ML093290318: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
Line 1: Line 1:
{{Adams
#REDIRECT [[ULNRC-05665, Application for Amendment to Facility Operating License NPF-30 (Ldcn 09-0039) Completion Time Extensions for TS 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation Functions]]
| number = ML093290318
| issue date = 11/25/2009
| title = Callaway - Application for Amendment to Facility Operating License NPF-30 (Ldcn 09-0039) Completion Time Extensions for TS 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation Functions
| author name = Sandbothe S
| author affiliation = AmerenUE
| addressee name =
| addressee affiliation = NRC/Document Control Desk, NRC/NRR
| docket = 05000483
| license number = NPF-030
| contact person =
| case reference number = LDCN 09-0039, ULNRC-05665
| document type = Letter, License-Application for Facility Operating License (Amend/Renewal) DKT 50
| page count = 348
}}
 
=Text=
{{#Wiki_filter:w Ameren UE AmerenUE Callaway Plant November 25, 2009 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Stop PI-137 Washington , DC 20555-0001 Ladies and Gentlemen: DOCKET NUMBER 50-483 CALLAWAY PLANT UNION ELECTRIC CO. APPLICA TION FOR AMENDMENT TO FACILITY OPERATING LICENSE NPF-30 (LDCN 09-0039) PO B ox 620 Fult o n , MO 6 525 1 ULNRC-05665 10 CFR 50.90 COMPLETION TIME EXTENSIONS FOR TS 3.3.2 ENGINEERED SAFETY FEATURE ACTUATION SYSTEM (ESFAS) INSTRUMENTATION FUNCTIONS AmerenUE herewith transmits an application for amendment to Facility Operating License Number NPF-30 for the Callaway Plant. This amendment application submits a proposed change to Technical Specification (TS) 3.3.2, " Engineered Safety Feature Action System (ESFAS) Instrumentation
," t hat would add a new Required Act i on Q.l to require restoration of an inoperable Balance of Plant ESFAS (BOP ESFAS) train to OPERABLE status within 24 hours. Cu r rently , Condition Q ofTS 3.3.2 for Function 6.c ofTS Table 3.3.2-1 requires the plant to enter a shutdown track to MODE 3 within 6 hours and to MODE 4 within 12 hours with no allowed outage time provided for restoration. In addition , the Completion Times for TS 3.3.2 Required Actions J.l and 0.1 to trip inoperable channels that provide inputs to BOP ESF AS would also be extended to 24 hours. Shutdown track Completion Times to be in MODES 3 and 4 would be increased to reflect these longer restoration times. Separate Condition entry for TS Condition J would be restricted to assure that Function 6.g in TS Table 3.3.2-1 will provide a start signal to the motor-driven auxiliary feedwater (AFW) pumps from one train of BOP ESFAS actuation logic. This is a risk-informed amendment request following the guidance of NRC Regulatory Guides (RGs) 1.174 , 1.177 , and 1.200 Revision 1. a subsidiary of Ameren Corporation ULNRC-05665 November 25, 2009
 
Page 2
 
Attachments 1 through 4 provide th e Evaluation, Markup of Technical Specifications, Retyped Technical Speci fications, and Proposed Technical Specification Bases Changes, respectively, in support of this amendment request. Attachment 4 is provided for information only. Final TS Bases Changes will be
 
processed under Callaway's progra m for updates per TS 5.5.14, "Technical Specifications Bases Control Program," when the requested amendment is implemented. 
 
Attachment 5 provides a logic block diagram of the BOP ESFAS design at Callaway as well as a schematic from the AmerenUE presentation on September 17, 2009 to NRC staff that shows signal input s to, and logic outputs from, the BOP ESFAS cabinets.
provides a table that discusses the remaining open Significance A and B peer review findings against the Callaway PRA model. Attachments 7 and 8 provide the results of the internal fi re and internal flooding quantifications, respectively. Attachment 9 provides a gap analysis against the Ca pability Category II guidance of the PRA standards endorsed in NRC Regulatory Guide 1.200 Revision 1.         
 
No commitments are contained in this amendment application.
It has been determined that this amendment application does not involve a significant hazard consideration as determined per 10 CFR 50.92. Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need
 
be prepared in connection with the issuance of this amendment.
The Callaway Onsite Review Committee and a subcommittee of the Nuclear Safety Review Board have reviewed and approved the attached licensing evaluations and have approved the submittal of this amendment application. 
 
AmerenUE requests approval of this proposed license amendment prior to November 20, 2010. AmerenUE further requests that the license amendment be made effective upon NRC issuance to be implemented within 90 days.
 
In accordance with 10 CFR 50.91, a copy of this amendment application is being provided to the designated Missouri St ate official. If you have any questions on this amendment application, please contact me at (573) 676-8528, or Mr. Scott Maglio at (573) 676-8719.
 
ULNRC-05665 November 25,2009 Page 3 I declare under penalty of perjury that the foregoing is true and correct. Executed on: Attachments 1 -Evaluation 2 -Markup of Technical Specifications 3 -Retyped Technical Specifications Very truly yours, Scott Sandbothe Manager, Plant Support 4 -Proposed Technical Specification Bases Changes (for information only) 5 -Callaway BOP ESF AS Drawings 6 -Open Significance A and B Peer Review Findings 7 -Internal Fire Quantification 8 -Internal Flooding Quantification 9 -RG 1.200 Revision 1 Gap Analysis ULNRC-05665 November 25, 2009
 
Page 4
 
cc: U.S. Nuclear Regulatory Commission (Original and 1 copy) Attn:  Document Control Desk
 
Washington, DC 20555-0001 Mr. Elmo E. Collins, Jr.
Regional Administrator
 
U.S. Nuclear Regulatory Commission Region IV 612 E. Lamar Blvd., Suite 400 Arlington, TX  76011-4125 Senior Resident Inspector Callaway Resident Office
 
U.S. Nuclear Regulatory Commission 8201 NRC Road Steedman, MO  65077 Mr. Mohan C. Thadani (2 copies)
 
Senior Project Manager, Callaway Plant Office of Nuclear Reactor Regulation
 
U. S. Nuclear Regulatory Commission Mail Stop O-8G14 Washington, DC  20555-2738
 
ULNRC-05665 November 25, 2009
 
Page 5 Index and send hardcopy to QA File A160.0761 Hardcopy:
 
Certrec Corporation
 
4200 South Hulen, Suite 422 Fort Worth, TX  76109 (Certrec receives ALL attachments as long as they are non-safeguards and may be publicly disclosed.)
Electronic distribution for the followin g can be made via Tech Spec ULNRC Distribution:
 
A. C. Heflin F. M. Diya
 
L. S. Sandbothe
 
S. A. Maglio S. L. Gallagher T. L. Woodward (NSRB)
T. B. Elwood
 
G. G. Yates
 
Ms. Diane M. Hooper (WCNOC)
Mr. Dennis Buschbaum (Luminant Power)
 
Mr. Ron Barnes (Palo Verde)
Mr. Tom Baldwin (PG&E)
Mr. Wayne Harrison (STPNOC)
Mr. John O'Neill (Pillsbury Winthrop Shaw Pittman LLP)
Missouri Public Service Commission
 
Mr. Floyd Gilzow (DNR)
Page 1 of 41 EVALUATION
: 1. DESCRIPTION Page 2
: 2. PROPOSED CHANGES Page 2 
: 3. BACKGROUND Page 3
: 4. TECHNICAL ANALYSIS Page 11
: 5. REGULATORY SAFETY ANALYSIS Page 35 5.1 NO SIGNIFICANT HAZARDS CONSIDERATION Page 36
 
===5.2 APPLICABLE===
REGULATORY REQUIREMENTS/CRITERIA Page 38
: 6. ENVIRONMENTAL CONSIDERATION                    Page 40
: 7. REFERENCES Page 41
 
Page 2 of 41 EVALUATION
 
==1.0 DESCRIPTION==
 
This amendment application submits a proposed change to Technical Specification (TS) 3.3.2, "Engineered Safety Feature Action System (ESFAS) Instrumentation," that would add a new Required Action Q.1 to require rest oration of an inoperable Balance of Plant ESFAS (BOP ESFAS) train to OPERABLE stat us within 24 hours. Currently, Condition Q of TS 3.3.2 for Function 6.c of TS Table 3.3.2-1 requires the plant to enter a shutdown track to MODE 3 within 6 hours and to MODE 4 within 12 hours with no allowed outage time provided for restoration. In addition, the Completion Times for TS 3.3.2 Required Actions J.1 and O.1 to trip inoperable channe ls that provide inputs to BOP ESFAS would also be extended to 24 hours. Shutdown track Completion Times to be in MODES 3 and 4 would be increased to reflect these longer restoration times. Separate Condition entry for TS Condition J would be restricted to assure that Function 6.g in TS Table 3.3.2-1 will provide a start signal to the motor-driven auxiliary feedwater (AFW) pumps from one train of BOP ESFAS actuation logic. This is a risk-informed amendment request following the guidance of NRC Regulatory Guides (RGs) 1.174, 1.177, and 1.200
 
Revision 1. See References 1 through 3 in Section 7.0. 
 
==2.0 PROPOSED CHANGE==
S The proposed change to TS 3.3.2 Condition Q would add a new Required Action Q.1 that requires the restoration of an inoperable BOP ESFAS train (TS Table 3.3.2-1 Function 6.c, Auxiliary Feedwater - Automatic Actu ation Logic and Actuation Relays (BOP ESFAS)) to OPERABLE status within 24 hours. The new Required Action Q.1 for one
 
train inoperable would read:
 
"Restore train to OPERABLE status." 
 
The Completion Time for new Requi red Action Q.1 would be 24 hours.
 
Existing Required Actions Q.1 and Q.2 would be changed to Required Actions Q.2.1 and Q.2.2, respectively, with the joining logic c onnector ("AND") nested as required by TS
 
===1.2. Required===
Actions Q.2.1 and Q.2.2 would be joined to ne w Required Action Q.1 with an "OR" logic connector. The Completion Times for Required Actions Q.2.1 and Q.2.2 would be 30 hours and 36 hours, respectively, which reflect the typical shutdown track times (6 hours to MODE 3 and 12 hours to MODE 4 as discussed in LCO 3.0.3) for reaching MODES 3 and 4 when a restoration action has not been met.
 
Since the risk impact associated with the loss of one train of BO P ESFAS actuation logic and actuation relays is greater than the loss of individual anal og channel input(s) into that BOP ESFAS train, it is also proposed that the Completion Times for TS 3.3.2 Required Page 3 of 41 Action J.1 (for TS Table 3.3.2-1 Function 6.g, A uxiliary Feedwater - Tr ip of All Main  Feedwater Pumps) and Required Action O.1 (for TS Table 3.3.2-1 Function 6.h, Auxiliary Feedwater - Pump Suction Transfer on Suction Pressure - Low) be changed from 1 hour to 24 hours. The Completion Time for Required Action J.2 (shutdown to MODE 3 if Required Action J.1 is not met within 24 hours) would be extended to 30 hours (24 + 6). The Completion Time for Required Action O.2 would be unchanged.
 
An additional restriction would be added to TS 3.3.2 Condition J in the form of a new Note limiting the application of separate Condition entry. Since the Required Channels for Function 6.g are specified in TS Table 3.3.2-1 as 2 per pump, Condition J may be entered separately for each main feedwa ter pump. However, as shown on the J-104-00176 logic block diagram provided in Attachment 5, satisfying the trip logic requires the presence of a low oil pressure signal in the same separation group on each main feedwater pump. An inoperable separation gr oup 1 channel on one pump coincident with an inoperable separation group 4 channel on the other pump would lead to the loss of this actuation function. Therefore, a new Note would be added to Condition J that would read:
  "Separate Condition entry is restricted to one inoperable channel per pump in the same separation group."   
 
This would assure that the AFW start signal after the loss of both main feedwater pumps would be generated by the operable inputs from the other separation group to both motor-driven AFW pumps (cross train actuations are provided as shown in Attachment 5).
Associated Bases changes for the above are provided in Attachment 4 and will be implemented under the provisions of TS 5.5.14, "Technical Specificat ions Bases Control Program."
 
==3.0 BACKGROUND==
 
===3.1 System===
Descriptions Balance of Plant (BOP) Engineered Safety Feature Actuation System (ESFAS) -Automatic Actuation Logic and Actuation Relays, Function 6.c of TS Table 3.3.2-1 provides a logic diagram for the BOP ESFAS and a schematic showing channel inputs and logic outputs. This system is also discussed in FSAR Section 7.3 and shown in FSAR Figure 7.3-1.
 
The BOP ESFAS actuation logic processes signals from several sources, such as the Solid State Protection System (SSPS) logic outputs associat ed with safety injection, containment isolation - phase A, and low-low steam generator (SG) water level, the load  shedder and emergency load sequencer (LSELS) logic outputs associated with ESF bus Page 4 of 41 undervoltage, inputs from various plant radiation monitors, inputs from main feedwater  pump lube oil pressure switches (used for motor-driven auxiliary feedwater (AFW) pump actuation), and inputs from pressure switches in the AFW suction supply from the condensate storage tank (CST) in order to actuate ESF equipment. There are two redundant trains of BOP ESFAS actuation l ogic (separation groups 1 and 4, cabinets SA036D and SA036E, respectively), and a thir d actuation logic cabin et (separation group 2, cabinet SA036C) to actuate the turbine-driven AFW pump (T DAFP) and reposition automatic valves required for that pump's operation (i.e., open turbine steam supply valves and the turbine trip and throttle valve). Th e separation group 2 BOP ESFAS actuation logic cabinet SA036C receives isolated inputs from both the SA036D and SA036E cabinets (separation groups 1 a nd 4) to start the TDAFP upon ESF bus undervoltage or upon low-low steam generator level in two or more steam generators. 
 
Per Callaway's original licensing basis, which was reconfirmed dur ing the NRC reviews that led to the issuance of Callaway License Amendment 130 (notably pages 2 and 3 of the NRC Safety Evaluation for LA130) a nd the ITS conversion approved in Callaway License Amendment 133, the SA036C separation group 2 cabinet is considered to be part of its only end device (the TDAFP) and that cabinet's operability requirements are addressed under TS 3.7.5, "Auxiliary Feedwater System."  The redundant train BOP
 
ESFAS actuation logic cabinets SA036D and SA036E actuate the motor-driven auxiliary feedwater pumps and reposition automatic valv es as required (i.e., steam generator blowdown and sample line isolation valves, es sential service water (ESW) supply valves, and CST supply valves). These redundant train cabinets also actuate containment purge isolation, control room emergency ventilation isolation, and emergency exhaust system (EES) actuation functions.
Auxiliary Feedwater - Trip of All Main Feedwater Pumps, Function 6.g of TS Table 3.3.2-1 A trip of all (both) main feedwater (MFW) pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no-load temperature and pressure. Each turbine-driven MFW pump is equipped with two pressure switches (one in separation group 1 and one in separation group 4) on the oil line for the speed control system. A low pressure signal from either of these pressure switches indicates a trip of that pump. Two OP ERABLE channels per pump satisfy redundancy requirements with one-out-of-two logic on both pumps required for signal actuation. A trip of all MFW pumps starts the motor-driven AFW pumps to ensure that the intact SGs are available with water to act as the heat sink for the reactor.
 
Auxiliary Feedwater - Pump Suction Transfer on Low Suction Pressure, Function 6.h of TS Table 3.3.2-1 A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the CST. Three pressure switches are located on the AFW pump suction line from th e CST. A low pressure signal sensed by Page 5 of 41 any two of the three switches coincident with an auxiliary feedwater actuation signal will  cause the emergency supply of water for the pump s to be aligned. Esse ntial service water  (ESW) is the safety grade suction source that is automati cally lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW System to maintain the intact SGs as the heat sink for reactor decay heat and sensible heat removal.
3.2 Need for License Amendment Change As discussed in Reference 4 in Section 7.0, a manual plant shutdown to MODE 3 was required on February 19, 2009, due to a 48-VDC power supply failu re in BOP ESFAS actuation logic cabinet SA036D (separation group 1, train 'A'). During the shutdown, all similar power supplies in the BOP ESFAS and LSELS cabinets were evaluated to establish when they were last replaced and the number of spares in stock. Scenarios for replacing the power supplies during that forced outage, during the rest of Cycle 17 power operation, and during Refuel 17 (spring 2010) were examined. Based on the Required Actions of TS 3.3.2 Condition Q (6-hour shutdown to MODE 3, 12 hours to MODE 4),
and concerns over infant mortality with replacement power supplies as well as the limited number of available spares, a decision was made to replace the power supplies with reverse-engineered power supplies featur ing no microprocessor-based components in Refuel 17. Modification of the existing BOP ESFAS cabinets to accommodate the addition of redundant power supplies was inve stigated; however, this conceptual design change was determined to be impractical given the physical space constraints in the existing logic cabinets. 
 
The power supply applications found to be the most limiting, based on the TS Completion Times and number of available sp ares, were the 48-VDC power supplies in BOP ESFAS actuation logic cabinets SA036D and SA036E. One of the two 48-VDC spares in stock was taken from the warehouse, placed on a bench in the I&C shop, and energized as a "hot spare" to burn in the pow er supply, with the intent of avoiding infant mortality concerns. Work packages, pre-j ob briefing instructions , and an Operations Night order were prepared in advance. Performance monitoring of the similar power supplies indicated that they were performing within expectations prior to making the decision to restart from the February 2009 forced outage.
 
Nowithstanding the Refuel 17 replacement pl ans for the BOP ESFAS power supplies, it has been determined that the existing Required Action Completion Times specified for an
 
inoperable BOP ESFAS actuation logic cabinet and certa in channel inputs are overly restrictive given the relatively low risk associated with such inoperabilities. More reasonable Completion Times would allow re storation of an i noperable BOP ESFAS actuation logic cabinet, or i noperable channel inputs, dur ing plant operation without subjecting the plant to a forced shutdown. Th erefore, changes are being proposed to the applicable TS Completion Times on a risk-informed basis. The details of that basis are provided in Section 4.0, "Tec hnical Analysis."   
 
Page 6 of 41
 
===3.3 Compliance===
with Current Regulations This amendment request itself does not propose to deviate from existing regulatory requirements, and compliance with existing regulations is maintained.
 
Evaluation of Safety Margins
 
Safety analysis acceptance cr iteria for the events analyzed in FSAR Chapters 6.2 and 15 are not impacted by the proposed changes. The proposed Completion Time extensions would not impact any of the assumptions or inputs to the safety analyses. There are no design changes associated with this amendment request. Consequently, safety margins are not affected.
 
This amendment request does not impact any deterministic analysis nor does it credit safety margins in any deterministic analysis. 
 
The containment pressure / temperature analyses in FSAR Section 6.2 and the transient and accident analyses in FSAR Chapter 15 are deterministic in nature. For those types of deterministic analyses, a safety analysis limit (SAL) is the acceptance criterion used in the analysis to assure the integrity of phys ical plant barriers (i.e., fuel cladding, RCS pressure boundary, and containment) to preven t the uncontrolled release of radioactivity.
Therefore, the SALs assure that the design basis limits for fission product barriers (DBLFPBs) are not exceeded. Nominal trip setpoints (NTSs) are established at an appropriate level away from the SALs. The NTSs are field setting values for the equipment and are obtained by adding (or subtracting) channel error allowance terms to/from the SAL (depending on whether the actuation channel is a low level or high level trip). The NTS allows for the normal expected channel behavior such that design limits are protected, inadvertent trips are avoi ded, and Technical Specification Allowable Values (AVs) will not be exceeded under normal operation and anticipated operational occurrences. The AV is obtained by adding or subtracting a calculated allowance to/from the NTS. The AV accounts for the function-spec ific allowances discussed in the Bases for Technical Specifications 3.3.1 and 3.3.2.
There are no changes to any SALs, DBLFPBs, NTSs, or AVs in this amendment request.
 
The Completion Times in the Required Actions of the Technical Specifications have no tie to the above deterministic analyses. Completion Times were originally established in
 
the first set of Standard Technical Specifications (STS) for Westinghouse plants (NUREG-0452, circa 1980) based on operating experience and engineering judgment, and that is largely still the case for the current STS for Westinghouse plants (NUREG-1431). Changes to Completion Times that are consistent with approved NRC staff positions, as discussed in Section 1.1 of RG 1.174 Revision 1, are typically evaluated deterministically by the NRC. Other Completion Time changes are evaluated by the NRC using a combination of deterministic and risk-based considerations; however, the durations of Completion Times are not themselves a factor in any deterministic analysis. Completion Time changes do not affect the values for SAL, NTS, or AV.
 
Page 7 of 41 Finally, it should be noted that since the requirement to postulate a single failure is waived during the time a TS Condition is entered, i.e., in the event that a BOP ESFAS actuation logic train were declared inoperable, the operable BOP ESFAS train will continue to be capable of performing the n ecessary safety functions consistent with accident analysis assumptions.
 
Defense in Depth
 
RG 1.177 contains several attributes that should be examined when requesting risk- informed changes to TS requirements.
The following discussion considers those attributes.
 
A reasonable balance among prevention of core damage, prevention of containment failure, and consequence mitigation is preserved.
 
The proposed changes involve extensions of the current TS 3.3.2 Condition J, Condition
 
O, and Condition Q Completion Times associated with BOP ESFAS functions. The functions that are affected during entry into these Conditions are all associated with a single inoperable BOP ESFAS tr ain or inoperable channel in put(s) into a single train, leaving one BOP ESFAS train fully operable and capable of performing its safety functions. Preserving the operability of one BOP ESFAS train will maintain the balance among the prevention of core damage, pr evention of containment failure, and consequence mitigation.
 
Since the requirement to assume a single failure is suspended while operating under a TS Required Action, there will be no effect on the analysis of any accident or that accident's progression since the operable BO P ESFAS train is capable of actuating 100% of the required ESFs. As such, there will be no impact on core damage, containment release, or consequence mitigation for any transient or accident.
 
Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided.
 
The proposed change involves extensions of the current TS 3.3.2 Condition J, Condition
 
O, and Condition Q Completion Times associated with BOP ESFAS functions. The functions that are affected during entry into these Conditions are all associated with a single inoperable BOP ESFAS tr ain or inoperable channel in put(s) into a single train, leaving one BOP ESFAS train fully operable and capable of performing its safety functions. No programmatic activities outside the requirements of the Technical Specifications are credited in this amendment application.
System redundancy, independence, and di versity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).
 
Page 8 of 41 The operable BOP ESFAS train will continue to be capable of performing the necessary safety functions consistent with accident analysis assumptions. Redundant, independent, and diverse capabilities will be maintained for performing critical safety functions. A review of the actuation signal pathways in Attachment 5 would support a position that the Completion Time allowed to restore one train of BOP ESFAS actuation logic and actuation relays should at least be equal to that of the SSPS train that must provide the SG water level low-low signal inputs to BOP ESFAS for AFW actuation.
Defenses against potential common cause failures are preserved and the potential for the introduction of new common cause failure mechanisms is assessed.
 
Section 4.0 below has a discussion of common cause failures. No new common cause failure modes are introduced since the replacement power supplies being reverse
 
engineered for the BOP ESFAS cabinets do not contain microprocessor-based components. One BOP ESFAS train will be maintained in an operable status during any entry into TS 3.3.2 Condition Q. No new requirements are being placed on the BOP ESFAS design. There is nothing that will be allowed by the Completion Time extensions that would impact the protected BOP ESFAS train's availability or introduce a new common mode failure mechanism.
 
Independence of barriers is not degraded.
This amendment application wi ll not result in any undue challenges to the fuel cladding, reactor coolant pressure boundary, or containment. The amendment request does not involve design changes that would affect or degrade the independence of these barriers. Further, the extension of Completion Times does not directly impact these barriers or otherwise cause them to be degraded. Ther efore, the independence of barriers will not be degraded by the proposed Completion Time extensions.
Defenses against human errors are preserved.
Continuing operator training will apprise the operating staff of the effects of these Completion Time extensions. This training program will assure that the defenses against human errors will be adequately preserved.
 
The intent of the GDC in Appendix A to 10 CFR Part 50 is maintained.
 
The proposed change involves extensions of the current TS 3.3.2 Condition J, Condition
 
O, and Condition Q Completion Times associated with BOP ESFAS functions. The proposed amendment does not modify the plant design bases or the design criteria that were applied to structures, systems, and components during plant licensing.
Consequently, the plant design with respect to the General Design Criteria is not affected by the proposed change.
 
Page 9 of 41
 
===3.4 Relationship===
to Completion Ti me Extensions of WCAPs 10271, 14333, and 15376  Between May 1986 and March 2003 the Westinghouse Owners Group (now called the Pressurized Water Reactor Owners Group, or PWROG) completed a series of topical reports that documented the relaxation of reactor trip system (RTS) and ESFAS test times in bypass, Completion Times (CTs), and surv eillance test interv als (STIs) for the protection system instrumentation. The relaxa tions were justified by an analysis of the protection system unavailability and the impact of that unavailability on the overall plant risk. The original study was identified by the acronym TOP (taken from Technical Specification Optimization Program) as docum ented in the WCAP-10271-P-A series of  reports. The TOP changes were implemented at Callaway Plant via OL Amendment 17 for the RTS and OL Amendment 64 for the ESFAS, respectively. 
 
Fault tree models of the protection system instrumentation were used to calculate the unavailability sensitivity to test and maintenance time allowances and frequencies. The changes in RTS and ESFAS unavailability were then used in a risk model to predict changes in risk as the test and maintenance time allowances and frequencies were  relaxed. Differences in analysis methods from the TOPS WCAP-10271-P-A series of reports to the subsequent follow-up topical reports are discusse d in Section 7.1 of WCAP-14333-P-A Revision 1 and in Secti on 8.3.5 of WCAP-15376-P-A Revision 1. 
 
The approach used in WCAP-14333-P-A Revision 1 and WCAP
-15376-P-A Revision 1 was consistent with the appro ach established in the TOP program. This included the fault tree models, signals, component reliability database, and most of the test and maintenance assumptions. The methodology used in the WCAP-10271 studies was applied to a representative set of RTS and ESFAS functions using the Vogtle Plant PRA model and revised unavailability data. The work documented in WCAP-14333 used a different common cause failure modeling appr oach for analog channels and included more realistic assumptions related to the component unavailability due to maintenance activities based on a survey of WOG plants. Operator actions to either manually trip the reactor or initiate safety injection were also modeled in WCAP-14333. In addition, credit for auxiliary feedwater pump start from the ATWS mitigating system actuation circuitry (AMSAC) was taken. More discussion of thes e differences is cont ained in Sections 7 and 8 of WCAP-14333. The relaxations that were justified in WCAP-14333 are summarized below:
 
Summary of WCAP-14333 RTS and ESFAS Completion Time and Bypass Test Time Changes - Solid State Protection System Component Completion Time Bypass Test Time Analog channels  6+6 hours to 72+6 hours 4 hours to 12 hours    Logic  train 6+6 hours to 24+6 hours no relaxation*
Page 10 of 41 Actuation relays 6+6 hours to 24+6 hours no relaxation*    *no relaxation beyond TOP (WCAP-10271 and its supplements)
WCAP-14333 was submitted for NRC review with WOG letter OG-95-51 dated June 20, 1995. The NRC issued a Safety Evalua tion on July 15, 1998 approving WCAP-14333. Southern Nuclear Operating Company submitted a License Amendment Request on October 13, 1999 for the Vogtle Units 1 and 2 to adopt the relaxations that were generically approved in WCAP-14333. As a result of the NRC review of this application,  incremental conditional large early release proba bility (ICLERP) valu es were developed  generically for all WOG plants. Amendm ents 116 and 94 were issued for Vogtle approving the changes proposed in WCAP-14333.
WOG letter OG-00-112, dated November 8, 2000, transmitted WCAP-15376, Revision 0 to the NRC for review and approval. WCAP-15376 expanded upon the groundwork laid  by WCAP-14333, but used updated component failure probability data (WCAP-15376 Section 8.2) and made some changes to the fault tree models (WCAP-15376 Section 8.3).
Using these modifications, the changes previously approved in WCAP-14333 were quantified as the base case for WCAP-15376. Section 8.4 of WCAP-15376 provides the risk metrics for this change and demonstrat es that the acceptance criteria of RG 1.174 and RG 1.177 were satisfied. 
 
WCAP-15376 provided the technical justification for the following RTS Instrumentation (TS 3.3.1), ESFAS Instrumentation (TS 3.3.2), and BDMS (TS 3.3.9) Technical Specification changes:
 
Summary of WCAP-15376 RTS and ESFAS STI and CT Changes Solid State Protection System Component  Surveillance Test Intervals Completion Times  and Bypass Times Logic  Train 2 months to 6 months No changes Master Relays 2 months to 6 months No changes Analog Channels 3 months to 6 months No changes Reactor Trip Breakers 2 months to 4 months AOT:  1 hour to 24 hours Bypass Time:  2 hours to 4 hours  The NRC approved WCAP-15376 by letter dated December 20, 2002.
 
Page 11 of 41 The Completion Time extensions requested in this amendment for BOP ESFAS and some of its associated input signals can be viewed in two perspectives with respect to these PWROG initiatives and topical reports. The amendment application submitted herewith does not use any of the inputs or results from the PWROG initiatives which were done on a generic basis for the entire fleet of Wes tinghouse NSSS plants. Therefore, Section 3.3.2 of RG 1.174 on cumulative risks can not truly be addressed by an individual licensee since nothing in an individual plant's PRA model was changed in order to receive the relaxations granted in WC APs 10271, 1433, and 15376. However, there are three considerations which can be cited here with respect to cumulative risk and the applicability of these pr evious topical reports:
This amendment application proposes a 24-hour Completion Time which is the same duration as approved under WCAP-14333 for an inoperable SSPS train.
Callaway performed a plant-specific evaluation of the RWST level function that was not analyzed generically. NRC appr oved the plant-specific evaluation in Callaway Amendment 64 dated October 9, 1991 (Reference 6, item 11 on pages 6-7 of the NRC Safety Evaluation) and in Callaway Amendment 165 dated January 31, 2005 (Reference 5, Section 4.4, pages 19-20 of the NRC Safety
 
Evaluation). Those approvals were based on a relative comparison of the signal unavailabilities between the RWST level signal and those representative signals specifically analyzed in the topical repor ts. A comparison of the requested BOP ESFAS unavailability commensurate with one 24-hour Condition entry per year (24/8760 = 2.74E-03), as discussed in Section 4.0 of this amendment application, with the AFW pump start unavailability values in Table 7.1 for the proposed case
 
of WCAP-14333 (1.56E-02) and in Table 8.10 for the combined case of WCAP-15376 (1.31E-02) with 2/4 logic, without common causes included and one SSPS
 
train out-of-service, would support a similar conclusion, i.e., that a 24-hour Completion Time for one BOP ESFAS train and its input signals would not have a detrimental impact on the unavailability and risk conclusions reached in  WCAP-14333 and WCAP-15376.
The cumulative delta-CDF risk from pre-TO P conditions to those proposed herein would be the sum of the value from Table 8.33 of WCAP-15376 (CDF of 5.7E-07 yr-1 for 2/4 AFW actuation logic signals on SG level low-low) and the value reported here in Section 4.1.4 (CDF of 1.92E-08 yr
-1). That sum is less than the "very small" criterion of 1E-06 yr
-1 identified in NRC Regulatory Guide 1.174.
 
==4.0 TECHNICAL ANALYSIS==
 
The following NRC Regulatory Guides provide an acceptable approach for the development and submittal of risk-informed licensing action requests.
 
Page 12 of 41 Regulatory Guide (RG) 1.174, Revision 1, "An A pproach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," describes a risk-informed approach, acceptable to the NRC, for assessing the nature and impact of proposed permanent licensing-basis changes by considering engineering issues and applying risk insights. This regulato ry guide also provides risk acceptance guidelines for evaluating the results of such evaluations.
 
RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," describes an acceptable risk-informed approach specifically for assessing proposed permanent TS changes in allowed outage times, referred to in TS parlance as Completion Times. This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.
 
RG 1.200, Revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," describes one  acceptable approach for determining that a licensee's PRA quality is sufficient to support regulatory decision-making.
 
One acceptable approach to making risk-informed decisions about proposed TS changes is to show that the proposed changes meet the five key principles stated in RG 1.174, Section 2 and RG 1.177, Section B:
: 1. The proposed change meets the current regula tions unless it is exp licitly related to a requested exemption or rule change.
: 2. The proposed change is consistent w ith the defense-in-depth philosophy.
: 3. The proposed change maintains sufficient safety margins.
: 4. When proposed changes result in an increase in core-damage frequency (CDF) or risk, the increases should be small a nd consistent with the intent of the Commission's Safety Goal Policy Statement.
: 5. The impact of the proposed change should be monitored using performance measurement strategies.
 
The first three of the key princi ples have been addressed in Section 3.0 of this Evaluation. The remaining two key principles are addressed in this section.
 
For permanent TS changes, RG 1.174 and RG 1.177 provide numerical risk acceptance guidelines that are helpful in determining whether or not the fourth key principle (small risk increases consistent with the inte nt of the Commission's Safety Goal Policy Statement) has been satisfied. These guideli nes are not intended to be applied in an overly prescriptive manner; rather, they provi de an indication, in numerical terms, of what is considered acceptable. The intent in comparing risk results with the risk acceptance guidelines is to demonstrate with reasonable assurance that the fourth key principle has been satisfied. 
 
Page 13 of 41 The risk evaluation presented below addresse s the last two key pr inciples of the NRC staff's philosophy of risk-informed decision-making which concern changes in risk and performance measurement strategies. These key principles were evaluated by using the three-tiered approach described in Chapte r 16.1 of the NRC Standard Review Plan and RG 1.177.
 
Tier 1 - The first tier evaluates the Callaway PRA and the impact of the change on plant operational risk, as expressed by the change in core damage frequency (CDF) and the change in large early release frequency (LERF). The change in risk is compared against the acceptan ce guidelines presented in RG 1.174. The first tier also aims to ensure that plant risk does not increase unacceptably during the period when equipment is taken out of service per the license amendment, as expressed by the incremental conditional core damage probability (ICCDP) and incremental conditional large early re lease probability (ICLERP). The incremental risk is compared against the acceptance guidelines presented in RG 1.177. Tier 2 - The second tier addresses the need to preclude potentially high-risk plant configurations that could result if equipment, in addition to that associated with the proposed license amendment, is taken out of service simultaneously, or if other risk-significant operational factors such as concurrent system or equipment testing, are also involved. The objective of th is part of the review is to ensure that appropriate restrictions on dominant risk-significa nt plant configurations associated with the CT extension are in place.
Tier 3 - The third tier addresses Ca llaway's overall configuration risk management program (CRMP) to ensure that adequate programs and procedures are in place for identifying risk-significant plant configurations resulting from maintenance or other operational activities and taking appropriate compensatory measures to avoid such configurations. The purpose of the CRMP is to ensure that equipment removed from service prio r to or during the proposed extended CT period will be appropriately assessed from a risk perspective.
 
It can be demonstrated with reasonable assurance that Completion Time extensions meet the fourth key principle if the associated risk metrics:
Satisfy the risk acceptance guideli nes in RG 1.174 and RG 1.177, or Are not substantially above the risk acceptance guidelines in RG 1.174 and RG 1.177 and effective compensatory measur es to maintain lower risk are  implemented while a temporary TS change is in effect.
The discussion that follows addr esses Tiers 1, 2, and 3 of RG 1.177.
 
Page 14 of 41 4.1 Tier 1, PRA Capability and Insights PRA Capability
 
The PRA model used to calculate the core damage risk metrics associated with this amendment is the Callaway Fourth PRA Update, i.e., the fourth revision to the Callaway PRA model which was originally developed to meet the Individual Plant Examination (IPE) requirement. The Fourth PRA Update was completed in April 2006 and was undertaken primarily to meet the PRA quality and quantification truncation limit requirements associated with the Mitigating System Performance Index (MSPI).
 
Updates to the Callaway PRA are controlled by an administrative procedure (APA-ZZ-00312) which includes provisions for monitoring plant changes that c ould affect the PRA model. The procedure requires an update of the PRA model, to maintain fidelity between the model and actual plant design and operation, at a minimum frequency of every 36 months, or when a plant change is made that would significantly impact the PRA model.
In addition, PRA personnel participate in the review of all EOP revisions (per APA-ZZ- 00103 Attachment 7) and in the meetings of the Callaway Emergency Operating  Procedure (EOP) Steering Committee when PRA i nput is needed. At present, there are no outstanding plant changes that would significantly impact the Callaway PRA model or the risk results reported in this submittal. Future plant changes will be evaluated under
 
the process discussed above in this paragraph. 
 
The Fourth Update Model, used for this appl ication, is an internal events PRA model. The model does not include internal flooding, internal fires, or seismic/external events. To meet the Individual Plant Examination of External Events (IPEEE) requirement, Callaway utilized the Electric Power Research Institute's (EPRI's) Seismic Margins Assessment and Fire Induced Vulnerability Evaluation (FIVE) methodologies. These  methodologies, as well as the internal flooding analysis method used for Callaway, are essentially successive screening approaches focused on the identifica tion of associated plant vulnerabilities. The methodologies do not calculate an overall core damage  frequency from seismic, internal fire, or internal flood events, and do not lend themselves to direct incorporation into the internal events PRA model. The Callaway internal flooding and internal fire risk analyses, and seismic assessment, were therefore not integrated into the Fourth PRA Update Model. 
 
Another Callaway PRA update is currently underway that will enable AmerenUE to submit a license amendment application in calendar year 2011 on TSTF-505 (risk initiative 4b). 
 
Peer Reviews
 
The Callaway PRA has undergone two peer reviews: a review sponsored by the Westinghouse Owners Group (WOG), performed in accordance with NEI-00-02, "Industry PRA Peer Review Process," and a review by Scientech, LLC, performed Page 15 of 41 against the ASME PRA standard [ASME RA-S-2002,"Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications" (April 5, 2002), Addendum A to this standard (ASME RA-Sa-2003, December 5, 2003), and Addendum B to this standard (ASME RA-Sb-2005, December 30, 2005)]. Attachment 9 provides a gap analysis
 
against the Capability Category II guidan ce of the PRA standards endorsed in NRC Regulatory Guide 1.200 Revision 1.   
 
The WOG PRA Peer Review followed a revi ew process adapted by the WOG and was performed during the week of November 5-10, 2000. The WOG Callaway Plant PRA
 
peer review report was drafted in March 2001. The WOG peer review generated 4 significance level A Facts and Observations (F&Os) and 28 significance level B F&Os. See Table 1 of Attachment 6 to this amendm ent application for a description of those findings and the corresponding dispositions with respect to this amendment application. 
 
Of those 32 F&Os, 3 (one significance level A and two significance level B) F&Os have not yet been addressed; however, none of the open F&Os would have a direct impact on the PRA insights developed for this application. 
 
The findings/observations (F/Os) from the Scie ntech review are discussed in Table 2 of  Attachment 6 to this amendment application (there were no significance level A or level D findings) as well as the corresponding dispositions with respect to this amendment application. Based on a review of these F/Os with respect to this amendment application, no significance level B F/O was identified with a significant impact on the enclosed PRA evaluation. One significance level C F/O (SC-4) was identified that had an impact on the enclosed PRA evaluation. For this F/O a sensitivity analysis was performed to evaluate the impact of different beta factor values on the common cause failure (CCF) evaluation. See page 22 of Attachment 1. The remainde r of the significance level C F/Os had no significant impact on the results of this PRA evaluation. AmerenUE does not believe that the gap analysis findings invalidate the PR A insights developed to support this license amendment request.
 
Truncation Levels
 
The Callaway PRA is a "small event tree, large fault tree" model. Quantification of this  type of PRA model involves quant ification of linked fault trees which represent the event  tree headings and then quantification of the event tree (i.e., accident) sequences to generate the overall core damage (or large earl y release) results.
To generate the risk results reported in the license amendment re quest, cutsets were re-generated using the Fourth Callaway PRA Update model.
 
To meet the core damage frequency (CDF) truncation level requirements of the Mitigating System Performance Index (MSPI) in NEI 99-02, Revision 4, Appendix F, the fault and event tree quantifications of the Fourth PRA Update were each performed using a cutset truncation value (4E-
: 12) that was seven orders of magnitude less than the  baseline core damage frequency.
Page 16 of 41 In addition to meeting the MSPI CDF truncation level requirement, the truncation values used in the quantification of the current Callaway PRA (i.e., Fourth PRA Update) also meet Capability Category II of Supporting Requirement (SR) QU-B3 of ASME RA-Sb-2005 Addenda to ASME RA-S-2002, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications the ASME PRA Standard."  This Supporting Requirement indicates that model solution c onvergence / truncation can be considered  sufficient when successive reductions in truncation value of one decade result in decreasing changes in CDF or LERF, a nd the final change is less than 5%.
 
A CDF truncation value sensitivity evaluation was performed as part of the Fourth PRA Update quantification, and show ed that if the truncation value was decreased from 1E-10 to 1E-11, CDF increased by 1.45%, and if the truncation value was decreased from 1E-11 to 4E-12, the CDF value increased by 0.24%
 
For the quantification of LERF, various trunca tion values were used as discussed on page 19 below.
 
Based on the above discussion, the truncation va lues used are sufficiently low such that valid results are generated for this PRA application.
 
Risk Insights
 
A review of the actuation signals deve loped from BOP ESFAS cabinets SA036D and SA036E (containment purge isolation signal (CPIS), control room emergency ventilation isolation signal (CRVIS),  emergency exhaust system actuation signal (also referred to as the fuel building ventilation isolation signal or FBVIS), steam gene rator blowdown safety injection signal (SGBSIS), auxiliary feedwater actuation si gnal (AFAS), and low suction pressure (LSP) for AFW pump swapover to the ESW) demonstrates that the equipment that would factor into the risk metrics discussed later in this application are the motor-driven AFW pumps, the low suction swapover from the CST to ESW for the AFW pumps, SG blowdown and sample isolation valves, and containment mini-purge isolation valves. Control room ventilation isolation is important for control room habitability, and fuel building isolation is important for minimizing offsite exposures after a postulated fuel handling accident in the fuel building; however, those deterministic analysis mitigation systems do not have an impact on the probability of core damage or a large release from containment. In addition, Condition A in TS 3.3.7 and Condition A in TS
 
====3.3.8 already====
contain Required Actions for one inoperable BOP ESFAS train with respect to the control room and emergency exhaust ventilation systems.   
 
====4.1.1 Internal====
Events In order to model the BOP ESFAS functions, the fault tree model "AFW.LGC" for the AFW system was updated to reflect the risk impact from the BOP ESFAS Completion Time extension, as were the component basi c events. The corres ponding surrogate basic events for applicable components that respond to the actuation signals would experience Page 17 of 41 increased failure probabilities due to the unavailability of one BOP ESFAS train, where the additional out-of-service (OOS) time results from the  proposed 24-hour Completion Time (CT). Since a power supply in BOP ESFAS cabinet SA036D failed once and a power supply in BOP ESFAS cabinet SA036E failed once during the last 25 years of plant operation, the BOP ESFAS may potentially fail again during the remaining plant lifetime. Thus, it is likely the plant will enter TS 3.3.2 Condition Q again.
 
The current Callaway PRA model (4 th Update), which is an internal events at-power model with test and maintenance unavailability data, was used for this evaluation. There are separation group 1 and se paration group 4 BOP ESFAS actuation signals from cabinets SA036D and SA036E, respectively.
Since there are two redundant BOP ESFAS separation group cabinets, SA036E was chosen to be evaluated.
Failure History at Callaway
 
The failures of the Sorensen pow er supplies and cards that are the same as those used in the BOP ESFAS cabinets were identified.
There were 14 failures during Callaway's 25-year operating history, and the shortest running time was 4 days which could be deemed as an early infant mortality failure. The service times of the failed components are shown in the following table.
 
Failure Start Date Failure Date Service Time  (day) Service Time  (year) 1 12/19/1984 3/19/1990 1916.00 5.25 2 12/19/1984 11/7/1990 2149.00 5.89 3 12/19/1984 11/11/1990 2153.00 5.90 4 12/19/1984 1/30/1995 3694.00 10.12 5 12/19/1984 10/16/2002 6510.00 17.84 6 12/19/1984 4/25/2009 8893.00 24.36 7 12/19/1984 2/19/2009 8828.00 24.19 8 12/19/1984 3/1/1989 1533.00 4.20 9 12/19/1984 1/1/1990 1839.00 5.04 10 12/19/1984 1/1/1990 1839.00 5.04 11 12/19/1984 1/1/1990 1839.00 5.04 12 12/19/1984 3/1/1988 1168.00 3.20 13    2340.00 6.41 14    4.00 0.01  Sum: 44705.00 122.48 A Bayesian estimate of the BOP ESFAS trai n failure rate at Callaway is 1.225E-01 yr
-1. This failure rate is conser vative since there have b een only two BOP ESFAS power supply failures during the plant's 25-year ope rating history. The above failure rate considers failures in other systems at Callaway with the same vendor power supply or card. 
 
Page 18 of 41 Baseline Risk Evaluation due to the BOP ESFAS CT Extension
 
If it is assumed that one BOP ESFAS train has failed and the plant has entered TS 3.3.2 Condition Q, the allowed out-of-service time would impact the availability of the BOP ESFAS. Therefore, the TS CT extension for BOP ESFAS would increase the plant risk due to the unavailability induced by one train's failure if the plant remains online. The additional unavailability due to the propos ed BOP ESFAS TS CT extension would be 24/8760 =2.74E-03. With consideration given to the above Bayesian estimate of the BOP ESFAS train failure rate, the yearly av erage unavailability due to the BOP ESFAS CT extension would be 1.225E-01*24/8760 = 3.
355E-04. The plant risk would be increased by the CT extension due to that failure. Risk metrics, namely ICCDP and ICLERP, address this single even t risk contribution in the Tier 1 calculations below. In addition, CDF and LERF address the yearly risk contri bution in the Tier 1 calculations based on a single 24-hour Condition entry per year.
 
ICCDP and CDF Calculation
 
The baseline CDF, CDF 0 , for use in the calculation of ICCDP, is 4.213E-05 yr
-1. This value is the point estimate mean of the baseline Callaway CDF with normal test and maintenance. Use of this value is consistent with the guidance in RG 1.177.
 
The Callaway basic event data file UEADD8ESFAS.BED was updated to reflect the CT extension. Then the batch processing file LEVEL1-ESFAS.IN was run to generate the new cutset equation file CALCDMIN.EQN and calculate the conditional CDF. In addition, Calculation Module "Quantify an E quation" was used to create the quantified cutset equation file CALCDMIN.EQP in folder "plot."  This calculation used WinNUPRA3.0. 
 
Based on the BOP ESFAS design and actuation signal logic, the affected basic events are listed as follows:
 
BE Description Comments for Revision AL-ICC-AF-AFAS4 No Aux Feed Actuation Signal to Components
 
(4) Set AL-ICC-AF-AFAS4 =1.0.
This represents  ESFAS cabinet SA036E out-of-service due to the cabinet failure. AL-ICC-AF-NOLSP4 No Low Suction Pressure Signal
 
Available (SG4)
Set AL-ICC-AF-NOLSP4 = 1.0. One important function for cabinets
 
SA036D/E is the low suction pressure (LSP) swapover from the CST to ESW. This represents ESFAS cabinet SA036E out-of-service due to the cabinet failure.
Page 19 of 41 AMSACFAILS AMSAC System Fails (AM)
Set AMSACFAILS = 9.999E-02 (0.1). Since AMSAC system function on AFW system through AFAS, the failure of one train AFAS will increase the failure probability of AMSAC. Conservatively assuming that the failure of ESFAS cabinet SA036D and ESFAS cabinet SA036E are the
 
only logic inputs to th e failure of AMSAC, when the failure of ESFAS cabinet SA036E is TRUE, the failure probability of AMSAC will be equal to the failure probability of
 
ESFAS cabinet SA036D, which is the square root of the nominal probability of AMSACFAILS with the assumption that both separation group ESFAS cabinets have the same failure probability.
 
Without considering common cause failures, the above changes to the probabilities of the affected basic events yield a Conditional Core Damage Frequency (CCDF) of 4.477E-05. The Incremental Conditional Core Damage Probability (ICCDP) was calculated as follows:
 
ICCDP = (4.477E 4.213E-05)*24/8760 = 7.233E-09
 
If it is assumed that the proposed TS 3.3.2 Condition Q is entered once per year, which is
 
conservative given the above discussed ope rating history, the increase in CDF, CDF, is then equivalent to:
 
CDF = 1/yr*(4.477E 4.213E-05)*24/8760 = 7.233E-09 yr
-1 ICLERP and LERF Calculation
:
The basic events mentioned in the CDF and ICCDP calculation section do not exist in the Callaway large early release cutset equation MINLERF1.EQN which is associated with the basic event data file UEALL.BED. This means these basic events are not risk significant from a LERF perspective. The Callaway containment isolation fault tree model only includes containment mini-purge, main steam isolation valves (MSIVs), and main feedwater isolation valves (FWIVs). Since the control room operators are required to take immediate actions per TS 3.3.6 Condition B to place and maintain the containment purge supply and exhaust valves in the closed position upon failure of one train of BOP ESFAS, the effect of containment mini-purge on LERF is unchanged. The  MSIVs and FWIVs are not affected because they isolate on signals from different  cabinets (the main steam/feedwa ter isolation system, or MSFI S, cabinets SA075A/B). It was thus determined that the LERF increase fr om the event is negligible and a calculation is not warranted. However, a bounding anal ysis was performed using the approach  described below to calculate the ICLERP and LERF for the configuration in which the Page 20 of 41 plant intends to operate during the extended CT.
WinNUPRA Fault Tree Module "Update LGC from BED" was used to update the fault tree CISMESF.LGC (originally CISM 1.LGC) with the house event data file HST-T.BED and basic event data file UEADD8ESFAS.BED. WinNUPRA Calculation m odule "Link Fault Trees" was used to link the containment isolation fault tree CISMESFAS.LGC and generate file
 
CISMESFAS.LKC, and then "Solve Fault Trees" was used to solve CISMESFAS.LKC on the top gate GCMI100 to evaluate the fault tree. A cutset equation, CISMESF.EQN, was created, whic h represents the baseline failure probability of containment isolation. Different cutoff values were tested as shown below (as previously discussed on page 15) and a cutoff value 1.0E-12 was used because the probability was unchanged and the number of minimum cutsets was reasonable; the resulting baseline probability is 3.551E-03 for containment isolation failure.
Cutoff Value 1.000E-10 1.000E-11 1.000E-12 1.000E-13 1.000E-14 1.000E-15 Probability 3.551E-03 3.551E-03 3.551E-03 3.551E-03 3.551E-03 3.506E-03 Number of MCS (Minimum Cutset) 17 34 56 105 243 24372 The probabilities of basic events were adjusted as follows. WinNUPRA Result module was used to perform sensitivity analysis using UEADD8ESFAS.BED and CISMESF.EQN. The resulting conditional failure probability is 5.651E-03.
Calculation Module "Quantify an Equati on" was used to cr eate the quantified cutset equation file CISMESF.EQP in folder "plot."  The result was verified by re-evaluating the fault tree with the adjust ed probabilities of the following basic events in the data file UEADD8ESFAS.BED; both results match.
BE Description Comments for Revision VT-PND-FT-VTHZ04 VT-PND-FT-VTHZ11 Mini Purge Isolation Valve VTH04 Fails to Transfer Closed Mini Purge Isolation Valve VTH11 Fails to Transfer Closed Set VT-PND-FT-VTHZ04
= 1.0 Set VT-PND-FT-VTHZ11
= 1.0  due to the failure of  BOP ESFAS cabinet SA036E MNPURGVLVSOPEN Percent of Year Mini-Purge Open Set MNPURGVLVSOPEN
= 1.0 This conservatively assumes that the mini-purge valves are not closed immediately per TS 3.3.6.
The LERF was calculated by multiplying the Conditional CDF of 4.477E-05 yr
-1 by the difference of the containment isolati on failure probabiliti es. The corresponding Incremental Conditional Large Early Release Probability (ICLERP) for the CT 24-hour  extension was calculated as follows:
 
ICLERP = (5.651E 3.551E-03)*4.477E-05*24/8760 = 2.576E-10 Page 21 of 41 Assuming TS 3.3.2 Condition Q with a 24-hour restoration time is entered once per year, the increase in LERF, LERF, is then equivalent to:
 
LERF = 1/yr*(5.651E 3.551E-03)*4.477E-05*24/8760 = 2.576E-10 yr
-1 Common Cause Factor Impact on the Plant Risk                                                                         
 
If the plant has entered the BOP ESFAS TS 24-hour CT due to an inoperable separation group 4 BOP ESFAS train, a concurrent sepa ration group 1 BOP ESFAS train failure would cause multiple components to fail to receive the appropriate actuation signals. Thus, a BOP ESFAS separation group 1 failure concurrent with th e separation group 4 cabinet out-of-service under TS 3.3.2 Cond ition Q would represent a common cause failure mode and this common cause factor (CCF) must be evaluated.   
 
The CCF is directly attributable to basic event AL-ICC-AF-AFAS1 using a beta factor. If the failure probability of this basic event is changed to account for CCF, this will propagate to the actuation of the 'A' train MDAFP, the TDAFP, and the SG blowdown isolation valves via the logic model. So, if TS 3.3.2 Condition Q is entered because AL-ICC-AF-AFAS4 is failed, then the probability of AL-ICC-AF-AFAS1 would be set to the beta factor. The value of the beta factor may be in the 0.05 to 0.1 range per NUREG/CR-5485 and WCAP-15167. Given that SA036E has failed, AL-ICC-AF-AFAS4 and AL-ICC-AF-NOLSP4 were set to 1.0 and AMSACFAILS was set to 0.1. 
 
The generic CCF parameter was used to modify AL-ICC-AF-AFAS1. Based on NUREG/CR-5485 equation (3.1), a value of 0.1 applies to the components of a system which are tested simultaneously (non-staggere d) and a value of 0.05 applies to systems which are tested at fixed time intervals (sta ggered). Since both BOP ESFAS trains can not be taken out-of-service at the same time, the average value 0.075 was assigned to AL-ICC-AF-AFAS1. The conditional CDF is 9.342E-05, increasing by 108% from the CCDF of 4.477E-05. This means that the common cause failure that may fail both BOP ESFAS trains could be the major contributor to plant risk. The plant risk was therefore re-evaluated.
 
The Incremental Condition Core Damage Probability (ICCDP) would then be:
 
ICCDP = (9.342E 4.213E-05)*24/8760 = 1.405E-07
 
Assuming TS 3.3.2 Condition Q with a 24-hour CT is entered once per year, the increase in CDF would be:
 
CDF = 1/yr*(9.342E 4.213E-05)*24/8760 = 1.405E-07 yr
-1 The Incremental Conditional Large Early Re lease Probability (ICLER P) would then be:
 
ICLERP = (5.651E 3.551E-03)* 9.342E-05*24/8760 = 5.375E-10 Page 22 of 41 Assuming TS 3.3.2 Condition Q with a 24-hour CT is entered once per year, the increase in LERF would be:
 
LERF = 1/yr*(5.651E 3.551E-03)* 9.342E-05*24/8760 = 5.375E-10 yr
-1  CCF Sensitivity To evaluate the impact of beta factor on BOP ESFAS CCF, a sensitivity calculation was performed to show the impact of beta factor values in the range of 0.05 and 0.1 on risk. The values were assigned to the basic event AL-ICC-AF-AFAS1 to model CCF of BOP ESFAS. The conditional CDF 4.477E-5 was used to compare the CDF increase, where CCF was not given considerati on, so that different beta factors could demonstrate their common cause impacts on risk. The summary is listed as follows. The beta factor could increase the conditional CDF dramatically; the CCF would be the main contributor to the plant risk increase.
CCDF Increase Percentage (%)
ICCDP ICLERP 0.05 7.652E-05 71% 9.422E-08 4.403E-10 0.075 9.342E-05 108% 1.405E-07 5.375E-10 0.1 1.103E-04 145% 1.868E-07 6.346E-10 Comparing beta factor 0.075 with 0.05 and 0.1, the change of the resulting CCDF would not exceed 20%. It shows that CCF presents a more significant impact on the risk than the different values of beta factor. Considering the given conservatism and the margin to the acceptance values, the most conservative beta factor would not unduly affect the plant risk, and the overall risk would not exceed the "very small" change criteria.
 
In another case for the CCF of the SG blowdow n isolation valves, the beta factor of BM-AOV-DF-HV1-4 was 0.1 which is conservative. To evaluate the impact, the values of the beta factor were tried as 0.05 and 0.075. Si nce the CDF change is less than 5% and it decreases when compared with the BOP ESFAS CCF, there is little impact of this beta factor on the risk from the BOP ESFAS Completion Time (CT) extension. Thus, the use of the most conservative beta factor for SG blowdown isolation valves did not impact the results of the PRA evaluation fo r the BOP ESFAS CT extension.
Failure Probability CCDF Increase Percentage
(%) Baseline CDF Increase Percentage
(%) ICCDP ICLERP 0.05 1.100E-04 4.267E-5 -4.67%
4.004E-05 -4.97% 7.205E-09 2.455E-10 0.075 1.650E-04 4.372E-5 -2.34%
4.109E-05 -2.48% 7.205E-09 2.515E-10
 
Page 23 of 41
 
====4.1.2 Internal====
Fires The following fire risk evaluation is generally based on the data and methods used in the Callaway Plant Individual Plant Examination of External Events (IPEEE). The IPEEE fire analysis used the EPRI Fire Induced Vulnerability Evaluation (FIVE) method. The IPEEE was submitted to the NRC in June of 1995. The NRC SER on the Callaway IPEEE submittal was issued in September 1999.
 
Fire Areas of Interest Attachment 7 is a comprehensive list of all of the fire areas identified in IPEEE Table 4.3.2-1 (except for those areas that obviously do not affect core damage, e.g., the Fuel Building). The column titled "Screen Basis" provides 9 reasons (including the control room fire discussion below) for screening a fire area from furt her evaluation. These reasons are explained below:
 
CCDP = 1.0:  The fire area conditional core damage probability (CCDP) was evaluated to be 1.0 in the original fire analysis. Therefore, th ere is no change in risk due to the BOP ESFAS CT extension. No Appendix R or PRA equipment:  The fire area has no equipment that is damaged that is credited in the deterministic or PRA fire analyses. Therefore, there is no change in risk due to the BOP ESFAS CT extension. Low frequency:  The fire area fire frequency is low (below 1E-03 yr
-1) and was excluded as was done for the ESW CT extension project (see LA186, Reference 7). CCDP very low, mitigation not significantly impacted:  The fire area original CCDP was very low (approximately E-07), such that, when combined with the fire area fire frequency and any impact due to the BOP ESFAS CT extension, the risk impact is negligible (i.e., the difference in AFW unavailability is approximately 1.3E-04, determined in the flood evaluation above, and when considered in combination with other mitigation unavailability such as feed and bleed, the impact is negligible). Reactor trip only, mitigation not impacted:  The only impact due to a fire in the fire area is a reactor trip. No mitigation is impacted by the fire. Any impact due to the BOP ESFAS CT extension is negligible (i.e., the difference in AFW unavailability is approximately 1.3E-04, determined in the flood evaluation above, and when considered in combination with other mitigation unavailability such as feed and bleed, the impact is negligible). Thermo-lag barriers credited:  The fire area was credited with thermo-lag barriers such that the fire did not cause any damage to mitigation equipment. Any impact due to the BOP ESFAS CT extension is negligible. LOOP delta CCDP = 0.0:  A fire in the fire area results in a LOOP (or near LOOP) with no other mitigation equipment impacted. A sensitivity study 
 
was performed to show that there is essent ially no risk increase for a LOOP event during the BOP ESFAS CT extension.
Page 24 of 41 A fire in the Control Room (fire area C-
: 27) was analyzed separately in the IPEEE with the results presented in IPEEE Section 4.3.6. Recovery of a fire in the control room is dominated by human actions, including manual actions to initiate many functions. Automatic actuation signals are not specifically credited in the analysis. A train of BOP ESFAS out-of-service does not impact the ability of the operators to manually actuate AFW from either the control room or the auxiliary shutdown panel (ASP). Thus, there is no risk increase for a fire in the control room with respect to th e BOP ESFAS CT extension. Fire freq = 0:  It was determined in th e IPEEE that the fire frequency for the fire area was 0. Thus, there is no risk increase for a LOOP event during the BOP ESFAS CT extension.
 
There are 25 non-screened fire area s that required further evaluation.
 
The designators of the areas for evaluation are in bold text in the column titled "Fire Compartment" in Attachment 7. This evaluati on addressed those fire areas identified in bold text in Attachment 7.
Fire Frequencies Attachment 7 lists the fire frequency for each fire area. These values were obtained from the IPEEE. The fire frequencies used in the IPEEE were based upon the EPRI Fire Events Database (NSAC-178L). As was done in the IPEEE, a fire in a given fire area is assumed to fail all PRA-credited equipment in the fire area, as well as fail equipment associated with cable in the fire area, unless the fire area was fire modeled in detail. This evaluation used the fire frequencies listed in Attachment 7, except for those fire areas that were fire modeled. This is discussed below.
 
Fire Modeled Scenarios Fire areas A-1A, A-16, and A-27 were fire modeled in the IPEEE due to their high fire frequencies and their potentially high CCDPs.
 
IPEEE Table 4.3.3.4-5 presents the fire modeling results for fire area A-1A. Six fire scenarios were developed for this fire area. Each scenario is discussed below:
Scenario 1: Has a low fi re frequency (approx. E-05 yr
-1) and only non-safety related cable is impacted. This scenario was neglected.
 
Scenario 2: CCDP = 0 since no target damage is possible. This scenario was neglected.
 
Scenario 3: Only non-safety cable is im pacted. This scenario was neglected.
Page 25 of 41 Scenario 4: CCDP = 0 since no damage from a hot gas layer (HGL) to any targets.
This scenario was neglected.
 
Scenario 5: Fire frequency of 3.93E-04 yr
-1, multiplied by 0.1 to credit non-exposure to transients. So, fire modeled fire frequency is:
f A-1A/5 = (3.93E-04)
* 0.1 = 3.93E-05 yr
-1  Scenario 6: Fire frequency of 3.93E-04 yr
-1, multiplied by 0.1 to credit non-exposure to transients and 0.07 to credit small area of impact for a
 
transient combustible fire. So, fire modeled fire frequency is:
f A-1A/6 = (3.93E-04)
* 0.1
* 0.07 = 2.75E-06 yr
-1  IPEEE Table 4.3.3.4-8 presents the fire modeling re sults for fire area A-16. Twelve fire scenarios were developed for this fire area. Each scenario is discussed below:
Scenario 1: This scenario is a failure of a CCW pump due to a fire. Since there are four CCW pumps, this applies to Scenarios 1 to 4. The fire modeled fire frequency is:
fA-16/1 = 2.64E-04 yr
-1  Scenario 5: CCDP = 0 since no damage from a HGL to any targets. This scenario was neglected.
Scenario 6: CCDP = 0 since no damage from a HGL to any targets. This scenario was neglected.
 
Scenario 7: CCDP = 0 since no damage from a HGL to any targets. This scenario was neglected.
 
Scenario 8: CCDP = 0 since no damage from a HGL to any targets. This scenario was neglected.
 
Scenario 9: Fire frequency of 3.26E-05 yr
-1, multiplied by 0.05 to credit probability of suppression prior to damage. This results in a frequency of 1.63E-06 yr
-1 which is very low. In addition, the IPEEE CCDP is low (E-05). Thus, this scenario was neglected.
 
Scenario 10: Fire frequency of 3.93E-04 yr
-1, multiplied by 0.1 to credit non-exposure to transients and 0.05 to credit small area of impact for a transient combustible fire. This ap plies to Scenarios 10 to 12. So,  fire modeled fire frequency is:
Page 26 of 41 fA-16/10 = (3.93E-04)
* 0.1
* 0.05 = 1.97E-06 yr
-1  IPEEE Table 4.3.3.4-10 presents the fire modeling results for fire area A-27. Two fire scenarios were developed for this fire area. Each scenario is discussed below:
Scenario 1: Fire frequency of 1.67E-03 yr
-1, multiplied by 0.005 to credit probability of suppression prior to damage and 0.333 to credit manual recovery of the Halon system. The fire modeled fire frequency is:
fA-27/1 = (1.67E-03)
* 0.005
* 0.333 = 2.78E-06 yr
-1  Scenario 2: CCDP = 1.0:  The scenario conditional core damage probability (CCDP) was evaluated to be 1.0 in the original fire analysis. Therefore, there can be no change in risk due to the BOP ESFAS CT extension. This scenario was neglected.
Probability of Non-suppression IPEEE Table 4.3.3.2-2 lists the probability of non-suppression of the fire [column heading P(ns)] for the fire areas. The IPEEE references the EPRI FIVE document (EPRI TR-100370) for the unavailability of fire suppression equipment. The unavailability of pre-action sprinkler systems and Halon system s is 0.05. The unavailability of wet pipe sprinkler systems is 0.02. This evaluation cr edited the probability of non-suppression for fire areas A-17, A-18, C-6, C-9, C-10, D-1, an d D-2, as well as what was credited in the fire modeled scenarios above. Attachme nt 7 lists the probability of non-suppression, taken from IPEEE Table 4.3.3.2-2, in the column labeled "P(NS)".
Conditional Core Damage Probability (CCDP)
For all evaluated fire areas, it was assumed that the increase in unavailability of the AFW system, due to an AFAS train out-of-service (OOS), represents the potential increase in risk for these fire areas. So, the change in CCDP is the increase in the unavailability between the "baseline" AFW results and the AFW results with an AFAS train OOS event. Thus, from the flood evaluation above:
 
CCDPAFWAFAS = PAFWAFAS1 - PAFWORIG  = (4.862E-04) - (3.616E-04) = 1.246E-04
 
The above CCDP was applied to evaluated fire areas as shown in the Attachment 7 column titled "Fire CDF-".
Page 27 of 41 Increase in CDF Due to Fires The ICCDP reported below is per Condition entry with the new 24-hour CT and the CDF is based on entering the new 24-hour CT once a year. From Attachment 7:
 
CDFfires = 3.20E-06 yr
-1 ICCDPfires = (3.20E-06) * (24 / 8760) =
8.77E-09 CDFfires = 1/yr
* ICCDPfires = (1/yr) * (3.20E-06) * (24 / 8760) =
8.77E-09 yr
-1 Using the same approach used for internal events, with ICLERP reported per Condition entry with the new 24-hour CT and LERF based on entering the new 24-hour CT once a year:
 
ICLERP =
1.84E-11 LERF = 1.84E-11 yr
-1  4.1.3 Internal Flooding The following flooding risk evaluation is generally based on the data and methods used in the Callaway Plant Individual Plant Examination (IPE). The IPE was submitted to the NRC in September of 1992. The NRC Staff Evaluation Report (SER) on the Callaway IPE submittal was issued in May 1996. 
 
The flood frequency, due to a pipe failure in an ESW or AFW train, was determined for each risk-significant flood area. The flood frequencies were obtained from data used in the IPE. The IPE states that flood initiator frequencies were estimated using a combination of EPRI NP 6992L, EGG-SSRE-9639, NSAC-60, and EPRI TR-102266.
As was done in the IPE, a flood in a given flood area was assumed to fail all PRA-credited equipment in the flood area, as well as fail the flooding source.
 
Flood Zones of Interest Attachment 8 is a comprehensive list of all of the pertinent flood areas (except for those areas that obviously do not affect core damage, e.g., the Fuel Building). The column titled "Screen Basis" provides 4 reasons for screening a flood zone from further evaluation. These reasons are explained below:
 
CCDP = 1.0:  The flood zone conditional core damage probability (CCDP) was evaluated to be 1.0 in the original flooding analysis. Therefore, there is no change in risk due to the BOP ESFAS CT extension.
Page 28 of 41 No ESW/AFW Flood:  The flood zone does not have a flooding source attributable to either the ESW or AFW systems. Floods due to breaks in ESW or  AFW will affect the AFW system and thus are the most pertinent. Thus, for areas with no flood due to ESW or AFW, all three trains of AFW are potentially available, as well as most all of the ECCS equipment, and the impact of one train of BOP ESFAS OOS is negligible. Low flood frequency:  The flood zone flood frequency is low (approximately 1E-7 yr-1) and would have a negligible contri bution to risk due to the BOP ESFAS CT extension. Included in THREE:  A re view of the flood zones revealed that the diesel generator zones (D-1 and D-2, rooms 5201 and 5203) were included with flood zone THREE. Thus, these rooms were previously "double counted" in the flooding analysis. The "double counting" was excluded in this evaluation.
 
There are 26 non-screened flood zone s that required further evaluation.
 
The designators of the areas for evaluation are in bold text in the column titled "Flood Areas" in Attachment 8. This evaluation addressed those flood zones identified in bold text in Attachment 8.
 
Flood Frequencies Attachment 8 lists the flood frequency for each flood zone that is attributable to a flood due to the ESW or AFW system in that flood zone (Attachment 8 column titled "ESW/AFW Flood Source"). With one train of AFAS OOS, during the CT, a flood initiating event due to a leak/break in the opposite ESW or AFW train is the limiting flood event. Other flood events will not impact an entire train of equipment and thus are  less limiting. The ESW and AFW flood frequencies, identified in Attachment 8, were used as the flood initiating event frequencies in this evaluation.
Conditional Core Damage Probability (CCDP)
For all flood zones, except ES-1, ES-2, UHS-1, and UHS-2, the flood results from a break in an ESW line or an AFW line. This results in one train of AFW unavailable. Such a break, in combination with the opposite train's AFAS OOS, represents the potential increase in risk for these flood zones. 
 
Fault tree AFW.LGC, as modified to perform this evaluation, was linked and then updated with BED files UEADD8ESFAS-12.BED and HSE-T.BED. The linked and updated fault tree was then solved and produced files AFW.EQN and AFW.FTP. The resulting AFW unavailability, with one train of AFAS OOS (i.e., probability of AL-ICC-AF-AFAS4 = 1.0) is:
 
PAFWAFAS4 = 4.862E-04 Page 29 of 41 Next, a sensitivity analysis was performed wherein the probability of AL-ICC-AF-AFAS4 was reset to its original value. The unavailability valu e, shown below, is consistent with the nominal AFW unavailability from the Fourth PRA Update of  3.53E-04. This established the "baseline" unavailability of the AFW system.
 
PAFWORIG = 3.616E-04
 
Another sensitivity was performed wherein the probability of AL-ICC-AF-AFAS1 was set to fail (i.e., probability of AL-ICC-AF-AFAS1 = 1.0). The unavailability value, shown below, is consistent with the AFW unavailability when AFAS4 is OOS of 4.862E-
: 04. This established the unavailability of the AFW system with AFAS1 OOS.
 
PAFWAFAS1 = 4.909E-04
 
A sensitivity was performed wherein the probability of EF-DRAIN-TRAINB was set to fail (i.e., probability of EF-DRAIN-TRAINB = 1.0), with nominal failure probabilities for AFAS1 and AFAS4. The unavailability value, shown below, established the "baseline" unavailability of the AFW system with a train of ESW drained.
 
PAFWDRAIN = 9.351E-04
 
A sensitivity was performed wherein the probability of EF-DRAIN-TRAINB was set to fail (i.e., probability of EF-DRAIN-TRAINB
= 1.0) and the probability of AL-ICC-AF-AFAS1 was set to fail (i.e., probability of AL-ICC-AF-AFAS1 = 1.0). This established the unavailability of the AFW system with AFAS1 OOS and ESW train B drained.
PAFWAF1-DRAIN
= 1.840E-03
 
It is conservatively assumed that the change in CCDP for these flood zones is the change in AFW unavailability between the "baseline" ESW drained event and the ESW drained coincident with an AFAS train out-of-service event. Thus, 
 
CCDPAFWAF1-DRAIN
= (1.840E-03) - (9.351E-04) = 9.049E-04
 
Flood zones ES-1, ES-2, UHS-1, and UHS-2 reside outside the normal power block buildings. As such, flooding that occurs in any of these zones will not impact equipment associated with normal service water, and the break can be isolated such that normal service water (system EA) can be used to continue to pr ovide cooling flow to the protected train, including the AFW system. A sensitivity was performed wherein the conditional probability of a T(2) event (reactor trip without MFW available) was determined coincident with EF-MDP-FR-PEF 01A set to fail (i.e., probability of EF-MDP-FR-PEF01A = 1.0) and the probability of AL-ICC-AF-AFAS4 was kept failed (i.e., probability of AL-ICC-AF-AFAS4 = 1.0). The CCDP value, shown below, established the CCDP for a T(2) event (c aused by a flood in ES-1, ES-2, UHS1, or UHS-2) with a train of ESW failed (which represents the ES W flood, but with EA still available) and a Page 30 of 41 train of AFAS OOS.
 
CCDPAF4-EFA = 2.627E-05
 
A sensitivity was performed wherein the conditional probability of a T(2) event (reactor trip without MFW available) was determined coincident with EF-MDP-FR-PEF01A set to fail (i.e., probability of EF-MDP-FR-PEF01A = 1.0) and with nominal failure probabilities for AFAS1 and AFAS4. The CCDP value, shown below, established the "baseline" CCDP for a T(2) event (cause d by a flood in ES-1, ES-2, UHS1, or UHS-2) with a train of ESW failed (which represents the ESW flood, but with EA still available).
 
CCDP EFA = 1.971E-05
 
The change in CCDP for these flood zones is the change in CCDP between the "baseline" ESW train failed event and the ESW train faile d coincident with an AFAS train out-of-service event. Thus, 
 
CCDPAF4-EFA = (2.627E-05) - (1.971E-05) = 6.560E-06
 
The above two CCDPs were applied to their resp ective flood zones as shown in the Attachment 8 column titled "Flooding CDF-". Attachment 8 Note 1 delineates the flood zones to which these apply.
 
Increase in CDF Due to Floods The ICCDP reported below is per Condition entry with the new 24-hour CT and the CDF is based on entering the new 24-hour CT once a year. From Attachment 8:
 
CDF floods = 1.17E-06 yr
-1 ICCDP floods = (1.17E-06) * (24 / 8760) =
3.21E-09 CDF floods = 1/yr
* ICCDP floods = (1/yr) * (1.17E-
: 06) * (24 / 8760) =
3.21E-9 yr
-1 Using the same approach used for internal events, with ICLERP reported per Condition entry with the new 24-hour CT and LERF based on entering the new 24-hour CT once a year:
 
ICLERP =
6.73E-12 LERF = 6.73E-12 yr
-1 Page 31 of 41 Fire and Flood Sensitivities The most likely source of uncertainty in the flood and fire risk assessments is the assumption that the increase in risk for most of these zones/areas is the change in unavailability of the AFW system. For mo st of the zones/areas, the change in unavailability of the AFW system was based on the whole AFW system (all three trains), being potentially available (e xcept in the case of the flood zones where the flood was due to an ESW or AFW pipe break).
 
To quantify this source of uncertainty, fault tree AFW.LGC, as modified to perform this evaluation, was linked and then updated with BED files UEADD8ESFAS-12.BED and SBOINIT.BED. The linked and updated fault tree was then solved and produced files AFWT1S-AF.EQN and AFWT1S-AF.FTP. The resulting unavai lability represented only the TDAFP being potentially available with no ESW backup source (SBO event) and with one train of AFAS OOS (i.e., pr obability of AL-ICC-AF-AFAS4 = 1.0). The unavailability is:
 
PAFWT1S-AF = 2.534E-02
 
Next, a sensitivity was performed wherein the probability of AL-ICC-AF-AFAS4 was reset to its original value. The unavailability value, shown below, is consistent with the nominal TDAFP unavailability from the Fourth PRA Update of 2.50E-02. This established the "baseline" unavailability of the TDAFP during an SBO event.
 
PAFWT1S = 2.508E-02 So, the change in CCDP is the increase in the unavailability between the "baseline" TDAFP results and the TDAFP results with an AFAS train OOS event. 
 
CCDPAFWAFAS = PAFWT1S-AF - PAFWT1S  = (2.534E-02) - (2.508E-02) = 2.60E-04
 
The above CCDP is roughly double the CCDP calculated for the fire risk.
 
Thus, to estimate the sensitivity of the flood and fire risk evaluations to the uncertainty in the assumed CCDPs, the risk metrics were doubled. A doubling of the risk metrics for floods and fires continues to result in a small impact on risk due to the BOP ESFAS CT extension.
 
====4.1.4 Combined====
Risk Metric Results The following tables provide the risk metrics associated with this amendment request.
 
Page 32 of 41 The yearly risk contribution from a single TS 3.3.2 Condition Q 24-hour entry per year (ICCDP and ICLERP values apply to each Condition entry):
 
Callaway Results Risk Metric Acceptance Criteria Internal Flood Fire Total CDF <1E-06 yr
-1  very small
 
RG 1.174 7.23-09 yr
-1 3.21E-09 yr
-1 8.77E-09 yr
-1 1.92E-08 yr
-1LERF <1E-07 yr
-1 very small
 
RG 1.174 2.58E-10 yr
-1 6.73E-12 yr
-1 1.84E-11 yr
-1 2.83E-10 yr
-1ICCDP <5E RG 1.177 7.23E-093.21E-098.77E-09 1.92E-08 ICLERP <5E RG 1.177 2.58E-106.73E-12 1.84E-11 2.83E-10
 
Regulatory Guides 1.174 and 1.177 provide the core damage risk increase acceptance criteria above for very small risk changes.
 
===4.2 External===
Events Seismic The Callaway Plant has a robust seismic design. Due to the SNUPPS design originally being intended for multiple sites, additional design conservatism was built into the plant by designing to floor response spectra (FRS) th at overlapped the vari ous sites originally considered. In order for Union Electric (now AmerenUE) to respond to Generic Letter 88-20, Supplement 4, the results of a Seismic Margins Assessment (SMA) were reported to the NRC in the IPEEE Report submitted via ULNRC-3232 dated 6-30-95. In support
 
of that response, Bechtel Power Corporation was contracted to compare Callaway's FRS against the 0.3g Review Level Earthquake (RLE). After this effort, seismic qualification documentation was reviewed to verify whether specific equipment was qualified for the limited frequencies where the RLE exceeded the FRS. This screened out all but 22 components listed in the IPEEE Report Section 3.1.4.1.4. As an example of how the SNUPPS design led to Callaway's robust seismic design, IPEEE Report Section 3.1.4.5.3 documents a calculation demonstrating that the component cooling water (CCW) heat  exchangers would survive a peak ground acceleration of 0.41g, far in excess of the RLE and the Safe Shutdown Earthquake (SSE).
Page 33 of 41 NUREG-1488 estimates a mean seismic hazard frequency of 1.68E-5 yr
-1 for a 0.3g or greater earthquake. The SMA of the Callaway Plant determined that the Safe Shutdown Equipment List (SSEL) equipment, which is needed for two success paths to mitigate the effects of a seismically induced small br eak LOCA as discussed in Section 3.1.2.3 of Reference 8, is capable of withstanding th e 0.3g Review Level Earthquake (RLE). Since the internal events CCDF due to this  BOP ESFAS Completion Time Extension is calculated to be 4.48E-05 yr
-1 , as discussed above, the seismic risk is not significant for this application. 
 
High Winds, External Floods, Transporta tion and Nearby  Facility Accidents
 
Callaway Plant's design conforms to the 1975 Standard Review Plan and no potential vulnerabilities from high winds and torn adoes, floods, and transportation and nearby facility accidents exist that have not been in cluded in the original design basis analysis. 
 
All Seismic Category I structures are designed to withstand the effects of a tornado and the most severe wind phenomena encountered.
Non-Category I structures are designed to preclude their collapse upon safe ty-related structures or components under loads imposed by the design basis tornado. 
 
All Seismic Category I structures and the sy stems they house are designed to withstand the effects of natural phenomena, such as flooding and groundwater level. These structures are not protected above grade for flooding because there are no above-grade floods at the structure locations. 
 
There are no hazards presented to the Callaway Plant either from barge traffic on the Missouri River or from the roads nearest the plant site. There are no aircraft hazards whose probability of occurrence is greater than 1E-07 per year.
 
There are no military bases, missile sites, or military firing ranges, manufacturing or chemical plants, pipelines or tank farms are located within 5 miles of the site. The  potential design basis accidents from nearby facility hazards have been evaluated and there are no onsite or offsite hazards which have an adverse effect on the plant structures.
 
Therefore, there are no elevated risks from high winds and tornadoes, floods, and transportation and nearby facility accidents that are significant for the extended BOP ESFAS Completion Times.
 
4.3 Tier 2, Avoidance of Risk-Significant Plant Configurations In the calculation of ICCDP, delta-CDF, ICLERP and delta-LERF, no credit was taken for any compensatory measures. However, there are two Technical Specification LCOs that bear some discussion with respect to the risk findings reported herein:
Page 34 of 41 The BOP ESFAS must be OPERABLE in MODES 1-4 to support TS 3.3.6, "Containment Purge Isolation Instrument ation."  Condition B of TS 3.3.6 is entered for one or more inoperable BOP ESFAS trains and requires immediate action to be taken to close the containment mini-purge isolation valves. This Required Action B.1 is credited in the LERF and ICLERP calculations.
The new Note added to TS 3.3.2 Condition J will assure the availability of the actuation signal for AFW start after the loss of both main feedwater pumps from one train of BOP ESFAS. While this doe s not directly factor into the CDF and ICCDP calculations, it does address a deterministic concern with the separate Condition entry allowance.
4.4 Tier 3, Risk-Informed Conf iguration Risk Management Tier 3 requires a proceduralized process to as sess the risk associated with both planned and unplanned work activities. The objective of th e third tier is to en sure that the risk impact of out-of-service equipment is evaluated prior to performing any maintenance activity. As stated in Section 2.3 of Regulatory Guide 1.177, "a viable program would be one that is able to uncover risk-significant plant equipment outage configurations in a  timely manner during normal plant operation."  The third-tier requirement is an extension of the second-tier requirement, but addresses the limitation of not being able to identify all possible risk-significant pl ant configurations in the second-tier evaluation. Programs  and procedures are in place at Callaway which serve to address this objective.
In particular, APA-ZZ-003l5, "Configuration Risk Management Program," and EDP-ZZ-01129, "Callaway Plant Risk Assessment," are an integral part of the work management process at the plant. The Configuration Risk Management Program (CRMP) ensures that configuration risk is assessed (using the PR A-based Safety Monitor, a computer-based program for assessing the impact on plant sa fety of out of service equipment) and managed prior to initiating any maintenance activity consistent with the requirements of 10 CFR 50.65(a)(4). The BOP ESFAS and systems actuated by the BOP ESFAS are within the scope of Callaway's maintenance rule program and have availability and reliability criteria established to monitor performance. The CRMP also ensures that risk is reassessed if an emergent condition results in a plant c onfiguration that has not been previously assessed. 
 
Under the CRMP, using the associated Safety Monitor, risk threshol ds were established to ensure that average baseline risk is maintained within an acceptable band. The four bands used in this program are:
 
Green - Key safety functions are at minimum risk. TS LCOs are met.
Yellow - A key safety function is in a reduced capability. The plant's ability to perform the associated safety function is reduced but sti ll acceptable. Risk Page 35 of 41 Management Action may be required prior to planned entry. For unplanned entry, Risk Management Action plan must be implemented as soon as possible. Plant  and equipment availability conditions meet the TS without reliance on the action  statements and the minimum equipment requirements.
Orange - Key safety functions are de graded and steps should be taken to minimize the amount of time in this condition. Risk Management Action plan and specific approval are required prior to planned entry. For unplanned entry, Initiation of a Risk Management Action Plan and Plant Director/EDO notification are required. Approval Forms and Risk Management Action Plans are contained in APA-ZZ-00322, Integrated Work Management Process Description.
Red - Key safety functions are severely threatened. Immediate actions are required to restore acceptable plant risk. Planned entry is NOT allowed. For unplanned entry, Initiation of a Risk Management Action Plan and Plant Director/EDO notification is required.
 
The risk thresholds for these bands are listed in the table that follows, where ICCDP is as defined under Tier 1 above, CDF' is the conditional core damage frequency, ICLERP is as defined under Tier 1 a bove, and LERF' is the conditi onal large earl y release frequency:
 
ICCDP CDF' ICLERP LERF' Red  > 1E-3  >1E-4 Orange > 1E-5 > 5.5E-4 >1E-6 >5.2E-5 Yellow 1E 1E-5 8.7E 5.5E-4 1E 1E-6 5.7E 5.2E-5 Green < 1E-6 < 8.7E-5 < 1E-7 < 5.7E-6 When a risk significant configuration occurs (Safety Monitor in the Yellow, Orange, or Red Bands), Risk Management Action Planning is performed in accordance with Section 4.6 of APA-ZZ-00315 and APA-ZZ-00322, "Integrated Work Management Process Description."  Compensatory measures are established to reduce risk (limit unavailability time and implement a contingency plan to restore and/or mitigate the loss of a key safety function). If an unacceptable risk level occurs (in the orange or red band), the Shift
 
Manager / Control Room Supervisor or the Work Week Manager reschedules work as needed to minimize the overall plant risk. 
 
The Callaway CRMP was reviewed and a pproved by NRC in support of License Amendment 165 as discussed on pages 13-15 of the Safety Evaluation attached to Reference 5 in Section 7.0.
 
===5.0 REGULATORY===
 
SAFETY ANALYSIS This section addresses the st andards of 10 CFR 50.92 as well as the applicable regulatory requirements and acceptance criteria.
Page 36 of 41 This amendment application submits a proposed change to Technical Specification (TS) 3.3.2, "Engineered Safety Feature Action System (ESFAS) Instrumentation," that would add a new Required Action Q.1 to require rest oration of an inoperable Balance of Plant ESFAS (BOP ESFAS) train to OPERABLE stat us within 24 hours. Currently, Condition Q of TS 3.3.2 for Function 6.c of TS Table 3.3.2-1 requires the plant to enter a shutdown track to MODE 3 within 6 hours and to MODE 4 within 12 hours with no allowed outage time provided for restoration. In addition, the Completion Times for TS 3.3.2 Required Actions J.1 and O.1 to trip inoperable channe ls that provide inputs to BOP ESFAS would also be extended to 24 hours. Shutdown track Completion Times to be in MODES 3 and 4 would be increased to reflect these longer restoration times. Separate Condition entry for TS Condition J would be restricted to assure that Function 6.g in TS Table 3.3.2-1 will provide a start signal to the motor-driven auxiliary feedwater (AFW) pumps from one train of BOP ESFAS actuation logic. This is a risk-informed amendment request following the guidance of NRC Regulatory Guides (RGs) 1.174, 1.177, and 1.200
 
Revision 1.
 
5.1 No Significant Hazards Consideration (NSHC)
AmerenUE has evaluated whether or not a significant hazards consid eration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," Part 50.92(c), as discussed below:
: 1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?
Response: No
 
Overall protection system performance will remain within the bounds of the previously performed accident analyses since no hardwa re changes are proposed to the protection systems. The same reactor trip system (RTS) and engineered safety feature actuation system (ESFAS) instrumentation will continue to be used. The protection systems will continue to function in a manner consistent with the plant design basis. There will be no changes to the BOP ESFAS surveillance and operating limits. 
 
The proposed changes will not adversely affect accident initiators or precursors nor alter the design assumptions, conditions, and configuration of the facility or the manner in which the plant is operated and maintaine
: d. The proposed changes will not alter or prevent the ability of structures, systems, and components (SSCs) from performing their intended functions to mitigate the consequences of an initiating event within the assumed acceptance limits.
 
The proposed changes do not affect the way in which safety-related systems perform their functions. 
 
All accident analysis acceptance criteria will continue to be met with the proposed Page 37 of 41 changes. The proposed changes will not affect the source term, containment isolation, or radiological release assumptions used in evaluating the radi ological consequences of an accident previously evaluated. The proposed changes will not alter any assumptions or change any mitigation actions in the radiological consequence evaluations in the FSAR. 
 
The applicable radiological dose acceptan ce criteria will continue to be met. 
 
Therefore, the proposed changes do not involve a signifi cant increase in the probability or consequences of an accident previously evaluated.
: 2. Does the proposed change create the po ssibility of a new or different kind of accident from any accident previously evaluated?
 
Response: No
 
There are no proposed changes in the method by which any safety-related plant SSC performs its safety function. The proposed changes will not affect the normal method of plant operation or change any operating parameters. No equipment performance requirements will be affected. The proposed changes will not alter any assumptions made in the safety analyses.
 
No new accident scenarios, transient precursors, failure mechanisms, or limiting single
 
failures will be introduced as a result of this amendment. Ther e will be no adverse effect or challenges imposed on any safety-related system as a result of this amendment.
The proposed amendment will not alter the design or performance of the 7300 Process  Protection System, Nuclear Instrumentation System, Solid State Protection System, BOP ESFAS, MSFIS, or LSELS used in the plant protection systems. 
 
Therefore, the proposed changes do not create the possibility of a new or different accident from any accident previously evaluated.
: 3. Does the proposed change involve a si gnificant reduction in a margin of safety?
 
Response: No
 
There will be no effect on those plant systems necessary to assure the accomplishment of protection functions. There will be no impact on the overpower limit, departure from nucleate boiling ratio (DNBR) limits , heat flux hot channel factor (F Q), nuclear enthalpy rise hot channel factor (FH), loss of coolant accident peak cladding temperature (LOCA PCT), peak local power density, or any other margin of safety. The applicable radiological dose consequence acceptance criteria will continue to be met.
 
The proposed changes do not eliminate any surveillances or alte r the frequency of surveillances required by the Technical Specifications. No instrument setpoints or Page 38 of 41 system response times are affected. None of the acceptance criteria for any accident analysis will be changed. 
 
The proposed changes will have no impact on the radiological consequences of a design
 
basis accident.
 
Therefore, the proposed change s do not involve a significant reduction in a margin of safety. Conclusion
:  Based on the above evaluation, AmerenUE concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.
 
===5.2 Applicable===
Regulatory Requirements / Criteria Section 182a of the Atomic Energy Act requires applicants for nuclear power plant operating licenses to include T echnical Specifications (TSs) as part of the license. The TSs ensure the operational capability of structures, systems, and components that are required to protect the health and safety of the public. The U.S. Nuclear Regulatory Commission's (NRC's) requirements related to the content of the TSs are contained in Section 50.36 of Title 10 of the Code of Federal Regulations (10 CFR 50.36) which requires that the TSs include items in the following specific categories: (1) safety limits,  limiting safety systems settings, and limiting control settings; (2) limiting conditions for  operation; (3) surveillance requirements per 10 CFR 50.36(c)(3); (4) de sign features; and  (5) administrative controls.
 
This amendment application is related to th e second category above (LCOs) and is a less restrictive change; however, the requested chan ge still affords an adequate assurance of safety when judged against applicable sta ndards. 10 CFR 50.36 al so requires that a licensee's TSs be derived from the analyses and evaluations included in the safety analysis report.
 
The regulatory requirements and guidance documents associated with this risk-informed amendment application include the guidance provided by Standard Review Plan (SRP) Chapter 16.1, "Risk-Informed Decisionmaking: Technical Specifications."  SRP Chapter 16.1 refers to RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," as an acceptable approach for assessing proposed risk-informed changes to TS allowed outage times. 
 
One acceptable approach for making risk-informed decisions about proposed TS changes, including both permanent and temporary TS changes, is to show that the proposed changes meet the five key principles stated in RG 1.177, Section B:
Page 39 of 41
: 1. The proposed change meets the current regu lations unless it is e xplicitly related to a requested exemption or rule change. 2. The proposed change is consistent with the defense-in-depth philosophy. 3. The proposed change maintains sufficient safety margins.
: 4. When proposed changes result in an increase in core-damage frequency (CDF) or risk, the increases should be small a nd consistent with the intent of the Commission's Safety Goal Policy Statement. 5. The impact of the proposed change should be monitored using performance measurement strategies.
 
The first three principles pertain to trad itional engineering considerations and are discussed in Section 3.0 of this Evaluation.
The last two principles involve risk considerations as discussed in Section 4.0 of this Evaluation. Another traditional engineering consideration that is listed in Sections II.A and III.A of SRP Chapter 16.1, and is addressed in Section 3.0 of this Evalua tion, is the need for and adequacy of the proposed change. References 1-3 provide guida nce on the attributes necessary to support regulatory findings associated with risk-informed applications.
 
Although not the direct subject matter of this requested amendment, the following regulatory requirements and guidance documents apply to th e BOP ESFAS logic cabinets and its input signals:
 
GDC 2 requires that structures, systems, and components important to safety be designed to withstand the effects of natural phenomena such as earthquakes,  tornadoes, hurricanes, floods, tsunami, and seiches without the loss of the capability to perform their safety functions.
GDC 4 requires that structures, systems, and components important to safety be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with the normal operation, maintenance, testing, and postulated accidents, including loss-of-coolant accidents. These  structures, systems, and components sha ll be appropriately protected against  dynamic effects, including the effects of missiles, pipe whipping, discharging fluids that may result from equipment failures, and from events and conditions outside the nuclear power unit. However, dynamic effects associated with postulated pipe ruptures in nuclear power units may be excluded from the design basis when analyses reviewed and approved by the Commission demonstrate that the probability of fluid system piping rupture is extremely low under conditions consistent with the design basis for the piping.
 
GDC 13 requires that instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission Page 40 of 41 process, the integrity of the reactor co re, the reactor coolant pressure boundary, and the containment and its associated systems.
GDC 20 requires that the protection system(s) shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as  a result of anticipated operational occurr ences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.
GDC 21 requires that the protection system(s) shall be designed for high functional reliability and testability.
GDC 22 through GDC 25 and GDC 29 require various design attributes for the protection system(s), including independence, safe failure modes, separation from control systems, requirements for reactivity control malfunctions, and protection against anticipated operational occurrences.
Regulatory Guide 1.22 discusses an acceptable method of satisfying GDC-20 and GDC-21 regarding the periodic testing of protection system actuation functions.
These periodic tests should duplicate, as closely as practicable, the performance that is required of the actuation devices in the event of an accident.
10 CFR 50.55a(h) requires that the protection systems meet IEEE 279-1971. Section 4.2 of IEEE 279-1971 discusses the general functional requirement for protection systems to assure they sa tisfy the single failure criterion. 
 
There are no changes being proposed in this amendment application such that commitments to the regulatory requirements and guidance documents above would come into question. The evaluations documented above confirm that Callaway Plant will continue to comply with all applicable regulatory requirements. 
 
In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the  Commission's regulations, and (3) issuance of the amendment will not be inimical to the 
 
common defense and security or to th e health and safety of the public.
 
==6.0 ENVIRONMENTAL CONSIDERATION==
 
AmerenUE has evaluated the proposed amendment and has determined that the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be  released offsite, or (iii) a significant increas e in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion Page 41 of 41 for categorical exclusion set fo rth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR  51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.
 
==7.0 REFERENCES==
: 1. NRC Regulatory Guide 1.174, Revision 1, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Deci sions on Plant-Specific Changes to the Licensing Basis," November 2002.
: 2. NRC Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Sp ecifications," August 1998."
: 3. NRC Regulatory Guide 1.200, Revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," January 2007. 
: 4. ULNRC-05612, "Licensee Event Report 2009-001-00, Technical Specification Required Shutdown Due To Loss of Power Supply," dated April 17, 2009.
: 5. Callaway License Amendment No. 165 dated January 31, 2005, "Callaway Plant, Unit 1 - Issuance of Amendment Re:  Plant Protection Test Times, Completion Times, and Surveillance Test Intervals (TAC NO. MC1756)."
: 6. Callaway License Amendment No. 64 dated October 9, 1991, "Amendment No.
64 to Facility Operating License No. NPF-30 (TAC NO. M79969)."
: 7. Callaway License Amendment No. 186 date d October 31, 2008, "Callaway Plant, Unit 1 - Issuance of Amendment Re: One-Time Extension of Completion Time for Essential Service Water System Piping Replacement (TAC No. MD7252," ADAMS Accession Number ML082810643.   
: 8. ULNRC-3232, "Response to Generic Lette r 88-20, Supplement No. 4, Individual Plant Examination of External Events (IPEEE)," dated June 30, 1995.
 
ATTACHMENT 2
 
MARKUP OF TECHNICAL SPECIFICATIONS ACTIONS (continued)
CONDITION I. One channel inoperable.
..... J." One Main Feedwater Pumps trip channel inoperable. No-rE----" -------CALLAWAY PLANT REQUIRED ACTION -------------------
NOTE -------------------
The inoperable channel may be bypassed for up to 12 hours for surveillance testing of other channels.
ESFAS Instrumentation
 
====3.3.2 COMPLETION====
 
TIME -------------------------------------------------
 
===1.1 Place===
channel in trip. 72 hours OR 1.2 Be in MODE 3. 78 hours -------------------
NOTE -------------------
The inoperable channel may be bypassed for up to 2 hours for surveillance testing of other channels.
-------------------------------------------------
J.1 Place channel in trip. ;;J!/-fAr. OR J.2 Be in MODE 3. hours (continued) 3.3-29 Amendment No. 165 INSERT 1 Separate Condition entry is restricted to one inoperable channel per pump in the same separation group.
ACTIONS (continued)
CONDITION M. Not used. N. One or more Containment N.1 Pressure -Environmental Allowance Modifier OR channel(s) inoperable.
N.2.1 AND N.2.2 O. One channel inoperable.
0.1 AND 0.2 CALLAWAY PLANT REQUIRED ACTION Place channel(s) in trip. Be in MODE 3. Be in MODE 4. Place channel in trip. Restore channel to OPERABLE status. 3.3-31 ESFAS Instrumentation
 
====3.3.2 COMPLETION====
 
TIME 72 hours 78 hours 84 hours 1 "'el:lf rs During performance of the next required COT (continued)
Amendment No. 168 ACTIONS (continued)
CONDITION P. One or more channel(s) inoperable.
Q One train inoperable.
.:2. R. One or both train(s) inoperable.
CALLAWAY PLANT REQUIRED ACTION P.1 Declare associated auxiliary feedwater pump(s) inoperable.
-------------------
NOT E -------------------
One train may be bypassed for up to 2 hours for surveillance testing provided the other train is OPERABLE.
ESFAS Instrumentation
 
====3.3.2 COMPLETION====
 
TIME Immediately
::;,:----------------------------------------------
:30 .... -e.-:+{}.=J./
Be in MODE 3. -&hours ANrH-/ Q.2. ':2 Be in MODE 4. " R.1 Restore train(s) to 48 hours OPERABLE status. OR R.2.1 Be in MODE 3. 54 hours AND R.2.2 Be in MODE 4. 60 hours (continued) 3.3-32 Amendment No. 165 INSERT 2 REQUIRED ACTION COMPLETION TIME Q.1 Restore train to OPERABLE 24 hours status. OR FUNCTION 6. Auxiliary Feedwater
: a. Manual Initiation
: b. Automatic Actuation Logic and Actuation Relays (SSPS) Table 3.3.2-1 (page 7 of 9) ESFAS Instrumentation
 
====3.3.2 Engineered====
 
Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED REQUIRED SURVEILLANCE ALLOWABLE CONDITIONS CHANNELS CONDITIONS REQUIREMENTS VALUE(a) 1,2,3 1/pump P SR 3.3.2.8 NA 1,2,3 2 trains G SR 3.3.2.2 NA SR 3.3.2.4 SR 3.3.2.6 ] [, Automatic 1,2,3 2 trains Q SR 3.3.2.3 NA Actuation Logic and Actuation Relays (BOP ESFAS) d. SG Water Level Low-Low (1) Steam. 1,2,3 4 per SG D SR 3.3.2.1 ;?: 20.6%(5) of Generator SR 3.3.2.5 Narrow Range Water Level SR 3.3.2.9 Instrument Low-Low SR 3.3.2.10 Span (Adverse Containment Environment)
(2) Steam 1 (r), 2(r), 3(r) 4 per SG D SR 3.3.2.1 ;?: 16.6%(5) of Generator SR 3.3.2.5 Narrow Range Water Level SR 3.3.2.9 Instrument Low-Low SR 3.3.2.10 Span (Normal Containment Environment) (a) The Allowable Value defines the limiting safety system setting except for Functions 1.e, 4.e.(1), 5.c, 5.e.(1), 5.e.(2), 6.d.(1), and 6.d.(2) (the Nominal Trip Setpoint defines the limiting safety system setting for these Functions).
See the Bases for the Nominal Trip Setpoints. (r) Except when the Containment Pressure -Environmental Allowance Modifier channels in the same protection sets are tripped. (s) 1. If the as-found instrument channel setpoint is conservative with respect to the Allowable Value, but outside its as-found test acceptance criteria band, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service. If the as-found instrument channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable.
: 2. The instrument channel setpoint shall be reset to a value that is within the as-left setpoint tolerance band on either side of the Nominal Trip Setpoint, or to a value that is more conservative than the Nominal Trip Setpoint; otherwise, the channel shall be declared inoperable.
The Nominal Trip Setpoints and the methodology used to determine the as-found test acceptance criteria band and the as-left setpoint tolerance band shall be specified in the Bases. CALLAWAY PLANT 3.3-44 Amendment No. 189 
: 6. (a) (k) (I) (n) FUNCTION Auxiliary Feedwater
: d. SG Water Level Low-Low (3) Not used. (4) Containment Pressure -Environmental Allowance Modifier e. Safety Injection
: f. Loss of Offsite Power g. Trip of all Main Feedwater Pumps h. Auxiliary Feedwater Pump Suction Transfer on Suction Pressure -Low Table 3.3.2-1 (page 8 of 9) ESFAS Instrumentation
 
====3.3.2 Engineered====
 
Safety Feature Actuation System Instrumentation APPLICABLE MODES OR OTHER SPECIFIED CONDITIONS 1,2,3 REQUIRED CHANNELS 4 SURVEILLANCE CONDITIONS REQUIREMENTS N SR 3.3.2.1 SR 3.3.2.5 SR 3.3.2.9 SR3.3.2.10 ALLOWABLE VALUE(a) ::; 2.0 psig Refer to Function 1 (Safety Injection) for all initiation functions and requirements.
1,2,3 2 trains R SR 3.3.2.7 NA SR 3.3.2.10 1,2(n) 2 per pump J SR 3.3.2.8 NA 1,2,3 3 0 SR 3.3.2.1 2: 20.64 psia SR 3.3.2.9 SR 3.3.2.10 SR 3.3.2.12 The Allowable Value defines the limiting safety system setting except for Functions i.e, 4.e.(1), 5.c, 5.e.(1), 5.e.(2), 6.d.(1), and 6.d.(2) (the Nominal Trip Setpoint defines the limiting safety system setting for these Functions).
See the Bases for the Nominal Trip Setpoints.
Not used. Not used. Trip function may be blocked just before shutdown of the last operating main feedwater pump and restored just after the first main feedwater pump is put into service following performance of its startup trip test. CALLAWAY PLANT 3.3-45 Amendment No. 189 ATTACHMENT 3
 
RETYPED TECHNICAL SPECIFICATIONS
 
ACTIONS (continued)
CONDITION I. One channel inoperable.
J. -------------
NOT E -------------
Separate Condition entry is restricted to one inoperable channel per pump in the same separation group. -----------------------------------
One Main Feedwater Pumps trip channel inoperable.
CALLAWAY PLANT REQUIRED ACTION -------------------
NOTE -------------------
The inoperable channel may be bypassed for up to 12 hours for surveillance testing of other channels.
ESFAS Instrumentation
 
====3.3.2 COMPLETION====
 
TIME -------------------------------------------------
 
===1.1 Place===
channel in trip. 72 hours OR 1.2 Be in MODE 3. 78 hours -------------------
NOTE -------------------
The inoperable channel may be bypassed for up to 2 hours for surveillance testing of other channels.
-------------------------------------------------
J.1 Place channel in trip. 24 hours OR J.2 Be in MODE 3. 30 hours (continued) 3.3-29 Amendment No. ###
ACTIONS (continued)
CONDITION M. Not used. N. One or more Containment N.1 Pressure -Environmental Allowance Modifier OR channel(s) inoperable.
N.2.1 AND N.2.2 O. One channel inoperable.
0.1 AND 0.2 CALLAWAY PLANT REQUIRED ACTION Place channel(s) in trip. Be in MODE 3. Be in MODE 4. Place channel in trip. Restore channel to OPERABLE status. 3.3-31 ESFAS Instrumentation
 
====3.3.2 COMPLETION====
 
TIME 72 hours 78 hours 84 hours 24 hours During performance of the next required COT (contmued)
Amendment No. ###
ACTIONS (continued)
CONDITION P. One or more channel(s) inoperable.
Q One train inoperable.
R. One or both train(s) -inoperable.
CALLAWAY PLANT REQUIRED ACTION P.1 Declare associated auxiliary feedwater pump(s) inoperable.
-------------------
NOT E -------------------
One train may be bypassed for up to 2 hours for sUNeillance testing provided the other train is OPERABLE.
-------------------------------------------------
Q.1 Restore train to OPERABLE status. OR Q.2.1 Be in MODE 3. AND Q.2.2 Be in MODE 4. R.1 Restore train(s) to OPERABLE status. OR R.2.1 Be in MODE 3. AND R.2.2 Be in MODE 4. 3.3-32 ESFAS Instrumentation
 
====3.3.2 COMPLETION====
 
TIME Immediately 24 hours 30 hours 36 hours 48 hours 54 hours 60 hours (continued)
Amendment No. ###
ATTACHMENT 4
 
PROPOSED TECHNICAL SPEC IFICATION BASES CHANGES (for information only)
BASES APPLICABLE SAFETY ANALYSES, LCO, AND APPLICABILITY CALLAWAY PLANT d. ESFAS Instrumentation B 3.3.2 Auxiliary Feedwater
-Steam Generator Water Level -Low Low (continued) (Normal) trip setpoint when these conditions are not present, thus allowing more margin to trip for normal operating conditions.
If the EAM trip function has inoperable required channels, it is acceptable to place the inoperable channels in the tripped condition and continue operation.
Placing the inoperable channels in the trip mode enables the Steam Generator Water Level -Low Low (Adverse)
Function, for the EAM. If the Steam Generator Water Level -Low Low (Normal) trip Function has an inoperable required channel, the inoperable channel must be tripped, subject to the LCO Applicability footnote.
The Trip Setpoint reflects the inclusion of both steady state and adverse environment instrument uncertainties.
The Trip Setpoints for the SG Water Level -Low Low (Adverse Containment Environment) and (Normal Containment Environment) bistables are 21.0% and 17.0% of narrow range span, respectively.
The Trip Setpoint for the Containment Pressure -Environmental Allowance Modifier bistables is :.::; 1.5 psig. e. Auxiliary Feedwater
-Safety Injection An SI signal starts the motor driven AFW pumps. The AFW initiation functions are the same as the requirements for their SI function. Therefore, the requirements are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is referenced for all initiating functions and requirements.
: f. Auxiliary Feedwater
-Loss of Offsite Power The loss of offsite power (LOP) is detected by a voltage drop on each ESF bus. The LOP is sensed and processed by the circuitry for LOP DG Start (Load Shedder and Emergency Load Sequencer) and fed to BOP ESFAS by relay actuation.
Loss of power to either ESF bus will start (continued)
B 3.3.2-32 Revision 8 BASES APPLICABLE SAFETY ANALYSES, LCO, AND APPLICABILITY CALLAWAY PLANT f. ESFAS Instrumentation B 3.3.2 Auxiliary Feedwater
-Loss of Offsite Power (continued) the turbine -riven AFW pump, to at 6, ,e contai enough water to serve as the heat sink for reactor decay heat and sensible heat removal following the reactor trip, and automatically isolate the SG blowdown and sample lines. In addition, once the diesel generators are started and up to speed, the motor -driven AFW pumps will be sequentially loaded onto the diesel generator buses. Functions 6.a through 6.f must be OPERABLE in MODES 1, 2, and 3 to ensure that the SGs remain the heat sink for the reactor. SG Water Level -Low Low in any operating SG will cause the motor -driven AFW pumps to start. The system is aligned so that upon a start of the pump, water immediately begins to flow to the SGs. SG Water Level -Low Low in any two operating SGs will cause the turbine -driven pump to start. The SG Water Level -Low Low (Normal Containment Environment) channels do not provide protection when the Containment Pressure -Environmental Allowance Modifier (EAM) channels in the same protection sets are tripped since that enables the SG Water Level -Low Low (Adverse Containment Environment) channels with a higher water level trip setpoint.
As such, the SG Water Level -Low Low (Normal Containment Environment) channels need not be OPERABLE when the Containment Pressure -EAM channels in the same protection sets are tripped, as discussed in a footnote to Table 3.3.2-1. These Functions do not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW actuation does not need to be OPERABLE because either AFW or residual heat removal (RHR) will be available to remove decay heat or sufficient time is available to manually place either system in operation. (continued)
B 3.3.2-33 Revision 8 BASES APPLICABLE SAFETY ANALYSES, LCO, AND APPLICABILITY CALLAWAY PLANT 6. Auxiliary Feedwater (continued)
ESFAS Instrumentation B 3.3.2 g. Auxiliary Feedwater
-Trip of All Main Feedwater Pumps A Trip of all MFW pumps is an indication of a loss of MFW and the subsequent need for some method of decay heat and sensible heat removal to bring the reactor back to no load temperature and pressure.
Each turbine driven MFW pump is equipped with two pressure switches (one in separation group 1 and one in separation group
: 4) on the oil line for the speed control system. A low pressure signal from either of these pressure switches indicates a trip of that pump. Two OPERABLE channels per pump satisfy redundancy requirements with one-out-of-two logi n both pumps required for signal actuation.
A trip of all W pumps starts the motor driven AFW pumps to e sure that .....
IIPvailable with water to act the heat sink for the react r. f" f/..e same are.
dHJo/ E in MODES 1 and 2. This with water to serve as the heat sink to remove reactor decay heat and sensible heat in the event of an accident.
In MODES 3, 4, and 5, the MFW pumps may be normally shut down, and thus pump trip is not indicative of a condition requiring automatic AFW initiation.
Note (n) of Table 3.3.2-1 allows the blocking of this trip function just before shutdown of the last operating main feedwater pump and the restoration of this trip function just after the first main feedwater pump is put into service following its startup trip test. This limits the potential for inadvertent AFW actuations during normal startups and shutdowns.
: h. Auxiliarv Feedwater
-Pump Suction Transfer on Suction Pressure -Low A low pressure signal in the AFW pump suction line protects the AFW pumps against a loss of the normal supply of water for the pumps, the CST. Three pressure switches are located on the AFW pump suction line from the CST. A low pressure signal sensed by any two of the (continued)
B 3.3.2-34 Revision 8 BASES APPLICABLE SAFETY ANALYSES, LCO, AND APPLICABILITY CALLAWAY PLANT h. ESFAS Instrumentation B 3.3.2 Auxiliary Feedwater
-Pump Suction Transfer on Suction Pressure -Low (continued) three switches coincident with an auxiliary feedwater actuation signal will cause the emergency supply of water for the pumps to be aligned. ESW (safety grade) is automatically lined up to supply the AFW pumps to ensure an adequate supply of water for the AFW System to maintai as the heat sink for reactor ecay heat and sensible heat removal.
Since the detectors are located in an area not affected by HELBs or high radiation, they will not experience any adverse environmental conditions and the Trip Setpoint reflects only steady state instrument uncertainties.
The Trip Setpoint is 21.71 psia. This Function must be OPERABLE in MODES 1, 2, and 3 to ensure a safety grade supply of water for the AFW System to maintain the SGs as the heat sink for the reactor. This Function does not have to be OPERABLE in MODES 5 and 6 because there is not enough heat being generated in the reactor to require the SGs as a heat sink. In MODE 4, AFW automatic suction transfer does not need to be OPERABLE because RHR will already be in operation, or sufficient time is available to place RHR in operation, to remove decay heat. 7. Automatic Switchover to Containment Sump At the end of the injection phase of a LOCA, the RWST will be nearly empty. Continued cooling must be provided by the ECCS to remove decay heat. The source of water for the RHR pumps is automatically switched to the containment recirculation sumps. The low head residual heat removal (RHR) pumps and containment spray pumps draw the water from the containment recirculation sumps, the RHR pumps pump the water through the RHR heat exchanger, inject the water back into the RCS, and supply the cooled water to the other ECCS pumps. Switchover from the RWST to the containment sumps must occur before the RWST empties to prevent damage to the RHR pumps and a loss of core cooling capability.
For similar reasons, switchover must not occur before there is sufficient water in the containment sumps to support ESF pump suction. (continued)
B 3.3.2-35 Revision 8 BASES ACTIONS CALLAWAY PLANT 1.1 and 1.2 (continued)
ESFAS Instrumentation B 3.3.2 The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 12 hours for surveillance testing of other channels.
The 72 hours allowed to place the inoperable channel in the tripped condition, and the 12 hours allowed for an inoperable channel to be in the bypassed condition for testing, are justified in Reference
: 18. J.1 and J.2 Condition J applies to the AFW pump start on trip of all MFW pumps. This action addresses the train orientation of the BOP ESFAS for the auto start function of the AFW System on loss of all MFW pumps. The OPERABILITY of the AFW System must be assured by providing automatic start of the AFW System pumps. If a channel is inoperable,;;)f4-AotlY:S ttY"*.. 1 is allowed to place it in the tripped condition.
If the channel cannot be tripped inti 6 additional hours are allowed to lace the unit in MODE 3. The allowed Completion Time 0 ours is reasonable, based 30 on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems. In MODE 3, the unit does not have any analyzed transients or conditions that require the are modified by a Note that allows the inoperable annel to be bypassed for up to 2 hours for surveillance testing of other c annels. explicit use of the protection function noted abovetThe Required Actions ::LNS'EK/3.
'3.::l,T K.1, K,2.1, and K.2.2 Condition K applies to: RWST Level -Low Low Coincident with Safety Injection.
RWST Level -Low Low Coincident With SI provides actuation of switchover to the containment recirculation sumps. Note that this Function requires the bistables to energize to perform their required action. The failure of up to two channels will not prevent the operation of this Function.
This Action Statement limits the duration that an RWST level channel could be inoperable in the tripped condition in order to limit the probability for automatic switchover to an empty containment sump upon receipt of an inadvertent safety injection signal (SIS), coincident with a single failure of another RWST level channel, or for premature switchover to the sump after a valid SIS. This sequence of events would start the RHR pumps, open the containment sump RHR suction valves (continued)
B 3.3.2-50 Revision 8 INSERT 3.3.2.J Condition J is modified by a Note that restricts the application of the ACTIONS Note allowing separation Condition entry. Since the Required Channels for Function 6.g are specified in Table 3.3.2-1 as 2 per pump, Condition J may be entered separately for each main feedwater pump. However, as shown on FSAR Figure 7.3-1, sheet 2 (Ref. 2), satisfying the trip logic requires the presence of a low oil pressure signal in the same separation group on each main feedwater pump. An inoperable separation group 1 channel on one pump coincident with an inoperable separation group 4 channel on the other pump would lead to the loss of this actuation function requiring entry into LCO 3.0.3. This Note represents an additional requirement associated with the Completion Time increase approved for Condition J in Reference
: 23.
BASES ACTIONS (continued)
CALLAWAY PLANT N.1. N.2.1. and N.2.2 ESFAS Instrumentation B 3.3.2 Condition N applies to the Environmental Allowance Modifier (EAM) circuitry for the SG Water Level -Low Low trip Functions in MODES 1,2, and 3. With one or more EAM channel(s) inoperable, they must be placed in the tripped condition within 72 hours. Placing an EAM channel in trip automatically enables the SG Water Level -Low Low (Adverse Containment Environment) bistable for that protection channel, with its higher SG level Trip Setpoint (a higher trip setpoint means a feedwater isolation or an AFW actuation would occur sooner). The Completion TIme of 72 hours is based on Reference
: 18. If the inoperable channel cannot be placed in the tripped condition within the specified Completion TIme, the unit must be placed in a MODE where this Function is not required to be OPERABLE.
The unit must be placed in MODE 3 within an additional six hours and in MODE 4 within the following six hours. 0.1 and 0.2 Condition 0 applies to the Auxiliary Feedwater Pump Suction Transfer on Suction Pressure -Low trip Function.
The Condensate Storage Tank is the highly reliable and preferred suction source for the AFW pumps. This function has a two-out-of-three trip logic. Therefore, continued operation is allowed with one inoperable channel until the performance of the next monthly COT on one of the other channels, as long as the inoperable channel is placed in trip within -4 R9l:lF. ::J.4-hOUrs .. Condition P applies to the Auxiliary Feedwater Manual Initiation trip Function.
The associated auxiliary feedwater pump(s) must be declared inoperable immediately when one or more channel(s) is inoperable.
Refer to LCO 3.7.5, "Auxiliary Feedwater (AFW) System." Condition Q applies to the Auxiliary Feedwater Balance of Plant ESFAS automatic actuation logic and actuation the unit must be brought to MODE 3 and MODE 4 within tRs f911eovil
'E6. ours. The Required Action are modified by a Note that allows one tr to be bypassed for up to 2 ours for surveillance testing provided the ther train is OPERABLE.
30 3t (continued)
B 3.3.2-52 Revision 8 INSERT 3.3.2.0 If one train is inoperable, 24 hours are allowed to restore the train to OPERABLE status. The 24 hours allowed for restoring the inoperable train to OPERABLE status is justified in Reference
: 23. The specified Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this interval.
If the inoperable train cannot be restored to OPERABLE status within 24 hours, BASES REFERENCES (continued)
CALLAWAY PLANT 17. ESFAS Instrumentation B 3.3.2 Letter from Mel Gray (NRC) to Garry L. Randolph (UE), "Revision 20 of the Inservice Testing Program for Callaway Plant, Unit 1 (TAC No. MA4469)," dated March 19, 1999. 18. WCAP-14333-P-A, Revision 1, "Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times," October 1998. 19. WCAP-15376-P-A, Revision 1, "Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times," March 2003. 20. Westinghouse letter SCP-04-90 dated August 27,2004. 21. ULNRC-03748 dated February 27, 1998. 22. IDP-ZZ-00017 . .23.
/lh.enime;rl-XXX tkI-el I B 3.3.2-63 Revision 8 ATTACHMENT 5
 
CALLAWAY BOP ESFAS DRAWINGS 8
RESET ACT MOTOIt llRIVEN "U1UL.I"III.," F!.lDWATU PUMP 8 5"" CCoTII:'T3Z.)
I 7
* _ .--... J 6 CONT .... IN Me:N"T PURG.E I SOLATION __ CHP-B1-lcre
____ SFME' MAN. COTR,T2.2.
MOTOR I>RIVEN AUIfILIAIt1 FEEDWA.lf1l.
PUMP (A FA!) Il[ CIS'" I CISA. (6TRT31) &TIi:T33 N Il[ Il[ AC" '" ReSET :nr I I I 150LAliON
___ 7 "U)([LIARY FEEDWAH.R Of'EN STEM1 SUPPLY yALVU 'Ttl STAIt:T TLlR8IN! llRI'YfN AUX I"EfDWAT1!It-P'Uh'lP (AFAS) n . I AL.PT37 I 6 (CItVIS) I OI"EN Al/X PEEDWKrEIt fuMP SUCTION 'VALV!:S TO EsW (LSP) N 5 B1'P1iS5 elSA RESET SYI'AS5 I SAJTI I STEAM GEN. 8LOW'POWN
* SAMPLE ISOL"'T'ON (sus's) I 5 CONTROL ROOM B.Yf'ASS II:'fSf.T 6Yf'ASS I 4 VENTlL.A.TION MANUAl. ACT\fATION I lRIr' RESET RooM ACT,(I)
* T 3 ISOLATION CONTROL ROOM VENTILATION lS0LATlON (CRVIS) :rr FU1;"L. BUIU>IN; VENTILATION ISOL. .... TION FUEL I!UILDlh1G
":et(I) T GiG.RT:l.7(1)
FUEL !UILbING.
ISOLATiON(FBVIS)
APPUC.<TION FUEl. !UILPING ACT.l&#xa3; T <<''I' .... -" ACT-Ill
* NOTes: I. KEY TO SYMSOLS:
-<!> TEST INP\JT --0 TRIP SIGNAL ISOLATiON
--@ AMBER LAM" ----0 -0
\. --tJ--'AND' LOCSIC. j)--'OR' L06)C OUT OF L061C. r:-r!l R/s MEMORY WITt!.
RESET ---INVERoSlON 30X 1CALLAWAY PLANT RISK-INFORMED AMENDMENT REQUEST24-HOUR BOP ESFAS COMPLETION TIME ATTACHMENT 6
 
OPEN SIGNIFICANCE A AND B PEER REVIEW FINDINGS Page 1 of 1 TABLE 1  WOG PEER REVIEW LEVEL A AND B FACTS AND OBSERVATIONS F&O Significance Status F&O Description Comments / BOP ESFAS Disposition      TH-3 B Open Consider preparing success criteria guidance for the PRA, to address such items as overall success criteria definition process, development of success criteria for systems, etc. This is a documentation issue. No issues were identified with the actual success criteria utilized. Therefore, this F&O would not impact the results of the PRA evaluation for the BOP ESFAS completion time extension. L2-1 A Open Address containment isolation failure and internal floods in the LERF calculation. An undetected, residual failure to the containment would result in a small increase in the baseline LERF. However, this increase would be reflected in both the baseline LERF and the Conditional LERF given one BOP ESFAS train out-of-service. There would be a negligible impact on the delta risk. Flooding was addressed explicitly in the PRA evaluation for the BOP ESFAS completion time extension. Therefore, this F&O would have a minimal impact on the results of the PRA evaluation for the BOP ESFAS completion time extension. L2-3 B Open The calculation of LERF is based on containment event tree split fractions. The process simply multiplies the split fractions together, resulting in an overall LERF split fraction for each plant damage state (PDS). It is not obvious how the split fractions are related back to elementary phenomena or system failures. The Callaway process of using split fractions to partition a PDS to a LERF status is similar to the process used in NUREG/CR-6595. The split fractions are not generally subjected to change due to system failures. Any systems that were credited in accident mitigation (e.g., sprays or containment coolers) were explicitly modeled, not developed as split fractions. Elementary phenomena (such as direct containment heating due to corium dispersal that is dependent on a plant's cavity design) do not usually change, and thus split fractions do not change. Containment isolation failure is not subject to split fractions. Therefore, this F&O would not impact the results of the PRA evaluation for the BOP ESFAS completion time extension.
 
Page 1 of 9 TABLE 2  SCIENTECH GAP ANALYSIS LEVEL B FINDINGS/OBSERVATIONS F/O Significance Status F/O Description Comments / BOP ESFAS Disposition AS-1 B Open Event Tree T(SW), function L2SW-M should evaluate the TDAFW pump with no functioning SW/ESW equipment. The cutsets for this function include failures of the ESW pumps and human action failures for alignment of SW/ESW. Since the initiator fails all SW/ESW, the logic should not include these events. A similar situation exists for function L2T1s. Event Tree T(SW) function O1SW-M includes a FANDB operator error which does not belong in the function. A similar situation exists for functions O1C-M, O1CT1-M, and
 
O1SW-M. Correction of these functions, which also addresses similar issues in F/Os AS-3, AS-7, SY-1, QU-3, and QU-4, would result in a small increase in the total baseline CDF (approx. 1%) for the Callaway PRA. The current model without the corrections will have a very small, conservative impact on the CCDF for the PRA evaluation for the BOP ESFAS completion time extension due to the incorrect ESW dependency and the associated BOP ESFAS actuation dependency. Therefore, these F/Os would have a minimal impact on the results of the PRA evaluation for the BOP ESFAS completion time extension.
Page 2 of 9 AS-2 B Open Transfers between event trees may be used to reduce the size and complexity of individual event trees. DEFINE any transfers that are used and the method that is used to implement them in the qualitative definition of accident sequences and in their quantification. USE a method for implementing an event tree transfer that preserves the dependencies that are part of the transferred sequence. These include functional, system, initiating event, operator, and spatial or environmental dependencies. This requirement is not met. Many transfers such as seal LOCA and stuck open PORV transfer to a "psuedo event tree". These transfers are quantified using an OCL file that does not have a specific event tree.
This introduces possibilities for error in the quantification since there is no event tree on which to base the evaluated functions, especially those that require preservation of dependencies. The actual event tree for quantification of the RCP seal LOCA events was not found. An event tree Trcp appears to have been used, but this event tree has an event for recovery of CCW, which is not included in the .OCL files for the RCP seal LOCA events. This is a documentation issue. The transfer sequences have been extensively reviewed and no issues have been identified. Therefore, this F/O would not impact the results of the PRA evaluation for the BOP ESFAS completion time extension. AS-3 B Open The method of event tree analysis for support system initiators does not appear to correctly capture the failed dependencies in the mitigating systems for some support system IE's. A single basic event is used for the initiating event. House events are included in the fault trees to turn off the affected trains when a support system is not available. It is not clear there are sufficient support systems modeled in the main feedwater and non-safety service water to fail these systems when their support systems are unavailable. This may occur in Tsw, Tnk01, and Tnk04. The cutsets for Tsw, Tnk01, Tnk04, and Tccw should be checked to search for systems that would be failed by the loss of the initiator, and then modify the fault trees to include the appropriate house events to disable these systems. Reviews of the support system initiators reveal that this F/O actually only pertains to T(SW). This issue was addressed in the response to F/O AS-1 above.
Page 3 of 9 AS-4 B Open The RCP seal LOCA model needs to be updated to reflect the latest WOG model, which is approved by the NRC. The current Callaway PRA model utilizes the RCP seal LOCA model of WCAP-10541, in which the 21 gpm/pump seal LOCA has a probability of occurrence of approximately 90%. The WOG-2000 RCP seal LOCA model (documented in WCAP-15603), uses a probability of approximately 80% for the 21 gpm/pump seal LOCA. A sensitivity analysis was performed to address this source of uncertainty related to RCP seal LOCA. The associated core uncovery probabilities, follo wing loss of RCP seal cooling, were increased by 25 percent to approximate the impact of the WOG-2000 RCP seal failure probabilities, and resulted in an insignificant increase of approximately 1.5% in CDF. However, this increase would be reflected in both the baseline CDF and the Conditional CDF given one BOP ESFAS train out-of-service. There would be a negligible impact on the delta risk. Therefore, this F/O would have a minimal impact on the results of the PRA evaluation for the BOP ESFAS completion time extension. AS-6 B Open The MAAP results indicate there are 60 hours before core melt for the SGTR sequence with failure to isolate the SG. If the MAAP analysis is correct, then the sequence should be screened. If the MAAP analysis is not correct, or MAAP 3 can not provide a correct representation of the sequence, MAAP 4 should be used. Elimination of these sequences would result in a small reduction in the total baseline CDF results (approx. 1%). Retaining these sequences in the results is slightly conserva tive. Therefore, this F/O would have a minimal impact on the results of the PRA evaluation for the BOP ESFAS completion time extension.
Page 4 of 9 AS-7 B Open Specific errors are as noted below:  Function O1T1S in the SBO event tree contains basic events for MFW and SW as a backup source for water to SGs if the TDP fails. The problem occurs in the SECDEP fault tree, which asks for GMFX100, but does not have any logic to cancel the gate in SBO. There are no events in the MFX fault tree which will cancel it in the event of an SBO, either. Also, in MFW.lgc, gate GMFW413 - the SVC system will be failed by LOSP, but comes through the link in the SBO function. Back-up sources of water to the SG are modeled at a high level, often only represented by an HEP. There needs to be either a) support systems developed which will be failed by LOSP or AC power, or b) house event logic to fail these for SBO. The AFW function on the TSW event tree -
(L2SW-M) - has recovery factors for ESW as a suction source to the turbine driven AFW pump. (AL-XHE-FO-AFWESW). ESW is failed by the initiator, but the IE is a basic event, not cutsets. Need to represent the initiator as a support system fault tree, OR need to include house events in the AFW function to fail the cross-tie to the ESW system after a Loss of ESW. In TSW event tree, function O1SW-M has an event (AE-XHE-FO-MFWFLO) for failure of MFW as back up to AFW. MFW is unavailable after loss of SW. Need to include support systems for MFW or insert house events in fault tree to turn off MFW for loss of TSW. This issue was addressed in the response to F/O AS-1 above.
Page 5 of 9 SY-1 B Open For the Instrument Air System (IAS) a single basic event is used and is based on generic data. The Callaway plant is not highly dependent upon IAS and the PRA loads on IAS also are supplied with N2 backup which is modeled. Modeling the IAS as a single basic is acceptable however, the MFW dependency on the IAS is not modeled and needs to be included since MFW is credited as a backup to AFW and is important. The actuation system is modeled with a single event for each of the redundancies which is set to fail for scenarios in which the conditions are not present to generate the signal. The level of detail is acceptable for this use. The dependency of MFW on IAS needs to be included and the data associated with these single event failures need to be reviewed against current industry data and updated if necessary. The applicability of the data to the Callaway configuration also needs to be justified. One such source of data is
 
NUREG/CR-5750. The IAS consists of three compressors, two of which are cooled by ESW and one that is cooled by normal service water (NSW). Parts of the MFW system and the condensate system are dependent on IAS.
MFW and IAS are part of the modeled PRA function to cooldown and depressurize the RCS. This action occurs with successful secondary side cooling but failed primary high head injection for events with a primary leak. This dependency between ESW/NSW, IAS, and MFW has an insignificant effect on the PRA results, except for the T(SW) event. For this event, this issue was addressed in the response to F/O AS-1 above. Note that safety-related components using instrument air also have safety-related nitrogen accumulators to support their
 
operation. SY-2 B Open The Callaway PRA adequately models CCFs with the exception of battery chargers and breakers as noted in supporting requirement (SR) SY-B1 and B3. The quantification of all CCFs should be updated. CCFs should be added for Battery Chargers and Breakers. The quantification of the CCFs should be done in accordance with NUREG/CR-5485. The Battery Charger basic events are not risk significant in the Callaway PRA model. A Battery Charger CCF basic event is not expected to be risk significant. Many of the breaker basic events are risk significant, so a breaker CCF basic event would also be expected to be risk significant and would probably slightly increase the baseline total CDF. However, because one train of BOP ESFAS is assumed to be out of service for the PRA evaluation for the BOP ESFAS completion time extension, CCF of the breakers between trains actuated by BOP ESFAS would not exist in the cutset solution. Therefore, this F/O should not impact the results of the PRA evaluation for the BOP ESFAS completion time extension.
Page 6 of 9 DA-2 B Open Group estimations are based only on component type. Capability Category II requires grouping of components according to type (e.g., motor-operated pump, air-operated valve) and according to the characteristics of their usage to the extent supported by data:  (a)  mission type (e.g., standby, operating)  (b)  service condition (e.g., clean vs. untreated water, air)  The level of grouping used in the latest data update uses a very fine grouping which leads to a smaller data pool for each different component. Consideration should be given to collecting data on as large a group of components as possible to establish a meaningful collection of data. Grouping of the components as defined in SR DA-B1 and DA-B2 provides a more reasonable aggregation of data and results in a larger data pool to characterize the failure data. A more recent data update, performed to the ASME standard, grouped pumps and valves by component type, service conditions, etc. The resulting groupings had populations that were similar to the groupings that are the subject of this F/O. Therefore, this F/O would not impact the results of the PRA evaluation for the BOP ESFAS completion time extension. IF-2 B Open This requirement is not met at any Category. The Category I/II screening quantitative criterion in the standard is 1E-09/year. AmerenUE Calculation ZZ-466 screening criterion was 1E-06/yr. Flooding was addressed explicitly in the PRA evaluation for the BOP ESFAS completion time extension. IF-4 B Open If additional human failure events are required to support quantification of flood scenarios, PERFORM any human reliability analysis in accordance with the applicable requirements described in Tables 4.5.5-2(e) through Table 4.5.5-2(h). This requirement is not met. The HEP values used in ZZ-466 are not developed from a human reliability analysis. Flooding was addressed explicitly in the PRA evaluation for the BOP ESFAS completion time extension. IF-5 B Open For each defined flood area and each flood source, IDENTIFY those automatic or operator responses that have the ability to terminate or contain the flood propagation. This requirement is not met. ZZ-466 treats operator response in a generic sense. Flooding was addressed explicitly in the PRA evaluation for the BOP ESFAS completion time extension.
Page 7 of 9 IF-6 B Open For each flood scenario, REVIEW the LERF analysis to confirm applicability of the LERF sequences. If appropriate LERF sequences do not exist, MODIFY the LERF analysis as necessary to account for any unique flood-induced scenarios or phenomena in accordance with the applicable requirements described in paragraph 4.5.9. This requirement is not met. The internal flooding sequences are not considered in the LERF analysis. Flooding was addressed explicitly in the PRA evaluation for the BOP ESFAS completion time extension.
QU-1 B Open The current quantification does not include an uncertainty calculation to account for the "state-of-knowledge" correlation betw een event probabilities. The structure exists to perform this correlation within WinNUPRA but at the current time it has not been done. The "state-of-knowledge" correlation generally pertains to the data applied to equipment across trains. For example, an SBO cutset may contain the failure of the "A" and "B" EDGs. The failure data for both EDGs most likely is based on the same source of information. Therefore, any uncertainty analysis should vary the failure data for these components in the same manner (i.e., the data is not independent). For the BOP ESFAS completion time extension, one train of BOP ESFAS will be out of service. Except in some minor circumstances (e.g., cutsets in which multiple breakers, in the same train, fail), the "state-of-knowledge" correlation does not apply.
Therefore, this F/O should not impact the results of the PRA evaluation for the BOP ESFAS completion time extension.
QU-3 B Open Some instances of incorrect transfer of sequence characteristics, incorrect logic, incorrect house event settings, and resultant cutsets were identified based on cutset reviews. The process is generally set up correctly but the overall process would benefit from revising the quantification process to account for the additional software capability currently available. As a minimum, the top cutsets (500) need to be reviewed to make sure that the transfers, logic, house event setting are yielding realistic combinations. This issue was addressed in the response to F/O AS-1 above.
Page 8 of 9 QU-4 B Open The IAS is correctly failed for LOSP, but remains available in all other cases. The IAS is cooled by SW and would be unavailable after loss of all SW (T(SW)) and should be set to failed via a house event setting.
The availability of IAS needs to be propagated correctly during the quantification process. This issue was addressed in the response to F/O AS-1 above.
QU-9 B Open In general the model integration process is adequately documented, however several of the areas do not meet the requirements. Items b (records of the cutset review process), f (the accident sequences and their contributing cutsets), g (equipment or human actions that are the key factors in causing the accidents to be non-dominant), and i (the uncertainty distribution for the total CDF) are not addressed in the documentation. As a minimum, these items need to be addressed to meet SR QU-F2. If the quantification process and documentation are revised the list of information included in SR QU-F2 should be followed in the revision. This is a documentation issue. For the PRA evaluation for the BOP ESFAS completion time extension application, accident sequences and cutsets were reviewed.
QU-10 B Open Key assumptions and key sources of uncertainty which influence the current quantification are not addressed in a coherent manner in the documentation. This is a documentation issue. For the PRA evaluation for the BOP ESFAS completion time extension application, an uncertainty analysis was performed.
QU-11 B Open The quantitative definition used for significant cutset and significant accident sequence are documented and vary from the ASME definition. The ASME definitions need to be applied or the Ameren definition needs to be justified. Significant sequence:  ASME - aggregate 95% of total, individual sequence >1%  Ameren - aggregate 88% of total, individual sequence >1%
Significant cutset:  ASME - aggregate 95% of total, individual cutset >1%  Ameren - cutsets >1E-6 This issue is has no impact on the BOP ESFAS completion time extension evaluation.
Page 9 of 9 LE-1 B Open Probability of containment isolation failure leading to LERF does not contain a term to represent undetected, residual failures in containment structural integrity. This has been estimated at 5E-3 in NUREG/CR-4550.
Failure of containment isolation is derived by fault tree analysis of the containment isolation combinations on the penetration paths. There are three LERF split fractions with probabilities of 7.7E-4. If the 5E-3 was added to this, the split fraction would change, although LERF would not move significantly. Split fractions for induced SGTR and HPME were not explicitly stated in the documentation available for review. Split fractions for SGTR and HPME were included in the LERF analysis. An undetected, residual failure to the containment would result in a small increase in the baseline LERF. However, this increase would be reflected in both the baseline LERF and the Conditional LERF given one BOP ESFAS train out-of-service. There would be a negligible impact on the delta risk. Therefore, this F/O would have a minimal impact on the resu lts of the PRA evaluation for the BOP ESFAS completion time extension. LE-2 B Open The Level 2 analysis does not include uncertainty analysis nor are there sensitivity studies identified to examine the significant contributors to LERF. As a minimum, the Uncertainty in the Level 1 sequences should be propagated and sensitivity studies developed and evaluated for the important LERF scenarios. Core damage is the limiting risk metric for the BOP ESFAS completion time extension application. Core damage uncertainty analysis was provided.
SC-4 C Open The Callaway PRA has a common cause event for failure to isolate SG blowdown. This event fails all AFW.
The importance of the event is 0.10 in the base case model with all initiators and 0.57 in the fire-transient model. Very few plants have this strong dependence on failure to isolate SG blowdown. Suggest examination of the success criteria, or at least re-evaluation of the CCF values used, away from the 0.1 beta factor for 4/4 blowdown valves fail to close. This F/O relates to the success criteria contained in the auxiliary feedwater fault tree.
 
Reducing the common cause failure probability to isolate SG blowdown would result in a small reduction in the total baseline CDF results (about 5% - 10%). This F/O would have a small impact on the results of the PRA evaluation for the BOP ESFAS completion time extension. A sensitivity analysis was performed as discussed in Attachment
: 1.
ATTACHMENT 7
 
INTERNAL FIRE QUANTIFICATION INTERNAL FIRE QUANTIFICATION Page 1 of 6 Fire Compartment Description Screen Basis Fire Frequency (yr-1) P(NS) Fire Modeled Fire Frequency(yr-1) Fire CDF Due to an AFAS Train OOS            (Note 1) (yr-1) A-1A Aux. 1974' CVCS, AFW  2.10E-03  3.93E-5/2.75E-6 5.26E-09 A-1B 1988' Pipe Chase Areas CCDP = 1.0 3.90E-04 A-1C Vestibule near area A-1B No App. R or PRA equipment        A-1D NCP Room low frequency 8.50E-04      A-2 ECCS Train A Pump Rooms CCDP very low, mitigation not significantly impacted 2.60E-03 A-3 Boric Acid Tank Rooms CCDP very low, mitigation not significantly impacted 1.40E-03 A-4 ECCS Train B Pump Rooms  2.80E-03    3.50E-07 A-5 Stairway Reactor trip only, mitigation not impacted 3.90E-04      A-6 Stairway Thermo-lag barriers credited 3.90E-04      A-7 BIT Room CCDP very low, mitigation not significantly impacted 1.00E-03      A-8 CVCS Components low frequency 8.00E-04      A-9 RHR B HX Room CCDP very low, mitigation not significantly impacted 3.90E-04      A-10 RHR A HX Room CCDP very low, mitigation not significantly impacted 3.90E-04      A-11 Electrical Chase low frequency 3.90E-04      A-12 Electrical Chase low frequency 3.90E-04      A-13 MDAFP B  9.50E-04    1.19E-07 A-14 MDAFP A  9.50E-04    1.19E-07 A-15 TDAFP  1.10E-03    1.38E-07 INTERNAL FIRE QUANTIFICATION Page 2 of 6 Fire Compartment Description Screen Basis Fire Frequency (yr-1) P(NS) Fire Modeled Fire Frequency(yr-1) Fire CDF Due to an AFAS Train OOS            (Note 1) (yr-1) A-16 CCW Area  1.70E-03  2.64E-4/1.97E-6 1.33E-07 A-17 B Electrical Pen Room  1.90E-03 0.05  1.19E-08 A-18  A Electrical Pen Room  1.20E-03 0.05  7.50E-09 A-19 CB Supply A/C Unit low frequency 3.90E-04      A-20 CCW Surge Tank Area  2.30E-03    2.88E-07 A-21 Control Room A/C B low frequency 9.80E-04      A-22 Control Room A/C A  1.40E-03    1.75E-07 A-23 MSIV/MFIV Area low frequency 3.90E-04 A-24 North Piping Pen Room low frequency 5.10E-04 A-25 South Piping Pen Room low frequency 5.10E-04 A-26 Chem Storage Area low frequency 3.90E-04      A-27 Reactor Trip Switchger Room  2.90E-03  2.78E-06 3.48E-10 A-28A Aux Shutdown Panel Room A low frequency 5.60E-04 A-28B Aux Shutdown Panel Room B low frequency 5.60E-04      A-29 AFW Valves and Pipe Chase  7.20E-04    9.00E-08 A-30 AFW Valves and Pipe Chase  7.20E-04    9.00E-08 C-1 ESW Pipe Space low frequency 3.90E-04 INTERNAL FIRE QUANTIFICATION Page 3 of 6 Fire Compartment Description Screen Basis Fire Frequency (yr-1) P(NS) Fire Modeled Fire Frequency(yr-1) Fire CDF Due to an AFAS Train OOS            (Note 1) (yr-1) C-2 North Electrical Chase Reactor trip only, mitigation not impacted 3.90E-04 C-3 South Electrical Chase Reactor trip only, mitigation not impacted 3.90E-04      C-5 HP Access LOOP delta CCDP = 0.0 3.90E-04 C-6 HP Access  5.00E-03 0.02  1.25E-08 C-7 North Electrical Chase low frequency 3.90E-04 C-8 South Electrical Chase Reactor trip only, mitigation not impacted 5.60E-04 C-9 ESF Switchgear Room 1  2.90E-03 0.05  1.81E-08 C-10 ESF Switchgear Room 2  3.20E-03 0.05  2.00E-08 C-11 North Electrical Chase low frequency 3.90E-04      C-12 South Electrical Chase low frequency 3.90E-04      C-13 Access Control A/C CCDP very low, mitigation not significantly impacted 1.20E-03      C-14 Access Control A/C CCDP very low, mitigation not significantly impacted 1.30E-03      C-15 Battery and Switchboard Rooms B  1.30E-03    1.63E-07 C-16 Battery and Switchboard Rooms A  2.60E-03    3.25E-07 C-17 South Electrical Chase low frequency 3.90E-04 INTERNAL FIRE QUANTIFICATION Page 4 of 6 Fire Compartment Description Screen Basis Fire Frequency (yr-1) P(NS) Fire Modeled Fire Frequency(yr-1) Fire CDF Due to an AFAS Train OOS            (Note 1) (yr-1) C-18 North Electrical Chase low frequency 3.90E-04      C-19 Column C-3 Electrical Chase CCDP very low, mitigation not significantly impacted 3.90E-04      C-20 Column C-6 Electrical Chase CCDP very low, mitigation not significantly impacted 3.90E-04      C-21 Lower Cable Spreading Rm low frequency 4.80E-04      C-22 Upper Cable Spreading Rm low frequency 3.90E-04      C-23 South Electrical Chase low frequency 3.90E-04      C-24 North Electrical Chase low frequency 3.90E-04      C-25 Column C-6 Electrical Chase CCDP very low, mitigation not significantly impacted 3.90E-04      C-26 Column C-3 Electrical Chase CCDP very low, mitigation not significantly impacted 3.90E-04      C-27 Control Room See Attachment 1.
C-28 Service Area near CR Reactor trip only, mitigation not impacted 3.90E-04      C-29 SAS Room and Panel Reactor trip only, mitigation not impacted 5.60E-04      C-30 South Electrical Chase low frequency 3.90E-04      C-31 North Electrical Chase low frequency 3.90E-04      C-32 Column C-6 Electrical Chase CCDP very low, mitigation not significantly impacted 3.90E-04      C-33 South Electrical Chase low frequency 3.90E-04 INTERNAL FIRE QUANTIFICATION Page 5 of 6 Fire Compartment Description Screen Basis Fire Frequency (yr-1) P(NS) Fire Modeled Fire Frequency(yr-1) Fire CDF Due to an AFAS Train OOS            (Note 1) (yr-1) C-34 Column C-6 Electrical Chase CCDP very low, mitigation not significantly impacted 3.90E-04      C-35 Control Building 2016 Corridor Reactor trip only, mitigation not impacted 3.90E-04      C-36 Column C-6 Electrical Chase Reactor trip only, mitigation not impacted 3.90E-04      C-37 Column C-3 Electrical Chase Reactor trip only, mitigation not impacted 3.90E-04 CS Circ and Service Water  1.00E-03    1.25E-07 D-1 B EDG  2.90E-02 0.05  1.81E-07 D-2 A EDG  2.90E-02 0.05  1.81E-07 T-1 Stairwell Reactor trip only, mitigation not impacted 4.10E-04      TB-1 Turbine Building CCDP = 1.0 4.40E-02 TB-2 Comm Corr.
Stairwell CCDP very low, mitigation not significantly impacted 4.10E-04 TB-3 Access Area and Hot Lab LOOP delta CCDP = 0.0 4.10E-04 ES-1 ESW Pumphouse Train A  1.20E-03    1.50E-07 ES-2 ESW Pumphouse Train B  1.20E-03    1.50E-07 UHS-1 UHS Cooling Tower North  1.40E-03    1.75E-07 UHS-2 UHS Cooling Tower South  1.40E-03    1.75E-07 INTERNAL FIRE QUANTIFICATION Page 6 of 6 Fire Compartment Description Screen Basis Fire Frequency (yr-1) P(NS) Fire Modeled Fire Frequency(yr-1) Fire CDF Due to an AFAS Train OOS            (Note 1) (yr-1) INST Plant Intake Reactor trip only, mitigation not impacted 8.10E-04 YD-1A Manhole w/ A train cable Fire freq = 0 0.00E+00 YD-1B Manhole w/ B train cable Fire freq = 0 0.00E+00 YD-1C Train A emergency fuel oil tank CCDP very low, mitigation not significantly impacted 4.20E-04 YD-1D Train B emergency fuel oil tank CCDP very low, mitigation not significantly impacted 4.20E-04      YD-1E Various yard tanks CCDP very low, mitigation not significantly impacted 4.20E-04      YD-1F XNB01 LOOP delta CCDP = 0.0 8.10E-04      YD-1G XNB02 LOOP delta CCDP = 0.0 8.10E-04      SWYD Plant Switchyard LOOP delta CCDP = 0.0 1.10E-04      MXTR Main Transformers Reactor trip only, mitigation not impacted 2.40E-03 TBXTR Turbine Building Transformers Reactor trip only, mitigation not impacted 1.20E-03            Total  3.20E-06 Note 1: CCDP of 1.25E-4 applied to all areas to account for one AFAS train OOS.
 
ATTACHMENT 8
 
INTERNAL FLOODING QUANTIFICATION INTERNAL FLOODING QUANTIFICATION Page 1 of 4 Flood Area Description ESW/AFW Flood Source Screen Basis ESW/AFW  Flood Frequency (yr-1) Flooding CDF Due to an AFAS Train OOS (yr
-1)                      (Note 1) ONE CCW Area ESW CCDP = 1.0 TWO ESW Pipe Chase ESW  2.15E-05 1.95E-08 THREE ESF Switchgear ESW CCDP = 1.0    FOUR Battery and Chargers ESW CCDP = 1.0    FIVE Circ/SW Pump House None No ESW/AFW flood SIX-A 1974' Aux Building ESW  8.92E-06 8.07E-09 SIX-B 1988' Pipe Chase Areas ESW/AFW  7.37E-06 6.67E-09 SIX-C 1988' Pipe Spaces ESW 9.70E-07 8.78E-10 A-2 ECCS Train A Pump Rooms ESW 2.65E-05 2.40E-08 A-4 ECCS Train B Pump Rooms ESW 2.65E-05 2.40E-08 A-5 Stairway None No ESW/AFW flood    A-6 Stairway None No ESW/AFW flood    A-7 BIT Room None No ESW/AFW flood    A-8 CVCS Components ESW CCDP = 1.0    A-9 RHR B HX Room None No ESW/AFW flood    A-10 RHR A HX Room None No ESW/AFW Flood    A-11 Electrical Chase None Prop from A-24 1.10E-05 9.95E-09 A-12 Electrical Chase None Prop from A-25 1.10E-05 9.95E-09 A-13 MDAFP B ESW/AFW  1.63E-04 1.47E-07 A-14 MDAFP A ESW/AFW  1.42E-04 1.28E-07 A-15 TDAFP AFW  1.19E-04 1.08E-07 A-17 B Electrical Pen Room ESW 4.93E-06 4.46E-09 A-18  A Electrical Pen Room ESW 4.93E-06 4.46E-09 A-19 CB Supply A/C Unit None No ESW/AFW flood    A-20 CCW Surge Tank Area None No ESW/AFW flood    A-21 Control Room A/C B ESW Low flood frequency INTERNAL FLOODING QUANTIFICATION Page 2 of 4 Flood Area Description ESW/AFW Flood Source Screen Basis ESW/AFW  Flood Frequency (yr-1) Flooding CDF Due to an AFAS Train OOS (yr
-1)                      (Note 1) A-22 Control Room A/C A ESW  3.08E-06 2.79E-09 A-23 MSIV/MFIV Area None No ESW/AFW flood    A-24 North Piping Pen Room ESW  1.10E-05 9.95E-09 A-25 South Piping Pen Room ESW  1.10E-05 9.95E-09 A-26 Chem Storage Area None No ESW/AFW flood    A-28 Aux Shutdown Panel Room None Included w/ ONE for prop and no ESW/AFW flood    A-29 AFW Valves and Pipe Chase AFW  2.45E-04 2.22E-07 A-30 AFW Valves and Pipe Chase AFW  2.45E-04 2.22E-07 C-2 North Electrical Chase None Drains handle flood and no ESW/AFW flood    C-3 South Electrical Chase None Drains handle flood and no ESW/AFW flood    C-5 HP Access None No ESW/AFW flood    C-6 HP Access None No ESW/AFW flood    C-7 North Electrical Chase None No ESW/AFW flood    C-8 South Electrical Chase None Drains handle flood and no ESW/AFW flood    C-11 North Electrical Chase None Prop from THREE  4.30E-06 3.89E-09 C-12 South Electrical Chase None Prop from THREE  4.30E-06 3.89E-09 C-13 Access Control A/C ESW 4.93E-06 4.46E-09 C-14 Access Control A/C ESW  2.46E-06 2.23E-09 C-17 South Electrical Chase None Prop from FOUR Low flood frequency INTERNAL FLOODING QUANTIFICATION Page 3 of 4 Flood Area Description ESW/AFW Flood Source Screen Basis ESW/AFW  Flood Frequency (yr-1) Flooding CDF Due to an AFAS Train OOS (yr
-1)                      (Note 1) C-18 North Electrical Chase None Prop from FOUR Low flood frequency    C-19 Column C-3 Electrical Chase None Prop from FOUR Low flood frequency    C-20 Column C-6 Electrical Chase None Prop from FOUR Low flood frequency    C-21 Lower Cable Spreading Rm None No ESW/AFW flood    C-22 Upper Cable Spreading Rm None No ESW/AFW flood    C-23 South Electrical Chase None No ESW/AFW flood    C-24 North Electrical Chase None No ESW/AFW flood    C-25 Column C-6 Electrical Chase None No ESW/AFW flood    C-26 Column C-3 Electrical Chase None No ESW/AFW flood    C-27 Control Room None No ESW/AFW flood    C-28 Service Area near CR None No ESW/AFW flood    C-29 SAS Room and Panel None No ESW/AFW flood    C-30 South Electrical Chase None No ESW/AFW flood    C-31 North Electrical Chase None No ESW/AFW flood    C-32 Column C-6 Electrical Chase None No ESW/AFW flood    C-33 South Electrical Chase None No ESW/AFW flood    C-34 Column C-6 Electrical Chase  No ESW/AFW flood    C-36 Column C-6 Electrical Chase None Drains handle flood and no ESW/AFW flood    C-37 Column C-3 Electrical Chase None Drains handle flood and no ESW/AFW flood    D-1 B EDG ESW Included in THREE    D-2 A EDG ESW Included in THREE    T-1 Stairwell None No ESW/AFW flood    TB-1 Turbine Building None No ESW/AFW flood INTERNAL FLOODING QUANTIFICATION Page 4 of 4 Flood Area Description ESW/AFW Flood Source Screen Basis ESW/AFW  Flood Frequency (yr-1) Flooding CDF Due to an AFAS Train OOS (yr
-1)                      (Note 1) TB-2 Comm Corr. Stairwell None No ESW/AFW flood    TB-3 Access Area and Hot Lab None No ESW/AFW flood ES-1 ESW Pumphouse Train A ESW  3.30E-03 2.16E-08 ES-2 ESW Pumphouse Train B ESW  3.30E-03 2.16E-08 UHS-1 UHS Cooling Tower North ESW  1.16E-02 7.61E-08 UHS-2 UHS Cooling Tower South ESW  1.16E-02 7.61E-08 INST Plant Intake None No ESW/AFW flood Total  1.17E-06  Note 1: CCDP of 9.049E-4 applied to all Areas except ES-1/2 and UHS-1/2 to account for one train of AFAS OOS and one train of ESW drained. CCDP of 6.56E-6 applied to Areas ES-1/2 and UHS-1/2 to account for one train of AFAS OOS and one train of ESW failed.
 
ATTACHMENT 9
 
RG 1.200 REVISION 1 GAP ANALYSIS 
 
Callaway PRA Gap Analysis Report
 
Prepared under Contract No. P99005-0001-001-17, Revision 2 Prepared for: AmerenUE 
 
September 21, 2006
 
Final Report
 
Prepared by:
SCIENTECH, LLC
 
Callaway PRA Gap Analysis Report i Table of Contents
 
1.0  Introduction............................................................................................................................1 2.0  Assessment..............................................................................................................................3
 
===2.1. Internal===
Events During Full Power.....................................................................................3 2.2. External Events During Full Power....................................................................................4 2.3. Low Power and Shutdown with External Events...............................................................5
 
===2.4. Internal===
Fires During Full Power........................................................................................6 3.0  Conclusions.............................................................................................................................7 3.1 Internal Events During Full Power.....................................................................................7 3.2 External Events During Full Power..................................................................................27 3.3 Low Power and Shutdown PRA with External Events....................................................32
 
===3.4 Internal===
Fire During Full Power.......................................................................................59 4.0  Recommendations................................................................................................................60 5.0  References.............................................................................................................................65
 
===5.1 Callaway===
PRA Model.......................................................................................................65
 
===5.2 Reference===
Standards.........................................................................................................68 Appendix A - Independent Assessment Database Report (Areas AS, DA, IE, HR, LE, QU, SC, SY, MU)......................................................................................................................................A-1 Appendix B - Independent Assessment Results for Internal Events During Full Power............B-1 Appendix B Initiating Events Analysis Assessment Results................................................B-2 Appendix B Accident Sequence Analysis Assessment Results..........................................B-17 Appendix B Success Criteria Assessment Results..............................................................B-25 Appendix B Systems Analysis Assessment Results...........................................................B-30 Appendix B Human Reliability Analysis Assessment Results...........................................B-34 Appendix B Data Analysis Assessment Results.................................................................B-38 Appendix B Internal Flooding Assessment Results............................................................B-42 Appendix B Quantification Assessment Results.................................................................B-49 Appendix B LERF Analysis Assessment Results...............................................................B-62 Appendix B Maintenance and Update Assessment Results..............................................B-66 Appendix C - Independent Assessment Results for External Events During Full Power..........C-1 Appendix C Other External Events: Requirements for Screening and Conservative Analysis Assessment Results.....................................................................................................................C-2 Appendix C Seismic Margins Assessment Results...............................................................C-4 Appendix D - Independent Assessment Results for Low Power and Shutdown Plant States modeling Internal and External Initiating Events........................................................................D-7
 
Callaway PRA Gap Analysis Report 1 Independent Assessment Report
 
===1.0 Introduction===
 
NRC approved in 2003 implementation of a phase d approach to achieving an appropriate quality for probabilistic risk assessments (PRAs) for NRC's risk-informed regulatory decision-making. This approach allows for c ontinued practical use of risk insights while progressing towards more complete and technically acceptable PRAs. The phases of this approach are:
 
Phase 1 - This phase represented the status quo at the time of implementation of the approach where PRA quality is judged only in the context of what is needed for an individual application.
All contributors to risk (ope rational modes and initiating event types) are considered but contributors to risk not within th e scope of a given PRA can be addressed by qualitative arguments, performa nce of bounding analysis, or restricting the scope of the application of th e PRA. In reality, most current industry PRAs, including Callaway, have undergone peer reviews and have achieved a higher level of quality than the basic level of phase 1.
Phase 2 - This is the first step towards a more efficient approach by establishing an "issue-specific" phase to PRA quality. During this "issue-specific" phase, each general topic (such as: risk-informed IS I applications, or risk-informed Tech Spec applications, or risk-informed 50.46 applic ations) should be addressed with a PRA that meet applicable consensus standards (e.g., ASME standard at Capability Category II). With respect to the critical issue of PRA scope, this phase should have PRAs that address all modes and all initiators applicable to the issue. Some modes and initiators could be addressed qualitatively but all significant modes and initiator, those that could change the regulatory decision substantially and that are applicable to the issue and within the scope of the change being considered, should to be quantified and should include an uncertainty analysis.
 
Phase 3 - This phase represents continued progress in PRA methodologies beyond Phase 2, with the goal of achieving a level of PRA quality consistent with using enhanced PRAs for all currently envisioned regulatory or operational uses. This phase therefore differs from Phase 2 in that a single base-line PRA should be fully capable of supporting currently envisioned uses and doing so in a manner consistent with all the applicable consensus standards. This phase requires PRAs to consider all modes and all initiators applicable to the full range of currently envisioned issues. Since there are a wide variety of applications currently e nvisioned, this would likely co rrespond to all modes and all initiators reasonably applicable, that is, power operation, low-power and shutdown, internal and reasonable external events. Some modes and initiators could be addressed qualitatively but all significant modes and initiators (tho se that could change the regulatory decision substantiall y) should be quantified and s hould include an uncertainty analysis.
 
The NRC's goal is to complete phase 3 by the end of 2008. In order to assess the status of the Callaway PRA with respect to this approach, AmerenUE has chosen to perform a Callaway PRA Gap Analysis Report 2 gap analysis to identify the areas of the PRA which need to be strengthened in order to assure that the Callaway PRA conforms to all the existing standards in sufficient depth to address all currently envisioned a pplications. The gap analysis is an informal peer review designed to provide an overall status of all of the PRA elements with respect to the applicable standards in the form that they presently exist and to provide a roadmap and initial estimate of the time and resources required to upgrade the Callaway PRA.
 
This report documents the results of the gap analysis conducted of the complete Callaway PRA model, data and documentation in accordance with the Category II requirements of the ASME Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, updated to include Addenda B (Reference 1), the Category II requirements of ANSI/ANS-58.21-2003, "American National Standard External-Events PRA Methodology," (Reference 2), and the expected requirements of the ANS Low Power and Shutdown PRA Standard (draft being written). The review was conducted by a team of three senior experts with experience in performing NEI PRA Certifications and pre-Certification reviews with support from a sist er plant PRA staff member and experts in the areas of shutdown risk analyses and human reliability analyses.
 
The Callaway Internal Events PRA has had a peer review by the Westinghouse Owner's Group (WOG) in accordance with NEI 00-02. Resolution of all F&Os from the peer review is essentially complete with a few exceptions. The assessment team performed its review of the model as currently used. The open peer review F&Os, however, were reviewed to determine if there are additional areas of the PRA (i.e., not noted in the peer review F&Os) to which the comment (or similar comments) might also be applicable.
 
The intent of this independent assessment was to review the entire current model against the applicable standards to assess the ability of the model to meet each of the supporting requirements for Capability Category II of the standards and identify those areas where the model did not meet Capability Category II requirements. The task was not limited to the changes made to the Callaway PRA since the peer review, but covered the full PRA. The current Callaway PRA is composed of the IPE, Union Electric (AmerenUE) calculation packages and Addenda, the IPEEE, and the low power and shutdown safety monitor model. The specific calculation packages which comprise the Callaway IPE are shown in tabular form in Section 5, References. The assessment team reviewed the technical adequacy of compliance with each of the supporting requirements as compared to current PRA practices in the industry. Any requirements of the Standard that were believed to have not been fully complied with were noted in F&O format. 
 
Callaway PRA Gap Analysis Report 3 2.0  Assessment The Callaway PRA was divided into four distinct areas for the purpose of performing the gap analysis:  1) Inte rnal Events During Full Power; 2) External Events During Full Power; 3) Low Power and Shutdown with Exte rnal Events; and 4) Internal Fires During Full Power. The assessment conducted in each area is discussed in the following subsections.
 
===2.1. Internal===
Events During Full Power The review of the Callaway Internal Events PRA was performed by examining the Callaway internal events model, including Internal Floods, with respect to each of the supporting requirements in Reference 1. A determination was made for each supporting requirement whether the current Callaway model met the requirement or not. If the model was identified to not meet the requirement, the basis behind that conclusion was documented and an F&O generated. A significant effort was made to ensure that when a requirement was identified as not being met, that it was a true defici ency and not due to a failure to locate the correct documentation. Due to the sheer volume of documentation it is possible that some documentation was overlooked and the associated F&O can be resolved by identifying the documentation.
 
The review was largely documented in database format. The supporting requirements and evaluations to the Capability Category II criteria are provided in Appendix A. 
 
The database report consists of the following information (describ ed by report column heading):
SR Each supporting requirement is identified in Reference 1 with a designator that includes the PRA Area to which the SR re lates (e.g., AS, IE, QU, etc.), the high level requirement to which the SR relates and a sequential number within the HLR.
Category II Requirement This is the supporting requirement statement from Reference 1 for Category II.
Cat II Not Met This column represents the judgment of the reviewer as to whether the Category II requirement is satisfied. Additional information, however, is contained in this column in several distinct entries:  Blank - This entry indicates that the requirements of Category II are met. Some SRs are identical for multiple categories and, even though Category III may be satisfied, the evaluation was performed with regard to Category II.
Callaway PRA Gap Analysis Report 4  Checked - The entry indicates that the requirements of Category II are not met. The requirements for Category I may or may not be satisfied for the specific supporting requirement. New F&Os will be found for these SRs. N/A - The specific SR is not applicable. (Note:  N/A items omitted from Appendix A listing)
F and O Number This column contains the F&Os, iden tified by number, that apply to this supporting requirement.
 
Assessment The contents of this field were not constrained and it contains any comments related to the supporting requirement that the reviewer felt to be important to the assessment.
 
Document Enhancement This field was used to identify potential enhancements to documentation related to the SR.
 
Model Enhancement This field was used to identify potential enhancements to the model related to the SR.
 
The ASME PRA Standard does not assign specific IDs to the c onfiguration control requirements of Section 5 of the Standard; to support this review, high level requirements and Supporting Requirements for PRA configura tion control are defi ned here using the text of Section 5 of the ASME PRA Standard.
 
The results of the independent assessment consists of the evaluation of the Callaway Internal Events PRA with respect to the requirements for Category II described in Reference 1 and the identifica tion of any deficiencies note d in this process. The deficiencies are identified as "Findings and Observations" (F&Os) and are presented in Appendix B for each of the areas covered by Reference 1. Appendix B is subdivided into sections corresponding to the PRA analysis areas identified in Reference 1. The comparison of the Callaway Internal Events PRA to the high level requirements and the supporting requirements associated with each PRA analysis area is provided in Section 3.1.
 
===2.2. External===
Events During Full Power The external events analyses performed for Callaway as part of the IPEEE (excluding the fire analysis which is in the process of being revised) were reviewed against the criteria of ANSI/ANS-58.21-2003, "American National Standard External-Events PRA Methodology" (Reference 2). This review included the seismic margins assessment Callaway PRA Gap Analysis Report 5 (SMA) and the other external events. These analyses have not been reviewed or updated since the IPEEE submittal. 
 
The review of the Callaway External Events Analysis was performed by examining the Callaway IPEEE documentation with respect to each of the applicable supporting requirements in Reference 2. A determination was made for each supporting requirement whether the current Callaway analysis met the requirement or not. If the analysis was identified to not meet the requirement, the basis behind that conclusion was documented and an F&O generated. A significant effort was made to ensure that when a requirement was identified as not being met, that it was a true deficiency and not due to a failure to locate the correct documentation. Due to the sheer volume of documentation it is possible that some documentation was overl ooked and the associated F&O can be resolved by identifying the documentation.
 
The results of the independent assessment consists of the evaluation of the Callaway IPEEE with respect to the requirements for Category II described in Reference 2 and the identification of any deficiencies noted in this process. The deficiencies are identified as F&Os and are presented in Appendix C for each of the areas covered by Reference 2 and are subdivided into sections corresponding to the applicable High Level Requirements. The comparison of the Callaway IPEEE to the high level requirements and the supporting requirements associated with each analysis area are provided in Section 3.2.
 
2.3. Low Power and Shutdown with External Events The low power and shutdown (internal and external events) analyses performed for Callaway were constructed as part of a Safe ty Monitor Users Group project to develop a configuration risk management tool for ev aluating risk trade-offs between conducting maintenance on-line or shutdown; and to provi de an additional tool for outage risk management. The low power and shutdown PRA was reviewed against the high level requirements that are expected to be in the American National Standard Low Power and Shutdown PRA Methodology. Drafts of this pa rticular PRA standard show that low power and shutdown PRA modeling starts with the ASME PRA elements and requirements, and then ANS adds, modifies, or deletes the ASME requirements to create the set of requirements applic able to low power and shutdown plant states. The low power and shutdown PRA analyses have not been reviewed nor updated since the their original development several years ago. 
 
The review of the Callaway Low Powe r and Shutdown PRA was performed by examining the Callaway Low Power and Shutdown documentation with respect to each of the applicable high level requirements that are expected to be in the ANS Standard (based on drafts that have been released for comment). A determination was made for each high level requirement whether the current Callaway analysis met the requirement or not. If the analysis was identified to not meet the requirement, the basis behind that conclusion was documented and an F&O generated. A significant effort was made to Callaway PRA Gap Analysis Report 6 ensure that when an requirement was identified as not being met, that it was a true deficiency and not due to a failure to locate the correct documentation. As with other sections of the gap analysis, due to the large volume of documentation it is possible that some documentation was overlooked and the associated F&O can be resolved by identifying the documentation.
 
The results of the independent assessment c onsists of the evaluation of the Callaway Low Power and Shutdown PRA with respect to the requirements associated with Capability Category II and the identifica tion of any deficiencies note d in this process. The deficiencies are identified as F&Os and are presented in Appendix D for each of the PRA elements. The comparison of the Callaway Low Power and Shutdown PRA to the high level requirements and the supporting requirements associated with each analysis area are provided in Section 3.3.
 
===2.4. Internal===
Fires During Full Power The current Internal Fire mode l for the fire evaluation at Callaway is a Fire Induced Vulnerability Evaluation (FIVE) which was submitted to NRC as part of the IPEEE Submittal. Callaway is making the transition to NFPA 805 and is in the process of performing a detailed Fire PRA which will need to satisfy the intent of the requirements
 
of the draft ANS Fire PRA Standard (Reference 3). Therefore, the Internal Fire Analysis was not reviewed as part of this gap analysis.
Callaway PRA Gap Analysis Report 7 3.0  Conclusions As indicated in Section 2, the Callaway PRA was divided into four distinct areas for the purpose of performing the gap analysis:  1) Internal Events During Full Power; 2)
External Events During Full Power; 3) Low Power and Shutdown with External Events; and 4) Internal Fires. 
 
The conclusions associated with each of these areas of the assessment are discussed in the following subsections.
 
===3.1 Internal===
Events During Full Power This gap analysis identified a number of items necessary to meet each Supporting Requirement of ASME RA-Sb-2005. Most of th e findings of this gap analysis concern the enhancement of the documentation of the PRA, as opposed to recommending changes in models, data or PRA methodology. 
 
The review was largely documented in database format. Ap pendix A provides the printout of the complete assessment of the Callaway PRA against each of the Capability Category II supporting requirements. 
 
Where additional items were identified as necessary to meet the supporting requirements, F&Os were generated during the gap analysis. The individual F&Os, in some cases, address more than one supporting requirement and/or high level requirement.
Additionally, F&Os were generated when an error was discovered in the model or a significant conservatism was identified.
The F&Os are presented in Appendices B-1 through B-10.
 
Table 1 provides an overview of the results of the review, indicating the number of supporting requirements meeting th e various capability categories for each PRA area. Table 1 provides the number of SRs in each PRA Area found in Reference 1. This total
 
count includes those SRs which are noted as "Deleted" in Addendum B but retain a number. Additionally it indicates the number of SRs found to be in each category as a result of this assessment. SRs which were "Deleted" or were otherwise not applicable to Callaway (e.g., dual unit consid erations) are totaled in the Not Applicable column. Although Category III is met for some suppor ting requirements, this table does not include Category III because this project assessed the PRA against the requirements for Category II. For example, of the 44 SRs fo r the SY area, thirty-nine were found to currently meet at least the Category II requirements, two more will meet at least the Category II requirements when the outstanding F&Os are resolved satisfactorily, and three were not applicable to Callaway. 
 
Callaway PRA Gap Analysis Report 8 Table 1. Internal Events PRA During Full Power -  PRA Elements and Associated Supporting Requirements and Status PRA Element SRs Cat II / Met Not Met Not Applicable No. of F&Os IE 35 17 14 4 14 AS 21 16 4 1 7 SC 15 11 4  4 SY 44 39 2 3 3 HR 36 32 3 1 3 DA 33 25 8  3 IF 54 37 9 8 6 QU 36 27 8 1 12 LE 42 36 6  3 MU (Note 1) 10 8 2  2 Note 1:  The ASME PRA Standard does not assign specific IDs to the configuration control requirements of Section 5 of the Standard; to support this review, high level requirements and Supporting Requirements for PRA configuration control are defined here using the text of Section 5 of the ASME PRA Standard..
Table 2 provides a summary of each of the supporting requirements which were identified as not meeting the Capability Category 2 requirements. For each SR, the table provides a brief text description of the assessment; an indication whether the resolution requires a documentation change, a modeling change, or both; and a reference to the applicable F&Os.
 
Callaway PRA Gap Analysis Report Table 2: Capability Category II Supporting Requirements Not Met Enhancement Type SR Assessment Doc Model FO No  9  IE-A4 The initial screening of the systems was performed during the initial PRA and is discussed in 3.1.1.1.3 of the X IE-3  IPE submittal. Detailed FMEAs were developed for those systems identified as leading to plant trip.
However, there was no justification provided for the exclusion of systems for which FMEAs were not performed. The FMEAs performed were documented in Calcs ZZ-116 (DC Power), ZZ-119 (AC Power), ZZ-120 (HVAC), EA-03 (SWS), EG-18 (CCWS), KA-30 (IAS). These FMEAs or the screening evaluations have not been revisited since the IPE. In order to meet Category 2 requirements, the documentation of the basis for the disposition of each system as an initiating event must be specified. In order to keep this documentation current, a review of the applicability of the FMEAs/screening basis should be made during each model update.
IE-A5 The screening process does not distinguish why events which occur during non-power were excluded.
X IE-4  Therefore SR IE-A5 is not met.
IE-A7 There was no evidence found  that operating experience was reviewed with precursors in mind. If an event did X IE-6  not result in the generation of a trip or an LER, then it was not reviewed. As a minimum, interviews with operations and maintenance personnel should be conducted to meet SR IE-A7. The current analysis does not meet Cat 2 SR IE-A7.
IE-C1 The IE frequencies do not include any distribution information. The Callaway PRA justifies excluding the early X IE-7  operational data not indicative of normal plant power operation. The IE frequencies need to have uncertainty bounds assigned to meet SR IE-C1.
IE-C1a The IE frequencies do not include any distribution information. The Callaway PRA justifies excluding the early X IE-7  operational data not indicative of normal plant power operation. The IE frequencies need to have uncertainty bounds assigned to meet SR IE-C1a.
IE-C1b As noted in SY, the Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and X IE-8  loss of SWS initiating events. The recovery events, which include recovery of CCF of pumps and valves lack sufficient analysis or data. The Callaway PRA does not meet SR IE-C1b.  (See also SY-22)
IE-C3 The Callaway PRA does not make this correction. Note that the T2 and T3 initiating events already include X IE-10  this based on the data collection method and calculation. SR-C3 is not explicitly met for the other initiating events.
IE-C9 The Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and loss of SWS X IE-8  initiating events. The recovery events, which include recovery of CCF of pumps and valves lack sufficient analysis or data. The Callaway PRA does not meet criterion IE-C9.
IE-C10 There is no documentation of a comparison with generic data sources. This is primarily of interest for the X IE-12  support system initiating event fault trees and needs to be documented as part of each update in order to  meet SR IE-C10.
 
Callaway PRA Gap Analysis Report Table 2 (cont.): Capability Category II Supporting Requirements Not Met Enhancement Type SR Assessment Doc Model FO No  10  IE-C12 The Callaway treatment of ISLOCA addresses items a-d and may include item e but that is not clear. The X X IE-13  ISLOCA documentation is good for the evaluation of the high/low interfaces (ZZ-105) however the documentation of the quantification from that point on is minimal, is not incorporated in the main model, and has not been revised or reexamined since the IPE submittal. The ISLOCA model as it now stands does not  meet SR IE-C12.
IE-C13 The data used in the PRA quantification are mean values but there is no characterization of the uncertainty.
X IE-7  Therefore SR IE-C13 is not met.
IE-D1 The initiating event analysis documentation does not facilitate PRA applications, upgrades, and peer review.
X IE-14  IE-D2 The current documentation of the initiating event selection, grouping, screening, modeling, and quantification is X IE-14  scattered throughout multiple calculation packages and only small portions have been updated since the completion of the IPE. The documentation could be significantly enhanced by combining all IE related calculations into one IE calculation package and making a commitment to revisit the calculation during each  model update.
IE-D3 The assumptions made during the initiating events analysis are spread throughout multiple documents which X IE-14  makes it difficult to judge whether the assumptions are fully documented. Likewise, the key sources of uncertainty in the initiating events analysis are spread throughout multiple documents which makes it difficult to judge whether the assumptions are fully documented.
AS-A11 This requirement is met for some of the event trees. Calc note ZZ-267 contains a table of transfers.
X X AS-2  However, many transfers such as seal LOCA and stuck open PORV transfer to a "psuedo event tree". These transfers are quantified using an OCL file that does not have a specific event tree. This introduces possibilities for error in the quantification since there is no event tree on which to base the evaluated functions, especially those that require preservation of dependencies. The actual event tree for quantification of the RCP seal LOCA events was not found. An event tree Trcp appears to have been used, but this event tree has an event for recovery of CCW, which is not included in the .OCL files for the RCP seal LOCA events. AS-B1 This requirement is not met. See F&Os AS-1, AS-3, AS-5, and AS-7  for specific examples.
X AS-1, AS-3,  AS-5, AS-7 AS-B2 This requirement is not met. See F&Os AS-1, AS-3, AS-5, and AS-7  for specific examples.
X AS-1, AS-3,  AS-5, AS-7 AS-B6 Discussed in IPE, ZZ-275, ZZ-267, and the individual system calc notes. In most cases this requirement is X AS-4, AS-5 met, however, the RCP seal LOCA model needs to be updated to reflect the latest WOG model, which is approved by the NRC.
Room cooling requirements for the switchgear rooms for SBO should be re-evaluated to consider the actual heat loads in the rooms during SBO.
 
Callaway PRA Gap Analysis Report Table 2 (cont.): Capability Category II Supporting Requirements Not Met Enhancement Type SR Assessment Doc Model FO No  11  SC-B5 There was no  documentation found which provides a comparison of the plant-specific analysis with that of X SC-2  different plants or with other computer code calculations SC-C1 Success criteria are not documented in a single place. Each system notebook has the SC for that application.
X SC-1  Current system of documentation does not provide easy comparison of T/H use for consistency. The ASME criteria expects to see a single place for SC documentation and a coordinated effort to compare and show that all SC are consistently derived from the same set of consistent T/H runs.
SC-C2 As identified for SR SC-C1, the documentation is spread out, and while it appears that all of the information is X SC-1  provided, the quality, useability and reviewability of the PRA would be greatly enhanced by pulling the disparate pieces in to a single document.
SC-C3 Not done X SC-1  SY-A7 Detailed system models are available for all but two systems. For the Instrument Air System a single basic X X SY-1  event is used and is based on generic data. The Callaway plant is not highly dependent upon IAS and the PRA loads on IAS also are supplied with N2 backup which is modeled. The IAS is correctly failed for LOSP, but remains available in all other cases. The IAS is cooled by SW and would be unavailable after loss of all SW (T(SW)) and should be set to failed via a house event setting. The actuation system is modeled with a single event for each of the redundancies which is set to fail for scenarios in which the conditions are not present to generate the signal. The data associated with these single event failures need to be reviewed against current industry data and updated if necessary. The applicability of the data to the Callaway configuration also needs to be justified. In addition, the scram system has not been modeled in detail but is evaluated in a similar manner to  most PRAs. SR SY-A7 is not met due to the above noted correction and documentation issues.
SY-A22 The Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and loss of SWS X IE-8  initiating events. The recovery events, which include recovery of CCF of pumps and valves lack sufficient analysis or data. The Callaway PRA does not meet SR SY-A22.
SY-B1 The Callaway PRA adequately models CCFs with the exception of battery chargers and breakers as noted in X SY-2  SR SY-B3. SY-B3 The Callaway PRA includes most of the CCF groups identified. In order to meet the criterion for SY-B3, either X SY-2  a justification must be provided or the events added for:  Battery chargers and circuit breakers. The current treatment does not meet the criterion for SY-B3.
HR-D3 Documentation should be updated to add a ground rule statement that the quality of written procedures is X HR-1  considered in the operator-procedure interface failure mechanisms of the CBDTM, and in the EOM parts of the THERP analyses (step-by-step vs. verbose). The instrumentation and control layout is considered in the "Cues" sections and in the THERP execution analyses. Equipment configuration is considered for local actions in "Execution PSFs" and in the THERP analyses.
 
Callaway PRA Gap Analysis Report Table 2 (cont.): Capability Category II Supporting Requirements Not Met Enhancement Type SR Assessment Doc Model FO No  12  HR-G6 The analyst who performed the reevaluation of the HFEs indicated that a reasonableness check was X HR-2  performed, however the documentation does not discuss this issue.
HR-I3 Key assumptions are documented in the individual analyses files, where applicable. Key sources of X HR-3  uncertainty associated with the HRA are not documented.
DA-B1 Group parameter estimations are generally based only on component type. Recent data updates have used a X DA-2  much finer levels of grouping (e.g., the charging pumps are considered a different group than the SI pumps).
The grouping used to apply plant-specific data updates should be reexamined to make sure the data aggregation is reasonable. This meets category I but does not meet category II.
DA-C2 Plant specific data was initially collected but has not been updated for components associated with low risk X X DA-2  significant components in the most recent update. Consideration should be given to collecting data on as large a group of components as possible to establish a meaningful collection of data. Grouping of the components as defined in SR DA-B1 and DA-B2 provides a more reasonable aggregation of data.
DA-C6 The data collected is provided by the MR Group. It appears, based on discussions with the PRA analyst that X DA-1  the correct information is collected and transferred to the PRA Group however the documentation of the collection method needs to be formalized and included as part of the PRA.
DA-C7 The data collected is provided by the MR Group. It appears, based on discussions with the PRA analyst that X DA-1  the correct information is collected and transferred to the PRA Group however the documentation of the collection method needs to be formalized and included as part of the PRA.
DA-C8 The data collected is provided by the MR Group. It appears, based on discussions with the PRA analyst that X DA-1  the correct information is collected and transferred to the PRA Group however the documentation of the collection method needs to be formalized and included as part of the PRA.
DA-C9 The data collected is provided by the MR Group. It appears, based on discussions with the PRA analyst that X DA-1  the correct information is collected and transferred to the PRA Group however the documentation of the collection method needs to be formalized and included as part of the PRA.
DA-C14 The Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and loss of SWS X IE-8  initiating events. The recovery events, which include recovery of CCF of pumps and valves lack sufficient analysis or data. The Callaway PRA does not meet DA-C14.
DA-D2 No justification is provided for the use of engineering judgment to determine the probability as required by DA-X DA-3  D2 (Example: HYDRAULICSYSFAIL, STR-FR, STR-FS). There is no indication that any parameters were (or were not) determined by using data or estimates of similar equipment.
IF-C2a This requirement is not met. ZZ-466 treats operator response in a generic sense.
X IF-5 Callaway PRA Gap Analysis Report Table 2 (cont.): Capability Category II Supporting Requirements Not Met Enhancement Type SR Assessment Doc Model FO No  13  IF-C6 This requirement is met to Category I only. ZZ-466 allows the operator intervention and mitigation for floods X IF-3  that take 30 minutes or longer. Isolation and available manpower not specifically addressed. F&O IF-3 IF-C8 This requirement is met to Category I only. ZZ-466 allows the operator intervention and mitigation for floods X IF-3  that take 30 minutes or longer. Isolation and available manpower not specifically addressed. F&O IF-3 IF-D5 This requirement is met to Category I. The flood initiating event frequencies are based on generic pipe break X IF-1  frequencies. No plant specific experience is considered in the deter mination of the flooding initiator.
IF-D5a This requirement is met to Category I. The flood initiating event frequencies are based on generic pipe break X IF-1  frequencies. No plant specific experience is considered in the deter mination of the flooding initiator IF-E3a This requirement is not met at any Category. The Category I/II screening quantitative criteria in the standard X IF-2  is 1E-09/year. ZZ-466 screening criteria was 1E-06/yr.
IF-E5 This requirement is not met. The HEP values used in ZZ-466 are not developed from a human reliability X IF-4  analysis. IF-E5a This requirement is not met. The HEP values used in ZZ-466 are not developed from a human reliability X IF-4  analysis. IF-E7 This requirement is not met. The internal flooding sequences are not considered in the LERF analysis.
X IF-6  QU-A2b The current quantification does not include an uncertainty calculation to account for the "state-of-knowledge"  X QU-1  correlation between event probabilities. The structure exists to perform this correlation but at the current time it has not been done.
QU-B9 The Callaway PRA does not use modules, subtrees, or split fractions, with one exception. That exception is in X QU-2  the SSIE events. These "modules" provide a place that some dependencie s can be overlooked. While the Ameren staff have made the effort to account for these hidden dependencies, enough inconsistencies were identified that SR QU-B9 is not considered to be met. Linking of the SSIE fault trees to the event trees provides more assurance of the correct treatment and should be considered.
QU-D4 There was no documentation of a review of non-significant accident sequences or cutsets to determine their X QU-5  reasonableness. This review is necessary to meet SR QU-D4.
QU-E3 The current quantification does not include an uncertainty calculation to account for the "state-of-knowledge" X QU-1  correlation between event probabilities. The structure exists to perform this correlation but at the current time it has not been done. SR QU-E3 is not met.
QU-F1 The documentation of the model quantification accurately documents what was performed during the X X QU-8  quantification process, however the manual integration required for several stand-alone pieces of the analysis is not well documented. The recommended changes to the quantification process to integrate the entire internal events (including internal flooding) would serve to facilitate the use of the quantification process for PRA applications, upgrades, and peer review.
QU-F2 In general the model integration process is adequately documented, however several of the areas do not meet X QU-9  the requirements. Items b, f, g, and i are not addressed in the documentation. These items need to be addressed to meet SR QU-F2.
 
Callaway PRA Gap Analysis Report Table 2 (cont.): Capability Category II Supporting Requirements Not Met Enhancement Type SR Assessment Doc Model FO No  14  QU-F4 Key assumptions and key sources of uncertainty which influence the current quantification are not addressed X QU-10  in a coherent manner in the documentation.
QU-F5 No documentation of limitations was identified.
X QU-12  QU-F6 The quantitative definition used for significant cuts et and significant accident sequence are documented and X QU-11  vary from the ASME definition. The ASME definitions need to be applied or the Ameren definition needs to be justified.
Significant sequence:
ASME - aggregate 95% of total, individual sequence >1%
Ameren - aggregate 88% of total, individual sequence >1%
Significant cutset:
ASME - aggregate 95% of total, individual cutset >1%
Ameren - cutsets >1E-6 LE-B1 Not necessarily done. LERF identified based on source term and timing. Not evident that containment X X LE-1  isolation failure is included. Not evident that HPME is included.
Probability of containment isolation failure leading to LERF does not contain a term to represent undetected,  residual failures in containment structural integrity. This has been estimated at 5E-3 in NUREG/CR-4550.
Failure of containment isolation is derived by fault tree analysis of the c ontainment isolation combinations on the penetration paths. There are three LERF split fractions with probabilities of 7.7E-4. If the 5E-3 was added to this, the split fraction would change, although LERF would not move significantly. Split fractions for induced SGTR and HPME were not explicitly stated in the documentation available for review.
LE-D4 Meets category I. Little benefit expected from additional analysis at significant cost.
X LE-3  LE-D5 Meets category I. Little benefit expected from additional analysis at significant cost.
X LE-3  LE-D6 Containment isolation failure only occurs in bypass sequences. Failures of CI system are not included.
X X LE-1  Probability of containment isolation failure leading to LERF does not contain a term to represent undetected,  residual failures in containment structural integrity. This has been estimated at 5E-3 in NUREG/CR-4550.
Failure of containment isolation is derived by fault tree analysis of the c ontainment isolation combinations on the penetration paths. There are three LERF split fractions with probabilities of 7.7E-4. If the 5E-3 was added to this, the split fraction would change, although LERF would not move significantly.
LE-F2 Not done. The Level 2 analysis does not include uncertainty analysis nor are there sensitivity studies X LE-2  identified to examine the significant contributors to LERF. As a minimum, the uncertainty in the Level 1 sequences should be propagated and sensitivity studies developed and evaluated for the important LERF scenarios.
LE-G4 Not done. The Level 2 analysis does not include uncertainty analysis nor are there sensitivity studies X LE-2  identified to examine the significant contributors to LERF. As a minimum, the uncertainty in the Level 1 sequences should be propagated and sensitivity studies developed and evaluated for the important LERF scenarios.
 
Callaway PRA Gap Analysis Report Table 2 (cont.): Capability Category II Supporting Requirements Not Met Enhancement Type SR Assessment Doc Model FO No  15  MU-B3 This requirement is not met. There is no direction in APA-ZZ-00312 to follow the industry guidance, nor is there X MU-1  a reference to the industry standards. The procedure was written prior to the issuance of the standards and should be revised to incorporate the standards.
MU-B4 This requirement is not met. There is no direction in APA-ZZ-00312 to perform a peer review following an X MU-2  upgrade.
Callaway PRA Gap Analysis Report 16 An Importance Level, as defined in Table 3, were assigned to each of the F&Os generated during the review process. 
 
Table 3. F&O Importance Levels Importance Level Definition A Extremely important and necessary to address to assure the technical adequacy of the PRA or the quality of the PRA or the quality of the
 
PRA update process. B Important and necessary to address, but may be deferred until the next PRA update. C Marginal importance, but considered desirable to maintain maximum flexibility in PRA Applications and consistency in the Industry. D Editorial or Minor Technical Item, left to the discretion of the host utility. Table 4 provides the numbers of F&Os that we re identified for each of the PRA areas for each level of significance. Of those F&Os identified as "A/B", none were id entified by the reviewers to qualify as "A" level issues; all "A/B" items were identified on the F&O forms as "B."  This means that the reviewers felt that for the "A/B" findings, the issues needed to be corrected but that the issues did not cause the PRA to be technically inadequate from an overall perspective.
Table 4. HLR F&O Summary HLR Total F&Os Level A/B Level C IE 14 5 9 AS 7 7 0 SC 4 0 4 SY 4 3 1 HR 3 0 3 DA 3 1 2 IF 6 4 2 QU 12 6 6 LE 3 2 1 MU 2 0 2  The tables below summarize the assessment comments for each of the HLRs for each PRA
 
functional area.
Callaway PRA Gap Analysis Report 17 Table 5. Initiating Event (IE) HLR Summary GAP ANALYSIS REVIEW REPORT ELEMENT:  INITIATING EVENT ANALYSIS (IE) Completeness (IE-A): Most of the SRs for this HLR meet Category II. There are three SRs which are not met due primarily to documentation issues:    There is no documentation of the FMEAs associated with the plant systems that were not identified as support system initiating events. The documentation of screening process doe s not justify the exclusion of events which occur during non-power. There is no documentation of operating experience review with precursors in mind. Once these documentation issues are addressed this HLR should be met at a Category II level or greater. 
 
Grouping (IE-B): The Callaway PRA currently meets this HL R at a Category II level or greater. Frequency Estimation (IE-C):
Eight SRs associated with this HLR were not met at the Category II Level and fall into five classes:  Lack of distribution information and propagation of uncertainty (3 SRs)  Credit for repair with insufficient justification (2 SRs)  IE frequencies not uniformly calculated on a reactor-year basis  Lack of documentation of a comparison of the IE frequencies, particularly the SSIEs, with generic data  Lack of documentation of the ISLOCA quantification and the consideration of isolation capabilities.
Once these F&Os are addressed, this HLR should be met at a Category II level or greater.
Documentation (IE-D): The documentation provided for IE currently does not meet all of the requirements for Category II, primarily due to the documentation of the various pieces of the IE analysis being scattered throughout multiple calculation packages. Resolution of the F&O will enable this HLR to meet Category II (or better) requirements.
 
Callaway PRA Gap Analysis Report 18 Table 6. Accident Sequence Analysis (AS) HLR Summary GAP ANALYSIS REVIEW REPORT  ELEMENT:  ACCIDENT SEQUENCE ANALYSIS (AS)
Scenario Description (AS-A):
 
The approach used is consistent with the requirements of the standa rd and other industry PRAs. One SR regarding the treatment of event tree transfers is not met for Category II. The Callaway PRA will meet the requirements of Category II for this HLR, once the
 
F&O generated during the gap analysis is resolved.
Dependencies (AS-B): The overall treatment of dependencies in the accident sequence analysis is good. However, several cases (involving SSIEs) were identified where dependencies were not correctly addressed. Three F&Os document the specific cases identified in this area. Resolution of these F&Os will ensure that this HLR is met for Category II.
 
Documentation (AS-C): The documentation provided for AS meets the requirements for Category II, however it would be beneficial to the future use of the PRA to merge the documentation currently in the IPE and  multiple calculation packages. This HLR is met to Category II (or better) requirements.
 
Callaway PRA Gap Analysis Report 19 Table 7. Success Criteria (SC) HLR Summary GAP ANALYSIS REVIEW REPORT  ELEMENT:  SUCCESS CRITERIA (SC)
Definition/Appropriateness (SC-A):
The Callaway PRA incorporates industry-accepted definitions and methods for developing success criteria. The Category II requirements are met in this area.
Success Criteria Bases (SC-B): The Callaway PRA attempts to define realistic success criteria, based on thermal-hydraulic evaluations using the MAAP 3 code.
Questions have arisen regarding validity of MAAP 3. Callaway plans to re-analyze the success criteria with MAAP 4. This analysis should be considered a high priority. Also, comparisons of the calculated results with other sources were not performed or docum ented. This issue needs to be resolved in order to fully meet the requirements of Category II.
 
Documentation (SC-C): The SC documentation does not meet the requirements for Category II from the standpoint of facilitating PRA applications, upgrades, or peer review. While it appears that all of the necessary information is provided, the ASME criteria expects to see a single place for SC documentation and a coordinated effort to compare and show that all SC are consistently derived from the same set of consistent T/H runs. Resolution of these F&Os should allow the Category II (or higher) requirements to be met. 
 
Callaway PRA Gap Analysis Report 20 Table 8. Systems Analysis (SY) HLR Summary GAP ANALYSIS REVIEW REPORT  ELEMENT:  SYSTEMS ANALYSIS (SY) Completeness (SY-A):
In general, the overall systems analysis pr ocess is good. The modeli ng is appropriate and is generally consistent with other plant m odels across the industry. There are many SRs in this set for which the analysis process meets Cat III, however, there are 2 SRs in which Cat II is not currently met. Correct dependencies for systems modeled as single basic events and review these single basic event models against curr ent industry data and configurations  Credit for repair with insufficient justification in the SSIE fault trees A specific example is correcting the dependence of Instrument Air (IAS) on Service Water (SW). Resolution of these issues should allow the Category II (or higher) requirements to be met.
 
Common Cause/Dependencies (SY-B):
Common cause and dependency issues are in ge neral, satisfactorily addressed. Processes that are in place are good. The only outstanding issue is to add or justify why CCFs are not necessary for battery charger and circuit breakers. It is also recommended that the CCF data be updated from NUREG/CR-5485 as the beta factors used in the Callaway model are currently very conservative. Resolution of this issue will meet at least the Category II requirements for this HLR.
 
Documentation (SY-C): The overall documentation packages for SY are very good and provide all the necessary information. The documentation of the systems analysis, while reasonably complete, could benefit from reorganization. There are currently thirty three calculation packages which document different pieces of the systems analysis. The recommendation is to replace these calculations with a single calculation which merges all of these calculations. This HLR is met to Category II (or better) requirements.
 
Callaway PRA Gap Analysis Report 21  Table 9. Human Reliability Analysis (HR) HLR Summary GAP ANALYSIS REVIEW REPORT  ELEMENT:  HUMAN RELIABILITY ANALYSIS (HR) Identification (Pre-Initiators) (HR-A):
The SRs related to this HLR meet the Category II (or better) requirements.
Screening (Pre-Initiators) (HR-B): The SRs related to this HLR meet the Category II (or better) requirements.
HFE Definition (Pre-Initiators) (HR-C): The SRs related to this HLR meet the Category II (or better) requirements.
HFE Assessment (Pre-Initiators) (HR-D): It is expected that Capability Category II (at least) will be met after documentation is added to clarify the following points:  The quality of written procedures (for performing tasks) and administrative controls (for independent review) (HR-D3)  The quality of the human-machine interface, including both the equipment configuration, and instrumenta tion and control layout (HR-D3)
Identification (Post-Initiators) (HR-E): The SRs related to this HLR meet the Category II (or better) requirements.
HFE Definition (Post-Initiators) (HR-F): The SRs related to this HLR meet the Category II (or better) requirements.
HFE Assessment (Post-Initiators) (HR-G):
It is expected that Capability Category II will be met after the following actions are accomplished. Documenting the reasonableness check of HEPs (HR-G6).
Recovery Modeling (Post-Initiators) (HR-H): The SRs related to this HLR meet the Category II (or better) requirements.
Documentation (Pre-Initiators and Post-Initiators) (HR-I):
The documentation associated with the HLR-HR-I generally meets the requirements for Capability Category II (at least) with one exception:  The key sources of uncertainty associated with the HRA are not documented.
 
This issue needs to be resolved in order to fully meet the requirements of Category II.
 
Callaway PRA Gap Analysis Report 22 Table 10. Data Analysis (DA) HLR Summary GAP ANALYSIS REVIEW REPORT  ELEMENT:  DATA ANALYSIS (DA) Parameter Definition (DA-A):
The Callaway PRA Data effort meets Capability Category II requirements for this HLR.
Component Grouping (DA-B): The component grouping and parameter estimation currently meet Capability Category I. In order to meet the Capability Category II requirements the component groupings for parameter estimations should be re-examined to support reasonable aggregations of data. The Callaway PRA Data effort will meet Capability Category II requirements for this HLR upon resolution of this grouping issue.
 
Collection (DA-C):
In general, the overall data analysis process is good. Six SRs associated with this HLR were not met at the Category II Level and fall into three classes:  Lack of documentation/procedures of collection methods used by MR group for plant specific data collection (4 SRs)  Limited collection of component s for plant specific data. Lack of documentation/analysis of plant specific data for repair events.
The data collection effort for the Callaway PRA will meet Category II requirements, once  these issues are resolved to ensure that pl ant specific data is accurately counted and estimated, that the number of components that plant specific data is collected for is
 
sufficient to characterize the fa ilure rates for all components, and that a sufficient basis exists for all repair activities credited. It is also recommended that coincident T&M is examined to ensure that it is correctly accounted for. 
 
Parameter Estimation (DA-D): The parameter estimation will meet the Category II requirements, once documentation is provided on the data estimates made which are based upon "engineering judgment" Documentation (DA-E): Meets Category II requirements.
 
Callaway PRA Gap Analysis Report 23 Table 11. Internal Flooding (IF) HLR Summary GAP ANALYSIS REVIEW REPORT  ELEMENT:  INTERNAL FLOODING (IF)
Completeness of Flood Area Identification (IF-A):
The Callaway flood area identification process meets the ASME requirements of Category II.
 
Flood Source Identification and Characterization(IF-B):
The Callaway flood source identification process meets the ASME requirements of Category II.
 
Flooding Scenario Development (IF-C): The Callaway flooding scenario development process generally meets the ASME requirements of Category II of HLR-IF-C with the exception of three SRs. These SRs all arise from the treatment of human interactions in a completely generic manner. Revision of the IF analysis to account for plant specific treatment of operator responses will meet the ASME requirements of Category II.
 
Initiating Event Identification and Quantification (IF-D):
The flood initiating frequencies are based on ge neric pipe break frequencies and currently meet Capability Category I only. In order to meet the Capability Category II requirements plant-specific information must be considered. The Ca pability Category II requirements for this HLR will be met upon consideration of plant specific considerations.
 
Quantification of Flooding Scenarios (IF-E):
The Callaway quantification of flooding scenarios does not meet Category II in four SRs for this HLR. These are grouped in three categories:  Screening criteria  Insufficient human reliability analysis (2 SRs)  Lack of consideration of the internal flooding sequences in LERF analysis Each of these areas must be revised to meet the Category II requirements of HLR-IF-E.
Documentation (IF-F): Meets Category II requirements.
 
Callaway PRA Gap Analysis Report 24 Table 12. Quantification (QU) HLR Summary GAP ANALYSIS REVIEW REPORT  ELEMENT:  QUANTIFICATION (QU)
Core Damage Frequency Quantification (QU-A):
In general, the Callaway PRA process meets the ASME requirements of Cat II with the exception that the uncertainty analysis has not been update d during the PRA updates. The quantification must account for the "state-of-knowledge" correlation between event probabilities by properly utilizing WinNUPRA to calculate the results uncertainty.
Quantification Methodology (QU-B): The Callaway PRA process generally meets the ASME requirements of Category II with the exception of the treatment of dependencies between the support system initiating event and the mitigation systems. In order to meet this SR to Category II, the dependencies need to be corrected. It is recommended to link the SSIE fault trees to the event trees.
 
Dependencies (QU-C): The Callaway PRA process meets the ASME requirements of Cate gory II of HLR-C. However, several errors were identifie d with incorrect transfer of sequence characteristics. While the process is acceptable it places a significant burden on the analyst. The quantificati on process should be revised to account for the additional capabilities and automation available in the PRA software which will result in less manual manipulation (and potential for error) in the quantif ication process.
Results Analyses (QU-D): The Callaway PRA process generally meets the ASME requirements of Category II with the exception of the documenta tion of a review of a sample of the non-significant sequences/cutsets.
 
Uncertainty Characterization (QU-E):
The Callaway PRA quantification updates do not calculate the uncertainty associated with the results and therefore do not meet one of the requirem ents of Category II for this HLR.
Documentation (QU-F): The documentation of the model quantification accurately documents what was performed during the process, however the ma nual integration required for several stand-alone pieces of the analysis is not well documented. The recommended changes to the
 
quantification process to integr ate the entire internal even ts (including internal flooding and ISLOCA) would serve to facilitate the use of the quantification process for PRA applications, upgrades, and peer review and meet the Category II requirements. 
 
Callaway PRA Gap Analysis Report 25 Table 13. LERF Analysis (LE) HLR Summary GAP ANALYSIS REVIEW REPORT ELEMENT:  LERF ANALYSIS (LE)
Plant Damage States (LE-A): The Callaway Level 2 PRA meets Capability Category II requirements for this HLR.
Contributors to LER (LE-B): Most of the severe accident phenomena that can result in LERF in a large, dry PWR containment are explicitly addressed in the Call away Level 2 analysis. It is unclear as to whether containment isolation failure and high pressure melt ejection (HPME) are included. In order to meet the Category II requirements for this HLR, these two issues must be addressed and documented.
 
Identification of LER Sequences (LE-C): The Callaway Level 2 PRA meets Capability Category II requirements for this HLR.
Containment Evaluation (LE-D): The Callaway Level 2 PRA meets most of the Category II requirements for this HLR. There are three SRs which are not met to Category II requirements, two of which meet Category I. These areas are:  Conservative assessment of secondary si de isolation capability for all SGTR sequences (Cat I),  Conservative assessment of induced tube rupture sequences (Cat I),  Completeness of containment isolation analysis. The first two issues, while not meeting the requirements for Category II explicitly, could be addressed by including a sensitivity study to demonstrate the minimal impact of additional analysis. The issue of the containment isolation analysis needs to be addressed in order to meet the Category II requirements.
 
Containment Failure Quantification (LE-E): The Callaway Level 2 PRA meets Capability Category II requirements for this HLR.
LERF Quantification (LE-F): The Callaway Level 2 PRA meets most of the Category II requirements for this HLR. There is one SR which is not met to Category II requirements. This results from a lack of uncertainty analysis or sensitivity studies associated with the Level 2 analysis. As a minimum to meet the Category II requirements, the uncertainty in the Level 1 sequences
 
should be propagated and sensitivity studies developed and evaluated for the important LERF scenarios.
 
Documentation (LE-G): Overall, the documentation of the Callaway Level 2 PRA is good. The only portion of the Category II requirements that is not met is the requirement to document key assumptions and key sources of uncertainty, including results and insights from sensitivity studies. Once this analysis and documentation is completed the Category II requirements will be met.
Callaway PRA Gap Analysis Report 26 Table 14. Maintenance and Update (MU) HLR Summary GAP ANALYSIS REVIEW REPORT ELEMENT:  MAINTENANCE AND UPDATE (MU)
Inputs (MU-A): This requirement is met. APA-ZZ-00312.
Consistency with Plant (MU-B): This requirement is not met. APA-ZZ-00312 does not reference industry guidance and standards. There is no mention of a peer review requirement following a PRA upgrade. Although the documentation does not contain these requirements, it appears that the guidance is being followed. 
 
Impact of Pending Changes on PRA Application (MU-C): This requirement is met. APA-ZZ-00312.
Impact of PRA Changes on Previous RI Decisions (MU-D): This requirement is met. APA-ZZ-00312.
Code Control (MU-E): This requirement is met. APA-ZZ-00312.
Documentation (MU-F): This requirement is met. APA-ZZ-00312.
 
Callaway PRA Gap Analysis Report 27 3.2 External Events During Full Power The gap analysis of the External Events during full power identified several items necessary to meet the Supporting Requirements of ANSI
/ANS-58.21-2003. Most of the findings of this gap analysis concern the enhancement of the documentation of the PRA, as opposed to recommending changes in models, data or PRA methodology. 
 
Where additional items were identified as necessary to meet the supporting requirements, F&Os were generated during the gap analysis. The individual F&Os, in some cases, address more than one supporting requirement. The F&Os are presented in Appendices C-1 and C-2.
 
The high level requirements (HLR) from ANSI/ANS-58.21-2003 which are potentially applicable to the Callaway PRA are:
 
EXT - Probabilistic Risk Assessment for Other External Events: Requirements for Screening and Conservative Analysis ANA - Probabilistic Risk Assessment fo r Other External Events: Technical Requirements for Analysis SM - Seismic Margin Assessment: Technical Requirements WIND - High-Winds Probabilistic Risk Assessment: Technical Requirements FLOOD - External-Flooding Probabilistic Risk Assessment: Technical Requirements
 
The Callaway IPEEE was performed using the standard techniques recommended in NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities."  With the exception of the SMA and FIVE fire analysis, all other external events were screened from further quantitative evaluation based on conforman ce with the 1975 Standard Review Plan (SRP). While this screening criterion remains valid in the ANSI/ANS-58.21-2003 standard, in order to meet the requirements of the standard, additional documentation is required. The Callaway IPEEE documentation addresses, as directed in NUREG-1407, seismic events, internal fires, high winds, floods, and transportation and nearby facility accidents. However, NUREG-1407 also states that "-licensees should confirm that no other plant unique external events with poten tial severe accident vulnerability arc being excluded from the IPEEE." 
 
The documentation does not discuss the entire range of external events considered and screened. In order to fully meet the EXT HLRs, several items, primarily documentation related, need to be resolve
: d. The following list summarizes the four issues to be resolved:
 
Callaway PRA Gap Analysis Report 28 1. The ANSI/ANS standard requires a broader examination of external events than performed in the Callaway IPEEE. Th e list of external events requiring consideration from Appendix A of the st andard should be assessed and the reason for screening or evaluation should be documen ted. This review is not expected to result in identification of any additional events to be evaluated but is needed to show comprehensive coverage (EXT-A1).
: 2. Similarly, the search for any site-specifi c or plant-unique external events should be documented (EXT-A2).
: 3. External events which are screened based on conformance with the 1975 SRP should be examined to assess the impact of any significant changes (plant design, operation, nearby military or industrial facilities, nearby transportation, on-site storage or activities involving hazardous materials, or any other changes that could affect the original de sign considerations) or revisions to data (extreme local precipitation, high wind data, probable maximum flood, etc.) on the screening basis (EXT-C2).
: 4. Documentation of the screening process needs to be revised to provide the criteria/basis for the screening classifi cation of each external event (EXT-E1, EXT-E2, EXT-E3).
 
If the four EXT HLR issues are resolved and result in all events being screened similar to the IPEEE based on conformance to the 1975 SRP requirements, the ANA, WIND, and FLOOD HLRs are not applicable. If however, external events are identified which require additional analysis, this revised analysis needs to be structured to meet the applicable ANA, WIND, and FLOOD HLRs.
 
The remaining area regarding external events for discussion is the SMA. The SMA was found to be sufficient to meet the SM HLRs with two exceptions related to documentation:
: 1. Documentation that the required Soil-Structure interaction calculations were performed could not be located and must be provided in order to assure compliance with HLR SM-C4.
: 2. Documentation of the identification of major contributors to the uncertainty and inclusion of the peer review report are requir ed by HLR SM-H1.
Table 15 provides the numbers of F&Os that were identified for each of the analysis
 
areas for each level of significance as define d previously in Table 3. No F&Os were identified as "A/B", since it is believed that the update of the documentation will not result in any additional model revisions, however, the documentation needs to be completed prior to use of the PRA where external events may become an issue.
Callaway PRA Gap Analysis Report 29  Table 15. HLR F&O Summary HLR Total F&Os Level A/B Level C EXT 1 0 1 SM 2 0 2  Table 16 provides the text of the requirement and summarizes the assessment for each of the requirements which are not met to Category II.
Callaway PRA Gap Analysis Report Table 16:  Capability Category II Supporting Requirements Not Met HLR SR Category 2 Requirement Assessment 30  EXT A1 In the list of external events, INCLUDE as a minimum those that are enumerated in the PRA Review performed in accordance with guidance provided Procedures Guide, NUREG/CR-2300 [8] and NUREG-1407 [9] and examined in past studies in NUREG-1407 and used standard review plan for FSAR such as the NUREG-1150 analyses [10]. Appendix A contains the list adapted from to screen items. Appendix A contains additional external NUREG/CR-2300, and this list MAY be used as one acceptable way to meet this events which need to be addressed but should not result in any additional events being identified. This review needs to be documented.
EXT A2 SUPPLEMENT the list considered in (REQ. EXT-A1) with any sitespecific and plant-unique Not documented currently, needs to be documented at a external events.
minimum. NOTE EXT-A2: The purpose of this requirement is to ensure that an unusual type of event is not inadvertently omitted simply because it does not definitely fit into any of the list of events commonly considered and listed in the standard references in (REQ. EXT-A1).
Examples are possible detritus or zebra  mussels growth in the river affecting the intake (although they may be considered to have been included in the category "biological events"),  or possible shorelineslump effects (although they may be considered to have been included under "landslide or seiche").
EXT B1 Initial Preliminary Screening:  For screening out an external event, any one of the following This IPEEE submittal followed the guidance of NUREG-five screening criteria MAY be used as an acceptable basis:
1407 that required licensees to review the information Criterion 1: The event is of equal or lesser damage potential than the events for which the obtained on the plant design bases and any identified plant has been designed. This requires an evaluation of plant design bases in order to significant changes sinc e the operating license for estimate the resistance of plant structures and systems to a particular external event.
conformance with the 1975 Standard Review Plan Criterion 2: The event has a significantly lower mean frequency of occurrence than another criteria. It also required a confirmatory walkdown. As a event, taking into account the uncertainties in the estimates of both frequencies, and the minimum, the significant changes since the completion event could not result in worse consequences than the consequences from the other event.
of the IPEEE should be reevaluated.
Criterion 3: The event cannot occur close enough to the plant to affect it. This criterion must be applied taking into account the range of magnitudes of the event for the recurrence frequencies of interest.
Criterion 4: The event is included in the definition of another event.
Criterion 5: The event is slow in developing, and it can be demonstrated that there is sufficient time to eliminate the source of the threat or to provide an adequate response.
NOTE EXT-B1: These criteria are based on those found in the PRA Procedures Guide [8]. The use of these criteria minimizes the likelihood of omitting any signifi cant risk contributors while at the same time reducing the amount of detailed analysis required. In its guidance for the Individual Plant Examination of External Events (IPEEE) procedures and submittals
  [9,11], the U.S. Nuclear Regulatory Commission (NRC) staff applied these criteria for the population of operating nuclear power plants in the United States and concluded that only earthquakes, high winds, floods, transportation accidents, and nearbyfacility accidents required evaluation in the IPEEE. However, the NRC staff required that each licensee confirm that no plant-unique external events with the potential to cause severe accidents were being excluded from the IPEEE. In NUREG-1407 [9] , a progressive screening approach is recommended for evaluating high winds, floods, transportation accidents, and nearby-facility accidents in the IPEEE. This IPEEE guidance required all licensees to review the information obtained on the plant design bases and any identified significant changes since the operating license for conformance with the 1975 Standard Review Plan criteria. It  also requires a confirmatory walkdown.
 
Callaway PRA Gap Analysis Report Table 16(cont.):  Capability Categor y II Supporting Requirements Not Met HLR SR Category 2 Requirement Assessment 31  EXT B4 REVIEW any significant changes since the U.S. Nuclear Regulatory Commission operating No documentation was reviewed that indicates changes license was issued. In particular, CONSIDER in the review all of the following:  (1) military to facilities or transportation near Callaway has been and industrial facilities within 8 kilometers of the site; (2) on-site storage or other activities reviewed since the FSAR review in 1986.
involving hazardous materials; (3) nearby transportation;  (4) any other developments that could affect the origi nal design conditions.
NOTE EXT-B4: This short list [(1), (2), and (3)] is specifically identified because it represents the most common areas where a significant change might have occurr ed since the issuance of the operating license. The 8-kilometer distance is defined in the U.S. Nuclear Regulatory Commission Standard Review Plan [7].
EXT C2 BASE the estimation of the mean frequency and the other parameters of the design-basis Changes to the data due to the collection of experience hazard on state-of-the art hazard modeling and recent data (e.g., annual maximum wind since the IPEEE should be reviewed to determine any speeds at the site, aircraft activity in the vicinity, or precipitation data), or BOUND the impact to the analysis. Data for extreme local estimation for the purposes of a demonstrably conservative analysis. CONSIDER the precipitation analysis has not been updated since 1986 uncertainties in modeling and data in this hazard evaluation.
and does not include the heavy rains in the early 1990s.
NOTE EXT-C2: The spirit of a bounding (demonstrably conservative) analysis is such that it is acceptable to use demonstrably conservative modeling and data for the hazard evaluation EXT E1 In the documentation, MEET the general documentation requirements in Section 7.
The documentation is weak and inadequate for the current requirements.
EXT E2 For each external event that is screened out, DOCUMENT the approach used for the The documentation is weak and inadequate for the screening (preliminary screening or demonstrably conservative analysis) and the screening current requirements.
EXT E3 In the documentation, INCLUDE any engineering or other analysis performed to support the The documentation is weak and inadequate for the screening out of an external event.
current requirements.
SM C4 ENSURE that soil-structure interaction (SSI) analysis is median centered using median Soil-Structure interaction calculations. Documentation properties at soil strain levels corresponding to the review level earthquake input ground that the required Soil-Structure interaction calculations motion. CONDUCT at least three SSI analyses to investigate the effects on response due were performed could not be located.
to uncertainty in soil properties. ENSURE that one analysis is at the median low strain soil shear modulus and additional analyses at the median value times (1+ Cv) and the median value divided by (1 + Cv), where Cv is a factor that accounts for uncertainties in the SSI analysis and soil properties. If adequate soil investigation data are available, ESTABLISH the mean and standard deviation of the low strain shear modulus for every soil layer.
ESTABLISH the value of Cv so that it will cover the mean plus or minus one standard deviation for every layer. For the minimum value of Cv, USE 0.5. When insufficient data are available to address uncertainty in soil properties, USE Cv at a value not less than 1.0.
NOTE SM-C4: Further details about the basis for this requirement can be found in Ref. 25.
SM H1 MEET the general documentation requirements in Section 7.
This requirement is not met. The documentation requirements for uncertainty and inclusion of the peer review report for the seismic analysis do not exist.
 
Callaway PRA Gap Analysis Report 32  3.3 Low Power and Shutdown PRA with External Events The gap analysis of the Low Power and Shutdown PRA with External Events identified several items necessary to meet the high level requirements that are expected to be in the ANS Low Power and Shutdown PR A Standard. The findings of this gap analysis are evenly split between the enhancement of the documentation of the PRA, and the technical changes in models, data or PRA methodology. 
 
Where additional items were identified as necessary to meet the high level requirements, F&Os were generated during the gap analysis. Due to the lack of a draft standard for low power and shutdown PRA a single F&O was de veloped to indicate the areas thought at the present time to require an upgrade. The F&O is presented in Appendix D-1. Table 17 indicates the assessment of the Calla way Low Power and Shutdown model with respect to each of the requirements that ar e expected to be in the ANS Low Power and Shutdown PRA Standard.
Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD Plant Operational State (New PRA Element) High
 
Level Requirement #1 Using a structured, systematic process, the POS analysis shall identify and characterize a set of plant states during
 
low-power and shutdown operations that are representative of all the plant states not covered in the full-power PRA. IDENTIFY a repres entative set of LPSD evolutions (low-power and
 
shutdown evolutions or outage
 
types include refueling outage, drained-down maintenance outage, non-drained maintenance outage, hot shutdown) to be modeled. For each LPSD evolution, REVIEW plant specific documentation (such as Technical Specifications, normal shutdown, refueling and startup procedures)
 
and records (such as recent outage plans and records, maintenance
 
plans and records, operations data, trip. Capability Category I expected to be met.
 
The Callaway shutdown PRA started with a refueling outage.
Several of the Plant Operational States (POS's) occurring as
 
part of the refueling
 
outage are also states were maintenance is
 
conducted (e.g. hot
 
standby or cold
 
shutdown). A systematic review was
 
not conducted of all
 
outages in order to determine if any
 
additional plant states
 
should be added. For example, the current
 
model has no low Callaway PRA Gap Analysis Report 33 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD  For each LPSD evolutions, DEFINE the characteristics of each Plant Operational State. In characterizing the POSs of each LPSD evolution based on relevant and capable SSCs: ASSESS the ability of each system to mitigate transient and LOCA initiating events in each POS, preventing core damage and large early
 
release. For Capability Category II and III Interview appropriate plant
 
personnel.
power plant states.
 
Furthermore, plant operations personnel
 
were not interviewed as
 
part of the identification and
 
characterization of plant states. Plant Operational
 
State (New PRA Element) High
 
Level Requirement #2 The POS analysis shall justify any grouping of POSs to facilitate the practicality and efficiency of the PRA.
POSs with less limiting characteristics may be grouped with a state with more limiting
 
characteristics. If Plant Operational States from a LPSD evolution are combined into groups to facilitate LPSD tasks the
 
grouping process and definition of
 
final POS conditions shall ensure that the most severe or constraining characteristics (with respect to CD
 
or LER) of any group are chosen for the combined group. GROUP Plant Operational States  Define unique POSs with different plant response impacts. For Category I, GROUP initiating events that are activity-based. For Category II and III, CREATE separate POSs for time periods
 
involving activities (operational or maintenance) that could lead to initiating events that are "demand-Capability Category II expected to be met.
Callaway PRA Gap Analysis Report 34 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD based". REVIEW known plans for future refueling outage (e.g. the next) to ensure the grouping remains valid. Plant Operational
 
State (New PRA Element) High
 
Level Requirement #3 The POS analysis shall determine the frequency, duration, and associated
 
fraction of a year, along with the representative decay heat levels, associated with each POS. DETERMINE the average frequency and duration of LPSD evolutions based on a review of applicable plant specific records. Within the LPSD evolutions selected DETERMINE the average duration and time after shutdown for each Plant Operational State. COMBINE the durations for the subsumed POSs for the duration of the group. REVIEW plans to ensure the quantification of decay heat and durations remains valid. DETERMINE the decay heat level associated with each POS for use in defining and applying success criteria and the timing for operator actions. Capability Category I expected to be met.
 
Frequency, duration, and time after
 
shutdown data in the
 
Callaway low power
 
and shutdown PRA
 
model are based on an
 
outage schedule (the
 
last one or the next one) and did not consider adding/averaging all plant states. . Plant Operational State (New PRA Element) High
 
Level Requirement #4 The POS analysis shall be documented in a manner that facilitates PRA applications, updates, and peer review by describing the
 
processes that were followed to identify, group, screen the POS list and to model
 
and quantify the POS frequencies, durations, and fraction of the year with the assumptions and bases stated. Document Identification and Characterization of LPSD Capability Category II expected to be met.
Callaway PRA Gap Analysis Report 35 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD evolutions and Plant Operational States  Document Grouping of Plant Operational States  Document Quantification of Plant Operational States  Document key assumption  Document interfaces with other PRA tasks HLR-IE-A The initiating event analysis shall provide a reasonably complete identification of initiating events for all identified Plant
 
operational states. Special emphasis is placed on review of plant evolutions (e.g., reducing water level to midloop for PWRs and hydro testing for BWRs) and maintenance activities (including plant realignment in preparation for maintenance) during shutdown POSs to identify
 
initiating events unique to these
 
operating conditions. For a LPSD analysis it is necessary to define what is meant by "normal" plant operation for each POS. Once normal plant operation
 
for a POS is defined, events are identified which challenge that
 
operation. For ASME requirement IE-A5, it is important to review experience from all POSs.
Capability Category II expected to be met (conditionally) assuming there are no
 
changes to the POS definitions based on
 
comments above (specifically for IE-A5 the experience from all POSs is to be reviewed,HLR-IE-B The initiating event analysis shall group the initiating events so that events in the same group have similar mitigation requirements (i.e., the requirements for
 
most events in the group are less restrictive Capability Category II expected to be met.
Callaway PRA Gap Analysis Report 36 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD than the limiting mitigation requirements for the group) to facilitate an efficient but realistic estimation of figures-of-merit (e.g., CDF). (Note that this grouping must
 
be done in coordination for how the POSs
 
are grouped, in which case the grouping combinations shall be delineated.)  Care must be taken in grouping initiating events for LPSD because of the variety of system
 
configurations that are entered.
 
Identifying the "bounding" or "worst case" could require a
 
careful review of plant operational
 
practices. HLR-IE-C The initiating event analysis shall estimate the annual frequency of each initiating
 
event or initiating event group. If the PRA is being used for some purpose other than calculating annual average risk, then it may
 
not be necessary to account for the fraction of time the plant is in a particular POS. The decision of
 
whether to account for such a
 
fraction will be dependent upon the
 
application. For requirement IE-C4, just as with the ASME Standard, the numerical screening criteria are appropriate
 
for an annual average risk
 
calculation. If the PRA is to be
 
used for other types of analyses, then it is possible that different numerical criteria might need to be developed. Development and
 
defense of such criteria would be a
 
unique obligation of such an analysis. When fault trees are used to Capability Category I or II expected to be met (depending on resolution of this
 
issue). The Callaway
 
low power and
 
shutdown PRA was made for "some
 
purpose other than calculating the average
 
annual risk" Callaway PRA Gap Analysis Report 37 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD quantify support system initiating events, it is important to account for the amount of time the support system can cause the initiating
 
event. For requirement IE-C12, ASME discussion applies during low-power and hot standby conditions
 
and is not applicable during
 
shutdown conditions. HLR-IE-D The initiating event analysis shall be documented in a manner that facilitates
 
PRA applications, upgrades, and peer
 
review by describing the processes that
 
were followed to select, group, and screen the initiating event list and to model and quantify the initiating event frequencies, with assumptions and bases stated. For ASME IE-D3 Item (g) does not apply to shutdown conditions.
Capability Category II expected to be met. HLR-AS-A The accident sequence analysis shall describe the plant-specific scenarios that can lead to core damage following each initiating event or initiating event category.
These scenarios shall address system
 
responses and operator actions, including
 
recovery actions that support the key
 
safety functions necessary to prevent core damage. Capability Category II expected to be met. HLR-AS-B Dependencies that can impact the ability of the mitigating systems to operate and
 
function shall be addressed. For example, identify, the mitigating systems impacted by the occurrences of the initiator and the event of the impact (eg.
 
dependency between an operator
 
induced initiating event and recovery events especially at Capability Category I expected since another
 
plant's data was used to assess the viability of recirculation from the containment sump.
 
Callaway PRA Gap Analysis Report 38 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD shutdown)  For each critical safety function, IDENTIFY its dependence on the success or failure of preceding functions. INCLUDE the impact on accident progression. For example: Operator control of "fill & spill" in a PWR. In some cases, operators are
 
directed to control the rate of feed to match boil-off. Success of this action has two ramifications:  (1) it may avoid the need to
 
go to recirculation and (2) it adds heat to the containment that may require containment heat removal systems to
 
operate. Failure to control flow (i.e., over
 
feeding), leads to a need for recirculation, but may not require additional heat removal capability beyond the recirculation system  For example, systems that might not be available at the start of an accident due to the plant's operational state could become
 
available during the progression from initiating event to core damage. (RCIC is initially
 
unavailable during Cold Shutdown due to the lack of steam). An example of a phenomenological condition that could affect accident progression is viability of recirculation from the containment. For shutdown, include the dependence between the initiator
 
and subsequent recovery events. For example:  An operator-induced loss of RHR followed by recovery of RHR due to the time phased recovery applicable to the plant operational state being modeled (also
 
see HR-H3).
Callaway PRA Gap Analysis Report 39 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD HLR-AS-C Documentation shall be performed in a manner that facilitates peer review, as well
 
as future upgrades a nd applications of the PRA by describing the processes that were
 
used, and providing details of the assumptions made and their bases.
Capability Category II expected to be met. HLR-SC-A The overall success criteria for the PRA and the system, structure, component and human action success criteria used in the
 
PRA shall be defined and justified, and shall be consistent with the features, procedures, and opera ting philosophy of the plant.
Capability Category I expected to be met.
The current low power
 
and shutdown success
 
criteria have been
 
developed by extrapolating full
 
power data. HLR-SC-B The thermal/hydrau lic, structural and other supporting engineering bases shall be
 
capable of providing success criteria and event timing sufficient for quantification of
 
CDF, and LERF, determination of the relative impact of success criteria on SSC and human action importance, and the impact of uncertainty on this determination. Full-power success criteria are not always bounding for LPSD
 
conditions Capability Category I expected to be met.
The current low power
 
and shutdown success
 
criteria have been
 
developed by extrapolating full
 
power data. Plant-specific analyses were not available. HLR-SC-C Documentation shall be performed in a manner that facilitates peer review, as well
 
as future upgrades a nd applications of the PRA, by describing the processes that were
 
used, and providing details of the assumptions made and their bases.
HLR-SY-A The systems analysis shall provide a reasonably complete treatment of the causes of system failure and unavailability modes represented in the initiating events
 
analysis and sequence definition. For LPSD states, look for outage-specific planning guides, temporary Capability Category I expected to be met.
 
Walkdowns need to be documented, and the shutdown system Callaway PRA Gap Analysis Report 40 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD system alignments, etc. For LPSD states, past outages should be reviewed to determine unique system operating states (e.g., temporary power or cooling)
 
that should be included in sequence
 
models. Additional systems walkdowns would be necessary for systems and alignments not modeled in the full-power PRA. Systems that perform similar functions during LPSD and full-power conditions may not need additional walkdowns if included in the full-power PRA. During LPSD conditions, additional human failure events (HFEs) are expected due to the
 
different POSs. The capability to remove differing sets of SSCs for maintenance and testing is a unique characteristic of
 
shutdown conditions. In some shutdown cases where relatively long times are available before core damage, more credit for restoration of equipment could
 
be feasible than is true for at-power
 
models. models need to be confirmed that they are
 
current (e.g. that system fault tree changes to the full power model may also
 
apply during shutdown. HLR-SY-B The systems analysis shall provide a reasonably complete treatment of common cause failures, intersystem and intra-system dependencies, as well as dependencies on Plant Operational States. For LPSD analyses, actuation signals sometimes vary by POS or might not be present.
Capability Category II expected to be met.
HLR-SY-C The systems analysis shall be documented in a manner that facilitates PRA Capability Category II Callaway PRA Gap Analysis Report 41 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD applications, upgrades, and peer review by describing the processes that were followed to select, to model, and to quantify the system unavailability.
Assumptions and bases shall be stated. expected to be met.
HLR-HR-A A systematic process shall be used to identify those specific routine activities which, if not completed correctly, may impact the availability of equipment necessary to perform system function
 
modeling in the PRA. Normal operational or standby conditions vary by POS. However, it is the responsibility of the analyst to identify activities based on the requirements of HR-A, not based on another PRA (i.e., not based on the full-power PRA). Infrequent maintenance configurations and procedures are worthy of more careful
 
evaluation. These would include
 
procedures that have not gone through the long in-service use of EOPs, normal maintenance procedures, or outage
 
procedures that have been used for many
 
outages. Review of LPSD operational events can assist the analyst identify activities and alignments that have led to HFEs. Same as ASME Standard, extended to account for the fact that many responses are manual during LPSD
 
conditions. As a special case for requirement HR-A3, note that, during LPSD
 
conditions, pre-init iator activities can be important when they impact the only available train.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model
 
human reliability events occurring
 
before the initiating
 
events. HLR-HR-B Screening of activities that need not be None of the criteria Callaway PRA Gap Analysis Report 42 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD addressed explicitly in the model shall be based on an assessment of how plant-specific operational practices limit the
 
likelihood of errors in such activities. Screening can only be done on a POS by POS basis, i.e., the screening criteria are met for each particular POS, for the activity to be screened. In each POS, the
 
previous and current sequence of
 
events are relevant. As a special case of this requirement, note that, during LPSD conditions, pre-initiator activities can be important when they impact the only available
 
train. are met since the Low Power and Shutdown
 
PRA does not model
 
human reliability events occurring
 
before the initiating
 
events. HLR-HR-C For each activity that is not screened, an appropriate human failure event (HFE) shall be defined to characterize the impact
 
of the failure as an unavailability of a component, system, or function modeled in
 
the PRA. AMSE Requirement HR-C3 is extended to account for the fact that many responses are manual
 
during LPSD and recognizing that miscalibration can be especially troublesome if only one train of equipment is available (e.g., it can lead to so-called error of commission in stopping running equipment).
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model
 
human reliability events occurring
 
before the initiating
 
events. HLR-HR-D The assessment of the probabilities of the pre-initiator human failure events shall be performed by using a systematic process that addresses the plant-specific and activity-specific influences on human performance.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model
 
human reliability events occurring
 
before the initiating Callaway PRA Gap Analysis Report 43 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD  While standard HRA methods may be appropriate for pre-initiator events during LPSD, some adaptation of the methods may be
 
required due to unusual conditions
 
existing during LPSD. In particular consider the possible impacts of:  Dependence among the many human actions occurring during LPSD  Highly variable time frame for returning equipment to service and for detection of
 
errors  Changing configurations (POS and maintenance) Many seldom-used maintenance procedures are carried out. Administrative cont rols during LPSD include control of additional conditions than at power; e.g., RCS configuration changes and extensive maintenance activities. Uncertainties in HEPs for some pre-initiator HFEs may be broad, for the reasons identified in the commentary to
 
HR-D1. events. HLR-HR-E A systematic review of the relevant procedures shall be used to identify the set
 
of operator responses required for each of
 
the accident sequences. As reviews are specialized to LPSD conditions:  Reviews can only be done on a POS by POS basis, as conditions and cues to operators can vary widely among POS's  Procedures applicable during LPSD have much less practical verification than at power procedures; be sure to search for
 
traps and discuss with operators and Capability Category I expected to be met. No operator interviews or
 
talk-throughs however
 
were used to identify human failure events.
Callaway PRA Gap Analysis Report 44 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD maintenance personnel Consider the fact that personnel are less familiar with LPSD procedures  Talk-throughs are especially important, because use of control room simulators for shutdown scenarios is limited. Use simulators for scenarios that
 
move quickly enough for
 
practical study and to
 
explore potential difficulties in identified scenarios. HLR-HR-F Human failure events shall be defined that represent the impact of not properly performing the required responses, consistent with the structure and level of detail of the accident sequences. This can only be done on a POS by POS basis, as
 
conditions and cues to
 
operators can vary widely among POSs.
Capability Category II expected to be met.
HLR-HR-G The assessment of the probabilities of the post-initiator HFEs shall be performed
 
using a well defined and self-consistent process that addresses the plant-specific and scenario-specific influences on human performance, and addresses potential dependencies between human failure events in the same accident sequence. Most methods require adaptation to handle the special LPSD
 
considerations tabulated below. Many methods can
 
be adapted to address such issues, even when they have
 
no existing guidelines for Capability Category I expected to be met.
The current Callaway
 
HRA does not have a
 
dependency analysis.
 
Callaway PRA Gap Analysis Report 45 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD their resolution. Newer methods are structured to
 
consider these and other
 
aspects of context. Most detection and nearly all actions are manual (especially in PWRs)  Many initiating events are so-called errors of commission; when few events are available, quantification relies on
 
Bayesian analysis and expert judgment  Dependence among human actions is affected by process activities (moving from POS to POS), maintenance
 
activities, operator-induced initiating events, operational response actions, and recovery actions  Several  correlated performance shaping factors can be involved  Impacts of instrument failures and control system failures on operator performance can be very important  Highly variable time frames for detection and action from minutes to hours to days and weeks (for similar actions, they may occur at various times/conditions in the outage)  Data imbedded in some HRA methods include unstated assumptions about the nature of plant conditions, validity of situation model, extent of EOP (detail, applicability), extent of training, availability of automatic detection  Changing configurations (POS and maintenance) mean that operators are less secure in their situation model  Many seldom-used procedures are carried out  EOPs are less thoroughly tested and exercised; they can be less applicable Callaway PRA Gap Analysis Report 46 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD to specific POS/Maintenance Configuration conditions  Pre-initiators can cause problems with post-initiator restoration The ASME standard did not address all things that will have post-maintenance /
 
restoration test, but because of delay in
 
testing during LPSD co nditions, they could be unavailable for prolonged periods following maintenance. Therefore, administrative practice is important to the
 
evaluation for LPSD conditions. Uncertainties in HEPs for many post-initiator HFEs in all POSs will be broad, for the reasons identified
 
in the note above HLR-HR-H Recovery actions (at the cutset or scenario level) shall be modeled only if it has been demonstrated that the action is plausible and feasible for those scenarios to which they are applied. Estim ates of probabilities of failure shall address dependency on prior human failures in the scenario. The requirement for a formal procedure can be relaxed for scenarios late in the outage, with very long time for recovery. Note that similar recovery actions can have very different PSFs from POS
 
to POS. Include dependence with any human action causing the initiating event. Beware of the increased
 
chance of dependency as described in the HR-G bullets.
Capability Category I expected to be met.
The current Callaway
 
HRA does not have a
 
dependency analysis.
HLR-HR-I The HRA shall be documented in a manner that facilitates PRA applications, upgrades
 
and peer review by describing the Capability Category I expected to be met.
Callaway PRA Gap Analysis Report 47 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD processes that were used, and providing details of the assumptions made and their
 
bases. Include dependence with any human action causing the initiating event. Beware of the increased
 
chance of dependency as described
 
in the NOTE at HR-G.
HLR-DA-A Each parameter shall be clearly defined in terms of the logic model, basic event boundary, and the model used to evaluate
 
event probability. One common source for many data analysis methods and techniques is:
Atwood, C.L., J.L. LaChance, H.F. Martz, D.J. Anderson, M. Englehardt, D.
Whitehead, and T. Wheeler, Handbook of Parameter Estimation for Probabilistic Risk Assessment , NUREG/CR-6823, SAND2003-3348P, U.S. Nuclear Regulatory Commission, Washington, DC, September 2003.
It provides advice on selecting appropriate models. Capability Category II expected to be met. HLR-DA-B The rationale for grouping components into a homogeneous population for the purposes of parameter estimation shall consider both the design, environmental, and service conditions of the components
 
in the as-built and as-operated plant. One source that provides a range of statistical tests to complement engineering characteristics for
 
grouping data is the Handbook of Parameter Estimation for Probabilistic Risk Assessment. Capability Category II expected to be met. HLR-DA-C Generic parameter estimates shall be chosen and plant-specific data shall be collected consistent with the parameter Capability Category I expected to be met
 
since the new Callaway PRA Gap Analysis Report 48 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD definitions of HLR A and the grouping rationale of HLR B. This can only be done on a POS-specific basis. Use of the same estimates in multiple POS requires
 
care and justification. One source for shutdown-related initiating event data, see EPRI-TR-113051 (Reference 12). Generally equipment failure data are no different during shutdown
 
than during operations. However, several factors are important, when considering using normal failure
 
data. The following factors can affect all parameter estimates, not just equipment failure rates:  Maintenance, construction, and installation activities can be the direct cause of failure (e.g., draining the RCS can lead to pump cavitation and failure, calibration of pressure instruments can
 
cause MOVs to fail closed, etc.)  Maintenance, construction, and installation activities can be the cause of direct physical damage to supposedly unaffected components  Satisfactorily conducted post-maintenance, construction, and installation tests are important to the performance of all components  Long outages with equipment far outside normal operating conditions and test practice can affect successful performance  Systems analysis models can account for different test and operating practice during the outage  Parameter estimates are affected by supporting requirement to collect timeline data was not accomplished
 
over a wide range of
 
outages.
Callaway PRA Gap Analysis Report 49 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD special configuration (RCS and maintenance) that occur during
 
LPSD  Caution is required for ASME Requirement DA-C3, because changes in outage practice are
 
occurring. Refueling occurs less often, outages are getting much
 
shorter, some forced outages are far
 
less frequent, and planning is improving. The analyst is faced with playing off the value of
 
historical data against its current relevance. He tempers new plans with knowledge of past problems. 
 
Generalized Bayesian methods and expert elicitation techniques may
 
be needed. The NRC's Handbook of Parameter Estimation for
 
Probabilistic Risk Assessment provides some useful "how to" guidance for such situations. For ASME Requirements DA-C6, the counts may need to be
 
specialized to LPSD conditions and even to specific shutdown maintenance conditions. The timing information may need to be specialized to LPSD
 
conditions and even to specific
 
shutdown maintenance and POS
 
conditions. ASME Requirements DA-C12  will be modified to account for LPSD conditions. Note that out of service unavailability data are very different for shutdown conditions, Callaway PRA Gap Analysis Report 50 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD primarily because  Equipment unavailabilities are correlated by planned maintenance configurations; they are no longer
 
independent as for corrective maintenance at-power  Equipment repair is more a function of outage schedule and outage management than actual time required to complete repair  Outage times may be much longer than at power [i.e., there may be no LCO and outage management considerations may defer
 
restoration to service; thus data for outage time is often be based on
 
policy and outage practice, rather
 
than past experience (full-power
 
data are irrelevant to such cases)]  For ASME Requirement DC-C14 repair data can be very different for shutdown conditions, primarily because the equipment repair is
 
more a function of outage schedule and outage management than actual time. Or Outage times may be much longer than at power [i.e.,
there may be no LCO and outage management considerations may
 
defer restoration to service; thus data for outage time can often be
 
based on policy and outage practice, rather than past experience (full-power data are irrelevant to such cases)]. Realistic assessment of repair/ restoration depends on a realistic assessment
 
of LPSD conditions on a POS-by
 
POS basis. Cognizance of outage
 
planning considerations is Callaway PRA Gap Analysis Report 51 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD essential. For ASME Requirement DA-C15, other planned maintenance activities can have a major impact
 
on recovery of off-site power
 
Outage and POS-specific corrections may be required. NEW Supporting Requirement - COLLECT plant-specific outage timeline data, accounting for POS start time and duration and special maintenance configurations for each LPSD evolution (see also
 
POS-C1, C2). This new supporting to provide new data not required for full-power conditions. It is
 
a function of the outage plan and uncertainties in the plant staff's ability to meet that plan. Thus data collection
 
includes elicitation of expert information. Uncertainty information can be developed from time lines of previous outages combined with expert elicitation. In such cases, the line between data gathering and parameter estimation (DA-D) gets a bit
 
fuzzy. All indications are that such data
 
are very plant-specific and vary with time, especially in recent years. Data may be collected and assembled differently for average risk calculations and outage-specific assessments. HLR-DA-D The parameter estimates shall be based on relevant generic industr y or plant specific evidence. Where feasible, generic and plant specific evidence shall be integrated using acceptable methods to obtain plant specific parameter estimates. Parameter estimates for the important parameters shall be accompanied by a characterization
 
of the uncertainty.
Capability Category I expected to be met. Plant-specific loss of offsite power initiating
 
event frequency and
 
diesel generator data
 
during shutdown
 
should be considered
 
and if not used, then Callaway PRA Gap Analysis Report 52 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD  USNRC PRA Data Handbook provides additional guidance. For ASME Requirement DA-D6, note that equipment common cause
 
failure data is a difficult area for
 
LPSD conditions. Many of the
 
underlying causes of common cause failure can be affected by physical activities during outages, changes in plant conditions, and outside personnel having access to plant equipment. Full-power common cause data may be applicable to the POS and maintenance activities during each phase of LPSD. However, adjustments are often necessary. Cognizance of the many controls the plant has in place to keep workers from interacting with the "protected train" helps ensure that CCF probabilities are realistic .
Good points and probably a better area to focus data assessment on rather than changing equipment failure rates with each
 
POS. Are there any references where this has been performed before?
explain why not used. HLR-DA-E Documentation shall be performed in a manner that facilitates peer review, as well
 
as future upgrades a nd applications of the PRA by describing the processes that were
 
used, and providing details of the assumptions made and their bases. The documentation requirements ensure there is a record of how the special conditions that exist during
 
LPSD are accounted for in the
 
analysis. They provi de a picture of the POS by POS differences in the data and parameter estimation.
Capability Category II expected to be met. HLR-IF-A Different flood areas of the plant and the None of the criteria Callaway PRA Gap Analysis Report 53 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD SSCs located within such areas SHALL be identified. The collection of data for LPSD includes verification of temporary alignments for the specific outage, or outages being modeled in the average LPSD model. For example, opened/impaired hazard doors, opened covering drains, additional
 
sources of floods. For outage work activities with potential for temporary impairment of flood
 
doors/barriers and potential for maintenance-induced floods, risk management actions are required and may include limiting the allowed impairment time (AIT) of flood barriers and using compensatory measures and contingency
 
plans. Walkdown for shutdown POSs might be needed if configuration differs from full-power. are met since the Low Power and Shutdown
 
PRA does not model
 
internal flooding.
HLR-IF-B The potential flood sources in the plant and their associated flooding mechanisms SHALL be identified. Maintenance-induced events could be more critical during LPSD.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model
 
internal flooding.
HLR-IF-C The potential flooding scenarios SHALL be developed for each flood source by
 
identifying the propagation path(s) of the water and the affected SSCs. Automatic responses likely to differ from full power; examples of
 
flood scenarios originating when
 
no one is watching (filling is going
 
on and workers are on break) are
 
apparent in flood data None of the criteria are met since the Low Power and Shutdown
 
PRA does not model
 
internal flooding.
HLR-IF-D Flooding-induced initiating events SHALL be identified and their frequencies None of the criteria are met since the Low Callaway PRA Gap Analysis Report 54 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD estimated. Databases such as INPO/EPIX, lessons learned from industry outages, and lessons learned from
 
self-assessment of previous outages
 
are good sources for identifications
 
of flood-induced initiating events
 
and their frequencies. Power and Shutdown PRA does not model
 
internal flooding.
HLR-IF-E Flood-induced accident sequences SHALL be quantified.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model
 
internal flooding.
HLR-IF-F The internal flooding analysis SHALL be documented consistent with the applicable supporting requirements.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model
 
internal flooding.
HLR-QU-A The level 1 quantification shall quantify core damage frequency and shall support
 
the quantification of LERF. Quantification is to be performed separately by POS groups and then aggregated.
Capability Category II expected to be met. HLR-QU-B The quantificati on shall use appropriate models and codes, and shall account for method-specific limitations and features.
Capability Category II expected to be met. HLR-QU-C Model quantification shall determine that all identified dependencies are addressed
 
appropriately.
Capability Category II expected to be met. HLR-QU-D The quantification results shall be reviewed and significant contributors to
 
CDF, such as Plant Operational States, initiating events, acci dent sequences, basic events (equipment unavailabilites and human failure events) shall be identified.
 
The results shall be traceable to the inputs and assumptions made in the PRA.
Capability Category I expected to be met
 
since results were reviewed and
 
significant contributors
 
were not identified.
Callaway PRA Gap Analysis Report 55 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD HLR-QU-E Uncertainties in the PRA results shall be characterized. Key sources of model
 
uncertainty and key assumptions shall be identified, and their potential impact on the
 
results understood.
Capability Category I expected to be met
 
since uncertainty was
 
not conducted. HLR-QU-F Documentation shall be performed in a manner that facilitates peer review, as well
 
as future upgrades a nd applications of the PRA by describing the processes that were
 
used, and providing details of the assumptions made and their bases.
Capability Category II expected to be met.
HLR-LE-A Plant Damage Analysis Core damage sequences shall be grouped into plant damage states based on their accident progression attributes. Some examples may not apply to all POSs (e.g., high RCS pressure is not possible with the reactor vented; containment open). An example of ASME Requirement LE-A1 is time after shutdown None of the criteria are met since the Low Power and Shutdown
 
PRA does not model large early release.
HLR-LE-B Accident Progression
 
Analysis The accident progression analysis shall include an evaluation of the credible contributors (e.g., phenomena, equipment failures, human actions) to a large early
 
release. The potential for air oxidation and its affect on releases of radionuclides, such as ruthenium, is being researched. Therefore this
 
issue is beyond the state-of-the-art and is out of the scope of this
 
standard, at this point. For ASME Requirements HLR-LE-B2 Capability Category II and III: DETERMINE the containment challenges (e.g., temperature, pressure loads, debris impingement) resulting from contributors None of the criteria are met since the Low Power and Shutdown
 
PRA does not model large early release.
 
Callaway PRA Gap Analysis Report 56 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD identified in LE-B1 in a realistic manner. Conservative treatment or a combination of conservative and realistic treatment is used for nonsignificant phenomena.
CONSIDER differential pressure loadings
 
on the RCS and vesse l support capabilities during vessel failure and blowdown, in
 
order to address whether RCS motions may impact containment integrity. USE plant-specific containment thermal hydraulic analyses to model containment
 
and RPV/RCS response under severe accident progression. The thermal/hydraulic computer codes used are
 
developed, validated, and verified in sufficient detail to analyze the phenomena
 
of interest, are applicable in the pressure, temperature, and flow range of interest, and are utilized by qualified trained users
 
who have an understanding of the code and its limitations. HLR-LE-C The accident progression analysis shall include identification of those sequences that would result in a large early release. For Capability Category II, the criteria in Appendix A of NUREG/CR-6595, Rev. 1, for LER provide an acceptable alternative during transition from full power
 
operation to shutdown operation. 
 
For shutdown operation, CONSIDER radionuclide decay.
For transition from shutdown
 
operation to full power operation, ACCOUNT for core changes
 
during the outage. These screening criteria may be applied to individual core damage sequences, as well as entire plant damage states (PDSs) or POSs, None of the criteria are met since the Low Power and Shutdown
 
PRA does not model large early release.
 
Callaway PRA Gap Analysis Report 57 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD provided the criteria can be shown to apply to the entire PDS or POS.
HLR-LE-D The accident progression analysis shall include an evaluation of the containment structural capability for those containment challenges that would result in a large early release. The containment may be open or have a reduced pressure capability
 
during shutdown. The calculation of containment capacity will be associated with the capacity of temporary closures for certain
 
POSs. TREAT thermally-induced SG tube rupture in a conservative manner. ASME Requirement LE-D6 is the same as ASME-2005 except for the addition of the need to consider operator action and closure time for containment status during
 
shutdown POSs.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model large early release.
HLR-LE-E LERF Quantification The frequency of different containment failure modes leading to a large early
 
release shall be quantified and aggregated. For ASME Requirement LE-E3 Capability Category II, include as
 
LERF contributors potential large early release (LER) sequences identified from the results of LE-C
 
except those LER sequences
 
justified as non-LERF contributors
 
in LE-C1. For ASME Requirement LE-E3 Capability Category III, include as LERF contributors potential large early release (LER) sequences from the results of LE-C.
None of the criteria are met since the Low Power and Shutdown PRA does not model large early release.
 
Callaway PRA Gap Analysis Report 58 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD HLR-LE-F The quantification results shall be reviewed and significant contributors to
 
LERF, such as plant damage states, containment challenges and failure modes, shall be identified. Sources of uncertainty shall be identified and their impact
 
characterized. For ASME Requirement LE-F1a Capability Category II and III: PERFORM a quantitative evaluation to determine the relative contribution to LERF from plant damage states and significant LERF contributors from Table
 
4.5.9-3. None of the criteria are met since the Low Power and Shutdown
 
PRA does not model large early release.
HLR-LE-G Documentation  The LERF analysis shall be documented consistent with the applicable supporting requirements. New Supporting Requirement:
LE-G7 Document core damage sequences, plant damage states, and POSs screened and the technical justification.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model large early release.
HLR-EXT-A Screening and Bounding Analysis The LPSD external events analysis shall include screening analysis of external events that are unimpor tant at the site, and may also include bounding analysis (demonstrably conservative analysis) for some of these events.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model external events.
HLR-EXT-B Hazard Analysis The LPSD external events analysis shall include a hazard analysis.
None of the criteria are met since the Low Power and Shutdown PRA does not model external events.
HLR- EXT-C Plant Operational State (POS) The LPSD external events analysis shall include the identification of each relevant Plant Operational State (POS).
None of the criteria are met since the Low Power and Shutdown Callaway PRA Gap Analysis Report 59 Table 17: Assessment of Callaway Low Power and Shutdown PRA Model with Respect to Expected Requirements Designator High Level Requirement Gap Between Callaway and STD  PRA does not model external events.
HLR- EXT-D Initiating Events  The LPSD external events analysis shall include the identification of the character of all initiating events caused by the
 
hazard. None of the criteria are met since the Low Power and Shutdown
 
PRA does not model external events.
HLR- EXT-E List of SSCs The LPSD external events analysis shall include the identification of the relevant list of SSCs.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model external events.
HLR- EXT-F Fragility Analysis The LPSD external events analysis shall include fragility analysis for those SSCs identified as relevant.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model external events.
HLR- EXT-G Systems Analysis  The LPSD external events analysis shall include a systems analysis.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model external events.
HLR- EXT-H Integration The LPSD external events analysis shall include integration to produce CDF and
 
LERF. None of the criteria are met since the Low Power and Shutdown
 
PRA does not model external events.
HLR- EXT-I Documentation The LPSD external events PRA analysis shall be documented in a manner that
 
facilitates applying the PRA and updating
 
it, and that enables peer review.
None of the criteria are met since the Low Power and Shutdown
 
PRA does not model external events.
 
===3.4 Internal===
Fire During Full Power As indicated in Section 2.4, the Callaway Fire Analysis is not included in the gap analysis review.
Callaway PRA Gap Analysis Report 60  4.0  Recommendations The gap analysis identified a number of items necessary for the internal events PRA to meet the Supporting Requirement of ASME RA-Sb-2005. Most of the findings of this gap analysis concern the enhancement of the documentation of the PRA, as opposed to recommending changes in models, data or PRA methodology. Many of the findings are indicative of the age of the PRA and the documentation requirements at that time. Many of the subtasks were individually documente d in separate calculation packages during performance of the IPE. 
 
The level of day-to-day and enhanced usage desired of today's PRA models was not envisioned at the time of the Callaway PRA development. The need for readily accessible documentation has significantly increased as the model usage and applications have become more sophisticated. Additionally, evaluation code limits at the time of the Callaway PRA development provided constraints on the combined solution and aggregation of the entire internal events PRA results. Since that time significant advances have been made to the PRA evaluation codes which should be applied to make the quantification and reporting of results more automated and easier to use. As a result of all of these factors, the AmerenUE staff can significantly increase the efficiency when using the Callaway model and ensure a model which meets the Capability Category II requirements of ASME RA-Sb-2005 by resolution of the findings of this gap analysis.
Table 18 provides a consolidated list of the recommended modificati ons to the Callaway internal events PRA model. The fifty-eight F&Os are grouped into logical categories to form thirteen tasks. The specific SRs and F&O addressed by each of the identified tasks are identified and a rough estimate of the level of effort is provided in the table.
The gap analysis identified several items necessary for the external events analysis to meet the applicable Supporting Requirem ent of ANSI/ANS-58.21-2003. Most of the findings of this gap analysis concern the enhancement of the documentation of the identification and screening of external initiati ng events, as opposed to recommending changes in models, data or PRA methodology. These findings are more indicative of the age of the IPEEE and the documentation requirements at that time than of any deficiency. 
 
The gap analysis for the low power and shutdown PRA identified numerous items however due to the lack of a draft standard caution should be taken with respect to upgrades of the model and documentation. In contrast to the F&Os generated for the internal events PRA, the F&Os generated for the external events analysis and the low
 
power and shutdown PRA evaluations are independent and not amenable to additional grouping and are included individually in Table 18. The specific SRs and F&O addressed by each of the identified tasks ar e identified and a rough estimate of the level of effort is provided in the table. While it is not expected that a ny additional quantitative analysis will be required for the external events analysis, the documentation effort associated with satisfying the EXT HLRs may result in identifying additional analyses to satisfy the ANA, WIND, and FLOOD HLRs.     
 
Callaway PRA Gap Analysis Report 61 Table 18 - Callaway PRA R ecommended Modifications Effort (MW)
Task No. SRs Recommended Modifications Cat II Met Doc ModelFO_No LowerUpper 1 IE-A1, IE-A3a, IE-A6, IE-D1, IE-D2, IE-D3, IE-A4, IE-A5, IE-A7, IE-C2, IE-C10 Documentation upgrade for Initiating Event Analysis - Combine the multiple calculation packages currently documenting the IE analysis into a single coherent calculation using the list in SR IE-D2 as a guide. If possible, provide a section which summarizes the assumptions and sources of uncertainty. Additions include: 1) Document FMEAs performed to identify SSIEs and the resolution of each systems status as SSIE, 2) Document basis for excluding events which occur at non-power, 3) Document the review of operating experience to identify plant specific precursor
: events,
: 4) Document the comparison of the Callaway initiator frequencies, particularly the SSIEs, with generic values. 5) Document justification of info rmative prior distributions used. 6) Make sure the PRA Update plans address re visitation of Initiating Event Identification No X  IE-1, IE-2, IE-5, IE-14, IE-3, IE-4, IE-6, IE-9, IE-12 2 4 QU-F1, QU-F2, QU-C3, QU-D1a, QU-D1b, QU-D1c, MU-B3, MU-B4 Upgrade to Quantification Process - The quantification process is generally set up correctly but the clarity and ease of use would benefit from revising the quantification process to take full advantage of the software capability. The recommended changes to the quantification process to integrate and automate the entire internal events (including internal flooding) model would serve to facilitate the use of the quantification process for PRA applications, upgrades, and peer review. As a minimum, the top cutsets (500?) need to be reviewed to make sure that the transfers, logic, house event setting are yielding realistic combinations. Following the requantification, the documentation should be developed to provide the required information from QU-F2. In addition Procedure APA-ZZ-00312 should be revised to reference the ASME Standard and consider peer reviews No X X QU-3, QU-4, QU-8, QU-9, MU-1, MU-2 IE-C7, IE-C8, QU-B9 Merge the support system initiating event fault trees into the model to help insure dependencies are properly treated. No X X IE-11, QU-2 IE-C1b, IE-C9, SY-A22, DA-C14 Repair events included in recovery of the Loss of CCW and Loss of SWS need to be justified in light of the requirements. No X X IE-8 IE-C12 Revise the ISLOCA analysis as necessary based on the work being performed for the fire PRA and incorporate the quantification into the main model. Document full ISLOCA in one calculation. No X X IE-13 AS-A11 Develop and document event trees for transfers currently quantified only with an OCL(e.g., seal LOCA, stuck open PORV) and ensure that dependencies are retained. No X X AS-2, AS-4 2 QU-D4 Include a review of a sampling of non-signifi cant cutsets/accident sequence cutsets in the PRA Update procedure and perform during next requantification. No X  QU-5 4 8 Callaway PRA Gap Analysis Report 62 Table 18 - Callaway PRA R ecommended Modifications Effort (MW)
Task No. SRs Recommended Modifications Cat II Met Doc ModelFO_No LowerUpperQU-E1, QU-E2, QU-F4 The recommended consolidation of documentation for the various areas of the PRA will enhance the visibility of the sources of model uncertainty and key assumptions and allow their consolidation in the quantification. This should be an area which is visited during each model update. No X  QU-6, QU-10 QU-F6 Consider redefining significant terms to match the ASME definitions, otherwise justify the Ameren definition. No X  QU-11 AS-B1, AS-B2, QU-A2a, AS-B6 Review and document the dependence of mitigating systems on the initiating events to ensure they are accurately reflected. See F&Os AS-1, AS-3, AS-5, and AS-7 for
 
specific examples.
No  X AS-1, AS-3, AS-5, AS-7 QU-E4 During each model update, the sensitivity studies being run should be reviewed and revised if necessary. Yes X  QU-7 IF-C2a, IF-C6, IF-C8, IF-E5, IF-E5a Identify scenario specific automatic and operator responses with the ability to impact the flooding analysis. Perform a human reliability analysis to determine any HEP values. No  X IF-3, IF-4, IF-5 IF-D5, IF-D5a Consider plant specific information as indicated in SR IF-D5a No  X IF-1 IF-E3a Revise the flood screening using a 1E-9/yr screening criteria No  X IF-2 3 IF-E7 Revise the LERF analysis to include appropriate flooding scenarios No  X IF-6 25 50 4 HR-D3, HR-G6, HR-I3 HRA Documentation Fixes -  1) Documentation should be updated to add a ground rule statement that the quality of written procedures is considered in the operator-procedure interface failure mechanisms of the CBDTM, and in the error of omission parts of the THERP analyses (step-by-step vs. verbose).
: 2) Revise documentation to include a description and results of the HFE
 
reasonableness check. 3) Document the uncertainty associated with the HRA events. No X  HR-1, HR-2, HR-3 0.4 1 5 IE-C3 Modify each initiating event not currently on a reactor year basis to represent a reactor year basis.
No  X IE-10 0.2 0.4 6 IE-C1, IE-C1a, IE-C13, QU-A2b, QU-E3 Review/update parameter file data to ensure distributions are available for all basic events (including initiating events) and perform uncertainty calculation.
No  X IE-7, QU-1 1 2 7 SC-B5, SC-C1,SC-C2, SC-C3 Combine the multiple calculation packages currently documenting the SC analysis into a single coherent calculation using the list in SR SC-C2 as a guide. If possible, provide a section which summarizes the assumptions and sources of uncertainty. One specific required item is missing and must be added: 1) Document comparison of plant specific analysis with similar plant results. No X  SC-1, SC-2 2 3 Callaway PRA Gap Analysis Report 63 Table 18 - Callaway PRA R ecommended Modifications Effort (MW)
Task No. SRs Recommended Modifications Cat II Met Doc ModelFO_No LowerUpperSY-A7, SY-A6 Modify IAS to reflect dependency on SW. Document a comparison of the values used for the single event models of the IAS and the actuation system with generic industry data or other plant models. Verify correct dependencies for NCP FT. No X X SY-1, SY-4 SY-B1, SY-B3 Add CCFs for battery chargers and breakers or justify why it is not appropriate.
No  X SY-2 SY-B4, DA-C1, DA-
 
D6 Update CCF terms in the model using the method/data from NUREG/CR-5485 to remove excessive conservatism.
Yes  X SY-2 DA-A1 AL check valves are only modeled for 'fail to open'. Fail to close should also be considered and discussed. CC failure events don't address all possible combinations. There are no CCF events for ALPT-37, 38, 39; ALHV-5,7,9,11; ALHV-6,8,10,12.
Yes  X  SY-C1,SY-C2, SY-C3 Combine the multiple calculation packages currently documenting the SY analysis into a single coherent calculation using the list in SR SY-C2 as a guide. If possible, provide a section which summarizes the assumptions and sources of uncertainty. Yes X  SY-3 8 DA-C13 Consider examining the actual plant history and if coincident maintenance is significant then the modeling should be revised.
Yes  X  2 4 DA-E1, DA-E2, DA-
 
E3 Combine the multiple calculation packages currently documenting the DA analysis into a single coherent calculation using the list in SR DA-E2 as a guide. If possible, provide a section which summarizes the assumptions and sources of uncertainty. Consider adding a summary table to the data update calculation which summarizes the actual data changes. Yes X    DA-D2 Document justification for items derived from engineering judgment. No X  DA-3 9 DA-C3 Revise documentation to indicate whether any failure events were excluded and the basis. Yes X    2 3 DA-A3, DA-C6, DA-C7, DA-C8, DA-C9, DA-C5 Revise plant-specific data collection procedures to reflect the currently used data collection methods. Also, ensure data collection procedure is clear that repeated plant-specific component failures occurring within a short time interval should be counted as a single failure if there is a single, repetitive problem that causes the failures and to count only one demand. No X X DA-1 10 DA-B1, DA-C2 Consideration should be given to collecting data on as large a group of components as possible to establish a meaningful collection of data. Grouping of the components as defined in SR DA-B1 and DA-B2 provides a more reasonable aggregation of data. No X X DA-2 2 4 11 LE-B1, LE-D6 Revise to address containment isolation issues and HPME. No X X LE-1 2 3 Callaway PRA Gap Analysis Report 64 Table 18 - Callaway PRA R ecommended Modifications Effort (MW)
Task No. SRs Recommended Modifications Cat II Met Doc ModelFO_No LowerUpperLE-D4, LE-D5 Justify acceptability of current modeling associated w/secondary isolation for SGTR and induced SGTR with sensitivity study.
No  X LE-3 LE-F2, LE-G4 As a minimum, the uncertainty in t he Level 1 sequences should be propagated and sensitivity studies developed and evaluated for the important LERF scenarios. No X X LE-2 LE-A1 Consider expanding documentation to add discussion of the physical characteristics that can influence LERF to cover the items identified in the SR. Yes X    12 AS-A1, AS-A2, AS-A3, AS-A4, AS-A5, AS-A6, AS-C1 Combine the multiple calculation packages currently documenting the AS analysis into a single coherent calculation using the list in SR AS-C2 as a guide. If possible, provide a section which summarizes the assumptions and sources of uncertainty. Yes X    2 4 13 SC-B1, SC-B4, LE-C4, AS-A9 Re-analyze L1 success criteria AND L2 scenarios with MAAP 4.
Yes  X AS-6 ? ? Total Effort - Internal Events PRA  (Excluding MAAP 4 Analysis) 44.6 86.4 14 EXT-A1, EXT-A2, EXT-C2, EXT-E1, EXT-E2, EXT-E3 Revise external events identification and screening documentation to fully encompass requirements.
No X  EXT-1 2 4 15 SM-C4 Provide documentation that the required Soil-Structure interaction calculations were performed.
No  X  SM-1 1 2 16 SM-H1 Provide documentation of the identification of major contributors to the uncertainty and inclusion of the peer review report No  X  SM-2 1 2 Total Effort - External Events Analysis (Excluding Fire) 4 8 17 SDLP-INT Upgrade shutdown and low power internal events model and documentation to meet the final approved standard No  X X SDLP-1 13 26 Total Effort - Shutdown and Low Power Internal Events Analysis 13 26 18 SDLP-EXT Incorporate shutdown and low power external events model and documentation to meet the final approved standard (assumes completion of power operation other external events analysis)
No  X X SDLP-1 4 8 Total Effort - Shutdown and Low Power External Events Analysis (Excluding Seismic and Fire) 4 8 Callaway PRA Gap Analysis Report 65 5.0  References
 
===5.1 Callaway===
PRA Model The following AmerenUE documents, calculation packages and addenda comprise the Callaway PRA for at power conditions:
 
Calc No. Title Original Calc. (IPE) 1st PRA Update 2nd PRA Update 3rd PRA Update 4th PRA Update NA Individual Plant Examination (IPE) Report For The Callaway Plant, Record Type: I020, File Number: A210.0027 NA Individual Plant Examination Of External Events (IPEEE) Report For The Callaway
 
Plant      AB-11 Failure Of Main Steam Isolation Fault Tree  R0    R0, Add1 AE-29 Failure Of Main Feedwater Isolation Fault Tree  R0  R0, Add1 R0, Add2 AE-31 Callaway IPE - Main Feedwater Fault Tree  R0  R0, Add1 AL-04 Auxiliary Feedwater System Fault Tree Model  R0 R1  R1, Add1, Add2, Add3 R1, Add4 BB-92 Pressurizer PORV Failure To Reclose Following Reactor Trip Fault Tree  R0  R1 R1, Add2 BB-93 Pressurizer PORVs Fault Trees  R0 BB-94 Failure Of Reactor Protection (Trip) Function Fault Tree  R0 BB-95 Failure Of Pressurizer Relief Or Safety Valve To Reclose After An ATWS Event Fault Tree  R0  R1 R1, Add1 BB-96 Post-SGTR Pressurizer PORV Fault Tree  R0 BB-97 Callaway IPE-Probabilities Of Core Uncovery Due To RCP Seal LOCA  R0 BB-98 Callaway IPE -Top Level Fault Trees For RCS Bleed Path And Depressurization  R0    R0, Add1 BG-32 High Pressure Coolant Injection System (Cold Leg Recirculation Phase) Fault Tree Model  R0    R0, Add1 BG-33 RCP Seal Cooling Fault Tree  R0 R0, Add1  R0, Add3 R0, Add4 EA-03 Service Water System Failure Modes And Effects Analysis  R0 EA-05 Complete Loss Of Service Water Initiating Event Quantification  R0  R0, Add1, Add2  EA-06 Service Water Fault Tree Package  R0 R0, Add1 R0, Add2 R0, Add3 R0, Add4 EA-07 Modified Normal Service Water Fault Tree  R0  R0, Add1 R0, Add2 EA-08 Calculation Of Service Water Recovery At 2 And 8 Hours  R0    EF-15 Essential Service Water System Fault Tree Model  R0 R0, Add1 R0, Add3, Add4 Callaway PRA Gap Analysis Report 66 Calc No. Title Original Calc. (IPE) 1st PRA Update 2nd PRA Update 3rd PRA Update 4th PRA Update EG-16 CCWS Trains A & B Fault Trees  R0 R0, Add1 R0, Add2, Add3 EG-18 Component Cooling Water System (CCWS) Failure Modes And Effects Analysis (FMEA)  R0    EG-19 Complete Loss Of Component Cooling Water - Special Initiator Quantification  R0  R0, Add1  EG-27 Calculation Of CCW System Recovery  R0 EJ-04 RHR System (Injection Phase) Fault Tree Model  R0 EJ-19 RHR System Cold Leg Recirculation Mode Fault Tree Model  R0    R0, Add1 EJ-20 RHR System Long Term Cooldown Mode Fault Tree Model  R0    R0, Add1 EM-02 High Pressure Coolant Injection System (Injection Phase) Fault Tree Model  R0    R1, Add1 EM-03 Safety Injection System (Injection Phase) Fault Tree Model  R0    R1, Add1 EM-04 Safety Injection System (Cold Leg Recirculation Phase) Fault Tree Model  R0    R1, Add1 EN-05 Fault Tree Model For Containment Spray System (Injection Mode)  R0 EN-06 Fault Tree Model For Containment Spray System (Recirculation Mode)  R0    EP-10 Accumulator Safety Injection System Fault Tree Model  R0 R0, Add1 GK-19 Calculation Of DC And ESF Switchgear Room Heatup  R0    GN-05 Fault Tree Model For Containment Cooling System (GN)  R0    KA-30 Instrument Air System Failure Modes And Effects Analysis  R0    NB-03 Class 1E AC Power System Fault Tree Model  R0 R0, Add1  R0, Add2 R0, Add3 NE-03 Failure Of Both Emergency Diesel Generators Fault Tree  R0    NK-06 Class 1E DC Power System Fault Tree Model  R0 R0, Add1  R0, Add2 ZZ-105 Interfacing System LOCA (ISL) Location Review  R0    ZZ-116 DC Power System Failure Modes And Effects Analysis  R0    ZZ-118 Loss Of Class 1E Air Conditioning And DC Power Train Special Initiator Quantification  R0    ZZ-119 AC Power System Failure Modes And Effects Analysis  R0    ZZ-120 Heating,  Ventilation,  And Air Conditioning (HVAC) Failure Modes And Effects Analysis  R0    ZZ-126 Common Cause Failure Evaluation For Callaway IPE  R0 R0, Add1, Add3 Callaway PRA Gap Analysis Report 67 Calc No. Title Original Calc. (IPE) 1st PRA Update 2nd PRA Update 3rd PRA Update 4th PRA Update ZZ-138 Determine Core Damage Frequency For Interfacing Systems LOCA (ISL)  R0    ZZ-174 PRA/Subtle Interactions Review  R0    ZZ-253 Secondary Plant Depressurization Fault Tree Model  R0 R1  R1, Add1  ZZ-256 Review Of NUREG/CR-3862 PWR Categories For Inclusion As Initiating Events For The Callaway IPE  R0    ZZ-257 Callaway IPE Level 1 PRA Initating Event Frequency Determination  R0 R0, Add1 R0, Add2 R0, Add3, Add4  ZZ-258 Quantification Fault Tree Models  R0  R0, Add1  R0, Add2 ZZ-259 Documentation Of The Event Tree-Fault Tree Success Criteria Discrepancy  R0    ZZ-260 Grouping Of Initiating Events For The Callaway IPE R0    ZZ-261 Callaway IPE-Initiating Events Task-Review Of Callaway Reactor Trips  R0    ZZ-263 Callaway IPE - Actuation Fault Trees  R0    R0, Add1 ZZ-264 Callaway PRA - Disallowed Maintenance Fault Tree  R0 R0, Add1 R0, Add2, Add3 R0, Add4 ZZ-266 Callaway Plant IPE Database  R0 R0, Add2 R0, Add3 R0, Add4, Add6, Add7 R0, Add8 ZZ-267 Callaway IPE Sequence Quantification  R0  R0, Add2 R0, Add3 R0, Add4 ZZ-268 Master Logic Diagram  R0    ZZ-269 Plant Response Trees  R0    ZZ-270 Fault Tree Model For The Containment Isolation System  R0    ZZ-273 Special Data Development  R0    ZZ-275 Callaway IPE - Level I Event Trees  R0 R0, Add1  R0, Add2 R0, Add3 ZZ-276 Callaway IPE -. AC Power Recovery/Non-Recovery Probabilities  R0  R1 R1, Add1 ZZ-278 Callaway IPE Human Error Calculation  R0    ZZ-434 Identification Of Callaway Flood Zones For Internal Flooding Evaluation. R0    ZZ-436 Quantitative Screening Of Callaway Flood Areas -  Re-Evaluation. R0    ZZ-462 Callaway Internal Flooding Analysis Update - Calculation Of CDFs Due To Flooding In
 
Select Areas  R0    ZZ-466 Quantitative Screening Of Callaway Flood Areas For Internal Flooding Re-Evaluation. R0    ZZ-470 Callaway IPE I PRA LERF Model  R0  R0, Add1  ZZ-481 Verification And Validation Of The NUPRA Computer Code  R0    ZZ-492 Loss Of Offsite Power Multiplication Factors For Use In The Safety Monitor R0  R1 Callaway PRA Gap Analysis Report 68 Calc No. Title Original Calc. (IPE) 1st PRA Update 2nd PRA Update 3rd PRA Update 4th PRA Update ZZ-510 Verification And Validation Of The WinNUPRA PRA Computer Code  R0   
 
===5.2 Reference===
Standards
: 1. ASME RA-S-2002, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," with ASME RA-Sa-2003 and ASME RA-Sb-2005 Addenda,  ASME, 2005. 2. ANSI/ANS-58.21-2003, "American National Standard External-Events PRA Methodology," American National Standards Institute, Inc., 2003.
: 3. BSR/ANS 58.23,  " Draft FPRA Methodology Standard, Version of 03 April 2006.
 
Callaway PRA Gap Analysis Report A-1 
 
Appendix A - Independent Assessment Databas e Report (Areas AS, DA, IE, HR, LE, QU, SC, SY, MU)
 
Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementASUSE a method for accident sequence analysis that:
(a)  explicitly models the appropriate combinations of system responses and operator actions that affect the key safety functions for each modeled initiating event; (b)  includes a graphical representation of the accident sequences in an "event tree structure" or equivalent such that the accident sequence progression is displayed; and (c)  provides a framework to support sequence quantification.This requirement is met, however the documentation to confirm is hard to locate and follow. Process discussed in the  IPE.Doc.ModelSRAS-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each modeled initiating event, IDENTIFY the key safety functions that are necessary to reach a safe, stable state and prevent core damage.  [See note 1]This requirement is met, however the documentation to confirm is hard to locate and follow. Process discussed in the  IPE.Doc.ModelSRAS-A2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each modeled initiating event, using the success criteria defined for each key safety function (in accordance with SR SC-A4), IDENTIFY the systems that can be used to mitigate the initiator.  [See note 1]This requirement is met, however the documentation to confirm is hard to locate and follow. Process discussed in the  IPE.Doc.ModelSRAS-A3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-1 of A-106 Appendix A - Callaway PRA Gap AnalysisFor each modeled initiating event, using the success criteria defined for each key safety function (in accordance with SR SC-A4), IDENTIFY the necessary operator actions to achieve the defined success criteria.  [See notes 1 and 2]This requirement is met, however the documentation to confirm is hard to locate and follow. Process discussed in the  IPE.Doc.ModelSRAS-A4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDEFINE the accident sequence model in a manner that is consistent with the plant-specific: system design, EOPs, abnormal procedures, and plant transient response.This requirement is met, however the documentation to confirm is hard to locate and follow. Process discussed in the  IPE.Doc.ModelSRAS-A5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhere practical, sequentially ORDER the events representing the response of the systems and operator actions according to the timing of the event as it occurs in the accident progression. Where not practical, PROVIDE the rationale used for the ordering.This requirement is met, however the documentation to confirm is hard to locate and follow. Process discussed in the  IPE.Doc.ModelSRAS-A6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDELINEATE the possible accident sequences for each modeled initiating event, unless the sequences can be shown to be a non-contribution using qualitative arguments.This requirement meets category III. ZZ-275.Doc.ModelSRAS-A7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-2 of A-106 Appendix A - Callaway PRA Gap AnalysisDEFINE the end state of the accident progression as occurring when either a core damage state or a steady state condition has been reached.This requirement is met. Process discussed in the  IPE and calc note ZZ-275.Doc.ModelSRAS-A8Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUSE realistic, applicable (i.e., from similar plants) thermal hydraulic analyses to determine the accident progression parameters (e.g., timing, temperature, pressure, steam) that could potentially affect the operability of the mitigating systems.In general this requirement meets Category III. Plant specific analysis was used. Evaluations were made with MAAP. However, one case appears questionable. The MAAP results indicate there are 60 hours before core melt for the SGTR sequence with failure to isolate the SG. If the MAAP analysis is correct, then the sequence should be screened. If the MAAP analysis is not correct, or MAAP 3 can not provide a correct representation of the sequence, MAAP 4 should be used.AS-6Doc.ModelSRAS-A9Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIn constructing the accident sequence models, INCLUDE, for each modeled initiating event,  sufficient detail that significant differences in requirements on systems and operator responses are captured. Where diverse systems and/or operator actions provide a similar function, if  choosing one over another changes the requirements for operator intervention or the need for other systems, MODEL each  separately.This requirement meets Category II. Discussed in IPE, inividual system calc notes, ZZ-275, and ZZ-267.Doc.ModelSRAS-A10Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-3 of A-106 Appendix A - Callaway PRA Gap AnalysisTransfers between event trees may be used to reduce the size and complexity of individual event trees. DEFINE any transfers that are used and the method that is used to implement them in the qualitative definition  of accident sequences and in their quantification. USE a method for implementing an event tree transfer that preserves the dependencies that are part of the transferred sequence. These include functional, system, initiating event, operator, and spatial or environmental dependencies.This requirement is met for some of the event trees. Calc note ZZ-267 contains a table of transfers. However, many transfers such as seal LOCA and stuck open PORV transfer to a "psuedo event tree". These transfers are quantified using an OCL file that does not have a specific event tree. This introduces possibilities for error in the quantification since there is no event tree on which to base the evaluated functions, especially those that require preservation of dependencies. The actual event tree for quantification of the RCP seal LOCA events was not found. An event tree Trcp appears to have been used, but this event tree has an event for recovery of CCW, which is not included in the
.OCL files for the RCP seal LOCA events.
Therefore, this requirement is not met.AS-2Doc.ModelSRAS-A11Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each modeled initiating event, IDENTIFY mitigating systems impacted by the occurrence of the initiator and the extent of the impact. INCLUDE the impact of initiating events on mitigating systems in the accident progression either in the accident sequence models or in the system models.This requirement is not met. See F&Os AS-1, AS-3, AS-5, and AS-7  for specific examples.AS-1, AS-3, AS-5, AS-7Doc.ModelSRAS-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY the dependence of modeled mitigating systems on the success or failure of preceding systems, functions, and human actions. INCLUDE the impact on accident progression, either in the accident sequence models or in the system models. For example:
(a)  turbine driven system dependency on SORV, depressurization, and containment heat removal (suppression pool cooling);(b)  low pressure system injection success dependent on need for RPV depressurization.This requirement is not met. See F&Os AS-1, AS-3, AS-5, and AS-7  for specific examples.AS-1, AS-3, AS-5, AS-7Doc.ModelSRAS-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-4 of A-106 Appendix A - Callaway PRA Gap AnalysisFor each accident sequence, IDENTIFY the phenomenological conditions created by the accident progression. Phenomenological impacts include generation of harsh environments affecting temperature, pressure, debris, water levels, humidity, etc. that could impact the success of the system or function under consideration [e.g., loss of pump net positive suction head (NPSH), clogging of flow paths]. INCLUDE the impact of the accident progression phenomena, either in the accident sequence models or in the system models.This requirement is met. See IPE discussion.Doc.ModelSRAS-B3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDEVELOP the accident sequence models to a level of detail sufficient to identify intersystem dependencies and train level interfaces, either in the event trees or through a combination of event tree and fault tree models and associated logic.This requirement is met. See IPE discussion and individual system calc notes.Doc.ModelSRAS-B5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIf plant configurations and maintenance practices create dependencies among various system alignments, DEFINE and MODEL these configurations and alignments in a manner that reflects these dependencies, either in the accident sequence models or in the system models.This requirement is met. See IPE discussion and individual system calc notes.Doc.ModelSRAS-B5aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-5 of A-106 Appendix A - Callaway PRA Gap AnalysisMODEL time-phased dependencies (i.e., those that change as the accident progresses, due to such factors as depletion of resources, recovery of resources, and changes in loads) in the accident sequences .
Examples are:
(a)  For SBO/LOOP sequences, key time phased events, such as:  (1)  AC power recovery  (2)  DC battery adequacy (time dependent discharge)
  (3)  Environmental conditions (e.g., room cooling) for operating equipment and the control room(b)  For ATWS/failure to scram events (for BWRs), key time dependent actions such as:
  (1)  SLCS initiation (2)  RPV level control (3)  ADS inhibit(c)  Other events that may be subject to explicit time dependent characterization include:
  (1)  CRD as an adequate RPV injection source (2)  Long term make-up to RWSTDiscussed in IPE, ZZ-275, ZZ-267, and the individual system calc notes. In most cases this requirement is met, however, the RCP seal LOCA model needs to be updated to reflect the latest WOG model, which is approved by the NRC. Room cooling requirements for the switchgear rooms for SBO should be re-evaluated to consider the actual heat loads in the rooms during SBO.AS-4, AS-5Doc.ModelSRAS-B6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the accident sequence analysis in a manner that facilitates PRA applications, upgrades, and peer review.This requirement is met, however the documentation to confirm is hard to locate and follow. The analysis discussed in the  IPE, various calc notes, and calc note appendices.Doc.ModelSRAS-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-6 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the processes used to develop accident sequences and treat dependencies in accident sequences, including the inputs, methods, and results. For example, this documentation typically includes:
(a)the linkage between the modeled initiating event in the Initiating Event Analysis section and the accident sequence model;(b)the success criteria established for each modeled initiating event including the bases for the criteria (i.e., the system capacities required to mitigate the accident and the necessary components required to achieve these capacities);
(c)a description of the accident progression for each sequence or group of similar sequences (i.e., descriptions of the sequence timing, applicable procedural guidance, expected environmental or phenomenological impacts, dependencies between systems and operator actions, end states, and other pertinent information required to fully establish the sequence of events);
(d)the operator actions reflected in the event trees, and the sequence specific timing and dependencies that are traceable to the HRA for these actions; (e)the interface of the accident sequence models with plant damage states;(f)[when sequences are modeled using a single top event fault tree] the manner in which the requirements for accident sequence analysis have been satisfied.This requirement is met. Discussed in IPE, ZZ-275, ZZ-267, and the individual system calc notes.Doc.ModelSRAS-C2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the key assumptions and key sources uncertainty associated with the accident sequence analysis.Assumptions are documented in the calc notes associated with the initiating event and the individual systems.
Sources of uncertainty are discussed in ZZ-267.Doc.ModelSRAS-C3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-7 of A-106 Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementDAIDENTIFY from the systems analysis the basic events for which probabilities are required. Examples of basic events include:(a)  independent or common cause failure of a component or system to start or change state on demand (b)  independent or common cause failure of a component or system to continue operating or provide a required function for a defined time period(c)  equipment unavailable to perform its required function due to being out of service for maintenance (d)  equipment unavailable to perform its required function due to being in test mode(e)  failure to recover a function or system (e.g., failure to recover offsite-power)(f)  failure to repair a component, system, or function in a defined time periodAll basic events identified by the systems analysis are included in the data base and have associated data assignedAL check valves are only modeled for 'fail to open'. Fail to close should also be considered and discussed. CC failure events don't address all possible combinations. There are no CCF events for ALPT-37, 38, 39; ALHV-5,7,9,11; ALHV-6,8,10,12.Doc.ModelSRDA-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementESTABLISH definitions of SSC boundaries, failure modes, and success criteria consistent with corresponding basic event definitions in Systems Analysis (SY-A5, SY-A7, SY-A8, SY-A10 through SY-A13 and SY-B4) for failure rates and common cause failure parameters, and ESTABLISH boundaries of unavailability events consistent with corresponding definitions in Systems Analysis (SY-A18).The definition of the SSC boundaries, failure modes, and success criteria are consistent with corresponding basic event definitions in Systems Analysis for failure rates and common cause failure parameters. The boundaries of the out-of-service unavailability events are consistent with the corresponding definitions in Systems AnalysisDoc.ModelSRDA-A1aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUSE an appropriate probability model for each basic event. Examples include:(a)  binomial distributions for failure on demand(b)  Poisson distributions for standby and operating failures and initiating eventsProcedure 43.15 DBTP, table 1 lists the model used for each type basic event.Doc.ModelSRDA-A2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-8 of A-106 Appendix A - Callaway PRA Gap AnalysisIDENTIFY the parameter to be estimated and the data required for estimation. Examples are as follows: (a)  For failures on demand , the parameter is the probability of failure, and the data required are the number of failures given a number of demands; (b)  For standby failures, operating failures, and initiating events, the parameter is the failure rate, and the data required are the number of failures in the total (standby or operating) time; (c)  For unavailability due to test or maintenance, the parameter is the unavailability on demand, and alternatives for the data required include:      the total time of unavailability; OR      a list of the maintenance events with their durations, together with the total time required to be available, OR the number of maintenance or test acts, their average duration, and the total time required to be available.Procedures ZZ-266 and 43.15 DBTP provide guidance on what parameters are to be estimated and the required data. The total time of unavailability is provided. The procedures still refer to the RAPID system that is no longer used. Procedures need to be revised to current practices.Doc.ModelSRDA-A3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor parameter estimation, GROUP components according to type (e.g., motor-operated pump, air-operated valve) and according to the characteristics of their usage to the extent supported by data:(a)  mission type (e.g., standby, operating)(b)  service condition (e.g., clean vs. untreated water, air)Group parameter estimations are generally based only on component type. Recent data updates have used a much finer levels of grouping (e.g., the charging pumps are considered a different group than the SI pumps). The grouping used to apply plant-specific data updates should be reexamined to make sure the data aggregation is reasonable. This meets category I but does not meet category II.DA-2Doc.ModelSRDA-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDO NOT INCLUDE outliers in the definition of a group (e.g., do not group valves that are never tested and unlikely to be operated with those that are tested or otherwise manipulated frequently)Groups are general and are done only by component type. It is possible there are outliers in some of the groups from the original IPE but this was not well documented. Later grouping is on a much finer level and outliers are not included.Doc.ModelSRDA-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-9 of A-106 Appendix A - Callaway PRA Gap AnalysisOBTAIN  generic parameter estimates from recognized sources. ENSURE that the parameter definitions and boundary conditions are consistent with those established in response to DA-A1 to DA-A3. [Example:  some sources include the breaker within the pump boundary, whereas others do not.]  DO NOT INCLUDE generic data for unavailability due to test, maintenance, and repair  unless it can be established that the data is consistent with the test and maintenance philosophies for the subject plant.
Examples of parameter estimates and associated sources include:
(a)  component failure rates and probabilities: NUREG/CR-4639 [Note (1)], NUREG/CR-4550 [Note (2)](b)  common cause failures: NUREG/CR-5497 [Note (3)], NUREG/CR-6268
[Note (4)]
(c) AC off-site power recovery: NUREG/CR-5496 [Note (5)], NUREG/CR-5032 [Note (6)](d)  component recoveryNo use of generic unavail. for test, maint. or repair was found.NUREG/CR-4550 used in ZZ-266. As noted in SY, CCFs are acceptable, but conservative and the quality of the PRA could be improved with use of the noted CCF reference.Doc.ModelSRDA-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCOLLECT plant-specific data for the basic event/parameter grouping corresponding to that defined by requirement DA-A1, DA-A2, DA-A3, DA-B1, and DA-B2.Plant specific data was initially collected but has not been updated for components associated with low risk significant MR function in the most recent update. Consideration should be given to collecting data on as large a group of components as possible to establish a meaningful collection of data. Grouping of the components as defined in SR DA-B1 and DA-B2 provides a more reasonable aggregation of data.DA-2Doc.ModelSRDA-C2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-10 of A-106 Appendix A - Callaway PRA Gap AnalysisCOLLECT plant-specific data, consistent with uniformity in design, operational practices, and experience. JUSTIFY the rationale for screening or disregarding plant-specific data (e.g., plant design modifications, changes in operating practices).Data collected for IPE includes basis why some events were disregarded. Subsequent updates don't clearly identify if any events were excluded and why. Plant specific data was initially collected but has not been updated for components associated with low risk significant MR function in the most recent update. Data collection should be performed on as large a group of components as possible to establish a meaningful collection of data. Grouping of the components as defined in SR DA-B1 and DA-B2 provides a more reasonable aggregation of data.Doc.ModelSRDA-C3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen evaluating maintenance or other relevant records to extract plant specific component failure event data, DEVELOP a clear basis for the identification of events as failures.DISTINGUISH between those degraded states for which a failure, as modeled in the PRA, would have occurred during the mission and those for which a failure would not have occurred (e.g., slow pick up to rated speed).
Include all failures that would have resulted in failure to perform the mission as defined in the PRAProcedure ZZ-266 provides guidance for evaluating failure data. The raw failure data is provided ito the PRA group by the MR group and the PRA group examines each failure to determine whether or not it constitutes a failure for the PRA model.Doc.ModelSRDA-C4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCOUNT repeated plant-specific component failures occurring within a short time interval as a single failure if there is a single, repetitive problem that causes the failures. In addition, COUNT only one demand.There is no documentation to indicate this did or did not occur. This is not discussed in PRA guidance. A PRA analyst performed a high level review of the failures to search for any notable abnormalities. In addition, the failure data was collected for the years 1996 to 2000. 1996 was chosen because that was the beginning of the Maintenance Rule (MR). All of the failure data came from the MR group. If repetitive failures had occurred, it would be expected that the MR Expert Panel would have noted the problem. A PRA analyst sits on the MR Expert Panel.Doc.ModelSRDA-C5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-11 of A-106 Appendix A - Callaway PRA Gap AnalysisDETERMINE the number of plant-specific demands on standby components on the basis of the number of(a)  surveillance tests (b)  maintenance acts (c)  surveillance tests or maintenance on other components(d)  operational demands.DO NOT COUNT additional demands from post-maintenance testing; that is part of the successful renewal.The data collected is provided by the MR Group. It appears, based on discussions with the PRA analyst that the correct information is collected and transferred to the PRA Group however the documentation of the collection method needs to be formalized and included as part of the PRA.DA-1Doc.ModelSRDA-C6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementBASE number of surveillance tests on plant surveillance requirements and actual practice. BASE number of planned maintenance activities on plant maintenance plans and actual practice. BASE number of unplanned maintenance acts on actual plant experience.The data collected is provided by the MR Group. It appears, based on discussions with the PRA analyst that the correct information is collected and transferred to the PRA Group however the documentation of the collection method needs to be formalized and included as part of the PRA.DA-1Doc.ModelSRDA-C7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen required, USE plant-specific operational records to determine the time that components were configured in their standby status.The data collected is provided by the MR Group. It appears, based on discussions with the PRA analyst that the correct information is collected and transferred to the PRA Group however the documentation of the collection method needs to be formalized and included as part of the PRA.DA-1Doc.ModelSRDA-C8Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-12 of A-106 Appendix A - Callaway PRA Gap AnalysisESTIMATE operational time from surveillance test practices for standby components, and from actual operational data.The data collected is provided by the MR Group. It appears, based on discussions with the PRA analyst that the correct information is collected and transferred to the PRA Group however the documentation of the collection method needs to be formalized and included as part of the PRA.DA-1Doc.ModelSRDA-C9Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen using surveillance test data, REVIEW the test procedure to determine whether a test should be credited for each possible failure mode. COUNT only completed tests or unplanned operational demands as success for component operation. If the component failure mode is decomposed into sub-elements (or causes) that are fully tested, then USE tests that exercise specific sub-elements in their evaluation. Thus, one sub-element sometimes has many more successes than another.[Example: a diesel generator  is tested more frequently than the load sequencer. IF the sequencer were to be included in the diesel generator boundary, the number of valid test would be significantly decreased.]It appears during the initial development of the PRA model surveillance tests were reviewed to determine what failure modes should be credited with a demand. Design and procedure modifications require the Responsible Engineer to assess the impact on plant programs. The PRA is one of the programs assessed. The PRA Group is notified to perform an evaluation of the modification to assess its impact on plant risk before the modification can be installed. These risk assessments are documented in a QA-document called a PRA Evaluation Request (PRAER). The list of PRAERs is reviewed during a PRA update to determine if there are modifications that must be captured in the PRA.Doc.ModelSRDA-C10Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-13 of A-106 Appendix A - Callaway PRA Gap AnalysisWhen using data on maintenance and testing durations to estimate unavailabilities at the component, train, or system level, as required by the system model, only INCLUDE those maintenance or test activities that could leave the component, train, or system unable to perform its function when demanded.In the development of the IPE, maintenance and test procedures were reviewed to identify those that would result in a component, train, or system unavailable to perform it's function. Design and procedure modifications require the Responsible Engineer to assess the impact on plant programs. The PRA is one of the programs assessed. The PRA Group is notified to perform an evaluation of the modification to assess its impact on plant risk before the modification can be installed.
These risk assessments are documented in a QA-document called a PRA Evaluation Request (PRAER). The list of PRAERs is reviewed during a PRA update to determine if there are design or procedure modifications that must be captured in the PRA.Doc.ModelSRDA-C11Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen an unavailability of a front line system component is caused by an unavailability of a support system, COUNT the unavailability towards that of the support system and not the front line system, in order to avoid double counting and to capture the support system dependency properly.Generally, the PRA and MR philosophy is, a support system failure is counted against the support system. In certain rare instances (e.g., rule-of-the-box), a support system failure is counted against the supported system.Doc.ModelSRDA-C11aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-14 of A-106 Appendix A - Callaway PRA Gap AnalysisEVALUATE the duration of the actual time that the equipment was unavailable for each contributing activity. Since maintenance outages are a function of the plant status, INCLUDE only outages occurring during plant at power. Special attention should be paid to the case of a multi-plant site with shared systems, when the Specifications (TS) requirements can be different depending on the status of both plants. Accurate modeling generally leads to a particular allocation of outage data among basic events to take this mode dependence into account. In the case that reliable estimates or the start and finish times are not available, INTERVIEW the plant maintenance and operations staff to generate estimates of ranges in the unavailable time per maintenance act for components, trains, or systems for which the unavailabilities are significant basic events.Estimates of outage start and finish times are collected and reasonable. The T&M unavailabilities come from the MR. The MR Expert Panel reviews this information. Maintenance and Ops personnel are members of the MR Expert Panel.Doc.ModelSRDA-C12Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementEXAMINE coincident  unavailability due to maintenance for redundant equipment (both intra- and inter-system) based on actual plant experience.
CALCULATE coincident maintenance unavailabilities that reflect actual plant experience. Such coincident maintenance unavailability can arise, for example, for plant systems that have "installed spares", i.e.,  plant systems which have more redundancy than is addressed by tech specs. For example, the charging system in some plants has a third train which may be out of service for extended periods of time coincident with one of the other trains and yet is in compliance with tech specs.The modeling of unavailability due to maintenance is based on the plant philosophy for maintenance. Maintenace combinations which result in violation of the technical specifications are removed from the cutsets on the basis that any coincident maintenance which results in the plant entering an LCO is short lived and not a significant contributor. The actual plant history should be examined and if coincident maintenance is significant then the modeling should be revised.In Calculation ZZ-266 system unavailability is based on actual plant historical experience.Doc.ModelSRDA-C13Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each SSC for which repair is to be modeled (see SY-A22), IDENTIFY instances of plant-specific or applicable industry experience and for each repair, COLLECT the associated repair time with the repair time being the period from identification of the component failure until the component is returned to service.The Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and loss of SWS initiating events. The recovery events, which include recovery of CCF of pumps and valves lack sufficient analysis or data. The Callaway PRA does not meet DA-C14.IE-8Doc.ModelSRDA-C14Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-15 of A-106 Appendix A - Callaway PRA Gap AnalysisData on recovery from loss of offsite power, loss of service water, etc. are rare on a plant-specific basis. If available, for each recovery, COLLECT the associated recovery time with the recovery time being the period from identification of the system or function failure until the system or function is returned to service.Callaway has never experienced a loss of offsite power, loss of all service water, or loss of all component cooling water. These are the only special initiators which credit recovery of the initiating fault. Recovery of offsite power is based on generic industry data due to the lack of plant specific experience. Recovery of loss of all service water or loss of component cooling water is discussed in the initiating events section. For information on the recovery events see F&O IE-8.Doc.ModelSRDA-C15Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCALCULATE realistic parameter estimates for significant basic events based on relevant generic and plant specific evidence unless it is justified that there are adequate plant specific data to characterize the parameter value and its uncertainty. When it is necessary to combine evidence from generic and plant specific data USE a Bayes update process or equivalent statistical process that assigns appropriate weight to the statistical significance of the generic and plant specific evidence and provides an appropriate characterization of uncertainty,  CHOOSE prior distributions as either non-informative, or representative of variability in industry data. CALCULATE parameter estimates for the remaining events by using generic industry data.The PRA model uses a combination of generic, plant specific, Bayesian updated data for PRA parameters, as appropriate.
Statistical analysis is provided for each event value. 
 
==Reference:==
ZZ-266 Table 4 and Table 5.Doc.ModelSRDA-D1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIf neither plant-specific data nor generic parameter estimates are available for the parameter associated with a specific basic event, USE data or estimates for the most similar equipment available, adjusting if necessary to account for differences. Alternatively, USE expert judgment and document the rationale behind the choice of parameter values.No justification is provided for the use of engineering judgment to determine the probability as required by DA-D2 (Example: HYDRAULICSYSFAIL, STR-FR, STR-FS). There is no indication that any parameters were (or were not) determined by using data or estimates of similar equipment.DA-3Doc.ModelSRDA-D2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-16 of A-106 Appendix A - Callaway PRA Gap AnalysisPROVIDE a mean value of, and a statistical representation of the uncertainty intervals for, the parameter estimates of significant basic events. Acceptable systematic methods include Bayesian updating, frequentist method, or expert judgment.Mean values and a statistical representation of uncertainty intervals are provided in procedure ZZ-266 table 5. Bayesian updating is used by Callaway Cat II METDoc.ModelSRDA-D3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen the Bayesian approach is used to derive a distribution and mean value of a parameter,  CHECK that the posterior distribution is reasonable given the relative weight of evidence provided by the prior and the plant specific data. Examples of tests to ensure that the updating is accomplished correctly and that the generic parameter estimates are consistent with the plant-specific application include the following:(a) confirmation  that the Bayesian updating does not produce a posterior distribution with a single bin histogram (b) examination of  the cause of any unusual (e.g., multimodal) posterior distribution shapes (c) examination of inconsistencies between the prior distribution and the plant-specific evidence to confirm that they are appropriate(d) confirmation that the Bayesian updating algorithm provides meaningful results over the range of values being considered (e) confirmation of the reasonableness of the posterior distribution mean valueGuidelines for the appropriateness of Bayesian updating of events is provided in Attachment 3 to ZZ-266 Addendum 4. These guidelines discusses a process that is used to determine whether a Bayesian update for a basic event given the collected data is appropriate.Doc.ModelSRDA-D4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUSE one of the following models for estimating CCF parameters for significant CCF basic events:(a)  Alpha Factor Model (b)  Basic Parameter Model (c)  Multiple Greek Letter Model(d)  Binomial Failure Rate ModelJUSTIFY the use of alternative methods (i.e., provide evidence of peer review or verification of the method which demonstrates its acceptability).Procedure 43.15 states that beta factors were used for common cause evaluation. The multiple greek letter (MGL) method was used for quantification of common cause failures events.
CAT II METDoc.ModelSRDA-D5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-17 of A-106 Appendix A - Callaway PRA Gap AnalysisUSE generic common cause failure probabilities  consistent with available plant experience. EVALUATE the common cause failure probabilities consistent with the component boundaries.This is generally met although NUREG/CR-4550 was used rather than the more current NUREG/CR-5485. The Callaway PRA adequately models CCFs with the exception of battery chargers and breakers as noted in SR SY-B1 and B3. The quantification of all CCFs should be updated. CCFs should be added for Battery Chargers and Breakers. The quantification of the CCFs should be done in accordance with NUREG/CR-5485.SY-2Doc.ModelSRDA-D6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIf screening of generic event data is performed for plant-specific estimation, PERFORM screening on both the CCF events and the independent failure events in the data base used to generate the CCF parameters.Screening of generic data is not performed.Doc.ModelSRDA-D6aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIf modifications to plant design or operating practice lead to a condition where past data are no longer representative of current performance, LIMIT the use of old data:
(a)  If the modification involves new equipment or a practice where generic parameter estimates are available, USE the generic parameter estimates updated with plant-specific data as it becomes available for significant basic events; or (b)  If the modification is unique to the extent that generic parameter estimates are not available and only limited experience is available following the change, then ANALYZE the impact of the change and assess the hypothetical effect on the historical data to determine to what extent the data can be used.Design modifications require the design's Responsible Engineer to assess the design's impact on plant programs. The PRA is one of the programs assessed. The PRA Group is notified to perform an evaluation of the modification to assess its impact on plant risk before the modification can be installed. These risk assessments are documented in a QA-document called a PRA Evaluation Request (PRAER). The list of PRAERs is reviewed during a PRA update to determine if there are design modifications that must be captured in the PRA. As an example, calculation AE-29 Addendum 1 covers the Main Feedwater Isolation Valves being replaced with a different type.
This necessitated changes to the basic event naming convention as well as to the failure probability. Because the valve type did not exist in the generic data base, the valve manufacturer was contacted to provide failure data.Doc.ModelSRDA-D7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-18 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the data analysis in a manner that facilitates PRA applications, upgrades, and peer review.Documentation is adequate to support PRA applications and upgrades because Callaway has been successful at both.
Documentation and organization of documentation could be improved to facilitate peer reviews.Doc.ModelSRDA-E1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the processes used for data parameter definition, grouping, and collection including parameter selection and estimation, including the inputs, methods, and results. For example, this documentation typically includes:(a)  system and component boundaries used to establish component failure probabilities (b)  the model used to evaluate each basic event probability(c)  sources for generic parameter estimates(d)  the plant-specific sources of data (e)  the time periods for which plant-specific data were gathered (f)  justification for exclusion of any data (g)  the basis for the estimates of common cause failure probabilities, including justification for screening or mapping of generic and plant-specific data(h)  the rationale for any distributions used as priors for Bayesian updates, where applicable (i)  parameter estimate including the characterization of uncertainty, as appropriateGenerally adequate but needs improvement.
Identification of data excluded and justification for exclusion not provided in revisions and Addenda to IPE.Doc.ModelSRDA-E2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the key assumptions and key sources of uncertainty associated with the data analysis.The key assumptions and key sources of uncertainty were identified in the IPE. Since that time there is little documentation of assumptions or uncertainty. To be useful going forward the documentation of assumptions and sources of uncertainty need to be revised.Doc.ModelSRDA-E3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-19 of A-106 Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementHRFor equipment modeled in the PRA, IDENTIFY, through a review of procedures and practices, those test and maintenance activities that require realignment of equipment outside its normal operational or standby status.Done in IPE, changes in procedures, test, system alignment reviewed for impact by PRA staff and added to list for model update if any impact.Doc.ModelSRHR-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY, through a review of procedures and practices, those calibration activities that if performed incorrectly can have an adverse impact on the automatic initiation of standby safety equipment.Done in IPE, changes in procedures reviewed for impact by PRA staff and added to list for model update if any impact.Doc.ModelSRHR-A2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY which of those work practices identified above (HR-A1, HR-A2) involve a mechanism that simultaneously affects equipment in either different trains of a redundant system or diverse systems [e.g., use of common calibration equipment by the same crew on the same shift,a maintenance or test activity that requires realignment of an entire system (e.g., SLCS)].Done in IPE, changes in procedures, test, system alignment reviewed for impact by PRA staff and added to list for model update if any impact.Doc.ModelSRHR-A3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-20 of A-106 Appendix A - Callaway PRA Gap AnalysisIf screening is performed, ESTABLISH rules for screening individual activities from further consideration.Example:  Screen maintenance and test activities from further consideration only if (a)equipment is automatically re-aligned on system demand, or(b)following maintenance activities, a post-maintenance functional test is performed that reveals misalignment, or (c)equipment position is indicated in the control room, status is routinely checked, and realignment can be affected from the control room, or(d)equipment status is required to be checked frequently (i.e., at least once a shift)System modeling guidelines used in IPE outlines acceptable screening criteria.Doc.ModelSRHR-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDO NOT screen activities that could simultaneously have an impact on multiple trains of a redundant system or diverse systems (HR-A3).System modeling guidelines used in IPE outlines acceptable screening criteria.Doc.ModelSRHR-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each unscreened activity, DEFINE a human failure event (HFE) that represents the impact of the human failure at the appropriate level, i.e., function, system, train, or component affected.Performed as part of IPEDoc.ModelSRHR-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-21 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE those modes of unavailability that, following completion of each unscreened activity, result from failure to restore(a)equipment to the desired standby or operational status(b)initiation signal or set point for equipment start-up or realignment(c)automatic realignment or powerADD failure modes identified during the collection of plant-specific or applicable generic operating experience that leave equipment unavailable for response in accident sequences.Human errors are included for each identified unscreened activity.Doc.ModelSRHR-C2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementINCLUDE the impact of miscalibration as a mode of failure of initiation of standby systems.Miscalibraqtion is included where the potential exists for miscalibration and miscalibration is not readily discernibleDoc.ModelSRHR-C3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementESTIMATE the probabilities of human failure events using a systematic process. Acceptable methods include THERP [Note (1)] and ASEP [Note (2)].Risk significant HFEs were revised in 2005 using the EPRI HRA Calculator Version 3.0 which meets the criteria.Doc.ModelSRHR-D1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor significant HFEs, USE detailed assessments in the quantification of pre-initiator HEPs. USE screening values based on a simple model, such as ASEP in the quantification of the pre-initiator HEPs for non-significant human failure basic events. When bounding values are used, ENSURE they are based on limiting cases from models such as ASEP.Risk significant Type A & B HEPs were analyzed in detail, non-significant HEPs were not revised from their IPE values.Doc.ModelSRHR-D2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-22 of A-106 Appendix A - Callaway PRA Gap AnalysisFor each detailed human error probability assessment, INCLUDE in the evaluation process the following plant-specific relevant information:(a)  the quality of written procedures (for performing tasks) and administrative controls (for independent review)
(b)  the quality of the human-machine interface, including both the equipment configuration, and instrumentation and control layoutDocumentation should be updated to add a ground rule statement that the quality of written procedures is considered in the operator-procedure interface failure mechanisms of the CBDTM, and in the errors of omission parts of the THERP analyses (step-by-step vs. verbose). The instrumentation and control layout is considered in the "Cues" sections and in the THERP execution analyses. Equipment configuration is considered for local actions in "Execution PSFs" and in the THERP analyses.HR-1Doc.ModelSRHR-D3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen taking into account self-recovery or recovery from other crew members in estimating HEPs for specific HFEs, USE pre-initiator recovery factors consistent with selected methodology. If recovery of pre-initiator errors is credited(a)  ESTABLISH the maximum credit that can be given for multiple recovery opportunities (b)  USE the following information to assess the potential for recovery of pre-initiator:(1)post-maintenance or post-calibration tests required and performed by procedure (2)independent verification, using a written check-off list, which verify component status following maintenance/testing(3) original performer, using a written check-off list, makes a separate check of component status at a later time(4)work shift or daily checks of component status, using a written check-off listRisk significant HFEs were revised in 2005 using the EPRI HRA Calculator Version 3.0 which meets the criteria.Doc.ModelSRHR-D4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-23 of A-106 Appendix A - Callaway PRA Gap AnalysisASSESS the joint probability of those HFEs identified as having some degree of dependency (i.e., having some common elements in their causes, such as performed by the same crew in the same time- frame).Dependency between HFEs was assessed and accounted for in the Callaway PRADoc.ModelSRHR-D5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPROVIDE an assessment of the uncertainty in the HEPs consistent with the quantification approach. USE mean values when providing point estimates of HEPs.The calculated values of the HEPs are presented as mean values of the distribution and associated error factor.Doc.ModelSRHR-D6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementNo requirement to check reasonableness of HEPs in light of the plant's experienceNot applicable for category IIDoc.ModelSRHR-D7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen identifying the key human response actions REVIEW:(a)the plant-specific emergency operating procedures, and other relevant procedures (e.g., AOPs, annunciator response procedures) in the context of the accident scenarios.
(b)system operation such that an understanding of how the system(s) functions and the human interfaces with the system is obtained.The plant specific procedures were reviwed as part of the HRA update for the risk significant HEPs. During the development of the IPE fault tree/event tree models, the system operation was reviewed to ensure the models and the underlying assumptions reflected how the system(s) function and the human interface was correctly incorporated.Doc.ModelSRHR-E1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-24 of A-106 Appendix A - Callaway PRA Gap AnalysisIDENTIFY (a)those actions required to initiate (for those systems not automatically initiated), operate, control, isolate, or terminate those systems and components used in preventing or mitigating core damage as defined by the success criteria (e.g., operator initiates RHR)(b) those actions performed by the control room staff either in response to procedural direction or as skill-of-the-craft to recover a failed function, system or component that is used in the performance of a response action as identified in HR-H1.These issues were identified in the IPE and system/procedure changes are evaluated on a regular basis and incorporated if important.Doc.ModelSRHR-E2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementTALK THROUGH (i.e., review in detail) with plant operations and training personnel the procedures and sequence of events to confirm that interpretation of the procedures is consistent with plant observations and training procedures.Operator interviews were conducted in August 2005 during the reevaluation of the risk significant HFEsDoc.ModelSRHR-E3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUSE simulator observations or talk-throughs with operators to confirm the response models for scenarios modeled.Operator interviews were conducted in August 2005 during the reevaluation of the risk significant HFEsDoc.ModelSRHR-E4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDEFINE human failure events (HFEs) that represent the impact of the human failures at the function, system, train, or component level as appropriate. Failures to correctly perform several responses may be grouped into one HFE if the impact of the failures is similar or can be conservatively bounded.HFEs were defined during the performance of the IPE.Doc.ModelSRHR-F1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-25 of A-106 Appendix A - Callaway PRA Gap AnalysisCOMPLETE THE DEFINITION of the HFEs by specifying (a)  accident sequence specific timing of cues, and time window for successful completion (b)  accident sequence specific procedural guidance (e.g., AOPs, and EOPs)
(c)  the availability of cues and other indications for detection and evaluation errors(d)  the specific high level tasks (e.g., train level) required to achieve the goal of the response.Risk significant HFEs are fully defined to Category III requirements.Doc.ModelSRHR-F2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM detailed analyses for the estimation of HEPs for significant HFEs.
USE screening values for HEPs for non-significant human failure basic events.Detailed analysis performed for all risk significant HFEs. All other values remain at the original IPE values.Doc.ModelSRHR-G1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUSE an approach to estimation of HEPs that addresses failure in cognition as well as failure to execute.Risk significant HFEs were revised in 2005 using the EPRI HRA Calculator Version 3.0 which meets the criteria.Doc.ModelSRHR-G2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-26 of A-106 Appendix A - Callaway PRA Gap AnalysisWhen estimating HEPs EVALUATE the impact of the following plant-specific and scenario-specific performance shaping factors:(a)  quality [type (classroom or simulator) and frequency] of the operator training or experience (b)  quality of the written procedures and administrative controls(c)  availability of instrumentation needed to take corrective actions(d)  degree of clarity of cues/indications (e)  human-machine interface (f)  time available and time required to complete the response(g)  complexity of the required response(h)  environment (e.g., lighting, heat, radiation) under which the operator is working (i)  accessibility of the equipment requiring manipulation (j)  necessity, adequacy, and availability of special tools, parts, clothing, etc.In the evaluation of the risk significant HEPs, all of the listed PSF were considered.Doc.ModelSRHR-G3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementBASE the time available to complete actions on appropriate realistic generic thermal/hydraulic analyses, or simulation from similar plants (e.g., plant of similar design and operation). SPECIFY the point in time at which operators are expected to receive relevant indications.Time windows for operator action were developed using plant-specific MAAP analysis during performance of the IPE.Doc.ModelSRHR-G4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen needed, BASE the required time to complete actions for significant HFEs on action time measurements in either walkthroughs or talk-throughs of the procedures or simulator observations.Required times for completion of actions was developed during the IPE.Doc.ModelSRHR-G5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-27 of A-106 Appendix A - Callaway PRA Gap AnalysisCHECK the consistency of the post-initiator HEP quantifications. REVIEW the HFEs and their final HEPs relative to each other to check their reasonableness given the scenario context, plant history, procedures, operational practices, and experience.The analyst who performed the reevaluation of the HFEs indicated that a reasonableness check was performed, however the documentation does not discuss this issue.HR-2Doc.ModelSRHR-G6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor multiple human actions in the same accident sequence or cut set, identified in accordance with supporting requirement QU-C1, ASSESS the degree of dependence, and calculate a joint human error probability that reflects the dependence. ACCOUNT for the influence of success or failure in preceding human actions and system performance on the human event under consideration including: (a) time required to complete all actions in relation to the time available to perform the actions (b) factors that could lead to dependence (e.g., common instrumentation, common procedures, increased stress, etc.)
(c)  availability of resources (e.g., personnel)  [Note (3)]The dependency between human interactions is assessed and is discussed in Appendix E of calculation ZZ-278, Rev. 0, Addendum 1.Doc.ModelSRHR-G7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCharacterize the uncertainty in the estimates of the HEPs consistent with the quantification approach, and PROVIDE mean values for use in the quantification of the PRA results.HEPs are presented in terms of mean values and error factors.Doc.ModelSRHR-G9Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-28 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE operator recovery actions that can restore the functions, systems, or components on an as needed basis to provide a more realistic evaluation of significant accident sequences.The IPE inclusion of operator actions meets the category II requirementDoc.ModelSRHR-H1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCREDIT operator recovery actions only if, on a plant-specific basis:
(a)  a procedure is available and operator training has included the action as part of crew's training, or justification for the omission for one or both is provided(b)  "cues" (e.g., alarms) that alert the operator to the recovery action provided procedure, training, or skill of the craft exist (c)  attention is given to the relevant performance shaping factors provided in HR-G3(d)  there is sufficient manpower to perform the actionOpeator actions included in the Callaway PRA account for items a-d of the requirement.Doc.ModelSRHR-H2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementACCOUNT for any dependency between the HFE for operator recovery and any other HFEs in the sequence, scenario, or cutset to which the recovery is applied (see HR-G7).The dependency between human interactions is assessed and is discussed in Appendix E of calculation ZZ-278, Rev. 0, Addendum 1.Doc.ModelSRHR-H3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the human reliability analysis in a manner that facilitates PRA applications, upgrades, and peer review.The documentation of the HRA facilitates PRA applications, upgrades, and peer review.Doc.ModelSRHR-I1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-29 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the processes used to identify, characterize and quantify the pre-initiator, post-initiator and recovery actions considered in the PRA, including the inputs, methods, and results. For example, this documentation typically includes:
(a)HRA methodology and process used to identify pre- and post-initiator HEPs (b)qualitative screening rules and results of screening(c)factors used in the quantification of the human action, how they were derived (their bases), and how they were incorporated into the quantification process(d)quantification of HEPs, including:(1)screening values and their bases(2) detailed HEP analyses with uncertainties and their bases(3) the method and treatment of dependencies for post-initiator actions(4) tables of  pre- and post-initiator human actions evaluated by model, system, initiating event, and function(5)HEPs for recovery actions and their dependency with other HEPsThe process is well documented and addresses all the issues included in the SR.Doc.ModelSRHR-I2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the key assumptions and key sources uncertainty associated with the human reliability analysis.Key assumptions are documented in the individual analyses files, where applicable. Key sources of uncertainty associated with the HRA are not documented.HR-3Doc.ModelSRHR-I3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-30 of A-106 Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementIEIDENTIFY those initiating events that challenge normal plant operation and that require successful mitigation to prevent core damage using a structured, systematic process for identifying initiating events that accounts for plant-specific features. For example, such a systematic approach may employ master logic diagrams, heat balance fault trees, or failure modes and effects analysis (FMEA). Existing lists of known initiators are also commonly employed as a starting point.The Callaway identification of initiating events that challenge normal plant operation and require successful mitigation to prevent core damage was initially performed using a structured systematic process to account for plant specific features. It is unclear from the documentation whether the initial basis for selecting the support system initiating events is ever revisited with the changing models or plant modifications. The Callaway PRA meets SR IE-A1.IE-1Doc.ModelSRIE-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-31 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE in the spectrum of internal-event challenges considered at least the following general categories: (a)  Transients. INCLUDE among the transients both equipment and human induced events that disrupt the plant and leave the primary system pressure boundary intact.(b)  LOCAs. INCLUDE in the LOCA category both equipment and human induced events that disrupt the plant by causing a breach in the core coolant system with a resulting loss of core coolant inventory. DIFFERENTIATE the LOCA initiators, using a defined rationale for the differentiation. Example of LOCA types includes:(1)  Small LOCAs. Examples: reactor coolant pump seal LOCAs, small pipe breaks(2)  Medium LOCAs. Examples: stuck open safety or relief valves(3)  Large LOCAs. Examples: inadvertent ADS, component ruptures(4)  Excessive LOCAs.  (LOCAs that cannot be mitigated by any combination of engineered systems). Example: reactor pressure vessel rupture(5)  LOCAs Outside Containment. Example: primary system pipe breaks outside containment (BWRs)(c) SGTRs: INCLUDE spontaneous rupture of a steam generator tube (PWRs)
(d)  ISLOCAs:  INCLUDE postulated events in systems interfacing with the reactor coolant system that could fail or be operated in such a manner as to result in an uncontrolled loss of core coolant outside the containment [e.g.,
interfacing systems LOCAs (ISLOCAs)].(e)  Special initiators (e.g., support systems failures, instrument line breaks) [Note (1)].
(f)  Internal flooding initiators (see IF-D1 and D2) [Note (1)].The Callaway PRA includes the identified general categories and therefore meets the SR IE-A2.Doc.ModelSRIE-A2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW the plant-specific initiating event experience of all initiators to ensure that the list of challenges accounts for plant experience. See also IE-A7.The plant trips were reviewed in the development of the IPE and documented in Calc. ZZ-261. This calculation has never been updated since 1992.
The plant trips occurring since the completion of the IPE have been systematically reviewed and updated via calculation ZZ-257. This process is completed for each update and. therefore meets SR IE-A3Doc.ModelSRIE-A3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-32 of A-106 Appendix A - Callaway PRA Gap AnalysisREVIEW generic analyses of similar plants to assess whether the list of challenges included in the model accounts for industry experience.This was performed in the original PRA in Calculation ZZ-256, which has not been revisited. There doesn't appear to be any process to review current industry lists. The Callaway PRA meets SR IE-A3aIE-2Doc.ModelSRIE-A3aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM a systematic evaluation of each system, including support systems, to assess the possibility of an initiating event occurring due to a failure of the system. USE a structured approach (such as a system-by-system review of initiating event potential, or an FMEA  [failure modes and effects analysis], or other systematic process) to assess and document the possibility of an initiating event resulting from individual systems or train failures.The initial screening of the systems was performed during the initial PRA and is discussed in 3.1.1.1.3 of the IPE submittal. Detailed FMEAs were developed for those systems identified as leading to plant trip. However, there was no justification provided for the exclusion of systems for which FMEAs were not performed. The FMEAs performed were documented in Calcs ZZ-116 (DC Power), ZZ-119 (AC Power), ZZ-120 (HVAC), EA-03 (SWS), EG-18 (CCWS), KA-30 (IAS). These FMEAs or the screening evaluations have not been revisited since the IPE. In order to meet Category 2 requirements, the documentation of the basis for the disposition of each system as an initiating event must be specified. In order to keep this documentation current, a review of the applicability of the FMEAs/screening basis should be made during each model update.IE-3Doc.ModelSRIE-A4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen performing the systematic evaluation required in IE-A4, INCLUDE initiating events resulting from multiple failures, if the equipment failures result from a common cause, and from routine system alignments.The support system FMEAs were examined on the basis of loss of each load. If loss of that load resulted in a reactor trip and loss of mitigation capability the event was identified as an initiating event, regardless of the necessary failures to lose the load. The IE fault trees contain random as well as common cause events. Other than the documentation requirements discussed above, the Callaway models meet the Category 3 requirements for IE-A4aDoc.ModelSRIE-A4aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-33 of A-106 Appendix A - Callaway PRA Gap AnalysisIn the identification of the initiating events, INCORPORATE(a)  events that have occurred at conditions other than at-power operation (i.e., during low-power or shutdown conditions), and for which it is determined that the event could also occur during at-power operation.
(b)  events resulting in a controlled shutdown that includes a scram prior to reaching low -power conditions, unless it is determined that an event is not applicable to at-power operation.The screening process does not distinguish why events which occur during non-power were excluded. Therefore SR IE-A5 is not met.IE-4Doc.ModelSRIE-A5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementINTERVIEW plant personnel (e.g., operations, maintenance, engineering, safety analysis) to determine if potential initiating events have been overlooked.The IPE calculations were reviewed by each of the mentioned groups prior to the IPE submittal however, it is not clear if this process is ever revisited. The analysis meets Cat. 2 SR IE-A6 but should be revisited as part of each major update.IE-5Doc.ModelSRIE-A6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW plant-specific operating experience for initiating event precursors, for the purposes of identifying additional initiating events  For example, plant-specific experience with intake structure clogging might indicate that loss of intake structures should be identified as a potential initiating event.There was no evidence found  that operating experience was reviewed with precursors in mind. If an event did not result in the generation of a trip or an LER, then it was not reviewed.
Interviews with operations and maintenance personnel would be one method to meet SR IE-A7. The current analysis does not meet Cat 2 SR IE-A7.IE-6Doc.ModelSRIE-A7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCOMBINE initiating events into groups to facilitate definition of accident sequences in the Accident Sequence Analysis element (para. 4.5.2) and to facilitate quantification in the Quantification element (para. 4.5.8).Callaway groups the IEs into logical groups and meets SR IE-B1.Doc.ModelSRIE-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-34 of A-106 Appendix A - Callaway PRA Gap AnalysisUSE a structured, systematic process for grouping initiating events. For example, such a systematic approach may employ master logic diagrams, heat balance fault trees, or failure modes and effects analysis (FMEA).The Callaway IPE used a structured approach to group the individual initiating events and meets SR IE-B2Doc.ModelSRIE-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementGROUP initiating events only when the following is true:
(a) events can be considered similar in terms of plant response, success criteria, timing, and the effect on the operability and performance of operators and relevant mitigating systems; or (b)  events can be subsumed into a group and bounded by the worst case impacts within the "new" group.AVOID subsuming events into a group unless:
(i) the impacts are comparable to or less than those of the remaining events in that group, AND(ii) it is demonstrated that such grouping does not impact significant accident sequences.The method Callaway used to group the individual initiating events looked at the impact to the plant and whether they required a different plant response or different mitigating system impact. If no additional plant effects were identified, the event was considered to be in either the T2, transient w/MFW unavailable or T3, transient w/MFW available depending upon the impact to the plant. The documentation of the initiating event grouping does not discuss timing issues which may impact the success criteria or human error evaluations. The success criteria used to evaluate the event trees are selected to represent the worst case scenario for the IE group. The HEP quantification where an event is performed for the limiting time window. The Cat. 2 criteria for SR IE-B3 are therefore met.Doc.ModelSRIE-B3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementGROUP separately from other initiating event categories those categories with different plant response (i.e., those with different success rate criteria) impacts or those that could have more severe radionuclide release potential (e.g.,
LERF). This includes such initiators as excessive LOCA, interfacing systems LOCA, steam generator tube ruptures, and unisolated breaks outside containment.All scenarios which are LERF scenarios are maintained separately. The success criteria are a major factor in grouping. The Callaway PRA meets SR IE-B4.Doc.ModelSRIE-B4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-35 of A-106 Appendix A - Callaway PRA Gap AnalysisCALCULATE the initiating event frequency accounting for relevant generic and plant specific data unless it is justified that there are adequate plant specific data to characterize the parameter value and its uncertainty.  (See also IE-C11 for requirements for rare and extremely rare events)The IE frequencies do not include any distribution information.
The Callaway PRA justifies excluding the early operational data not indicative of normal plant power operation. The IE frequencies need to have uncertainty bounds assigned to meet SR IE-C1.IE-7Doc.ModelSRIE-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen using plant-specific data, USE the most recent applicable data to quantify the initiating event frequencies. JUSTIFY excluded data that is not considered to be either recent or applicable (e.g., provide evidence via design or operational change that the data are no longer applicable.)The IE frequencies do not include any distribution information.
The Callaway PRA justifies excluding the early operational data not indicative of normal plant power operation. The IE frequencies need to have uncertainty bounds assigned to meet SR IE-C1a.IE-7Doc.ModelSRIE-C1aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCREDIT recovery actions (those implied in IE-C4(c), and those implied and discussed in IE-C6 through IE-C9) as appropriate  JUSTIFY each such credit (as evidenced such as through procedures or training).As noted in SY, the Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and loss of SWS initiating events. The recovery events, which include recovery of CCF of pumps and valves lack sufficient analysis or data. The Callaway PRA does not meet SR IE-C1b.  (See also SY-22)IE-8Doc.ModelSRIE-C1bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen combining evidence from generic and plant specific data, USE a Bayesian update process or equivalent statistical process. JUSTIFY the selection of any informative prior distribution used on the basis of industry experience.  [See Note 2]The Callaway IPE uses Bayesian update techniques, however, limited justification is provided about the informative prior distribution. SR IE-C2 is met. Refer to note 2 of the standard for guidance.IE-9Doc.ModelSRIE-C2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-36 of A-106 Appendix A - Callaway PRA Gap AnalysisCALCULATE initiating event frequencies on a reactor year basis. [See Note 3]  INCLUDE in the initiating event analysis the plant availability, such that the frequencies are weighted by the fraction of time the plant is at-power.The Callaway PRA does not make this correction. Note that the T2 and T3 initiating events already include this based on the data collection method and calculation. SR-C3 is not explicitly met for the other initiating events. Refer to the ASME Standard for guidance on making this correction.IE-10Doc.ModelSRIE-C3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUSE as screening criteria no higher than the following characteristics (or more stringent characteristics as devised by the analyst) to eliminate initiating events or groups from further evaluation:(a)  the frequency of the event is less than 1E-7 per reactor year (/ry) and the event does not involve either an ISLOCA, containment bypass, or reactor pressure vessel rupture (b)  the frequency of the event is less than 1E-6/ry and core damage could not occur unless at least two trains of mitigating systems are failed independent of the initiator, or (c)  the resulting reactor shutdown is not an immediate occurrence. That is, the event does not require the plant to go to shutdown conditions until sufficient time has expired during which the initiating event conditions, with a high degree of certainty (based on supporting calculations), are detected and corrected before normal plant operation is curtailed (either administratively or automatically).
If either criterion (a) or (b) above is used, then CONFIRM that the value specified in the criterion meets the applicable requirements in the Data Analysis section (para. 4.5.6) and the Level 1 Quantification section (para. 4.5.8).No internal event initiating event was screened from the evaluation. SR IE-C4 is met.Doc.ModelSRIE-C4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementNo requirement for time trend analysis.No time trend analysis is required for Cat. 2 SR IE-C5.Doc.ModelSRIE-C5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-37 of A-106 Appendix A - Callaway PRA Gap AnalysisSome initiating events are amenable to fault-tree modeling as the appropriate way to quantify them. These initiating events, usually support system failure events, are highly dependent upon plant-specific design features. If fault-tree modeling is used for initiating events, USE the applicable systems-analysis requirements for fault-tree modeling found in the Systems Analysis section (para. 4.5.4).The Callaway PRA uses fault trees to calculate the support system initiating events. The support system initiator fault trees are based on the system fault trees and meet SR IE-C6.Doc.ModelSRIE-C6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIf fault tree modeling is used for initiating events, QUANTIFY the initiating event frequency (as opposed to the probability of an initiating event over a specific time frame, which is the usual fault tree quantification model described in the Systems Analysis section, para. 4.5.4.). MODIFY, as necessary, the fault tree computational methods that are used so that the top event quantification produces a failure frequency rather than a top event probability as normally computed. USE the applicable requirements in the Data Analysis section, para. 4.5.6, for the data used in the fault-tree quantification.The fault trees used to quantify the support system initiating events all appear to use the correct computational methodology however the clarity is somewhat limited. The quantification process and maintenance of the support system initiating event fault trees could be improved and a better understanding of the support system importance by actually using a modified support system fault tree to generate an equation which then is assigned to the initiating event for the corresponding event tree. The current methodology marginally meets SR IE-C7 and IE-C8.IE-11Doc.ModelSRIE-C7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIf fault-tree modeling is used for initiating events, CAPTURE within the initiating event fault tree models all relevant combinations of events involving the annual frequency of one component failure combined with the unavailability (or failure during the repair time of the first component) of other components.The fault trees used to quantify the support system initiating events all appear to use the correct computational methodology however the clarity is somewhat limited. The quantification process and maintenance of the support system initiating event fault trees could be improved and a better understanding of the support system importance by actually using a modified  support system fault tree to generate an equation which then is assigned to the initiating event for the corresponding event tree.
The current methodology marginally meets SR IE-C7 and IE-C8.IE-11Doc.ModelSRIE-C8Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-38 of A-106 Appendix A - Callaway PRA Gap AnalysisIf fault-tree modeling is used for initiating events, USE plant-specific information in the assessment and quantification of recovery actions where available, consistent with the applicable requirements in the Human Reliability Analysis section (para. 4.5.5)The Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and loss of SWS initiating events.
The recovery events, which include recovery of CCF of pumps and valves lack sufficient analysis or data. The Callaway PRA does not meet criterion IE-C9.IE-8Doc.ModelSRIE-C9Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCOMPARE results and EXPLAIN differences in the initiating event analysis with generic data sources to provide a reasonableness check of the results.There is no documentation of a comparison with generic data sources for the support system initiating event fault tree results. This comparison needs to be documented as part of each update in order to meet SR IE-C10.IE-12Doc.ModelSRIE-C10Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor rare initiating events, USE industry generic data and INCLUDE plant-specific functions. For extremely rare initiating events, engineering judgment may be used; if used, AUGMENT with applicable generic data sources.
Refer to para. 4.3, Use of Expert Judgment, as appropriate.For purposes of this Requirement, a "rare event" might be expected to occur one or a few times throughout the world nuclear industry over many years. An "extremely rare event" would not be expected to occur even once throughout the industry over many years.The basis for initiating event frequencies used for the rare and extremely rare IEs are well documented and are from acceptable sources. SR IE-C11 is met.Doc.ModelSRIE-C11Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-39 of A-106 Appendix A - Callaway PRA Gap AnalysisIn the ISLOCA frequency analysis, INCLUDE the following features of plant and procedures that influence the ISLOCA frequency:(a)  configuration of potential pathways including numbers and types of values and their relevant failure modes existence and positioning of relief valves (b)  provision of protective interlocks(c)  relevant surveillance test procedures.(d) the capability of secondary system piping (e)  isolation capabilities given high flow/differential pressure conditions that might exist following breach of the secondary system,The Callaway treatment of ISLOCA addresses items a-d and may include item e but that is not clear. The ISLOCA documentation is good for the evaluation of the high/low interfaces (ZZ-105) however the documentation of the quantification from that point on is minimal, is not incorporated in the main model, and has not been revised or reexamined since the IPE submittal. The ISLOCA model as it now stands does not meet SR IE-C12.IE-13Doc.ModelSRIE-C12Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCHARACTERIZE the uncertainty in the initiating event frequencies and PROVIDE mean values for use in the quantification of the PRA results.The data used in the PRA quantification are mean values but there is no characterization of the uncertainty. Therefore SR IE-C13 is not met.IE-7Doc.ModelSRIE-C13Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the initiating event analysis in a manner that facilitates PRA applications, upgrades, and peer review.The initiating event analysis documentation does not facilitate PRA applications, upgrades, and peer review.IE-14Doc.ModelSRIE-D1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-40 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the processes used to select, group, and screen the initiating events and to model and quantify the initiating event frequencies, including the inputs, methods, and results. For example, this documentation typically includes:
(a)  the functional categories considered and the specific initiating events included in each.(b)  the systematic search for plant-unique and plant-specific support system initiators.
(c)  the systematic search for RCS pressure boundary failures and interfacing system LOCAs.(d)  the approach for assessing completeness and consistency of initiating events with plant-specific experience, industry experience, other comparable PRAs and FSAR initiating events.
(e)  the basis for screening out initiating events.(f)  the basis for grouping and subsuming initiating events(g)  the dismissal of any observed initiating events, including any credit for recovery (h)  the derivation of the initiating event frequencies and the recoveries used.
(i)  the approach to quantification of each initiating event frequency. (j)  the justification for exclusion of any data.The current documentation of the initiating event selection, grouping, screening, modeling, and quantification is scattered throughout multiple calculation packages and only small portions have been updated since the completion of the IPE.
The documentation could be significantly enhanced by combining all IE related calculations into one IE calculation package and making a commitment to revisit the calculation during each model update.IE-14Doc.ModelSRIE-D2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the key assumptions and key sources uncertainty associated with the initiating event analysis.The assumptions made during the initiating events analysis are spread throughout multiple documents which makes it difficult to judge whether the assumptions are fully documented.
Likewise, the key sources of uncertainty in the initiating events analysis are spread throughout multiple documents which makes it difficult to judge whether the assumptions are fully documented.IE-14Doc.ModelSRIE-D3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-41 of A-106 Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementIFDEFINE flood areas by dividing the plant into physically separate areas where a flood area is viewed as generally independent of other areas in terms of the potential for internal flooding effects and flood propagation.Internal flooding evaluation meets this requirement. ZZ-434. ZZ-279.Doc.ModelSRIF-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDEFINE flood areas at the level of individual rooms or combined rooms/halls for which plant design features exist to restrict flooding.This requirement is met at Category II/III. ZZ-434.
ZZ-279.Doc.ModelSRIF-A1aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUSE plant information sources that reflects the as-built as-operated plant to support development of flood areas.Internal flooding evaluation meets this requirement. ZZ-434.
ZZ279.Doc.ModelSRIF-A3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCONDUCT plant walkdown(s) to verify the accuracy of information obtained from plant information sources and to obtain or verify:(a)  spatial information needed for the development of flood areas, and (b)  plant design features credited in defining flood areas.
Note:  A walkdown(s) may be done in conjunction with the requirements of IF-B3a, IF-C9 and IF-E8.This requirement is met. ZZ-436. ZZ-279. ZZ-274.Doc.ModelSRIF-A4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-42 of A-106 Appendix A - Callaway PRA Gap AnalysisFor each flood area, IDENTIFY the potential sources of flooding [Note 1]. INCLUDE:(a)  equipment (e.g., piping, valves, pumps) located in the area that are connected to fluid systems (e.g., circulating water system, service water system, component cooling water system, feedwater system, condensate and steam systems)(b)  plant internal sources of flooding (e.g., tanks or pools) located in the flood area (c)  plant external sources of flooding (e.g., reservoirs or rivers) that are connected to the area through some system or structure(d)  in-leakage from other flood areas (e.g., back flow through drains, doorways, etc.)This requirement is met. ZZ-466Doc.ModelSRIF-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementSCREEN OUT flood areas with none of the potential sources of flooding listed in IF-B1and IF-B1a.This requirement is met. ZZ-462, ZZ-466.Doc.ModelSRIF-B1bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each potential source of flooding, IDENTIFY the flooding mechanisms that would result in a fluid release. INCLUDE:
(a)  failure modes of components such as pipes, tanks, gaskets, expansion joints, fittings, seals, etc.
(b)  human-induced mechanisms that could lead to overfilling tanks, diversion of flow through openings created to perform maintenance; inadvertent actuation of fire suppression system (c)  other events resulting in a release into the flood areaThis requirement is met. ZZ-466.Doc.ModelSRIF-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-43 of A-106 Appendix A - Callaway PRA Gap AnalysisFor each source and its identified failure mechanism, IDENTIFY the characteristic of release and the capacity of the source. INCLUDE: (a)  a characterization of the breach, including type (e.g., leak, rupture, spray)
(b)  flow rate (c)  capacity of source (e.g., gallons of water)(d)  the pressure and temperature of the sourceThis requirement is met. ZZ-466.Doc.ModelSRIF-B3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCONDUCT plant walkdown(s) to verify the accuracy of information obtained from plant information sources and to determine or verify the location of flood sources and in-leakage pathwaysNote: Walkdown(s) may be done in conjunction with the requirements of IF-A4, IF-C9 and IF-E8.This requirement is met. ZZ-436. ZZ-279. ZZ-274.Doc.ModelSRIF-B3aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each defined flood area and each flood source, IDENTIFY the propagation path from the flood source area to its area of accumulation.This requirement is met. ZZ-436.Doc.ModelSRIF-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-44 of A-106 Appendix A - Callaway PRA Gap AnalysisFor each defined flood area and each flood source, IDENTIFY plant design features that have the ability to terminate or contain the flood propagation. INCLUDE the presence of :
(a)  flood alarms, (b)  flood dikes, curbs, sumps (i.e., physical structures that allow for the accumulation and retention of water),(c)  drains (i.e., physical structures that can function as drains),
(d)  sump pumps, spray shields, water-tight doors, and (e)  blowout panels or dampers with automatic or manual operation capability.This requirement is met. ZZ-466Doc.ModelSRIF-C2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each defined flood area and each flood source, IDENTIFY those automatic or operator responses that have the ability to terminate or contain the flood propagation.This requirement is not met. ZZ-466 treats operator response in a generic sense.IF-5Doc.ModelSRIF-C2aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementESTIMATE the capacity of the drains and the amount of water retained by sumps, berms, dikes and curbs. ACCOUNT for these factors in estimating flood volumes and SSC impacts from flooding.This requirement is met. ZZ-466Doc.ModelSRIF-C2bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-45 of A-106 Appendix A - Callaway PRA Gap AnalysisFor each flood area not screened out using the requirements under other Internal Flooding supporting requirements (e.g., IF-B1b and IF-C5), IDENTIFY the SSCs located in each defined flood area and along flood propagation paths that are modeled in the internal events PRA model as being required to respond to an initiating event or whose failure would challenge normal plant operation, and are susceptible to flood. For each identified SSC, IDENTIFY, for the purpose of determining its susceptibly per IF-C3, its spatial location in the area and any flooding mitigative features (e.g., shielding, flood or spray capability ratings).This requirement is met. ZZ-466. Additionally, SSCs identified for most flood zones that were screened out.Doc.ModelSRIF-C2cCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor the SSCs identified in IF-C2c, IDENTIFY the susceptibility of each SSC in a flood area to flood-induced failure mechanisms.
INCLUDE failure by submergence and spray in the identification process.EITHER:(a)  ASSESS qualitatively the impact of flood-induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement), by using conservative assumptions; OR(b)  NOTE that these mechanisms are not included in the scope of the evaluation.This requirement is met to Category I/II. ZZ-462, ZZ-466Doc.ModelSRIF-C3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIn applying SR IF-C3 to determine susceptibility of SSCs to flood-induced failure mechanisms, TAKE CREDIT for the operability of SSCs identified in IF-C2c with respect to internal flooding impacts only if supported by an appropriate combination of:
(a)  test or operational data(b)  engineering analysis(c)  expert judgment.This requirement is met. ZZ-462, ZZ-466Doc.ModelSRIF-C3aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-46 of A-106 Appendix A - Callaway PRA Gap AnalysisIDENTIFY inter-area propagation through the normal flow path from one area to another via drain lines; and areas connected via back flow through drain lines involving failed check valves, pipe and cable penetrations (including cable trays), doors, stairwells, hatchways, and HVAC ducts.
INCLUDE potential for structural failure (e.g., of doors or walls) due to flooding loads.This requirement is met to Category II. ZZ-466.Doc.ModelSRIF-C3bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM any necessary engineering calculations for flood rate, time to reach susceptible equipment, and the structural capacity of SSCs in accordance with the applicable requirements described in Table 4.5.3-2(b).This requirement is met. ZZ-466Doc.ModelSRIF-C3cCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDEVELOP flood scenarios (i.e., the set of information regarding the flood area, source, flood rate and source capacity, operator actions, and SSC damage that together form the boundary conditions for the interface with the internal events PRA) by examining the equipment and relevant plant features in the flood area and areas in potential propagation paths, giving credit for appropriate flood mitigation systems or operator actions, and identifying susceptible SSCs.This requirement is met. ZZ-462, ZZ-466Doc.ModelSRIF-C4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-47 of A-106 Appendix A - Callaway PRA Gap AnalysisSCREEN OUT flood areas where flooding of the area does not cause an initiating event or a need for immediate plant shutdown, AND either of the following applies:
(a) the flood area (including adjacent areas where flood sources can propagate) contains no mitigating equipment modeled in the PRA; OR(b) the flood area has no flood sources sufficient (e.g., through spray,  immersion, or other applicable mechanism) to cause failure of the equipment identified in IF-C2c.
DO NOT USE failure of a barrier against inter-area propagation to justify screening (i.e., for the purposes of screening, do not credit such failures as a means of beneficially draining the area)
JUSTIFY any other qualitative screening criteria.This requirement is met. ZZ-436.Doc.ModelSRIF-C5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementSCREEN OUT flood areas where flooding of the area does not cause an initiating event or a need for immediate plant shutdown, AND the following applies:The flood area contains flooding mitigation systems (e.g., drains or sump pumps) capable of preventing unacceptable flood levels, and the nature of the flood does not cause equipment failure (e.g., through spray, immersion, or other applicable failure mechanisms).
DO NOT CREDIT mitigation systems for screening out flood areas unless there is a definitive basis for crediting the capability and reliability of the flood mitigation system(s).This requirement is met. ZZ-436, ZZ-466.Doc.ModelSRIF-C5aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-48 of A-106 Appendix A - Callaway PRA Gap AnalysisUSE potential human mitigative actions as additional criteria for screening out flood areas if all the following can be shown: (a) flood indication is available in the control room (b) the flood sources in the area can be isolated (c) the mitigative action can be performed with high reliability for the worst flooding initiator. High reliability is established by demonstrating, for example, that the actions are procedurally directed, that adequate time is available for response, that the area is accessible, and that there is sufficient manpower available to perform the actions.This requirement is met to Category I only. ZZ-466 allows the operator intervention and mitigation for floods that take 30 minutes or longer. Isolation and available manpower not specifically addressed. F&O IF-3IF-3Doc.ModelSRIF-C6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementSCREEN OUT flood sources if it can be shown that:
(a)  the flood source is insufficient (e.g., through  spray,  immersion, or other applicable mechanism) to cause failure of equipment identified in IF-C2c; OR(b)  the area flooding mitigation systems (e.g., drains or sump pumps) are capable of preventing unacceptable flood levels and nature of the flood does not cause  failure of equipment identified in IF- C2c (e.g., through spray, immersion, or other applicable failure mechanism); OR(c)  the flood only affects the system that is the flood source and the systems analysis addresses this per SY-A13 and SY-A14 and need not be treated as a separate internal flooding initiating event.This requirement is met. ZZ-466, ZZ-436.Doc.ModelSRIF-C7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-49 of A-106 Appendix A - Callaway PRA Gap AnalysisUSE potential human mitigative actions as additional criteria for screening out flood sources if all the following can be shown: (a) flood indication is available in the control room, (b) the flood source can be isolated, and (c) the mitigative action can be performed with high reliability for the worst flood from that source. High reliability is established by demonstrating, for example, that the actions are procedurally directed, that  adequate time is available for response, that the area is accessible, and that there is sufficient manpower available to perform the actions.This requirement is met to Category I only. ZZ-466 allows the operator intervention and mitigation for floods that take 30 minutes or longer. Isolation and available manpower not specifically addressed. F&O IF-3IF-3Doc.ModelSRIF-C8Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCONDUCT plant walkdown(s) to verify the accuracy of information obtained from plant information sources and to obtain or verify:
(a)  SSCs located within each defined flood area(b)  flood / spray / other applicable mitigative features of the SSCs located within each defined flood area (e.g., drains, shields, etc.)
(c)  pathways that could lead to transport to the flood area Note: Walkdown(s) may be done in conjunction with the requirements of IF-A4, IF-B3a and IF-E8.This requirement is met. ZZ-436, ZZ-466.Doc.ModelSRIF-C9Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each flood scenario,  IDENTIFY the corresponding plant initiating event group identified per Table 4.5.7-1 and the scenario-induced failures of SSCs required to respond to the plant initiating event. INCLUDE the potential for a flooding-induced transient or LOCA.
If an appropriate plant initiating event group does not exist, CREATE a new plant initiating event group in accordance with the applicable requirements of Table 4.5.1-2(b).This requirement is met. The flooding initiators are not grouped with any other initiator. ZZ-462.Doc.ModelSRIF-D1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-50 of A-106 Appendix A - Callaway PRA Gap AnalysisGROUP flooding scenarios identified in IF-C4 only when the following  is true:(a) scenarios can be considered similar in terms of plant response, success criteria, timing, and the effect on the operability and performance of operators and relevant mitigating systems; or (b) scenarios can be subsumed into a group and bounded by the worst case impacts within the "new" group.AVOID subsuming scenarios into a group unless:
(i) the impacts are comparable to or less than those of the remaining scenarios in that group, AND(ii) it is demonstrated that such grouping does not impact significant accident sequences.This requirement is met to Category III since the flooding initiators are treated individually and not grouped. ZZ-462.Doc.ModelSRIF-D3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementGROUP OR SUBSUME the flood initiating scenarios with an existing plant initiating event group, if the impact of the flood (i.e., plant response and mitigating system capability) is the same as a plant initiating event group already considered in the PRA in accordance with the applicable requirements of Table 4.5.1-2(b).This requirement is met to Category III. Flooding initiators are not grouped or subsumed into other plant initiating event groups.      ZZ-434, ZZ-436, ZZ-466.Doc.ModelSRIF-D3aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDETERMINE the flood initiating event frequency for each flood scenario group by using the applicable requirements in Table 4.5.1-2(c).This requirement is met to Category I. The flood initiating event frequencies are based on generic pipe break frequencies. No plant specific experience is considered in the determination of the flooding initiator frequencies. Plant experience at the time the flooding analysis was performed was 0 events. Documentation of the plant specific considerations used in the development of the scenarios needs to be added as discussed in SR IF-D5a.IF-1Doc.ModelSRIF-D5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-51 of A-106 Appendix A - Callaway PRA Gap AnalysisGATHER plant-specific information on plant design, operating practices and conditions that may impact flood likelihood (i.e., material condition of fluid systems, experience with water hammer, and maintenance induced floods).
In determining the flood initiating event frequencies for flood scenario groups, USE a combination of (a) generic and plant-specific operating experience, (b) pipe, component, and tank rupture failure rates from generic data sources and plant-specific experience, and (c) engineering judgment for consideration of the plant-specific information collected,This requirement is met to Category I. The flood initiating event frequencies are based on generic pipe break frequencies.
No plant specific experience is considered in the determination of the flooding initiator frequencies. Plant experience at the time the flooding analysis was performed was 0 events. Documentation of the plant specific considerations used in the development of the scenarios needs to be added as discussed in SR IF-D5a.IF-1Doc.ModelSRIF-D5aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementINCLUDE consideration of human-induced floods during maintenance through application of generic data.This requirement is met to Category I/II. IPE discusses maintenance induced floods and that they will not be explicitly considered due to low potential.Doc.ModelSRIF-D6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementSCREEN OUT flood scenario groups if (a)  the quantitative screening criteria in IE-C4, as applied to the flood scenario groups, are met,  OR (b)  the internal flooding initiating event  affects only  components in a single system, AND it can be shown that the product of the frequency of the flood and the probability of SSC failure given the flood is two orders of magnitude lower than the product of the non-flooding frequency for the corresponding initiating event in the PRA, and the random (non-flood-induced) failure probability of the same SSCs that are assumed failed by the flood. If the flood impacts multiple systems, DO NOT screen on this basis.This requirement is considered to be met. No screening is performed based on the value of the flood initiating frequency.
ZZ-466.Doc.ModelSRIF-D7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-52 of A-106 Appendix A - Callaway PRA Gap AnalysisFor each flood scenario, REVIEW the accident sequences for the associated plant initiating event group to confirm applicability of the accident sequence model.
If appropriate accident sequences do not exist, MODIFY sequences as necessary to account for any unique flood-induced scenarios and/or phenomena in accordance with the applicable requirements described in para. 4.5.2.This requirement is met. ZZ-462.Doc.ModelSRIF-E1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementMODIFY the systems analysis results obtained by following the applicable requirements described in para 4.5.4 to include flood-induced failures identified by IF-C3.This requirement is met. ZZ-462.Doc.ModelSRIF-E3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementSCREEN OUT a flood area if the product of the sum of the frequencies of the flood scenarios for the area, and the bounding conditional core damage probability (CCDP) is less than 1E-9/reactor yr.
The bounding CCDP is the highest of the CCDP values for the flood scenarios in an area.This requirement is not met at any Category. The Category I/II screening quantitative criteria in the standard is 1E-09/year. ZZ-466 screening criteria was 1E-06/yr.IF-2Doc.ModelSRIF-E3aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIf additional analysis of SSC data is required to support quantification of flood scenarios, PERFORM the analysis in accordance with the applicable requirements described in para. 4.5.6.This requirement is met. ZZ-462.Doc.ModelSRIF-E4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-53 of A-106 Appendix A - Callaway PRA Gap AnalysisIf additional human failure events are required to support quantification of flood scenarios, PERFORM any human reliability analysis in accordance with the applicable requirements described in Tables 4.5.5-2(e) through Table 4.5.5-2(h).This requirement is not met. The HEP values used in ZZ-466 are not developed from a human reliability analysis.IF-4Doc.ModelSRIF-E5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor all human failure events in the internal flood scenarios, INCLUDE the following scenario-specific impacts on PSFs for control room and ex-control room actions as appropriate to the HRA methodology being used:(a) additional workload and stress (above that for similar sequences not caused by internal floods)
(b) cue availability (c) effect of flood on mitigation, required response, timing, and recovery activities (e.g., accessibility restrictions, possibility of physical harm)
(d) flooding-specific job aids and training (e.g., procedures, training exercises)This requirement is not met. The HEP values used in ZZ-466 are not developed from a human reliability analysis.IF-4Doc.ModelSRIF-E5aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM internal flood sequence quantification in accordance with the applicable requirements described in para. 4.5.8.This requirement is met. ZZ-462.Doc.ModelSRIF-E6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementINCLUDE, in the quantification, the combined effects of failures caused by flooding and those coincident with the flooding due to independent causes including equipment failures, unavailability due to maintenance, and other credible causes.This requirement is met. ZZ-462.Doc.ModelSRIF-E6aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-54 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE, in the quantification, both the direct effects of the flood (e.g., loss of cooling from a service water train due to an associated pipe rupture) and indirect effects such as submergence, jet impingement, and pipe whip, as applicable.This requirement is met. ZZ-462.Doc.ModelSRIF-E6bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFor each flood scenario, REVIEW the LERF analysis to confirm applicability of the LERF sequences. If appropriate LERF sequences do not exist, MODIFY the LERF analysis as necessary to account for any unique flood-induced scenarios or phenomena in accordance with the applicable requirements described in para. 4.5.9..This requirement is not met. The internal flooding sequences are not considered in the LERF analysis.IF-6Doc.ModelSRIF-E7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCONDUCT walkdown(s) to verify the accuracy of information obtained from plant information sources and to obtain or verify inputs to:
(a)  engineering analyses (b)  human reliability analyses(c)  spray or other applicable impact assessments(d)  screening decisions Note: A walkdown(s) may be done in conjunction with the requirements of IF-A4, IF-B3a, and IF-C9.This requirement is met. ZZ-436, ZZ-466.Doc.ModelSRIF-E8Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the internal flooding analysis in a manner that facilitates PRA applications, upgrades, and peer review.This requirement is met. ZZ-436, ZZ-466, ZZ-434, ZZ-462, IPE.Doc.ModelSRIF-F1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-55 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the process used to identify flood sources, flood areas, flood pathways, flood scenarios, and their screening, and internal flood model development and quantification. For example, this documentation typically includes:
(a) flood sources identified in the analysis, rules used to screen out these sources, and the resulting list of sources to be further examined(b) flood areas used in the analysis and the reason for eliminating areas from further analysis (c) propagation pathways between flood areas and key assumptions, calculations, or other bases for eliminating or justifying propagation pathways(d) accident mitigating features and barriers credited in the analysis, the extent to which they were credited, and associated justification (e) key assumptions or calculations used in the determination of the impacts of submergence, spray, temperature, or other flood-induced effects on equipment operability(f) screening criteria used in the analysis (g) flooding scenarios considered, screened, and retained (h) description of how the internal event analysis models were modified to model these remaining internal flooding scenarios (i) flood frequencies, component unreliabilities/unavailabilities, and HEPs used in the analysis (i.e., the data values unique to the flooding analysis)
(j) calculations or other analyses used to support or refine the flooding evaluation (k) results of the internal flooding analysis, consistent with the quantification requirements provided in HLR QU-DThis requirement is met. ZZ-436, ZZ-466, ZZ-434, ZZ-462, IPE.Doc.ModelSRIF-F2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDocument the key assumptions and key sources of uncertainty associated with the internal flooding analysis.This requirement is met. ZZ-436, ZZ-466, ZZ-434, ZZ-462, IPE.Doc.ModelSRIF-F3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-56 of A-106 Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementLEIDENTIFY those physical characteristics at the time of core damage that can influence  LERF. Examples include:(a)  RCS pressure (high RCS pressure can result in high pressure melt ejection)
(b)  status of emergency core coolant systems (failure in injection can result in a dry cavity and extensive Core Concrete Interaction)(c) status of containment isolation (failure of isolation can result in an unscrubbed release)
(d)  status of containment heat removal (e) containment integrity (e.g., vented, bypassed or failed)
(f) steam generator pressure and water level (PWRs)(g) status of containment inerting (BWRs)These items were included, but not specifically stated.Doc.ModelSRLE-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY the accident sequence characteristics that lead to the physical characteristics identified in LE-A1. Examples include:
(a)  type of initiator  (1)  Transients can result in high RCS pressure  (2)  LOCAs usually result in lower RCS pressure (3)  ISLOCAs, SGTRs can result in containment bypass.
(b)  status of electric power: loss of electric power can result in loss of ECC injection(c)  status of containment safety systems such as sprays, fan coolers, igniters, or venting systems:  operability of containment safety systems determines status of containment heat removal The references in Notes (1) and (2) provide example lists of typical characteristics.All includedDoc.ModelSRLE-A2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-57 of A-106 Appendix A - Callaway PRA Gap AnalysisIDENTIFY how the physical characteristics identified in LE-A1 and the accident sequence characteristics identified in LE-A2 are addressed in the LERF analysis. For example, (a) which characteristics are addressed in the level 1 event trees, (b) which characteristics, if any, are addressed in bridge trees, and (c) which characteristics, if any, are addressed in the containment event trees. JUSTIFY any characteristics identified in LE-A1 or LE-A2 that are excluded from the LERF analysis.This is obvious from the analysis.Doc.ModelSRLE-A3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPROVIDE a method to explicitly account for the LE-A1 and LE-A2 characteristics and ensure that dependencies between the Level 1 and Level 2 models are properly treated. Examples include:  treatment in Level 2, expanding Level 1, construction of a bridge tree, transfer of the information via PDS, or a combination of these.The Level 2 PDS trees are explicitly solved to retain dependencies.Doc.ModelSRLE-A4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDEFINE plant damage states consistent with LE-A1, LE-A2, LE-A3, and LE-A4.DoneDoc.ModelSRLE-A5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-58 of A-106 Appendix A - Callaway PRA Gap AnalysisIDENTIFY LERF contributors from the set identified in Table 4.5.9-3. INCLUDE as appropriate, unique plant issues as determined by expert judgment and/or engineering analyses.Not necessarily done. LERF identified based on source term and timing. Not evident that containment isolation failure is included. Not evident that HPME is included.
Probability of containment isolation failure leading to LERF does not contain a term to represent undetected, residual failures in containment structural integrity. This has been estimated at 5E-3 in NUREG/CR-4550. Failure of containment isolation is derived by fault tree analysis of the containment isolation combinations on the penetration paths. There are three LERF split fractions with probabilities of 7.7E-4. If the 5E-3 was added to this, the split fraction would change, although LERF would not move significantly. Split fractions for induced SGTR and HPME were not explicitly stated in the documentation available for review.LE-1Doc.ModelSRLE-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDETERMINE the containment challenges (e.g., temperature, pressure loads, debris impingement) resulting from contributors identified in LE-B1 using applicable generic or plant-specific analyses for significant containment challenges. USE conservative treatment or a combination of conservative and realistic treatment for non-significant containment challenges. If generic calculations are used in support of the assessment, JUSTIFY applicability to the plant being evaluated.Used plant specific analysis to develop bridge trees whose success criteria are based on MAAP  3. Used realistic estimate for phenomenaDoc.ModelSRLE-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUTILIZE supporting engineering analyses in accordance with the applicable requirements of Table 4.5.3-2(b).DoneDoc.ModelSRLE-B3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-59 of A-106 Appendix A - Callaway PRA Gap AnalysisDEVELOP accident sequences to a level of detail to account for the potential contributors identified in LE-B1 and analyzed in LE-B2. Compare the containment challenges analyzed in LE-B with the containment structural capability analyzed in LE-D and identify accident progressions that have the potential for a large early release.JUSTIFY any generic or plant- specific calculations or references used to categorize releases as non-LERF contributors based on release magnitude or timing. NUREG/CR-6595, App. A [Note (1)] provides an acceptable definition of LERF source terms.DoneDoc.ModelSRLE-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementINCLUDE realistic treatment of feasible operator actions following the onset of core damage consistent with applicable procedures, e.g., EOPs/SAMGs, proceduralized actions, or Technical Support Center guidance.No risk significant additional human actions after core damage occurs are included in the level 2.Doc.ModelSRLE-C2aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW significant accident progression sequences resulting in a large early release to determine if repair of equipment can be credited. JUSTIFY credit given for repair (i.e., ensure that plant conditions do not preclude repair and actuarial data exists from which to estimate the repair failure probability [see SY-A22, DA-C14 and DA-D8]). AC power recovery based on generic data applicable to the plant is acceptable.No repair after core damage was postulated. Meets Cat III.Doc.ModelSRLE-C2bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-60 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE model logic necessary to provide a realistic estimation of the significant accident progression sequences resulting in a large early release. INCLUDE mitigating actions by operating staff, effect of fission product scrubbing on radionuclide release, and expected beneficial failures in significant accident progression sequences. PROVIDE technical justification (by plant-specific or applicable generic calculations demonstrating the feasibility of the actions, scrubbing mechanisms, or beneficial failures) supporting the inclusion of any of these featuresDoneDoc.ModelSRLE-C3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUSE appropriate realistic generic or plant-specific analyses for system success criteria for the significant accident progression sequences. USE conservative or a combination of conservative and realistic system success criteria for non-risk significant accident progression sequencesAll done with plant specific MAAP. See SC-B1 and SC-B4Doc.ModelSRLE-C4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDEVELOP system models that support the accident progression analysis consistent with the applicable requirements for para. 4.5.4, as appropriate for the level of detail of the analysis.DoneDoc.ModelSRLE-C5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIn crediting HFEs that support the accident progression analysis, USE the applicable requirements of para. 4.5.5 as appropriate for the level of detail of the analysis.No post CD HFE'sDoc.ModelSRLE-C6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-61 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE accident sequence dependencies in the accident progression sequences consistent with the applicable requirements of para. 4.5.2, as appropriate for the level of detail of the analysis.Done, because they used the same fault trees.Doc.ModelSRLE-C7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementJUSTIFY any credit given for equipment survivability or human actions under adverse environments.No credit for post core damage equipment operation.Doc.ModelSRLE-C8aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW significant accident progression sequences resulting in a large early release to determine if engineering analyses can support continued equipment operation or operator actions during accident progression that could reduce LERF. USE conservative or a combination of conservative and realistic treatment for non-significant accident progression sequences.Do not creditDoc.ModelSRLE-C8bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementJUSTIFY any credit given for equipment survivability or human actions that could be impacted by containment failure.Containment failure is so rare in Level 2, that no credit is needed. Containment failure equals release. All CD sequences occur prior to CF.Doc.ModelSRLE-C9aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-62 of A-106 Appendix A - Callaway PRA Gap AnalysisREVIEW significant accident progression sequences resulting in a large early release to determine if engineering analyses can support continued equipment operation or operator actions after containment failure that could reduce LERF.
USE conservative or a combination of conservative and realistic treatment for non-significant accident progression sequences.There are none. LERF dominated by CF, ISLOCA and SGTR, for which there are no mitigating actions.Doc.ModelSRLE-C9bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM a containment bypass analysis in a realistic manner. JUSTIFY any credit taken for scrubbing (i.e., provide an engineering basis for the decontamination factor used).No credit for scrubbingDoc.ModelSRLE-C10Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDETERMINE the containment ultimate capacity for the containment challenges that result in a large early release. PERFORM a realistic containment capacity analysis for the significant containment challenges. USE a conservative or a combination of conservative and realistic evaluation of containment capacity for non-significant containment challenges. If generic calculations are used in support of the assessment, JUSTIFY applicability to the plant being evaluated.
Analyses may consider use of similar containment designs or estimating containment capacity based on design pressure and a realistic multiplier relating containment design pressure and median ultimate failure pressure. Quasi-static containment capability evaluations are acceptable unless hydrogen concentrations are expected to result in potential detonations. Such considerations need to be included for small volume containments such as the ice-condenser type.Done. Containment fails at 135 psig at 400F.Doc.ModelSRLE-D1aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-63 of A-106 Appendix A - Callaway PRA Gap AnalysisEVALUATE the impact of accident progression conditions on containment seals, penetrations, hatches, drywell heads (BWRs), and vent pipe bellows. INCLUDE these impacts as potential containment challenges, as required. If generic analyses are used in support of the assessment, JUSTIFY applicability to the plant being evaluated.Done in evaluationDoc.ModelSRLE-D1bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen containment failure location [Note (2)] affects the event classification of the accident progression as a large early release, DEFINE failure location based on a realistic Containment assessment which accounts for plant-specific features. If generic analyses are used in support of the assessment, JUSTIFY applicability to the plant being evaluated.Doesn't make a differenceDoc.ModelSRLE-D2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM a realistic interfacing system failure probability analysis for the significant accident progression sequences resulting in a large early release.
USE a conservative or a combination of conservative and realistic evaluation of interfacing system failure probability for non-significant accident progression sequences Resulting in a large early release. INCLUDE behavior of piping relief valves, pump seals, and heat exchangers at applicable temperature and pressure conditions.doneDoc.ModelSRLE-D3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-64 of A-106 Appendix A - Callaway PRA Gap AnalysisPERFORM a realistic secondary side isolation capability analysis for the significant accident progression sequences caused by SG tube failure resulting in a large early release. USE a conservative or a combination of conservative and realistic evaluation of secondary side isolation capability for non-significant accident progression sequences resulting in a large early release. JUSTIFY applicability to the plant being evaluated. Analyses may consider realistic comparison with similar isolation capability in similar containment designs.Meets category I. Little benefit expected from additional analysis at significant cost.LE-3Doc.ModelSRLE-D4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM an analysis of thermally-induced SG tube rupture that includes plant-specific procedures and design features and conditions that could impact tube failure  An acceptable approach is one that arrives at a plant-specific split fractions by selecting the SG tube conditional failure probabilities based on NUREG -1570 [Note (3)] or similar evaluation for induced SG failure of a similarly designed SGs and loop piping.
SELECT failure probabilities based on(a)  RCS and SG post-accident conditions to sufficient to describe the important risk outcomes, (b)  secondary side conditions including plant-specific treatment of MSSV and ADV failures.
JUSTIFY key assumptions and selection of key inputs. An acceptable justification can be obtained by the extrapolation of the information in NUREG-1570 to obtain plant-specific models, use of reasonably bounding assumptions, or performance of sensitivity studies indicating low sensitivity to changes in the range in question.Meets category I. Little benefit expected from additional analysis at significant cost.LE-3Doc.ModelSRLE-D5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-65 of A-106 Appendix A - Callaway PRA Gap AnalysisPERFORM containment isolation analysis in a realistic manner for the significant accident progression sequences resulting in a large early release. USE conservative or a combination of conservative or realistic treatment for the non-significant accident progression sequences resulting in a large early release. INCLUDE consideration of both the failure of containment isolation systems to perform properly and the status of safety systems that do not have automatic isolation provisions.Containment isolation failure only occurs in bypass sequences.
Failures of CI system are not included. Probability of containment isolation failure leading to LERF does not contain a term to represent undetected, residual failures in containment structural integrity. This has been estimated at 5E-3 in NUREG/CR-4550. Failure of containment isolation is derived by fault tree analysis of the containment isolation combinations on the penetration paths. There are three LERF split fractions with probabilities of 7.7E-4. If the 5E-3 was added to this, the split fraction would change, although LERF would not move significantly.LE-1Doc.ModelSRLE-D6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementSELECT parameter values for equipment and operator response in the accident progression analysis consistent with the applicable requirements of paras. 4.5.5 and 4.5.6 including consideration of the severe accident plant conditions, as appropriate for the level of detail of the analysis.Same as level 1Doc.ModelSRLE-E1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementUSE realistic parameter estimates to characterize accident progression phenomena for significant accident progression sequences resulting in a large early release. USE conservative or a combination of conservative and realistic estimates for non-significant accident progression sequences resulting in a large early release.DoneDoc.ModelSRLE-E2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-66 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE as LERF contributors potential large early release (LER) sequences identified from the results of the accident progression analysis of LE-C except those LER sequences justified as non-LERF contributors in LE-C1.DoneDoc.ModelSRLE-E3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementQUANTIFY LERF consistent with the applicable requirements of Tables 4.5.8-2(a), 4.5.8-2(b), and 4.5.8-2(c). NOTE: The supporting requirements in these tables are written in CDF language. Under this requirement, the applicable quantification requirements in Table 4.5.8-2 should be interpreted based on the approach taken for the LERF model. For example, supporting requirement QU-A2 addresses the calculation of point estimate/mean CDF. Under this requirement, the application of QU-A2 would apply to the quantification of point estimate/mean LERF.DoneDoc.ModelSRLE-E4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM a quantitative evaluation of the relative contribution to LERF from plant damage states and significant LERF contributors from Table 4.5.9-3.DoneDoc.ModelSRLE-F1aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW contributors for reasonableness (e.g., to assure excessive conservatisms have not skewed the results, level of plant-specificity is appropriate for significant contributors, etc.).DoneDoc.ModelSRLE-F1bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-67 of A-106 Appendix A - Callaway PRA Gap AnalysisPROVIDE uncertainty analysis that identifies the key sources of uncertainty and includes sensitivity studies for the significant contributors to LERF.Not done. The Level 2 analysis does not include uncertainty analysis nor are there sensitivity studies identified to examine the significant contributors to LERF. As a minimum, the uncertainty in the Level 1 sequences should be propagated and sensitivity studies developed and evaluated for the important LERF scenarios.LE-2Doc.ModelSRLE-F2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY contributors to LERF and characterize LERF uncertainties consistent with the applicable requirements of Tables 4.5.8-2(d) and 4.5.8-2(e). NOTE: The supporting requirements in these tables are written in CDF language. Under this requirement, the applicable requirements of Table 4.5.8 should be interpreted based on LERF, including characterizing key modeling uncertainties associated with the applicable contributors from Table 4.5.9-3.
For example, supporting requirement QU-D5 addresses the significant contributors to CDF. Under this requirement, the contributors would be identified based on their contribution to LERF.DoneDoc.ModelSRLE-F3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the LERF analysis in a manner that facilitates PRA applications, upgrades, and peer review.DoneDoc.ModelSRLE-G1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-68 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the process used to identify plant damage states and accident progression contributors, define accident progression sequences, evaluate accident progression analyses of containment capability, and quantify and review the LERF results. For example, this documentation typically includes:
(a) the plant damage states and their attributes, as used in the analysis (b)the method used to bin the accident sequences into plant damage states(c)the containment failure modes, phenomena, equipment failures and human actions considered in the development of the accident progression sequences and the justification for their inclusion or exclusion from the accident progression analysis(d)the treatment of factors influencing containment challenges and containment capability, as appropriate for the level of detail of the analysis (e)the basis for the containment capacity analysis including the identification of containment failure location(s), if applicable  (f)the accident progression analysis sequences considered in the containment event trees(g)the basis for parameter estimates(h)the model integration process including the results of the quantification including uncertainty and sensitivity analyses, as appropriate for the level of detail of the analysis.DoneDoc.ModelSRLE-G2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the relative contribution of contributors (i.e., plant damage states, accident progression sequences, phenomena, containment challenges, containment failure modes) to LERF.DoneDoc.ModelSRLE-G3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-69 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT key assumptions and key sources of uncertainty associated with the LERF analysis, including results and important insights from sensitivity studies.Not done. The Level 2 analysis does not include uncertainty analysis nor are there sensitivity studies identified to examine the significant contributors to LERF. As a minimum, the uncertainty in the Level 1 sequences should be propagated and sensitivity studies developed and evaluated for the important LERF scenarios.LE-2Doc.ModelSRLE-G4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY limitations in the LERF analysis that would impact applications.DoneDoc.ModelSRLE-G5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the quantitative definition used for significant accident progression sequence. If other than the definition used in Section 2, JUSTIFY the alternative.DoneDoc.ModelSRLE-G6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-70 of A-106 Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementMUThe PRA configuration control process shall include monitoring of changes in design, operation, and maintenance that could affect the PRA. Such changes shall include operating procedures, design configuration, initiating event frequencies, unavailabilities, and component failure rate data.This requirement is met. APA-ZZ-00312.Doc.ModelSRMU-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThe PRA configuration control process shall include monitoring of changes in PRA technology and industry experience that could change the results of the PRA.This requirement is met. APA-ZZ-00312.Doc.ModelSRMU-A2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementChanges in PRA inputs or new information (as obtained per MU-A1 and MU-A2) shall be assessed and incorporated as appropriate in PRA maintenance activities (i.e., PRA update) or a PRA Upgrade.This requirement is met. APA-ZZ-00312.Doc.ModelSRMU-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementChanges that would impact risk-informed decisions should be prioritized to ensure that the most significant changes are incorporated as soon as possible.This requirement is met. APA-ZZ-00312.Doc.ModelSRMU-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-71 of A-106 Appendix A - Callaway PRA Gap AnalysisPRA changes shall be performed consistent with the previously defined Supporting Requirements.This requirement is not met. There is no direction in APA-ZZ-00312 to follow the industry guidance, nor is there a reference to the industry standards. The procedure was written prior to the issuance of the standards and should be revised to incorporate the standards.MU-1Doc.ModelSRMU-B3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPRA Upgrades shall receive a peer review (in accordance with the requirements specified in Section 6 of the ASME PRA Standard) for those aspects of the PRA that have been upgraded. Refer to Section 2 of the ASME PRA Standard for the distinction of a PRA Upgrade versus PRA maintenance and update.This requirement is not met. There is no direction in APA-ZZ-00312 to perform a peer review following an upgrade.MU-2Doc.ModelSRMU-B4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThe PRA configuration control process shall consider the cumulative impact of pending changes in the performance of risk applications.This requirement is met. APA-ZZ-00312.Doc.ModelSRMU-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThe PRA configuration control process shall include evaluation of the impact of changes on previously implemented risk-informed decisions that have used the PRA AND that affect the safe operation of the plant.This requirement is met. APA-ZZ-00312.Doc.ModelSRMU-D1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-72 of A-106 Appendix A - Callaway PRA Gap AnalysisThe PRA configuration control process shall include a process for maintaining control of computer codes used to support PRA quantification.This requirement is met. APA-ZZ-00312.Doc.ModelSRMU-E1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThe PRA configuration control process shall be documented. Documentation typically includes:Description of the process used to monitor PRA inputs and collect new information Evidence that the aforementioned process is active Descriptions of proposed changesDescriptions of changes in PRA due to each Update or UpgradeRecord of the performance and result of the appropriate PRA reviews Record of the process and results used to address the cumulative impact of pending changes Record of the process and results used to evaluate changes on previously implemented risk-informed decisions (pursuant to MU-D1)Description of the process used to maintain software configuration controlThis requirement is met. APA-ZZ-00312.Doc.ModelSRMU-F1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-73 of A-106 Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementQUINTEGRATE the accident sequence delineation, system models, data, and HRA in the quantification process for each initiating event group, accounting for system dependencies, to arrive at accident sequence frequencies.The Callaway PRA integrates all of the mentioned items and therefore SR QU-A1 is metDoc.ModelSRQU-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPROVIDE estimates of the individual sequences in a manner consistent with the estimation of total CDF to identify significant accident sequences/cutsets and confirm the logic is appropriately reflected. The estimates may be accomplished by using either fault tree linking or event trees with conditional split fractions.The Callaway PRA provides this capability, however several examples were identified which identified logic errors. Since the process is acceptable, SR QU-A2a is met.AS-1, AS-3, AS-5, AS-7Doc.ModelSRQU-A2aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementESTIMATE the mean CDF from internal events, accounting for the "state-of-knowledge" correlation between event probabilities when significant (see NOTE (1)).The current quantification does not include an uncertainty calculation to account for the "state-of-knowledge" correlation between event probabilities. The structure exists to perform this correlation within WinNUPRA but at the current time it has not been done.QU-1Doc.ModelSRQU-A2bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementSELECT a method that is capable of discriminating the contributors to the CDF commensurate with the level of detail in the model.The method used to quantify the Callaway PRA provides the required capability.Doc.ModelSRQU-A3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-74 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE recovery actions in the quantification process in applicable sequences and cut sets.  [see HR-H1, HR-H2, and HR-H3)]Recovery actions are included in the models as appropriate and SR QU-A4 is met.Doc.ModelSRQU-A4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM quantification using computer codes that have been demonstrated to generate appropriate results when compared to those from accepted algorithms. IDENTIFY method-specific limitations and features that could impact the results.WinNUPRA is an acceptable code. This meets SR QU-B1.Doc.ModelSRQU-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementTRUNCATE accident sequences and associated system models at a sufficiently low cutoff value that dependencies associated with significant cutsets or accident sequences are not eliminated.
NOTE: Truncation should be carefully assessed in cases where cutsets are merged to create a solution (e.g., where system level cutsets are merged to create sequence level cutsets)The truncation is currently performed at 4E-12 which is seven orders of magnitude below the TCDF and is sufficient to ensure all significant terms are retained. This meets SR QU-B2.Doc.ModelSRQU-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementESTABLISH truncation limits by an iterative process of demonstrating that the overall model results converge and that no significant accident sequences are inadvertently eliminated.
For example, convergence can be considered sufficient when successive reductions in truncation value of one decade result in decreasing changes in CDF or LERF, and the final change is less than 5%The latest quantification demonstrated convergence at a truncation level of 1E-10. This meets SR QU-B3.Doc.ModelSRQU-B3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-75 of A-106 Appendix A - Callaway PRA Gap AnalysisWhere cutsets are the means used in quantification, USE the minimal cutset upper bound or an exact solution. The rare event approximation may be used when basic event probabilities are below 0.1.The rare event approximation is used. In general, all basic event probabilities are less than 0.1.Doc.ModelSRQU-B4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementFault tree linking and some other modeling approaches may result in circular logic that must be broken before the model is solved. BREAK the circular logic appropriately. Guidance for breaking logic loops is provided in NUREG/CR-2728 [Note (1)]. When resolving circular logic, AVOID introducing unnecessary conservatisms or non-conservatismsThe logic loops have been broken correctly. This meets SR QU-B5.Doc.ModelSRQU-B5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementACCOUNT for system successes in addition to system failures in the evaluation of accident sequences to the extent needed for realistic estimation of CDF. This accounting may be accomplished by using numerical quantification of success probability, complementary logic, or a delete term approximation and includes the treatment of transfers among event trees where the "successes" may not be transferred between event trees.WinNUPRA accounts for successes by a combination of numerical correction when the failure branch exceeds a predefined value and a delete term approximation. This meets SR QU-B6.Doc.ModelSRQU-B6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY cutsets (or sequences) containing mutually exclusive events in the results.Mutually exclusive cutsets are identified during the system modeling task and set up in the DAM (Disallowed Maintenance) fault tree to be automatically deleted from the results during the quantification. This meets SR QU-B7a.Doc.ModelSRQU-B7aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-76 of A-106 Appendix A - Callaway PRA Gap AnalysisCORRECT cutsets containing mutually exclusive events by either:(a)  developing logic to eliminate mutually exclusive situations, or(b)  deleting cutsets containing mutually exclusive events.Mutually exclusive cutsets are identified during the system modeling task and set up in the DAM (Disallowed Maintenance) fault tree to be automatically deleted from the results during the quantification. This meets SR QU-B7b.Doc.ModelSRQU-B7bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen using logic flags, SET logic flag events to either TRUE or FALSE (instead of setting the event probabilities to 1.0 or 0.0), as appropriate for each accident sequence, prior to the generation of cutsets.The Callaway PRA is quantified with house events (logic flags) set to logical TRUE or FALSE values. The settings are defined in Tables in the documentation and in data sets for each sequence and applied during the batch process. This meets SR QU-B6.Doc.ModelSRQU-B8Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIf modules, subtrees, or split fractions are used to facilitate the quantification, USE a process that allows (a)  identification of shared events (b)  correct formation of modules that are truly independent(c)  results interpretation based on individual events within modules (e.g., risk significance)The Callaway PRA does not use modules, subtrees, or split fractions, with one exception. That exception is in the SSIE events. These "modules" provide a place that some dependencies can be overlooked. While the Ameren staff have made the effort to account for these hidden dependencies, enough inconsistencies were identified that SR QU-B9 is not considered to be met. Linking of the SSIE fault trees to the event trees provides more assurance of the correct treatment and should be considered. EPRI is currently developing a procedure to guide the treatment of support system initiating events which should be issued in the near future.QU-2Doc.ModelSRQU-B9Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-77 of A-106 Appendix A - Callaway PRA Gap AnalysisIDENTIFY cutsets with multiple HFEs that potentially impact significant accident sequences/cutsets by requantifying the PRA model with HEP values set to values that are sufficiently high that the cutsets are not truncated. The final quantification of these post-initiator HFEs may be done at the cutset level or saved sequence level.The latest HRA update ZZ-278 Rev0, Add. 1, evaluated dependent HEPs and replaced multiple dependent HEPs with a single event appropriately in the FTs. SR QU-C1 is met.Doc.ModelSRQU-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementASSESS the degree of dependency between the HFEs in the cutset or sequence in accordance with HR-D5 and HR-G7.The latest HRA update ZZ-278 Rev0, Add. 1, evaluated dependent HEPs and replaced multiple dependent HEPs with a single event appropriately in the FTs. SR QU-C2 is met.Doc.ModelSRQU-C2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen linking event trees, TRANSFER the sequence characteristics (e.g., failed equipment, flag settings) that impact the logic or quantification of the subsequent accident development, as well as the sequence frequency. For example, sequence characteristics can be transferred to another event tree by using the appropriate cutsets.Some instances of incorrect transfer of sequence characteristics were identified based on cutset reviews. The process is generally set up correctly but the overall process would benefit from revising the quantification process to account for the additional software capability currently available.QU-3Doc.ModelSRQU-C3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW a sample of the significant  accident sequences/cutsets sufficient to determine that the logic of the cutset or sequence is correct.Some instances of incorrect logic were identified based on cutset reviews. The process is generally set up correctly but the overall process would benefit from revising the quantification process to account for the additional software capability currently available.QU-3, QU-4Doc.ModelSRQU-D1aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-78 of A-106 Appendix A - Callaway PRA Gap AnalysisREVIEW the results of the PRA for modeling consistency (e.g., event sequence models consistency with systems models and success criteria) and operational consistency (e.g., plant configuration, procedures, and plant-specific and industry experience).Some instances of incorrect results were identified based on cutset reviews. The process is generally set up correctly but the overall process would benefit from revising the quantification process to account for the additional software capability currently available.QU-3Doc.ModelSRQU-D1bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW results to determine that the flag event settings, mutually exclusive event rules, and recovery rules yield logical results.Some instances of incorrect house event settings were identified based on cutset reviews. The process is generally set up correctly but the overall process would benefit from revising the quantification process to account for the additional software capability currently available.QU-3Doc.ModelSRQU-D1cCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCOMPARE results to those from similar plants and IDENTIFY causes for significant differences. For example: Why is LOCA a large contributor for one plant and not another?Comparisons have been made between Callaway and its sister plant Wolf Creek and differences were identified and explained. SR QU-D3 is met.Doc.ModelSRQU-D3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW a sampling of non-significant accident cutsets or sequences to determine they are reasonable and have physical meaning.There was no documentation of a review of non-significant accident sequences or cutsets to determine their reasonableness. This review is necessary to meet SR QU-D4.QU-5Doc.ModelSRQU-D4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-79 of A-106 Appendix A - Callaway PRA Gap AnalysisIDENTIFY significant contributors to CDF, such as initiating events, accident sequences, equipment failures, common cause failures, and operator errors. INCLUDE SSCs and operator actions that contribute to initiating event frequencies and event mitigation.The Callaway PRA has undergone extensive looks at importance of contributors to the plant CDF as a part of MSPI. SR QU-D5a is met.Doc.ModelSRQU-D5aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW the importance of components and basic events to determine that they make logical sense.The Callaway PRA has undergone extensive looks at importance of contributors to the plant CDF as a part of MSPI. SR QU-D5b is met.Doc.ModelSRQU-D5bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY key sources of model uncertainty.Key sources of model uncertainty were identified during the IPE but they are scattered throughout the calculation packages which serve as the documentation. There is no indication that the results have ever been revisited since that time even though the model has underwent changes. Gathering the information in one place would be very beneficial to the long term maintainability of the analysis.QU-6Doc.ModelSRQU-E1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-80 of A-106 Appendix A - Callaway PRA Gap AnalysisIDENTIFY key assumptions made in the development of the PRA model.Key assumptions were identified during the IPE but they are scattered throughout the calculation packages which serve as the documentation. There is no indication that the results have ever been revisited since that time even though the model has underwent changes. Gathering the information in one place would be very beneficial to the long term maintainability of the analysis.QU-6Doc.ModelSRQU-E2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementESTIMATE the uncertainty interval of the overall CDF results. ESTIMATE the uncertainty intervals associated with parameter uncertainties (DA-D3, HR-D6, HR-G9, IE-C13), taking into account the "state-of-knowledge" correlation.The current quantification does not include an uncertainty calculation to account for the "state-of-knowledge" correlation between event probabilities. The structure exists to perform this correlation within WinNUPRA but at the current time it has not been done. SR QU-E3 is not met.QU-1Doc.ModelSRQU-E3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementEVALUATE the sensitivity of the results to key model uncertainties and key assumptions using sensitivity analyses.  [Note 1]Key sources of model uncertainty and key assumptions were evaluated during the IPE with sensitivity analyses and those cases are requantified during each update to the model quantification but there is no documentation to show that the basis for the sensitivity studies has ever been revisited since that time even though the model has underwent changes. The sensitivity studies should be reexamined to make sure they cover the major sources of modeling uncertainty in the current model.QU-7Doc.ModelSRQU-E4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-81 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the model quantification in a manner that facilitates PRA applications, upgrades, and peer review.The documentation of the model quantification accurately documents what was performed during the quantification process, however the manual integration required for several stand-alone pieces of the analysis is not well documented. The recommended changes to the quantification process to integrate the entire internal events (including internal flooding) would serve to facilitate the use of the quantification process for PRA applications, upgrades, and peer review.QU-8Doc.ModelSRQU-F1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-82 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the model integration process including any recovery analysis, and the results of the quantification including uncertainty and sensitivity analyses. For example, documentation typically includes:
(a)  records of the process/results when adding non-recovery terms as part of the final quantification(b)  records of the cutset review process(c)  a general description of the quantification process including accounting for systems successes, the truncation values used, how recovery and post-initiator HFEs are applied(d)  the process and results for establishing the truncation screening values for final quantification demonstrating that convergence towards a stable result was achieved (e)  the total plant CDF and contributions from the different initiating events and accident classes(f)  the accident sequences and their contributing cutsets(g)  equipment or human actions that are the key factors in causing the accidents to be non-dominant (h)  the results of all sensitivity studies (i)  the uncertainty distribution for the total CDF(j)  importance measure results(k)  a list of mutually exclusive events eliminated from the resulting cutsets and their bases for elimination (l) asymmetries in quantitative modeling to provide application users the necessary understanding regarding why such asymmetries are present in the model (m) the process used to illustrate the computer code(s) used to perform the quantification will yield correct results processIn general the model integration process is adequately documented, however several of the areas do not meet the requirements. Items b, f, g, and i are not addressed in the documentation. These items need to be addressed to meet SR QU-F2.QU-9Doc.ModelSRQU-F2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the significant contributors (such as initiating events, accident sequences, basic events) to CDF in the PRA results summary. PROVIDE a detailed description of significant accident sequences or functional failure groups.The significant contributors are documented as required, but the definition of significant used by Ameren differs from the ASME standard as previously noted. The documentation meets SR QU-F3.Doc.ModelSRQU-F3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-83 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT key assumptions and key sources of uncertainty, such as:  possible optimistic or conservative success criteria, suitability of the reliability data, possible modeling uncertainties (modeling limitations due to the method selected), degree of completeness in the selection of initiating events, possible spatial dependencies, etc.Key assumptions and key sources of uncertainty which influence the current quantification are not addressed in a coherent manner in the documentation.QU-10Doc.ModelSRQU-F4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT limitations in the quantification process that would impact applications.No documentation of limitations was identified.QU-12Doc.ModelSRQU-F5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the quantitative definition used for significant basic event, significant cutset, significant accident sequence. If other than the definition used in Section 2, JUSTIFY the alternative.The quantitative definition used for significant cutset and significant accident sequence are documented and vary from the ASME definition. The ASME definitions need to be applied or the Ameren definition needs to be justified.Significant sequence:  ASME - aggregate 95% of total, individual sequence >1%
Ameren - aggregate 88% of total, individual sequence >1%Significant cutset:  ASME - aggregate 95% of total, individual cutset >1%
Ameren - cutsets >1E-6QU-11Doc.ModelSRQU-F6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-84 of A-106 Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementSCUSE the definition of core damage provided in Section 2 of this Standard. If core damage has been defined differently than in Section 2:(a)  IDENTIFY any substantial differences from the Section 2 definition (b)  PROVIDE the bases for the selected definitionCalc - ZZ-2752200F core peak node temp.Doc.ModelSRSC-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementSPECIFY the plant parameters (e.g., highest node temperature, core collapsed liquid level) and associated acceptance criteria (e.g., temperature limit) to be used in determining core damage. SELECT these parameters such that the determination of core damage is as realistic as practical, consistent with current best practice. DEFINE computer code-predicted acceptance criteria with sufficient margin on the code-calculated values to allow for limitations of the code, sophistication of the models, and uncertainties in the results, consistent with requirements specified under HLR-SC-B.Examples of measures for core damage suitable for Capability Category II / III, that have been used in PRAs, include:
(a)  Collapsed liquid level less than 1/3 core height or code-predicted peak core temperature >2,500&deg;F (BWR) (b)  Collapsed liquid level below top of active fuel for a prolonged period, or code-predicted core peak node temperature >2,200&deg;F using a code with detailed core modeling; or code-predicted core peak node temperature >1,800&deg;F using a code with simplified (e.g., single-node core model, lumped parameter) core modeling; or code-predicted core exit temperature >1,200&deg;F for 30 min using a code with simplified core modeling (PWR)2200F core peak node temp.Doc.ModelSRSC-A2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-85 of A-106 Appendix A - Callaway PRA Gap AnalysisSPECIFY success criteria for each of the key safety functions identified per SR AS-A2 for each modeled initiating event,  [Note 2]DoneDoc.ModelSRSC-A4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementSPECIFY an appropriate mission time for the modeled accident sequences.For sequences in which stable plant conditions have been achieved, USE a minimum mission time of 24 hr. Mission times for individual SSCs that function during the accident sequence may be less than 24 hr, as long as an appropriate set of SSCs and operator actions are modeled to support the full sequence mission time. For example, if following a LOCA, low pressure injection is available for 1 hour, after which recirculation is required, the mission time for LPSI may be 1 hour and the mission time for recirculation may be 23 hours.
For sequences in which stable plant conditions would not be achieved by 24 hr using the modeled plant equipment and human actions, PERFORM additional evaluation or modeling by using an appropriate technique. Examples of appropriate techniques include:
(a)  assigning an appropriate plant damage state for the sequence; (b)  extending the mission time, and adjusting the affected analyses, to the point at which conditions can be shown to reach acceptable values; or(c)  modeling additional system recovery or operator actions for the sequence, in accordance with requirements stated in the Systems Analysis and Human Reliability sections of this Standard, to demonstrate that a successful outcome is achieved.24 hr for all, except where noted for SBO.Doc.ModelSRSC-A5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCONFIRM that the bases for the success criteria are consistent with the features, procedures, and operating philosophy of the plant.DoneDoc.ModelSRSC-A6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-86 of A-106 Appendix A - Callaway PRA Gap AnalysisUSE appropriate realistic generic analyses/evaluations  that are applicable to the plant for thermal/hydraulic, structural, and other supporting engineering bases in support of success criteria requiring detailed computer modeling. Realistic models or analyses may be supplemented with plant-specific/generic FSAR or other conservative analysis applicable to the plant, but only if such supplemental analyses do not affect the determination of which combinations of systems and trains of systems are required to respond to an initiating event.Plant specific MAAP analysis was used for all Success Criteria in 1992. The SC re-analysis is being updated with MAAP 4 currently (Indeterminate schedule). This resolution in Addendum B may be a way of saying NRC does not trust MAAP 3. If such is the case, Callaway should update with MAAP 4 as a priority.SC-B1Doc.ModelSRSC-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDO NOT USE expert judgment except in those situations in which there is lack of available information regarding the condition or response of a modeled SSC, or a lack of analytical methods upon which to base a prediction of SSC condition or response. USE the requirements in para. 4.3 when implementing an expert judgment process.Found no instance of expert judgement being used in place of thermal hydraulic analysis.Doc.ModelSRSC-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen defining success criteria, USE thermal/hydraulic, structural, or other analyses/evaluations appropriate to the event being analyzed, and accounting for a level of detail consistent with the initiating event grouping (HLR-IE-B) and accident sequence modeling (HLR-AS-A andHLR-AS-B).DoneDoc.ModelSRSC-B3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-87 of A-106 Appendix A - Callaway PRA Gap AnalysisUSE analysis models and computer codes that have sufficient capability to model the conditions of interest in the determination of success criteria for CDF, and that provide results representative of the plant. A qualitative evaluation of a relevant application of codes, models, or analyses that has been used for a similar class of plant (e.g., Owner's Group generic studies) may be used. USE computer codes and models only within known limits of applicability.MAAP 3 used. The SC re-analysis is being updated with MAAP 4 currently whose completion should be a priority before application of the PRA.Doc.ModelSRSC-B4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCHECK the reasonableness and acceptability of the results of the thermal/hydraulic, structural, or other supporting engineering bases used to support the success criteria.Examples of methods to achieve this include:
(a)  comparison with results of the same analyses performed for similar plants, accounting for differences in unique plant features (b)  comparison with results of similar analyses performed with other plant-specific codes(c)  check by other means appropriate to the particular analysisThere was no  documentation found which provides a comparison of the plant-specific analysis with that of different plants or with other computer code calculationsSC-2Doc.ModelSRSC-B5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the success criteria in a manner that facilitates PRA applications, upgrades, and peer review.Success criteria are not documented in a single place. Each system notebook has the SC for that application. Current system of documentation does not provide easy comparison of T/H use for consistency. The ASME criteria expects to see a single place for SC documentation and a coordinated effort to compare and show that all SC are consistently derived from the same set of consistent T/H runs.SC-1Doc.ModelSRSC-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-88 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the processes used to develop overall PRA success criteria and the supporting engineering bases, including the inputs, methods, and results. For example, this documentation typically includes:
(a)  the definition of core damage used in the PRA including the bases for any selected parameter value used in the definition (e.g., peak cladding temperature or reactor vessel level)(b)  calculations (generic and plant-specific) or other references used to establish success criteria, and identification of cases for which they are used (c)  identification of computer codes or other methods used to establish plant-specific success criteria(d)  a description of the limitations (e.g., potential conservatisms or limitations that could challenge the applicability of computer models in certain cases) of the calculations or codes (e)  the uses of expert judgment within the PRA, and rationale for such uses(f)  a summary of success criteria for the available mitigating systems and human actions for each accident initiating group modeled in the PRA (g)  the basis for establishing the time available for human actions (h)  descriptions of processes used to define success criteria for grouped initiating events or accident sequencesAs identified for SR SC-C1, the documentation is spread out, and while it appears that all of the information is provided, the quality, useability and reviewability of the PRA would be greatly enhanced by pulling the disparate pieces into a single document.SC-1Doc.ModelSRSC-C2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDOCUMENT the key assumptions and key sources uncertainty associated with the development of success criteria.Not doneSC-1Doc.ModelSRSC-C3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-89 of A-106 Appendix A - Callaway PRA Gap AnalysisHigh Level RequirementSYDEVELOP system models for those systems needed to provide or support the safety functions contained in the accident sequence analyses.There are fault tree system models associated with each function in the accident sequence analysis and therefore meet SR SY-A1.Doc.ModelSRSY-A1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementCOLLECT pertinent information to ensure that the systems analysis appropriately reflects the as-built and as-operated systems. Examples of such information include system P&IDs, one-line diagrams, instrumentation and control drawings, spatial layout drawings, system operating procedures, abnormal operating procedures, emergency procedures, success criteria calculations, the final or updated SAR, technical specifications, training information, system descriptions and related design documents, actual system operating experience, and interviews with system engineers and operators.The Callaway fault tree documentation packages contain a detailed list of the items used to develop the fault tree. The information meets SR SY-A2.Doc.ModelSRSY-A2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementREVIEW plant information sources to define or establish(a)  system components and boundaries (b)  dependencies on other systems (c)  instrumentation and control requirements (d)  testing and maintenance requirements and practices(e) operating limitations such as those imposed by technical specifications(f)  component operability and design limits (g)  procedures for the operation of the system during normal and accident conditions (h)  system configuration during normal and accident conditionsThe Callaway fault tree documentation packages contain a detailed list of the items used to develop the fault tree. The information meets SR SY-A3.Doc.ModelSRSY-A3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-90 of A-106 Appendix A - Callaway PRA Gap AnalysisPERFORM plant walkdowns and interviews with system engineers and plant operators to confirm that the systems analysis correctly reflects the as-built, as-operated plant.Plant walkdowns as well as system engineer and plant operations review of the basis for the fault tree models and correct system operational assumptions were performed during the Callaway PRA and therefore SR SY-A4 is met.Doc.ModelSRSY-A4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementINCLUDE the effects of both normal and alternate system alignments, to the extent needed for CDF and LERF determination.The Callaway PRA is based on the normal system alignments and no other alignments were identified which would result in a lower reliability. SR SY-A5 is met. During any revisions to the model, alternate alignments should be evaluated.Doc.ModelSRSY-A5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIn defining the system model boundary [see SY-A3], INCLUDE within the boundary the components required for system operation, and the components providing the interfaces with support systems required for actuation and operation of the system components.The fault tree model boundaries including the support system interfaces are adequately defined and meet SR SY-A6.Doc.ModelSRSY-A6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-91 of A-106 Appendix A - Callaway PRA Gap AnalysisDEVELOP detailed systems models, unless (a) sufficient system-level data are available to quantify the system failure probability, or (b) system failure is dominated by operator actions, and omitting the model does not mask contributions to the results of support systems or other dependent-failure modes.
For case (a), USE a single data value only for systems with no equipment or human-action dependencies, and if data exist that sufficiently represent the unreliability or unavailability of the system and account for plant-specific factors that could influence unreliability and unavailability. Examples of systems that have sometimes not been modeled in detail include the scram system, the power-conversion system, instrument air, and the keep-fill systems.JUSTIFY the use of limited (i.e., reduced or single data value) modeling.Detailed system models are available for all but two systems.
For the Instrument Air System a single basic event is used and is based on generic data. The Callaway plant is not highly dependent upon IAS and the PRA loads on IAS also are supplied with N2 backup which is modeled. The IAS is correctly failed for LOSP, but remains available in all other cases. The IAS is cooled by SW and would be unavailable after loss of all SW (T(SW)) and should be set to failed via a house event setting. The actuation system is modeled with a single event for each of the redundancies which is set to fail for scenarios in which the conditions are not present to generate the signal. The data associated with these single event failures need to be reviewed against current industry data and updated if necessary. The applicability of the data to the Callaway configuration also needs to be justified. In addition, the scram system has not been modeled in detail but is evaluated in a similar manner to most PRAs. SR SY-A7 is not met due to the above noted correction and documentation issues.SY-1Doc.ModelSRSY-A7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementESTABLISH the boundaries of the components required for system operation.
MATCH the definitions used to establish the component failure data. For example, a control circuit for a pump does not need to be included as a separate basic event (or events) in the system model if the pump failure data used in quantifying the system model include control circuit failures.MODEL as separate basic events of the model, those sub-components  (e.g., a valve limit switch that is associated with a permissive signal for another component) that are shared by another component or affect another component, in order to account for the dependent failure mechanism.The component boundaries are defined and the prior plant specific data collection effort was based on those definitions.
Future data collection needs to observe the same boundaries.
Actuation components (limit, temperature switches) which impact multiple components were modeled explicitly. SR SY-A8 is met.Doc.ModelSRSY-A8Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-92 of A-106 Appendix A - Callaway PRA Gap AnalysisINCORPORATE the effect of variable success criteria (i.e., success criteria that change as a function of plant status) into the system modeling. Example causes of variable system success criteria are:
(a)  different accident scenarios. Different success criteria are required for some systems to mitigate different accident scenarios (e.g., the number of pumps required to operate in some systems is dependent upon the  modeled initiating event);
(b)  dependence on other components. Success criteria for some systems are also dependent on the success of another component in the system (e.g., operation of additional pumps in some cooling water systems is required if non-critical loads are not isolated);
(c)  time dependence. Success criteria for some systems are time- dependent (e.g., two pumps are required to provide the needed flow early following an accident initiator, but only one is required for mitigation later following the accident);(d)  sharing of a system between units when both units are challenged by the same initiating event (e.g., LOOP)The Callaway PRA fault trees represent the appropriate success criteria defined in the accident sequence analysis. Support function success criteria are based on either the design basis of the system or on analysis which demonstrates acceptable alternatives. The Callaway PRA meets SR SY-A11.Doc.ModelSRSY-A11Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementINCLUDE in the system model those failures of the equipment and components that would affect system operability (as identified in the system success criteria), except when excluded using the criteria in SY-A14. This equipment includes both active components (e.g., pumps, valves, and air compressors) and passive components (e.g., piping, heat exchangers, and tanks) required for system operation.The fault tree models all components necessary to provide the required functions and therefore SR SY-A12 is met.Doc.ModelSRSY-A12Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDO NOT INCLUDE in a system model component failures that would be beneficial to system operation, unless omission would distort the results.Example of a beneficial failure:  A failure of an instrument in such a fashion as to generate a required actuation signal.The Callaway PRA does not credit component failures which would be beneficial, therefore SR SY-A12a is met.Doc.ModelSRSY-A12aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-93 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE those failures that can cause flow diversion pathways that result in failure to meet the system success criteria.Flow diversion pathways of sufficient size to fail the function are explicitly modeled therefore SR SY-A12b is met.Doc.ModelSRSY-A12bCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen identifying the failures in SY-A12 INCLUDE consideration of all failure modes, consistent with available data and model level of detail, except where excluded using the criteria in SY-A14.For example:
(a)  active component fails to start (b)  active component fails to continue to run(c)  failure of a closed component to open(d)  failure of a closed component to remain closed (e)  failure of an open component to close (f)  failure of an open component to remain open (g)  active component spurious operation(h)  plugging of an active or passive component(i)  leakage of an active or passive component (j)  rupture of an active or passive component (k)  internal leakage of a component (l)  internal rupture of a component(m)  failure to provide signal/operate (e.g., instrumentation)(n)  spurious signal/operation (o)  pre-initiator human failure events (see SY-A15)
(p)  other failures of a component to perform its required functionThe Callaway PRA considered each of the example failure modes in the fault tree development. Therefore SR SY-A13 is met.Doc.ModelSRSY-A13Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-94 of A-106 Appendix A - Callaway PRA Gap AnalysisIn meeting SY-A12 and SY-A13, contributors to system unavailability and unreliability (i.e., components and specific failure modes) may be excluded from the model if one of the following screening criteria is met:
(a)  A component may be excluded from the system model if the total failure probability of the component failure modes resulting in the same effect on system operation is at least two orders of magnitude lower than the highest failure probability of the other components in the same system train that results in the same effect on system operation; (b)  One or more failure modes for a component may be excluded from the systems model if the contribution of them to the total failure rate or probability is less than 1% of the total failure rate or probability for that component, when their effects on system operation are the same.Applicable failure modes were included for all components in the model. In most cases, although more than two orders of magnitude below other system failures, plugging of passive valves were included if they were considered to be the only credible failure mode for a component (e.g., manual valve which is not required to change state). The fault tree documentation identifies components which are not included in the model and although not explicitly stated, the exclusion is obviously based on the low magnitude of the possible failure mode and is covered under the general assumptions included in the IPE. SR SY-A14 is therefore met.Doc.ModelSRSY-A14Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIn the system model, INCLUDE HFEs that cause the system or component to be unavailable when demanded. These events are referred to as pre-initiator human events.  (See also Human Reliability Analysis, para. 4.5.5.)Pre-initiator human errors were included in the fault tree model where considered to be credible and the probability of occurrence was not inconsequential. SR SY-A15 is therefore met.Doc.ModelSRSY-A15Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIn the system model, INCLUDE HFEs that are expected during the operation of the system or component or that are accounted for in the final quantification of accident sequences unless they are already included explicitly as events in the accident sequence models . These HFEs are referred to as post-initiator human actions. [See also Human Reliability Analysis (para. 4.5.5) and Accident Sequence Analysis (para. 4.5.2)].Post-initiator human actions were included in the fault tree model where determined to be appropriate. SR SY-A16 is therefore met.Doc.ModelSRSY-A16Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-95 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE in either the system model or accident sequence modeling those conditions that cause the system to isolate or trip, or those conditions that once exceeded cause the system to fail, or SHOW that their exclusion does not impact the results. For example, conditions that isolate or trip a system include:
(a)  system-related parameters such as a high temperature within the system(b)  external parameters used to protect the system from other failures[e.g., the high reactor pressure vessel (RPV) water level isolation signal used to prevent water intrusion into the turbines of the RCIC and HPCI pumps of a BWR]
(c)  adverse environmental conditions (see SY-A20)The fault trees include conditions necessary for operation where appropriate. Protective trips, such as high temperature trips were not modeled explicitly but if a trip was expected to occur on loss of a support function, then loss of that support function was assumed to fail the component. SR SY-A17 is therefore met.Doc.ModelSRSY-A17Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIn the systems model, INCLUDE out-of-service unavailability for components in the system model, unless screened, consistent with the actual practices and history of the plant for removing equipment from service.INCLUDE:(a)  unavailability caused by testing when a component or system train is reconfigured from its required accident mitigating position such that the component cannot function as required;(b)  maintenance events at the train level when procedures require isolating the entire train for maintenance; (c)  maintenance events at a sub-train level (i.e., between tagout boundaries, such as a functional equipment group) when directed by procedures.Examples of out-of-service unavailability to be modeled:(a)  train outages during a work window for preventive/corrective maintenance; (b)  a functional equipment group (FEG) removed from service for preventive/corrective maintenance; (c)  a relief valve taken out of service.Maintenance unavailability is included in the Callaway PRA on the basis of existing practices. The application of these terms was done at the level necessary to reflect the effect on the ability to provide the safety function. This may be in some cases the train level, subtrain level or component level. Relief valves modeled as being required which are allowed to be taken out of service are addressed in the model. SR SY-A18 is therefore met.Doc.ModelSRSY-A18Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-96 of A-106 Appendix A - Callaway PRA Gap AnalysisINCLUDE events representing the simultaneous unavailability of redundant equipment when this is a result of planned activity (see DA-C13).As discussed for SR SY-A18a, maintenance failures were included for each portion of the system as applicable. Terms including maintenance combinations which violated tech specs were removed from the analysis. SR SY-A18a is therefore met.Doc.ModelSRSY-A18aCapability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY system conditions that cause a loss of desired system function, e.g.,
excessive heat loads, excessive electrical loads, excessive humidity, etc.The Callaway fault tree models consider environmental conditions which may fail components, typically due to failure of support systems. SR SY-A19 is met.Doc.ModelSRSY-A19Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementTAKE CREDIT for system or component operability only if an analysis exists to demonstrate that rated or design capabilities are not exceeded.Analysis was performed to verify the operability of systems and components where it was determined that conditions would exist which were outside the original design envelope. SR SY-A20 is therefore met.Doc.ModelSRSY-A20Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDEVELOP system model nomenclature in a consistent manner to allow model manipulation and to represent the same designator when a component failure mode is used in multiple systems or trains.The Callaway PRA follows a rigorous naming convention for basic events to assure dependencies are correctly accounted for. SR SY-A21 is therefore met.Doc.ModelSRSY-A21Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-97 of A-106 Appendix A - Callaway PRA Gap AnalysisDO NOT MODEL the repair of hardware faults, unless the probability of repair is justified through an adequate analysis or examination of data. (See DA-C14.)The Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and loss of SWS initiating events.
The recovery events, which include recovery of CCF of pumps and valves lack sufficient analysis or data. The Callaway PRA does not meet SR SY-A22.IE-8Doc.ModelSRSY-A22Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementMODEL intra-system common-cause failures when supported by generic or plant-specific data. An acceptable method is represented in NUREG/CR-5485 [Note (1)].The Callaway PRA adequately models CCFs with the exception of battery chargers and breakers as noted in SR SY-B3.SY-2Doc.ModelSRSY-B1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementNo requirement to model inter-system common cause failures.No requirements exist for Category 2 SR SY-A18 and is therefore NA for Callaway.Doc.ModelSRSY-B2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-98 of A-106 Appendix A - Callaway PRA Gap AnalysisESTABLISH common cause failure groups by using a logical, systematic process that considers similarity in(a)  service conditions (b)  environment (c)  design or manufacturer(d)  maintenanceJUSTIFY the basis for selecting common cause component groups.
Candidates for common-cause failures include, for example:
(a)  motor-operated valves (b)  pumps (c)  safety-relief valves (d)  air-operated valves (e)  solenoid-operated valves (f)  check valves (g)  diesel generators (h)  batteries (i)  inverters and battery charger (j)  circuit breakersThe Callaway PRA includes most of the CCF groups identified.
In order to meet the criterion for SY-B3, either a justification must be provided or the events added for:  Battery chargers and circuit breakers. The current treatment does not meet the criterion for SY-B3.SY-2Doc.ModelSRSY-B3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementINCORPORATE common cause failures into the system model consistent with the common cause model used for data analysis. (See DA-D6.)The current Callaway PRA uses fairly high beta factors and although acceptable, use of the current method/data from NUREG/CR-5485 would be beneficial. SR SY-B4 is met, but only marginally.SY-2Doc.ModelSRSY-B4Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-99 of A-106 Appendix A - Callaway PRA Gap AnalysisACCOUNT explicitly for the modeled system's dependency on support systems or interfacing systems in the modeling process. This may be accomplished in one of the following ways:
(a)for the fault tree linking approach by modeling the dependencies as a link to an appropriate event or gate in the support system fault tree;(b)for the linked event tree approach, by using event tree logic rules, or calculating a probability for each split fraction conditional on the scenario definition.The Callaway fault tree models include links to all identified support fault trees necessary to perform their required function.
Therefore SR SY-B5 is met.Doc.ModelSRSY-B5Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementPERFORM engineering analyses to determine the need for  support systems that are plant-specific and reflect the variability in the conditions present during the postulated accidents for which the system is required to function.Support system requirements are based on design success criteria and timing, unless determined to be over conservative at which point more realistic success criteria were evaluated. Therefore SR SY-B6 is met.Doc.ModelSRSY-B6Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementBASE support system modeling on realistic success criteria and timing, unless a conservative approach can be justified, i.e. if their use does not impact risk significant contributors.Support system modeling is based on design success criteria and timing, unless determined to be over conservative at which point more realistic success criteria were evaluated. Therefore SR SY-B7 is met.Doc.ModelSRSY-B7Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-100 of A-106 Appendix A - Callaway PRA Gap AnalysisIDENTIFY spatial and environmental hazards that may impact multiple systems or redundant components in the same system , and ACCOUNT for them in the system fault tree or the accident sequence evaluation.
Example: Use results of plant walkdowns as a source of information regarding spatial/environmental hazards, for resolution of spatial/environmental issues, or evaluation of the impacts of such hazards.Plant walkdowns were performed as part of the fault tree development and used as a source of information regarding spatial/environmental hazards, for resolution of spatial/environmental issues, or evaluation of the impacts of such hazards during the Callaway PRA and therefore SR SY-B8 is met.Doc.ModelSRSY-B8Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementWhen modeling a system, INCLUDE appropriate interfaces with the support systems required for successful operation of the system for a required mission time (see also AY-A6). Examples include:
(a)  actuation logic (b)  support systems required for control of components (c)  component motive power(d)  cooling of components(e)  any other identified support function (e.g., heat tracing) necessary to meet the success criteria and associated systemsThe Callaway fault tree models include links to all identified support fault trees necessary to perform their required function. Therefore the SY-B10 criterion is met.Doc.ModelSRSY-B10Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-101 of A-106 Appendix A - Callaway PRA Gap AnalysisMODEL those systems that are required for initiation and actuation of a system. In the model quantification, INCLUDE the presence of the conditions needed for automatic actuation (e.g., low vessel water level). INCLUDE permissive and lockout signals that are required to complete actuation logic.The Callaway PRA models the Safety Injection signals and the LOSP signals at the train level. The trains are not modeled in detail due to the large redundancy built into the system.
Interlocks were modeled as failing the components they prevented from operating. For each sequence, and the associated functional equations, the presence of the conditions for an SI or LOSP signal were assessed and a house event was used to fail the signal if the conditions were not present or apply an event representing the train unavailability if the conditions were present. A review was made to identify the potential permissives and lockouts which could affect components. In those cases, failure of the component was modeled as resulting from failure of the component which provides the permissive.
The requirements of SY-B11 are met.Doc.ModelSRSY-B11Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementMODEL the ability of the available inventories of air, power, and cooling to support the mission time.The available inventories for all systems were considered in the development of the Callaway fault trees and therefore SR SY-B12 is met.Doc.ModelSRSY-B12Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementDO NOT USE proceduralized recovery actions as the sole basis for eliminating a support system from the model; however, INCLUDE these recovery actions in the model quantification. For example, it is not acceptable to not model a system such as HVAC or CCW on the basis that there are procedures for dealing with losses of these systems.Support system requirements are not eliminated from the Callaway model unless it can be shown that the loss of the support system does not impact the ability of the front-line system to perform its function and therefore SR SY-B13 is met.Doc.ModelSRSY-B13Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-102 of A-106 Appendix A - Callaway PRA Gap AnalysisSome systems use components and equipment that are required for operation of other systems. INCLUDE components that, using the criteria in SY-A14, may be screened from each system model individually, if their failure affects more than one system (e.g., a common suction pipe feeding two separate systems).Components which are part of or impact multiple systems/functions are not screened in the Callaway PRA and therefore SR SY-B14 is met.Doc.ModelSRSY-B14Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementIDENTIFY SSCs that may be required to operate in conditions beyond their environmental qualifications. INCLUDE dependent failures of multiple SSCs that result from operation in these adverse conditions.Examples of degraded environments include:
(a)  LOCA inside containment with failure of containment heat removal (b)  safety relief valve operability (small LOCA, drywell spray, severe accident) (for BWRs)(c)  steam line breaks outside containment (d)  debris that could plug screens/filters (both internal and external to the plant)
(e)  heating of the water supply (e.g., BWR suppression pool, PWR containment sump) that could affect pump operability(f)  loss of NPSH for pumps(g)  steam binding of pumpsEach of the example degraded environments were considered and addressed in either the event trees or fault trees. SR SY-B15 is met.Doc.ModelSRSY-B15Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementINCLUDE operator interface dependencies across systems or trains, where applicable.Dependencies between operator actions are identified and treated in the HRA and therefore the criterion for SY-B16 is met..Doc.ModelSRSY-B16Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-103 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the systems analysis in a manner that facilitates PRA applications, upgrades, and peer review.The documentation of the systems analysis, while reasonably complete, could benefit from reorganization. There are currently thirty three calculation packages which document different pieces of the systems analysis. The recommendation is to replace these calculations with a single calculation which merges all of these calculations.SY-3Doc.ModelSRSY-C1Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-104 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the system functions and boundary, the associated success criteria, the modeled components and failure modes including human actions, and a description of modeled dependencies including support system and common cause failures, including the inputs, methods, and results. For example, this documentation typically includes:(a)  system function and operation under normal and emergency operations(b)  system model boundary (c)  system schematic illustrating all equipment and components necessary for system operation(d)  information and calculations to support equipment operability considerations and assumptions (e)  actual operational history indicating any past problems in the system operation (f)  system success criteria and relationship to accident sequence models(g)  human actions necessary for operation of system(h)  reference to system-related test and maintenance procedures (i)  system dependencies and shared component interface (j)  component spatial information (k)  assumptions or simplifications made in development of the system models(l)  the components and failure modes included in the model and justification for any exclusion of components and failure modes (m)  a description of the modularization process (if used)
(n)  records of resolution of logic loops developed during fault tree linking (if used)(o)  results of the system model evaluations (p)  results of sensitivity studies (if used)
(q)  the sources of the above information, (e.g., completed checklist from walkdowns, notes from discussions with plant personnel)(r)  basic events in the system fault trees so that they are traceable to modules and to cutsets.
(s) the nomenclature used in the system models.The documentation of the systems analysis, addresses all of the items identified with the exception of the component spatial information which was only included at a very general level. If the revision of the documentation recommended above is performed, each of these areas for each system model should be examined for robustness.SY-3Doc.ModelSRSY-C2Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-105 of A-106 Appendix A - Callaway PRA Gap AnalysisDOCUMENT the key assumptions and key sources uncertainty associated with the systems analysis.The system analysis key assumptions and areas of uncertainty are documented. If the revision of the documentation recommended above is performed, each of these areas for each system model should be examined for robustness.SY-3Doc.ModelSRSY-C3Capability Category II RequirementAssessmentCat II Not MetFandO NoEnhancementThursday, September 21, 2006Page A-106 of A-106 Callaway PRA Gap Analysis Report B-1 
 
Appendix B - Independent Assessment Resu lts for Internal Events During Full Power Callaway PRA Gap Analysis Report B-2 
 
Appendix B Initiating Events Analysis Assessment Results Callaway PRA Gap Analysis Report B-3  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-1 Technical Element:  IE Supporting Requirement:  IE-A1 The Callaway identification of initiating ev ents that challenge no rmal plant operation and require successful mitigation to prevent core damage was initially performed using a structured systematic process to account for plant specific features. It is unclear from the documentation whether the initial basis for selecting th e support system initiating events is ever revisited with the chan ging models or plant modifications.
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-4  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-2 Technical Element:  IE Supporting Requirement:  IE-A3a The review of generic analyses of similar plants to assess whether the list of challenges included in the model accounts for industry experience was performed in the original PRA in Calculation ZZ-256, which has not been revisited. There doesn't appear to be any process to review current industry lists.
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-5  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-3 Technical Element:  IE Supporting Requirement:  IE-A4 The initial screening of the systems was performed during the initial PRA and is discussed in 3.1.1.1.3 of the IPE submittal. Detailed FMEAs were developed for those
 
systems identified as leading to plant trip. However, there was no justification provided for the exclusion of systems for which FMEAs were not performed. The FMEAs performed were documented in Calcs ZZ-116 (DC Power), ZZ-119 (AC Power), ZZ-120 (HVAC), EA-03 (SWS), EG-18 (CCWS), KA-30 (IAS). These FMEAs or the screening evaluations have not been revisited since the IPE. In order to meet Category 2 requirements, the documentation of the basis for the disposition of each system as an initiating event must be specified.
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-6  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-4 Technical Element:  IE Supporting Requirement:  IE-A5 The screening process does not distinguish why events which occur during non-power were excluded. This does not meet SR IE-A5.
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-7  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-5 Technical Element:  IE Supporting Requirement:  IE-A6 The IPE calculations were reviewed by plan t personnel (e.g., operations, maintenance, engineering, safety analysis) prior to the IPE submittal to determine if potential initiating events have been overlooked however, it is not clear if this process is ever revisited. The analysis meets Cat. 2 SR IE-A6 but should be revisited as part of each major update. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-8  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-6 Technical Element:  IE Supporting Requirement:  IE-A7 There was no evidence found that operating experience was reviewed with precursors in mind. If an event did not resul t in the generation of a trip or an LER, then it was not reviewed. Interviews with operations and maintenance personnel would be one method to meet SR IE-A7. The current analysis does not meet Cat 2 SR IE-A7. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-9  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-7 Technical Element:  IE Supporting Requirement:
IE-C1, IE-C1a, and IE-C13 The IE frequencies currently do not include any uncertainty bounds. The IE frequencies need to have uncertainty bounds assigned to meet SR IE-C1, IE-C1a, and IE-C13. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-10  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-8 Technical Element:  IE, SY Supporting Requirement:
IE-C1b, IE-C9, SY-A22 The Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and loss of SWS initiating events. The repair events, which include repair of CCF of pumps and valves lack sufficient analysis or data. 
 
Crediting repair of components is not acceptable unless the probability of repair is justified through an adequate an alysis or examination of data.
 
The Callaway PRA does not meet SR IE-C1b, IE-C9, and SY-A22.
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-11  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-9 Technical Element:  IE Supporting Requirement:  IE-C2 The Callaway IPE uses Bayesian update techniques, however, limited justification is provided about the informative prior distribution. Refer to note 2 of the standard for guidance. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-12  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-10 Technical Element:  IE Supporting Requirement:  IE-C3 IE-C3 requires that calculation of initiating event frequencie s on a reactor year basis. The Callaway PRA does not make this correction. Note that the T2 and T3 initiating events already include this based on the data collection method and calculation. SR-C3 is not explicitly met for the other initiating events. Refer to the ASME Standard for guidance on making this correction. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-13  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-11 Technical Element:  IE Supporting Requirement:  IE-C7 &
IE-C8  The fault trees used to quantify the support syst em initiating events all appear to use the correct computational methodology however the clarity is somewhat limited. The quantification process and maintenance of the support system initiating event fault trees could be improved and a better understanding of the support system importance by actually using a modified support system fault tree to generate an equation which then is assigned to the initiating event for the corresponding event tree. The current methodology marginally meets SR IE-C7 and IE-C8. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-14  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-12 Technical Element:  IE Supporting Requirement:  IE-C10 There is no documentation of a comparison with generic data sources for the support system initiating event fault tree results. This comparison needs to be documented as part of each update in order to meet SR IE-C10.
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-15  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-13 Technical Element:  IE Supporting Requirement:  IE-C12 The Callaway treatment of ISLOCA addresse s items a-d and may include item e but that is not clear. The ISLOCA documentatio n is good for the evaluation of the high/low interfaces (ZZ-105) however the documentation of the quantification from that point on is minimal, is not incorporated in the main model, and has not been revised or reexamined since the IPE submittal. The ISLOCA model as it now stands does not meet
 
SR IE-C12. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-16  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IE-14 Technical Element:  IE Supporting Requirement:  IE-D1, IE-D2, IE-D3  The documentation of the initiating events analysis, while reasonably complete except as noted above, is not conducive to performing updates necessary to maintaining the PRA and does not make the IE analysis clear for peer review.
 
There are currently fifteen calculation packages which document different pieces of the initiating events analysis as well as some information only found in the IPE submittal. The recommendation is to replace these calculations with two IE calculations, one for the identification of initiating events and one for the quantification of the initiating events. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-17 
 
Appendix B Accident Sequence Analysis Assessment Results Callaway PRA Gap Analysis Report B-18  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: AS-1 Technical Element:  AS Supporting Requirement:  AS-B1, AS-B2, QU-A2a Event Tree T(SW), function L2SW-M should evaluate the TDAFW pump with no functioning SW/ESW equipment. The cutsets for this function include failures of the ESW pumps and human action failures for alignment of SW/ESW. Since the initiator
 
fails all SW/ESW, the logic should not include these events. A similar situation exists for function L2T1s.
 
Event Tree T(SW) function O1SW-M includes a FANDB operator error which does not belong in the function. A similar situatio n exists for functions O1C-M, O1CT1-M, and O1SW-M.
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report B-19  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: AS-2 Technical Element:  AS Supporting Requirement:  AS-A11 Transfers between event trees may be used to reduce the size and complexity of individual event trees. DEFINE any transfers that are used and the method that is used to implement them in the qualitative definiti on  of accident sequences and in their quantification. USE a method for implementing an event tree transfer that preserves the dependencies that are part of the transf erred sequence. These include functional, system, initiating event, operator, and spatial or environmental dependencies.
 
This requirement is not met. Many transf ers such as seal LOCA and stuck open PORV transfer to a "psuedo event tree". These transfers are quantified using an OCL file that does not have a specific event tree. This introduces possibilit ies for error in the quantification since there is no event tree on which to base the evaluated functions, especially those that require preservation of dependencies. The actual event tree for quantification of the RCP seal LOCA events was not found. An event tree Trcp appears to have been used, but this event tree has an event for recovery of CCW, which is not included in the .OCL files fo r the RCP seal LOCA events. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report B-20  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: AS-3 Technical Element:  AS Supporting Requirement:  AS-B1 The method of event tree analysis for support system initiators does not appear to correctly capture the failed dependencies in the mitigating systems for some support system IE's. A single basic event is used for the initiating event. House events are included in the fault trees to turn off the affected trains when a support system is not available. It is not clear there are sufficient support systems modeled in the main feedwater and non-safety service water to fail these systems when their support systems are unavailable. This may occur in Tsw, Tnk01, and Tnk04. The cutsets for Tsw, Tnk01, Tnk04, and Tccw should be checked to search for systems that would be failed by the loss of the initiator, and then modify the fault trees to include the appropriate house events to disable these systems.
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-21  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: AS-4 Technical Element:  AS Supporting Requirement:  AS-B6 The RCP seal LOCA model needs to be updated to reflect the latest WOG model, which is approved by the NRC. 
 
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-22 FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: AS-5 Technical Element:  AS Supporting Requirement:  AS-B6 Room cooling requirements for the switchgear rooms for SBO should be re-evaluated to consider the actual heat loads in the rooms during SBO.
 
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-23  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: AS-6 Technical Element:  AS Supporting Requirement:  AS-A9 The MAAP results indicate there are 60 hours before core melt for the SGTR sequence with failure to isolate the SG. If the MAAP analysis is correct, then the sequence should be screened. If the MAAP analysis is not correct, or MAAP 3 can not provide a correct representation of the sequence, MAAP 4 should be used. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-24  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: AS-7 Technical Element:  AS Supporting Requirement:  AS-B1 Specific errors are as noted below:  Function O1T1S in the SBO event tree contains basic events for MFW and SW as a backup source for water to SGs if the TDP fails. The problem occurs in the SECDEP fault tree, which asks for GM FX100, but does not have any logic to cancel the gate in SBO. There are no events in the MFX fault tree which will cancel it in the event of an SBO, either. Also, in MFW.lgc, gate GMFW413 - the SVC system will be failed by LOSP, but comes through the link in the SBO function. Back-up sources of water to th e SG are modeled at a high level, often only represented by an HEP. There needs to be either a) support systems developed which will be failed by LOSP or AC power, or b) house event logic to fail these for SBO. The AFW function on the TSW event tree - (L2SW-M) - has recovery factors for ESW as a suction source to the turb ine driven AFW pump. (AL-XHE-FO-AFWESW). ESW is failed by the initiator, but the IE is a basic event, not cutsets.
Need to represent the initiator as a support system fault tree, OR need to include house events in the AFW function to fail the cross-tie to the ESW system after a Loss of ESW. In TSW event tree, function O1SW-M has an event (AE-XHE-FO-MFWFLO) for failure of MFW as back up to AFW. MFW is unavailable after loss of SW.
Need to include support systems for MFW or insert house events in fault tree to turn off MFW for loss of TSW.
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-25 
 
Appendix B Success Criteria Assessment Results Callaway PRA Gap Analysis Report B-26  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: SC-1 Technical Element:  SC Supporting Requirement:  SC-C1, SC-C2, SC-C3 Success criteria are not documented in a single place. Each system notebook has the SC for that application. Current system of documentation does not provide easy comparison
 
of T/H use for consistency. The ASME criteria expects to see a single place for SC documentation and a coordinated effort to compare and show that all SC are consistently derived from the same set of consistent T/H runs. The documentation should also identify the key assumptions and key sources of uncertainty associated with the development of success criteria. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-27  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: SC-2 Technical Element:  SC Supporting Requirement:  SC-B5 There was no documentation found which provides a comparison of the plant-specific analysis with that of different plants or with other computer code calculations to check the reasonableness and acceptability of the results of the thermal/hydraulic, structural, or other supporting engineering bases used to support the success criteria. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-28  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: SC-3 Technical Element:  SC Supporting Requirement:  SC-B1 It is noted that the feed and bleed criteria is conservatively set to 2 of 2 PORV. This may have significant numerical impact in use of the PRA, particularly considering spatial dependencies, for rooms that disable a train of AC power or DC power or fail a PORV. The base case CCDP for a transient in 1.3E-6. If one PORV is OOS, the CCDP is 3.3E-5.
It may be worthwhile to re-evaluate F&B criteria with MAAP 4.
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-29  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: SC-4 Technical Element:  SC Supporting Requirement:  SC-B1 The Callaway PRA has a common cause event for failure to isolate SG blow down. This event fails all AFW. The importance of the event is 0.10 in the base case model with all initiators and 0.57 in the fire-transient model. Very few plants have this strong dependence on failure to isolate SG blow down. Suggest examination of the success criteria, or at least re-evaluati on of the CCF values used, away from the 0.1 beta factor for 4/4 blowdown valves fail to close.
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-30 
 
Appendix B Systems Analysis Assessment Results Callaway PRA Gap Analysis Report B-31  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: SY-1 Technical Element:  SY Supporting Requirement:  SY-A7 For the Instrument Air System a single basic event is used and is based on generic data.
The Callaway plant is not highly dependent upon IAS and the PRA loads on IAS also are supplied with N2 backup which is modeled. Modeling the IAS as a single basic is acceptable however, the MFW dependency on the IAS is not modeled and needs to be included since MFW is credited as a backup to AFW and is important. The actuation system is modeled with a single event for each of the redundancies which is set to fail for scenarios in which the conditions are not pres ent to generate the signal. The level of detail is acceptable for this use.
 
The dependency of MFW on IAS needs to be included and the data associated with these single event failures need to be reviewed against current industry data and updated if necessary. The applicability of the data to the Callaway configuration also needs to be justified. One such source of data is NUREG/CR-5750.
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-32  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: SY-2 Technical Element:  SY Supporting Requirement:  SY-B1,  SY-B3, & SY-B4 The Callaway PRA adequately models CCFs with the exception of battery chargers and breakers as noted in SR SY-B1 and B3. The quantification of all CCFs should be updated. CCFs should be added for Battery Chargers and Breakers. The
 
quantification of the CCFs should be done in accordance with NUREG/CR-5485.
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-33  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: SY-3 Technical Element:  SY Supporting Requirement:  SY-C1, SY-C2, & SY-C3 The documentation of the systems analysis, while reasonably complete, is not conducive to performing updates necessary to maintain ing the PRA and does not make the systems analysis clear for peer review.
 
There are currently thirty three calculation packages which document different pieces of the systems analysis. The recommendation is to replace these calculations with a single calculation which merges all of these calculations. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-34 
 
Appendix B Human Reliability Analysis Assessment Results Callaway PRA Gap Analysis Report B-35  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: HR-1 Technical Element:  HR Supporting Requirement:  HR-D3 Documentation should be updated to add a gr ound rule statement that the quality of written procedures is considered in th e operator-procedure interface failure mechanisms of the CBDTM, and in the EOM parts of the THERP analyses (step-by-step vs. verbose). The instrumentation and control layout is considered in the "Cues" sections and in the THERP execution analyses. Equipment configuration is considered for local actions in "Execution PSFs" and in the THERP analyses. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Lincoln Sarmanian
 
Callaway PRA Gap Analysis Report B-36  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: HR-2 Technical Element:  HR Supporting Requirement:  HR-G6 The analyst who performed the reevaluation of the HFEs indicated that a reasonableness check was performed, however the documentation does not discuss this issue. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Lincoln Sarmanian
 
Callaway PRA Gap Analysis Report B-37  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: HR-3 Technical Element:  HR Supporting Requirement:  HR-I3 Key assumptions are documented in the individual analysis files, where applicable. Key sources of uncertainty associated with the HRA are not documented. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Lincoln Sarmanian
 
Callaway PRA Gap Analysis Report B-38 
 
Appendix B Data Analysis Assessment Results Callaway PRA Gap Analysis Report B-39  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: DA-1 Technical Element:  DA Supporting Requirement:  DA-C6, DA-C7, DA-C8, DA-C9 The data collected for component demands, surveillance tests, maintenance unavailability, system configuration, and operati on time is provided by the MR Group. It appears, based on discussions with the PRA analyst, that the correct information is collected and transferred to the PRA Group; however the documentation of the collection method needs to be formaliz ed and included as part of the PRA. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Mark Farrell
 
Callaway PRA Gap Analysis Report B-40  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: DA-2 Technical Element:  DA Supporting Requirement:  DA-B1, DA-C2  Group estimations are based only on component type. Capability Category II requires
 
grouping of components according to type (e.g., motor-operated pump, air-operated valve) and according to the characteristics of their usage to the extent supported by data:
(a)  mission type (e.g., standby, operating)
(b)  service condition (e.g., clean vs. untreated water, air)
 
The level of grouping used in the latest data update uses a very fine grouping which leads to a smaller data pool for each diffe rent component. Consideration should be given to collecting data on as large a gro up of components as possible to establish a meaningful collection of data. Grouping of the components as defined in SR DA-B1 and DA-B2 provides a more reasonable aggregation of data and results in a larger data pool to characterize the failure data. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Mark Farrell
 
Callaway PRA Gap Analysis Report B-41  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: DA-3 Technical Element:  DA Supporting Requirement:  DA-D2 No justification is provided for the use of engineering judgment to determine the probability as required by DA-D2 (Exam ple: HYDRAULICSYSFAIL, STR-FR, STR-FS). There is no indication that any parameters were (or were not) determined by using data or estimates of similar equipment. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Mark Farrell
 
Callaway PRA Gap Analysis Report B-42 
 
Appendix B Internal Flooding Assessment Results Callaway PRA Gap Analysis Report B-43  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IF-1 Technical Element:  IF Supporting Requirement:  IF-D5,                                                IF-D5a This requirement is met to Category I. The flood initiating event frequencies are based on generic pipe break frequencies. No pl ant specific experience is considered in the determination of the flooding initiator frequencies. Plant experience at the time the flooding analysis was performed was 0 events. Documentation of the plant specific considerations used in the development of the scenarios needs to be added as discussed in SR IF-D5a.
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report B-44  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IF-2 Technical Element:  IF Supporting Requirement:  IF-E3a This requirement is not met at any Category. The Category I/II screening quantitative criteria in the standard is 1E-09/year. ZZ-466 screening criteria was 1E-06/yr.
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report B-45  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IF-3 Technical Element:  IF Supporting Requirement:  IF-C6,                                              IF-C8 This requirement is met to Category I only. ZZ-466 allows the operator intervention and mitigation for floods th at take 30 minutes or longer. Isolation and available manpower not specifically addressed. 
 
Isolation and available manpower should be considered and documented with the revised screening discussed in F&O IF-2.
LEVEL OF SIGNIFICANCE: C AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report B-46  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IF-4 Technical Element:  IF Supporting Requirement:  IF-E5,                                              IF-E5a If additional human failure events are re quired to support quant ification of flood scenarios, PERFORM any human reliability an alysis in accordance with the applicable requirements described in Tables 4.5.5-2(e) through Table 4.5.5-2(h).
 
This requirement is not met. The HEP val ues used in ZZ-466 are not developed from a human reliability analysis. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report B-47  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IF-5 Technical Element:  IF Supporting Requirement:  IF-C2a For each defined flood area and each flood source, IDENTIFY those automatic or operator responses that have the ability to terminate or co ntain the flood propagation.
 
This requirement is not met. ZZ-466 treats operator response in a generic sense. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report B-48  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: IF-6 Technical Element:  IF Supporting Requirement:  IF-E7 For each flood scenario, REVIEW the LERF an alysis to confirm applicability of the LERF sequences. If appropriate LERF seque nces do not exist, MODIFY the LERF analysis as necessary to account for any unique flood-induced scenarios or phenomena in accordance with the applicable requirements described in para. 4.5.9.
 
This requirement is not met. The internal flooding sequences are not considered in the LERF analysis. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report B-49 
 
Appendix B Quantification Assessment Results Callaway PRA Gap Analysis Report B-50  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-1 Technical Element:  QU Supporting Requirement:  QU-A2b &
QU-E3  The current quantification does not include an uncertainty calculation to account for the "state-of-knowledge" correlation between event probabilities. The structure exists to perform this correlation wi thin WinNUPRA but at the current time it has not been done. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-51  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-2 Technical Element:  QU Supporting Requirement:  QU-B9 The Callawa y PRA does not use modules, subtrees, or split fractions, with one exception.
That exception is in the SSIE events. These "modules" provide a place that some dependencies can be overlooked. While the Ameren staff have made the effort to account for these hidden dependencies and SR QU-B9 is considered to be met, linking of the SSIE fault trees to the event trees provides more assurance of the correct treatment and should be considered. EPRI is currently developing a procedure to guide the treatment of support system initiating events which should be issued in the near future. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-52  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-3 Technical Element:  QU Supporting Requirement:  QU-C3, QU-D1a, QU-D1b, QU-D1c Some instances of incorrect transfer of sequence characteristics, incorrect logic, incorrect house event settings, and resultant cutsets were identified based on cutset reviews. The process is generally set up correctly but the overall process would benefit from revising the quantification process to account for the additional software capability currently available. As a minimum, the top cutsets (500?) need to be reviewed to make sure that the transfers, logic, house event setting are yielding realistic combinations. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-53  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-4 Technical Element:  QU Supporting Requirement:  QU-D1a The IAS is correctly failed for LOSP, but remains available in all other cases. The IAS is cooled by SW and would be unavailable aft er loss of all SW (T(SW)) and should be set to failed via a house event setting. The availability of IAS needs to be propagated correctly during the quantification process.
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-54  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-5 Technical Element:  QU Supporting Requirement:  QU-D4 There was no documentation of a review of non-significant accident sequences or cutsets to determine their reasonableness. This review is necessary to meet SR QU-D4. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-55  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-6 Technical Element:  QU Supporting Requirement:  QU-E1 &
QU-E2  Key sources of model uncertainty and key assumptions were identified during the IPE but they are scattered throughout the calculation packages which serve as the documentation. There is no indication that the results have ever been revisited since that time even though the model has underwent changes. Gathering the information in one place would be very beneficial to the long term maintainabili ty of the analysis. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-56  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-7 Technical Element:  QU Supporting Requirement:  QU-E4 Key sources of model uncertainty and key assumptions were evaluated during the IPE with sensitivity analyses and those cases are requantified during each update to the model quantification but there is no documentation to show that the basis for the sensitivity studies has ever been revisited since that time even though the model has underwent changes. The sensitivity studies should be reexamined to make sure they cover the major sources of modeling uncertainty in the current model. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-57  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-8 Technical Element:  QU Supporting Requirement:  QU-F1 The documentation of the model quantification accurately documents what was performed during the quantification process, however the manual integration required for several stand-alone pieces of the analysis is not well documented. The recommended changes to the quantification process to inte grate the entire internal events (including internal flooding) would serve to facilitate the use of the quantification process for PRA applications, upgrades, and peer review. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-58  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-9 Technical Element:  QU Supporting Requirement:  QU-F2 In general the model integration process is adequately documented, however several of the areas do not meet the requirements. Items b (records of the cutset review process), f (the accident sequences and their contributing cutsets), g (equipment or human actions that are the key factors in causing the a ccidents to be non-dominant), and i (the uncertainty distribution for the total CDF) are not addressed in the documentation. As a minimum, these items need to be addresse d to meet SR QU-F2. If the quantification process and documentation are revised the list of information included in SR QU-F2 should be followed in the revision. LEVEL OF SIGNIFICANCE: B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-59  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-10 Technical Element:  QU Supporting Requirement:  QU-F4 Key assumptions and key sources of uncertainty which influence the current quantification are not addressed in a coherent manner in the documentation. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-60  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-11 Technical Element:  QU Supporting Requirement:  QU-F6 The quantitative definition used for significant cutset and significant accident sequence are documented and vary from the ASME defini tion. The ASME definitions need to be applied or the Ameren definition needs to be justified.
 
Significant sequence:
 
ASME - aggregate 95% of total, individual sequence >1%
Ameren - aggregate 88% of total, individual sequence >1%
 
Significant cutset:
ASME - aggregate 95% of total, individual cutset >1%
Ameren - cutsets >1E-6
 
LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-61  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: QU-12 Technical Element:  QU Supporting Requirement:  QU-F5 SR QU-F5 requires documentation of limitations in the quantification process that would impact applications. No documentation of limitations was identified.
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report B-62 
 
Appendix B LERF Analysis Assessment Results Callaway PRA Gap Analysis Report B-63  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: LE-1 Technical Element:  LE Supporting Requirement:  LE-B1, LE-D6  Probability of containment isolation failure leading to LERF does not contain a term to represent undetected, residual failures in co ntainment structural integrity. This has been estimated at 5E-3 in NUREG/CR-4550. Failu re of containment is olation is derived by fault tree analysis of the containment isolation combinations on the penetration paths. There are three LERF split fractions with probabilities of 7.7E-4. If the 5E-3 was added to this, the split fraction would change, although LERF would not move significantly. Split fractions for induced SGTR and HPME were not explicitly stated in the documentation available for review. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-64  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: LE-2 Technical Element:  LE Supporting Requirement:  LE-F2, LE-G4  The Level 2 analysis does not include uncertainty analysis nor are there sensitivity studies identified to examine the significant contributors to LERF. As a minimum, the Uncertainty in the Level 1 sequences should be propagated and sensitivity studies developed and evaluated for the important LERF scenarios. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-65  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: LE-3 Technical Element:  LE Supporting Requirement:  LE-D4, LE-D5  Meets category I for the evaluation of induced SGTR only. In order to meet category II, it is necessary to perform an analysis of thermally-induced SG tube rupture that includes plant-specific procedures and design features and conditions that could impact tube failure and a more plant specific estimation of secondary side isolation capability.
Little benefit is expected from the addi tional analysis at significant cost. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Robert C. Bertucio
 
Callaway PRA Gap Analysis Report B-66 
 
Appendix B Maintenance and Update Assessment Results Callaway PRA Gap Analysis Report B-67  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: MU-1 Technical Element:  MU Supporting Requirement:  MU-B3 Supporting requirement MU-B3 states that all PRA changes shall be performed consistent with the supporting requirements in the ASME standard. There is no requirement in APA-ZZ-00312 to do this. There is no reference in the procedure to any PRA standard. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report B-68  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: MU-2 Technical Element:  MU Supporting Requirement:  MU-B4 Supporting requirement MU-B4 states that PRA upgrades shall receive a peer review. There is no requirement in APA-ZZ-00312 to do this. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report C-1 
 
Appendix C - Independent Assessment Results for External Events During Full Power Callaway PRA Gap Analysis Report C-2 Appendix C Other External Event s: Requirements for Screening and Conservative Analysis Assessment Results Callaway PRA Gap Analysis Report C-3  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: EXT-1 Technical Element:  EXT Supporting Requirement:  EXT-A1, EXT-A2, EXT-C2, EXT-E1, EXT-E2, EXT-E3  The ANSI/ANS standard requires a broader examination of external events than performed in the Callaway IPEEE. The list of external events requiring consideration from Appendix A of the ANSI/ANS standard should be assessed and the reason for screening or evaluation should be documented. This review is not expected to result in identific ation of any additional events to be evaluated but is needed to show comprehensive coverage. Similarly, the search for any site-specific or plant-unique external events should be documented.
 
External events which are screened based on conformance with the 1975 SRP need to be examined to assess the impact of any signifi cant changes (plant design, operation, nearby military or industrial facilities, nearby transportation, on-site storage or activities involving hazardous materials, or any other changes that could affect the original design considerations) or revisions to data (extreme local preci pitation, high wind data, probable maximum flood, etc.) on the screening basis.
 
Documentation of the screening process needs to be revised to provide the criteria/basis for the screening classification of each external event (EXT-E1, EXT-E2, EXT-E3)
LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  Marc D. Quilici
 
Callaway PRA Gap Analysis Report C-4 
 
Appendix C Seismic Margins Assessment Results Callaway PRA Gap Analysis Report C-5  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: SM-1 Technical Element:  SM Supporting Requirement:  SM-H1 Requirement SM-H1 is to meet the general do cumentation requirements of Section 7 of the External Events Standard. The following requirements in Section 7 are not met for the Seismic margins analysis.
 
DOC-5:  The documentation SHALL describe the major contributors to the uncertainty in each of the important final PRA results and insights.
 
DOC-7:  The documentation SHALL include the peer-review report and the PRA analysis team's disposition of the peer-review team's comments.
 
Neither of these are included in the docume ntation of the Seismic Margins analysis. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report C-6  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION: SM-2 Technical Element:  SM Supporting Requirement:  SM-C4 ENSURE that soil-structure interaction (SSI) analysis is median centered using median properties at soil strain levels corresponding to the review level earthquake input ground motion. CONDUCT at least three SSI analyses to investigate the effects on response due to uncertainty in soil properties.
ENSURE that one analysis is at the median low strain soil shear modulus and additional analyses at the median value times (1 + Cv) and the median value divided by (1 + Cv), where Cv is a factor that accounts for uncertainties in the SSI analysis and soil properties. If adequate soil investigation data are available, ESTABLISH the mean and standa rd deviation of the low strain shear modulus for every soil layer. ESTABLISH the value of Cv so that it will cover the mean plus or minus one standard deviation for every layer. For the minimum value of Cv, USE 0.5. When in sufficient data are available to address uncertainty in soil prope rties, USE Cv at a val ue not less than 1.0.
 
Could not locate any documentation that the soil-structure analyses required by this requirement were performed. LEVEL OF SIGNIFICANCE:  C AR: PRESOLUTION PLAN:
REVIEWER:  MIKE A. PHILLIPS
 
Callaway PRA Gap Analysis Report D-1 Appendix D - Independent Assessment Results for Low Power and Shutdown Plant States modeling Internal and External Initiating Events Callaway PRA Gap Analysis Report D-2  FINDING/OBSERVATION REGARDING PRA  TECHNICAL ELEMENTS OBSERVATION:
Technical Element:
Supporting Requirement:
The Low Power and Shutdown PRA Stan dard is under development. When issued, there are expected to be PRA elements that will be required but are not part of the Callaway shutdown PRA model, specifically pre-initiating event HRA, internal flooding, uncertainty, LERF, and external events. Additionally the POS element will likely require additional analyses documenting the identification of plant stat es. The other PRA elements of the low power and shutdown PRA generally satisfy Capability Category II of the expected PRA Standard. LEVEL OF SIGNIFICANCE:  B AR: PRESOLUTION PLAN:
REVIEWER:  JEFF A. JULIUS}}

Revision as of 20:36, 16 April 2019

Redirect to:

Retrieved from "https://kanterella.com/w/index.php?title=ML093290318&oldid=1465690"