewed as reasonable estimates.

Analysis of the likelihood of a loss of offsite power, and potential LOOP recovery, following high wind events is an area of ongoing investigation for to ULNRC-06678 Page 24 of 45 Table E6-3 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions the nuclear industry. Therefore, this will not impact the 50.69 categorization process.

Operator Actions in Unprotected Areas For operator actions where one or For human failure events where one The sensitivity case undertaken in the more of the diagnosis or execution or more of the diagnosis or execution HWPRA study demonstrated that this steps takes place in the field outside steps takes place in the field outside assumption has only a very small the protected areas of the Category I the protected areas of the Category I impact on the PRA results; therefore, buildings, the timing details are buildings, the timing details are there would be no impact on the reviewed and used as a basis for reviewed and used as a basis for 50.69 categorizations.

modifying the human error modifying the human error probabilities:

probabilities. - If the total system time window (TSW) is less than 60 minutes, regardless of the time margin, then the operator action is not credited (i.e., set to logical TRUE) for all wind speeds.

to ULNRC-06678 Page 25 of 45 Table E6-3 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions

- If the field action does not need to be completed within the first 60 minutes after the high wind event, the human error probability is adjusted depending on the time margin (i.e., the difference between the time required and the time available) and the severity of the wind.

- The human error probability multipliers are a pure assumption for the Callaway HWPRA study but are generally consistent with similar multipliers recommended for seismic PRA.

A sensitivity case was undertaken in the HWPRA study to assess the sensitivity of the results to these human error probability multipliers.

to ULNRC-06678 Page 26 of 45 Table E6-3 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions The sensitivity case results showed only a very small impact on CDF.

Default CCW Train Alignment The default operating CCW train The alternate CCW configurations are The uncertainty or assumption will alignment is for the Train A CCW to be modeled, and a sensitivity was have minimal impact on the PRA running. Alternate configurations are performed which shows the results and therefore there would be possible between SW, CCW, and ESW. equipment related failures for the no impact on the 50.69 alternate alignments are not categorizations.

significantly sensitive. For High Winds, operator actions drive some deltas in the alternate alignment.

to ULNRC-06678 Page 27 of 45 As part of Attachment 8, responses to audit questions, additional High Winds uncertainty discussion is provided.

Response to APLC-Q6a - Summary of HW Hazard Analyses Tornado Wind Hazard Analysis P aram eter Uncertainty. Table E6-4 summarizes the sources of parameter (i.e. random) uncertainties considered in the tornado hazard analysis.

Table E6-4. Summary of Parameter (Random) Uncertainties Considered in Tornado Hazard Analysis Uncertainty Model/ Submodel Number Parameter Basis for Quantification Type Tornado Number of tornadoes in plant sub-region and 1

Occurrence Rate analysis of reporting trends by F-Scale.

Tornado Intensity Number of tornadoes in each intensity scale; 2

(F, EF, and F) reporting trends; error analysis.

Variation of 3 intensity along Mapping of tornado damage for selected events.

tornado path 4 Wind Speeds Tornado wind speeds given damage.

Tornado Hazard Random Analysis of lat-long postions of starting and ending 5 Path Direction point of tornado path.

Analysis of path length data conditional for 6 Path Length selected events.

Analysis of path width data conditional on F-Scale 7 Path Width and path length.

Quantification of Translation Speed, Rmax, inflow Tornado Windfield parameter, Boundary layer height, velocity profile, 8

Parameters core slope parameters developed in Twisdale et al.,

(1978b, 1981).

M odel Uncertainty. Table E6-5 summarizes the sources of modeling uncertainties considered in the tornado hazard analysis.

to ULNRC-06678 Page 28 of 45 Table E6-5. Summary of Modeling (Epistemic) Uncertainties Considered in Tornado Hazard Analysis Model/ Uncertainty Number Parameter Basis for Quantification Submodel Type 1 Occurrence Rate Number of years of data.

Three distributions are developed based on error F-Scale Probability 2 analysis, Bayesian updating, and engineering Distribution judgment.

Three wind speed ranges are used to reflect the EF, Tornado Hazard Model Tornado F-Scale F, and F wind speeds. The F winds are based on a 3

Wind Speeds Bayesian updating process reflecting engineering data and judgment.

Engineering judgment to reflect modeling Overall Modeling uncertainties in the overall estimation process, 4

Uncertainty Factor including tornado windfield parameter uncertainties, damage variation along path length.

Additional information on treatment of modeling uncertainties can be found in the following references:

• F-Scale Probability Distributions - See Twisdale et. al. (1978b, 1981),

Twisdale (1978), Twisdale and Dunn (1983), and Edward and Brooks (2010).

• Tornado F-Scale Wind Speeds - See Twisdale et. al. (1978a, 1981),

Twisdale (1978), and Texas Tech (2004).

K ey Assum ptions. Table E6-6 summarizes the key assumptions made in the development of the tornado hazard curves.

to ULNRC-06678 Page 29 of 45 Table E6-6. Key Assumptions in Tornado Hazard Analysis No. High Wind Hazard Analysis Assumption 1 Use of Poisson process for modeling of tornado occurrence.

Tornado path variables correlation to F-Scale. Treatment of path width and length correlation 2

is achieved through discrete frequency tables of the FPP categories.

Rectangular tornado path areas are assumed for purposes of estimating tornado strikes to the 3

plant safety envelope.

Assumptions regarding F, F, and EF-Scale tornado wind speeds associated with damage 4 intensity assignments by NWS. Subjective weighting of these wind scales was used to reflect epistemic uncertainties.

5 Peak Gust winds less than 73 mph are not capable of damaging safety SSCs.

SPC database assumed to be most accurate data available. Independent research to verify accuracy of SPC database vs. NCDC or other raw sources was not performed. Use of SPC 6

databases, which includes biases, errors, mistakes, and default data, introduces considerable uncertainties and potential biases into the analysis.

7 Use of TORMIS research results regarding tornado modeling.

8 Use of Cluster Analysis to identify the sub-region.

The tornado risk at the plant is assumed to be modeled by the tornadoes that have occurred 9

within the subregion.

Increase in numbers of reported tornadoes over time is due to increased reporting 10 efficiencies.

11 Tornado reporting efficiency in modern era is assumed to be 80% (1/1.25).

Any portion of the tornado path that intersects the plant safety envelope is defined as a 12 tornado strike for purposes of missile fragility analysis.

13 Use of normal distribution to model statistical uncertainties in mean occurrence rate.

14 Use of normal distribution for overall modeling (epistemic) uncertainty factor.

Tornado wind speeds are assumed to correspond to damage producing gusts (3 sec time 15 average).

Uncertainties in F/EF-Scale probabilities, given a tornado, can be modeled using three 16 weighted distributions.

Uncertainties in tornado wind speeds given damage can be modeled as a weighted distribution 17 of F, F, and EF-Scales.

to ULNRC-06678 Page 30 of 45 Straight Wind Hazard Analysis P aram eter Uncertainty. Parameter uncertainties were estimated from estimates of the standard errors in both the mean and standard deviations of the annual wind data that are used in the Type I parameter estimation. Errors in the mean shift the Type I fit vertically without a change in the slope. Errors in the standard deviation change the slope of the Type I fit.

Since the parameters of the Type I distribution were obtained using the method of moments, the standard errors in the estimates of the mean and standard deviation of the wind speed maxima were used to compute the errors in the estimates of the mode, U, and the dispersion, 1/.

Parameter uncertainty estimates were treated for Occurrence Rate, the Type I Mode, and the Type I Dispersion.

M odel Uncertainty. Modeling (epistemic) uncertainties treated using expert judgment in the Straight Wind hazard analysis include:

1. Uncertainty in the correction for anemometer height.

2. Uncertainty in the roughness of the surrounding terrain.

3. Uncertainty in the effective gust duration for the cup anemometer era, and gust wind speed adjustment in the case of the ASOS measurements.

4. Modeling overall uncertainty associated with the possibility of an erroneous choice of the extreme value distribution used in the study and uncertainties in the applicability of the model sub-components (ESDU models)

K ey Assum ptions. Key assumptions in the Straight wind Hazard Analysis include:

1. Methodology Assumptions:

a. The methodology assumes the Type I (e.g., Simiu and Scanlan, 1996) distribution provides a good representation of the distribution of annual extremes.

b. The use of the Type I distribution implies no upper bound to the wind speeds produced by the statistical model that could lead to unrealistically high estimates of very rare winds.

2. Thunderstorm and Extratropical Storm Wind Speeds

a. The modeling approach assumes that thunderstorm and non-thunderstorm winds can be treated as statistically independent events.

to ULNRC-06678 Page 31 of 45

b. It is assumed that on days where a thunderday was reported in the NCDC database the maximum gust recorded on that day was associated with a thunderstorm.

3. NCDC Wind Data

a. Use of N years of data to estimate wind frequencies for return periods much longer than N years.

b. Use of nearby airport station data for CEC due to lack of suitable site-specific data.

Response to APLC-Q6b - Summary of HW Fragility Analyses High Wind Missile Fragility Analysis P aram eter Uncertainty. Parameter (random) uncertainty is addressed by running TORMIS for 60 individual model replications. Each one of these replications includes a different random seed and sampled number of total missiles available my missile type and source (zone and structure). The sampling of the number of missiles used for each run is determined based on expected changes to the missile population over time to account for foreseeable events such as regularly scheduled refueling outages and planned construction projects.

M odel Uncertainty. Modeling (epistemic) uncertainties treated in the HW Missile Fragility analysis are listed, along with the basis for quantification of such uncertainties, in Table E6-7.

to ULNRC-06678 Page 32 of 45 Table E6-7. Listing of Modeling Uncertainties Treated in the HW Missile Fragility Analysis Number Description Basis for Quantification Misssile Sensitivity Analysis 1 Missile Inventory (Twisdale and Sciaudone, 2013) 23 Missile Types to Original TORMIS Research 2

Catergorize All Missiles (Twisdale, et. al. 1978a)

Sensitivity Analyses in ARA 3 Rotational Velocity Profile (2012a) and ARA(2012b)

Wind Field Parameter 4 Twisdale et. al. (1981)

Distribitions 5 Single Wind Field Parameter Twisdale et. al. (1981)

Random Orientation 6 Twisdale et. al. (1981)

Trajectory Model Generic Building Failure 7 FEMA (2007)

Model Approximations in 3D Plant 8 Twisdale et. al. (2011)

Model 9 Simplified Damage Criteria Engineering Judgment Limtations of TORMIS 10 Engineering Judgment Modeling Approach Missile Transport within 11 Engineering Judgment Buildings K ey Assum ptions. Key Assumptions in the development of the CEC HW Missile Fragility analysis are listed in Table E6-8.

to ULNRC-06678 Page 33 of 45 Table E6-8. Key Assumptions in CEC HW Missile Fragility Analysis Number Assumption 1 No missiles are generated from the UHS Retaining Pond.

2 Sheds, shacks, and other small structures located within the missile zones will fail and become missiles at all wind speeds.

Tree density in treed areas around CEC are assumed to be the same as those found at a similar Nuclear Power Plant site in 3

Western Illinois.

4 Each 10 ft (3 m) length of chain length fence is assumed to produce one 3-in (76 mm) pipe missile.

Missile source structures will break up into their component parts when subjected to tornado winds and will become wind-5 borne missiles. The total number of missiles each structure breaks into increases with wind speed considered.

Structures with walls and roofs constructed with reinforced concrete that is at least 1.5 ft thick will not fail due to impact by 6

wind-borne missiles and will not contribute to plant risk.

7 Missile populations are assumed to be normally distributed for purposes of the stochastic missile model.

8 Mean value of missile population, by source, is equal to 1.05 times the number of missiles surveyed and/or estimated.

9 COV of missile population, by source, for non-outage conditions is 15%.

10 COV of missile population, by source, for outage conditions is 20%.

Stochastically modeled missile population by source has a minimum value of 80% of the mean missile population or 84%

11 of the surveyed missile population.

Typical duration of elevated missile counts for a refueling outage is 60 days out of every 18 months. This estimate includes 12 time to cover staging, actual outage time, and de-mobilization.

Failure of transmission line structures were assumed to consist of collapse near their foundations, as has been observed in 13 many high wind failures. No wind-borne missiles were assumed to originate from transmission line structures.

Offset hit dimension of 1.5 ft in each free direction for the impact missiles causing damage to safety related components.

14 This implies that the average length of missiles impacting safety related targets is less than or equal to 12 ft.

15 Siding missiles will bend and deform during failure and are not considered in the modeling for offset hit.

Air and motor operated valves that are required to operate during a PRA event are evaluated for damage based on the missile 16 velocity required to break tempered glass.

Required missile velocities to crush the EDG Lube Oil and Day, Tank Vents, Exhausts, or Truck Connections, TDAFP 17 Exhausts, MSSVs, and ADVs are estimated using a single degree of freedom crimping model discussed in Section 8.2.5.

18 Where not shown on plans, all safety-related piping is assumed to be of standard thickness.

Where not shown on plans, yield strength of structural steel comprising safety-related targets is conservatively assumed to 19 be 30,000 psi based on the yield strength of of typical types of steel (AISC 2011).

Where not shown on plans, compressive strength of concrete comprising safety-related targets is conservatively assumed to 20 be 3,000 psi based on the compressive strength of normal concrete (ACI 2014).

Where not shown on plans, compressive strength of masonry block comprising safety-related targets conservatively 21 assumed to be 2,000 psi based on the compressive strength of normal concrete masonry (NCMA 2011).

Thickness of steel in standard industrial steel doors is assumed to be 2 thicknesses of 18 gage steel (one for each face) for 22 an equivalent steel thickness of 0.1 in based on the Steel Door Institute's "Selection and Usage Guide" (2014).

Deviation Justification . The CEC HW Missile Fragility analysis used a plant-specific methodology for determining the frequency of tornado and straight wind missile damage. As such, there are no deviations from the requirement for a plant-specific analysis.

High Wind Pressure Fragility Analysis P aram eter Uncertainty. Parameter uncertainties treated in the wind pressure fragility analysis are listed in Table E6-9.

to ULNRC-06678 Page 34 of 45 Table E6-9. Listing of Parameter (Random) Uncertainties Treated in CEC HW Pressure Fragility Analysis Uncertainty Number Parameter Basis for Quantification Type Overall Code Based 1 Random uncertainty not applied.

Uncertainty Constant exposure to the outside environment, thermal cycles, 2 Condition and other loads lead to variations in level of degradation that will not be consistent between elements or structures.

Structural steel members are sized based on a number of 3 Member Size Selection factors such as load, span, and availability of sections. Not all uncertainty is reducible.

Uncertainty in the ultimate capacity of wind braces and their 4 Failure Mode Capacity connections in a braced frame.

Dead, Live, and Crane Design dead and live loads could have been over- or under-5 Loads estimated. Loads, by nature, have a random element.

Random Random variability in the strength of members due to loading 6 Strength Margin and failure in- vs. out-of-plane, elastic, and inelastic buckling.

Uncertainty for effects of terrain and shielding from other 7 Directionality Dependent structures includes randomness.

There is a lot of variability in internal pressures throughout a Building Enclosure and 8 building and these fluctuate throughout progressive failure due Internal Pressure Effect to opening sizes, wind direction, gusts, etc.

Uncertainty of pressure coefficients on structures cannot be Code Pressure 9 fully eliminated because they vary by wind direction, surface, Coefficients air separation around edges, etc.

10 Wind Uplift Uncertainty in wind uplift in a tornado event 11 APC Uncertainty in atmospheric pressure change in a tornado event.

M odel Uncertainty. Sources of modeling uncertainty treated in the HW pressure fragility analysis are listed in Table E6-10.

to ULNRC-06678 Page 35 of 45 Table E6-10. Listing of Modeling Uncertainties Treated in CEC HW Pressure Fragility Analysis U11certai11ty Number Parameter Basis for Qua11tijicatio11 Type Overa ll Code Based Limitations of the code-based a na lysis, available information I

Uncertainty a nd level of detail for the a nalysis .

E ngineering j udgme nt that reflects age-related degradation o f 2 Condition structural materials.

Structura l steel members a nd pa nels are conservatively c hosen 3 Member Size Selection from standard sizes in des ign. Deta iled review of design calculations a nd additiona l a nalys is could reduce uncerta inty.

Uncerta inty in the ultimate capac ity of wind braces a nd their 4 Fa ilure Mode Capac ity connections in a braced frame.

Dead, Live, a nd Crane Structura l systems supporting cranes a re often tied back to the 5

Loads structural fra me of a building, providing additional stiffness.

Structural me mbers and compone nts have a range of stre ngth Model 6 Strength Margin and resistance that could be better modeled from testing, mill certificates, and are influences by qua lity of construction.

7 D irectiona lity Dependent Unce rta inty in directional te rrain roughness .

Interna l press ure mode ling uncertainties. More deta iled B uilding Enclosure and 8 progressive failure ana lyses can be performed to bette r mode l Inte rnal Pressure Effect internal press ures.

There is a limited a mount of data comparing w ind tunnel test Code P ressure 9 data to code ca lculations for buildings other tha n high-rises.

Coefficie nts W ind tunnel tests specific to the site would reduce uncertainty.

10 Wind Uplift Uncerta inty in the w ind uplift in a tornado event.

Unce rta inty in the atmospheric press ure c hange in a tornado 11 APC e vent.

Key Assumptions. Key assumptions regarding the wind pressure fragility methodology analyses include:

1. Fragility functions developed for non-tornado (i.e., straight wind, hurricane) and tornado hazards are based on peak gust wind speed.

2. The design tornado wind speed specified in CEC FSAR corresponds to the open-terrain fastest-mile wind speed at 10 m height above ground.

3. All structures analyzed are assumed to be rigid and not wind sensitive (cross-wind dynamic response is neglected).

4. No wind speed variation in height is considered for short buildings. The calculations are referenced to the design code and assumptions regarding the original design basis.

5. Duration effects are neglected, such as low-cycle fatigue of metal structures.

6. All calculations are simplified code-based estimates. Capacity factors computed are based on simple hand calculations and do not include a

to ULNRC-06678 Page 37 of 45 Deviation Justification . The completed analysis used a plant-specific methodology for determining the HW pressure fragility. As such, there are no deviations from the requirement for a plant-specific analysis.

to ULNRC-06678 Page 38 of 45 5.0 Assessment of Supplementary Seismic PRA Epistemic Uncertainty Impacts An assessment was conducted of the supplementary seismic PRA epistemic uncertainty impacts on the 50.69 system categorizations. Table E6-12 provides the results of the assessment.

Significant assumptions and sources of model uncertainty identified during the development of the SPRA model are documented in Section 4 of the SPRA plant response model notebook (Reference 13). Table 2-1 of the Quantification Notebook (Reference 14) characterizes these assumptions and sources of model uncertainty for their impact on the seismic risk results.

to ULNRC-06550 Page 39 of 45 Table E6-12 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions Non-Safety Component Sensitivity Non-safety components basic events This treatment is conservative. A The uncertainty/assumption were assigned a generic fragility value seismic sensitivity is performed to represents a conservative bias in the and were assumed to be fully show that the generic fragility value PRA model, and removing the correlated. used for the non-safety component identified conservative bias would not basic events does not significantly have a significant impact on the 50.69 impact CDF. categorization process. This is consistent with the guidance in Section 3.1.1 of EPRI 1016737.

Mission Time A mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was used A sensitivity study was performed to The sensitivity study performed on the in the Callaway SPRA model show that use of a 48-hour mission base model shows that there is no consistent with the internal event time has a negligible increase on CDF. impact on the PRA results and model. Mission times are used to therefore the uncertainty or define a safe stable state at which assumption will have no impact on the time the core has not been damaged, to ULNRC-06550 Page 40 of 45 Table E6-12 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions remains in a safe condition, and PRA results and therefore no impact offsite resources and/or personnel on the 50.69 categorizations.

may be available to aid in restoring equipment, connecting temporary equipment, etc. Given that a seismic event can potentially impact the ability for offsite plant or supplemental personnel to reach the site, there is an inherent uncertainty associated with the use of the 24-hour mission time. A seismic event can have impacts that are wide ranging on not only plant structure but offsite infrastructure (roads, communications, etc.) that may prevent personnel from easily accessing the site to assist in plant recovery actions.

to ULNRC-06550 Page 41 of 45 Table E6-12 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions On-Site FLEX Equipment Sensitivity FLEX equipment has the potential to The current treatment of FLEX The sensitivity documented in the be incorporated into a plant given a equipment is conservative. Sensitivity Seismic Uncertainty analysis shows severe accident on site and with some studies show that CDF and LERF can that significant reductions in CDF assumed conditions during the be reduced by improving credit for could result from fully crediting FLEX extreme event. The SPRA Model FLEX equipment. capabilities. The currently includes no credit for this uncertainty/assumption represents a equipment in the baseline model conservative bias in the PRA model, (events set to True). and removing the identified conservative bias would not have a significant impact on the 50.69 categorization process. This criterion is consistent with the guidance in Section 3.1.1. of EPRI 1016737.

Model Sensitivity to Seismic HRA Bin Definitions to ULNRC-06550 Page 42 of 45 Table E6-12 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions An inherent uncertainty associated HEP binning can have a significant The binning is developed using EPRI with the SPRA development relates to impact on the baseline results. The guidance, which is in essence, a the binning for the HEP seismic binning process used in the Callaway consensus process for HEP binning.

hazard group to the number of model is developed consistently with There is also no reasonable alternative seismic hazard bins modeled in the EPRI Guidance and is ensured to be to the assumption which would SPRA. realistic based on the relevant produce different results and/or there component fragilities used to define is no reasonable alternative that is at plant damage. The use of the EPRI least as sound as the assumption Guidance in HEP binning is essentially being challenged. This criterion is a consensus model or process. consistent with Section 3.3.2 of RG 1.200 Revision 3. Therefore, no additional sensitivity studies are required.

Default CCW Train Alignment The default operating CCW train The alternate CCW configurations are The uncertainty or assumption is not alignment is for the Train A CCW to be modeled, but a sensitivity has not expected to have any significant been performed. Based on the impact on the PRA results and to ULNRC-06550 Page 43 of 45 Table E6-12 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty Sources of Uncertainty and 50.69 Categorization Impact Model Sensitivity and Disposition Assumptions running. Alternate configurations are sensitivity of Internal Events and the therefore no impact on the 50.69 possible between SW, CCW, and ESW. modeling for Seismic, the existing categorizations.

Internal Events sensitivity is expected to bound the results of a Seismic sensitivity. The Seismic results are not expected to be sensitive to the alternate alignments.

to ULNRC-06550 Page 44 of 45 REFERENCES

1. NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, January 2018 (ADAMS Accession No. ML17317A256)

2. NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Final Report," Revision 1, March 2017

3. EPRI 1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," December 2008

4. EPRI 1026511, "Practical Guidance on the use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," December 2012

5. EPRI 1013491, "Guideline for the Treatment of Uncertainty in Risk-Informed Applications," October 2006

6. PRA-IE-UNCERT, "Probabilistic Risk Assessment (PRA), Uncertainty Analysis Notebook," Revision 001

7. PRA-IE-UNCERT_APP6, "Disposition of Key Uncertainties: Risk Informed Engineering Programs (10 CFR 50.69)," Revision 001.

8. NRC Letter to Mr. Greg Krueger (NEI), "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-13, Close Out of Facts and Observations (F&Os)," May 3, 2017, (Accession No. ML17079A427)

9. NUREG/CR-6850 (also EPRI 1011989), "Fire PRA Methodology for Nuclear Power Facilities," September 2005, with Supplement 1 (EPRI 1019259),

September 2010.

10. PRA-IE-UNCERT_APP2, "Fire Uncertainty Analysis and Sensitivities," Revision 1, June 2021.

11. NUREG/CR-7150, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), October 2012.

12. PRA-IE-UNCERT_APP4, "High Wind Uncertainty Analysis and Sensitivities,"

Revision 0, June 2021.

to ULNRC-06550 Page 45 of 45

13. PRA-SEISMIC-PLANT_RESPONSE, "Seismic Probabilistic Risk Assessment Modeling Notebook," Revision 1, May 2021.

14. PRA-SEISMIC-QUANT, "Seismic Probabilistic Risk Assessment, Quantification Analysis Notebook," Revision 1, June 2021.

to ULNRC-06678 Page 1 of 1 Attachment 7: Comparison of RG 1.200 Revision 1 and Revision 2 SRs Applicable to CC-I/II, CC-II/III, and CC-I/II/III The Callaway Plant, Unit No.1, probabilistic risk assessments (PRAs) to be applied in the 10 CFR 50.69 Program were all performed and peer reviewed based on Regulatory Guide 1.200, Revision 2, standard requirements.

Therefore, this comparison is not required for the PRAs to be applied in this program.

to ULNRC-06678 Page 1 of 38 Attachment 8: LAR Supplement to Address Audit Discussion Points and Potential RAIs Summarized in NRC Letter Dated June 9, 2021 (ML21139A022)

Audit Question: New - Probabilistic Risk Assessment (PRA) Update 9 Document and justify the basis for the large change in seismic large early release frequency (SLERF) from the PRA model update 8 to 9.

Response

The large change in seismic large early release frequency (SLERF) from PRA model update 8 to 9 was due to an error, which has since been corrected in PRA model update 9.01, as described in the PRA-SEISMIC-PLANT_RESPONSE notebook. In PRA model update 9, the CDF hazard midpoints had been inadvertently selected for the LERF scenarios, shifting the containment penetration fragility values and causing an overestimation of the CLERP. As documented in the PRA-SEISMIC-QUANT notebook, CLERP in PRA model update 9.01 is only slightly higher (about 36%, due primarily to the application of a lower truncation level) than in PRA model update 8, and the overall SLERF contributors are similar between PRA model update 8 and PRA model update 9.01. Attachment 2 of the LAR was revised to show SLERF for PRA model update 9.01, which is now the current PRA model of record.

Audit Question: APLA PRA Upgrades Part a:

• Positive statement to document the closure of open fact and observations (F&O) associated with PRA update 9.

• Positive statement there were no PRA upgrades that have not been peer-reviewed.

Part b:

• Positive statement that that there were no unreviewed upgrades to the fire PRA since 2009.

• Table summarizing major updates to fire PRA and justification that they were updates opposed to upgrades.

• Include guidance used to make the determination of maintenance update/upgrade.

Part c:

• Positive statement there are no unreviewed upgrades.

to ULNRC-06678 Page 2 of 38

Response

Open F&Os, that were associated with PRA model update 8, were closed, as of PRA model update 9.01; in addition, as of PRA update 9.01, there are no unreviewed PRA Upgrades contained in the PRA model of record. LAR section 3.3 (i.e., as submitted under ULNRC-06550) provides more detailed information on peer reviews and F&O closure reviews.

As documented in Attachment 3 of the PRA-FIRE-17671_015 notebook, the major updates to the FPRA, as of PRA model update 9.01, were tabulated and assessed for upgrade.

Description of Change Upgrade Assessment Documentation change to represent all This is a documentation update only and does scenario frequencies, CDF, and LERF to not constitute an upgrade.

three significant digits The staff guidance permitted the incorporation of probabilities (other than 1.0) to some types of circuit configurations, as well as probabilities for clearing of a hot short as a function of the Implementation of February 2014 NRC available time. At the time of this guidance, fire Interim Staff Guidance on spurious hot PRA methods were undergoing development to short probabilities and hot short durations support NFPA 805 transition in the industry, and it is deemed acceptable to implement NRC approved guidance without requiring a new peer review.

Plant modifications which result in impacts to the fire modeling are required to be Incorporated plant modifications not incorporated so the model reflects the as-built related to NFPA 805 implementation into plant. These types of changes do not involve the fire modeling supporting the fire PRA new methods and do not alter the scope of the fire PRA. These changes are considered a model maintenance and not an upgrade.

Update rooms 3101, 1206, and 1207 transient initiating event frequencies based on permitting storage of transient combustibles and conduct of hot work during power operation; note that the This change is necessary to ensure the fire PRA method of NUREG/CR-6850 conserves total reflects the as-operated plant and does not transient frequency, so that the increase in involve any new method for calculation of frequency for these three rooms would be transient fire frequencies. These changes are offset by reductions in other rooms - this considered model maintenance and not an reduction was incorporated for whole room upgrade.

burn compartments (no detailed fire modeling), but was conservatively not incorporated for fire-modeled compartments to ULNRC-06678 Page 3 of 38 Description of Change Upgrade Assessment Correction of this error fixed the reported CDF Corrected an error in the quantification of and LERF results for the two areas. No new areas YD-EX1 and YD-EX2 - the two areas methods were applied, and the total CDF and level one failure reports (target sets) had LERF were unchanged. This correction is been transposed considered model maintenance and not an upgrade.

Alignment of the fire PRA model to the baseline internal events model is a requirement of the Update LERF plant damage state binning PRA standard and was a requirement for and split fraction calculations to align with implementation of NFPA 805. The change did internal events model and comply with not involve any new methods or significantly NFPA 805 implementation commitments change LERF results. These changes are considered model maintenance and not an upgrade.

The use of cutoff values for concatenation of functional cutset results when combining to arrive at final CDF and LERF cutsets is used to Changed WinNupra quantification to use limit the size of the resulting files and changing no cutoff value for concatenation, in an the applied frequency to zero would not effort to reduce variability for future eliminate any final cutsets. This does not updates constitute a change in method of quantification.

This change is considered model maintenance and not an upgrade.

The use of more recent industry data is Updated ignition frequencies using new identified in the PRA Standard 1-A.3.3 as model data in NUREG-2169 maintenance and not an upgrade.

The changes maintain the fire PRA model consistent with the internal events model and Plant changes incorporated into model: the as-built plant. These changes are

• Generation 3 Reactor Coolant Pump considered model maintenance and not an shutdown seals upgrade. (It is noted that the internal events

• Hardened Condensate Storage Tank PRA model which included these changes was subsequently peer reviewed as described in this document.)

Changes to existing system modeling which Modified battery dependence on charger, does not significantly impact results is identified and updated battery test and maintenance in the PRA Standard 1-A.3.14 as model modeling maintenance and not an upgrade.

Update to the HRA using the existing HRA Updates to the Human Reliability Analysis methods is identified in the PRA Standard 1-(HRA) A.3.20 as model maintenance and not an upgrade.

This change is needed to maintain consistency with the internal events baseline model used for Incorporated internal events PRA data into the fire PRA. The use of updated data is fire PRA identified in the PRA Standard 1-A.3.3 as model maintenance and not an upgrade.

to ULNRC-06678 Page 4 of 38 Description of Change Upgrade Assessment This update to the HRA using the existing HRA Remove cognitive human error for a stuck methods is identified in the PRA Standard 1-open steam generator atmospheric steam A.3.20 as model maintenance and not an dump valve upgrade.

This minor update of the fault tree location of Incorporated Hardened Condensate the component is not a change in methods or Storage Tank into the WinNupra AFW scope and is considered model maintenance system model and not an upgrade.

This change involved a substantial number of minor updates to add and remove components, change component ratings, change component locations, change component names, and Update fire ignition frequencies as part of address errors in the component by fire zone a general review and update of plant-wide listing which is the basis for determining components data to ensure consistency component counts and fire ignition frequencies.

with as-built plant There are no new methods or calculations involved. This is considered to be a routine update which is model maintenance and not an upgrade.

This update is considered a routine set of Updated main control room analysis to changes based on a review of the analysis to update panel frequencies and include all correct identified issues; no new methods or fire zones data sources were applied. This is considered a maintenance update and not an upgrade.

The use of a lower screening frequency is a conservative modeling choice and is not a Updated multi-compartment analysis to change in method. Including the quantitative use a lower (more conservative) screening results in the totals upgrades the PRA frequency, and incorporated CDF and LERF supporting requirement FSS-G6 for capability for unscreened scenarios into the final total category I to category II/III. A focus scope peer CDF and LERF review was completed for this change as documented in Reference 14.

This update to the HRA using the existing HRA Updated human error probabilities based methods is identified in the PRA Standard 1-on recent update of document 17671-011 A.3.20 as model maintenance and not an Revision 3 upgrade.

This update to the fault tree linking code is identified in the PRA Standard 1-A.3.11 as Conversion of fire PRA model from model maintenance and not an upgrade. (It is WinNupra to CAFTA using new internal noted that the internal events PRA model event CAFTA model as baseline updated for CAFTA was subsequently peer reviewed as described in this document.)

to ULNRC-06678 Page 5 of 38 Description of Change Upgrade Assessment The use of the internal events HRA as a baseline for developing the fire HRA is required to maintain consistency with the internal events baseline model. (It is noted that the internal events HRA was subsequently peer reviewed as described in this document.) The update is judged not to have a significant impact on risk Update fire HRA using updated internal insights. This update to the HRA using the events HRA as a baseline and applying a existing HRA methods is identified in the PRA new dependency analysis also based on Standard 1-A.3.20 as model maintenance and the internal events dependency not an upgrade. While the assessment of assessment dependencies among multiple human failure events is now automated using the EPRI© HRA Calculator and is more extensive in scope than the previous model, there are no new assumptions or methods applied to assess these dependencies. This change is considered model maintenance and not an upgrade.

This update to use more recent data is Update suppression/detection unavailability identified in the PRA Standard 1-A.3.2 as model using recent plant data and a minimum maintenance and not an upgrade. The Bayesian probability of 0.01 (conservative) update method had been previously applied to generate probabilities.

Including a new scenario using existing methods is considered model maintenance and not an upgrade. Scenarios which were Updated quantified scenarios to include a previously screened and are now quantified is a newly identified scenario, to quantify conservative modeling decision; no new scenarios previously screened due to methods are applied only updated screening limited impacts to the fire PRA, and to criteria. While some of the previously screened include multi-compartment scenarios scenarios in the new model are significant, it is previously screened based on CDF or judged to not represent a significant impact to LERF.

the overall model results. This change is considered model maintenance and not an upgrade.

Updated spurious failure probabilities and Updates to the analysis using updated failure hot short clearing probabilities used in probabilities used existing methodology. This model to be consistent with NUREG/CR- does not constitute an upgrade per the PRA 7150 Standard 1-A.2.c.

As part of the normal Fire PRA process, the Fire model logic should be updated to align with the Updated Fire model for revised Internal latest Internal Events modeling. No IE Events modeling. modeling updates constituted a significant change that would impact the Fire results significantly (e.g., no new accident sequences).

Incorporation of plant modifications used the Incorporated plant modifications impacting existing approaches in the Fire PRA and were plant partitioning and ignition frequency documented in the natural process of model documentation.

updates.

to ULNRC-06678 Page 6 of 38 Description of Change Upgrade Assessment This is a frequency update to the latest industry Revised Bin 4 frequency value to use the accepted frequency value for Bin 4. There is no updated industry guidance in NUREG-2178 change in methods to the ignition frequency Volume 2.

calculations.

The additional cognitive for the Loss of Control abandonment was developed using industry accepted guidance (NUREG-1921 Supplement 2) and included in the CAFTA fault tree to be quantified along with the existing Main Control Room scenarios. NUREG-1921 Supplement 2 states that it "provides guidance for quantifying Revised the Main Control Room the probabilities of human failure events (HFEs)

Abandonment analysis to include a for fire PRA scenarios resulting in MCRA, cognitive HEP to recognize the need to building upon both NUREG-1921 and abandon due to Loss of Control for select Supplement 1. The HRA process for MCRA fire scenarios based on equipment scenarios remains unchanged from NUREG-damage. 1921 but supplemented by additional contextual factors unique to MCRA scenarios." Therefore, as this is an extension of existing guidance used in the Callaway PRA, there are no new methods, no change in scope, and no change in capability of the PRA. In addition, this change was related to closure of an F&O and was peer reviewed as described in section 3.3 of the LAR.

As guidance for the determination of PRA model maintenance update/upgrade, Step 4.1.4.c of Revision 2 of PRA-ZZ-00001, PRA Model Updates and Maintenance, invokes the non-mandatory Appendix 1-A of the ASME/ANS PRA Standard. As stated above, CEC confirms that there are no unreviewed Upgrades contained in the fire PRA model of record, 9.01.

Audit Question: APLA Use of Newly Developed Method from Pressurized-Water Reactor Owners Group PWROG-18027-NP Part a:

• Positive statement that the necessary supporting requirements (SRs),

including the hazard-specific back reference to these SRs, have been peer reviewed.

Part b:

• If cited SRs were not included in the peer review, then perform a focused-scope peer review or justify exclusion (e.g., using a sensitivity study)

Part c:

• How was room cooling screening from full power internal event mode revisited for other hazards (e.g., fire PRA)?

to ULNRC-06678 Page 7 of 38

Response

See response below to revised audit question APLA-02, Use of Newly Developed Method from PWROG-18027-NP.

Audit Question: APLA Overlap of Functions and Components

• Restate audit response on the docket.

Response

As stated during the audit, in cases where a component supports functions in another system the component is mapped to the applicable function from each of the two systems. The highest risk significance of the two (or more) functions is assigned to the component. If the other system(s) has not yet been categorized or if its functions have not been developed the component remains unranked. For example, a heat exchanger may belong to the cooling system but supports the cooled system as well. Until both systems are categorized the heat exchanger remains unranked. Once, both systems are categorized the heat exchanger would be assigned the highest ranking between the system functions.

Audit Question: APLA Key Assumptions and Sources of Uncertainties Identification Process Part a:

• Provide description of the updated uncertainty analysis performed for the application.

Part b:

• Provide an explicit statement that generic industry sources of uncertainty in Electric Power Research Institute (EPRI) report 1026511 were reviewed for seismic, fire and high winds hazards.

Part c:

• Provide summary bullet list of the half dozen or so criteria used to justify why each uncertainty issue was determined not to be key as described verbally during the audit.

Part d:

• No questions based on the response

Response

The updated uncertainty analysis that was performed for the 50.69 LAR is described in Appendix 6 to the uncertainty notebook (PRA-IE-UNCERT_APP6).

to ULNRC-06678 Page 8 of 38 All PRA notebooks for each hazard (i.e., Internal Events, Internal Flooding, Internal Fire, Seismic, and High Winds) were reviewed to determine and document any assumptions or key sources of uncertainty. The review also identified the part of the model that would be affected, the generic impact on risk applications, the risk impact on the 50.69 categorizations process, and whether the item would be considered key to 50.69. NUREG-1855, EPRI TR-1016737, and EPRI 1026511 were cited for the detailed process of identifying, characterizing, and qualitatively screening model uncertainties. In general, if the PRA model used a non-conservative treatment or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on the 50.69 implementation LAR application.

As defined in the ASME/ANS standard and consistent with EPRI TR-1016737 and EPRI 1026511, a key assumption or key source of model uncertainty is identified in the context of the application as significant enough that it changes the degree to which the risk acceptance criteria are met. As documented in PRA-IE-UNCERT_APP6, some justifications for issues being determined not to be key included:

• The LOOP frequency values used are realistic and based on the most recent industry data.

• The Callaway Energy Center seal LOCA model is based upon a consensus model.

• The uncertainty or assumption will have no impact on the PRA results and therefore no impact on the decision of HSS or LSS for any SSC.

• The NEI 00-04 required sensitivity to assess HFEs at the 5th and 95th percentile values captures the impact on the 50.69 application.

• The approach is the current industry method for the development of FRPAs.

• The sensitivity study performed on the base model shows that there is no impact on the PRA results and therefore no impact on the decisions for HSS or LSS for any SSCs.

• Use of the TORMIS code is a standard practice in HWPRA and therefore represents a consensus model.

Audit Question: APLA/APLC PRA Model Uncertainty Dispositions Part a:

• Identify the studies that form the basis of the electrical grid fragility in the high winds analysis.

• Summarize the results of the sensitivity studies on the impact of component fragility on component categorization. Elaborate on what "pessimistic" estimate means.

to ULNRC-06678 Page 9 of 38 Part b:

• Positive statement on docket that the Nuclear Energy Institute (NEI) 00-04 sensitivity studies for human failure events (HFEs) will include adjustment to the four seismic human reliability analysis (HRA) bins.

Part c:

• Describe PRA update 9 results and margin to Regulatory Guide 1.174 guidelines.

Part d:

• Statement that truncation convergence criteria met in PRA update 9

• Basis for seismic core damage frequency (CDF) and SLERF decrease from PRA update 8 to PRA update 9.

Response

As identified in Section 4.2 of the PRA-HW-PLANT_RESPONSE notebook, the electrical grid fragilities are generally consistent with values assumed in other studies, notably:

• Mironenko, A. and Lovelace, N. "High Wind PRA Development and Lessons Learned from Implementation," PSA 2015 Paper 12074, April 27, 2015

• Twisdale, L., Vickery, P., Sciaudone, J., Banik, S., and Mizzen, D. "Advances in Wind Hazard and Fragility Methodologies for HW PRAs" PSA 2015 Paper, April 2015

• And as further described in Nuclear Energy Institute (2017). "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," NEI Technical Report 17-02 Rev 1, Washington, D.C.

As documented in Table 3 of PRA-IE-UNCERT_APP4, "High Wind Uncertainty Analysis and Sensitivities," the sensitivity studies on the impact of component fragility suggest that component categorization would not be significantly affected. While CDF is sensitive to the assumptions about the fragility of the electrical grid, the identification of risk-significant in-plant components is generally not sensitive. Increasing the grid fragility (e.g., to a "pessimistic" estimate or to a simplified assumption of definite LOOP at all wind speeds) results in a larger increase in CDF because the most frequent F1 winds are then modeled as requiring LOOP mitigation. In contrast, a more optimistic grid fragility does not result in as large of a decrease in CDF because the more severe winds (F2 and higher) will still result in a LOOP. As a result, the most risk significant plant components in all cases are those associated with mitigating to ULNRC-06678 Page 10 of 38 LOOPs (e.g., the emergency diesel generators) and station blackout events (e.g.,

the turbine driven auxiliary feedwater pump). A more pessimistic fragility of the offsite electrical grid will tend to increase the importance of those components, which are already significant in the baseline results. There are no component failure basic events that are significant (RAW > 2, FV > 0.005) in the baseline results but that are not significant in the "pessimistic" sensitivity case results.

Consistent with NEI 00-04, sensitivity studies to address HRA uncertainty for seismic HFEs and HFE combinations will include adjustment to the four seismic HRA bins.

With PRA model update 9.01, the margin to the RG 1.174 acceptance guidelines has increased for CDF and decreased for LERF, driven primarily by seismic results, and the margins remain adequate to support the 50.69 categorization.

The best estimate mean point estimate values, calculated using ACUBE, are presented in the table in Attachment 2. The point estimate values below are generated using the UNCERT utility with varying levels of ACUBE processing.

The mean values below are generated using the Monte Carlo sampling process used by UNCERT, again with varying levels of ACUBE processing, representing a sampled mean which addresses the State of Knowledge Correlation. Due to the inability to fully post-process with ACUBE, these mean value estimates are conservative.

PRA Model Update 9.01 Parametric Uncertainty Analysis Results CDF (/yr)1 LERF (/yr)1 HAZARD Point Estimate Mean Point Estimate Mean PRA-IE-UNCERT 4.47E-06 4.52E-06 6.23E-08 6.44E-08 PRA-IE-UNCERT_APP1, "Internal Flooding 6.50E-06 6.54E-06 1.51E-08 1.53E-08 Uncertainty Analysis and Sensitivities" PRA-IE-UNCERT_APP2, "Fire Uncertainty 1.21E-05 1.21E-05 5.55E-08 5.75E-08 Analysis and Sensitivities" PRA-IE-UNCERT_APP3, "Seismic Uncertainty 4.01E-05 5.34E-05 4.43E-06 5.93E-06 Analysis and Sensitivities" PRA-IE-UNCERT_APP4, "High Wind Uncertainty 5.97E-06 6.68E-06 2.55E-07 5.29E-07 Analysis and Sensitivities" to ULNRC-06678 Page 11 of 38 Aggregate Risk2 6.91E-05 8.32E-05 4.82E-06 6.60E-06 Note 1: These values may vary slightly, depending on the selection of cutsets for ACUBE.

Note 2: Including uncertainties and State of Knowledge Correlation.

For PRA model update 9.01, appropriate truncation limits were established by truncation studies for each hazard to demonstrate overall model convergence.

PRA Model Update 9.01 Truncation Study Results CDF LERF HAZARD Truncation Limit %Change Truncation Limit %Change PRA-IE-QUANT 5E-13 3.19 1E-14 3.61 PRA-FLOOD-QUANT 1E-12 3.2 1E-15 3.4 PRA-FIRE-QUANT 1E-13 2.39 1E-15 3.87 PRA-SEISMIC-QUANT 1E-11 2.4 1E-12 1.1 PRA-HW-QUANT 5E-12 ~6 5E-12 2 Although the truncation study for HW CDF did not achieve the "<5% change in CDF for a one-decade reduction in truncation" that is given in QU-B3 of ASME/ANS RA-Sa-2009 as an example of sufficient convergence, the selection of 5E-12 as the appropriate truncation limit for HW CDF was made after observing model convergence at the lower truncation levels and after a comparison of HW cutsets to IE cutsets to ensure that significant sequences were not inadvertently eliminated.

It should also be noted that, in providing an example of sufficient convergence, QU-B3 does not, by contrapositive, establish criteria for insufficient convergence, and ASME/ANS RA-Sa-2009 does not cite QU-B3 as a back reference for Part 7 (HW), unlike for Part 4 (Fire).

As documented in the PRA-SEISMIC-QUANT notebook, seismic CDF CLERP in PRA model 9.01 is slightly higher (about 36%, due primarily to the application of a lower truncation level) than in PRA model update 8, and the overall SLERF contributors are similar between PRA model update 8 and PRA model update 9.01.

As documented in the PRA-SEISMIC-QUANT notebook, seismic CDF decreased slightly (about 28%) in PRA model update 9.01 compared to PRA model update 8, primarily attributed to corrections to the SPRA model. Seismic LERF increased slightly (about 36%) in PRA model update 9.01 compared to PRA model update 8, primarily attributed to the application of a lower truncation level.

to ULNRC-06678 Page 12 of 38 Audit Question: APLA Total Risk Consideration Part a:

• Provide a summary of the parametric uncertainty analysis performed for each hazard that addresses the state of knowledge correlation (SOKC) and identify the hazard-specific parameters that were correlated.

Part b:

• Provide a quantitative assessment of the level of impact that using point estimate means has on the application.

Response

For PRA model update 9.01, the SOKC was addressed by the performance of a parametric uncertainty analysis for each hazard using the EPRI UNCERT code, with a typical sample size in the tens of thousands. The SOKC becomes a concern for parameters that are represented by multiple basic events, with probabilities from the same data set, occurring in the same cutset and was addressed by linking such basic events to the same type code in the CAFTA database. The analyses compared the resulting mean value of the risk metric, as determined by UNCERT, to the corresponding point estimate to conclude that the point estimate was an acceptable representation of the mean value.

From the aggregate risk values provided in the response to Audit Question APLA/APLC-05, the point estimate for CDF is about 19% lower than the mean value for CDF, and the point estimate for LERF about 27% lower than the mean value for LERF. Therefore, the use of the point estimates as representative of the mean values has little or no impact on the 50.69 application.

Audit Question: APLA/APLC PRA Credit for Diverse and Flexible Coping (FLEX) Strategies

• Describe how FLEX was treated in PRA update 9, as opposed to update 8 (i.e., FLEX is set to true in PRA update 9 for all hazards).

Response

The two FLEX strategies (i.e., FLEX SG Makeup AFW Pump and 480Vac Portable Backup Generators), which involve portable equipment and which had been included only in the seismic PRA model update 8, were not credited for any hazard in PRA model update 9.01. The associated basic events were retained in the seismic fault tree for the possible performance of sensitivities but set to TRUE (i.e., failed), as documented in the PRA-SEISMIC-QUANT notebook.

to ULNRC-06678 Page 13 of 38 The FLEX strategy (i.e., HCST Credit), which involves permanently installed equipment and which was credited for the IE PRA model update 8 (and therefore used in all other hazards), was retained in PRA model update 9.01.

Audit Question: APLB Focused-Scope Peer Review of Fire PRA HRA for Main Control Room (MCR) Abandonment

• Positive statement regarding F&O closure in Feb 2021, that there are no longer any outstanding commitments or implementation items.

• Reference to May 3rd Appendix X memo.

Response

In fulfillment of Commitment 50437 in Enclosure 4 (ML20304A456) to ULNRC-06550 and related to closure of NFPA 805 LAR Table S-3 Implementation Item 13-805-001, a focused scope peer review was conducted in November 2020, as documented in AMN#PES00031-REPT-003, for the resolution of Fire PRA Suggestion F&O FSS-B1-03, which a July 2019 F&O closure review had determined to be an upgrade, as documented in AMN#PES00021-REPT-001. As documented in AMN#PES00042-REPT-002, the F&Os from this focus scope peer review were closed during an F&O closure review in February 2021. As a result, COMN 50437 is closed and there is no outstanding commitment related to this LAR. The F&O closures were performed in alignment with Appendix X of NEI 05-04/07-12/12-13 and accepted for use by the May 3rd memo (ML17079A427).

As discussed in Section 3.2.2 of the LAR, there are no outstanding NFPA 805 Implementation Items.

Section 3.3 of the LAR was updated to address fulfillment of Commitment 50437, and reconciling changes were made to Section 3.2.8 of the LAR and to Attachment 6 to Enclosure 1 of the revised LAR letter. The revised LAR letter contains no commitment as Enclosure 4.

Audit Question: APLB Fire PRA Methods

• Include listing of the guidance documents (NUREGs and frequently asked questions (FAQs)) that were used to update the fire PRA since the full-scope peer review - that were identified in the audit.

• Include positive statement that licensee does not credit incipient detection.

• Include positive statement regarding implementation of FAQ 13-0004 for sensitive equipment in fire PRA that includes a discussion of the caveats.

Response

to ULNRC-06678 Page 14 of 38 The guidance documents on fire PRA methods that were incorporated in the FPRA since the full-scope peer review in 2009 are:

• EPRI 1025284 (data that supported NUREG-2169),

• FAQ 12-0064 (hot work/transient influence factors),

• FAQ 14-0009 (MCC modeling),

• FAQ 17-0013 (HEAF suppression rate),

• ML12171A583 (Giitter memo on reduced transient HRRs),

• NUREG-1824 Supplement 1 (supporting the detailed fire modeling V&V),

• NUREG-1921 (fire HRA)

• NUREG-1921 Supplement 2 (cognitive MCR abandonment HFE development),

• NUREG-2169 (revised frequencies, suppression rates, and bin 21 split fraction),

• NUREG-2178 Volume 1 (revised electrical enclosure HRRs),

• NUREG-2178 Volume 2 (bin 4 frequency update).

• NUREG/CR-7100 (dc electrical shorting),

• NUREG/CR-7150 Volume 1 (self-healing of hot shorts), and

• NUREG/CR-7150 Volume 2 (CFMLA probabilities).

As of PRA model update 9.01, incipient detection is not installed in the Plant and thus not credited in the fire PRA.

Without explicitly citing FAQ 13-0004 for the treatment of sensitive electronics, the fire PRA does implement the salient conclusion that a generic screening heat flux damage threshold for thermoset cables, as observed on the outer surface of the cabinet, can be used as a conservative surrogate for assessing the potential for thermal damage to solid-state and sensitive electronics within an electrical panel (cabinet). As described in Section 3.4.1.1 of the PRA-FIRE-17671_010A notebook, Quantification of Individual Fire Areas, the impact on sensitive electronics due to fire is analyzed using the methodology provided in Appendix D of EPM Report R1984-001-002, "Verification and Validation of Fire Modeling Tools and Approaches for Use in NFPA 805 and Fire PRA Applications," and the damage criteria for sensitive electronics from Appendix H of NUREG/CR-6850.

Also, if sensitive electronics are in the fire compartment and not failed by the Zone of Influence (ZOI), they are assessed for failure based on the room temperature, or lower heat flux threshold. If the temperatures or heat flux reach the threshold for sensitive electronic failure, then they are included as fire failures for the appropriate scenarios.

Audit Question: APLC Integrated PRA Hazards Model

• Provide description presented during audit showing that integration of PRA importance factors will be in alignment with NEI 00-04 guidance.

to ULNRC-06678 Page 15 of 38

Response

For the seismic model, importance measures are integrated by appending the cutsets of the discretized bins (%G01 to %G10) into a single cutset. "The importance and relevance of individual fragilities was assessed with sensitivities that change one fragility at a time, increasing the capacity, and assess the effect on the overall results; using the base model generated cutset file results" (PRA-SPRA-002 R0 3.1.2.2). Separate top gates were evaluated for CDF and LERF in the model to generate SCDF and SLERF specific results.

The appended cutsets for SCDF and SLERF are evaluated for their F-V and RAW contribution based on the NEI 00-04 thresholds. Where a component is determined to be HSS based on SCDF or SLERF alone an integrated assessment is performed based on the formulas in NEI 00-04 Section 5.6 (Integral Assessment), to evaluate the IFV and IRAW impact on the PRA. The IFV and IRAW results are used to determine the PRA ranking.

Where individual basic event importance measures indicate HSS for a component, the integrated assessment allows the Integrated Decision-making Panel (IDP) to determine whether the safety significance of the SSC should be based on the significance for that individual hazard or from the overall integrated result, avoiding a strict reliance on a mathematical formula that ignores any significant dissimilarities in the calculated risk results from different hazards. An integrated assessment need not be performed for components ranked HSS based on the internal event PRA. Components that are HSS based on the internal events PRA are ranked HSS in the categorization. An integrated assessment need not be performed for components ranked LSS by all PRA assessments, because the integrated importance cannot be higher than the maximum of the individual measures. Thus, integrated assessments should focus on components driven to HSS by any modeled hazard other than internal events that would be candidates for consideration as LSS due to the relative weighting of the results based on each hazards contribution to the total CDF or LERF. To calculate the integrated importance, the equations included in NEI 00-04 section 5.6 are used.

Per NEI 00-04 the integrated Fussell-Vesely and Risk Achievement Worth importances are compared against the screening criteria of F-V > 0.005, RAW >

2.0 for individual basic events, and RAW > 20 for common cause events. For each component modeled in the PRA, all of the basic events related to the component are considered for all PRA models (i.e., Internal Events, Internal Flood, Fire, Seismic, and High Winds). For calculating the PRA ranking for each PRA model, the following criteria are used: PRA Ranking HSS - Sum of FV for all basic events modeling the SSC of interest, including common cause events >

0.005; HSS - Maximum of component basic event RAW values > 2; HSS -

to ULNRC-06678 Page 16 of 38 Maximum of applicable common cause basic events RAW values > 20; LSS -

Modeled SSCs that do not meet any of the HSS criteria.

The method used to generate the integrated importance measures does not deviate from NEI 00-04 and uses the method described in Section 5.6.

All failure basic events are mapped to the affected component.

Random and hazard induced failures of components are mapped to the appropriate component through evaluation of the PRA basic events. All basic events associated with a component are included in the overall component importance. Once the importances have been assigned then the largest RAW and the sum of the F-Vs are used for the integrated assessment per the NEI 00-04 guidance.

Audit Question: APLC Overall Use of NEI 00-04 Figure 5-6 and Use for External Floods

• LAR not consistent with licensee response regarding use of NEI 00-04, Figure 5-6. Provide positive statement that NEI 00-04, Figure 5-6 will be applied at the time of categorizing an SSC.

Response

Consistent with the LAR, section 3.2.5, the process for evaluating SSCs for other external hazards (i.e., non-PRA modeled hazards) will provide guidance to apply Figure 5-6 of NEI 00-04 at the time of categorizing an SSC.

Audit Question: APLC Seismic PRA Modeling

• Extension of discussion from APLA/APLC-05. Describe truncation convergence in PRA update 9.

• Explain how there are two separate quantifications for CDF and LERF and, thus, the seismic hazard intervals for CDF and LERF can be defined differently.

Response

The truncation analysis for Update 9.01 applies the example described in supporting requirement QU-B3 of ASME/ANS RA-Sb-2013 (PRA Standard). The truncation level was successively lowered by decade until the change in the metric (CDF or LERF) was found to be less than 5%. The individual quantifications were performed for each hazard range interval and then aggregated to derive the seismic CDF and LERF. The truncation test was conducted on the aggregate of the hazard range interval results. When a hazard to ULNRC-06678 Page 17 of 38 range interval quantification indicated a CCDP of 1.0 (when excluding the plant availability factor), the truncation analysis was stopped for that hazard range interval because lower truncations would not change CCDP. This process was conducted for both the CDF and LERF models with the convergence criterion being achieved for both metrics.

The CDF and LERF hazard segment ranges (segments) are selected to account for the steep slope for lower accelerations and to promote quantification at higher accelerations where the plant level fragility approaches 1.0 (0.9 including plant availability factor). For CEC, these points occur at 0.7g for CDF and 1.17g for LERF (PRA-SEISMIC-QUANT, Table 4-1).

The seismic model calculates the seismic induced component failure probability for each segment by applying a representative acceleration for the segment to the component fragility curve. The representative acceleration value for each hazard segment range is calculated for CDF and for LERF such that the representative acceleration value matches the metric (CDF, LERF) being quantified. This is done by replacing a probability with an equation in the CAFTA database and storing the fragility curve information (median, uncertainty) and the acceleration as data in the CAFTA database. A seismic hazard frequency is generated to match each CDF and each LERF segment. The combination of seismic hazard frequency and representative acceleration provides the unique information to quantify the two metrics (CDF and LERF) using the same SPRA model.

Audit Question: APLC Seismic Site-Specific Inputs

• Provide updated list of dominant fragilities in seismic PRA and justify not using more refined fragility analyses.

• Explain what is meant by a generic and conservative estimate with respect to site specific analysis.

Response

As listed in the PRA-SEISMIC-QUANT notebook (i.e., Table 4-19 for CDF and Table 4-22 for LERF), the dominant fragilities are:

CDF Event Fragility Description Rank SEISMIC FRAGILITY FOR %G07: Seismic induced loss of offsite 1 SF-IE-T1C%G07 power to ULNRC-06678 Page 18 of 38 SEISMIC FRAGILITY FOR %G06: Seismic induced loss of offsite 2 SF-IE-T1C%G06 power SEISMIC FRAGILITY FOR %G08: Seismic Induced failure of 3 SF-IE-SWC%G08 service water (NSCI)

SEISMIC FRAGILITY FOR %G06: Seismic Induced failure of 4 SF-IE-SWC%G06 service water (NSCI)

SEISMIC FRAGILITY FOR %G07: Seismic Induced failure of 5 SF-IE-SWC%G07 service water (NSCI)

LERF Event Fragility Description Rank SEISMIC FRAGILITY FOR %G05: Seismic Induced Failure of the 1 SF-NSSGC%G05 Steam Generator Supports 2 SF-SOILC%G06 SEISMIC FRAGILITY FOR %G06: Seismic Induced Soil Failure SEISMIC FRAGILITY FOR %G06: Seismic Induced Failure of the 3 SF-NSSGC%G06 Steam Generator Supports 4 SF-SOILC%G05 SEISMIC FRAGILITY FOR %G05: Seismic Induced Soil Failure 5 SF-SOILC%G07 SEISMIC FRAGILITY FOR %G07: Seismic Induced Soil Failure For these contributions, PRA model update 9.01 utilizes fragility estimates representing expected performance based on current industry experience matched to CEC design as described in EPRI 3002002933. The offsite power capacity is based on a reasonable expectation for site capacity and represents a limitation (insulators) that is mainly location independent. The failure location is at ground level such that site structural response would not be a factor.

The service water system is non-seismic class I system and is provided a capacity that is reflective of non-category I components performance. Plant walkdown estimation leads to median capacity of 0.24g which is comparable to that for offsite power. Since a loss of offsite power would preclude service water operation, the current fragility is deemed reasonable.

LERF is controlled by higher acceleration ranges involving structural failures such as soil-structure interaction, steam generator support failure, and reactor building penetration failures. LERF is controlled by the global structural impacts that are based on more detailed assessment would not be expected to provide significant revision to the current assessment.

Given the controlling fragilities for the SPRA analysis, the current fragility estimations are reasonable and are reasonable expectations of performance.

to ULNRC-06678 Page 19 of 38 Table 5.3 in Attachment 1 to ULNRC-06591 (ML20192A244) lists the development method for the four highest Fussell-Vesely fragility contributions as being generic and conservative estimate. One fragility is associated with the seismic-induced loss of offsite power (LOSP) and the other three deal with seismic-induced failure of non-seismic class 1 components.

As listed in the PRA-SEISMIC-QUANT notebook (i.e., Table 4-19 for CDF and Table 4-22 for LERF), the current SPRA indicates that the seismic-induced LOSP and the seismic-induced loss of normal service water (SW) remain significant based on Fussell-Vesely importance.

After a more detailed review of the fragility development, the development method for these components is deemed to be a plant-specific representation using the following basis.

PRA-SEISMIC-FRAGILITY APP22, "Seismic Analysis of Miscellaneous Items,"

Stevenson and Associates, Revision 0, indicates that the seismic-induced LOSP is taken from EPRI, Advanced Light Water Reactor Utility Requirements Document, Volume III, Chapter 1, Appendix A: PRA Key Assumptions and Groundrules, Revision 7, December 1995.

The value contained in the EPRI document is taken from an estimate for component fragility documented in Generic Component Fragilities for the GE Advanced BWR Seismic Analysis (Task 11.4), Advanced Reactor Severe Accident Program, International Technology Corporation, September 1988. The value for seismic-induced LOSP contained in the ITC document is based on historical data from conventional power plants subjected to earthquakes and available estimates from other seismic PRAs. The data review identified that the primary mode of failure was cracking of the ceramic insulators due to the non-seismic design of the transformer.

A review of the CEC design indicates that the predominant failure mode is applicable to the installed transformers and that the installation (ground level) is also consistent with the findings of the report such that no adjustment for amplification is needed. Therefore, the value selected is believed to be a realistic estimation of performance for CEC and the prior description no longer applies.

The loss of normal service water is based on the analysis defined in PRA-SEISMIC-FRAGILITY APP22, Seismic Analysis of Miscellaneous Equipment, for generic non-nuclear safety items. The estimation of the representative high confidence low probability of failure (HCLPF) value for these components is based on a walkdown of the installed plant equipment and an estimation of performance by a subject matter expert. Therefore, this value is also considered a plant-specific estimation of performance.

to ULNRC-06678 Page 20 of 38 Audit Question: APLC Seismic PRA Model Uncertainties

• Explain drivers for the difference in the mean and base SLERF values if the difference remains high (a factor of 3) for update 9.

Response

As documented in the PRA-SEISMIC-QUANT notebook at approximately 30%, the calculated difference between the mean and base SLERF values for PRA model update 9.01 is no longer high (a factor of 3), as was the case for PRA model update 9. The Seismic LERF mean and base values are also presented in response to question APLA/APLC-05.

Audit Question: APLC High Winds and Their Generated Missiles Hazards Development

• Summarize the PRA notebook references in the audit response such that it can be referenced in the safety evaluation (brief summary of method and data used).

Response

As described in the PRA-HW-TORNADO_HAZ notebook, the tornado hazard analysis developed two families of tornado hazard curves for use in the CEC HW PRA. The families represent tornado risk for a 200 ft by 200 ft building (for use with wind pressure fragilities) and the overall plant safety envelope (for use with tornado missile fragilities). The families of curves developed are shown in Figure 1.

to ULNRC-06678 Page 21 of 38 CEC Tornado Hazard for Wind (200x200) (Aleatory + Epistemic) CEC Tornado Hazard for Missiles (Plant Env.) (Aleatory + Epistemic) 1.E-03 1.E-02 1.E-04 5th 1.E-03 5th 25th 25th 50th 50th Mean Mean 1.E-05 75th 1.E-04 75th Exceedance Probability (per year)

Exceedance Frequency (per yr) 95th 95th 1.E-06 1.E-05 1.E-07 1.E-06 1.E-08 1.E-07 1.E-09 0 50 100 150 200 250 300 350 1.E-08 0 50 100 150 200 250 300 350 Peak Gust Windspeed (mph)

Peak Gust Windspeed (mph)

(a) 200 x 200 (b) Plant Risk Figure 1. CEC Families of Tornado Hazard Curves Data Sources. The NWS Storm Prediction Center (SPC) tornado data set (1950

- 2016, inclusive) provided the tornado data used in this analysis. SPC maintains and updates this database, which includes the key statistics for tornado occurrence in the US. Some of the key data in this file include tornado intensity, latitude and longitude of starting and ending points of tornado path centerline, path length, path width, and date of occurrence. Applied Research Associates (ARA) downloaded the data directly from the SPC website.

The latitude and longitude location of the plant was obtained from the Callaway FSAR. The location of the plant was used simply as a reference point in the analysis of tornadoes that have occurred in the vicinity of the plant, extending out hundreds of miles in all directions from the plant envelope.

M ethodology Sum m ary. The methodology includes identification of a homogeneous sub-region around CEC. A statistical method was used to examine a 15 degree by 15 degree grid centered on the plant. Tornadoes were mapped onto the grid and analyzed for point risk and detrended occurrence rate using the EML CLUSTER procedure in SAS. One degree and three degree clustering sets were produced to aid in the development of the final sub-region for CEC to ULNRC-06678 Page 22 of 38 tornado analysis. This method satisfies the USNRC requirement that "Data on tornado characteristics shall be employed for both broad regions and small areas around the site. A basic subregion data set for CEC was identified and analyzed.

The subregion data was analyzed to produce the tornado input files needed in TORRISK and TORMIS. Tornado hazard curves are developed using a TORMIS-derived code called TORRISK. TORRISK is a specialized version of TORMIS that produces tornado hazard curves distinct from the missile risk analysis features of TORMIS. The TORRISK hazard curves provide control points to ensure that the TORMIS simulations track the site-specific hazard curve and is conservative for the missile risk assessment.

The three steps used in this calculation include:

Step 1. Analyze the NOAA SPC data set to identify a CEC subregion.

Step 2. Develop tornado hazard data.

Step 3. Develop tornado hazard curves and propagate uncertainties.

The CEC calculation method includes several recent improvements the ARA method for developing tornado subregions. This includes refinements such as:

partial tornado allocation to cells, automatic cell size grid development, transformation of metrics consistent with the statistical analysis procedure, and use of an "elbow plot" to help determine the optimal number of clusters in a tornado region. Note that these improvements have also been implemented in a National Institute of Standards and Technology (NIST) funded research project (ARA, 2015), which will lead to U.S. tornado risk maps in the ASCE 7-22 standard.

As described in the PRA-HW-SL_WIND_HAZ notebook, straight winds include thunderstorm and extratropical storm winds. Note that hurricane winds are not included due to CECs location several hundred miles from the US hurricane coast. The final hazard curve was developed by combining wind hazard curves developed for five airport stations, weighted by the inverse distance from CEC.

The final family of straight wind hazard curves, corrected for height and terrain, is given in Figure 2.

to ULNRC-06678 Page 23 of 38 Callaway Plant - Straight Winds

. =

1.0E+OO

.'. ' ~

Nominal

~

f- - -Mean -

1.0E-01

\\ \ ******Median

~

.. - 5th and 95th 1.0E-02

\

f'

~T

~

- 4 1i f- 1-

~ 1.0E-03 E

Q. . ..:

2lC \ -\~

GI GI 1.0E-04 -

u \ \

X w

-;;; 1.0E-05

\ \ \

C C

\

<t \

\ \ 1 1.0E-06 1.0E-07

• - -- M .

.\

.\ ~

,._\

1.0E-08 0 50 100 150 200 250 300 Peak Gust Wind Speed at 10 m in Open Terrain (mph}

Figure 2. Final CEC Straight Wind Hazard Curves Data Sources. Peak gust wind speed and weather data were obtained from National Climatic Data Center (NCDC) through their online data request tools.

The data request is made at https://www.ncdc.noaa.gov/cdo-web/#t=secondTabLink. The data set is denoted Daily GHCND (Global Historical Climatology Network, Daily) and contains the daily maximum wind speed as well as information on all weather types that occurred during the day. Table 1 lists the airport stations for which analyses were completed along with the period of record and distance from CEC. Figure 3 shows the locations of the anemometer stations with respect to the plant location.

to ULNRC-06678 Page 24 of 38 Table 1. Airport Period of Record for Peak Gust Wind Speed Data Distance to Airport Location Airport Code Length of Record, n (years)

Site (miles)

Columbia Regional Airport KCOU 47 24 (1970-2012; 2014-2017)

St. Louis Lambert International Airport KSTL 46 76 (1970-2012; 2015-2017)

Springfield-Branson National Airport KSGF 44 137 (1972-2012; 2015-2017)

Kansas City International Airport KMCI 43 163 (1973-2012; 2015-2017)

Abraham Lincoln Capital Airport KSPI 44 135 (1972-2012; 2015-2017)

Figure 3. Map Showing Locations of CEC and Airport Anemometer Sites The selection of these data sources follows the methods discussed in Vickery and Twisdale (2014) and is consistent with the recommendations of EPRI 3002003107 (EPRI 2015) Section 3.4.1.2 that recommends the use of data from multiple weather stations that are representative of the site. While the distance to four of the sites exceeds the suggested 50 km (31 miles) (EPRI Section 3.4.1.1), these sites are within the bounds established by the studies referenced in Section 3.4.1.2 of the EPRI guidance.

Site anemometer data were not used in this analysis for the following reasons:

1. The archived data includes 5 second gust wind speed data, however, there is no thunder indicator in the data to distinguish thunderstorm and extra tropical storm winds.

2. The period of record provided is inadequate to derive reliable estimates of long return period wind speeds.

to ULNRC-06678 Page 25 of 38 M ethodology Sum m ary. The analysis methodology uses a statistical approach that considers both thunderstorm and non-thunderstorm wind gusts.

Thunderstorm and extratropical storms are different meteorological phenomena and research has shown that they generally have distinct distributions (Twisdale and Vickery 1992, 1993) and that the most accurate method to develop extreme wind frequencies is by a separate analysis of each. As such, wind data from the airport stations discussed above were separated into thunderstorm and non-thunderstorm datasets and used to develop separate extreme value distributions by storm type. These separate distributions were then combined as statistically independent processes to arrive at one final wind hazard model for each of the five locations. Figure 4 shows the four steps used in straight wind hazard analysis.

STEP 1: Collect Data Select stations within two hundred fifty kilometers of the site with at least 30 years of data NCDC

i. Download Daily GHCND Summary of the Day files ii. Anemometer type and height history file Aerial Photographs showing anemometer location and terrain STEP 2: Perform Basic Analysis Correct wind records for height and develop Type I Extreme Value distributions separately for all thunderday events and non-thunderstorm threshold exceeding events; Develop stochastic models for both thunderstorm and non-thunderstorm winds.

STEP 3: Account for Uncertainties Apply terrain adjustment and uncertainty distributions to develop final family of hazard curves.

STEP 4: Combine thunderstorm and non-thunderstorm wind hazard curves Figure 4. Extreme Data Analysis Steps The thunderstorm wind speed hazard curves were developed using a stochastic modeling approach in which the maximum gust wind speed recorded on each thunderday (i.e., a day when thunder was heard) was used to develop a distribution of thunderstorm wind gusts given the occurrence of a thunderday.

The annual extremes associated with thunderstorms were developed by combining the conditional distribution of thunderstorm extremes with a Poisson arrival rate model.

The annual extratropical storm wind hazard was developed using the method of independent storms (Cook, 1982). Using this approach, a minimum wind speed to ULNRC-06678 Page 26 of 38 threshold is selected, and all exceedances of the threshold value are retained and used to define an extreme value distribution (e.g., Simiu and Scanlan, 1996). To ensure that the individual peaks are associated with separate storms, the peak values must be separated by at least three days.

As described in the PRA-HW-MISSILE_FRAGILITY notebook, the CEC HW missile fragility analysis was completed following the TORMIS methodology. A total of 14.4 billion TORMIS missile simulations have been performed for tornadoes and straight winds for CEC. Each simulation consists of sampling and flying a missile for a simulated high wind event at the plant. A total of 240 million high wind event strikes on the plant were simulated for tornadoes and straight winds as part of this analysis with 15,000 missiles sampled per high wind event.

Separate fragilities for tornado and straight wind hazards were developed.

Data Sources . The CEC site-specific HW missile inventory was developed for an area extending out 2,500 ft from the identified safety-related targets.

Potential missiles located outside of buildings were inventoried based on the missile source zones shown in Figure 5. Additionally, potential missiles from 70 structures that are likely to fail and break up into component missiles were included as structure origin missiles. The missile survey produced the following number of modeled potential missiles at CEC:

1. Zone Missiles: 55,865

2. Structure Origin Missiles: 134,319

3. Total Missiles: 190,184 to ULNRC-06678 Page 27 of 38 Figure 5. Missile Zone Layout for CEC HW Missile Fragility Analysis Surveyed missiles were categorized based on their aerodynamic characteristics from Twisdale and Dunn (1981), depth dimension, overall length, weight per unit length, and minimum cross-sectional area. For CEC, missiles were grouped into the 23 missile types shown in Table 2. Note that this missile spectrum includes a site-specific metal siding missile (#13) based on the characteristics of the CEC Turbine Building siding, and a small steel sphere (#23) missile that was included to represent the thousands of scaffolding clamps stored around the plant and would be able to fly through the numerous small pipe penetration targets included in the analysis.

to ULNRC-06678 Page 28 of 38 Table 2. Missile Types and Characteristics Used for CEC HW Missile Fragility Analysis TORMIS Basis for Amin Missile Set Weight Minimal Missile TORMIS (Impact Area Used in USNRC Number Length L Depth d Width b per Unit Impact Weight Impact Area Source Data for TORMIS Row MTRANS Missile Description (Typical) Material Penetration Missile MTRANS(I,1) (ft) (in.) (in.) Length Area: (lbs) Geometry Missile Characteristics Number (I,2 ) Calculations to Produce Spectra

& Table 2-2 (lb/ft) Amin (in 2 )

(NP-769) a Hole in a Target)

SRP 3.5.1.4, 1 1 1 Rebar (#8) Steel 3.00 1.00 1.00 2.67 0.79 8 Solid Circle Area Solid Circle Area Nov 1975 "A" Original T ORMIS Research Original T ORMIS Research, 2 1 1 Gas Cylinder Steel 5.00 10.02 10.02 38.64 9.45 193 Solid Circle Area NP-769 Survey, Set 1 length made constant Original T ORMIS Research, 3 1 1 Drum, T ank Steel 5.00 19.98 19.98 23.55 313.53 118 Solid Circle Area NP-769 Survey, Set 1 length made constant SRP 3.5.1.4, Original T ORMIS Research, 4 2 2 Utility Pole Wood 35.00 13.50 13.50 42.85 143.14 1,500 Solid Circle Area Solid Circle Area Nov 1975 "A" updated weight Original T ORMIS Research, 5 2 2 Cable Reel Wood 1.80 42.21 42.21 140.70 126.60 253 Solid Circle Area NP-769 Survey, Set 2 length made constant SRP 3.5.1.4, 6 3 3 3" Pipe (Schedule 40) Steel 10.00 3.50 3.50 7.58 2.20 76 Hollow Pipe Pipe Cross Section Area Nov 1975 "A" Original T ORMIS Research SRP 3.5.1.4, 7 3 3 6" Pipe (Schedule 40) Steel 15.00 6.63 6.63 18.90 5.60 284 Hollow Pipe Pipe Cross Section Area Nov 1975 "A" Original T ORMIS Research SRP 3.5.1.4, 8 3 3 12" Pipe (Schedule 40) Steel 15.00 12.75 12.75 49.60 14.60 744 Hollow Pipe Pipe Cross Section Area Nov 1975 "A" Original T ORMIS Research Original T ORMIS Research, 9 4 5 Storage Bin-T ool box Steel 6.00 38.40 36.00 112.50 40.50 675 Square Area NP-769 Survey, Set 5 length made constant 10 5 8 Concrete Block ( 8" x 8" x 16" CMU) Concrete 1.33 8.00 8.00 27.00 64.00 36 Square Area Solid Square Area Plant Specific Missile SRP 3.5.1.4, Original T ORMIS Research, 11 6 9 Wood Beam (nominal 12" x 4" x 10') Wood 12.00 11.50 3.50 16.67 40.25 200 Rectangular Area Solid Rectangular Area Nov 1975 "A" updated weight Standardized wood plank, 12 7 11 Wood Plank (nominal 12" x 1.25" x 10') Wood 10.00 11.50 1.00 2.71 11.50 27 Rectangular Area Solid Rectangular Area common in construction 13 8 7 Metal Siding Steel 16.00 30.00 2.25 4.81 67.50 77 Rectangular Area Solid Rectangular Area Plant specific siding.

Standardized wood panel, common 14 9 13 Plywood Sheet ( 7/8" x 4' x 8') Wood 8.00 48.00 0.88 10.50 42.00 84 Rectangular Area Solid Rectangular Area in construction Original T ORMIS Research, 15 10 14 Wide Flange (W14 x 26) Steel 15.00 13.91 5.03 26.00 7.69 390 WF Area Section Area, ~NP-769 Set 14 updated to a specific section Original T ORMIS Research, 16 11 16 Channel Section (C6 x13) Steel 15.00 6.00 2.16 13.00 3.83 195 Channel Area Section Area, ~NP-769 Set 16 updated to a specific section Small Eqpt. (e.g. small motor, portable Original T ORMIS Research, 17 4 5 generator)

Steel 3.00 30.00 30.00 129.20 4.63 388 Rectangular Area NP-769 Survey, Set 18 updated to specific equipment Large Eqpt. (e.g. shop equip., towable Original T ORMIS Research, 18 4 5 concrete mixer)

Steel 6.00 48.00 36.00 225.00 15.70 1,350 Rectangular Area NP-769 Survey, Set 19 updated to specific equipment Original T ORMIS Research, 19 12 22 Steel Frame, Grating (1" x 2' x 3' grating) Steel 6.00 24.00 1.00 12.34 2.22 74 Rectangular Area ~NP-769 Survey, Set 22 updated to a specific grating Large Steel Frame (Warehouse Pallet Original T ORMIS Research, 20 12 22 Rack)

Steel 16.00 120.00 48.00 65.00 11.00 1,040 Rectangular Area ~NP-769 Survey, Set 22 updated to a specific frame SRP 3.5.1.4, Original T ORMIS Research, 21 13 25 Vehicle Steel 16.00 66.00 66.00 250.00 2880.00 4,000 Rectangular Area Solid Rect. Area, SRP 3.5.1.4 Nov 1975 "A" updated weight T ree Missile (Small T ree and/or Branch Original T ORMIS Research, 22 14 26 of Large T ree)

Wood 20.00 8.00 8.00 35.00 50.27 700 Solid Circle Area Solid Circle Area updated size and weight 23 5 4 Steel Sphere Steel 0.33 1.50 1.50 8.25 2.25 3 Rectangular Area Solid Rectangular Area Plant Specific Missile to ULNRC-06678 Page 29 of 38 Additionally, the HW missile survey also differentiated based on their initial restraint conditions by missile type. Restrained missiles are any missiles that have other missiles stacked on top of them or bound together that require some sort of restraint to be overcome before they can be released to the wind field.

Unrestrained missiles are available to fly without overcoming any initial restraint forces. Consideration of initial missile restraint reduces conservatism and uncertainties in the HW missile fragility analysis.

Fragility M ethodology Sum m ary . The summary for the methodology used for CEC HW missile fragility analysis is as follows:

1. The analysis is performed using the TORMIS code and modeling method (Twisdale et al., 1978a, 1978b and Twisdale and Dunn, 1981).

2. The method employed satisfies the requirements and conditions stated in the NRC SER (USNRC, 1983, Accession# ML8311090436), and addresses the concerns expressed in NRC RIS 2008-14 (USNRC, 2008).

3. Missiles are as defined by the TORMIS methodology. Missile populations are based on the results of the site survey performed by ARA between 8/6/2018 and 8/10/2018.

4. The plant layout is modeled as described in the plant base design configuration drawings or otherwise confirmed by plant walkdowns conducted in August 2018 and February 2019.

TORMIS uses a Monte Carlo simulation method that simulates windstorm strikes on a plant. For each simulated event, a wind field is simulated, missiles are injected and flown, and missile impacts are tracked and analyzed. Frequency of missile hit and damage are computed over repeated simulations for individual SSCs and groups of SSCs. As such, TORMIS evaluates missile hit and conditional probability of damage simultaneously for each simulated missile by:

1. Evaluating damage on a missile-by-missile basis corresponding to the characteristics and velocity of the simulated missile and the characteristics of the target. Types of damage evaluated include:

a. Perforation of steel targets

b. Spall of concrete and masonry targets

c. Pipe penetration screening - evaluates missile dimensions, orientation, and velocity vector, with respect to the geometry of small openings

d. Threshold velocity exceedance - evaluates missile velocity by missile type to determine if the simulated missile has sufficient kinetic energy to damage the SSC impacted. This is used to account for failure modes not directly assessed within TORMIS, such as crimping of exhaust and vent pipes.

to ULNRC-06678 Page 30 of 38

2. Crediting partial blockage of missile paths by intervening structures and partial missile barriers. This is especially significant for straight wind missiles when there is no cyclonic/rotational component to the wind field.

3. Considering multiple potentially damaging missiles impacting the same SSC in the same event.

The use of tornado wind missile fragilities for straight line wind hazards has been a point of discussion in recent peer reviews of HW PRAs. To improve the state of the practice, the wind missile fragility analysis for CEC produced separate wind missile fragilities for the tornado and straight-line wind hazards.

ARA has adapted the TORMIS code to produce straight wind missile fragilities by simulating straight wind fields instead of tornado wind fields and subsequently injecting missiles into the straight wind field and flown using the existing routines within the TORMIS code.

The straight wind field used is composed of a monodirectional wind flow with infinite width. Unlike the tornado wind fields, the straight wind field does not include vertical wind speeds, however, aerodynamic forces on missiles may result in lift. The magnitude of straight wind flow changes every second. The equivalent peak 3-second gusts during the time history produces the same levels of wind velocities as the tornado winds at 10m above the ground while the flow moves over the entire plant. The straight wind speed is adjusted to appropriate surface roughness using the method in ESDU (2012). The vertical profile of straight wind from 0 to 9 feet above the ground is evaluated using a log law model, which is published in ESDU (1974).

Audit Question: APLC High Winds PRA Modeling

• Summarize the PRA notebook reference provided in audit response.

Response

As described in PRA notebook PRA-HW-PLANT_RESPONSE, the high wind plant response model was adapted from the fully integrated internal events at-power PRA model for core damage and large early release. It was modified to reflect wind-caused initiating events and to incorporate high wind failures and other wind-analysis aspects that are different from the corresponding aspects in the internal events PRA model.

The high wind hazard analysis was used as the basis for defining a set of high wind initiating events for the plant response model. The straight wind hazard and tornado hazard curves are each discretized into a set of 10 windspeed intervals, each with an interval frequency, for a total of 20 high wind initiating events. Winds below the lower point of the F1 range (i.e., < 73 mph) are not included in the HWPRA plant response model since they are assumed to be to ULNRC-06678 Page 31 of 38 incapable of damaging the plant; those winds could potentially contribute to a loss of offsite power (LOOP) but are already captured in the LOOP initiating event frequency in the CEC internal events at-power PRA.

High wind accident sequences were modeled using event trees. Depending on the severity of the wind and the likelihood of failure of the offsite electrical grid, high wind events follow either the turbine trip or LOOP sequence logic from the CEC internal events at-power PRA. This is an enhancement in the CEC HWPRA when compared to the typical assumption in other HWPRA studies that all high winds cause a loss of offsite power. The probability of loss of offsite power at the time of the high wind event, that is, the electrical grid fragility, was assigned based on the wind speed; winds > 112 mph were assumed to result in a LOOP with certainty.

Following the initial partitioning of high wind events based on electrical grid fragility, the remaining high wind accident progression was modeled using either the turbine trip event tree or LOOP event tree from the internal events at-power PRA model. They include transfers to different trees for postulated events such as an induced LOCA from a pressurizer relief valve failure to close, reactor coolant pump seal failure, or an anticipated transient without scram. It is assumed that no high wind specific pre-emptive operator actions (e.g., controlled reactor shutdown prior to the event) take place just prior to the occurrence of the high wind event at the station. This is a somewhat conservative approach but is consistent with feedback from operator interviews and is considered reasonable in this study given that a significant contribution to the high wind hazard at CEC is from tornadoes and thunderstorms for which little warning may be available.

The CEC internal events PRA uses the integrated single-top fault tree approach; that is, all of the event tree models for the internal initiating events have been converted to equivalent fault tree logic, merged with the mitigating and support system fault trees, and combined with a single database to allow for direct cutset evaluation of the CDF and LERF top events. This same single-top approach was used for the HWPRA; the high wind event tree logic was converted into equivalent fault tree logic and was inserted into to the integrated single-top model.

The wind pressure fragility and wind missile fragility analyses were used to define a set of new basic events for wind-related failures. The newly defined wind fragility basic events were directly modeled in the HWPRA by inserting the fragility events alongside the existing basic events for equipment unavailability to due random failures, etc. Because the CEC internal events at-power PRA uses the single top fault tree approach for evaluating CDF / LERF, all mitigating and support system fault trees are already integrated into the master fault tree and to ULNRC-06678 Page 32 of 38 the wind fragility events were added to the integrated model rather than to separate individual system fault trees.

Based on information gathered during the plant walkdown and from reviews of the system fault tree model documentation for the internal events at-power PRA, certain additional fault tree model refinements were required to properly address items added to the final HWEL and fragility analyses. This included modelling of additional switchyard components, and the mapping of Category I building structural vulnerabilities (e.g., small penetrations) that were not otherwise associated with basic events on the High Wind Equipment List (HWEL).

The human reliability analysis for HWPRA considered the potential effect of a high wind event on the ability of operators to take actions to control systems or restore mitigating functions and equipment. For the HWPRA, the relevant post-initiating event human failure events were identified, assessed for location and timing, and the human error probabilities were modified as necessary to reflect high wind effects.

Quantification of the CDF / LERF results from the HWPRA model required several steps:

• Using a HW specific flag file, a number of event settings in the integrated fault tree model (e.g., assignment of certain events to logical TRUE) were implemented prior to evaluation. Relevant settings were carried over from the internal events at-power PRA and were modified and supplemented with high wind specific settings.

• The FTREX fault tree solution engine was used to generate initial cutsets for the CDF and LERF top events. The HWPRA model is evaluated at a truncation of 5E-12 for CDF and 5E-13 for LERF.

• Post-processing of the initial CDF / LERF cutsets was undertaken using the EPRI QRecover utility. In general, the QRecover post-processing from the internal events at-power PRA was carried over to the HWPRA model.

However, certain actions from the at-power PRA, such as the recovery of offsite power, were not applied in the HWPRA given the wind-related effects.

Other modifications to the post-processing were also implemented to reflect modeling changes for HWPRA, such as the modification of human error probabilities for operator field actions after high wind events.

• The CDF / LERF estimates from the final cutsets were refined with post-processing using the EPRI ACUBE code to reduce the conservatism of the min cut upper bound (MCUB) estimates.

• The CDF / LERF cutsets are reviewed and the quantification process is refined and iterated as needed.

to ULNRC-06678 Page 33 of 38 The final post-processed CDF and LERF cutsets are the baseline results of the HWPRA study. Other than the quantification parameters (e.g., truncation value) no additional key assumptions were made during quantification of the plant response model.

Two methods were used to assess the uncertainties in the CEC high wind plant response model:

1. A parametric uncertainty analysis was performed using Monte Carlo analysis to propagate uncertainty parameters in the input data through the high wind plant logic model to the CDF and LERF results. This was accomplished using the EPRI UNCERT code and allows for the uncertainty bounds (5% and 95%

percentiles) to be established for the baseline core damage and large early release frequency results of the CEC HWPRA.

2. Several sensitivity analysis cases were undertaken to examine the risk significance of key assumptions from the high wind plant logic model development and quantification on the CDF results.

to ULNRC-06678 Page 34 of 38 REVISED AUDIT QUESTION APLA 02 APLA Question 02 - Use of Newly Developed Method from PWROG-18027-NP Note: Changes to the audit question are underlined Section B of Regulatory Guide (RG) 1.200, Revision 3, "Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities," dated December 2020 (ADAMS Accession No. ML20238B871), endorses Nuclear Energy Institute (NEI) 17-07, Revision 2, "Performance of PRA Peer Reviews Using the ASME/ANS PRA Standard," dated August 2019 (ADAMS Accession No. ML19241A615). The guidance in NEI 17-07, Revision 2, establishes a newly developed method (NDM) peer review process. Section B of RG 1.200, Revision 3 also endorses the following portions from the Pressurized Water Reactor Owners Group (PWROG)-19027-NP, Revision 2, "Newly Developed Method Requirements and Peer Review," dated July 2020 (part of ADAMS Accession No. ML20213C660):

• Requirements for the peer review of NDMs (see Regulatory Positions C.2.2.2 through C.2.2.4).

• Process for determining whether a change to a PRA is classified as PRA maintenance or a PRA upgrade (see Appendix C).

• Definitions related to NDMs, PRA maintenance, and PRA upgrade.

Sections 3.2.1, "Internal Events and Internal Flooding," and 3.3 of Enclosure 1 to the LAR, state that Callaway incorporated the NDM described in PWROG-18027-NP, Revision 0, "Loss of Room Cooling in PRA Modeling," dated April 2020, into its internal events PRA. The licensee explains that in November 2019 an independent assessment was performed to close open F&Os, but that an F&O related to implementation of the PWROG-18027-NP methodology remained open. In Section 3.3 of the LAR, the licensee explains that in June 2020 an independent assessment to close open F&Os and a concurrent focused-scope peer review was performed to complete review of the use of the PWROG-18027-NP methodology. In the LAR, the licensee states that the PRA standard supporting requirements (SRs) associated with implementation of the guidance in PWROG-18027-NP, Revision 0, were found to meet Capability Category II. The licensee also explains, that as part of an effort unrelated to the Callaway reviews, a peer review was performed in February and March of 2020 on the PWROG-18027-NP methodology following the guidance in NEI 17-07, Revision 2, and PWROG-19027-NP, Revision 2, which contains the SRs for new methods. This NDM pilot review is documented in a letter to the NRC titled "For Information Only - PWROG-19020-NP Revision 1 Appendices B, C and E Newly Developed Method Peer Review Pilot - General Screening Criteria for Loss of Room Cooling in PRA Modeling per PA-RMSC-1647," dated August 6, 2020 (ADAMS Accession Nos. ML20230A125 and ML20230A126). The NDM pilot review document states that the PWROG-18027-NP methodology was found to meet all SRs associated with the NDM without any open F&Os. However, Section E.4.2 of PWROG-19020-NP states that a peer review of this method is needed when it is to ULNRC-06678 Page 35 of 38 implemented at a plant that includes evaluation of the following SRs: SY-A3, SY-A6, SY-A11, SY-A18, SY-A21, SY-A22, SY-B6, SY-B9, SY-B11, and SYB12 and hazard-specific SRs It is not clear to NRC staff whether these SRs were included in the focused-scope peer review of the methodology.

Also, the LAR states that the loss of room cooling evaluation methodology documented in PWROG-18027-NP, Revision 0, was incorporated into and peer reviewed for the internal events PRA. The NRC staff notes that because the internals events PRA is the foundation for the fire, seismic and high winds PRAs, the approach could be implemented in the other PRAs. For the fire PRA, it is not clear whether the screening and application of the method based on interference theory was re-applied or if the evaluation for the internal events PRA was assumed to apply without further assessment. It is also not clear how the consideration of internal fires impacts the application of the PWROG-18027-NP approach on fire PRA scenarios, given that fire can increase the temperature within a room with PRA components or that a fire outside of the room can impact the interfacing instrument and control systems associated with a room cooling system.

In light of the observations above, address the following:

• Confirm that the SRs cited above were included in the June 2020 Callaway internal events focused-scope peer review of the implementation of the PWROG-18027-NP methodology.

• If in response to Part a. above, it cannot be confirmed that the cited SRs were included in the June 2020 focused-scope peer review of the implementation of the PWROG-18027-NP methodology, then justify any exclusions. Alternatively, perform a focused-scope peer review of the method against the cited SRs and close any resulting F&Os using an NRC-approved process.

• Explain whether and how the PWROG-18027-NP methodology for evaluating room cooling systems from the PRA was applied in the fire PRA. If the approach is applied to the fire PRA, include a discussion and justification of how fire impacts were considered (i.e., room heat-up due to fire or fire damage of the instrument and control system associated with a room cooling system, which may exist outside the room).

to ULNRC-06678 Page 36 of 38

Response

As documented in Appendix A of AMN#PES00031-REPT-001, the cited SRs were not included in the June 2020 Callaway internal events focused-scope peer review of the implementation of the method described in PWROG-18027-NP.

Exclusion of the cited SRs from the scope of that focused-scope peer review of PWROG-18027-NP is justified because the method was implemented in the PRA and peer reviewed prior to the method being accepted through the NDM peer review process endorsed by Regulatory Guide 1.200, Revision 3.

The Callaway internal events model included the method described in PWROG-18027-NP and underwent a full scope peer review in July 2019, as documented in PWROG-19012-P. The cited SRs were reviewed and assessed as met at Capability Category II, with the generation of no associated F&Os. One unassociated (i.e. not related to the cited SRs) F&O related to implementation of PWROG-18027-NP (i.e., F&O 22-3), which was assessed against SR SC-B4, was generated from PWROG-19012-P. This F&O was generated because PWROG-18027-NP had not yet been finalized and had not yet been subjected to the NEI 17-07 and PWROG-19027-NP NDM peer review process. Prior to PWROG-18027-NP being subjected to the NEI 17-07 process, the method based on the Arrhenius model was widely used in the industry as noted in the paper "General Screening Criteria for Loss of Room Cooling in PRA Modeling" (Beckton, J.S. and Trull, C) presented at the ANS PSA 2019 conference. For this reason, the Internal Events discussion under Section 3.3 of the LAR describes that the method was implemented and notes that PWROG-18027-NP does not necessarily meet the NDM definition. Once PWROG-18027-NP had undergone the NDM peer review process, the F&O was closed as part of the Callaway focused-scope peer review performed in July 2020 and documented in AMN#PES00031-REPT-001.

As an important clarification to Audit Question APLA-02, Section E.4.2 of PWROG-19020-NP requires a peer review of the implementation of the method rather than a peer review of the method at the time of implementation. So, the relative timing of the peer reviews is not actually specified. As documented in AMN#PES00031-REPT-001, the focused scope peer review made checks in SY (Systems Analysis) SRs to ensure appropriate modeling and documentation.

In general, all of the external hazards contain backward-referencing SRs to the general systems modeling SRs contained in Part 2 of the ASME/ANS PRA Standard, which were reviewed in full in the context of Internal Events, under the full scope review documented in PWROG-19012-P. The difference for external hazards being to review the SRs in the context of the associated hazard. CEC found no context related to external hazards that impact application of the method provided in PWROG-18027-NP.

Therefore, in the absence of any contextual differences related to external hazards, the associated backward-referencing SY SRs would be met at the same capability category to ULNRC-06678 Page 37 of 38 (with respect to application of the PWROG-18027-NP method) as assessed for Internal Events under PWROG-19012-P. This is justified by the lack of any hazard-specific impacts on an SSC being able to perform credited functions at or below the preliminary screening temperature provided in PWROG-18027-NP.

For clarity, it is noted here that the method in PWROG-18027-NP allows for two modeling approaches. The primary method (based on a standard Arrhenius model and data) can be applied; which fails supported equipment with certainty (1.0) once the room temperature reaches the initial screening value. This includes an assessment of potentially sensitive electronic components, which may fail below the initial screening temperature. Based on this approach, for rooms where heat-up calculations show temperatures in excess of the screening value, room cooling systems are assumed to be required and are modeled. In these cases, if room cooling is failed the impacted components are assumed failed. Secondly, an interference theory approach can be applied to estimate a probability of failure with the appropriate analysis and justification. The second modeling approach, using interference theory, was not implemented in any CEC PRA model of record; only the assumed failure of unscreened components upon failure of HVAC was used in the CEC PRA.

Specifically related to implementation of this method in the fire PRA, as described in the PRA-FIRE-17671_010A notebook, the PWROG-18027-NP methodology for evaluating and screening HVAC components in the internal events PRA is carried into the FPRA with no modification necessary due to fire considerations. The discussion from the PRA-FIRE-17671_010A notebook is reproduced here:

During detailed fire modeling, fire scenarios, using specific or bounding HRRs, are used to calculate temperatures for the given fire compartment. These room heat up calculations do account for the fire source growth and does not credit HVAC in the calculation for temperatures in the fire compartment. The room temperature is used to inform which target failures are appropriate for the fire scenario. Locations with sensitive electronics have select targets with lower failure temperatures. If sensitive electronics are in the fire compartment and not failed by the Zone of Influence (ZOI), they are assessed for failure based on the room temperature, or lower heat flux threshold. If the temperatures or heat flux reach the threshold for sensitive electronic failure (Appendix D of Reference 34) then they are included as fire failures for the appropriate scenarios. HVAC that is modeled and credited in the Fire PRA as required is discussed in Table 3-7 of 17671-02a (Reference 16).

The method implemented in the Internal Events analysis for room heat up (PWROG-18027) is not affected by the current FPRA methods for determining when room cooling is required. Both analyses utilize the sensitive electronic temperature threshold, 65ºC (150ºF) and heat flux of 3 kW/m2, for areas where such components exist. The FPRA follows the established industry guidance for to ULNRC-06678 Page 38 of 38 assessing room heat up and the impact on PRA targets and systems. A fire scenario that damages HVAC components or cables, whether in the same location as the HVAC component or not, will result in that system not being available to complete its required PRA function.