ML22335A509

From kanterella
Jump to navigation Jump to search
Description and Assessment of the Proposed Change
ML22335A509
Person / Time
Site: Callaway Ameren icon.png
Issue date: 12/01/2022
From:
Ameren Missouri, Union Electric Co
To:
Office of Nuclear Reactor Regulation
Shared Package
ML22335A507 List:
References
ULNRC-06781
Download: ML22335A509 (1)
v • d • e


Text

Enclosure to ULNRC-06781 Page 1 of 21 DESCRIPTION AND ASSESSMENT OF THE PROPOSED CHANGE

1.

SUMMARY

DESCRIPTION Page 2

2. DETAILED DESCRIPTION Page 2 2.1 Proposed Changes Page 2 2.2 Background Page 3
3. TECHNICAL EVALUATION Page 8
4. REGULATORY EVALUATION Page 16 4.1 Applicable Regulatory Requirements/Criteria Page 16 4.2 Precedent Page 17 4.3 No Significant Hazards Consideration Determination Page 17 4.4 Conclusions Page 20
5. ENVIRONMENTAL EVALUATION Page 20
6. REFERENCES Page 20 ATTACHMENTS:
1. Proposed FSAR Changes (Markups)
2. Proposed TS Bases Changes (Markups)

Enclosure to ULNRC-06781 Page 2 of 21 1.0

SUMMARY

DESCRIPTION Pursuant to 10 CFR 50.90, Application for amendment of license or construction permit, Ameren Missouri (Union Electric Company) herewith transmits an application for amendment to Facility Operating License Number NPF-30 for the Callaway Plant. The proposed amendment is requesting NRC approval of a change (clarification) to the plant's licensing basis, i.e., the Technical Specification (TS) Bases and Final Safety Analysis Report (FSAR), to allow use of one train of the normal, non-safety related Service Water (SW) system to provide cooling water support (in lieu of support from the associated safety-related Essential Service Water (ESW) train) for one of two redundant trains of TS-required equipment when both equipment trains are required to be Operable during cold shutdown/refueling conditions. The supported equipment/systems affected by the proposed change are the Residual Heat Removal (RHR) system and Control Room Air Conditioning System (CRACS), as applicable during Modes 5 and 6. The applicable/affected TS Limiting Conditions of Operation (LCOs) are TS LCO 3.4.8, "RCS Loops - Mode 5, Loops Not Filled," TS LCO 3.7.11, "Control Room Air Conditioning System (CRACS)," and TS LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."

2.0 DETAILED DESCRIPTION

2.1 PROPOSED CHANGE

S Consistent with the intent to permit the use of non-safety related SW (in lieu of safety-related ESW to support one and only one of the two trains of RHR and/or CRACS during Modes 5 and 6 (i.e., during the plant conditions specified in the Applicability of each of the above-noted TSs), the following text/statements are proposed to be added/inserted in the LCO sections of the Bases for the affected/applicable TSs.

TS Bases 3.4.8 - RCS Loops - MODE 5, Loops Not Filled:

Cooling water for the RHR loops is provided by the Component Cooling Water System. The heat sink for the Component Cooling Water System is the Service Water System or Essential Service Water System, as determined by system availability and plant operational constraints during MODE 5. Specifically, one train of the Service Water System may serve as the heat sink for one of the two required RHR loops, provided that one train of the Essential Service Water System serves as the heat sink for the other RHR loop.

TS Bases 3.7.11 - CRACS Cooling water for the CRACS trains is provided by the Service Water System or Essential Service Water System, as determined by system availability and plant operational constraints during MODES 5 and 6. Specifically, in MODES 5 and 6, and during movement of irradiated fuel, one train of the Service Water System may serve as the heat sink for one of the two required CRACS trains, provided that one train of the Essential Service Water System serves as the heat sink for the other CRACS train.

Enclosure to ULNRC-06781 Page 3 of 21 TS Bases 3.9.6 - RHR and Coolant Circulation - Low Water Level:

Cooling water for the RHR loops is provided by the Component Cooling Water System. The heat sink for the Component Cooling Water System is the Service Water System or Essential Service Water System, as determined by system availability and plant operational constraints during MODE 6. Specifically, one train of the Service Water System may serve as the heat sink for one of the two required RHR loops, provided that one train of the Essential Service Water System serves as the heat sink for the other RHR loop.

Additionally, the following bracketed text/statements are proposed to be added/inserted in the applicable sub-sections of the Callaway FSAR, Standard Plant, section 9.4.1, Control Building HVAC, as noted.

FSAR SP 9.4.1.2.2 - Component Description Both the control room air-conditioning unit and the Class 1E electrical equipment air-conditioning unit consist of high efficiency prefilters, a self-contained refrigeration system utilizing essential service water as the heat sink, centrifugal fans, and electric motor drivers.

[(During cold shutdown or refueling conditions (Mode 5 or Mode 6 per the plant's Technical Specifications), one (and only one) of the two control room air-conditioning units may have normal service water solely aligned to it as its heat sink (i.e., without essential service water available), as permitted per the plant's Technical Specifications for such conditions.)]

FSAR SP 9.4.1.2.3 - System Operation Cooling water for the nonessential units is supplied by the central chilled water system (Section 9.4.10), and cooling water for the safety-related units is supplied by the essential service water system [(except that during cold shutdown or refueling conditions (Mode 5 or Mode 6 per the plant's Technical Specifications), one (and only one) of the two control room air-conditioning units may have normal service water solely aligned to it as its heat sink (i.e., without essential service water available), as permitted per the plant's Technical Specifications for such conditions)] (Section 9.2.1). Hot water for the control building supply air unit is supplied by the plant heating system (Section 9.4.9).

2.2 BACKGROUND

The systems involved in this License Amendment Request (LAR) are the SW system, ESW system, Component Cooling Water (CCW) system, RHR system, and CRACS. A brief description and relevant background information for each of these systems and their applicable functions is provided as follows:

RHR:

In Mode 5 with the Reactor Coolant System (RCS) loops not filled, the primary function of the reactor coolant is the removal of decay heat generated in the fuel and the transfer of this heat to the CCW system via the RHR heat exchangers. The secondary function of the reactor coolant

Enclosure to ULNRC-06781 Page 4 of 21 is to act as a carrier for the soluble neutron poison, boric acid. During RHR system operation, heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the CCW system. The heat sink for the CCW system is in turn normally provided by the SW system or ESW system, as determined by TS LCO requirements and system availability. The flow provided by one RHR loop is adequate for decay heat removal.

In Mode 5, RCS circulation is considered in the determination of the time available for mitigation of the accidental boron dilution event. The operation of one RHR train in Mode 5 provides adequate flow to ensure mixing, prevent stratification, and produce gradual reactivity changes during RCS boron concentration reductions. The reactivity change rate associated with boron reduction will, therefore, be within the transient mitigation capability of the Boron Dilution Mitigation System. The boron dilution analysis in this mode takes credit for the mixing volume associated with having at least one RHR train in operation.

The purpose of the RHR system in Mode 6 is to remove decay heat and the stored thermal energy of the RCS, as required by General Design Criterion (GDC) 34 (10 CFR 50, Appendix A) (Reference 3), to provide mixing of borated coolant, and to prevent boron stratification.

Heat is removed from the RCS by circulating reactor coolant through the RHR heat exchangers where the heat is transferred to the CCW system. (The heat sink for the CCW system is in turn normally provided by the SW system or ESW system, as determined by TS LCO requirements and system availability). The coolant is then returned to the RCS via the RCS cold leg(s).

Operation of the RHR System for normal cooldown decay heat removal is manually accomplished from the control room. The heat removal rate is adjusted by controlling the flow of reactor coolant through the RHR heat exchanger(s) and the bypass lines. Mixing of the reactor coolant is maintained by this continuous circulation of reactor coolant through the RHR System.

If the reactor coolant temperature is not maintained below 200°F, boiling of the reactor coolant could result. This could lead to a loss of coolant in the reactor vessel. Additionally, boiling of the reactor coolant could lead to boron plating out on components near the areas of the boiling activity. The loss of reactor coolant and the subsequent plate out of boron will eventually challenge the integrity of the fuel cladding, which is a fission product barrier. Two trains of the RHR system are required to be Operable, with one train in operation, in order to prevent this challenge.

CRACS:

The CRACS provides temperature control for the control room. The CRACS consists of two independent and redundant trains that provide cooling of recirculated control room air. Each train consists of a prefilter, self-contained refrigeration system (using ESW as a heat sink),

centrifugal fans, instrumentation, and controls to provide for control room temperature control.

The CRACS is a subsystem to the Control Room Emergency Ventilation System, providing air temperature control for the control room. The CRACS is an emergency system, which also operates during normal unit operations. A single train will provide the required temperature

Enclosure to ULNRC-06781 Page 5 of 21 control to maintain the control room 84°F. The design basis of the CRACS is to maintain the control room temperature for 30 days of continuous occupancy.

The CRACS components are arranged in redundant, safety related trains. During normal or emergency operations, the CRACS maintains the temperature 84°F. The CRACS is designed such that a single active failure of a component of the CRACS, with a loss of offsite power (LOOP), does not impair the ability of the system to perform its design function, except that during shutdown conditions, TS requirements are relaxed on the basis that it is not necessary to assume a single failure concurrent with a LOOP. Redundant detectors and controls are provided for control room temperature control. The CRACS is capable of removing sensible and latent heat loads from the control room, which include consideration of equipment heat loads and personnel occupancy requirements, to ensure equipment Operability.

CCW:

The CCW system provides a heat sink for the removal of process and operating heat from safety-related components during a Design Basis Accident (DBA) or transient. During normal operation, the CCW system also provides this function for various nonessential components as well as the spent fuel storage pool. The CCW system serves as a barrier to the release of radioactive byproducts between potentially radioactive systems and the ESW system, and thus to the environment.

The CCW system is arranged as two independent, full capacity cooling loops, and has isolatable non-safety-related components. Each safety-related train includes two full capacity pumps, surge tank, heat exchanger, piping, valves, and instrumentation. Each safety-related train is powered from a separate bus. The principal safety-related function of the CCW system is the removal of decay heat from the reactor via the RHR system. This may be during a normal or post-accident cooldown and shutdown. The design basis of the CCW system is for one CCW train to remove the heat from components important to mitigating the consequences of a loss of coolant accident (LOCA) or a main steam line break (MSLB). The CCW system is designed to perform its function with a single failure of any active component, assuming a LOOP (except that during shutdown conditions, TS requirements are relaxed on the basis that it is not necessary to assume a single failure concurrent with a LOOP).

ESW:

The ESW system provides a heat sink for the removal of process and operating heat from safety-related components during a DBA or transient. During normal operation, and a normal shutdown, the ESW system also provides this function for various safety- related and non-safety related components and receives coolant flow from the non-safety related SW system.

The ESW system consists of two separate, 100% capacity, safety-related, cooling water trains.

Each train consists of a self-cleaning strainer, prelube tank, one 100% capacity pump, piping, valving, and instrumentation. The pumps and valves are remote and manually aligned, except in the unlikely event of a LOCA. The pumps are automatically started upon receipt of a safety injection signal, low suction pressure to the auxiliary feedwater pumps coincident with an

Enclosure to ULNRC-06781 Page 6 of 21 auxiliary feedwater actuation signal, or LOOP. Upon receipt of one of these signals, the automatically actuated essential valves are aligned to their post-accident positions as required.

The ESW system also provides emergency makeup to the spent fuel pool and CCW system and is the backup water supply to the Auxiliary Feedwater system.

The principal safety-related function of the ESW system is the removal of decay heat from the reactor via the CCW system and removal of containment heat loads via the containment coolers. The ESW system is required to mitigate DBAs and transients that occur either with or without offsite power available. The design basis of the ESW system is for one ESW train, in conjunction with the CCW system and a 100% capacity containment cooling system, to remove accident generated and core decay heat following a design basis LOCA. This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the RCS by the Emergency Core Cooling System pumps. The ESW system is designed to perform its function with a single failure of any active component, assuming the LOOP (except that during shutdown conditions, TS requirements are relaxed on the basis that it is not necessary to assume a single failure concurrent with a LOOP).

The ESW system draws water from the ultimate heat sink (UHS) retention pond at a maximum temperature of 92.3 degrees Fahrenheit and returns water to the UHS cooling tower and/or retention pond. Requirements for the UHS are separately specified under TS LCO 3.7.9, "Ultimate Heat Sink (UHS)."

SW:

The SW system is a non-safety-related system which provides a source of heat rejection for plant auxiliaries which require cooling during normal plant operation and normal plant shutdown. The system also supplies cooling water to the safety-related ESW system during normal operation. The SW system provides pumped circulation of approximately 38,000 gpm of cooling water (using any 2 of the 3 system pumps) from the cooling tower basin through various main plant auxiliary heat exchange equipment and returns it to the circulating water system via a return line inside the plant.

The SW system provides sufficient cooling water for the heat removal from nonessential auxiliary plant equipment and from the ESW system over the full range of the normal reactor operation and normal shutdown. During normal plant operation, the SW system supplies cooling water to the turbine plant auxiliary equipment, steam generator blowdown nonregenerative heat exchanger, and chemical volume control system chiller, as well as components served by the ESW system.

The TS Bases and FSAR changes proposed for this LAR affect the above systems, as the changes primarily concern the required cooling water/heat sink support for RHR and CRACS, as provided by the ESW/SW system (via the CCW system) during cold shutdown/refueling conditions (i.e., Modes 5 and 6). It was recognized that the proposed changes would be needed during conduct of the 2022 Biennial Problem Identification and Resolution Inspection, documented under NRC Inspection Report 05000483/2022010 (ADAMS Accession No. ML22277A822) (Reference 1), when inspection

Enclosure to ULNRC-06781 Page 7 of 21 activities resulted in the NRC's identification of Non-Cited Violation (NCV)05000483/2022010-02, "Failure to Assess Operability of Residual Heat Removal in Low MODES with One Train of Essential Service Water Unavailable." The summary statement of this NCV is as follows:

The inspectors identified a Green finding and associated non-cited violation of Title 10 of the Code of Federal Regulations, Part 50 (10 CFR Part 50), Appendix B, Criterion V, "Instructions, Procedures, and Drawings," for the licensee's failure to complete an adequate operability evaluation in accordance with procedure APA-ZZ-00500, Appendix 1, "Operability Determinations," Revision 36. Specifically, the licensee failed to assess operability of residual heat removal in MODES 5 and 6 when one of its support systems was inoperable and unavailable.

The configuration utilizing the SW system as a support system for one of the RHR trains during periods when the corresponding ESW train is inoperable and unavailable, and while the plant is in cold shutdown/refueling conditions (Modes 5 and 6), was not recognized by Callaway as being outside of the licensing basis of the plant. An internal review of the associated FSAR and TS sections for these systems did not identify any information prohibiting this configuration and instead identified statements indicating the acceptability of this configuration. This review led to identification of a revision made to the TS Bases in 2007 to specifically document and allow this configuration. The TS Bases change modified the Bases for the RHR TSs applicable in Modes 5 and 6 by adding additional specificity on the source of the heat sink for the CCW system such that either SW or ESW systems could serve as the source, depending on their availability.

The TS Bases change made in 2007 was viewed (at the time) to be consistent with the licensing basis already described in the TS Bases, based on Bases wording that was incorporated in accordance with Callaway's adoption of the Improved Standard Technical Specifications (ISTS) (NUREG-1431)

(Reference 2) and their Bases, during the 1999-2000 timeframe, as finalized via License Amendment 133. As specifically described in the ISTS Bases wording, an underlying basis for system requirements in Modes 5 and 6 is that it is not necessary to assume a single failure concurrent with a LOOP during these Modes. This is reflected, in particular, in the less restrictive TS requirements for electrical power sources and distribution in Modes 5 and 6, during which only one emergency Diesel Generator (DG), one train of DC power sources, one train of inverters and one train of electrical power distribution is required, along with the allowance (as specifically stated in the Bases for the noted TSs) that permits non-safety related power sources and distribution to be used for one train of equipment when redundant equipment trains are required in these Modes.

The licensing basis as interpreted by Callaway, however, came into question with the identification of the aforementioned NCV. Although the NCV was focused on failure to perform an Operability Determination during a period in the last refueling outage at Callaway when SW was aligned to one of the two required RHR loops (during Mode 5), the issue was actually the result of Callaway's interpretation of the licensing basis (as described above) such that it was believed no Operability Determination was needed during the noted time. In discussions about this issue during the Problem Identification and Resolution Inspection, the position taken by the inspectors was that Operability of the two required RHR trains during Modes 5 and 6 (when both trains are required) can only be

Enclosure to ULNRC-06781 Page 8 of 21 satisfied when they are supported by both safety-related ESW trains and not when one train is supported by an SW train (such that the SW-supported train must be considered inoperable).

The NRC inspectors' position was subsequently accepted by Callaway, even when compared to the clear provision that a train may be supported by non-Class 1E (non-safety) power under the electrical power TSs for Modes 5 and 6. As a result, it was determined that a continuance of Callaway's position/interpretation regarding the plant's licensing basis would have to be considered a change to the licensing basis, going forward. Subsequently, from review of the change pursuant to 10 CFR 50.59, it was determined that such a change requires NRC approval, based on a conservative determination that the change involves more than a minimal increase in the likelihood of occurrence of a malfunction of a structure, system, or component (SSC) important to safety previously evaluated in the FSAR, per 10 CFR 50.59(c)(2)(ii). A summary of the basis for this determination is as follows:

While the change being made does not directly affect the function or operation of any SSC important to safety, it does revise the support systems credited for one train each of the CRACS and RHR system in shutdown/refueling modes. Use of the non-safety-grade Service Water system in lieu of the safety-grade Essential Service Water system to support one of the trains of the CRACS and RHR system carries an inherent increase of the likelihood of occurrence of malfunction of the support system, which is then carried to the supported system, as the failure of the support system would result in a failure of the supported system to perform its function. Due to this effect, the change must be assumed to result in a more than minimal increase in the likelihood of malfunction of the supported SSCs important to safety.

While the evaluation did identify a more than minimal increase in the likelihood of malfunction, the reliability of an RHR loop supported by an ESW train with non-Class 1E power is not viewed to be significantly different than the reliability of an RHR loop supported by a SW train (in lieu of an ESW train).

From further review of the NCV, the CRACS system was also identified as affected by this condition, due to a similar support/supported system relationship between the ESW and CRACS systems. It was determined that this relationship would require the same allowance in Modes 5 and 6, and during movement of irradiated fuel, when two CRACS trains are required but only one train of ESW may be Operable and available.

3.0 TECHNICAL EVALUATION

In general, TS LCO requirements for TS-required systems, structures, and components (SSCs) are based on the accident analyses that require or credit those SSCs for mitigation of the applicable accidents postulated and analyzed in the FSAR. Worst-case accidents such as a design-basis LOCA are generally postulated to occur during plant operation (such as at 100% power), and the systems required to mitigate such accidents must be capable of performing their required safety functions assuming a single failure concurrent with a LOOP. Systems designed with redundant trains, therefore, are required to have both trains Operable (including their required, redundant/associated support systems) during plant operating conditions (Modes 1, 2, 3 and 4, typically) as specified in the various TS LCOs for those systems.

Enclosure to ULNRC-06781 Page 9 of 21 For many of the systems required to be Operable during cold shutdown/refueling conditions (Modes 5 and 6), the TS requirements are generally relaxed compared to the TS requirements specified for the same systems during operating conditions (Modes 1-4). As noted in the Bases for the electrical power source/distribution TSs that only apply only during Modes 5 and 6 (i.e., TS 3.8.2, TS 3.8.5, TS 3.8.8, and TS 3.8.10), conditions during cold shutdown/refueling are such that it is not necessary to assume a single failure and concurrent LOOP for accidents/events that may occur during such conditions. As stated in the TS Bases for electrical power source/distribution for shutdown conditions:

The rationale for this is based on the fact that many design-basis accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analysis in MODES 5 and 6. Worst-case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrences being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCOs for required systems.

Beyond the provision for not requiring a single failure to be assumed with a LOOP, the requirements for systems during shutdown conditions are in some cases, less prescriptive or specific, when redundancy is required, as also explained in the Bases. In particular, the TS Bases note that in addition to the deterministically based TS requirements, shutdown risk management is also important to the system alignments prescribed or needed for shutdown conditions. This is specifically acknowledged and addressed in the TS Bases for the electrical power/distribution for shutdown conditions (TS 3.8.10), as follows:

In addition to the requirements established by the Technical Specifications, the plant staff must also manage shutdown tasks and electrical support to maintain risk at an acceptably low value.

As required by the Technical Specifications, one train of the required equipment during shutdown conditions is supported by one train of AC and DC power and distribution. The availability of additional equipment, both redundant equipment as required by the Technical Specifications and equipment not required by the Specifications, contributes to risk reduction, and this equipment should be supported by reliable electrical power systems. Typically, the Class 1E power sources and distribution systems of the unit are used to power equipment because these power and distribution systems are available and reliable. When portions of the Class 1E power distribution systems are not available (usually as a result of maintenance or modifications), other reliable power sources or distribution are used to provide the needed electrical support. The plant staff assesses these alternate power sources and distribution systems to assure that the desired level of minimal risk is maintained (frequently referred to as maintaining a desired defense in depth).

This wording is important because it reflects the provision that allows for some flexibility in the equipment used to support the second train of a system having redundant trains when both trains are required to be Operable during Modes 5 and 6. The choice of equipment for supporting the second

Enclosure to ULNRC-06781 Page 10 of 21 train, in lieu of a requirement allowing support only by the associated safety-related support train/equipment, is based on the allowance and need for risk management.

Risk management of system configurations during cold shutdown/refueling operations is implemented largely via the plant's Shutdown Safety Assessment Program. The changes proposed per this LAR would not adversely affect, and may be viewed to be consistent with, the site's program for implementing requirements to perform risk assessments and take risk management actions in accordance with 10 CFR 50.65(a)(4) and the site's Shutdown Safety Assessment program, modeled after NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management." Per the program, Shutdown Safety Assessments are performed on a once per 12-hours basis when the plant is in Modes 4, 5, 6, or "No Mode." The Shutdown Safety Assessments ensure that the site maintains the key safety functions of reactivity control, core decay heat removal capability, containment integrity, RCS inventory control, electrical power availability, and spent fuel pool decay heat removal capability. This maintains the plant's configuration within an acceptable level of risk while maintaining defense-in-depth such that failure of any one system does not challenge these key safety functions.

The basis for applying risk management to the RHR/CRACS trains during Modes 5 and 6 (at least in regard to the equipment for supporting one of the two RHR/CRACS trains during these Modes), is solidly reflected in the TS Bases, as already noted. This basis is further reflected by the fact that within the applicable safety analysis section of the Bases for TS 3.4.8 and TS 3.9.6, the applicable 10 CFR 50.36 criterion providing the basis for why these RHR LCO are included in the TSs is clearly identified to be Criterion 4 of 10 CFR 50.36(c)(2)(ii), which is the criterion based on risk.

Further descriptions of the plant's licensing basis are contained in Callaway's FSAR. For example, the following information about single-failure protection and assumptions is contained in FSAR SP section 3.1.2, "Additional Single Failure Assumptions":

In designing for and analyzing for DBAs [Design Bases Accidents] (i.e., large break loss-of-coolant accident (LBLOCA), main steam line break, main feedwater line break, rod ejection, locked RCP

[Reactor Coolant Pump] rotor or RCP shaft break, fuel handling accident, or steam generator tube rupture), the following assumptions (a-f) are made in addition to postulating the initiating event. In designing for and analyzing for an ANS Condition III small break loss-of-coolant accident (SBLOCA),

assumptions (a-e) are made in addition to postulating the initiating event (see also FSAR Sections 6.3.2.5, 6.3.3 Safety Evaluation 9, and 15.6.5).

a. The events are assumed not to result from a tornado, hurricane, flood, fire, loss of offsite power, or earthquake.
e. All offsite power is simultaneously lost and is restored within 7 days (except that for events postulated to occur during MODE 5, MODE 6, and/or during movement of irradiated fuel assemblies when the plant is in MODE 5 or MODE 6 or with the core fully offloaded, such as a

Enclosure to ULNRC-06781 Page 11 of 21 fuel handling accident, a loss of all offsite power is not required to be assumed in addition to a single failure).

In the design and analysis performed for provision of protection of safety-related equipment from hazards and events (tornadoes, floods, missiles, pipe breaks, fires, and seismic events) which could reasonably be expected, the following assumptions were made (FSAR Section 3.6.1.1 describes the design bases relative to the evaluation of the effects of the pipe failure hazards discussed in Section 3.6.2.):

a. Should the event result in a turbine or reactor trip, loss of offsite power is assumed, and the plant will be placed in a hot standby condition.
c. Redundancy or diversity of systems and components is provided to enable continued operation at hot standby or to cool the reactor to a CSD [cold shutdown] condition. If required, it is assumed that temporary repairs can be made to circumvent damages resulting from the hazard. All available systems, including non-safety related systems and those systems requiring operator action, may be employed to mitigate the consequences of the hazard.

In determining the availability of the systems required to mitigate the consequences of a hazard and those required to place the reactor in a safe condition, the direct consequences of the hazard are considered. The feasibility of carrying out operator actions are based on ample time and adequate access to the controls, motor control center, switchgear, etc., associated with the component required to accomplish the proposed action.

d. When the postulated hazard occurs and results in damage to one of two or more redundant or diverse trains, single failures of components in other trains (and associated supporting trains) are not assumed. The postulated hazard is precluded, by design, from affecting the opposite train or from resulting in a DBA. For the situation in which a hazard affects a safety-related component, the event and subsequent activities are governed by Technical Specification requirements in effect when that component is not functional.

In summary, this section describes the requirements for how events, hazards, and failures are to be analyzed, including how or when their coincidence of occurrence is required to be assumed. DBAs do not occur coincident with other analyzed hazards and events, and in shutdown modes, the plant analysis does not assume a single failure coincident with a LOOP. Additionally, in responding to hazards and events, the site may utilize non-safety related systems, though the hazard is not anticipated to produce failures that extend beyond a single train for redundant train systems.

With respect to the TS requirements for RHR during Modes 5 and 6, the requirements for an Operable RHR loop are specified in the Bases for TS 3.4.8 and TS 3.9.6, as follows:

Enclosure to ULNRC-06781 Page 12 of 21 For TS 3.4.8:

An OPERABLE RHR loop is comprised of an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger. RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required.

For TS 3.9.6:

An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, valves, piping, instruments and controls to ensure an OPERABLE flow path and to determine the RCS temperature. The flow path starts in one of the RCS hot legs and is returned to the RCS cold legs. An OPERABLE RHR loop must be capable of being realigned to provide an OPERABLE flow path.

With respect to the TS requirements for CRACS during Modes 5 and 6, the requirements for an Operable CRACS train are specified in the Bases for TS 3.7.11, as follows:

The CRACS is considered to be OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both trains. These components include the refrigeration compressors, heat exchangers, cooling coils, fans, and associated temperature control instrumentation. In addition, the CRACS must be operable to the extent that air circulation can be maintained.

None of these paragraphs refers to any particular cooling water supply, as each only defines Operability of an RHR loop within the scope of the RHR system and Operability of a CRACS train within the scope of the CRACS system. For cooling water support of RHR Operability, the Bases for TS 3.7.7, "Component Cooling Water (CCW) System," and TS 3.7.8, "Essential Service Water (ESW)

System," must be considered to complete the link from RHR heat exchanger to the ultimate cooling water supply. Similarly, for cooling water support of CRACS Operability, the Bases for TS 3.7.8, "Essential Service Water (ESW) System," must be considered to complete the link from CRACS heat exchanger to the ultimate cooling water supply. In addition, the Applicability sections of these TSs only explicitly identify Modes 1, 2, 3, and 4 as the applicable modes. Accordingly, the LCO sections of the Bases for these systems only address their Operability requirements for Modes 1, 2, 3, and 4 and do not explicitly address Operability requirements for Modes 5 and 6. The Applicability sections of the Bases for these TSs, however, do address Modes 5 and 6, simply as follows:

For TS 3.7.7:

In MODES 5 and 6, requirements for the CCW system are determined by the systems it supports.

For TS 3.7.8:

In MODES 5 and 6, requirements for the ESW system are determined by the systems it supports.

Enclosure to ULNRC-06781 Page 13 of 21 Support system relationships are important to Operability, but the requirements for redundant systems/trains are not the same for shutdown conditions as they are for operating conditions. This is consistent with the previously identified provision for shutdown conditions (wherein a single failure is not required to be assumed in combination with a LOOP) and with the fact the reduced requirements for shutdown conditions coincide with reduced specificity (but with appropriate risk management) for redundant train support, as described above. For example, with only one DG required during plant shutdown conditions (per TS 3.8.2, "AC Sources - Shutdown"), redundancy at the support system level (i.e., the DGs) is clearly not the same as it is for operating Modes, relative to the supported system(s) (RHR, CRACS, etc.). Thus, in the above-noted Bases statements, there is some flexibility in determining what is required to support Operability in regard to the requirements for a support system "based on the system it supports." For example, only one DG is required to support CRACS in Modes 5 and 6, instead of two DGs as required for Modes 1, 2, 3, and 4; likewise, per the proposed changes, only one ESW train should be required to support CRACS in Modes 5 and 6 instead of two ESW trains as required in Modes 1, 2, 3, 4. (The expectation is that the train supported by the DG would be the same train supported by ESW, since the DG and associated ESW train must support each other.)

In terms of what is described in the Callaway FSAR, the CCW, RHR, and Service Water (both SW and ESW) sections recognize the support function provided by the SW System in Modes 5 and 6, as follows:

Callaway FSAR SP 9.2.2.2.3 - (CCW) System Operation:

PLANT COOLDOWN AND SHUTDOWN - During periods of plant cold shutdown for maintenance or refueling operations following the plant cooldown phase, one of the trains of the CCWS [Component Cooling Water System] may be shut down, and one of the RHR heat exchangers may be taken out of service. At least one CCWS pump and one RHR heat exchanger are required to be in operation during cold shutdown to remove decay heat from the reactor coolant system. Cooling water flow through the fuel pool cooling heat exchangers is also required to cool spent fuel. In this mode of operation, heat absorbed by the CCWS is dissipated to the service water or essential service water system.

Callaway FSAR SP 9.2.2.3 - (CCW) Safety Evaluation:

SAFETY EVALUATION NINE - The nominal CCWS flow rates required to remove decay heat from the RCS during and following achieving a safe shutdown are listed in Table 9.2-8. Flow instrumentation indications and alarms are identified in Table 9.2-13. The CCWS heat is dissipated to the ESWS [Essential Service Water System] or SWS [Service Water System], as discussed in Section 9.2.1. The CCWS design assures that the flow requirements are met by operation of a CCWS pump and proper realignment of the associated valves.

Callaway FSAR SP 5.4.7.2.7 - (RHR) System Reliability Considerations:

General Design Criterion 34 requires that a system to remove residual heat be provided. The safety function of this required system is to transfer fission product decay heat and other residual heat from the core at a rate sufficient to prevent fuel or pressure boundary design limits from being exceeded. Safety grade systems are provided in the plant design, both nuclear

Enclosure to ULNRC-06781 Page 14 of 21 steam supply system (NSSS) scope and balance-of-plant (BOP) scope, to perform this function.

The NSSS scope safety grade systems which perform this function for all plant conditions, except a LOCA are: the RCS and steam generators, which operate in conjunction with the auxiliary feedwater system and the steam generator safety and power-operated relief valves; and the RHRS [Residual Heat Removal System], which operates in conjunction with the component cooling water and service water systems. The BOP scope safety grade systems which perform this function for all plant conditions, except a LOCA, are: the auxiliary feedwater system; the steam generator safety and power-operated relief valves, which operate in conjunction with the RCS and the steam generators; and the component cooling water and service water systems, which operate in conjunction with the RHRS. For LOCA conditions, the safety grade system which performs the function of removing residual heat from the reactor core is the ECCS, which operates in conjunction with the component cooling water system and the essential service water system.

Callaway FSAR Site Addendum (SA) 9.2.1 - (Water Systems) Station Service Water System The station service water system consists of the Service Water System (SW) and the Essential Service Water System (ESW). The SW system is used during normal operating and normal shutdown conditions in conjunction with portions of ESW system piping and valves. The ESW system is used during normal shutdown conditions when the SW system is not available and abnormal conditions, such as loss of off-site power or a LOCA.

Callaway FSAR SP 9.4.1.2.3 (Control Building HVAC) System Operation Cooling water for the nonessential units is supplied by the central chilled water system (FSAR SP 9.4.10), and cooling water for the safety-related units is supplied by the essential service water system (FSAR SP 9.2.1). Hot water for the control building supply air unit is supplied by the plant heating system (FSAR SP 9.4.9).

These FSAR sections describe the relationship between the RHR, CCW, SW, and ESW systems, in regard to the support function provided by the SW system during normal and shutdown conditions.

While the Control Building HVAC section of the Callaway FSAR (SP 9.4.1) only specifically calls out the ESW system for the safety-related units, it references FSAR SP 9.2.1 which discusses both SW and ESW systems, since the piping providing cooling water flow to the plant loads is ESW piping regardless of the flow source (ESW pump(s) or SW pumps(s)). During normal operations, the ESW system is not in service, since cooling water is normally supplied by the SW system as described in FSAR SP 9.2.1. Implementation of the proposed changes will make the system relationships clearer within the TS Bases and applicable FSAR sections, particularly for shutdown conditions.

With respect to the DBAs analyzed within the FSAR, and the other events and hazards to which the site is required to be capable of responding, the following should be noted for the CRACS and RHR systems:

  • The RHR system is not credited to respond to any DBAs in Modes 5 and 6. This is consistent with the fact that the TS LCO requirements for RHR during Modes 5 and 6, as previously noted, are included in the TS document on the basis of risk, i.e., per Criterion 4 of 10 CFR 50.36(c)(2)(ii) and

Enclosure to ULNRC-06781 Page 15 of 21 not on Criterion 3 (for accident mitigation) of 10 CFR 50.36(c)(2)(ii). This also means that all of the design and TS requirements applicable to accident mitigation functions required during operating Modes, such as the need for the redundant trains of an accident mitigation system to be supported only by the redundant trains of the associated safety-related support system(s), need not apply to the functions required during Modes 5 and 6. The proposed changes are consistent with the provision.

  • With respect to DBAs, CRACS is credited to respond to a fuel handling accident (FHA) in Modes 5 and 6. As previously noted, in shutdown modes, the site is only required to assume either a LOOP or a single failure in response to DBAs (per FSAR SP 3.1.2). Thus, having one train of CRACS supported by an Operable DG (consistent with TS 3.8.2) and one ESW train (which also supports the required DG) would provide adequate protection against an FHA coincident with a LOOP during shutdown modes, or in the event of a single failure in the CRACS during an FHA, a failure of any one of the CRACS trains will not result in loss of function, assuming no concurrent LOOP.
  • For hazards and other events, the site is allowed to utilize non-safety related systems in response to such events per FSAR SP 3.1.2, so utilizing the non-safety related SW system to support RHR or CRACS TS Operability, particularly during Modes 5 and 6 when the plant is already in a cold shutdown/refueling condition is not viewed to be inconsistent with the site's analysis of these hazards and events within the FSAR.

The proposed changes would make it clear that redundant CRACS/RHR trains may still be regarded as fully redundant and Operable to the extent that single failure protection is provided, even if one of the two trains is aligned to non-safety related SW in lieu of safety related ESW. If it is acceptable under the current TS requirements to allow one of two redundant equipment trains to be supported by non-Class 1E power, then comparatively, it should also be acceptable to allow one train to be supported by non-safety related SW such that both trains may be regarded as operable. In either case, one of the two/redundant equipment trains must be supported by the associated safety-related support train, even with the proposed changes approved.

Based on the preceding, the clarified TS requirements, with the proposed Bases and FSAR changes approved, would be as follows:

To meet the requirements for two Operable RHR (or CRACS) trains in Modes 5 and 6, one train must be supported by a DG with the associated safety related ESW train aligned to provide the ultimate cooling water supply. (This is required anyway due to the support-supported system relationship between the DGs and the ESW system since each supports the other on a train-by-train basis.) The other RHR (or CRACS) train, which is not required to have an Operable DG, may be aligned to the associated SW train (or the associated ESW train) to provide its ultimate cooing water supply. The latter is based on the fact that the requirements for shutdown conditions are met by such an alignment, as established by the clearly identified provision that a LOOP is not required to be assumed concurrent with a single-failure, that the TS Bases do not currently specify a particular alignment for the second train for shutdown conditions, that the flexibility intended for shutdown conditions (including maintenance activities) is reflective of the nexus between the TSs for shutdown conditions and risk management, as recognized in the TS Bases in regard to the support of redundant equipment trains,

Enclosure to ULNRC-06781 Page 16 of 21 and that the RHR (and CRACS) TS Requirements for shutdown conditions are not inconsistent with the plant's licensing basis as described in FSAR. As such, this LAR seeks formal NRC approval of the proposed operational alignment for Modes 5 and 6, as supported by the proposed TS Bases and FSAR changes, to use the SW system to support one of the two required trains of RHR and CRACS under TS LCOs 3.4.8, 3.7.11, and 3.9.6.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements / Criteria The regulatory requirements and/or guidance documents associated with this LAR include the following:

  • The CRACS, ESW system, CCW system, and RHR system are protected from the effects of natural phenomena, such as earthquakes, tornadoes, hurricanes, floods, and external missiles (GDC-2) (Reference 3).
  • The CRACS, ESW system, CCW system, and RHR system are designed to remain functional after a safe-shutdown earthquake and to perform their intended functions following a postulated hazard, such as a fire, internal missiles, or pipe break (GDC-3 and 4) (Reference 3).
  • The CRACS provides the control room with a conditioned atmosphere during all modes of plant operation, including post-accident operation (GDC-19) (Reference 3).
  • The functional requirements of the RHR system are derived from Appendix K (Reference 7) limits for fuel cladding temperature, etc., following any of the DBAs, as delineated in 10 CFR 50.46. The subsystem functional parameters are integrated so that the Appendix K requirements are met over the range of anticipated accidents and single failure assumptions.
  • The RHR system is provided to transfer fission product decay heat and other residual heat from the core at a rate sufficient to prevent fuel or pressure boundary design limits from being exceeded (GDC-34) (Reference 3).
  • The capability to isolate components or piping is provided so that the RHR system's, the CCW system's, and the ESW system's safety functions will not be compromised. This includes isolation of components to deal with leakage or malfunctions and to isolate non-safety-related portions of the system (GDC-35 and 44) (Reference 3).

Enclosure to ULNRC-06781 Page 17 of 21

  • The ESW system and CCW system are designed to remove heat from components important to mitigating the consequences of a LOCA or MSLB and to transfer the heat to the UHS (GDC-
44) (Reference 3).

There are no changes being proposed in this LAR such that conformance or commitments to the regulatory requirements and/or guidance documents above would come into question. Conformance to the GDC listed here remain met as described within the Callaway Plant FSAR SP Section 3.1, and under the associated system sections. The evaluations documented herein confirm that Callaway Plant will continue to comply with all applicable regulatory requirements.

The GDCs provide the design requirements and capabilities for structures, systems, and components; this change does not alter the design of the related systems. The required design provides for the availability of both trains of a system (concurrent with a LOOP) during operating Modes and when the plant is taken or driven to cold shutdown from an event or transient. The proposed changes only apply when the plant is being taken to refueling conditions (via Mode 5 into Mode 6), when the plant is already in a cold shutdown condition. As noted previously in Section 3.0 of this LAR, and in the Bases for the TS, TS requirements are reduced in these conditions, so when the plant is in these conditions the full complement of equipment, including systems with their redundant trains or support system trains is not required (provided shutdown risk is managed, as effected in part by measures for ensuring defense in depth). The configurations allowed during Modes 5 and 6 are not exceptions to the GDC; they merely reflect reduced TS requirements for which the system's complete as-designed capability is not required.

In conclusion, based on considerations discussed herein, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

4.2 Precedent This LAR is similar in nature, with respect to the justification and support system requirements when in Modes 5 and 6, to the following license amendment previously issued to Callaway Plant:

  • Callaway Plant, Unit 1, issued May 9, 2007 (ML071020342) (Reference 8)

While this precedent is specific to the electrical power system requirements for the CREVS, CRACS, and emergency exhaust systems, the discussions on reduced requirements during Modes 5, 6, and during the movement of irradiated fuel, including the corresponding arguments made within in regard to single failure assumptions, LOOP requirements, and support/supported system relationships, are similar to those being made within this request.

Enclosure to ULNRC-06781 Page 18 of 21 4.3 No Significant Hazards Consideration Determination Ameren Missouri has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No In general, when the unit is shut down, the Technical Specification (TS) requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents, including a fuel handling accident. However, assuming a single failure and concurrent loss of all offsite or all onsite power is not required (as described in Callaway Plant Final Safety Analysis Report, Standard Plant, section 3.1.2). The rationale for this is based on the fact that many design basis accidents (DBAs) that are analyzed in Modes 1, 2, 3, and 4 have no specific analyses in Modes 5 and 6. Worst case bounding events such as loss-of-coolant accidents and limiting pipe breaks are deemed not credible in Modes 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and in minimal consequences. These deviations from DBA analysis assumptions and design requirements during shutdown conditions are allowed by the Limiting Conditions of Operation (LCOs) for required systems, including those required for mitigation of a fuel handling accident which may be postulated to occur during such conditions (i.e., Modes 5 and 6 or with the reactor defueled/offloaded).

The Plant's design is such that, during normal plant operating conditions, the Service Water (SW) system supplies cooling water (via Essential Service Water (ESW) piping) to plant loads, including the Component Cooling Water (CCW) system. During accident/emergency conditions, the ESW system serves as the emergency back-up to provide cooling water. The proposed license amendment would allow the SW system to be a credited support system for one of the two required trains of the Control Room Air Conditioning System (CRACS) and of the Residual Heat Removal (RHR) system in Modes 5 and 6, and during movement of irradiated fuel under TS LCOs 3.4.8, 3.7.11, and 3.9.6. With the proposed changes approved, the applicable TS requirements would not require a second train of the ESW system to be maintained as a support system for the second train of the CRACS or the RHR system (since the second train would be supported by a SW train) during Modes 5 and 6 (when redundant trains are required). As a redundant train of the ESW system is not needed to respond to any accident in these modes, and the SW system can provide adequate cooling water to support the loads of these supported systems (for one train),

there is no change to the consequences of any accident previously evaluated.

The proposed amendment will not impact the ability of the RHR system to remove decay heat in Modes 5 or 6, or impact its ability to ensure mixing, prevent stratification, and produce gradual reactivity changes during Reactor Coolant System boron concentration reductions. The cooling

Enclosure to ULNRC-06781 Page 19 of 21 water requirements for at least one train of the RHR system will remain met assuming either a LOOP or a single failure in one RHR train consistent with the current Callaway Plant licensing basis, by either the train supported by the ESW system and an DG, or by the train supported by the non-essential SW system and a normal offsite power source.

The one FSAR described DBA that may be postulated to occur during Mode 5 or Mode 6 is a fuel handling accident (FHA). The proposed changes do not affect the systems/functions required to mitigate the dose consequences of an FHA. (Control room dose mitigation is effected via the Control Room Emergency Ventilation System and not by CRACS.) Therefore, the proposed changes do not invite any significant increase in the consequence of the FHA as previously outlined in the FSAR.

The proposed changes are consistent with the assumptions for system availability made within the accident and transient analysis for shutdown Modes (5 and 6) and do not involve making any physical changes to the plant. As such, the changes do not introduce any new failure mechanisms or transient precursors nor do they modify the likelihood of any existing precursors to an accident or transient as analyzed in the Callaway Plant FSAR.

Based on the above, it is concluded that the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No This proposed license amendment does not involve any physical changes to the plant or any changes to operation, function, or the performance requirements of the CRACS or RHR system.

As such it does not introduce any new failure mechanisms or transient precursors different than those previously evaluated.

Therefore, it is concluded that this change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No The margin of safety is established through equipment design, operating parameters, and the setpoints at which automatic actions are initiated. This amendment makes no physical changes to safety-related systems, operating parameters, or setpoints for initiation of protective actions.

The allowance for one train of the CRACS and RHR systems to be supported by the SW system in lieu of the ESW system under certain applicable TSs (3.4.8, 3.7.11, 3.9.6) i.e., does Modes 5 and 6, does not change any functional or performance requirements for these systems. The system

Enclosure to ULNRC-06781 Page 20 of 21 alignment wherein SW supplies cooling water to the CRACS and the CCW system heat exchangers (the intermediary cooling water loop to the RHR heat exchangers) is a normal operating configuration for the aforementioned systems. The SW system provides a more than an adequate cooling water flow rate, with system temperature limitations comparable to the ESW system, such that a significant change in residual heat removal rate and control room cooling is not realized by this change.

Therefore, it is concluded that the proposed change does not involve a significant reduction in a margin of safety.

In consideration of all of the above, Ameren Missouri concludes that the proposed changes present no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and on that basis, a finding of "no significant hazards consideration" is justified.

4.4 Conclusions Based on the considerations discussed above, 1) there is a reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, 2) such activities will be conducted in compliance with the Commission's regulations, and 3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL EVALUATION The proposed amendment would not change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or change an inspection or surveillance requirement. Additionally, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or a significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 REFERENCES

1. NRC Inspection Report 05000483/2022010 (ML22277A822)
2. NUREG-1431, "Standard Technical Specifications, Westinghouse Plants," Revision 1, April 1995
3. U.S. Code of Federal Regulations, 10 CFR 50, Appendix A, "General Design Criteria for Nuclear Power Plants"

Enclosure to ULNRC-06781 Page 21 of 21

4. U.S. NRC, Regulatory Guide 1.26, "Quality Group Classifications and Standards for Water-, Steam-, and Radioactive-Waste-Containing Components of Nuclear Power Plants,"

Revision 3, March 1976

5. U.S. NRC, Regulatory Guide 1.29, "Seismic Design Classification for Nuclear Power Plants," Revision 3, September 1978
6. U.S. NRC, Regulatory Guide 1.32, "Criteria for Power Systems for Nuclear Power Plants,"

Revision 2, February 1977

7. U.S. Code of Federal Regulations, 10 CFR 50, Appendix K, "ECCS Evaluation Models"
8. Callaway Plant, Unit 1, License Amendment 184, issued May 9, 2007 (ML071020342)
Retrieved from "https://kanterella.com/w/index.php?title=ML22335A509&oldid=3521480"