ML22181B140

From kanterella
Jump to navigation Jump to search
Enclosure 1 - Replacement for Enclosure 1, List of Revised Required Actions to Corresponding PRA Functions, of ULNRC-06688
ML22181B140
Person / Time
Site: Callaway Ameren icon.png
Issue date: 06/30/2022
From:
Ameren Missouri, Union Electric Co
To:
Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML22181B129 List:
References
ULNRC-06739
Download: ML22181B140 (37)
v • d • e


Text

Enclosure 1 to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 1 of 37 ENCLOSURE 1 License Amendment Request Callaway Unit No. 1 Renewed Facility Operating License NPF-30 NRC Docket No. 50-483 Post-Audit Supplement to License Amendment Request to Adopt TSTF-439 and TSTF-505 Replacement for Enclosure 1, "List of Revised Required Actions to Corresponding PRA Functions," of ULNRC-06688 to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 2 of 37

1.0 INTRODUCTION

The purpose of this enclosure is to provide a mapping of identified in-scope Technical Specifications (TSs) statements to modeled (and surrogate) Probabilistic Risk Assessment (PRA) functions. This mapping provides the basis by which to quantify the increase in risk associated with extending the Completion Time for a given TS Action and to calculate a Risk-Informed Completion Time (RICT) for the RICT Program application.

Section 4.0, Item 2 of the U.S. Nuclear Regulatory Commission (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) identifies the following necessary content:

The license amendment request (LAR) will provide identification of the TS Limiting Conditions for Operation (LCOs) and Required Actions to which the RMTS (or RICT for TSTF-505) will apply.

The LAR will provide a comparison of the TS functions to the PRA modeled functions of the structures, systems and components (SSCs) subject to those LCO actions.

The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions (i.e., 10 CFR 50.46 emergency core cooling system (ECCS) flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.

This enclosure provides confirmation that Callaway Plant, Unit No. 1 PRA models include the necessary scope of SSCs and their functions to address each proposed application of the RICT Program to the proposed scope of TS LCOs. The enclosure also provides the information requested by Section 4.0, Item 2 of Reference 1. The comparison includes each of the TS LCOs and associated Required Actions within the scope of the RICT Program. The Callaway PRA model has the capability to model directly, or using a bounding surrogate, the risk impact of entering each of the Actions associated with the TS LCOs that are in the scope of the RICT Program.

Table E1-1 below lists each TS LCO Condition to which the RICT Program is proposed to be applied and documents the following information regarding the TSs with the associated safety analyses, the analogous PRA functions and the results of the comparison:

Column Tech Spec

Description:

Lists all of the LCOs and condition statements within the scope of the RICT Program.

Column SSCs Covered by TS LCO Condition: The SSCs addressed by each action requirement.

Column Modeled in PRA?: Indicates whether the SSCs addressed by the TS LCO Condition are included in the PRA.

Column Function Covered by TS LCO Condition: A summary of the required functions from the design basis analyses.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 3 of 37 Column Design Success Criteria: A summary of the success criteria from the design basis analyses.

Column PRA Success Criteria: The function success criteria modeled in the PRA.

Column Comments: Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09-A, Revision 0-A.

The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA models. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT Program. Differences in success criteria typically arise due to the requirement in the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard to make PRAs realistic rather than bounding, whereas design basis criteria are necessarily conservative and bounding.

The use of realistic success criteria is necessary to conform to Capability Category II of the ASME/ANS PRA Standard as required by NEI 06-09-A (Reference 2).

Examples of calculated RICTs are provided in Table E1-2 for each individual Action to which the RICT Program is proposed to apply. These calculations assume the SSC in question is the only SSC out-of-service, and thus the values in Table E1-2 are representative examples only.

Following RICT Program implementation, RICT calculations will be based upon the actual real-time maintenance configuration of the plant and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09-A (Reference 2) and the NRC Safety Evaluation. Thus, in practice, RICT values may differ from the RICTs presented in Table E1-2.

For the purposes of the following information, the terms subsystem, train, and division are all considered interchangeable.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 4 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.3.1.B One Manual Reactor Trip channel inoperable.

Two manual Reactor Trip Channels Yes Reactor Trip Initiation One of two reactor trip channels Same 1 of 2 reactor trip switches used as surrogate for the channel (Note 4) 3.3.1.D One Power Range Neutron Flux-High channel inoperable.

Four Power Range Neutron Flux-High sensors Not explicitly Reactor Trip Initiation Two of four channels Same The function One Power Range Neutron Flux-High is not explicitly modeled in the PRA, one of the 2 reactor trip breakers will be used as a conservative surrogate in the RICT calculation.

(Notes 1 and 2) 3.3.1.E One channel inoperable.

Power Range Neutron Flux Rate - High Positive Rate, Overtemperature T, Overpower T.

Pressurizer Pressure -

High, SG Water Level Low-Low (Adverse and Normal Containment Environment)

Partially Reactor Trip Initiation Power Range Neutron Flux Rate -

High Positive Rate, 2 of 4 channels [2 seconds]

Overtemperature T, 2 of 4 channels Overpower T, 2 of 4 channels Pressurizer Pressure

- High, 2 of 4 channels SG Water Level Low-Low (Adverse and Normal Containment Environment), 2 of 4 channels on 1 of 4 generators Same The functions Power Range Neutron Flux-High Positive Rate, Overtemperature T, Overpower T are not explicitly modeled in PRA, one of the 2 reactor trip breakers will be used as a conservative surrogate in the RICT calculation. Pressurizer Pressure and SG level are explicitly modeled.

(Notes 1 and 2) to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 5 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.3.1.K One channel inoperable.

RCPs (Undervoltage, Underfrequency) (per bus),

Pressurizer (Pressure Low, Water Level-High),

Reactor Coolant Flow-Low (per loop)

Partially Reactor Trip Initiation RCP'UV/UFs,1 of 2 channels on 2 of 2 busses.

Pressurizer Pressure Low, 2 of 4; Pressurizer Water Level - High 2 of 3, RCS Flow-Low 2 of 3 per loop Same The functions RCP'UV/UFs, Pressurizer Water Level - High, RCS Flow-Low are not explicitly modeled in the PRA,.,

one of the 2 reactor trip breakers will be used as a conservative surrogate in the RICT calculation. Pressurizer pressure channels are explicitly modelled.

(Notes 1 and 2) 3.3.1.M One Low Fluid Oil Pressure Turbine Trip channel inoperable Turbine Emergency Trip System (ETS) (three sensors)

Not explicitly Reactor Trip Initiation Two of Three Electro-Hydraulic (EH) Fluid Pressure switches 1 of 2 for reactor trip breakers The function Trip Turbine Emergency Trip System is not explicitly modeled in the PRA, one of the 2 reactor trip breakers will be used as a conservative surrogate in the RICT calculation.

(Notes 1 and 2) 3.3.1.P One train inoperable.

SI Input from ESFAS, Automatic Trip logic Not explicitly Reactor Trip Initiation One of two trains 1 of 2 for automatic trip signals (manual trip also credited)

The function SI Input from ESFAS, Automatic Trip logic is not explicitly modeled in the PRA, 1 of 2 modeled auto trip signals will be used as a conservative surrogate in the RICT calculation. (Note 3) 3.3.1.Q One RTB train inoperable.

Reactor Trip Breakers and Bypass Breakers Yes Reactor Trip Initiation One of two RTBs open Same (Note 5) to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 6 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.3.1.U One trip mechanism inoperable for one RTB.

RTB Undervoltage and Shunt Trip Mechanisms Yes Reactor Trip Initiation One trip mechanism Same (Notes 3 and 4) 3.3.2.B One channel or train inoperable.

Manual Initiation (Safety Injection, Containment Spray, Containment Isolation (Phase A and B Isolation))

Partially ESF Actuation SI Function:

One of two SI Manual Initiation channels CS/CIS-B Function:

Two of two CS Manual Initiation channels CIS-A Function:

One of two CIS-A Manual Initiation channels Same Manual trip hand switches for SI and CIS-A are explicitly modeled. CS/CIS-B Function is not explicitly modeled in the PRA. Hydraulic analysis has been performed to show that success or failure of CS does not impact which sequences contribute to LERF. CIS-B isolates the component cooling water system (CCW) to the components located within the containment. CCW is a seismically designed closed loop system both inside and outside of the containment.

Penetrations associated with CCW (and therefore associated with CIS-B) have been screened from the PRA.

(Notes 1 and 2) to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 7 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.3.2.C One train inoperable.

Automatic Actuation Logic and Actuation Relays (Safety Injection, Containment Spray, Containment lsolation (Phase A and B),

Automatic Switchover to Containment Sump)

Partially ESF Actuation One of two trains Same Auto-signals for SI, switchover, and CIS-A are explicitly modeled. The functions Containment Spray and Containment Isolation - Phase B Isolation are not explicitly modeled in PRA. Hydraulic analysis has been performed to show that success or failure of CS does not impact which sequences contribute to LERF.

CIS-B isolates the component cooling water system (CCW) to the components located within the containment. CCW is a seismically designed closed loop system both inside and outside of the containment.

Penetrations associated with CCW (and therefore associated with CIS-B) have been screened from the PRA.

(Notes 1 and 2) to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 8 of 37 3.3.2.D One channel inoperable.

SI (Containment Pressure - High 1, Pressurizer Pressure -

Low, Steam Line Pressure - Low),

Steam Line Isolation (Containment Pressure -

High 2, Steam Line Pressure {Low, Negative Rate - High})

Turbine Trip and Feedwater Isolation (SG Water Level-Low Low

{Adverse and Normal Containment})

Auxiliary Feedwater (SG Water Level-Low Low

{Adverse and Normal Containment})

Automatic Pressurizer PORV Actuation -

Pressurizer Pressure -

High Partially ESF Actuation, Main Steam Line Isolation

Signal, Turbine trip and FWIS, AFW Pump
Start, PORV actuation SI (Containment Pressure-High 1): 2 of 3 (PZR Pressure Low): 2 of 4 (Steam line pressure low): 2 of 3 on 1 of 4 steam lines Steam Line Isolation (Containment Pressure-High 2): 2 of 3, Steam Line Pressure-Low, 2 of 3 on 1 of 4 steam lines Steam Line Pressure-Negative Rate-High, 2 of 3 on 1 of 4 steam lines Turbine Trip and Feedwater Isolation (SG Water Level-Low Low {Adverse and Normal Containment}) 2 of 4 channels on 1 of 4 generators Auxiliary Feedwater (SG Water Level-Low Low {Adverse and Normal Containment}) 2 of 4 channels on 1 of 4 generators Automatic Pressurizer PORV Actuation-Pressurizer Pressure

- High, 2 of 4 channels Same Signals for containment pressure high 1 & 2, pressurizer pressure low, steamline pressure low, and SG Level low are explicitly modeled. The functions Steam Line Isolation -

Steam Line Pressure -

Negative Rate-High, Feedwater Isolation - SG Water Level-Low Low, and PORV Actuation-Pressurizer Pressure-High are not explicitly modeled in PRA, and a failure of a reactor trip breaker will be used as a conservative surrogate. Note, the PRA does not model/distinguish between normal and adverse containment environment.

RICT will not be applied to function 9b. - Automatic Pressurizer PORV Actuation, Pressurizer Pressure - High (Notes 1 and 2).

3.3.2.F One channel or train inoperable.

Steam Line Isolation Manual Initiation, Partially Manual Steam SLI Function: 1 of 2 Control Room SLI Function: 1 of 2 Control Room push A channel of main steam isolation will be used as a to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 9 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments ESFAS Interlocks Rx Trip, P4 (2 per train, 2 trains)

Line Isolation, Rx Trip, P-4 functions: Trips the main turbine, Isolates MFW with coincident low Tavg, Prevents automatic reactuation of SI after a manual reset of SI, Allows arming of the steam dump valves and transfers the steam dump from the load rejection Tavg controller to the plant trip controller; and, Prevents opening of the MFW isolation valves if they were closed on SI or SG Water Level -

High High.

pushbuttons Rx Trip, P-4 functions 1 of 2 trains buttons conservative surrogate for the steam line isolation function.

The function Rx Trip, P-4 is not modeled in the PRA and will not be in the scope of RICT.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 10 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.3.2.G One train inoperable.

Automatic Actuation Logic and Actuation Relays (Steam Line Isolation, Turbine Trip and Feedwater Isolation, Auxiliary Feedwater)

Yes ESF Actuation One of two trains Same Signals for Automatic Actuation Logic and Actuation Relays (Steam Line Isolation, Turbine Trip and Feedwater Isolation, Auxiliary Feedwater) are explicitly modeled.

(Notes 1 and 2) 3.3.2.I One channel inoperable.

Turbine Trip and Feedwater Isolation (SG Water Level-High High -

P-14)

Not explicitly ESF Actuation, P-14:

  • Trips the MFW pumps (PAE01A/1B) closing the pump discharge valves
  • Initiates feedwater isolation Two of four on one of four Steam Generators None The function Turbine Trip - SG Water Level-High High is not explicitly modeled; one of the 2 reactor trip breakers will be used as a conservative surrogate for the turbine trip portion of this function in the RICT calculation. SG water level high-high signals for MFW Isolation is modeled. Loss of the associated channel will be used as a conservative surrogate for the MFW isolation portion of this function in the RICT calculation.

Also note that trip of the MFW pumps and closure of the pump discharge valves is not explicitly modeled.

(Notes 1 and 2) to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 11 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.3.2.J One channel inoperable.

Aux Feed, motor driven pump start on Trip of all main feed pumps Not explicitly AFW Pump Start Two of four, one in the same separation group from each feed pump None This function is not explicitly modeled but a conservative surrogate representing auto actuation of MDAFPs (PRA credits signals from SG low level, LOOP and SI) has been selected in the RICT calculation.

(Notes 1 and 2) 3.3.2.K One channel inoperable.

Automatic Switchover to Containment Sump -

Refueling Water Storage Tank (RWST) Level-Low Low coincident with Safety Injection.

Yes ESF Actuation Two of four Same The function Automatic Switchover to Containment Sump - Refueling Water Storage Tank (RWST) Level-Low Low is explicitly modeled.

(Notes 1 and 2) 3.3.2.Q One train inoperable.

Automatic Actuation Logic and Actuation Relays (BOP ESFAS)

(Auxiliary Feedwater and Steam Generator Blowdown and Sample Line Isolation)

Partially ESF Actuation One of two trains Same The function Automatic Actuation Logic and Actuation Relays (BOP ESFAS) Steam Generator Blowdown and Sample Line Isolation is not explicitly modeled in the PRA, but a conservative surrogate representing auto actuation of MDAFPs (PRA credits signals from SG low level, LOOP and SI) has been selected in the RICT calculation.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 12 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.3.2.R One or both train(s) inoperable.

Loss of Offsite Power (Auxiliary Feedwater and Steam Generator Blowdown and Sample Line Isolation)

Partially ESF Actuation,

-Start of TDAFP signal on LOOP

-SGBSIS signal on LOOP One of two trains Same The function Loss of Offsite Power (Steam Generator Blowdown and Sample Line Isolation) is not explicitly modeled in the PRA, but a conservative surrogate representing auto actuation of TDAFP (PRA credits signals from SG low level and UV) has been selected in the RICT calculation.

Note: RICT is only applicable to one train inoperable.

3.3.2.S One train inoperable.

Automatic Actuation Logic and Actuation Relays (MSFIS) (Steam Line Isolation, Turbine Trip and Feedwater Isolation)

Yes ESF Actuation One of two trains Same The functions Automatic Actuation Logic and Actuation Relays (Steam Line Isolation, Turbine Trip and Feedwater Isolation) are explicitly modeled.

(Notes 1 and 2) 3.3.5.A One or more Functions with one channel per bus inoperable.

Degraded Voltage and Loss of voltage sensors on safety related 4 kV buses Yes Diesel Generator -

Loss of Voltage Start as well as 4 kV Bus load shedding and initiating sequencing.

Two of four channels per bus Same The function Degraded Voltage and Loss of voltage sensors on safety related 4 kV buses is explicitly modeled.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 13 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.4.11.B One PORV inoperable for reasons other than excessive seat leakage Two PORVS and automatic actuation circuitry Yes RCS depressurization, once through core cooling (feed and bleed Automatic pressure relief during inadvertent ECCS actuation Two PORVs One PORV with One Centrifugal Charging pump OR Two PORVs with One SI pump (Note 6) 3.4.11.C One block valve inoperable.

Two PORV block valves Yes Isolate associated PORV Two PORV Block valves closable.

Same 3.5.2.A One or more trains inoperable.

AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available.

Two ECCS trains (ECCS train consists of one Centrifugal Charging, one Safety Injection, and one Residual Heat Removal subsystem.)

Yes Emergency make up to the RCS via injection from the RWST to the cold legs, and recirculation from the containment sump.

3 ECCS subsystems between two trains such that at least 100% ECCS flow equivalent to a single operable ECCS train is available.

Same 3.6.2.C One or more containment air locks inoperable for reasons other than Condition A or B.

Containment Airlocks Not explicitly Containment integrity One of two containment air lock doors closed.

None The containment airlocks are not modeled but their unavailability will be conservatively analyzed as an early containment failure in the RICT calculation.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 14 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.6.3.A One or more penetration flow paths with one containment isolation valve inoperable except for containment purge valve leakage not within limit.

Two active or passive isolation devices on each fluid penetration line Yes Containment boundary and minimization of RCS inventory Loss One of two isolation devices per penetration Same Selected Cl valves are modeled and can be used as a conservative surrogate of the failure.

3.6.3.C One or more penetration flow paths with one containment isolation valve inoperable.

See LCO Condition 3.6.3.A.

3.6.6.A One containment spray train inoperable.

Two Containment spray trains No Containment pressure +

temperature control and fission product retention from atmosphere during a DBA One of two trains None Containment sprays are not modeled for success in the Level 1 PRA or in the LERF PRA. Hydraulic analysis has been performed to show that success or failure of CS does not impact which sequences contribute to LERF.

3.6.6.C One containment cooling train inoperable.

Two Containment cooling trains No Containment pressure +

temperature control One of two trains None Containment cooling is not modeled for success in the Level 1 PRA or in the LERF PRA. Hydraulic analysis has been performed to show that success or failure of containment cooling does not impact which sequences contribute to LERF.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 15 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.7.2.A One MSIV actuator train inoperable.

Main Steam Isolation Valves (MSIVs)

Not explicitly Isolate Main Steam Lines One MSIV closure per steam generator (one of two actuator trains)

None Actuators are not explicitly modeled in PRA, but loss of the associated signal train will be used as a conservative surrogate in the RICT calculation.

3.7.2.B Two MSIV actuator trains inoperable for different MSIVs when the inoperable actuator trains are not in the same separation group.

See LCO Condition 3.7.2.A.

3.7.2.F One MSIV inoperable in MODE 1.

Main Steam Isolation Valves (MSIVs)

Yes Isolate Main Steam Lines Closure of 3 of 4 MSIVs Same 3.7.4.A One required ASD line inoperable for reasons other than excessive ASD seat leakage.

Automatic Steam Dump Valves (ASDs)

Yes Plant cooldown to RHR entry conditions Bounded by SGTR scenarios which require 2/4 ASDs available Same 3.7.5.A One steam supply to turbine driven AFW pump inoperable.

TD AFW pump steam supply line and valves Yes Steam supply to TDAFP to supply feedwater to steam generators to remove RCS decay heat One of two trains of steam supplies to TDAFP Same to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 16 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.7.5.B One ESW supply to turbine driven AFW pump inoperable.

ESW supply line, including valves, to AFW pumps Yes Safety related water supply to TDAFP to supply feedwater to steam generators to remove RCS decay heat One of two trains of ESW supplies to TDAFP Same 3.7.5.C One AFW train inoperable for reasons other than Condition A or B.

Three AFW trains each comprised of one pump (two containing a motor driven AFW pump and the other containing a TDAFW pump), piping, valves, and controls Yes Supply feedwater to steam generators to remove RCS decay heat One of three AFW (system AL) pump trains Same 3.7.7.A One CCW train inoperable.

Two CCW trains comprised of two full capacity pumps and surge tank with associated valves, piping, heat exchanger, instrumentation and controls.

Yes Heat sink for removing process and operating heat from safety related components during a Design Basis Accident or transient One of two CCW (EG system) trains available Same to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 17 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.7.8.A One ESW train inoperable.

Two ESW trains comprised of a self-cleaning strainer, prelube tank, one 100% capacity pump, piping, valving, and instrumentation and pump room supply fan Yes The Essential Service Water (ESW) System, in conjunction with the Service Water

System, provides a source of heat rejection for safety-related
loads, emergency makeup to the spent fuel pool and component cooling water systems, and is the backup water supply to the auxiliary feedwater system.

One of two ESW (EF system) pump trains available Same 3.7.9.A One cooling tower train inoperable.

Two UHS Cooling tower trains (2 cells per train) are required to dissipate the heat contained in the ESW system. UHS Cooling Tower Electrical Room Supply Fan must be operable per train Yes Ultimate heat sink availability for ESW 30 day mission time One of two trains (2 cells per train)

One of two trains (1 cell per train) for 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> PRA mission time.

(Note 7) to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 18 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.8.1.A One offsite circuit inoperable.

Two qualified circuits between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System Yes Provide power from offsite transmission network to onsite Class 1E safety buses.

One qualified circuit between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System Same 3.8.1.B One DG inoperable. Two EDGs capable of supplying onsite Class 1E AC Electrical Power Distribution System Yes Provide power to Class 1E safety buses when offsite power to them is lost.

One EDG capable of supplying the onsite Class 1E AC Electrical Power Distribution System Same 3.8.1.C Two offsite circuits inoperable.

Two qualified circuits between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System.

Yes Provide power from offsite transmission network to onsite Class 1E safety buses.

One qualified circuit between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System.

Same 3.8.1.D One offsite circuit inoperable.

AND One DG inoperable.

Two qualified circuits between the offsite transmission network and the onsite Class 1E AC Electrical Power Distribution System.

Two EDGs capable of supplying the onsite Class 1E AC Electrical Power Distribution System Yes Provide power from offsite transmission network to onsite Class 1Esafety buses, and provide onsite power to Class 1E safety buses when offsite power to them is lost.

One qualified circuit between the offsite transmission network and the onsite Class 1E AC Electrical Power distribution system, OR one EDG capable of supplying the onsite Class 1E AC Electrical Power distribution System Same to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 19 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.8.1.F One required LSELS inoperable.

Two Load Shedder and Emergency Load Sequencers: One Load Shedder and Emergency Load Sequencer (LSELS) per 4.16-kVClass 1E AC bus (i.e.,

one Train A LSELS and one Train B LSELS)

Yes Required functions of LSELS are initiating a DG start upon a detected undervoltage condition, tripping of the incoming offsite power upon a detected undervoltage or degraded voltage condition, shedding of nonessential loads, and proper sequencing of loads One LSELS: One Train A LSELS or one Train B LSELS Same to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 20 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.8.4.A One DC electrical power subsystem inoperable.

Two DC electrical power subsystems each consisting of two DC batteries, two battery chargers, one swing battery charger, and all the associated control equipment and interconnecting cabling Yes Ensure availability of required DC power to shut down the reactor and maintain it in a safe condition after an Anticipated Operational Occurrence (AOO) or a postulated DBA One DC electrical power subsystem available Same 3.8.7.A One required inverter inoperable.

Two trains (Train A and Train B) of inverters with two normal inverters or one normal inverter and one swing inverter per train. (The swing inverter may be aligned to either AC vital bus within the train, depending on which normal inverter is unavailable or removed from service.)

Yes Ensure the availability of AC electrical power for the systems instrumentation required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.

One train (Train A or Train B) of inverters consisting of either two normal inverters or one normal inverter and a swing inverter aligned to the AC vital buses for that train Same to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 21 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.8.9.A One AC electrical power distribution subsystem inoperable.

Two AC electrical power distribution subsystems (Train A and Train B),

each with its 4.16-kV Class 1E safety bus and associated load centers energized to their proper voltages Yes Ensure availability of required AC power to shut down the reactor and maintain it in a safecondition after an Anticipated Operational Occurrence or a postulated DBA One AC electrical power distribution subsystem (Train A or Train B) with its 4.16-kV Class 1E safety bus and associated load centers energized to their proper voltages Same to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 22 of 37 Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions TS LCO Action Tech Spec Description SSCs Addressed by TS LCO Condition Modeled in PRA Function Addressed by TS LCO Condition Design Success Criteria PRA Success Criteria Comments 3.8.9.B One AC vital bus subsystem inoperable.

Two AC vital bus subsystems (Train A and Train B) with both buses for each train/subsystem energized to their proper voltage and from their respective normal or swing inverter via inverted DC voltage or the alternate AC source (Bypass Constant Voltage Transformer)

Yes Ensure availability of required AC vital bus electrical power to shut down the reactor and maintain it in a safe condition after an Anticipated Operational Occurrence or a postulated DBA One AC vital bus distribution subsystem (Train A or Train B) with both of its buses energized to their proper voltage Same 3.8.9.C One DC electrical power distribution subsystem inoperable.

Two DC electrical power distribution subsystems (Train A and Train B) with both buses for each train/subsystem energized to their proper voltage from either the associated battery or charger Yes Ensure availability of required DC power to shut down the reactor and maintain it in a safe condition after an Anticipated Operational Occurrence or a postulated DBA One DC electrical power distribution subsystem (Train A or Train B) with both of its buses energized to their proper voltage from either the associated battery or charger Same to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 23 of 37 Notes:

1. The reactor protection system is segmented into four distinct but interconnected modules: field transmitters and process sensors, Signal Process Control and Protection System, Solid State Protection System (SSPS), and reactor trip switchgears. Field transmitters provide measurements of the unit parameters to the Signal Process Control and Protection System via separate, redundant channels. The Signal Process Control and Protection System forwards outputs to the SSPS, which consists of two redundant trains, to initiate a reactor trip or actuate Engineering Safety Functions.
2. Depending on the measured parameter, three or four instrumentation channels are provided to ensure protective action when required and to prevent inadvertent isolation resulting from instrumentation malfunctions. The output trip signal of each instrumentation channel initiates a trip logic. Failure of any one trip logic does not result in an inadvertent trip. Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient.
3. Each instrumentation channel provides input to both trains of the SSPS, which initiates a reactor trip on one-out-of-two logic.

Each train of SSPS provides input to the Reactor Trip Breakers (RTBs) by de-energizing the RTB undervoltage coils, which trips open the RTBs, tripping the reactor. One-out-of-two open RTBs will trip the reactor.

4. Each RTB is equipped with a shunt trip device that is energized to trip the RTB open and an undervoltage coil device that is de-energized to trip the RTB open upon receipt of a manual reactor trip signal. Either device can trip the RTB open, thus providing a redundant and diverse trip mechanism. Two Manual Reactor Trip channels provide the signal from reactor trip switches located in the Main Control Room to the RTBs.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 24 of 37

5. A trip breaker train consists of all trip breakers associated with a single Reactor Trip System logic train that are racked in, closed, and capable of supplying power to the Rod Control System.
6. PRA Success Criteria for feed and bleed cooling can be summarized as follows:

Two feed and bleed (F&B) decay heat removal success criteria are utilized in the Callaway PRA:

If any one (1) of the four (4) higher-head ECCS pumps (in the injection phase) provides flow for successful F&B decay heat removal, then both pressurizer power-operated relief valves (PORVs) must open. Because a medium head (approximately 1500 psia shutoff head) safety injection pump (SIP) is credited as a potential feed source, both PORVs must open for the bleed path to provide faster depressurization to reach the shutoff head of the pumps.

If one (1) of the two centrifugal charging pumps (CCPs) is required (in the injection phase) for successful F&B decay heat removal, then only one (1) pressurizer PORV must open. Because only high head (approximately 2500 psia shutoff head)

CCPs are credited as potential feed sources, only one PORV must open for the bleed path.

Each PZR PORV requires power from its respective DC division to perform its safety function for feed and bleed.

7. PRA Success Criteria for the number of required cells in an Ultimate Heat Sink (UHS) cooling tower train utilized in the Callaway PRA is as follows:

One cooling tower cell per train.

Thermal analysis has been performed to show that success of a single cooling tower cell per train provides sufficient heat dissipation from the ESW system to ensure the UHS pond temperature limit is not exceeded for the PRA mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 25 of 37 Table E1-2: RICT Estimates1,2,3,4 Tech Spec LCO Condition RICT Estimate (Days) (1,2) 3.3.1.B One Manual Reactor Trip channel inoperable 30.0 3.3.1.D One Power Range Neutron Flux-High channel inoperable 30.0 3.3.1.E One channel inoperable 30.0 3.3.1.K One channel inoperable 30.0 3.3.1.M One Low Fluid Oil Pressure Turbine Trip channel inoperable 30.0 3.3.1.P One train inoperable 30.0 3.3.1.Q One RTB train inoperable 30.0 3.3.1.U One trip mechanism inoperable for one RTB 30.0 3.3.2.B One channel or train inoperable 30.0 3.3.2.C One train inoperable 30.0 3.3.2.D One channel inoperable 30.0 3.3.2.F One channel or train inoperable.

30.0 3.3.2.G One train inoperable 30.0 3.3.2.I One channel inoperable 30.0 3.3.2.J One channel inoperable 30.0 3.3.2.K One channel inoperable 30.0 3.3.2.Q One train inoperable 30.0 3.3.2.R One or both train(s) inoperable 30.0 3.3.2.S One train inoperable 30.0 3.3.5.A One or more Functions with one channel per bus inoperable 30.0 3.4.11.B One PORV inoperable for reasons other than excessive seat leakage 30.0 3.4.11.C One block valve inoperable 30.0 3.5.2.A One or more trains inoperable AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available.

30.0 3.6.2.C One or more containment air locks inoperable for reasons other than Condition A or B.

4.9 3.6.3.A One or more penetration flow paths with one containment isolation valve inoperable except for containment purge valve leakage not within limit.

30.0 3.6.3.C One or more penetration flow paths with one containment isolation valve inoperable.

30.0 3.7.2.A One MSIV actuator train inoperable 30.0 3.7.2.B Two MSIV actuator trains inoperable for different MSIVs when the inoperable actuator trains are not in the same separation group.

30.0 3.7.2.F One MSIV inoperable in MODE 1.

30.0 3.7.4.A One required ASD line inoperable for reasons other than excessive ASD seat leakage 30.0 3.7.5.A One steam supply to turbine driven AFW pump inoperable.

30.0 3.7.5.B One ESW supply to turbine driven AFW pump inoperable.

30.0 3.7.5.C One AFW train inoperable for reasons other than Condition A or B.

30.0 3.7.7.A One CCW train inoperable 30.0 to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 26 of 37 Table E1-2: RICT Estimates1,2,3,4 Tech Spec LCO Condition RICT Estimate (Days) (1,2) 3.7.8.A One ESW train inoperable 16.1 3.7.9.A One cooling tower train inoperable 30.0 3.8.1.A One offsite circuit inoperable 30.0 3.8.1.B One DG inoperable 30.0 3.8.1.C(2)

Two offsite circuits inoperable 1.1 3.8.1.D One offsite circuit inoperable AND One DG inoperable 21.8 3.8.1.F One required LSELS inoperable 30.0 3.8.4.A One DC electrical power subsystem inoperable 6.0 3.8.7.A One required inverter inoperable 5.7 3.8.9.A One AC electrical power distribution subsystem inoperable 4.4 3.8.9.B One AC vital bus subsystem inoperable 5.5 3.8.9.C One DC electrical power distribution subsystem inoperable 6.0 Notes to Table E1-2:

1.

RICTs presented in Table E1-2 were calculated using the current federated PRA models. Following 4b implementation, the actual RICT values, applying the CRMP tool, will be calculated using the actual plant configuration and the current revision of the PRA model representing the as built, as-operated condition of the plant, as required by NEI 06-09-A, Revision 0-A and the NRC safety evaluation, and may differ from the RICTs presented in this table.

2.

RICTs are based on the internal events, internal flood, and internal fire, seismic, and high winds PRA model calculations. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A, Revision 0-A. RICTs not capped at 30 days are rounded to nearest tenth of a day.

3.

Per NEI 06-09-A, Revision 0-A, for plant configuration cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be entered.

4.

The results presented in Table E1-2 are an attempt to determine a bounding condition that might place the Plant in a given LCO. These are examples only and do not cover all possible combinations of equipment unavailability that may place the Plant in a given LCO Action. This process can result in apparent discrepancies in results between similar LCO Actions. E.g., for LCO 3.8.1.A a loss or unavailability of the 'A' train offsite power transformer XNB01 was used; for LCO 3.8.1.B a loss or unavailability of the 'A' EDG was used; for LCO 3.8.9.A a loss of the 'B' class 1E safety buss (due to a buss fault) was used, this choice fails all potential power sources and all supported equipment on that buss - as opposed to a single power source to the associated buss for the previous two LCOs.

2.0 ADDITIONAL JUSTIFICATION FOR SPECIFIC ACTIONS This section contains the additional technical justification for the list of Required Actions from Table 1, Conditions Requiring Additional Technical Justification, of TSTF-505, Revision 2.

Table 1, Conditions Requiring Additional Technical Justification, of TSTF-505 Revision 2 (ADAMS Accession No. ML18183A493) contains a list of required actions that may be proposed for inclusion in the RICT Program, but require additional technical justification to be provided by the licensee.

The following eight conditions are proposed to be included in the scope of the RICT program, but are identified in Table 1 as requiring additional justification:

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 27 of 37 Condition 3.3.1.D, One Power Range Neutron Flux - High channel inoperable Condition 3.3.1.Q, One RTB train inoperable Condition 3.5.2.A, One or more trains inoperable AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available Condition 3.6.2.C, One or more containment air locks inoperable for reasons other than Condition A or B Condition 3.6.6.A, One containment spray train inoperable Condition 3.6.6.C, One containment cooling train inoperable Condition 3.7.2.F, One MSIV inoperable in MODE 1 Condition 3.7.4.B, Two required ASD lines inoperable for reasons other than excessive ASD seat leakage.

As some of the TSs vary between the TSTF-505 and the site TS, the table in Attachment 5 provides a cross-reference between Table 1 of TSTF-505, Revision 2, and the Callaway Plant, Unit No. 1, LCOs in the scope of the proposed RICT Program.

2.1 TS 3.3.1 - Reactor Trip System (RTS) Instrumentation LCO:

The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

Condition D:

One Power Range Neutron Flux - High channel inoperable As indicated in Table E1-1, the Power Range Neutron Flux - High channels are not explicitly modeled in the Callaway PRA. The PRA models these channels as only one of many inputs into the reactor trip signal. Therefore, the failure of 1 of 2 reactor trip breakers provides a bounding surrogate for any equipment failure that would place the site in 3.3.1 D. As described in Section 7.2.2.3.1, Neutron Flux, of the Callaway FSAR, Revision OL-25:

Four power range neutron flux channels are provided for overpower protection. An isolated auctioneered high signal is derived by auctioneering the four channels for automatic rod control (automatic rod insertion only - automatic rod withdrawal no longer available). If any channel fails in such a way as to produce a low output, that channel is incapable of proper overpower protection but will not cause control rod movement as automatic rod withdrawal is no longer available. Two-out-of-four overpower trip logic will ensure an overpower trip if needed, even with an independent failure in another channel.

In addition, channel deviation signals in the nuclear instrumentation system (NIS), will give an alarm if any neutron flux channel deviates significantly from the average of the flux signals.

Finally, an overpower signal from any one neutron flux intermediate or power range channel will block any rod withdrawal. The setpoints for these rod stops are below the reactor trip setpoints.

These alarms and actions signify periodic monitoring of spatial power distribution and imposition of compensatory limits and reduced power.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 28 of 37 Therefore, TS 3.3.1 Condition D meets the requirements for inclusion in the RICT Program.

2.2 TS 3.3.1 - Reactor Trip System (RTS) Instrumentation LCO:

The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.

Revised Condition Q:

One RTB train inoperable.

As indicated in Table E1-1 of Enclosure 1, the RTB trains are explicitly modeled in the Callaway PRA. The PRA Success Criterion is the same as the Design success criteria which is one of two RTBs open. The completion time and bypass time delineated in TSTF-411 are not changed by this submittal, only modified by the allowed use of a RICT. The commitments made with respect to actions when an RTB train is inoperable are still applicable when the RICT program is not being utilized as permitted by this submittal.

During normal operation the output from the SSPS is a voltage signal that energizes the undervoltage coils in the RTBs and bypass breakers, if in use. When the required logic matrix combination is completed, the SSPS output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by the de-energized undervoltage coil, and the RTBs and bypass breakers are tripped open. This allows the shutdown rods and control rods to fall into the core. In addition to the de-energization of the undervoltage coils, each reactor trip breaker is also equipped with an automatic shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the SSPS. Either the undervoltage coil or the shunt trip mechanism is sufficient by itself, thus providing a diverse trip mechanism.

As documented in the Callaway FSAR Section 7.7.1.11.1, the ATWS Mitigation System Actuation Circuit (AMSAC) is designed to provide protections in the event of a failure within the RTS system to provide a reactor trip. The AMSAC signal will initiate an AFAS (MD and TD), a turbine trip as well as close the steam generator blowdown isolation valves and close the steam generator sample isolation valves.

Therefore, TS 3.3.1 Condition Q meets the requirements for inclusion in the RICT Program.

2.3 TS 3.5.2 - ECCS - Operating LCO:

Two ECCS trains shall be OPERABLE.

Condition A:

One or more trains inoperable AND at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available As indicated in Table E1-1, the ECCS trains are explicitly modeled in the Callaway PRA. The PRA success Criterion is the same as the Design Success Criteria which is, 3 ECCS subsystems between two trains such that at least 100% ECCS flow equivalent to a single operable ECCS train is available.

Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 29 of 37 a loss of function for the ECCS.

Additionally, Callaway TS 3.5.2 Condition A requires, "One or more trains inoperable AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available." With less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, LCO 3.0.3 would be entered. Therefore, Condition A 100% of the ECCS flow stipulation prevents an ECCS loss of function from occurring due to two ECCS trains being inoperable in Condition A.

TSTF-505, Rev. 2, Table 1 states: "Licensee must justify that one or more ECCS trains inoperable is not a condition in which all required trains or subsystems of a TS required system are inoperable. Acceptable justification is TS Condition requiring 100% flow equivalent to a single ECCS train."

Therefore, TS 3.5.2 Condition A meets the requirements for inclusion in the RICT Program.

2.4 TS 3.6.2 - Containment Air Locks LCO:

Two containment air locks shall be OPERABLE.

Condition C:

One or more containment air locks inoperable for reasons other than Condition A or B.

As indicated in Table E1-1 of Enclosure 1, the containment air locks are not explicitly modeled in the Callaway PRA. Since the containment airlocks are not modeled, there are no explicit PRA Success Criteria. The Design Success Criterion is: One of two containment air lock doors closed.

Since the containment airlocks are not modeled, their unavailability will be conservatively analyzed as an early containment failure as a conservative surrogate in the RICT calculation.

Each containment air lock forms part of the containment pressure boundary. As part of the containment pressure boundary, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

Compliance with the remaining portions of LCO Condition 3.6.2 ensures that there is a physical barrier (i.e., closed door) and an acceptable overall leakage from containment. Thus, the function is still maintained. Required Action C.1 of LCO Condition 3.6.2 requires the condition to be assessed in accordance with TS 3.6.1, Containment Integrity (i.e., Initiate action to evaluate overall containment leakage rate per LCO 3.6.1 with a Completion Time of Immediately). If containment leakage exceeds LCO 3.6.1 limits and cannot be restored to OPERABLE within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the plant is taken to Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Therefore, TS 3.6.2 Condition C meets the requirements for inclusion in the RICT Program.

2.5 TS 3.6.6 - Containment Spray and Cooling Systems LCO:

Two containment spray trains and two containment cooling trains to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 30 of 37 shall be OPERABLE.

Condition A:

One containment spray train inoperable Condition C:

One containment cooling train inoperable The Containment Spray and Containment Cooling systems provide containment atmosphere cooling to limit post-accident pressure and temperature in containment to less than the design values. Each train of Containment Spray consists of one pump, spray headers, nozzles, valves and associated piping. Each train of Containment Cooling consists of two fan coil units and associated ducting. Application of the RICT program to the referenced 3.6.6 A and C Conditions would require that one train remain operable and thus does not represent a loss of function during any proposed RICT application.

Containment sprays and Containment Cooling are not modeled for success in the Level 1 PRA or in the LERF PRA. Hydraulic analysis has been performed using MAAP to show that success or failure of Containment Spray and Containment Cooling does not impact which sequences contribute to LERF. While Containment Spray operation could impact the timing of swapping over to containment recirculation, the increased rate of RWST depletion is conservatively considered within the PRA model where appropriate.

The Callaway LERF model was developed using the guidance within WCAP-16341-P which is consistent with NUREG/CR-6595 Rev. 1. As stated within these and other documents (NUREG-1524, NUREG-1150, NUREG/CR-6338), Containment Cooling is not important for large, dry PWRs such as Callaway. These generic analyses were confirmed with Callaway-specific MAAP analysis. This plant specific work indicated that Containment Spray was only effective in fission product mitigation in a small subset of the core damage frequency progressing to LERF, and the majority of core damage frequency is associated with late containment failure. Current MAAP analyses without credit for Containment Spray and Cooling shows that containment does not fail early and thus LERF would not change due to any operation of either system.

As Containment Spray and Cooling trains are not modeled in the PRA, RICT application to these LCO's is dependent on the delta-risk indicated by the plant state at the time of LCO entry.

Mapping will be added to the CRM model which will allow operators to enter these LCO's and take the applicable equipment OOS, but where there is no direct delta-risk, the 30 day back stop would apply. If other equipment were OOS at the time, that delta-risk would be evaluated and a commensurate RICT would be applied. The hydraulic analyses discussed within this section would remain applicable to any RICT entry. The risk at the time of implementation of RICT would represent the likelihood of a core damage state to occur.

Therefore, TS 3.6.6 Conditions A and C meet the requirements for inclusion in the RICT Program.

2.6 TS 3.7.2 - Main Steam Isolation Valves (MSIVs), Main Steam Isolation Valve Bypass Valves (MSIVBVs), and Main Steam Low Point Drain Isolation Valves (MSLPDIVs)

LCO:

The MSIV and its associated actuator trains, the MSIVBV, and the to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 31 of 37 MSLPDIV in each of the four main steam lines shall be OPERABLE.

Condition F:

One MSIV inoperable in MODE 1 As indicated in Table E1-1 of Enclosure 1, the MSIVs are explicitly modeled in the Callaway PRA. The Design Success Criteria is Closure of 3 of 4 MSIVs which matches the PRA success criteria.

The MSIVs isolate steam flow from the secondary side of the steam generators following a High Energy Line Break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generators.

The design basis of the MSIVs is established by the containment analysis for the large steam line break (SLB) inside containment, discussed in FSAR Section 6.2.1.4 (Ref. 5). It is also affected by the accident analysis of the SLB events presented in the FSAR, Section 15.1.5. The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIV to close on demand). The postulated accidents (including the main steam line break, the feed water line break, and the steam generator tube rupture) assume the MSIVs function to isolate the secondary system to ensure the primary success path for steamline and feedline isolation and for delivery of required auxiliary feedwater flow.

As described in FSAR Section 10.3.1, Revision OL-25, there is one MSIV on each of the four loops to the SGs. FSAR Section 15.1.5.2 provides information regarding an alternate method of preventing blowdown of more than one steam generator:

Steam release from more than one steam generator will be prevented by automatic trip of the isolation valves in the steamlines by low steamline pressure signals, high-high containment pressure signals, or by high negative steamline pressure rate signals.

Even with the failure of one valve, release is limited by main steam isolation valve closure for the other steam generators while the one generator blows down.

From FSAR 15.1.5.1 regarding MSIV's:

Isolation valves are provided in each steamline. For breaks down-stream of the isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location, no more than one steam generator would experience an uncontrolled blowdown, even if one of the isolation valves fails to close. A description of steamline isolation is included in FSAR Section 10.3. In the analysis, these valves are assumed to fully close within 17 seconds upon receipt of a steamline isolation signal following a large break in a steamline. The 17 seconds includes a 2 second signal processing delay assumption. Additionally, an engineering evaluation was completed to support an increase in the main steam isolation valve stroke delay up to 60 seconds for steam generator pressures below that which corresponds to the P-11 permissive set point. This evaluation demonstrated that the acceptance criteria continue to be met for this scenario. More information on this engineering evaluation can be found in Reference 6.

Therefore, TS 3.7.2 Condition F meets the requirements for inclusion in the RICT Program.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 32 of 37 3.0 EVALUATION OF INSTRUMENTATION AND CONTROL SYSTEMS The following Instrumentation Technical Specifications Sections are included in the TSTF-505 application for the Callaway Plant, Unit No. 1.

The Callaway Plant, Unit No. 1, Technical Specifications 3.3, INSTRUMENTATION, LCOs were developed to assure that the Callaway Plant, Unit No. 1, facility maintains necessary redundancy and diversity. The reactor protection systems are designed in accordance with IEEE 279-1968. Furthermore, it is shown that the intent of the applicable criteria and codes at the time of construction, such as the GDCs referenced in Sections 1.2 and 1.5 of the Callaway Plant, Unit No. 1, Final Safety Analysis Report and IEEE 279-1971 (Ref. 7). The Engineered Safety Features Actuation System meets the single failure criterion as defined in Institute of Electrical and Electronics Engineers (IEEE) Standard 279-1971.

TSTF-505 (Reference 4) sets forth the following as guidance for what is to be included in this enclosure:

The description of proposed changes to the protective instrumentation and control features in TS Section 3.3, Instrumentation, should confirm that at least one redundant or diverse means (other automatic features or manual action) to accomplish the safety functions (for example, reactor trip, SI, containment isolation, etc.) remains available during use of the RICT, consistent with the defense-in-depth philosophy as specified in RG 1.174. (Note that for each application, the staff may selectively audit the licensing basis of the most risk-significant functions with proposed RICTs to verify that such diverse means exist.)

The following sections provide the justification that defense-in-depth is maintained for the applicable functions throughout the application of the RICT Program.

3.1 Reactor Trip System (RTS)

Reference:

TS 3.3.1, Reactor Trip System (RTS) Instrumentation The RTS design creates defense-in-depth due to the redundancy of the channels for each function.

Each function has multiple channels.

Each function will cause a reactor trip with 1/2, 2/3, or 2/4 channels tripped.

A bypassed channel does not trip. It reduces the number of total available channels by 1, e.g., from 2/4 to 2/3.

When applicable, if 1 channel in the function is out of service, then the 1 channel can be placed in trip, reducing the number of channels required to actuate the function; e.g., from 2/4 to 1/3.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 33 of 37 The RTS also employs diversity in the number and variety of different inputs which will initiate a reactor trip. A given reactor trip will typically be accompanied by several diverse reactor trip inputs from the RTS.

Diverse inputs trip the reactor (FSAR Table 7.2-1).

Power range high neutron flux (low setting) - 2/4 Power range high neutron flux (high setting) - 2/4 Intermediate range high neutron flux - 1/2 Source range high high neutron flux - 1/2 Power range high positive neutron flux rate - 2/4 Overtemperature T - 2/4 Overpower T - 2/4 Pressurizer low pressure - 2/4 when above 10% reactor power Pressurizer high pressure - 2/4 Pressurizer high water level - 2/3 when above 10% reactor power Low reactor coolant flow - 2/3 in any loop when reactor power > 48%; 2/3 in any two loops when reactor power > 10%

Reactor coolant pump undervoltage - 1/2 in both busses when above 10% reactor power Reactor coolant pump underfrequency - 1/2 in both busses when above 10% reactor power Low-low steam generator water level - 2/4 in any loop Safety injection signal - coincident with actuation of safety injection Turbine trip (anticipatory)

-Low trip fluid pressure - 2/3

-Turbine stop - 4/4 Manual - 1/2 See FSAR Table 7.2-4 for accident assumptions.

3.2 Engineered Safety Features Actuation System (ESFAS)

Reference:

TS 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation The ESFAS design creates defense-in-depth due to the redundancy of the channels for each function.

Each function has multiple channels.

Each function will cause a reactor trip with 1/2, 2/3, or 2/4 tripped signals.

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 34 of 37 A bypassed channel does not trip. It reduces the number of total available channels by 1; e.g., from 2/4 to 2/3.

When applicable, if 1 channel in the function is out of service, then the 1 channel can be placed in trip, reducing the number of channels required to actuate the function; e.g., from 2/4 to 1/3.

Inputs create diverse equipment response (FSAR Table 7.3-1 and 7.3-2, FSAR Section 7.3.1, and TS Bases 3.3.2).

Safety Injection Manual - 1/2 Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains Containment Pressure - High 1 - 2/3 Pressurizer Pressure - Low - 2/4 Steamline Pressure Low - 2/3 in one steam line Containment Spray Manual - 1/2 switches at 2/2 locations Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains Containment Pressure High 3 - 2/4 Containment Isolation (Phase A)

Manual - 1/2 Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains Any SI Signal Containment Isolation (Phase B)

Manual - 1/2 switches at 2/2 locations Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains Containment Pressure High 3 - 2/4 Steamline Isolation Manual - 1/2 Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains Automatic Actuation Logic and Actuation Relays (MSFIS) - 1/2 trains Containment Pressure High 2 - 2/3 Steam Line Pressure Low - 2/3 in one steam line (Can be blocked with Pressurizer Pressure below 1970 psig)

Steam Pressure Negative Rate High - 2/3 in one steamline (Interlocked when Steam Line Pressure Low is blocked below 1970 psig)

Turbine Trip and Feedwater Isolation Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains Automatic Actuation Logic and Actuation Relays (MSFIS) - 1/2 trains Steam Generator Water Level - High High (P-14) - 2/4 in one Steam Generator Any SI Signal SG Water Level Low Low (Adverse Containment Environment) - 2/4 per SG SG Water Level Low Low (Normal Containment Environment) - 2/4 per SG to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 35 of 37 SG Water Level Low-Low Containment Pressure Environmental Allowance Modifier -

2/4 EAM Channels Auxiliary Feedwater Manual - 1/pump Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains Automatic Actuation Logic and Actuation Relays (BOP ESFAS) - 1/2 trains SG Water Level Low Low (Adverse Containment Environment) - 2/4 per SG SG Water Level Low Low (Normal Containment Environment) - 2/4 per SG SG Water Level Low-Low Containment Pressure Environmental Allowance Modifier -

2/4 EAM Channels Any SI Signal Loss of Offsite Power - Starts Turbine Driven Aux Feed Pump - 1/2 trains Trip of all main feed pumps - Starts Motor Driven Aux Feed Pump - Two of four, one in the same separation group from each feed pump Auxiliary Feedwater Pump Suction Transfer on Suction Pressure - Low - 2/3 Automatic Switchover to Containment Sump Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains Refueling Water Storage Tank (RWST) Level Low Low Coincident with Safety Injection Signal present - 2/4 ESFAS Interlocks Reactor Trip, P 1 per train/2 trains Pressurizer Pressure, P 2/3 Automatic Pressurizer PORV Actuation Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains Pressurizer Pressure - High-2/4 Steam Generator Blowdown and Sample Line Isolation Manual - 1 per MDAFW pump Automatic Actuation Logic and Actuation Relays (BOP ESFAS) - 1/2 trains Any SI Signal Loss of Offsite Power - SGBSIS (isolation signal) - 1/2 trains 3.3 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation

Reference:

TS 3.3.5, Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation Each diesel generator has a starting control system, initiated either manually or automatically, which, when energized from the 125-VDC distribution bus of each diesel generators own ESF division, provides an independent emergency source of power in the event of a complete loss of offsite power with sufficient capacity to supply all of the electrical loads that are required for reactor safe shutdown either with or without a loss-of-coolant accident (LOCA)

(FSAR 8.3.1.1.2.2).

to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 36 of 37 The LOP DG Start Instrumentation design creates defense-in-depth due to the redundancy of the channels for each function.

Controls and circuitry for starting and loading each redundant diesel generator set are electrically and physically independent.

A diesel generator is started by any one of the following (FSAR 8.3.1.1.3):

Receipt of a safety injection signal (SIS)

Loss of voltage to the respective 4.16-kV Class 1E bus to which each generator is connected Manual - Remote switch actuation (main control room)

Manual - Local switch actuation (diesel generator room)

Emergency Manual - Local switch actuation (diesel generator room)

Diverse inputs start the diesel generators.

Manual Any SI Signal Loss of Power (LOP) signal on 4.16-kV Class 1E bus served by the diesel generator (1/2 bus). LOP signal is generated by:

  • Degraded voltage relays if voltage is below 90% after a longer time delay (2/4 channels)
  • Undervoltage relays if voltage is below 70% for a short time delay (2/4 channels) to ULNRC-06739 List of Revised Required Actions to Corresponding PRA Functions Page 37 of 37

4.0 REFERENCES

1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).
2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).
3. NUREG/CR-5500, Volume 2, Reliability Study: Westinghouse Reactor Protection System, 1984-1995, December 1998.
4. TSTF-505-A, Rev. 2, Technical Specifications Task Force Improved Standard Technical Specifications Change Traveler, November 2018.
5. Final Safety Analysis Report (FSAR) - Callaway Nuclear Power Plant, Unit 1, Revision OL-25.
6. SCP-07-19, Main Steam Isolation Valve (MSIV) Stroke Time Evaluation Phase 2 Report Revision 0, February 16, 2007.
7. Institute of Electrical and Electronics Engineers (IEEE) Standard 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, June 3, 1971.
Retrieved from "https://kanterella.com/w/index.php?title=ML22181B140&oldid=3794094"