ML22181B139

Attachment 9 - Responses to NRC Audit Questions

ML22181B139
Person / Time
Site:	Callaway
Issue date:	06/30/2022
From:	Ameren Missouri, Union Electric Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML22181B129	List: ML22181B131 ML22181B132 ML22181B133 ML22181B134 ML22181B135 ML22181B136 ML22181B137 ML22181B138 ML22181B139 ML22181B140 ML22181B141 ULNRC-06739, Post-Audit Supplement to License Amendment Request to Adopt TSTF-439 and TSTF-505 (LDCN 20-0007)
References
ULNRC-06739
Download: ML22181B139 (75)

Text

Attachment 9 to ULNRC-06739 Responses to NRC Audit Questions Page 1 of 75 Attachment 9 License Amendment Request Callaway Unit No. 1 Renewed Facility Operating License NPF-30 NRC Docket No. 50-483 Post-Audit Supplement to License Amendment Request to Adopt TSTF-439 And TSTF-505 Responses to NRC Audit questions to ULNRC-06739 Responses to NRC Audit Questions Page 2 of 75 Ameren Missouri Response to NRC Audit Questions On October 21, 2021, Union Electric Company, dba Ameren Missouri, submitted a license amendment request (LAR) for Callaway Plant, Unit 1 (ADAMS Accession Number ML21294A394). The proposed amendment would revise applicable Technical Specifications to implement risk-informed Completion Times and the Risk-Informed Completion Time (RICT)

Program in accordance with the guidance of TSTF-505, Revision 2. The requested license amendment would also adopt TSTF-439, Revision 2, which involves the elimination of second Completion Times currently specified in the Technical Specifications. Subsequent to NRC acceptance of the LAR, the NRC performed an audit which was conducted March 22 through 25, 2022. The NRC questions and responses to be addressed during the audit were provided in an NRC letter dated March 7, 2022 (ADAMS Accession No. ML22061A004). At the conclusion of the March 22-25, 2022 audit activities, the NRC requested that Ameren Missouri's responses to selected questions from the audit be transmitted via a letter to the NRC. The responses (with their associated audit questions) are provided on the following pages of this attachment.

Not all of the NRC audit questions and responses required docketed responses. Those that did not are listed below.

STSB Q-03 APLA Q-02 SCPB Q-01 APLA Q-06.a.ii EICB Q-01 APLC Q-07 EICB Q-02 EEEB Q-02.a APLA(C) Q-01.b EEEB Q-04.a APLA(C) Q-02.a EEEB Q-05 APLA(C) Q-02.c.iii EEEB Q-06.i APLA(C) Q-02.e.ii EEEB Q-06.ii APLA(C) Q-02.f.ii EEEB Q-06.iii APLA Q-03 EEEB Q-10 APLA Q-04.c to ULNRC-06739 Responses to NRC Audit Questions Page 3 of 75 APLA Q-04 Modeling of Digital I&C Systems Section 2.3.4 of NEI 06-09, Revision 0-A, states that PRA modeling uncertainties shall be considered in application of the PRA base model results to the RICT Program and that sensitivity studies should be performed on the base model prior to initial implementation of the RICT Program on uncertainties that could potentially impact the results of a RICT calculation.

Regarding digital I&C, there is a lack of consensus industry guidance for modeling these systems in plant PRAs for use to support risk-informed applications. In addition, known modeling challenges exist, such as: (1) lack of industry data, (2) the difference between digital and analog system failure modes, and (3) the complexities associated with modeling software failures including common cause software failures. Given these challenges, the uncertainty associated with modeling a digital I&C system could impact the RICT Program. It is not clear to the NRC staff whether the licensee credits digital systems in the PRA models that will be used in the RICT Program, and if so, how this modeling impacts the PRA used. In consideration of these observations address the following:

Question APLA Q-04.a

a. Identify any digital I&C system(s) credited in the probabilistic risk analysis models.

Response to APLA Q-04.a The Callaway PRA models mitigation function for the following systems that contain digital I&C:

- Main Feedwater. The Main Feedwater Pumps (MFPs) and feedwater flow control valves are directly controlled by the Digital Feedwater Control System (DFWCS).

- Main Steam/Main Feedwater Isolation Signal (MSFIS) controls. The Main Feedwater Isolation Valves (MFIVs) and Main Steam Isolation Valves (MSIVs) actuate through the digital MSFIS cabinets, which provide the hydraulic actuator controls for both automatic (originating from SSPS) and manual (MCB handswitch) isolations.

- Alternate Emergency Power Supply (AEPS). Starting the EDGs and breaker alignments within the system are controlled by a digital control system.

Question APLA Q-04.b

b. For the systems identified in a., briefly describe the modeling. Include the results of a sensitivity study performed for each digital system demonstrating that the uncertainty associated with probabilistic risk analysis modeling has no adverse impact on the RICT Program.

Response to APLA Q-04.b Main Feedwater The Callaway PRA credits the main feedwater system to both isolate given an isolation signal and as a backup to AFW if all AFW fails. The digital portion of the system (e.g., pump speed control and feed flow modulation) is not included in the PRA. For the reasons pointed out in the question, it is difficult to accurately model complex digital systems. However, based mostly on to ULNRC-06739 Responses to NRC Audit Questions Page 4 of 75 vendor data and Plant experience, the failure rates of the digital portions are expected to be very low. These failures are expected to be orders of magnitude below the analog and mechanical failures that are explicitly modeled. In addition to the MFPs, the condensate pumps, the start-up feedwater pump and the Non-Safety auxiliary feedwater pump are also modeled as part of the main feedwater system function to back up the Safety-Related AFW system. None of these pumps and associated controls are digitally controlled. Due to this redundancy, the digital controls are a very small part of the credited system function for supplying alternate feed flow.

ASME/ANS RA-Sa-2009 Supporting Requirement SY-A15 states:

In meeting SY-A11 and SY-A14, contributors to system unavailability and unreliability (i.e., components and specific failure modes) may be excluded from the model if one of the following screening criteria is met:

(a) A component may be excluded from the system model if the total failure probability of the component failure modes resulting in the same effect on system operation is at least two orders of magnitude lower than the highest failure probability of the other components in the same system train that results in the same effect on system operation.

(b) One or more failure modes for a component may be excluded from the systems model if the contribution of them to the total failure rate or probability is less than 1% of the total failure rate or probability for that component, when their effects on system operation are the same.

Due to the available data, the redundancy built into the digital controls, internal self-checking capabilities and Plant experience, in conjunction with the non-digital redundancy in the overall system, the failure rates of the digital portion of the system is assessed to meet both of these criteria.

Main Steam/Main Feedwater Isolation The MSIVs and MFIVs are actuated through the digital MSFIS cabinets, which provide the hydraulic actuator controls for both automatic (originating from SSPS) and manual (MCB handswitch) isolations. MSFIS is based on Allen Bradly programmable logic controllers (PLCs) which are subject to the digital I&C modeling complications identified in the question. However, there is significant redundancy as each train has three redundant processor racks with outputs hardwired in a 2/3 logic.

While it takes alignment of both trains of the digital MSFIS to open the MFIVs and MSIVs, either train is able to isolate them, providing redundancy for the isolation function. The MSIVs also have a diverse backup for isolation by directly energizing the A & B output relays using manual toggle switches on the Emergency Override Panel located in each MSFIS cabinet. The MFIVs do not have this diverse backup, their output relays are completely controlled by digital MSFIS.

However, the Main Feed Regulating (MFRV) and Main Feed Regulating Bypass (MFRBV) valves are credited as a diverse isolation function and have Safety-Related isolation signals.

The MFRVs and MFRBVs have direct isolation by dumping the air supply to their air operated actuators causing the valves to isolate. These are solenoid valves actuated by the analog SSPS relays.

to ULNRC-06739 Responses to NRC Audit Questions Page 5 of 75 For the same basic reasons as discussed under Main Feedwater, supporting requirement SY-A15 was used to screen detailed modeling of the digital portion of the MSFIS isolation function.

However, the support power to the MSFIS cabinet is explicitly modeled and, mostly for convenience, there is an undeveloped basic event representing failure of the MSFIS cabinet.

AEPS The AEPS system is a Non-Safety Related backup power supply system that can provide sufficient power to supply both trains of Class 1E equipment if the Cooperative power supply is available (although currently AEPS is only credited to supply one Class 1E buss at a time) or either of the Class 1E busses if only the AEPS EDGs are available. AEPS also supplies power to the Non-Safety auxiliary feedwater pump (NSAFP). This system is controlled by 3 PLCs operating on fiber optic lines and two touchscreen panels. All of the main components (breakers, EDGs, transformer, and manual controls, including the touchscreen panel in the main control room) are explicitly modeled. There are two PLC nodes in the control system. The master PLC consists of two redundant PLCs performing the EDG starts and alignment logic given a failure of the Cooperative power supply. The Cooperative power supply is the normal power source for the AEPS system and is normally aligned; a master PLC failure with the Cooperative available and aligned (normal) would have no impact on the availability of the normal AEPS supply to the Class 1E busses. On a loss of the Cooperative supply, two redundant PLCs operating in lead/lag mode would have to fail in order for the AEPS EDGs and associated breakers to fail to supply the AEPS loads. The other node is a PLC that controls the local breakers, these breakers are used to manually align power to the Class 1E busses and/or to start the NSAFP. The functions of this PLC can also be completed by manually operating the local breakers. It is noted that these breakers are next to the Control Building and close to the Control Room, however, this local manual action is currently not credited.

Again, for the same reasons discussed previously, supporting requirement SY-A15 was used to screen detailed modeling of the digital portions of the system. However, the PLC that controls the local switchgear is currently being added to the PRA as part of the ongoing model update.

Due to the lack of redundancy for this single PLC and Plant operating experience (fiber cable cut by external utility digging) it was decided that adding this PLC to the model would be convenient to provide a target basic event for the configuration risk model to use and to provide the ability to distinguish between manual operation of the system from the main control room and the need for local operation of the associated breakers (which is not currently credited).

Based on the information provided above, an incremental sensitivity of 10 or 20% on the failure probability of a digital component, if it were modeled, would be negligible. However, given the current PRA model update to add the PLC that controls the local AEPS switchgear, a sensitivity was performed on the addition of this PLC and around the uncertainty of the failure probability of the PLC. The most limiting RICTs associated with this uncertainty were evaluated for both the addition of the PLC to the model with its nominal failure rate and a bounding sensitivity on the uncertainty of the failure rate of the PLC. The results of these sensitivities are provided in the tables below.

Original RICT Results Tech Spec LCO Condition RICT Estimate (Days) 3.8.1.B One DG inoperable 30 to ULNRC-06739 Responses to NRC Audit Questions Page 6 of 75 3.8.1.D One offsite circuit inoperable AND One DG inoperable 21.80 A sensitivity was performed to incorporate the current PRA update to add a new basic event in the AEPS model to represent the PLC that controls the local AEPS switchgear. This event was given a PLC failure rate of 3E-05/hr per NUREG/CR-6962. The results of adding the PLC with a nominal failure rate are provided in the table below:

RICT Results with PLC Changes Tech Spec LCO Condition RICT Estimate (Days) 3.8.1.B One DG inoperable 30 3.8.1.D One offsite circuit inoperable AND One DG inoperable 21.05 The second sensitivity involved investigating a bounding impact of the uncertainty in the failure rate of the PLC, the results are provided in the table below:

RICT Results with PLC Changes Tech Spec LCO Condition RICT Estimate (Days) 3.8.1.B Sensitivity One DG inoperable 30 3.8.1.D Sensitivity One offsite circuit inoperable AND One DG inoperable 20.87 Note that Sensitivity Case increases PLC failure probability by x10 A factor of 10 on the PLC failure rate is considered conservative and bounding of the uncertainties associated with the failure rate. Digital devices are generally very reliable, and the vendor data provided for this PLC indicates that these devices have been in use for at least 20 years. In that timeframe it is expected that any software or other uncertain common mode failures would have been identified and corrected.

The difference in the 3.8.1.D RICT calculation for the nominal and bounding failure rates is 0.18 days as shown in the sensitivity results above. In addition, the results above do not reflect credit for an available operator action to locally operate the switchgear in the event of a PLC failure. If this operator action were credited it would significantly reduce the impact of the PLC failure, and the associated uncertainty, in the PLC failure probability reflected above.

Based on the results of the sensitivities above and evaluations of potential impacts from all digital systems discussed above, unreliability uncertainties associated with the mitigation functions of installed digital systems is not a Key Uncertainty and is not further evaluated.

to ULNRC-06739 Responses to NRC Audit Questions Page 7 of 75 APLA Q-05 Impact of Seasonal Variations The Tier 3 requirement of RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, stipulates that a licensee should develop a program that ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. NEI 06-09 and the accompanying NRC SE to this guidance state that for the impact of seasonal changes either conservative assumptions should be made or, the PRA should be adjusted appropriately to reflect the current (e.g., seasonal or time of cycle) configuration.

Question APLA Q-05 LAR Enclosure 8, Attributes of the Real Time Risk Model, Section 2.0, presents an unconnected bullet point near the end of the Section stating: No success criteria change based on seasonal variation. Given that changes in PRA success criteria due to seasonal changes will apparently not be made in the RTR model, confirm that conservative or bounding assumptions are used to encompass the impact of any seasonal variations on PRA modeling consistent with the guidance in NEI 06-09, Revision 0-A. "

Response to APLA Q-05 Callaway's PRA modeling is consistent with the guidance in NEI 06-09, Revision 0-A with respect to seasonal variations and associated success criteria. Bounding assumptions encompass the impact of any seasonal variations on PRA modeling.

While it is common for some sites to have significant differences in success criteria due to outside temperatures, Callaway has a relatively small secondary cooling heat sink that can be temperature controlled by manual alignments (applies to both the Non-Safety Related secondary cooling system and the Safety Class Ultimate Heat Sink). The success criteria for the normal Service Water System (Non-Safety) is 2/3 pumps. This system can potentially operate with 1/3 pumps during very short periods of cold temperatures in any given year, but this is rarely done and generally only for unplanned maintenance activities. The current procedural guidance for the normal service water system is as follows:

OTN-EA-00001, "Service Water System" 3.1.7 During system startup, or shutdown for outage conditions, heat loads on the system are minimal resulting in temperature control valves throttling to near closed conditions. Pump in-service time at low flow conditions, (discharge pressure greater than 75 psig), should be minimized.

3.1.8. It is acceptable to use one service water pump to supply both ESW and Service Water loads for extended periods of time during outage conditions, as long as pump discharge pressure is maintained within the normal operating band of 60 to 80 psig.

However, the following step indicates that at least 2/3 pumps are normally required:

3.1.1. One Service Water Pump has the capacity to supply only the requirements of the Service Water system. For normal plant operation, two pumps must be running to supply both Service Water and Essential Service Water components.

to ULNRC-06739 Responses to NRC Audit Questions Page 8 of 75 In addition, the standby pump is set to Auto so that if a running pump trips, the standby pump auto starts.

5.2.7. PLACE CSEA2102, SERV WTR PMPS AUTO BACK-UP SELECTOR SW, (on CPEA2107, SERVICE WATER VALVE CONTROL CABINET) to AUTO.

This is also backed-up by a manual start of the second pump in step 5.2.4:

5.2.4. START a service water pump as follows:

a. OPEN the applicable Strainer Differential Pressure Switch Equalizing Valve:

• VEA2168A, STRAINER DIFF PRESS SW PRESS EQUAL VALVE.

• VEA2168B, STRAINER DIFF PRESS SW PRESS EQUAL VALVE.

• VEA2168C, STRAINER DIFF PRESS SW PRESS EQUAL VALVE.

b. Using the applicable switch below, START the desired service water pump and ENSURE the associated discharge valve opens.

• PBHIS12104, SERV WATER PUMP A

• PBHIS12204, SERV WATER PUMP B

• PBHIS12303, SERV WATER PUMP C

c. CLOSE the applicable Strainer Differential Pressure Switch Equalizing Valve:

• VEA2168A, STRAINER DIFF PRESS SW PRESS EQUAL VALVE.

• VEA2168B, STRAINER DIFF PRESS SW PRESS EQUAL VALVE.

• VEA2168C, STRAINER DIFF PRESS SW PRESS EQUAL VALVE.

Normally single pump operation is during outage timeframes when the configuration risk model is not used. Therefore, the PRA success criteria of 2/3 normal service water pumps is not modified for seasonal conditions and remains bounding.

HVAC success criteria are another common seasonal impact. The room heat up calculations for HVAC success criteria are based on a bounding outside temperature and are not adjusted for seasonal impacts. Thus, these success criteria are not adjusted for seasonal impacts.

Auxiliary Feedwater water source temperature (CST and HCST) could minimally impact success criteria (temperature and volume). The temperature in these tanks is controlled by heaters during cold weather (colder water would be beneficial). Callaway PRA uses bounding bulk water temperatures to determine associated success criteria, which are not adjusted for seasonal variations.

There are no other success criteria in the Callaway PRA that are known to be potentially influenced by seasonal variations.

to ULNRC-06739 Responses to NRC Audit Questions Page 9 of 75 APLA Q-06 In-Scope LCOs and Corresponding PRA Modeling LAR Enclosure 1, Table E1-1 identifies each TS LCO proposed to be in the RICT Program, describes whether the systems and components participating in the TS LCO are modeled in the PRA, and compares the design basis and PRA success criteria. For certain TS LCO Conditions, the table explains that the associated SSCs are not explicitly modeled in the PRAs and identifies a surrogate to represent failure of the applicable function. For some LCO conditions, it is not clear how the identified surrogate is representative of the failure of the TS function. Therefore, address the following:

a. LAR enclosure 1, Table E1-1 states for TS LCO 3.6.6, Condition A (One containment spray train inoperable) and Condition C (One containment cooling train inoperable), that the design-basis success criterion is One of two trains and the PRA success criterion is None. The LAR states in Table E1-1 that containment cooling is not modeled in the PRA because hydraulic analysis shows that containment cooling does not impact which accident sequences contribute to LERF]. Table E1-1 does not define a surrogate event for modeling the unavailability of a containment spay and cooling system in the RICT calculations, and LAR Enclosure 1, Table E1-2, RICT Estimates, does not provide an example RICT estimate for LCOs 3.6.6.A and 3.6.6.C. Accordingly, it appears that the assumption made in the RICT calculation is that the unavailability of the containment spray and cooling systems has zero impact on CDF and LERF. LAR, Table E1-1, shows that functions addressed by the containment spray and cooling system are containment pressure and temperature control and fission produce retention (which NRC staff understands to be iodine removal according to the TS Basis for LCO 3.6.6.A presented in LAR Attachment 4). To support NRC staff understanding of whether the PRA modeling of the containment spray and cooling system is sufficient to support the RICT application, address the following:

Question APLA Q-06.a.i

i. Confirm that the cited hydraulic analysis addresses both the fission product removal as well as containment pressure and temperature control functions credited in the PRA models. Include clarification that the success or failure of the containment spray and cooling system has no impact on the success of heat and fission product removal functions as modeled in the PRAs.

Response to APLA Q-06.a.i The containment cooling function (i.e., Containment Spray (CS) and Containment Cooler Fans) is not modeled in the PRA logic, nor credited in the Modular Accident Analysis Program (MAAP) success criteria analyses for either CDF or LERF in any of the Callaway PRA models.

However, while the containment cooling function is not required to prevent core damage sequences from progressing to a large, early release, initial successful operation of these systems could impact other credited PRA functions. For completeness, potential adverse consequences of operation of CS and Containment Coolers (e.g., Class 1E buss electrical loading, load shed and sequencing, and reduced time to realign to recirculation) are included in PRA modeling considerations and in the MAAP analyses which are used in the modeling of relevant Human Failure Event (HFE) probabilities. Scrubbing of radionuclides has been conservatively not credited in the LERF analysis. The uncertainty analysis indicates that This to ULNRC-06739 Responses to NRC Audit Questions Page 10 of 75 assumption is conservative but is reasonable and consistent with standard PRA practice and is not a key source of uncertainty (see PRA-IE-UNCERT Rev. 001 Table 5.2-2).

Within the containment integrity and release analysis performed in MAAP, no credit is taken for containment leakage scrubbing by sprays or fan condensation. No credit is taken for any vacuum conditions that may result from steam condensation by sprays which would reduce containment outflows. In addition, containment heat removal is not modeled as a success requirement for ex-vessel cooling.

Based on plant design and plant-specific thermohydraulic analysis using MAAP, failure of the containment spray and cooling system has no impact on the success of heat and fission product removal functions as modeled in the PRA. The MAAP runs used to support the current PRA success criteria were reviewed and confirmed to not credit CS or containment cooling, thereby confirming that non-LERF sequences have appropriate success criteria even without operation of a CS train or containment cooling. Therefore, the mitigation function of these systems is assessed and has been determined to be unnecessary to appropriately reflect LERF risk contributions to RICT calculations.

Given Plant design, as verified by Plant-specific thermohydraulic analysis, the bounding analysis contained in the PRA, and any uncertainty in LERF modeling, will not significantly impact any configuration allowed by the RICT Program.

Question APLA Q-06.b

b. LAR Enclosure 1, Table E1-1 states for the turbine trip and feedwater function of TS LCO 3.3.2 Condition I (i.e., one channel inoperable, SG water level High-High, P-14) that the design-basis success criterion is [t]wo of four on one of four Steam Generators and the PRA success criterion is [n]one. In Table E1-1 of Enclosure 1 to the LAR, the licensee states that this trip function is not explicitly modeled, but SG level high-high signals for the main feedwater isolation are modeled and will be used as a conservative surrogate in the RICT calculations. The LAR further states that trip of the MFW [main feedwater] pumps and closure of the pump discharge valves is not explicitly modeled. It is not clear how SG level high-high signal for MFW isolation is a sufficient surrogate for the turbine trip and feedwater isolation functions.

Provide the impact the SG level high-high signal has on other modeled SSCs and provide justification for why the surrogate event identified for LCO 3.3.2.I is appropriate.

Response to APLA Q-06.b The PRA Success Criteria column is marked none because the specific function of Turbine Trip - SG Water Level-High High is not explicitly modeled because turbine controls are not credited or modeled in the PRA (these are subsumed into the associated initiating event frequency). However, the Callaway PRA does model the SG Hi-Hi water level for MFW isolation, and the PRA Success Criteria is the same as the Design Success criteria (i.e., Two of four on one of four Steam Generators). Regarding the surrogate, Callaway believes that this surrogate is correctly capturing the impact on MFW isolation. However, the impact on Turbine Trip which leads to a Reactor Trip may need to be addressed in a RICT calculation. Thus, another surrogate event for 3.3.2.I is proposed since the Turbine Trip/Reactor Trip for SG Hi-Hi to ULNRC-06739 Responses to NRC Audit Questions Page 11 of 75 is not explicitly modeled. Similar to other trip signals that are not explicitly modeled, the selected surrogate is SB-RTB-LP-102BRTA, REACTOR TRIP BREAKER RTA FAILS TO OPEN ON DEMAND, (for the 'A' Train) the basis for this is that this surrogate represents a bounding approach for Rx trip signals that are not explicitly modeled, wherein one reactor trip breaker is failed when one channel of a non-modeled Rx trip signal is OOS. The inclusion of this additional surrogate did not impact the estimated RICT reported in Enclosure 1, Table E1-2 for 3.3.2.I. However, based in the current modeling, this additional surrogate will be included in RICT calculations until such time that a more detailed modeling of this function is included, if ever, in the credited PRA modeling.

Question APLA Q-06.c

c. LAR enclosure 1, Table E1-1 states for the steam line isolation and reactor trip P-4 engineered safety features actuation system interlock function of TS LCO 3.3.2 Condition F (i.e., One channel or train inoperable) that [a] channel of main steam isolation will be used as a conservative surrogate for the steam line isolation function.

The proposed modeling does not appear to be conservative.

Provide justification for why the surrogate described for LCO 3.3.2.F is sufficient for the RICT calculations.

Response to APLA Q-06.c The Callaway PRA currently does not model or credit manual initiation of steam line isolation.

Thus, failing one train of automatic steam line isolation, which is explicitly modeled, is a reasonable alternative. The surrogate used for this evaluation is a basic event (as described in the response to APLA Q-04) for cabinets SA075A/B (Main Steam and Feedwater Isolation Signal, MSFIS Cabinet). Failure of this surrogate fails one train (of two available trains) of automatic isolation for steam lines and feedwater lines in the model. This is conservative in that this T/S condition only has one MANUAL pushbutton channel/train for steam line only isolation out of service, leaving all automatic functions for steam line and feed line isolations available; while the surrogate fails automatic isolation of both steam line and feed lines on the associated train. Regarding P-4, the LAR indicates this permissive is not modeled and Enclosure 1 indicates that P-4 is not in the scope of the RICT.

to ULNRC-06739 Responses to NRC Audit Questions Page 12 of 75 APLA(C) Q-01 PRA Model Uncertainty Analysis Process LAR Enclosure 9, Key Assumptions and Sources of Uncertainty, specifically discusses how plant specific sources of uncertainty were considered from the PRA notebooks for the internal events (IE), fire, seismic and high wind (HW) PRAs and how generic sources of uncertainty were considered from Electric Power Research Institute (EPRI) Topical Report (TR) 1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, for the IE PRA and from EPRI TR 1026511, "Practical Guidance of the Use of Probabilistic Risk Assessment in Risk-informed Applications with a Focus on the Treatment of Uncertainty, for the Level 2 and fire PRA. The LAR does not indicate that generic sources of seismic PRA uncertainty were considered though such a list exists In EPRI TR 1026511, Appendix C.

The Callaway Title 10 of the Code of Federal Regulations (10 CFR) Section 50.69, Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors, supplement dated July 29, 2021 (ADAMS Package Accession No. ML21210A025),

confirmed that the following five criteria were used to screen and identify assumptions and sources of uncertainty (including modeling choices and approximations): (1) based on a current industry consensus modeling approach, (2) applied the most recent industry data, (3) no impact on the PRA results and, therefore, no impact on the application, (4) the guidance in NEI 00-04,

[TITLE], already requires a sensitivity study on human failure events (HFEs), and (5) a sensitivity was performed on the base model demonstrating the source of uncertainty has no impact on the risk results and, therefore, no impact on the application. Though not explicitly stated in the TSTF-505 LAR, these same criteria would appear to also apply to the uncertainty analysis used to perform a RICT with the exception of No. 4.

In consideration of the observations above, address the following:

Question APLA(C) Q-01.a

a. Clarify whether the generic seismic PRA assumptions and sources of uncertainty listed in the EPRI TR 1026511 Appendix were considered in the uncertainty analysis performed for the RICT application. If they were not considered, provide justification for why the exclusion of considering the generic seismic probabilistic risk analysis assumptions and sources of uncertainty is not applicable or adverse to the probabilistic risk analysis used for the RICT Program.

to ULNRC-06739 Responses to NRC Audit Questions Page 13 of 75 Response to APLA(C) Q-01.a The generic seismic PRA assumptions and uncertainties listed in EPRI-TR-1026511 were used with other NRC and industry guidance documents to develop the disposition of key uncertainties for all the hazard models, including seismic. Per Section 1 of Report PRA-IE-UNCERT_App 5, Rev. 001, "Disposition of Key Uncertainties: Risk Informed Completion Times (RITS 4b)," the following sources were used:

• Section 2.3.4 of NEI 06-09-A, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, November 2006

• NUREG-1855, Revision 1, Guidance on Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision making, U.S. Nuclear Regulatory Commission, March 2017

• EPRI TR-1026511, Practical Guidance on the Use of Probabilistic Risk Assessment in Risk-Informed Applications with a Focus on the Treatment of Uncertainty. EPRI, Palo Alto, CA: 2012. 1026511.

• EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments. EPRI, Palo Alto, CA: 2008. 1016737.

• Regulatory Guide 1.200 Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, U.S.

Nuclear Regulatory Commission, March 2009.

• ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, 2009.

• Callaway Specific PRA Notebooks Review of the seismic uncertainties (and modeling considerations) from EPRI 1026511 was performed and incorporated into the development of the PRA. The SPRA modeling notebook, PRA-SEISMIC-PLANT_RESPONSE, addresses these generic sources, some of which are actually modeling decisions or level of detail considerations.

For example:

• Item #1 in the EPRI list under SHA. This refers to "Reliance on hazard curve" which is addressed in Section 4.6.1.1 "FRANX Hazard Setup" of PRA-SEISMIC-PLANT_RESPONSE.

to ULNRC-06739 Responses to NRC Audit Questions Page 14 of 75

• Item #2 in the EPRI list under SFR. This refers to " Soil structure Interactions" which is addressed in Section 4.1.4.12 Soil Failures in the CEC S-PRA.

• Item #12 in the EPRI list under SPR. This refers to Identification and treatment of seismically induced initiating events which is addressed in Section 4.1.1 Identification of Seismic Induced Initiating Events.

The generic seismic assumptions and sources of uncertainty from EPRI TR 1026511 were reviewed and dispositioned as not being key assumptions and sources of uncertainty for the 4b and 50.69 programs. The table of assumptions and source of seismic uncertainty provided with the respective LARs identify the final subset of assumptions and key sources of uncertainty that were determined to be key to the application. The majority of generic assumptions and sources of modeling uncertainty deal with SPRA modeling issues which have all been addressed and found technical adequate through Peer Review, F&O Closure, and previous NRC submittal through NTTF 2.1. Assumptions and sources of uncertainty that were determined to be significant to the baseline SPRA model and could potentially impact the RICT program would be retained by this process in the final table provided in the LAR.

It is noted that this process is not well described in the seismic portions of the Uncertainty Notebook. Therefore, the following table provides the consolidated seismic uncertainty dispositions for the 21 items identified in EPRI TR 1026511.

to ULNRC-06739 Responses to NRC Audit Questions Page 15 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application Probabilistic Seismic Hazard Analysis (SHA) 1 Reliance on The hazard curve needs Implementation of Not a key source of uncertainty.

hazard curve to be developed representative hazard (Consensus model/method; uncertainty considering issues such curve for the site. has insignificant impact on PRA results as: Seismic hazard and change in risk due to proposed characterization, Seismic The models used to changes) source data, Seismic characterize seismic source location and sources from limited The seismic hazard team developed the geometry, Maximum data have many seismic hazard curve (PSHA) and earthquake magnitude, uncertainties, but ground motion response spectrum Earthquake recurrence ultimately it is the output (GMRS) for use in the CEC SPRA. The Hazard uncertainty of these models that is development followed recent guidance characterization, Ground used to determine an for developing PSHA/GMRS motion characterization, appropriate range of information. This approach and results Ground motion hazard parameters for are considered to be more realistic than attenuation, Local site the source relying on EPRI or NRC generated characteristics on ground characterization in the results because of the use of more site-motion, Uncertainty PRA model. So in the specific information. Therefore, realism propagation, Site specific PRA this uncertainty has been obtained for the PSHA/GMRS response spectral shape, manifests itself as a given the current state of knowledge and Incorporation of other parameter uncertainty. and accepted modeling approaches.

seismic hazards The mean seismic hazard curve is used to determine the seismic hazard bin frequencies and representative peak ground accelerations. The percentile curves are used to estimate uncertainty parameters for those bins. The approach adequately characterizes contribution of seismic hazard curve uncertainty to CDF/LERF uncertainty.

Seismic Fragility Analysis (SFR)

2. Soil structure The soil structure Seismic fragility Not a key source of uncertainty interactions interaction is very site parameters utilized for (Uncertainty has insignificant impact on specific. It needs to be each component. PRA results and change in risk due to accounted for in the proposed changes).

seismic fragility development. The SHA element includes consideration of soil-structure interaction. This level of detail is adequate for the RICT application.

The civil structure evaluation of soil liquefaction, documented in Reference

[3], screened out soil liquefaction as a failure mode for CEC.

The seismic capacity of the reactor building is limited by the soil bearing pressure capacity and its ability to support the reactor building from failure by overturning.

Reference [4] discusses the foundation bearing pressure failure mode, which was studied for the Reactor Building but to ULNRC-06739 Responses to NRC Audit Questions Page 16 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application is considered a bounding assessment that is therefore applicable to all SC-I structures.

The impact of this failure mode is therefore conservatively assumed to result in a catastrophic failure of the Reactor Building (see Section 4.3.1.1 of Reference [1] for modeling considerations associated with a catastrophic failure of the Reactor Building).

3. Identification Realistic failure modes of Realistic failure modes Not a key source of uncertainty and treatment of SSCs need to be identified of SSCs need to be (Uncertainty has insignicant impact on critical failure and accounted for. identified and accounted PRA results and change in risk due to modes of SSCs for. proposed changes).

There are cases in which the seismic failure could result in different failure modes for a given function. For example, an earthquake can cause a pump fail-to-start or run failure but not both. There are cases the seismic failure should not fail the mutual exclusive failure modes for multiple functions. For example an earthquake could cause a valve to both fail to open and fail to close. An SSC may impact more than one basic event. This impact was considered and modeled. All the impacted basic events are conservatively mapped to the associated fragility group to fail all the functions. This level of detail is adequate for the RICT application.

to ULNRC-06739 Responses to NRC Audit Questions Page 17 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application

4. Use of generic A realistic representation Seismic fragility Not a key source of uncertainty fragility data of the seismic fragilities of parameters utilized for (Uncertainty has insignificant impact on the credited SSCs is each component. PRA results and change in risk due to desirable. proposed changes).

The fragilities of SSCs are different because there are many factors that play a role in determining the seismic capacity of an SSC, such as the type of the SSC, the location, the elevation, the seismic demand, etc. The fragility evaluation is performed with different degrees of detail and realism based on the importance of components.

Conservative HCLPF values are assigned to non-safety related components not expected to be important under a risk perspective.

Conservative deterministic failure margin (CDFM) techniques are used for the majority of the fragility assessments, while more detailed evaluations are reserved for components and structures that are identified, through initial iteration of the SPRA logic model, as risk-significant.

The CEC SPRA is developed under the main assumption of complete correlation of seismically induced failures. The fragility analysis provides indications to the SPRA logic model task about correlation of seismic failure between similar components.

Reference [7] discusses the process of calculating fragilities. Section 4.6.1.2 of Reference [1] provides a summary of the fragility values used in the CEC SPRA. This level of detail is adequate for the RICT application.

5. Building Building response Seismic fragility Not a key source of uncertainty response modeling needs to be parameters utilized for (Uncertainty has insignificant impact on modeling appropriately developed. each component. The PRA results and change in risk due to Any building response type of building proposed changes).

scaling needs to be response modeling appropriately justified (e.g. could represent a level The modeling of structural response to because of site- specific of detail issue, but the seismic events is detailed and includes considerations of different approaches are finite element modeling as needed. The structural models, included here for subsequent use of those models and foundation characteristics, reference purposes. results to determine structural fragilities and similarity of input and their assumed impacts on ground motion). equipment within the structures involves providing input to determine what in-structure failures should be used to represent the structural fragilities. This approach is expected to provide realistic structural fragilities and to ULNRC-06739 Responses to NRC Audit Questions Page 18 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application associated impacts on plant equipment.

6. Representation Structural failures are Seismic fragility Not a key source of uncertainty of structural included in the model parameters utilized for (Introduces a realistic conservative bias failures generally representing each structure. This in the PRA model results; there is no failure of all of the systems also could be reasonable alternative assumption or and components within characterized as a level reasonable modeling refinement to that structure. of detail issue. address the uncertainty that is at least as sound as the assumption under consideration).

To achieve realism in the CEC SPRA model, an iterative process was used in the model development and quantification. The draft SPRA model was revised iteratively with the updated structural and component fragilities, HEPs adjusted for seismic impacts, and anticipated seismic impacts and scenarios. Structural failures of the Reactor Building and Communications Corridor (combined with Loss of Offsite Power (LOSP)) result in failure of sufficient safety-related components to lead directly to core damage. Failures of other structures are assumed to fail all components within the structure.

Structural failures of pressurizer and steam generator supports are also included. The logic also models seismically-induced failure of the control room (ceiling collapse or cabinet failures), and failure of the operators to safely shut down the plant remotely.

This combination of events is also assumed to lead directly to core damage. This approach may introduce conservative bias in the PRA model results because it assumes failure of systems that could conceivably survive the structural failures. However, there is no reasonable alternative assumption or reasonable modeling refinement to address the uncertainty that is at least to ULNRC-06739 Responses to NRC Audit Questions Page 19 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application as sound as the assumptions under consideration. Modeling refinements to address this uncertainty would be complex and difficult to implement and defend. This level of detail is adequate for the RICT application.

7. Screening of The basis for screening of If handled appropriately, Not a key source of uncertainty high-seismic- any high-seismic-capacity this is not a source of (Uncertainty has insignificant impact on capacity components needs to be model uncertainty. It PRA results and change in risk due to components clearly identified. renders itself as a level proposed changes).

of detail issue.

This process a standard industry practice. In the CEC SPRA modeling, in order to be realistic as possible, there was no action taken to screen SSCs based on the HCLPF. Table 4-107 of Reference [1] documents the high level assignment of SSCs to the seismic fragility groups in the CEC S-PRA.

to ULNRC-06739 Responses to NRC Audit Questions Page 20 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application

8. Accessibility of Credited SSCs need to be Seismic fragility Not a key source of uncertainty equipment for examined with focus on parameters utilized for (Uncertainty has insignificant impact on walkdowns (e.g. equipment anchorage, each component. PRA results and change in risk due to limited access to lateral seismic support, proposed changes).

reactor vessel spatial interactions, and supports) potential system Extensive walkdowns are performed in interactions. These support to the CEC SPRA. Each aspects may not all be component on the initial SEL is readily accessible from reviewed and walked down as needed walkdowns. by a team of seismic fragility analysts.

Components are physically examined for seismic vulnerability, with emphasis on whether the component meets screening criteria, anchorage and attachment of subassemblies, spatial interactions, and the potential for seismic-induced fire and flood.

The fragility walkdowns are documented in Reference [7].

Extensive walkdowns are also performed in support of the identification of relays associated with equipment in the SEL (see Reference

[8]). Additionally, all operator actions external to the control room and credited by the SPRA plant response model are reviewed during dedicated walkdowns. In particular, the travel paths from the control room to the action location, and the action locations themselves, are inspected for their potential to be degraded or impeded by seismic failures (e.g., structural collapse, fire, flood, etc.).

Walkdowns dedicated to seismic HRA are discussed in Section 4.5.3. of Reference [1].

9. Development of A realistic representation Seismic fragility Not a key source of uncertainty site-specific of the seismic fragilities of parameters utilized for (Uncertainty has insignificant impact on fragility the credited SSCs is each component. This PRA results and change in risk due to parameters desirable. also could be proposed changes).

characterized as a level of detail issue, but the Fragilities for those components different approaches are determined to be the most risk-included here for significant contributors are refined to reference purposes. reduce excess conservatisms in fragility estimates, including use of advanced methods such as separation of variables, if appropriate. This level of detail is adequate for the RICT application.

to ULNRC-06739 Responses to NRC Audit Questions Page 21 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application

10. Loss of offsite power Seismic fragility Not a key source of uncertainty Representation of (LOOP) fragility is typically parameters utilized for (Uncertainty has insignificant impact on loss of offsite a significant contributor in the representation of the PRA results and change in risk due to power fragility a seismic PRA. Better off- site power lines and proposed changes).

plant specific analysis sources.

might remove unneeded Loss of Offsite Power (LOOP) may or conservatism in its may not occur as a result of the seismic estimate. Usually the IE or plant trip from the seismic event fragility used is based on (the offsite power fragility is explicitly what was done 30 years modeled using the most current ago, and the data has not Industry guidance). The general been updated. transient scenarios, including the loss of offsite power initiator, are modeled explicitly with their associated fragilities.

11. Relay chatter Relay chatter can be Identified failure mode Not a key source of uncertainty impacts on another mechanism that and likelihood of (Uncertainty has insignificant impact on components could impact the expected components due to PRA results and change in risk due to response of systems or relay chatter. proposed changes).

components.

Potential relay chatter effects are included in the seismic equipment list and are modeled in the SPRA for cases that cannot be screened out. A number of screenings are performed to manage the large number of relays and contacts present in the plant. After being mapped to SEL items, relays and contacts are assigned an initial conservative HCLPF, grouped, and conservatively entered into the SPRA logic model regardless of the fact that their chatter can actually fail the front-line equipment. Initial iteration of the SPRA logic model allows the identification of relays or relay groups that are risk relevant. For this group of relays, functional chatter evaluation is performed. Relays whose chatter is not detrimental are screened from further consideration and eliminated from the model. Relays whose chatter may be detrimental are examined further and a more refined fragility analysis is considered in Task 9 of Reference [1].

Seismic Plant Response Analysis (SPR) to ULNRC-06739 Responses to NRC Audit Questions Page 22 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application

12. Identification It is very important that If handled appropriately, Not a key source of uncertainty and treatment of site- specific failure this is not a source of (Uncertainty has insignificant impact on seismically events, usually model uncertainty. This PRA results and change in risk due to induced initiating earthquake-caused is a level of detail issue. proposed changes).

events structural, mechanical, and electrical failures, be Initiating events and consequential thoroughly investigated. events that can be caused by a seismic event were considered for components on the seismic equipment list. Each SSC on the list was considered for any plant impact could result from its failure.

Careful attention was paid to passive failures which may not have been represented in the internal events PRA, especially for building failures. The methodology for the identification of seismic-induced initiating events is deduced from the generic guidance provided in the EPRI SPRA Implementation Guide (Reference [9]).

Section 4.1.1 of the PRA Seismic Plant Response Notebook (Reference [1])

discusses the identification of seismic induced initiating events.

This level of detail is adequate for the RICT application.

13. Treatment of The principal way in which If handled appropriately, Not a key source of uncertainty seismically the seismic-PRA trees this is not a source of (Uncertainty has insignificant impact on induced failures differ from those used in model uncertainty. This PRA results and change in risk due to internal-events PRA ultimately is a level of proposed changes).

analysis, besides adding detail issue.

in the passive structures, In a seismic event, it is possible to fail a systems, or components, component externally by block wall or a combination thereof impact or by other SSC impact on the (SSCs), is the need to component, and internally because of consider the physical the failure of function, anchorage, relay locations and proximity of chatter or its support. Fragility analysis SSCs. This need exists and walkdowns take into consideration both because secondary these possible scenarios. For PRA failures such as spatial modeling, all the failure modes of a interactions must be component are accounted for by considered, and because mapping all the applicable fragility response correlations can groups to a surrogate basic event to fail be important and are its intended function. This level of detail related to co- location of is adequate for the RICT application.

similar items. After the seismic-capacity-engineering work has been accomplished, the systems analysis needs to introduce response correlations into the models where appropriate.

to ULNRC-06739 Responses to NRC Audit Questions Page 23 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application

14. Impact of The impacts of the seismic The actual impact will Not a key source of uncertainty.

seismic events on event need to be factored be methodology (Consensus model/method; uncertainty HEPs into the HFE analysis for dependent. has insignificant impact on PRA results the seismic PRA model and change in risk due to proposed (e.g. added stress or changes) limited accessibility for ex-control room actions). The list of post-initiator human actions for the internal events model is the starting point of the seismic HRA, and all existing HRAs are analyzed for modification due to seismic effects.

Human failure events associated with the existing accident sequence models were retained in the SPRA model. The model was also examined for any potential human actions unique to the seismic analysis, and any new operator actions identified were added to the SPRA. Since the potential earthquakes examined vary in magnitude, as does the on-site acceleration, the level of plant damage varies accordingly due to the impacts of the different seismic events. Post-initiator HFEs retained in the SPRA model were evaluated for seismic impacts. The degree of impact is dependent on the seismic acceleration level. The seismic impacts on every post-initiator HFE in the SPRA models were accounted for by the HFE-specific performance shaping factors and selected minimal values that increase with acceleration as a function of plant damage state. This process is a standard approach to developing modern SPRAs. Industry guidelines for performing SPRAs were used in the development of the SPRA.

15. Treatment of The quantification This is not a source of Not a key source of uncertainty success approach needs to model uncertainty, per (Uncertainty has insignificant impact on probabilities / consider the impact of the se. The appropriate PRA results and change in risk due to Approach to high failure probabilities treatment of success proposed changes).

quantification that are likely to be probabilities ultimately associated with specific results in a level of Cutset reviews, during which the impact seismic accident response detail issue. of high failure probabilities may be events. observed, appropriately consider the impacts that are likely to be associated with specific seismic accident response events. Additionally, the SPRA models success of offsite power. The level of detail is adequate for the RICT application.

to ULNRC-06739 Responses to NRC Audit Questions Page 24 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application 16.Representation The seismic-PRA systems This is a level of detail Not a key source of uncertainty of the as-built, as- model shall reflect the as- or completeness issue. (Uncertainty has insignificant impact on operated plant built and as-operated plant PRA results and change in risk due to being analyzed. proposed changes).

The seismic PRA systems model is developed in accordance with analyst judgement consistent with standard engineering practice, is subject to independent review, and is consistent with the objective to provide a realistic representation of the as-built, as-operated plant. This level of detail is adequate for the RICT application.

17.Completeness The seismic equipment list This is a level of detail Not a key source of uncertainty of seismic may be limited to those or completeness issue. (Uncertainty has insignificant impact on equipment list components on the safe PRA results and change in risk due to shutdown seismic proposed changes).

equipment list, or expanded to include All SSCs in the internal events PRA, all representations of other additional SSCs identified in SEL that PRA modeled have the potential to impact the PRA components not on the function and all operator actions SSEL. required to mitigate the seismic initiator are included in the SPRA model. The basic events included in the internal events PRA models were used to develop the CEC SEL. These events form a large portion of the SEL.

Therefore, most SSCs with seismic impacts are already represented in the internal events PRA model. The resulting CEC SPRA SEL is used as the starting point for the seismic walkdown and for the seismic fragility analysis (which makes use of the seismic walkdown observations). The passive SSC failures and potential relay chatter effects are included in the SEL. These new passive failures need only be added to the list of seismic impacts requiring a plant response if they are modeled or affect an existing component in the plant response model.

This level of detail is adequate for the RICT application.

to ULNRC-06739 Responses to NRC Audit Questions Page 25 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application

18. Treatment of The expected correlation Representation of Not a key source of uncertainty correlated seismic of like components needs groups of components (Uncertainty has insignificant impact on failures to be identified and that are assumed to be PRA results and change in risk due to factored into the correlated. proposed changes).

quantification process.

The CEC SPRA is performed under the generic assumption of full correlation of seismically-induced failures of similar components. This is a recognized conservative assumption that is commonly used in the development of SPRAs and is consistent with the guidance of Reference [9] and the requirements of Reference [11].

While research activities are performed in the industry to investigate alternative modeling of potential correlations between seismic failures, these are judged not yet ready to be implemented in the CEC SPRA. Correlation grouping was initially determined based on equipment type and building location.

For dominant contributors, correlation grouping was iteratively refined where appropriate based on additional considerations consistent with SFR-A2 (e.g., building elevation, anchorage similarity, orientation, etc.). For significant fragility groups (FV > 2% for CDF or LERF), the basis for the correlation assumptions discussed in Reference [1] include the physical attributes of the equipment that were considered in the correlation decisions.

19. Treatment of Relay chatter can be This is not a source of Not a key source of uncertainty relay chatter another mechanism that model uncertainty from (Uncertainty has insignificant impact on impacts could impact the expected the plant response PRA results and change in risk due to response of systems or model. It is covered in proposed changes).

components. the fragility analysis above. This is treated under Topic 11.

to ULNRC-06739 Responses to NRC Audit Questions Page 26 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application

20. Seismically- The impact of seismically Treatment and/or Not a key source of uncertainty induced fire and induced fire or floods disposition of (Uncertainty has insignificant impact on flood events could impact the accident seismically induced fire PRA results and change in risk due to sequence progression or and flood events. proposed changes).

availability of components in response to seismic Seismic-Induced Fire events.

EPRI 3002000709 (Reference [9])

Appendix G systematically reviews each ignition source type for its susceptibility to seismic induced fire, ranking each as "negligible", "low", and "moderate".

Table 4-72 of Reference [1])

summarizes the bins identified with a "moderate" (highest ranking) susceptibility to seismic-induced fire.

Additionally, the bins associated with high energy non-safety electrical cabinets have been added to this review.

Seismic-Induced Flood The CEC SPRA relies on the internal flooding PRA for the identification, screening and modeling of seismic-induced flood scenarios. The two main references used to generate the Seismic Flood Evaluations are References [12] and [13].

All the fluid systems identified in the internal flooding PRA as potential flood sources are re-assessed for seismic specific considerations. Fluid systems were screened at the system level with the following two rationales:

1. The system is safety related and piping is seismic class I piping. If this is the case, the expected seismic capacity is considered high enough that any failure of the piping would be subsumed in the catastrophic failure of the buildings. The individual flood scenarios would not add any additional insights in the analysis.

2. The system relies on offsite power for the motive force supporting the flooding scenario, meaning:

a. Flooding would not be significant without pumping capacity (e.g., no gravity feed)

b. Motive power is not independent from offsite power (i.e., pumps are not to ULNRC-06739 Responses to NRC Audit Questions Page 27 of 75 Table 1: Review of Generic Seismic PRA Modeling Uncertainties from EPRI 1026511 Part of Model Applicability and Resolution for Topic Discussion of Issue Affected this Application loaded to the emergency diesel generator after a loss of offsite power event and are not diesel)

21. Simplification Since many passive This is a level of detail Not a key source of uncertainty of the system components and or completeness issue. (Uncertainty has insignificant impact on model structures have to be PRA results and change in risk due to included in a seismic PRA, proposed changes).

for the sake of efficiency the seismic PRA plant After initially populating the seismic response model usually equipment list from the internal events starts with an internal PRA, the IPEEE, and the Fukushima events model that is Near-Term Task Force 2.3 Seismic simplified via various Evaluation, the following plant assumptions on initiating information sources were used to events and systems, identify any additional SSCs that should structures and be added to the SEL: piping and components (SSCs). This instrumentation diagrams (P&IDs),

results in a simplified electrical diagrams (for offsite power, system model with a and emergency power), systems limited number of SSCs. notebooks for the internal events PRA The simplified model may (including ISLOCA), and the FPRA miss potentially significant component selection and MSO report.

contributions of one or Situation specific guidelines were more SSCs not modeled followed to ensure the SEL is tailored to due to the simplification. include all SSCs specific to SPRA and to disposition SSCs added from the internal events PRA and IPEEE that are not required for SPRA. This level of detail is adequate for the RICT application.

Table 1

References:

[1] Callaway Seismic Probabilistic Risk Assessment Modeling Notebook, P3463-SPRA-001/R001, May 2021.

[2] Rizzo report 11-4695A, Revision 0, Probabilistic Seismic Hazard Analysis - Seismic Probabilistic Risk Assessment - Callaway Energy Center, Unit 1.

[3] 15C4310-RPT-001, Revision 2, Civil Structures Screening Evaluation for CEC S-PRA.

[4] 15C4310-CAL-016, Rev. 1, Seismic Capacity Calculations for Buildings, Part 2.

to ULNRC-06739 Responses to NRC Audit Questions Page 28 of 75

[5] CN-RAM-17-007, Revision 2, Converted Callaway Model Additional Focused Updates.

[6] LTR-RAM-18-48, Revision 0, Callaway Seismic Database Verification & Validation for a Single-Use Application.

[7] 15C4310-RPT-003, Revision 3, Seismic Fragility Analysis Results of CEC Structures, Systems and Components.

[8] 15C4310-CAL-009, Rev.2, Summary of Relay Screening for CEC S-PRA.

[9] Seismic Probabilistic Risk Assessment Implementation Guide. EPRI, Palo Alto, CA:

2013, 3002000709.

[10] An Approach to Human Reliability Analysis for External Events with a Focus on Seismic.

EPRI, Palo Alto, CA: 2016. 3002008093.

[11] ASME/ANS RA-S CASE 1, Case for ASME/ANS RA-Sb-2013 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications.

[12] CN-RAM-16-018, Converted and Updated Callaway Internal Flooding Model, Revision 0.

[13] Callaway PRA-Flood Quantification Notebook, Revision 1.

to ULNRC-06739 Responses to NRC Audit Questions Page 29 of 75 APLA(C) Q-02 sources of modeling uncertainty (part b)

LAR Enclosure 9, Table E9-3, Assessment of Supplementary Fire PRA Epistemic Uncertainty, for the fire PRA, identifies the treatment of components without cable routing information as always failed to be a source of modeling uncertainty to address lack of cable data. The LAR further states that components deemed risk insignificant or with cable routing too complex to route are not credited in the PRA. Though the assumption that such components always fail in a fire scenario is conservative, NRC staff notes that this conservatism in fire PRA modeling could have a nonconservative impact on the RICT calculations given certain plant configurations. If an SSC is part of a system not credited in the fire PRA or supports a system that is assumed to always fail, then the increase in risk due to taking that SSC out of service could be masked. The LAR cites a sensitivity study that removes these failures concluding that the impact is non-negligible. The LAR states that to ensure the calculated RICTs for the uncredited functions are not significantly affected as a result of assuming the function always fails, RMAs will be developed for the affected RICT LCOs.

A related entry in LAR Enclosure 9, Table E9-3 labeled Treatment of unknown cable locations states, in part, It is common to not know specifically in a room where every cable is located.

The LAR states that as a result, All components and cables located in a Fire Area are assumed to be failed by the fire in that area. The extent of the use of this conservative modelling assumption is unclear, and therefore, its impact on the RICT application is not clear. As described above, modeling conservatism could have a nonconservative impact on the RICT Program.

Based on the observations above, it is not clear to NRC staff whether the level of modeling associated with the Lack of Cable Data and Treatment of unknown cable locations issues have no adverse impact on the RICT Program for the plant configurations allowed by the RICT Program. Furthermore, it is not clear whether and how RMAs will be developed for the affected RICT LCOs. Therefore, address the following:

Question APLA(C) Q-02.b.i

i. Identify any systems and components that are assumed to always fail in the fire PRA or fire areas where it is conservatively assumed that all components and cables located in a fire area are failed by the fire in that area (instrument air, main feedwater and condensate are already identified).

Response to APLA(C) Q-02.b.i The following systems are assumed failed for fire scenarios:

a) Instrument Air b) Hardened Condensate Storage Tank (HCST) c) Refueling Water Storage Tank (RWST) flow diversions d) Power Conversion System (PCS) - Main Feedwater and Condensate e) ATWS Mitigation Actuation Circuit (AMSAC) f) Cross-Tie Credit (SW Cross-Tie and PB Bus Cross-Tie) g) Normal Charging Pump (NCP) backup Cooling and Power h) Specific Containment Isolation Signal i) Fire Pumps - For non-fire mitigation functions j) Non-Safety Related General Area Cooling (Closed Cooling Water/Central Chilled Water) to ULNRC-06739 Responses to NRC Audit Questions Page 30 of 75 Question APLA(C) Q-02.b.ii For the systems or components identified in response to part i. above, provide justification to demonstrate (e.g., sensitivity study) that the treatment of these systems in the fire PRA or fire areas will not adversely impact the RICT Program. The sensitivity study should at minimum consider a set of LCOs identified as to the most affected by the modeling uncertainty and an estimated RICT less than the backstop of 30 days.

Response to APLA(C) Q-02.b.ii The always-failed basic events falling in the categories listed in the response to Item i were qualitatively evaluated for fire impacts. The qualitative evaluation determined, for each category, whether a quantitative sensitivity study was warranted, and, if so, which LCO conditions were expected to be most impacted by the modeling uncertainty. The results of the evaluation are listed in the table below.

Table 1. Qualitative evaluation of always-failed assumption on RICT calculation Always-Failed Basic Impact on RICT results Event SSC Category

a. Instrument Air (KA) Inconsequential. Loss of all instrument air is included in the initiator group for Turbine Trip with Loss of Main Feedwater (T2).

Instrument air is a support system for SG ASDs, condenser steam dump valves, and a backup for AFW flow control valves. A sensitivity was performed on the initial base PRA model that failed the instrument air system and it showed a delta CCDP of ~0. In addition, instrument air is highly vulnerable due to fire because of soldered piping and the numerous components that can fail the instrument air system.

b. Hardened Inconsequential. The HCST is a backup to the Condensate Condensate Storage Storage Tank (CST). The HCST is not evaluated directly in the Tank (HCST) LCO conditions, but the most closely related are LCO 3.7.5.B, 3.7.7.A, and 3.7.8.A. Therefore, assuming that it is always failed in the Fire PRA removes beneficial impacts of that redundancy, resulting in conservative RICT values for LCO 3.7.5.B, 3.7.7.A, and 3.7.8.A. This is evaluated with a sensitivity study on 3.7.5.B, 3.7.7.A, and 3.7.8.A provided in Table 2. The HCST and all other always failed basic events for Table 1 items c, f, g, and j in the baseline Fire PRA will, in the sensitivity study, remain immune to fire impacts. The evaluation shown in Table 2 shows no change to the amount of RICT days.

to ULNRC-06739 Responses to NRC Audit Questions Page 31 of 75 Table 1. Qualitative evaluation of always-failed assumption on RICT calculation Always-Failed Basic Impact on RICT results Event SSC Category

c. Refueling Water Inconsequential. The basic events that are failed are additional Storage Tank (RWST) redundancy to prevent the flow diversion of the RWST. The flow diversion prevention RWST is not evaluated directly in the LCO conditions, but the most closely related are LCOs 3.3.2.K and 3.5.2.A. Therefore, assuming that it is always failed in the Fire PRA removes beneficial impacts of that redundancy, resulting in conservative RICT values for LCO 3.3.2.K and 3.5.2.A. This is evaluated with a sensitivity study on 3.3.2.K and 3.5.2.A in Table 2. The RWST and all other always failed basic events for Table 1 items b, f, g, and j in the baseline Fire PRA will, in the sensitivity study, remain immune to fire impacts. The evaluation shown in Table 2 shows no change to the amount of RICT days.

d. PCS - Main Inconsequential. After a fire leading to reactor trip, the Feedwater and condensate/feedwater system is challenging to maintain and not Condensate (AE, AD) expected to remain available. Decay heat removal is performed via the AFW system. The condensate/main feedwater system is not credited for Safe Shutdown (SSD) and is not credited in the CEC fire procedures. Therefore, not crediting the condensate/feedwater system is considered to be realistic.

e. ATWS Mitigation Inconsequential. The AMSAC system is a back-up to failing to System Actuation Circuit automatically SCRAM or trip the turbine per the design of AMSAC.

(AMSAC) Since a fire-induced ATWS due to failure of the signal inputs is assumed to not occur due to the diversity of signals which can cause a reactor trip for a fire initiator in the CEC FPRA model. A sensitivity on the contribution of AMSAC, if credited in the FPRA, shows a contribution of 0.01%; therefore, the failure of the AMSAC has an inconsequential impact to the RICT calculations.

f. Cross-Tie Credit (SW Inconsequential. These are related to the normal service Cross-Tie, PB Bus water/Essential Service Water cross-tie valves and the normal Cross-Tie) service water power supply buss (PB 121/122/123 busses) cross-ties. Credit for the cross-tie valves is not evaluated directly in the LCO conditions, but the most closely related are LCOs 3.7.5.B, 3.7.7.A, and 3.7.8.A. These are selected because normal service water is a non-safety backup to the safety-related Essential Service Water system. Therefore, assuming that valve cross-ties and the electrical support cross-ties available within the normal service water system are always failed in the Fire PRA removes beneficial impacts of that redundancy, resulting in conservative RICT values for LCO 3.7.5.B, 3.7.7.A, and 3.7.8.A. This is evaluated with a sensitivity study on 3.7.5.B, 3.7.7.A, and 3.7.8.A in Table 2. The cross-tie credit and all other always failed basic events for Table 1 items b, c, g, and j in the baseline Fire PRA will, in the sensitivity study, remain immune to fire impacts. The evaluation shown in Table 2 shows no change to the amount of RICT days.

to ULNRC-06739 Responses to NRC Audit Questions Page 32 of 75 Table 1. Qualitative evaluation of always-failed assumption on RICT calculation Always-Failed Basic Impact on RICT results Event SSC Category

g. Normal Charging Inconsequential. The normal charging pump is credited as a non-Pump backup Cooling safety backup to the safety-related high head charging pumps but and Power only for the RCP seal injection function. Room cooling and a power cross-tie provide backup cooling (as opposed to opening the doors which has been shown to ensure appropriate room temperatures) and power to the normal charging pump. The backup cooling and power to the normal charging pump are not evaluated directly in the LCO conditions, but the most closely related are LCOs 3.4.11.B and 3.5.2.A. Therefore, assuming these backup support functions for this backup non-safety pump are always failed in the Fire PRA removes beneficial impacts of that redundancy, resulting in conservative RICT values for LCO 3.4.11.B and 3.5.2.A. This is evaluated with a sensitivity study on 3.4.11.B and 3.5.2.A in Table 2. The backup cooling and power to the normal charging pump and all other always failed basic events for Table 1 items b, c, f, and j in the baseline Fire PRA will, in the sensitivity study, remain immune to fire impacts. The evaluation shown in Table 2 shows no change to the amount of RICT days.

h. Specific Containment Inconsequential. This assumed failed function is related to Isolation Signal radiation monitor-initiated containment purge valve isolation and is covered by LCO 3.3.6 which is not in scope for the RICT program.

This assumed failed function could be seen as a partial backup to the normal containment isolation signals but only for the purge valves. Since the containment isolation signal logic is diverse and has several signals to close the valves, only the ones that were considered most likely to actuate during a fire event were credited.

i. Fire Pumps - for non- Inconsequential. No credit for fire pumps to provide RWST fire mitigation functions makeup or pump cooling in RCP seal LOCA scenarios. The fire pumps are credited for their fire suppression function only; they are not credited in the Fire Safe Shutdown procedures.

to ULNRC-06739 Responses to NRC Audit Questions Page 33 of 75 Table 1. Qualitative evaluation of always-failed assumption on RICT calculation Always-Failed Basic Impact on RICT results Event SSC Category

j. Non-Safety Related Inconsequential. The non-safety related general area cooling is General Area Cooling required for instrument air (always failed), the normal charging (Closed Cooling pump, and the Main Feedwater and Condensate system (always Water/Central Chilled failed). The normal charging pump has an operator action credited Water) to open the NCP room doors within 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> which is a reliable action. The backup room cooling function and the associated impact on the RICT program are dispositioned in Item g. above.

The instrument air and the MFW and Condensate system are dispositioned in items a and d above. The non-safety general area cooling functions are evaluated directly in the LCO conditions, but the most closely related are LCOs 3.4.11.B and 3.5.2.A.

Therefore, assuming that it is always failed in the Fire PRA removes beneficial impacts of that redundancy, resulting in conservative RICT values for LCO 3.4.11.B and 3.5.2.A. This is evaluated with a sensitivity study on 3.4.11.B and 3.5.2.A in Table

2. The non-safety general area cooling and all other always failed basic events for Table 1 items b, c, f, and g in the baseline Fire PRA will, in the sensitivity study, remain immune to fire impacts.

The evaluation shown in Table 2 shows no change to the amount of RICT days.

The results of the sensitivity studies identified in Table 1 are given in Table 2. For each LCO condition identified in Table 1 as object of the sensitivity study, the minimum RICT was calculated. All previously always-failed basic events associated with SSCs that were assigned a sensitivity study in Table 1 (i.e., Items b, c, f, g, and j) were assumed to now be immune from fire impacts. Considering an expanded set of basic events immune to fire impacts provides added confidence that the sensitivity studies considered are appropriate.

Table 2. Sensitivity study RICT calculation results Case Description of LCO Baseline Sensitivity Comment (Note 1) condition (Note 1) Min RICT Min RICT Days Days (Note 2)

(Note 2) 3.3.2.K ESF Actuation - One 365.0 365.0 Sensitivity study shows no Channel Inoperable decrease in the RICT days value of the baseline case.

3.4.11.B One PORV inoperable 105.6 105.7 Sensitivity study shows no for reasons other than decrease in the RICT days excessive seat leakage value of the baseline case.

3.5.2.A One or more trains 101.9 110.1 Sensitivity study shows no inoperable. decrease in the RICT days AND value of the baseline case.

At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available.

to ULNRC-06739 Responses to NRC Audit Questions Page 34 of 75 Table 2. Sensitivity study RICT calculation results Case Description of LCO Baseline Sensitivity Comment (Note 1) condition (Note 1) Min RICT Min RICT Days Days (Note 2)

(Note 2) 3.7.5.B One ESW supply to 365.0 365.0 Sensitivity study shows no turbine driven AFW decrease in the RICT days pump inoperable. value of the baseline case.

3.7.7.A One CCW train 69.6 69.6 Sensitivity study shows no inoperable. decrease in the RICT days value of the baseline case.

3.7.8.A One ESW train 16.1 16.8 Sensitivity study shows no inoperable. decrease in the RICT days value of the baseline case.

Notes:

1. Technical specification (TS) condition case.

2. RICT days are given a maximum value of 365 days in this table to provide a higher resolution on the sensitivity results, the actual programmatic backstop is 30 days.

Question APLA(C) Q-02.b.iii As an alternative to part i. and ii. above, identify the LCO conditions impacted by the treatment of this modelling uncertainty, along with potential RMAs that will be applied for the associated RICT. Include justification for why the application of RMAs will be sufficient to address the modeling uncertainty.

Response to APLA(C) Q-02.b.iii Based on the results of Tables 1 and 2, the SSCs assumed to be always-failed in the Fire PRA have an inconsequential or conservative impact on RICT calculations. As such, no RMA is needed, however, it is noted that the RICT Program implementation procedure, APA-ZZ-00315 Appendix D, will cause all RICT configuration-specific risk contributors, from all modeled hazards, to be evaluated for appropriate RMAs.

to ULNRC-06739 Responses to NRC Audit Questions Page 35 of 75 APLA(C) Q-02 sources of modeling uncertainty (part c)

Concerning the fire PRA, portal report PRA-IE-UNCERT_APP5, Revision 1, Disposition of Key Uncertainties: Risk Informed Completion Times (RITS 4b), indicates that one of the important fire PRA frequently asked questions (FAQs) issued by the NRC for fire PRAs may not have been fully addressed. The report states that FAQ 14-0009, Treatment of Well-Sealed MCC

[Motor Control Center] Electrical Panels Greater than 440V [volts], (ADAMS Accession No. ML15040A136) is not incorporated into the scoping fire modeling; partially incorporated in the detailed fire modeling. NRC staff notes that the FAQ 14-0009 guidance was issued after NRC issued its SE for Callaways adoption of the National Fire Protection Association 805 program in January 2015. The guidance in FAQ 14-0009 provides the technique for evaluating fire damage from well-sealed MCC cabinets having a voltage greater than 440 V. Accordingly, propagation of fire outside the ignition source panel must be evaluated for all MCC cabinets that house circuits of 440 V or greater. Based on these observations, provide the following:

Question APLA(C) Q-02.c.i

i. Describe how fire propagation outside of well-sealed MCC cabinets greater than 440 V is evaluated for the Callaway fire PRA model.

Response to APLA(C) Q-02.c.i As documented in FAQ 14-0009, well-sealed, robustly-secured MCCs operating at 440V or greater must assume that there is a potential for fire propagation from all cubicles within the MCC. Contrary to this, currently at Callaway plant, only one vertical section in each MCC is treated as a vented, propagating scenario, and the remaining vertical sections are treated as non-propagating, which is not consistent with the method provided in the FAQ.

An exception is the fire modeling for NG01A and NG02A in Fire Areas C-9 and C-10 which has been updated with the new FAQ guidance and combined with the heat release rate revisions in NUCRG-2178. This update found that the total frequency of scenarios resulting in source only damage increased and the frequency of scenarios mapping to the 'suppression fails' damage state (the propagating fire scenario) decreased when the guidance of the FAQ was implemented and thus the original method, prior to the FAQ, produced bounding and conservative results. This update is not documented as a sensitivity study that encompasses all MCCs at Callaway plant but is exclusively an update to NG01A and NG02A. The analysis was performed as part of EPM Modification Review of MP 16-0024 documented in Report R2830-001-002 Revisions 0 and 1. The fire suppression event trees are documented in Calculation 17671-005A.

There are currently still 19 MCCs (see table below) that use the original methodology for modeling MCCs at Callaway. The reason for the lower priority for this update is that, based on the NG01A and NG02A work, the overall results for the remaining MCCs are expected to be bounding compared to the methodology of the FAQ. In addition, there is currently no regulatory backfit vehicle requiring the FAQ to be incorporated. Therefore, as the current results are believed to most likely be bounding and there is no regulatory requirement to implement the guidance for reasons other than the PRA maintenance process, such as a Generic Safety Issue, the priority of this update has been low.

to ULNRC-06739 Responses to NRC Audit Questions Page 36 of 75 Callaway MCC Scenarios that do not use FAQ 14-0009 Fire Fire Ignition Source Ignition Source ID Compartment Zone Description A-1 1120 PG20N-NonVented 480V MCC PG20N A-1 1122 PG19N-NonVented 480V MCC PG19N A-17 1409 NG02B-NonVented 480V MCC NG02B A-18 1410 NG01B-NonVented 480V MCC NG01B A-21 1501 NG04C-NonVented MCC NG04C A-22 1512 NG03C-NonVented MCC NG03C MCC PG19G-A-27 1403 480V MCC PG19G NonVented MCC PG20G-A-27 1403 480V MCC PG20G NonVented D-1 5203 NG03D-NonVented 480V MCC NG03D D-2 5201 NG04D-NonVented 480V MCC NG04D RB-1 RB5 PG20P-Nonvented MCC 480V PG20P TB-1 4401 PG14R-NonVented 480V MCC PG14R TB-1 4351 PG11J-NonVented 480V MCC PG11J TB-1 4351 PG12J-NonVented 480V MCC PG12J TB-1 4401 PG11K-NonVented 480V MCC PG11K TB-1 4401 PG12K-NonVented 480V MCC PG12K TB-1 4401 PG13Q-NonVented 480V MCC PG13Q TB-1 4401 PG13R-NonVented 480V MCC PG13R TB-1 4401 PG14Q-NonVented 480V MCC PG14Q to ULNRC-06739 Responses to NRC Audit Questions Page 37 of 75 Question APLA(C) Q-02.c.ii ii. If fires are not propagated outside of well-sealed MCC cabinets greater than 440 V, provide justification (e.g., sensitivity study) that this treatment has no adverse impact on the RICT Program. The sensitivity study should at minimum consider a set of LCOs identified as the most affected by the modeling uncertainty and an estimated RICT less than the backstop of 30 days.

Response to APLA(C) Q-02.c.ii A sensitivity analysis has been performed using the guidance from FAQ 14-0009 Treatment of Well-Sealed MCC Electrical Panels Greater than 440V. The scope of the sensitivity analysis included MCCs that were previously fire modeled assuming that a fire originating from well-sealed vertical sections was limited to the source-only. This consisted of 19 MCCs total and the following was completed for each:

• The generic factor FE (fraction of MCC fires that are energetic enough to breach the well-sealed MCC enclosure) 0.23 was applied to each vertical section that had all well-sealed cubicles.

• The corresponding 0.77 factor was applied to a scenario that failed the MCC only.

• Vertical sections with vented MCC cubicles did not apply the 0.23 (FE) factor.

• A severity factor (FD) was not calculated, and a 1.0 probability is assumed due to the lack of information from additional walkdowns not yet being available.

• This results in a conservative CDF as opposed to implementing the entire guidance of FAQ 14-0009. If calculated, a severity factor would be estimated to provide an additional factor of 2 to 4 reduction in the calculated CDF from this sensitivity.

• Target sets that were previously developed for the vented cabinet sections were reviewed for applicability to all vertical sections of the MCCs.

• These target sets were modified in one case to conservatively map to a new whole zone damage scenario. Target set for the new whole zone damage scenario included all targets listed in the Fire Zone (4401) in SAFE.

• The resultant scenarios were mapped to existing FRANX scenarios, except for the one case that a new whole room burn scenario was needed.

to ULNRC-06739 Responses to NRC Audit Questions Page 38 of 75 The results of this sensitivity are presented in the table below:

Base Sensitivity Delta %Change CDF 1.18E-05 1.20E-05 2.18E-07 1.8%

Estimate if a Severity Factor were calculated and resulted in a factor of 1.09E-7 0.92%

2 reduction Estimate if a Severity Factor were calculated and resulted in a factor of 5.45E-8 0.46%

4 reduction The results of this sensitivity show that the impact of implementing FAQ 14-0009 is small.

Evaluating the uncertainty of not fully implementing FAQ 14-0009 in the current model; this would not be identified as a Key Uncertainty and no further sensitivity studies are warranted.

to ULNRC-06739 Responses to NRC Audit Questions Page 39 of 75 APLA(C) Q-02 sources of modeling uncertainty (part d)

LAR Enclosure 9, Table E9-5, Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty, for the seismic PRA, concerning Model Sensitivity to Seismic HRA [Human Reliability Analysis] Bin Definitions, identifies the treatment of seismic bin definitions as having a potentially significant impact on the baseline risk results. The LAR states, that there is no reasonable alternative to the modeling used, therefore additional sensitivity studies for the RICT application were not performed. Portal report PRA-IE-UNCERT_APP3, Revision 0, Seismic Uncertainty Analysis and Sensitivities, states that sensitivity studies were performed in which the seismic HRA bins were shifted up and down one level and that the impacts on the seismic results were noticeable but not significant to the point they would distort the results. The meaning of this disposition is not completely clear to NRC staff.

Table 3-6 of the report provides the results of four sensitivity cases indicating that the general uncertainty associated with the failure probability of seismic HFEs have a significant impact on seismic core damage frequency (CDF) (e.g., in Case 3, the seismic CDF increases by a factor of 162 percent if the failure probability of these HFEs is increased by a factor of 10). NRC staff notes that the uncertainty associated with seismic HRA bins is addressed in the Callaway 10 CFR 50.69 SE (ADAMS Accession No. ML21344A005) through HRA sensitivity studies that are part of the 10 CFR 50.69 risk-informed categorization process. In consideration of these observations address the following Question APLA(C) Q-02.d.i

i. Provide justification (e.g., sensitivity) that the treatment of seismic HRA bins do not have an adverse impact on the RICT Program. The sensitivity study should at minimum consider a set of LCOs identified to the most affected by the modeling uncertainty and an estimated RICT less than the backstop of 30 days.

to ULNRC-06739 Responses to NRC Audit Questions Page 40 of 75 Response to APLA(C) Q-02.d.i Consistent with the guidance in the recognized industry sources as described in Report PRA-IE-UNCERT_App 5, Rev. 001, the following guidance was used to screen sources of model uncertainty for the RICT evaluation as described in the PRA-IE-UNCERT_App 5 report:

• The uncertainty/assumption is implemented using a consensus model as defined in Section 7.2.4 of NUREG-1855 Revision 1

• The uncertainty/assumption represents a conservative bias in the PRA model and removing the identified conservative bias would make an already acceptable calculated risk metric more acceptable compared to the acceptance guidelines. This criterion is consistent with the guidance in Section 3.1.1 of EPRI 1016737

• There is no reasonable alternative to the assumption which would produce different results and/or there is no reasonable alternative that is at least as sound as the assumption being challenged. This criterion is consistent with Section 3.3.2 of Regulatory Guide 1.200 Revision 2.

Some clarification may be necessary - the question states, "Table 3-6 of the report provides the results of four sensitivity cases indicating that the general uncertainty associated with the failure probability of seismic HFEs have a significant impact on seismic core damage frequency (CDF)

(e.g., in Case 3, the seismic CDF increases by a factor of 162 percent if the failure probability of these HFEs is increased by a factor of 10)." This is true but applies to a sensitivity related to the independent failure HEP values. This appears to be the basis for part "i" of the question, which refers to the seismic binning of HFE impacts related to the EPRI 1016737 method. While there is a sensitivity in the SPRA uncertainty notebook related to the selection of bins for HRA impacts, the sensitivity results noted in APLA(C) Q2.d are not directly related.

Regarding the uncertainty of human error probabilities with seismic considerations, Sensitivity Case 3, as referenced in the question (where the HFEs were increased by a factor of 10), the results showed the combinations and independent contributors were both associated with decay heat removal and alignment of the alternate emergency power system (AEPS) power supply for low to moderate seismic events. Comparison with the baseline importance indicates the same contributions being in the top 10 cases. Therefore, the insights gained from the baseline assessment are not significantly altered by the sensitivity and is an indication that uncertainty aspects of the HFE assessment would not tend to drive the overall uncertainty distribution such that the conclusions would be subject to significant uncertainty biased in one direction or the other under the RICT program.

Regarding the treatment of seismic HRA bins Callaway's implementation represents the industry approach that has a publicly available published basis for seismic HEP binning consistent with EPRI-3002008093, "An Approach to Human Reliability Analysis for External Events with a Focus on Seismic" and is therefore considered a consensus model or process. In addition, there currently is no accepted "reasonable alternative" to the approach provided in EPRI 3002008093 and implemented in the Callaway SPRA.

An inherent uncertainty associated with the SPRA development relates to the binning for the to ULNRC-06739 Responses to NRC Audit Questions Page 41 of 75 HEP seismic hazard groups to the number of seismic hazard bins modeled in the SPRA. In previous revisions of the Callaway SPRA quantification notebook (PRA-SPRA-002) a sensitivity study was performed to address the uncertainty regarding the cut-off definitions. The study looked at shifting cut-off breaking points down, up, and extending the breaking points for various bins. The previous study showed negligible changes in results for most cases except for the case in which the breaking point were shifted up (i.e., taking less credit for seismic-specific HFEs at lower g-levels). Although, the changes for this case were significant, the current binning is appropriate based on the following:

1. The current bin definitions used in the Callaway SPRA model are consistent with the guidance in EPRI 3002008093 An Approach to Human Reliability Analysis for External Events with a Focus on Seismic

2. The current bin definitions are realistic based on the relevant component fragilities used to define plant damage.

It is expected that the previous sensitivity results would reflect the impact of the current model if the sensitivity study was re-performed; therefore, the sensitivity study was not re-performed for the current model. The combination of the assessment above and previous sensitivity results are considered adequate to characterize the uncertainty. Additionally, the sensitivity of the model to the HFEs is assessed through an HRA ranking sensitivity such that individual HFEs can be targeted for future refinement strategies.

Question APLA(C) Q-02.d.ii ii. As an alternative to part (i) above, identify the LCO conditions impacted by the treatment of this modelling uncertainty, along with potential RMAs that will be applied for the associated RICT. Include justification for why the application of RMAs will be sufficient to address the modeling uncertainty.

Response to APLA(C) Q-02.d.ii In addition to the basis provided in Q02.d.i above, based on discussion during the audit, the software used for calculating RICT configurations has the ability to show risk significant operator actions, based on the RICT-specific configuration, and this information will be reviewed and considered for RMAs specific to risk significant operator actions. Proposed procedure APA-ZZ-00315 Appendix D currently has the following guidance related to this topic:

4.5 Risk Management Actions 4.5.1 Implement the RMAs at the earliest appropriate time as determined to be necessary for the specified plant configurations as follows:

• The evaluation of necessary configuration-specific RMAs will be informed by the risk contributions from the Internal Events, Fire, Flooding, High Winds, and Seismic Models, as well as operational knowledge, based on the Plant configuration(s) during the RICT period

• The evaluation will consider RMAs to protect the known configuration-specific risk profile, as well as mitigate the risk associated with the profile. Protection and/or mitigation RMAs will consider the following:

to ULNRC-06739 Responses to NRC Audit Questions Page 42 of 75 o Mitigation of important initiating events o Protection of mitigation equipment important to the configuration o Restoration of important OOS mitigation equipment o Reliance on Operator actions important to the configuration Development of configuration-specific RMAs related to important operator actions from any quantified Hazard is adequate to address uncertainties related to the HRA uncertainty contributions to a given RICT configuration.

to ULNRC-06739 Responses to NRC Audit Questions Page 43 of 75 APLA(C) Q-02 sources of modeling uncertainty (part e)

Epistemic Uncertainty, for the HW PRA states that based on sensitivity study results that the HW CDF was found to be sensitive to the modeling uncertainty associated with power grid fragility to HW, but that the fragility used in the HW PRA is a reasonable estimate. The LAR also notes that power grid recovery is not credited at any wind speed though recovery is credible for low to moderate wind speeds, which are the wind speeds for which the power grid fragility is uncertain. PRA-IE-INECERT_APP4, Revision 0, High Wind Uncertainty Analysis and Sensitivities, indicates that the sensitivity of the HW CDF to power grid wind fragility is significant. It is not clear to NRC staff that this source of modeling uncertainty has no adverse impact on the RICT Program. In consideration of these observations address the following:

Question APLA(C) Q-02.e.i

i. Provide justification (e.g., sensitivity that the treatment of power grid fragility in the HW PRA does not have an adverse impact on the RICT Program. The sensitivity study should at minimum consider a set of LCOs identified as the most affected by the modeling uncertainty and an estimated RICT less than the backstop of 30 days.

Response to APLA(C) Q-02.e.i The uncertainty item that originally generated this question was centered around the dominance of the LOOP (grid) fragility in the baseline high winds results and uncertainty around the potential conservatism of the grid fragility assumptions. Over-conservatism in the grid fragility assumptions in the F1 wind speed range (highest frequency events) could potentially mask other contributors not related to grid failures. While engineering judgement was applied using the best available information, it is possible that the assumed grid fragilities are overly conservative, and this is potentially exacerbated by the assumption that recovery of offsite power following a HW event is infeasible despite industry data showing some feasibility in recovering offsite power within the PRA mission time. The following sensitivity quantifies the results for selected cases where the LOOP fragility in the High Winds model is assumed to be zero (perfectly reliable) and then assesses the RICT calculation for the LCOs deemed to be most impacted by the HW LOOP fragility uncertainty. The results are as follows:

Tech SSCs Covered by TS LCO Spec. Example Failure Condition Case One AFW train inoperable for reasons TDAFP FAILS TO START 3.7.5.C.2 other than Condition A or B.

ESF XFMR XNB01 FAILS TO 3.8.1.A.1 One offsite circuit inoperable FUNCTION DIESEL GENERATOR NE01 FAILS 3.8.1.B.1 One DG inoperable TO START ESW PUMP A (PEF01A)FAILS TO 3.7.8.A.1 One ESW train inoperable START to ULNRC-06739 Responses to NRC Audit Questions Page 44 of 75 Changes to BE for HW GRID Sensitivity Run Origina Sensitivit Basic Event BE Description l Prob y Prob HW_GRID-FRAGIL-F1-1 Grid fragility after F1-1 high wind IE 0.1 0 HW_GRID-FRAGIL-F1-2 Grid fragility after F1-2 high wind IE 0.4 0 HW_GRID-FRAGIL-F1-3 Grid fragility after F1-3 high wind IE 0.7 0 HW_GRID-FRAGIL- Grid fragility after F2 / F3 / F4 / F5 high 1 0 F2345 wind IE NO-HW_GRID-FRAGIL-No grid fragility after F1-1 high wind IE 0.9 1 F1-1 NO-HW_GRID-FRAGIL-No grid fragility after F1-2 high wind IE 0.6 1 F1-2 NO-HW_GRID-FRAGIL-No grid fragility after F1-3 high wind IE 0.3 1 F1-3 GRID HW CDF Sensitivity Run Tech Spec. Original RICT HW HW CDF Sensitivity HW Sens HW Case CDF Delta CDF CDF Delta 3.7.5.C.2 3.28E-05 2.85E-05 1.63E-05 1.14E-05 3.8.1.A.1 1.51E-05 1.09E-05 2.82E-05 2.33E-05 3.8.1.B.1 4.26E-05 3.83E-05 5.06E-06 1.72E-07 3.7.8.A.1 7.57E-05 7.14E-05 3.10E-05 2.61E-05 Tech Spec. Original RICT Sensitivity RICT Case (days) (days) 3.7.5.C.2 30 30 3.8.1.A.1 30 29 3.8.1.B.1 30 30 3.7.8.A.1 16.1 20.1 Note the RICT values presented above are calculated using the total delta CDF value (deltas from FPIE, FIRE, HW, Seismic, and Flood).

The set of LCOs above are expected to be the most affected by the modeling uncertainty introduced by the HW grid fragility included in the HW model and includes an estimated RICT, requested during the NRC audit, where the baseline RICT might be impacted and is less than the backstop of 30 days (3.7.8.A).

It is noted that for T/S LCO 3.7.8.A.1 there is a moderate impact on the calculated RICT, however, this impact is in the conservative direction, meaning that if the LOOP fragility were to to ULNRC-06739 Responses to NRC Audit Questions Page 45 of 75 be refined or LOOP recovery were to be credited, the calculated RICT would increase, allowing more time in the RICT condition than the current model would indicate. This potential conservatism is deemed acceptable as it provides a more restrictive RICT, and thus, does not have an adverse impact on the RICT program.

to ULNRC-06739 Responses to NRC Audit Questions Page 46 of 75 APLA(C) Q-02 sources of modeling uncertainty (part f)

Concerning the HW PRA, portal report PRA-IE-UNCERT_APP4, Revision 0, explains for safety equipment vulnerabilities associated with openings in Seismic Category 1 structures that it is assumed HW missile impacts result in core damage (and possibly large early release). The report acknowledges this is a conservative approach because the physical separation of the redundant trains of safety-related equipment makes it unlikely that a postulated HW missile through a small opening in the Seismic Category 1 structure would cause the failure of equipment in both trains. The report presents the results of a sensitivity study in which only one train of the safety equipment is assumed to be failed showing that there is an 89 percent decrease in LERF compared to the base case. The report also states that this modeling uncertainty has a significant impact on risk and should be evaluated in more detail in the future. The NRC staff notes that overly conservative modeling can mask the risk significance, potential for a RICT. In consideration of these observations address the following:

Question APLA(C) Q-02.f.i

i. Provide justification (e.g., sensitivity study) that the modeling uncertainty does not have an adverse impact on the RICT Program. The sensitivity study should at minimum consider a set of LCOs identified as the most affected by the modeling uncertainty and an estimated RICT less than the backstop of 30 days.

Response to APLA(C) Q-02.f.i The sensitivity referenced by this question was recognized as a future refinement at the time it was generated. The priority of this refinement at the time the current model was issued was based on the fact that due to Callaway's design (large dry containment) it is exceedingly rare for LERF to be the limiting risk metric. However, due to the potential impact on uncertainty in the RICT program, among other things, this refinement was scoped into the currently in-progress PRA update. This PRA update (PRA Update 10) is expected to be issued prior to implementation of the RICT program.

The refinements referenced above essentially eliminate this uncertainty and were fully developed and incorporated into the current draft HW PRA model associated with Update 10. A sensitivity on this refined modeling using the current HW PRA model of record is provided in the table below:

Model Base Sensitivity Delta %Change (Truncation)

CDF 5.89E-06 5.78E-06 -1.10E-07 - 2%

(5E-12)

LERF 2.55E-07 4.56E-09 -2.50E-07 - 98%

(5E-12)

These results are consistent with expectations as the direct to CDF assumptions were previously refined and direct to LERF assumptions were known to be impactful. However, as stated above, LERF is rarely the limiting metric and thus these refinements were designated for a later PRA update at the time this uncertainty was identified.

to ULNRC-06739 Responses to NRC Audit Questions Page 47 of 75 Based on these refinements, there are still 9 targets that are assumed to be direct to CDF and 27 targets assumed direct to LERF. However, none of the remaining direct damage targets contribute to the results, except for missile group 36 which shows a F-V of approximately 32%

for LERF (negligible for CDF). While refinement of missile group 36 may reduce the direct damage assumption contribution to LERF (if it were made perfectly reliable, LERF would be approximately 3E-9), the current results already show LERF to be 3 orders of magnitude below CDF, which is sufficient to remove it as a Key Source of Uncertainty for the RICT application.

These results are developed from a sensitivity on the current HW model; when these refinements are carried forward into the ongoing PRA update, the impact of the remaining direct release assumptions are expected to be similar although the CDF and LERF values may be slightly different. Regardless of the updated CDF and LERF baselines, these refinements essentially eliminate the originally identified uncertainty.

Since the noted refinements have yet to be incorporated into the PRA model of record but should be incorporated prior to implementation of the RICT program (i.e., prior to implementation of the requested license amendment), completion of PRA Update 10 has been determined to be an implementation item for which a License Condition has been deemed necessary, based on discussion with the NRC staff. Proposed License Condition 2.(C).20 is therefore now part of the changes being proposed per the license amendment request.

to ULNRC-06739 Responses to NRC Audit Questions Page 48 of 75 APLA(C) Q-02 sources of modeling uncertainty (part g)

Concerning the internal flooding (IF) PRA, portal report PRA-IE-UNCERT_APP1, Revision 1, Internal Flooding Uncertainty Analysis and Sensitivities, identifies treatment of major IF scenarios as a source modeling uncertainty and presents the results of a sensitivity study showing it to have a significant impact on IF CDF. The analysis concludes that refinement focus on major flood events can result in a significant reduction in overall CDF, and that major flooding scenarios in Turbine Bay 1 are one of most significant contributors to IF CDF due to this conservative treatment. LAR Enclosure 9, Table E9-1 for the IE (including flooding) does not disposition this source of modeling uncertainty (or any other source of IF specific modeling uncertainty). The NRC staff notes that overly conservative modeling can mask the risk significance potential for a RICT. In consideration of these observations address the following:

Question APLA(C) Q-02.g.i

i. Provide justification (e.g., sensitivity study) that the IF modeling uncertainty does not have an adverse impact on the RICT Program. The sensitivity study should at minimum consider a set of LCOs identified as the most affected by the modeling uncertainty and an estimated RICT less than the backstop of 30 days.

Response to APLA(C) Q-02.g.i In general, the Callaway internal flooding (IF) PRA takes a conservative approach to generating flood scenarios. This process involves generating scenarios with the worst-case impacts, and then performing refinements on risk-significant scenarios. The scenarios are refined until there is a diminished return on effort involving refinement of the scenario. This process is aligned with the current state-of-practice for performing IF PRA, and was found technically adequate during peer reviews. For the Callaway IF PRA the top contributors to CDF involve various flood and major flood scenarios as major floods are typically the dominant contributors to IF PRA. Given that major floods generally involve system-specific flow rates and unique inundation of equipment in areas of the plant, each scenario must be evaluated individually to reduce the impact on CDF. As mentioned above, this process is performed until the refinement efforts result in diminished returns for the given scenario. After this process it is still expected that major floods will be the dominant contributors, and to have a significant reduction in overall CDF a more advanced analysis (such as a flood physics mode (e.g., GOTHIC, or a smoothed-particle hydrodynamics approach)) would need to be generated which goes above the current state of practice for IF PRA. The flood scenarios in the Turbine Bay are one of the top contributors, but these major floods (individually contributing >1%) account for only approximately 5% of the IF PRA CDF. Since the impacts of this scenario are conservatively assigned, and that the relative risk from these scenarios is relatively small, no advanced refinements were performed. The scenarios were refined until a diminished return on effort was encountered. The statement in the flooding uncertainty notebook that "Zone TB-1 continues to be one of the most significant contributors to IF CDF, and is a result of conservative treatment in the flood impacts," was intended to refer to the accepted practice of initially assigning conservative impacts and not applying extraordinary refinement effort unless warranted, and to acknowledge that Zone TB-1, as a top individual contributor, would be an appropriate target for any future refinement efforts.

The same process for developing major flood scenarios was used consistently across the flooding model. Thus, any conservatisms, or non-conservatisms, inherent in the process are to ULNRC-06739 Responses to NRC Audit Questions Page 49 of 75 consistently applicable across the model, and the treatment of major floods in the TB-1 flood area is not "overly conservative" with respect to the treatment of any other area. The process applied to all areas is aligned with the current state-of-practice for performing IF PRA, and was found technically adequate during peer reviews; therefore, the treatment of major floods in the TB-1 area are not considered to be "overly conservative" such that special treatment would be necessary under the RICT program.

Given that the impact to SSCs might be, in some cases, conservative for a given scenario, it is the accumulation of multiple component unavailabilities that provide alternative risk insights than from the average test and maintenance internal events model. Given certain equipment is taken out of service in the RICT model the conservative choices in the IF PRA model are not expected to significantly impact the delta risk calculations.

Finally, the assumptions and sources of uncertainties for the IF PRA model were reviewed in conjunction with the other hazards. This involved review of generic and plant-specific assumptions and uncertainties, of which a final set of key assumptions and sources of uncertainty were provided in the LAR. The focus of this process was to focus on items that could impact the calculation of a completion time. Conservative assumptions made in the baseline PRA model are expected to have conservative impacts in the RICT model.

Question APLA(C) Q-02.g.ii ii. As an alternative to i. above, identify the LCO conditions impacted by the treatment of this modelling uncertainty, along with potential RMAs that will be applied for the associated RICT. Include justification for why the application of RMAs will be sufficient to address the modeling uncertainty.

Response to APLA(C) Q-02.g.ii In addition to the basis provided in Q02.g.i above, based on discussion during the audit, the software used for calculating RICT configurations has the ability to show risk significant Hazard scenarios, based on the RICT-specific configuration, and this information will be reviewed and considered for RMAs specific to risk significant flooding initiators. Proposed procedure APA-ZZ-00315 Appendix D currently has the following guidance related to this topic:

4.5 Risk Management Actions 4.5.1 Implement the RMAs at the earliest appropriate time as determined to be necessary for the specified plant configurations as follows:

• The evaluation of necessary configuration-specific RMAs will be informed by the risk contributions from the Internal Events, Fire, Flooding, High Winds, and Seismic Models, as well as operational knowledge, based on the Plant configuration(s) during the RICT period.

• The evaluation will consider RMAs to protect the known configuration-specific risk profile, as well as mitigate the risk associated with the profile. Protection and/or mitigation RMAs will consider the following:

o Mitigation of important initiating events o Protection of mitigation equipment important to the configuration to ULNRC-06739 Responses to NRC Audit Questions Page 50 of 75 o Restoration of important OOS mitigation equipment o Reliance on Operator actions important to the configuration Development of configuration-specific RMAs related to important flooding scenarios is adequate to address uncertainties related to the flooding scenario uncertainty contributions to a given RICT configuration.

to ULNRC-06739 Responses to NRC Audit Questions Page 51 of 75 APLC Q "External Event Plant Configurations Impacts Section 2.3.1, Configuration Risk Management Process and Application of Technical Specifications, Item 7, of NEI 06-09, Revision 0-A, states, in part, that the impact of other external events risk shall be addressed in the RMTS program, and explains that one method to do this is by documenting prior to the RMTS program that external events that are not modeled in the PRA are not significant contributors to configuration risk. The SE for NEI 06-09 states that [o]ther external events are also treated quantitatively, unless it is demonstrated that these risk sources are insignificant contributors to configuration-specific risk.

In Section 3.2, Impacts to RICT, of Enclosure 4, Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models, to the LAR, the licensee concluded that all non-modeled external hazards are screened for all RICT configurations. The licensee specifically discussed those hazards that are screened using criteria other than C2 through C5. However, the licensee did not include external flooding, intense precipitation, and waves in this list for evaluation of RICT configurations. These hazards are screened based on Criterion C1 (or partially) in LAR Enclosure 4, Table E4-1, External Hazards Screening, but are not discussed for plant configurations in Section 3.2 of Enclosure 4 of the LAR.

Question APLC Q-01 Confirm that plant configurations for external flooding, intense precipitation, and waves hazards have no impact on the proposed RICTs. "

Response to APLC Q-01 The observation in this question is correct; LIP, Waves and by extension, External Flooding should be included in the Enclosure 4, Section 3.2, bullet list of external hazards screened using criteria other than C2-C5. The LAR bullet list is revised to correct this omission.

The screening of these hazards has been peer reviewed under Part 6 of the ASME/ANS RA-Sa-2009 PRA Standard. This screening approach meets CCII or higher and has no open findings.

Based on this modeling approach, these hazards have negligible impact in the quantitative PRA models and the calculation of RICTs. In addition, there are no SSCs, other than the power block buildings themselves, that are credited in mitigation or screening of LIP, Waves and External Flooding. Therefore, they screen regardless of plant configuration and have no impact on LCOs in scope of the RICT program.

A summary of the screening of each is provided below.

External Flooding: External flooding is incorporated into High Tide, Lake Level, or River Stage, Seiche, Tsunami, Storm Surge, Waves and Precipitation/Local Intense Precipitation (LIP). In summary though, Callaway Plant is approximately 300 feet above the Missouri River flood plain, therefore, external flooding has been screened and at the frequencies typically addressed in PRAs is a negligible impact on RICT calculations. This disposition is also consistent with Callaway's exemption from having to perform an external flooding integrated assessment under Near-Term Task Force (NTTF) Recommendation 2.1.

to ULNRC-06739 Responses to NRC Audit Questions Page 52 of 75 Local intense precipitation: The LIP hazard update that was performed for NTTF 2.1 has been incorporated into the Other External Hazards screening performed for the Callaway PRA. The updated Hazard is actually very slightly reduced, in terms of maximum water level in power block locations. This analysis is very conservative with respect to maximum water level calculations; therefore, this Hazard was screened as a bounding analysis from the Callaway PRA and has negligible impact on RICT.

Waves: Callaway is not near any natural water source that could generate waves, either wind-driven or seismic, that could impact the Plant. Being approximately 300 feet above the Missouri River flood plain, waves impacting the Plant from natural water sources are implausible. The Ultimate Heat Sink pond is within the power block, but its small size does not allow for significant wind-driven waves to form. In addition, any seismic event that could displace the UHS water inventory to the extent that it would become an external flooding/wave hazard would also fail the UHS function and lead directly to core damage. Thus, there would be no impact on a delta CDF calculation under the RICT program.

to ULNRC-06739 Responses to NRC Audit Questions Page 53 of 75 Question EEEB Q-01 In Section 8.3.2.1, Description, of the Callaway FSAR (ADAMS Accession No.ML21193A191),

the licensee refers to four independent Class 1E 125-Vdc (volts direct current) subsystems.

Please explain why TSs 3.8.4.A and 3.8.9.C in LAR Enclosure 1, Table E1-1, refers to only to two direct current (DC) electrical power distribution subsystems in Column 3 (SSCs Addressed) and one of two DC electrical power distribution subsystems in Column 6 for Design Success Criteria.

Response to EEEB Q-01 The noted FSAR Section 8.3.2.1 wording (which is or is based on original FSAR text) is potentially confusing in regard to its use of "subsystem" relative to use of that same term in the Technical Specifications and TS Bases. The use of "subsystem" and "train" (which are equivalent, as further shown below) in the Technical Specifications and TS Bases is due to the use of "subsystem" in the Improved Standard Technical Specifications (ISTS) (NUREG-1431) and the need to conform to the ISTS LCO, Condition and Required Action format when the Callaway Technical Specifications were converted to the improved Technical Specifications.

The FSAR Section 8.3.2.1 use of "subsystem" relative to each of the four 125-VDC buses is meant to describe how each bus has its associated configuration of one 125-V battery, one primary battery charger, one inverter, distribution switchboards, a shared swing battery charger, a shared swing inverter/UPS, swing inverter transfer switches, and swing battery charger transfer switches, all of which it describes as a "subsystem" for the associated bus. However, as already noted and as made clear from wording in the Bases for Technical Specifications 3.8.4 and 3.8.9, "susbsystem" or "train" (in the context of the Technical Specifications) has a meaning that lends itself to proper application of the ISTS, based on the assumption that there are two independent subsystems/trains for each of the electrical power distribution systems addressed by the Technical Specifications, such that a loss of one subsystem/train does not result in loss of function (barring no additional failure). The following is applicable wording from the TS Bases.

The station DC electrical power system provides the AC emergency power system with control power. It also provides both motive and control power to selected safety related equipment and preferred AC vital bus power (via inverters). As required by 10 CFR 50, Appendix A, GDC 17(Ref. 1), the DC electrical power system is designed to have sufficient independence, redundancy, and testability to perform its safety functions, assuming a single failure. The DC electrical power system also conforms to the recommendations of Regulatory Guide 1.6 (Ref. 2) and IEEE-308 (Ref. 3).

The 125 VDC electrical power system consists of two independent and redundant Class 1E DC electrical power subsystems (Train A and Train B). Each DC electrical subsystem consists of two 125 VDC batteries, two battery chargers, one swing battery charger and all the associated control equipment and interconnecting cabling. During normal operation, the 125 VDC load is powered from the battery chargers with the batteries floating on the system. In case of loss of normal power to the battery charger, the DC load is automatically powered from the station batteries.

The Train A and Train B DC electrical power subsystems provide the control power for associated Class 1E AC power load group, 4.16 kV switchgear, and 480 V load centers.

to ULNRC-06739 Responses to NRC Audit Questions Page 54 of 75 The DC electrical power subsystems also provide DC electrical power to the inverters, which in turn power the AC vital buses.

The DC electrical power subsystems (Train A and Train B), each subsystem consisting of batteries and battery chargers, as shown in the table below, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the train are required to be OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.

Loss of any train DC electrical power subsystem does not prevent the minimum safety function from being performed. An OPERABLE DC electrical power subsystem requires all required batteries and respective chargers, as shown in the table, to be operating and connected to the associated DC bus(es).

If one of the required DC electrical power subsystems is inoperable (e.g., inoperable battery, inoperable battery charger(s), or inoperable battery charger and associated inoperable battery), the remaining DC electrical power subsystem has the capacity to support a safe shutdown and to mitigate an accident condition.

The tables contained in the Bases for TS 3.8.4 and TS 3.8.9 provide an overview of which buses (and inverters) are associated with which subsystem (i.e., Train A or B).

In regard to Table E1-1 (provided in Enclosure 1 of the original LAR), the above description and additional information should explain why two subsystems (i.e., trains) are identified in Column 3 for TS Conditions 3.8.4.A and 3.8.9.C (consistent with the LCO statements of those Technical Specifications) and why only one subsystem or train is needed for functional success, as identified in Column 6 of the table for these TS Conditions. As noted in the responses to other audit questions/requests concerning the plant's electrical power distribution systems and their associated Technical Specifications, Table E1-1 has been enhanced to clarify "train" and "subsystem" designations and make the equivalency of those terms more obvious. Revised Table E.1-1 is contained in Enclosure 1 of this LAR supplement.

to ULNRC-06739 Responses to NRC Audit Questions Page 55 of 75 Question EEEB Q-02.b.

In Table E1-1 of Enclosure 1 to the LAR, for TSs 3.8.1.B and 3.8.1.D, please explain the following:

b. Why Column 6 for Design Success Criteria (DSC) does not use similar information as Column 3 (SSCs Addressed) to indicate what an operable diesel generator must do.

Response to EEEB Q-02.b In regard to TS LCO Condition 3.8.1.B for one emergency diesel generator EDG inoperable, the following wording is taken from portions of the Bases for TS 3.8.1:

Two qualified circuits between the offsite transmission network and the onsite Class 1E Electrical Power System, along with separate and independent emergency diesel generators for each train, ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence (AOO) or a postulated DBA. The onsite standby power source for each 4.16-kV Engineering Safety Feature bus is a dedicated emergency diesel generator (EDG).

The onsite Class 1E AC electrical power distribution system includes or is centered around the two 4.16-kV safety buses. In the TS 3.8.1 LCO-required configuration, each of the two 4.16-kV safety buses has its dedicated offsite circuit connection and its dedicated onsite EDG. Loss of one safety bus does not result in loss of function because each bus and its loads are redundant/independent of the other safety bus and its loads, with respect to the capability to mitigate an accident and achieve safe shutdown. Specifically, and consistent with the response given to audit question/response to EEEB Q-01, the Train A loads are normally associated with 4.16-kV bus NB01, and the Train B loads are normally associated with 4.16-kV bus NB02.

For the EDGs, both EDGs (i.e., the Train A EDG and the Train B EDG) must be Operable to satisfy the LCO. With one EDG inoperable (per TS LCO Condition B), the other EDG remains capable of supporting its associated 4.16-kV safety bus (in the event of a loss of offsite power).

Based on the above, it is agreed that Table E1-1 (of LAR Enclosure 1) can be enhanced with respect to Columns 3 and 6 for TS LCO Condition 3.8.1.B. Specifically, train designations have now been added, along with additional wording in Column 6 to make the description of success more consistent with wording used in Column 3. For the latter, the revised wording reads as follows:

One EDG capable of supplying the onsite Class 1E AC Electrical Power Distribution System.

These changes are reflected in revised Table E1-1, as provided within Enclosure 1 of this LAR supplement.

In regard to the concern for consistency in the wording used in Column 3 and Column 6 of Table E.1-1, a similar change can be made for TS LCO Condition 3.8.1.D, with respect to how EDGs are addressed/described in the originally provided table. In Column 3, the EDGs were to ULNRC-06739 Responses to NRC Audit Questions Page 56 of 75 described as "capable of supplying onsite [Class] 1E AC Electrical Power Distribution System,"

while in Column 6, success (with one EDG inoperable) was simply described as "1 of 2 EDGs."

It is thus agreed that for TS LCO Condition 3.8.1.D, the wording in Column 6 of Table E.1-1 should be revised to achieve the above-described consistency. Specifically, in describing success for the EDG function, the wording for this portion should be revised to read as follows:

" one EDG capable of supplying onsite Class 1E AC Electrical Power Distribution System."

Note: Another change to the wording in Column 6 for TS LCO Condition 3.8.1.D is being made as described in the response to the next audit question/request, i.e., audit question/request EEEB Q-03.

to ULNRC-06739 Responses to NRC Audit Questions Page 57 of 75 Question EEEB Q-03 In Table E1-1 of Enclosure 1 to the LAR, please explain if the DSC for TS 3.8.1.D should be corrected to one offsite circuit OR one of two EDGs.

Response to EEEB Q-03 In regard to TS LCO Condition 3.8.1.D for one offsite circuit inoperable AND one EDG inoperable, the following TS Bases wording describes this situation:

For Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power; however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure.

For functional success, one 4.16-kV safety bus must have power, either from the offsite circuit connection or the onsite EDG. In Table E1-1, as originally provided in Enclosure 1 of the LAR, Column 6 contained wording that could be understood to mean functional success required both one offsite circuit connection and one EDG (to the same safety bus) to be available. It is thus agreed that for a proper description of functional success, the wording in column 6 for TS LCO Condition 3.8.1.D should be modified by replacing "and" with "OR" such that it reads as follows:

One qualified circuit between the offsite transmission network and the onsite Class 1E AC Electrical Power distribution system OR one EDG capable of supplying the onsite Class 1E AC Electrical Power Distribution System.

to ULNRC-06739 Responses to NRC Audit Questions Page 58 of 75 Question EEEB Q-04.b Explain if LAR Enclosure 1, Table E1-1 for TS 3.8.1.F should refer to the following in the design success criteria:

b. Trains A and B as referenced in required alternating current (AC) electrical sources to be OPERABLE in LCO 3.8.1 Response to EEEB Q-04.b A Load Shedder and Emergency Load Sequencer (LSELS) is provided for each of the two 4.16-kV safety buses. The "A" LSELS is associated with safety bus NB01, and the "B" LSELS is associated with safety bus NB0. For the condition of one LSELS inoperable (such that TS LCO 3.8.1.F is entered), the following is noted in the TS Bases:

[The Required Actions applicable to Condition F] ensure that the appropriate Action is entered for the affected DG and offsite circuit if the associated Load Shedder and Emergency Sequencer (LSELS) becomes inoperable. A sequencer failure results in the inability to start all or part of the safety loads powered from the associated Engineered Safety Feature (ESF) bus The Load Shedder and Emergency Load Sequencer is an essential support system to both the offsite circuit and the DG associated with a given ESF bus. Furthermore, the sequencer is on the primary success path for most major AC electrically powered safety systems powered from the associated ESF bus. Therefore, loss of an ESF bus sequencer affects every major ESF system in the division.

In Table E.1-1, as originally provided in Enclosure 1 of the LAR, for TS LCO Condition 3.8.1.F, Column 3 correctly described that there is one LSELS per 4.16-kV Class 1E AC bus, and Column 6 correctly described that for functional success, one LSELS must be available.

However, it is agreed that these requirements/descriptions can be made clearer and more consistent by making some enhancements.

For TS LCO Condition 3.8.1.F in Table E.1-1, revise the wording in Column 3 to read as follows:

Two Load Shedder and Emergency Load Sequencers: One Load Shedder and Emergency Load Sequencer (LSELS) per 4.16-kV Class 1E AC b:us (i.e., one Train A LSELS and one Train B LSELS)

For the same TS LCO Condition (3.8.1.F) revise Column 6 to read as follows:..

OneLSELS: One Train A LSELS or one Train B LSELS.

to ULNRC-06739 Responses to NRC Audit Questions Page 59 of 75 Question EEEB Q-06 Explain if LAR Enclosure 1, Table E1-1 for TS 3.8.7.A should provide the following:

Column 3 (SSCs Addressed) and 6 (DSC)

What channels are associated with each train of inverters required and if should be identified in both column 3 and 6.

Relationship of trains to channels per USFAR Section 8.3.1.1.5.

If swing inverter can be supplied by non-Class 1E source for a design-basis accident.

Response to EEEB Q-06 The four Class 1E inverters independently supply the four 120-VAC vital instrument buses, which in turn ultimately supply the four channels (aligned in four separation groups) for the protection systems and reactor control systems. Separation groups 1, 2, 3 and 4 correspondingly align with AC vital instrument buses NN01, NN02, NN03 and NN04, as supported by inverter NN11 (or swing inverter NN17), inverter NN12 (or swing inverter NN18),

inverter NN13 (or swing inverter NN17), and inverter NN14 (or swing inverter NN18),

respectively. These alignments are summarized as well in Table 3.8.9-1 in the Bases for TS 3.8.9. (See also the response to audit question/request EEEB Q-07.)

Additional descriptive information about the inverters can be taken from the Bases for TS 3.8.7:

The function of the inverters is to provide AC electrical power to the vital buses. Each inverter is normally powered from its associated NK system 125-VDC battery; however, a 480-VAC source is available via a bypass constant voltage transformer (BCVT) to provide an alternate power source to the vital AC bus via an automatic static switch internal to the inverter. The automatic static transfer switch may be manually bypassed to provide a bypass power source to the vital AC bus directly from the BCVT.

Two swing inverters (one per train) are provided such that within either train, a swing inverter may be alternatively aligned to either AC vital bus when the normal source inverter is removed from service. The swing inverters are designed with the same functional capability as the normal source inverters, including alternate source capability via a BCVT. When a swing inverter is placed into service, the requirements for independence and redundancy between trains are maintained The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and is based on meeting the design basis of the unit. This includes maintaining required AC vital buses OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC electrical power or all onsite AC electrical power; and

b. A worst case single failure.

The inverters ensure the availability of AC electrical power for the systems instrumentation to ULNRC-06739 Responses to NRC Audit Questions Page 60 of 75 required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA. Maintaining the required inverters OPERABLE ensures that the redundancy incorporated into the design of the RTS and ESFAS instrumentation and controls is maintained.

The four inverters (two per train) ensure an uninterruptible supply of AC electrical power to the AC vital buses even if the 4.16-kV safety buses are de-energized. An OPERABLE inverter (i.e.,

normal source inverter or swing inverter) requires the associated AC vital bus to be powered by the inverter with output voltage within tolerances, and with power input to the inverter from a 125 VDC battery. The inverter must be powered from its associated 125 VDC battery to meet the uninterruptible power supply design requirements of the RTS and ESFAS instrumentation.

The following table from the TS 3.8.7 Bases depicts the configuration/alignment for each inverter, as required to satisfy the LCO requirements of TS 3.8.7.

With the above information provided, the response to audit question/request EEEB Q-06 may be completed. For the parts of the question/request concerning whether "channels" should be identified or mentioned in Columns 3 or 6 of Table E.1-1 (as provided in Enclosure 1 of the LAR), the relationship between the four vital AC buses (as supported by the inverters) and the separation groups for the four channels for the protection systems and reactor control systems has been further described above, but there does not appear to be a need to include additional description/text about that in Columns 3 or 6 of Table E.1-1. Further, in regard to the part of the question/request about whether a swing inverter can be supplied by a non-Class 1E source, the answer is that the swing inverter can only be aligned to the same source(s) as a normal inverter.

Notwithstanding the above response, it was identified that some enhancements to Table E1-1 for TS LCO Condition 3.8.7.A could be made to more clearly describe the swing inverter alignment (if used) and to include train designations as appropriate, as described below.

For TS LCO Condition 3.8.7.A in Table E1-1, revise the wording in Column 3 to read as follows:

Two trains (Train A and Train B) of inverters with two normal inverters or one normal inverter and one swing inverter per train. (The swing inverter may be aligned to either AC vital bus within the train, depending on which normal inverter is unavailable or to ULNRC-06739 Responses to NRC Audit Questions Page 61 of 75 removed from service.)

Along with the above change, for consistency, revise the wording in Column 6 for for TS LCO 3.8.7.A such that it reads as follows:

One train (Train A or Train B) of inverters consisting of either two normal inverters or one normal inverter and a swing inverter aligned to the AC vital buses for that train.

to ULNRC-06739 Responses to NRC Audit Questions Page 62 of 75 Question EEEB Q-07 Indicate for LAR Enclosure 1, Table E1-1 for TS 3.8.9.A how subsystems are associated with the terms load groups and trains used in UFSAR 8.3.1.1.2 and LCO 3.8.1.

Response to EEEB Q-07 The Limiting Condition for Operation for TS 3.8.9 requires that "Train A and Train B AC, DC, and AC vital bus electrical power distribution subsystems shall be OPERABLE." The following extracts from the TS 3.8.9 Bases provide further description of the train arrangement for these systems, and relates "train" or "subsystem" to "load group":

The onsite Class 1E AC, DC, and AC vital bus electrical power distribution systems are divided by train into two redundant and independent AC, DC, and AC vital bus electrical power distribution subsystems as defined in Table B 3.8.9-1. Train A is associated with AC load group 1; Train B with AC load group 2.

The AC electrical power subsystem for each train consists of an Engineered Safety Feature (ESF) 4.16-kV bus and 480-V buses, and load centers. Each 4.16-kV ESF bus has one separate and independent offsite source of power as well as a dedicated onsite diesel generator (DG) source.

The 120-VAC vital buses are arranged in two load groups per train and are normally powered through the inverters from the 125-VDC electrical power subsystem.

The 125-VDC electrical power distribution system is arranged into two buses per train.

"Load group" is used extensively throughout Chapter 8 of the Callaway FSAR. At the 4.16-kV safey bus level, load group 1 (or Train A) is associated with 4.16-kV safety bus NB01, and load group 2 is associated with 4.16-kV bus NB02. The two-train arrangement carries down to the 120-V level, though there are four, independent separation groups at that level. For the purposes of the Technical Specification compliance and conformance to the format of the Improved Technical Specifications, the 120-VAC vital AC buses and 125-VDC DC buses are aligned with Train A or Train B as shown in Table B 3.8.9-1, replicated below.

to ULNRC-06739 Responses to NRC Audit Questions Page 63 of 75 In response to audit question/request EEEB Q-07, it is agreed that the descriptive wording in Columns 3 and 6 of Table E1-1 (as originally provided in Enclosure 1 of the LAR) can be enhanced by incorporating train designations (Train A and/or Train B, as appropriate) into the wording of these columns for TS LCO Condition 3.8.9.A. (The term "load group" is not being added, based on the understanding that "load groups" 1 and 2 correspond to Trains A and B, respectively, as described above.) The following changes are being made.

For TS LCO Condition 3.8.9.A in Table E1-1, revise the wording in Column 3 to read as follows:

Two AC electrical power distribution subsystems (Train A and Trains B), each with its 4.16-kV Class 1E safety bus and associated load centers energized to their proper voltages.

For the same TS LCO Condition, revise the wording in Column 6 (of Table E1-1) to read as follows:

One of two AC electrical power distribution subsystems (Train A or Train B), with its associated 4.16-kV Class 1E safety bus and associated load centers energized to their proper voltages.

to ULNRC-06739 Responses to NRC Audit Questions Page 64 of 75 Question EEEB Q-08 Indicate for LAR Enclosure 1, Table E1-1 for TS 3.8.9.B how subsystems are associated with the term channels used in UFSAR 8.3.1.1.5.b Response to EEEB Q-08 Per USAR 8.3.1.1.5, "four independent Class 1E 120 VAC vital buses are provided to supply the four channels of the protection systems and reactor control systems." The four 120-VAC vital buses are independent. For the purposes of TS 3.8.9, however, they are assigned to a train/subsystem (A or B) as shown in Table B 3.8.9-1 (duplicated below).

With one AC vital bus inoperable, Condition B of TS LCO 3.8.9 must be entered. In this Condition, the remaining OPERABLE AC vital buses are capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition.

Overall reliability is reduced.

As noted in the response to audit question/response to EEEB Q-01, inverters are aligned by separation group. How protection system instrument channels are associated with the AC Vital buses and their separation scheme is further described below.

to ULNRC-06739 Responses to NRC Audit Questions Page 65 of 75 FSAR 8.3.1.3 describes how circuits/schemes and raceways in the plant are identified with a particular channel or load group, on a basis that associates each separation group with a load group and/or protection system channel:

SEPARATION GROUP 1 - A safety-related instrumentation, control, or power scheme/raceway associated with safety-related load group 1 or protection system channel 1.

SEPARATION GROUP 2 - A safety-related instrumentation, control, or power scheme/raceway associated with protection system channel 2.

SEPARATION GROUP 3 - A safety-related instrumentation, power, or control scheme/raceway associated with protection system channel 3.

SEPARATION GROUP 4 - A safety-related instrumentation, control, or power scheme/raceway associated with safety-related load group 2 or protection system channel 4.

Each separation group has its distinguishing color (which for the vital AC buses, is as follows:

NN01 - Red, NN02 - White, NN03 - Blue, NN04 - Yellow).

At the instrument channel level, the separation scheme described in FSAR 7.1.2.2.2 describes how instrument channels are divided into four separate protection sets (related to separation groups as noted above). Independence is maintained from the sensor to the devices actuating the protective function. Physical separation is used to achieve separation of redundant transmitters. Separation of field wiring is achieved using separate wireways, cable trays, conduit runs, and containment penetrations for each redundant protection channel set.

Redundant analog equipment is separated by locating modules in different protection rack sets.

Each redundant channel set is energized from a separate AC power feed (ultimately in connection with an AC vital instrument bus). Each protection set contains several channels, each channel sensing a different variable. Protection sets are formed at the process protection cabinets and transmit the required signals to the redundant trains in the solid state protection system logic racks. Redundant analog channels are separated by locating modules in different cabinets. Additional information is provided in FSAR section 7.1.2.3.

The above-described separation scheme for instrument channels, including the relationship between "channels" and the trains or subsystems of vital AC buses addressed by TS 3.8.9, is below the level of detail given in TS 3.8.9 and its Bases. On that bases, no additional wording or information about "channels" is deemed necessary in regard to what is presented in Columns 3 or 6 of Table E1-1 for TS LCO 3.8.9.B. However, in regard to the "trains" or "subsystems" associated with the AC vital buses, an enhancement is being made to these Columns by adding train designations (Train A and/or Train B, as appropriate) for clarity, as follows.

For TS LCO Condition 3.8.9.B in Table E1-1 (as originally provided in Enclosure 1 of the LAR, revise the wording in Column 3 to read as follows:

Two AC Vital bus subsystems (Train A & Train B) with both buses for each train/subsystem energized to their proper voltages from their respective normal or swing inverter via inverted DC voltage or the alternate AC source (Bypass Constant Voltage Transformer)

Also for TS LCO 3.8.9.B, revise the wording in Column 6 (of Table E1-1) to read as follows:

to ULNRC-06739 Responses to NRC Audit Questions Page 66 of 75 One AC Vital bus distribution subsystem (Train A or Train B) with both of its buses energized to their proper voltages to ULNRC-06739 Responses to NRC Audit Questions Page 67 of 75 Question EEEB Q-09 Indicate for LAR Enclosure 1, Table E1-1 for TS 3.8.9.C how subsystems are associated with the term trains used in LCO 3.8.4.

Response to EEEB Q-09 As noted in the responses to audit questions/requests EEEB Q-0X, EEEB Q-0Y, and others, for the purposes of the Technical Specifications, "train" and "subsystem" are equivalent. The 125-VDC electrical power distribution system required per TS LCO 3.8.9 is arranged into two buses per train with Train A consisting of NK01 and NK03 and Train B consisting of NK02 and NK04, as indicated in Table B 3.8.9-1 of the TS 3.8.9 Bases. The note at the bottom of Table 3.8.9-1 states, "Each train of the AC and DC electrical power distribution systems is a subsystem."

In response to audit question/request EEEB Q-09, it is agreed that for TS LCO 3.8.9.C, the wording in Columns 3 and 6 of Table E.1-1 (as originally provided in Enclosure 1 of the LAR) can be improved to more clearly indicate train/subsystem assignment/equivalence by inserting train designations (Train A and/or Train B, as appropriate) into the proper place. These changes are more specifically described below.

For TS LCO Condition 3.8.9.C in Table E1-1 (relative to what was originally provided in of the LAR), revise the wording in Column 3 to read as follows:

Two DC electrical power distribution subsystems (Train A and Train B), each with its associated buses energized to their proper voltage from either the associated battery or charger. .

As stated in the Bases for TS 3.8.9, with a DC bus(es) in one train inoperable, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced.

Consistent with this functional success criterion, and to address the subject audit/question regarding "trains" and "subsystems," an enhancement to the wording in Column 6 of Table E.1-1 for TS LCO 3.8.9.C is being made, consistent with what is being done for Column 3. Train designations are being similarly added (except that an "or" is appropriate for Column 6 in lieu of "and" being used for Column 3). Specifically, the wording in Column 6 is being revised to read as follows:

One DC electrical power distribution subsystem (Train A or Train B) (with both of its associated buses energized to their proper voltage from either associated battery or charger).

to ULNRC-06739 Responses to NRC Audit Questions Page 68 of 75 Question EEEB Q-11 In Table E1-2 of the Enclosure to the LAR, explain the potential discrepancy between RICT times for LCO 3.8.1.A or B to LCO 3.8.9.A.

Response to EEEB Q-11 The results presented in Table E1-2 are an attempt to determine a bounding condition that might place the plant in a given LCO Action. These are examples only and do not cover all possible combinations of equipment unavailability that may place the plant in a given LCO Action. This process can result in apparent discrepancies in results between similar LCO Actions. For example, for LCO 3.8.1.A, a loss or unavailability of the 'A' train offsite power transformer XNB01 was used (NB-TFM-VF-XNB01); for LCO 3.8.1.B, a loss or unavailability of the 'A' EDG was used (NE-DGN-FS-NE01); for LCO 3.8.9.A, a loss of the 'B' Class 1E safety bus (due to a bus fault, NB-BAC-LP-NB02) was used. The latter fails all potential power sources and all supported equipment on that bus, as opposed to a single power source to the associated bus for either of the first two examples.

to ULNRC-06739 Responses to NRC Audit Questions Page 69 of 75 Question EEEB Q-12 (New Audit Question)

New audit question for LCO 3.8.1, Condition A: Clarify in Columns 3 and 6 of LAR Table E1-1 that the two offsite power circuits for preferred offsite source connection are for Train A and Train B as stated on pages B 3.8.1-1 and B 3.8.1-3 and page LCO 3.8.1.

Response to EEEB Q-12 The Bases for TS 3.8.1 provide an effective description of the two, qualified offsite source connections required to satisfy the LCO requirements of TS 3.8.1:

Qualified circuits are those that are described in the FSAR and are part of the licensing basis for the unit. The capacities of the transformers and inclusion of normal and alternate feeder breakers in the offsite circuit connections to the ESF buses provide flexibility and diversity in the means to provide offsite power to each bus, as described in the FSAR. However, to maintain separation and independence of the offsite power sources for the ESF buses and their redundant trains of safety equipment, two qualified offsite power source connection circuits are specifically required for meeting the requirements of LCO 3.8.1.

One required offsite circuit consists of either Safeguards Transformer A or B, which is supplied from Switchyard Bus A or B and feeds through a breaker to ESF transformer XNB01, which in turn powers the NB01 ESF bus through its normal feeder breaker. The other required offsite circuit consists of the Startup Transformer, which is normally fed from the switchyard through breaker PA0201 and feeds to ESF transformer XNB02, which in turn powers the NB02 ESF bus through its normal feeder breaker.

It can be seen from this TS Bases description that one qualified offsite circuit connection is dedicated to ESF transformer XNB01 and thus to 4.16-kV safety bus NB01, which supplies Train A loads, and the other qualified offsite circuit connection is dedicated to XNB02 and thus to 4.16-kV safety bus NB02, which supplies Train B loads. In response to audit question/request EEEB Q-12, it is agreed that the relationship between one of the qualified offsite circuits and Train A and the relationship between the other qualified offsite circuit and Train B can be clarified by making the following enhancements to Table E.1-1.

For TS LCO Condition 3.8.1.A in Table E1-1, revise the wording in Column 3 (relative to what was originally provided in Enclosure 1 of the LAR) such that it reads as follows:

Two qualified circuits between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System (one for Train A and the other one for Train B)

Similarly, and again for TS LCO 3.8.1.A in Table E1-1, revise the wording in Column 6 such that it reads as follows:

One qualified circuit between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System (for Train A or Train B) to ULNRC-06739 Responses to NRC Audit Questions Page 70 of 75 Question SNSB Q-01 TS 3.7.4 - Atmospheric Steam Dump Valves (ASDs)

The design basis of the safety function for the ASDs is established by the capacity to cool the unit to the residual heat removal (RHR) entry conditions for various events such as a steam generator tube rupture (SGTR). Callaway Final Safety Analysis Report (FSAR), Section 15.6.3.1.2, "Analysis of Effects and Consequences" (ADAMS Accession No. ML21193A202),

discusses the analysis of the SGTR showing that an LOF of the ASDs would not occur. Page 15.6-17 of the Callaway FSAR states, in part, for the dose release limiting case that:

Two of the unaffected steam generators are assumed to continually discharge steam and entrained activity via the atmospheric steam dump valves up to the time initiation of the RHR system can be accomplished.

The licensee proposed to apply the RICT Program to TS 3.7.4 Condition B that allows two required ASD lines inoperable for reasons other than excessive ASD seat leakage. Since the TS LCO 3.7.4 requires four ASD lines to be operable, Condition B would result in only two required ASD lines operable. If an SGTR case (designated as an SGTR with one operable ASD line, thereafter) occurs in the steam generator (SG) with an operable ASD line, there would be one operable ASD line remaining in the unaffected SGs for plant cooldown, which is less than two ASD lines assumed in the SGTR analysis. The effect of using more operable ASD lines in the unaffected SGs for plant cooldown decreases the time it takes to reduce the reactor coolant system temperature to below the ruptured SG saturated temperature and decreases the dose releases. Therefore, an SGTR with one operable ASD line (allowed by Condition B) would not be bounded by the limiting case in Callaway FSAR, Section 15.6.3.1.2.

The NRC-approved Nuclear Energy Institute (NEI) 06-09, Revision 0-A Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines (ADAMS Accession No. ML12286A322) provides guidelines for application of the RICT Program. Specifically, Condition 3 in the NRC SE approving NEI 06-09 imposes a restriction stating that when an LOF of specific safety function for the affected TS system occurs, the RICT Program cannot be applied.

Provide analysis of the SGTR with one operable ASD line discussed above to show that the two required operable ASD lines would not result in an LOF for mitigating the SGTR event, when applying the RICT Program to TS 3.7.4 Condition B.

to ULNRC-06739 Responses to NRC Audit Questions Page 71 of 75 Response to SNSB Q-01 Entry into TS 3.7.4 Condition B for "Two required ASD lines inoperable for reasons other than excessive ASD seat leakage" does constitute a loss of safety function which is consistent with the most limiting case identified in Callaway Final Safety Analysis Report (FSAR), Section 15.6.3.1.2. for the SGTR event requiring use of two operable ASD lines and one ASD line associated with the ruptured generator that is required to be isolated. Because NEI 06-09 states that RICT Program cannot be applied when a loss of safety function exists for the affected Technical Specification system, T.S. 3.7.4 and the LAR will be amended to reflect that the RICT Program will only be utilized for Condition A in which one ASD line is inoperable. The licensee will remove use of the notes in TS Required Actions 3.7.4.A.1 and 3.7.4.B.1. No note is required, since the RICT program is not being applied to Condition B.

Per Callaway Final Safety Analysis Report (FSAR), Section 15.6.3.1.2, two ASD lines are required to perform the cooldown for the dose release limiting case for the SGTR event. This analysis requires accounting for a single active failure in addition to isolation of one ASD line for the ruptured steam generator. Because of this analysis, the Limiting Condition for Operation requires that Four ASD lines shall be OPERABLE. Upon entry into Condition A of TS 3.7.4 for "One required ASD line inoperable for reasons other than excessive ASD seat leakage", the remaining three OPERABLE ASD lines would be relied upon for the SGTR event.

Per Generic Letter 80-30:

By and large, the single failure criterion is preserved by specifying Limiting Conditions for Operation that require all redundant components of safety systems to be OPERABLE. When the required redundancy is not maintained, either due to equipment failure or maintenance outage, action is required, within a specific time, to change the operating mode of the plant to place it in a safe condition. The specified time to take action, usually called the equipment out of service time (termed Completion Time in the Standard Technical Specifications), is a temporary relaxation of the single failure criterion, which consistent with overall system reliability considerations, provides a limited time to fix equipment or otherwise make it OPERABLE.

Therefore, maintaining the remaining three ASD lines OPERABLE will allow the required safety systems to mitigate the most limiting case assumed in the accident analysis and does not represent a loss of safety function.

to ULNRC-06739 Responses to NRC Audit Questions Page 72 of 75 Question STSB Q-01 NRC staff observes that TSs 3.7.4.A.1 and 3.7.4.B.1 have notes added to the TSs which state, Not applicable when more than 2 ASD [Atmospheric Steam Dump Valves] lines are inoperable for any reason, and were not listed as variations. These are variations from TSTF-505 and need to be identified in the variation section of the LAR.

Response to STSB Q-01 The licensee will amend the License Amendment Request to remove applicability of RICT to TS 3.7.4 Condition B because use of RICT in TS 3.7.4 Condition B would result in a loss of function based on the current analysis in the FSAR. The licensee will also remove use of the notes in TS Required Actions 3.7.4.A.1 and 3.7.4.B.1 as they are no longer required with removal of the applicability of RICT to TS 3.7.4 Condition B. The additional justification in Attachment 1 "

Description and Assessment" Section 2.3 "Optional Variations" and the notes in TS 3.7.4 are no longer required because TSTF-505, Table 1 "Conditions Requiring Additional Technical Justification" only lists Condition B and not Condition A, as a condition requiring additional technical justification. Information provided in both Enclosure 1 and Attachments 2 through 5 will be modified to reflect this information. See response to SNSB Question 01 for additional details.

to ULNRC-06739 Responses to NRC Audit Questions Page 73 of 75 Question STSB Q-02 The NRC staff identified the following editorial issues in Attachment 4 (bases):

• For TS 3.3.1, the licensee removed Power Range Neutron Flux - Low from Action E. Based on Table 3.3.1-1, staff believes this was inadvertently included in the bases and is being removed as a cleanup item. Confirm

• For TS 3.3.1, Action L.1, there is a . missing between L and 1 in the Section title. In addition, staff notes that the last phrase should say below P-7 setpoint instead of below P-7.

Please confirm

• For TS 3.3.1, Action R.1, there is a period and space that were inadvertently deleted and needs to be corrected. Please confirm.

• For TS 3.3.1, Actions W.1, W.2.1, W.2.2.1, W.2.2.2, and W.2.3, staff notes that in the last paragraph, the licensee inadvertently forgot to delete the V from the three references to W actions.

• For TS 3.3.2, Actions C.1 and C.2, staff notes that and is missing and a , needs to be removed between the two actions for the Section titles in three places that they are listed.

• For TS 3.3.2, Action I.1, staff notes that and I.2 needs deleted from the Section title, as it was removed from the TS.

• For TS 3.3.2, Action R.1, staff notes that , R.2.1, and R.2.2 needs to be deleted from the Section title, as it was removed from the TS.

• For TS 3.3.2, Action S.1, staff notes that , S.2.1, and S.2.2 needs to be deleted from the Section title in two places, as it was removed from the TS.

• For TS 3.3.2, Action T.1, staff requests whether the last sentence should state In MODE 5 instead of In MODE 4.

• For TS 3.4.9, staff notes that the bases were provided with markups to include a RICT; however, the application indicates that this TS was not included in the RICT Program. Please confirm and correct.

Response to STSB Q-02

• The change to eliminate the first bullet on page B 3.3.1-40 (page 5 of 65 in Attachment 4) is being performed as a cleanup item. Contrary to the current Bases for TS 3.3.1, TS TS 3.3.1 Condition E in the current TS does not pertain to "Power Range Neutron Flux Low," as evidenced by current TS Table 3.3.1-1 Function 2.b.

• The markup of TS Bases page B 3.3.1-45 (page 9 of 65 in Attachment 4) for TS 3.3.1.L will be revised to change the heading from "L1" to "L.1," and change "below P-7" to "below the P-7 setpoint." Also, on TS Bases page B 3.3.1-50 (page 14 of 65 in Attachment 4), the heading "U1 (continued)" will be changed to "U.1 (continued)."

• The markup of TS Bases page B 3.3.1-48 (page 12 of 65 in Attachment 4) for TS 3.3.1.R will be revised to restore the deleted period and space at the end of the second sentence under the heading "R.1." Also, the spurious reference to "Condition R" in the last sentence in the markups of page B 3.3.1-47 (page 11 of 65 in Attachment 4, under the heading "Q.1") will be corrected to read "Condition Q."

to ULNRC-06739 Responses to NRC Audit Questions Page 74 of 75

• In the markup of TS Bases page B 3.3.1-51 (page 15 of 65 in Attachment 4) the last two sentences of the last paragraph under the heading for TS 3.3.1.R will be revised to change references to "VW. . ." to read "W. . ."

• The markup of TS Bases page B 3.3.2-49 (page 17 of 65 in Attachment 4) will be revised to change the header "C.1, C. 2" to read "C.1 and C.2."

• The markup of TS Bases page B 3.3.2-56 (page 24 of 65 in Attachment 4) will be revised to change the header "I.1 and I.2" to read "I.1."

• The markup of TS Bases page B 3.3.2-61 (page 29 of 65 in Attachment 4) will be revised to change the header "R.1, R.2.1 and R.2.2" to read "R.1."

• The markup of TS Bases pages B 3.3.2-61 and B 3.3.2-62 (pages 29-30 of 65 in Attachment 4) will be revised to change the header references to "S.1, S.2.1 and S.2.2" to read "S.1."

• In the markup of TS Bases page B 3.3.2-62 (page 30 of 65 in Attachment 4) the last sentence of the last paragraph under the heading for TS 3.3.1.T will be revised to state "In MODE 5, these Functions are no longer required OPERABLE."

• As RICT is not being applied to TS 3.4.9 Condition B, Required Action B.1., the markup of TS Bases page B.3.4.9-3 (page 32 of 65 in Attachment 4) will be removed.

to ULNRC-06739 Responses to NRC Audit Questions Page 75 of 75 Question STSB Q-04 NRC staff suggestion for licensee consideration: The proposed administrative controls for the RICT Program in TS 5.5.19 paragraph e of Attachment 2 to the LAR was based on the TS markups of TSTF-505, Revision 2 for Callaway. The NRC staff recognizes that the model SE for TSTF-505, Revision 2 contains improved phrasing for the administrative controls for the RICT Program in TS 5.5.19 paragraph e, namely the phrasing approved for use with this program instead of used to support this license amendment. In lieu of the original phrasing in TS 5.5.19 paragraph e, discuss whether the phrases used to support Amendment # xxx or, as discussed in the TSTF-505 model SE, approved for use with this program would provide more clarity for this paragraph.

Response to STSB Q-04 The licensee accepts the suggestion provided by the NRC and will revise the LAR to utilize improved phrasing provided in model SE for TSTF-505, Revision 2 as it applies to TS 5.5.19 paragraph "e." that states "Methods to assess the risk from extending the Completion Times must be PRA methods approved for use with this program " Proposed Technical Specification Changes (Mark-Up)" and Attachment 3 Revised Technical Specification Pages will be modified to utilize language provided in the model SE for TSTF-505, Revision 2 which contains improved phrasing for the administrative controls for the RICT Program in TS 5.5.19 paragraph e, namely the phrasing approved for use with this program instead of used to support this license amendment.

The wording provided in the model SE for TSTF-505, Revision 2 using the phrasing approved for use with this program helps to clarity that the methods used to assess the risk from extending Completion Times are PRA methods inherent to the program that can be changed via subsequent license amendments or by means that do not require prior NRC approval. Use of the phrase used to support this license amendment could be understood to mean (inappropriately) that the PRA methods used to assess risk are bound to the original license amendment (i.e., the amendment now being proposed) and are therefore unchangeable without a subsequent license amendment(s).