ML081340561

Callaway - Response to Request for Additional Information One-Time Completion Time Extension for Essential Service Water (ESW) System

ML081340561
Person / Time
Site:	Callaway
Issue date:	05/06/2008
From:	Graessle L H AmerenUE
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
TAC MD7252, ULNRC-05500
Download: ML081340561 (37)

Text

AmerenUE PO Box 620 Callaway Plant Fulton, MO 65251 May 6, 2008 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Stop P1-137 Washington, DC 20555-0001 ULNRC-05500 Ladies and Gentlemen:

DOCKET NUMBER 50-483 CALLAWAY PLANT UNION ELECTRIC COMPANY ONE-TIME COMPLETION TIME EXTENSION FOR ESSENTIAL SERVICE WATER (ESW) SYSTEM

References:

1. ULNRC-05445 dated October 31, 2007 2. ULNRC-05476 dated February 21, 2008 3. ULNRC-05482 dated March 7, 2008 4. NRC Request for Additional Information dated March 31, 2008 In Reference 1 above AmerenUE requested a license amendment that would revise Callaway Technical-Specification (TS) 3.7.8, "Essential Service Water (ESW)System," and TS 3.8.1, "AC Sources -Operating," to allow a one-time Completion Time extension from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days per ESW train, to be used prior to December 31, 2008, for replacing underground ESW piping.From the NRC's ongoing review of the subject license amendment request (LAR), several requests for additional information (RAIs) have been transmitted to AmerenUE, to which AmerenUE has responded except for the most recent request.Per Reference 2, AmerenUE responded to eight questions that were received electronically from the NRC's Probabilistic Risk Analysis (PRA) Licensing Branch on January 16, 2008. Per Reference 3, AmerenUE responded to four questions received electronically from the Electrical Branch on February 7, 2008. (It should be noted that the commitment regarding alternate AC power in response to question 2.b in Reference 3 has not been quantified for its effect on the previously reported risk metrics.)

Via Reference 4, the NRC formally transmitted four follow-up PRA questions that had been electronically received by AmerenUE on March 20, 2008. In the RAI letter of Reference 4 several editorial changes were made to the electronic information request of March 20, 2008.In response to the RAI letter of Reference 4, AmerenUE hereby provides the information contained in the enclosures to this letter. Specifically, Enclosure 1 to this a subsidiary of Ameren Corporation ULNRC-05500 May 6, 2008 Page 2 letter contains the responses to the four follow-up questions of Reference 4, which are in regard to the supplemental PRA information that was submitted in Reference 2 above. Enclosure 2 of this letter provides a list of Findings/Observations that is cited in the response to the first question in Enclosure

1. Enclosure 3 of this letter provides the original list of plant areas and rooms determined to be risk significant for internal flooding and fire events with respect to this amendment application.

This list was used to develop the responses to questions 3.b and 3.c in Enclosure

1. Enclosure 4 of this letter provides a revised list of commitments for this amendment, which supersedes the list that was transmitted as Enclosure 2 to Reference 3 above.If you have any questions on this letter or its enclosures, please contact Mr.Scott Maglio at (573) 676-8719.I declare under penalty of perjury that the foregoing is true and correct.Very truly yours, Executed on: S- 6 -0 Luke H. Graessle Manager -Regulatory Affairs GGY/nls

Enclosures:

1 -Responses to PRA Branch Follow-up Questions 2 -RG 1.200 Gap Assessment

-Findings/Observations (F/Os)3 -Risk-Significant Internal Flooding and Fire Areas / Rooms 4 -Summary of Regulatory Commitments ULNRC-05500 May 6, 2008 Page 3 cc: U.S. Nuclear Regulatory Commission (Original and 1 copy)Attn: Document Control Desk Mail Stop P1-137 Washington, DC 20555-0001 Mr. Elmo E. Collins, Jr.Regional Administrator U.S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-4005 Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission 8201 NRC Road Steedman, MO 65077 Mr. Mohan C. Thadani (2 copies)Licensing Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop O-8G14 Washington, DC 20555-2738 ULNRC-05500 May 6, 2008 Page 4 Index and send hardcopy to QA File A160.0761 Hardcopy: Certrec Corporation 4200 South Hulen, Suite 630 Fort Worth, TX 76109 (Certrec receives ALL attachments as long as they are non-safeguards and may be publicly disclosed.)

Electronic distribution for the following can be made via Tech Spec ULNRC Distribution:

C. D. Naslund A. C. Heflin T. E. Herrmann L. H. Graessle G. A. Hughes S. A. Maglio S. L. Gallagher L. M. Belsky (NSRB)T. B. Elwood D. E. Martin G. G. Yates Ms. Diane M. Hooper (WCNOC)Mr. Dennis Buschbaum (TXU)Mr. Scott Bauer (Palo Verde)Mr. Stan Ketelsen (PG&E)Mr. Scott Head (STP)Mr. John O'Neill (Pillsbury, Winthrop, Shaw, Pittman LLP)Missouri Public Service Commission Mr. Floyd Gilzow (DNR)

ULNRC-05500 May 6, 2008 Enclosure 1 ENCLOSURE 1 RESPONSES TO PRA BRANCH FOLLOW-UP QUESTIONS Enclosure 1 Page 1 of 11 REQUEST FOR ADDITIONAL INFORMATION RELATED TO AN AMENDMENT TO REVISE TECHNICAL SPECIFICATIONS FOR ESSENTIAL SERVICE WATER CALLAWAY PLANT DOCKET NO. 50-483 TAC NO. MD7252 The questions given below are based on the NRC staff's review of the license amendment request (LAR) submitted on October 31, 2007 (ULNRC-05445) and, more specifically, the supplemental information contained in ULNRC-05476 dated February 21, 2008 by the Union Electric Company (the licensee) for Callaway Plant. This LAR proposes changes to the Callaway Technical Specifications (TSs).1. Question:

The NRC staff asked for substantive justification that the known deficiencies in the probabilistic risk assessment (PRA) model, identified from peer reviews and identified to the NRC staff in the submittal, would not significantly impact the application.

In response, to address the Scientech gap assessment against the American Society of Mechanical Engineers internal events standard, the licensee restated that it "believed" these gaps would not invalidate the risk insights for this application, then argued that since the existing PRA results were already greater than the Regulatory Guide 1.177 guidelines for permanent changes, the gaps would not result in any further significant increase in the risk.Please submit specific information which qualitatively discusses the substance of the deficient items and adequately justifies that these deficiencies or gaps do not impact the risk results of this application.

Response:

It should be noted that the license amendment application (ULNRC-05445) and first set of RAI responses (ULNRC-05476) dealt with the five open Facts and Observations (F&Os) from the WOG PRA peer review.In response to the NRC staff's request for additional information on the Scientech gap analysis of the Callaway PRA, the Findings/Observations (F/Os) from that assessment (against the ASME internal events PRA standard) were reviewed.

The table included as Enclosure 2 to this letter lists all of the significance level "B" F/Os (there were no level"A" F/Os in the Scientech gap analysis) and provides qualitative discussions as to the effects these F/Os could have on the one-time essential service water (ESW) Completion Time (CT) extension amendment application.

2. Question:

The NRC staff asked for discussion and justification of the truncation level for this application.

The licensee's response identified the use of pre-solved cutsets to generate the application risk results. The staff is concerned that the use of pre-solved cutsets for this application may not be adequate to obtain an accurate assessment of the configuration-specific risk level. Specifically, the service water unavailability and random failure probability, coincident with the unavailability or failure of the backup Enclosure 1 Page 2 of 11 normal service water system (identified in other RAI responses as credited in the model), represent a very unlikely failure mode, which may not appear in many cutsets above truncation.

Regenerating the cutsets with the service water train out-of-service to reflect the actual configuration during the proposed extended completion time (CT) could result in many more cutsets generated above the nominal truncation level, resulting in an increase in the configuration-specific risk. This can be an especially significant problem if the nominal unavailability and random failure probability result in large numbers of cutsets just below the truncation level. In addition, initiating events, such as loss-of-service water, are more likely to occur when one of the two trains is out-of-service.

This frequency increase may not be reflected in the pre-solved cutsets, and, therefore, the risk contribution from such initiators would not be reflected in the results.Please provide risk results which avoid this potential non-conservatism by regenerating cutsets for the specific configuration(s) expected as result of the changes requested and addressing the increased likelihood of the loss-of-service water initiating event.Response:

In response to the NRC staff's request, the Callaway core damage (CD) and large early release (LER) PRA models were re-solved (i.e., CD and LER cutsets were regenerated) to reflect the configuration that the plant intends to operate in during the extended ESW CT. This re-solution of the models also took into account, as did the information in the original submittal, the impact on the loss of all service water initiator frequency of having a train of ESW out of service during the extended CT. The following table provides the risk metrics for the requested one-time per ESW train 14-day CT, given the "regenerated" CD and LER cutsets (standard acronyms are used in the table and were defined in the original amendment application).

Note that the risk metrics in the table below take no credit for cooling the affected ESW train heat loads with non-safety service water.Metric: Conditional Conditional ICCDP / Delta CDF /CDF/LERF CDF/LERF ICLERP Based Delta LERF Generated with from Re- on Regenerated Based on Pre-Solved Solution of the Cutsets: Regenerated Cutsets (yr-1): Models (i.e., Cutsets (yr-1): Regeneration of Cutsets) (yr-1): Core Damage 1.432E-4 1.564E-4 4.38E-6 8.75E-6 Large Early 3.058E-6 3.064E-6 1.O1E-7 2.02E-7.Release 3. Question:

The NRC staff requested the licensee to address initiating events not included in its risk assessment model, including fires, floods, seismic events, and other external events. The licensee identified proposed compensatory measures to include walkdowns of the operable service water train, fire and flood watches in rooms identified as risk important in the licensee's internal flooding, seismic margin, and fire Enclosure 1 Page 3 of 11 protection evaluations, and evaluation of transient combustibles within 20 feet of the operable service water train. The staff is unable to conclude that these sources of risk will not be potentially significant while the plant configuration has one service water header unavailable.(a) With regard to seismic risk, there is no risk mitigation provided by the compensatory measure of walkdowns of rooms identified as risk-important in a seismic margins analysis.

Please provide a summary of the relationship between the results of the seismic margins analyses which it identified in its response with the specific configuration of the plant-when it is reliant upon a single service water header. The seismic ruggedness of the remaining operable service water system should be addressed to justify that a seismic event is not likely to cause damage to this system. The qualitative information should be adequate for the NRC staff to conclude that seismic risk is not significant for this application.

Otherwise, additional quantified estimates should be provided to characterize the risk impact.(b) With regard to internal flooding, the NRC staff agrees that the compensatory measure of verifying the availability of flood mitigation equipment for the protected train is beneficial.

However, the NRC staff needs to understand the significant contributors to internal flooding risk, how these could potentially impact the remaining operable protected train of equipment, or otherwise result in increased reliance upon that equipment, and either conclude that the risk of these scenarios is not significant or that compensatory measures are in place to mitigate these events. Please provide adequate qualitative information for the NRC staff to determine whether the internal flooding risk is not significant for this application.

Otherwise, please provide additional quantified estimates to enable the NRC staff to characterize the risk impact.(c) Similar to internal flooding, the compensatory measures identified for walkdowns and monitoring of transient combustibles is a benefit. The staff must understand the significant contributors to fire risk, how these could potentially impact the remaining operable protected train of equipment or otherwise result in increased reliance upon that equipment, and either conclude that the risk of these scenarios is not significant or that compensatory measures are in place to mitigate these events. Please provide adequate qualitative information for the NRC staff to determine whether the fire risk is not significant-for this application.

Otherwise, provide additional quantified estimates to characterize the risk impact.(d) Please discuss the impact of this proposed TS change on other external events (i.e., hazardous material leaks, transportation events, high winds and'tornadoes, etc.).Although.

weather-related loss-of-offsite power was addressed (and credited in the risk analyses), there is no discussion of high winds with regard to any unique vulnerabilities during the time the service water header is out of service, the vulnerability of the backup normal service water system to high winds, or other discussion to characterize the site with regard to this source of risk. Other external events were not discussed at all.

Enclosure 1 Page 4 of 11 Response: (a) The Callaway Plant has a robust seismic design. Due to the SNUPPS design originally being intended for multiple sites, additional design conservatism was built into the plant by designing to floor response spectra (FRS) that overlapped the various sites originally considered.

In order for Union Electric (now. AmerenUE) to respond to Generic Letter 88-20, Supplement 4, the results of a Seismic Margins Assessment (SMA)were reported to the NRC in the IPEEE Report submitted via ULNRC73232 dated 6-30-95. In support of that response, Bechtel Power Corporation was contracted to compare Callaway's FRS against the 0.3g Review Level Earthquake (RLE). After this effort, seismic qualification documentation was reviewed to verify whether specific equipment was qualified for the limited frequencies where the RLE exceeded the FRS. This screened out all but 22 components listed in the IPEEE Report Section 3.1.4.1.4.

As an example of how the SNUPPS design led to Callaway's robust seismic design, IPEEE Report Section 3.1.4.5.3 documents a calculation demonstrating that the component cooling water (CCW) heat exchangers would survive a peak ground acceleration of 0.41g, far in excess of the RLE and the Safe Shutdown Earthquake (SSE).NUREG-1488 estimates a mean seismic hazard frequency of 1.68E-5 yr-1 for a 0.3g or greater earthquake.

The SMA of the Callaway Plant determined that the Safe Shutdown Equipment List (SSEL) equipment, which are required for the two success paths to mitigate the effects of a seismically induced small break LOCA, is capable of withstanding the 0.3g Review Level Earthquake (RLE). Since the CCDF due to the ESW Completion Time Extension is calculated to be 1.564E-4yr-1 per the response to question 2 above, the seismic risk is a negligible fraction of the CCDF and not significant for this application.

A Seismic Capability Walkdown was performed for the 22 screened-in components during the SMA to verify the initial evaluation and evaluate the equipment for spatial systems interactions and anchorage adequacy.

For this amendment application, the previous commitment to perform a walkdown will check the subset of the above mentioned 22 components from the IPEEE SMA that are affected by the relaxed ESW Completion Time, i.e. ultimate heat sink (UHS) cooling tower fans and motor control centers, ESW self-cleaning strainers, diesel generator (D/G) intake Air Filters, and D/G intercooler heat exchangers, to look for obvious mounting or seismic interaction issues (e.g., loose parts, missing hardware, etc.) prior to entering the extended ESW CTs.(b) The Callaway Plant is designed to withstand a flooding hazard resulting from worst case pipe breaks such that safety-related equipment would still function to mitigate and maintain the plant in a safe shutdown condition.

The Callaway IPE Flooding Update identified and analyzed sixty-five flood areas. The flooding sources (pipe break frequencies) and the conditional core damage probability (CCDP) for each flood area were evaluated and used to determine the CDF for the flood areas. Sixty-three flood areas have flooding CDFs below 1E-06 yr-1 , the only exceptions being Zone Three and Zone Four. Zone Three includes the ESF switchgear rooms in the control building and Enclosure 1 Page 5 of 11 the diesel generator rooms. Zone Three has a flooding CDF of 2.15E-6 yr-,. Zone Four includes the battery and charger rooms and has a flooding CDF of 1.37E-6 yr- .As provided in the response to question 2 above, the revised CCDF due to the ESW CT extension is 1.564E-4 yrf .Given the plant configuration during the ESW CT extension, only those flooding areas that could contribute a CDF of 1/10 or more of this value, i.e.approximately 1E-5 yr- , will be addressed for the application.

The biggest concern of the internal flooding risk for this application is that one ESW train was generally assumed to be the flooding source in the Callaway flooding analysis such that, if the other train of ESW is out of service for the extended CT, both trains of safety-related equipment will be failed. The turbine-driven auxiliary feedwater pump (TDAFP)would be the only source of decay heat removal and there would be no safety-related capability to make up to the RCS for a possible RCP seal LOCA (since the normal charging pump (NCP) is not in a flood-protected area, an RCP seal LOCA would occur due to the failure of CCW upon the failure of ESW). The CCDP of the flood areas with ESW as flooding source could now approach 1.0. The first cutoff for those flood areas that was used is whether the initiating frequency is greater than 1E-5 yr-. The second cutoff is whether ESW is part of the flooding source. There are sixteen such flood areas listed in Enclosure

3. The final screening process that was used was a determination of the contribution to the initiating event frequency and the flooding CDF due to ESW. The following eight flood areas are risk significant as a result of this process: A-2 (ECCS train A pump rooms Al 111-Al 114), A-4 (ECCS train B pump rooms Al 107-Al 110), A-24 and A-25 (2000' level piping penetration rooms A1323 and A1322 in the auxiliary building), ES-1 (ESW pumphouse train A, room U104), ES-2 (ESW pumphouse train B, room U105), UHS-l (UHS cooling tower north, rooms U301, U302, and U306), and UHS-2 (UHS cooling tower south, rooms U304, U305, and U307). In addition, flood area SIX-A (1974' and 1988' levels of the auxiliary building, no watertight rooms) has an ESW contributed flood frequency of 8.92E-06, which is close to the above screening threshold of 1E-05. For conservatism, flood area SIX-A is also considered to be a flood risk significant area.Consistent with prior commitments for this amendment application, with the intent of minimizing the flooding risk during the ESW Completion Time Extension, AmerenUE will institute flood watches on the protected ESW train as a compensatory measure. Prior to entering the extended ESW CTs, the Operations department will review the operational status of flood mitigation equipment to assure that important plant design features for mitigation of floods are available (drains, water-tight doors). During the 14-day CTs, one-hour flood watches will be posted for protected train equipment in the ECCS pump rooms (A-2 and A-4, auxiliary building rooms Al 107 through Al 114), piping penetration rooms (A-24 and A-25, auxiliary building rooms A1323 and A1322), ESW pumphouse rooms (ES-1 and ES-2, rooms U104 and U105), UHS cooling tower rooms (UHS-1 and UHS-2, rooms U301, U302, U304, U305, U306, and U307), and the 1974' and 1988',elevations of the auxiliary building (SIX-A, auxiliary building rooms Al101-A1106, A115-A1117, A1120-A1125, A1128-A1130, A1201, A1202, A1205, Enclosure 1 Page 6 of 11 and A1407). All other portions of the protected ESW train, except for the portion of the protected train inside containment or otherwise excluded by the Radiation Protection department, will be subject to flood watches on an 8-hour rotation.

With these compensatory measures, Callaway has high confidence that the elevated flood risk due to the extended ESW train outages will be effectively monitored and minimized for public safety and health protection.(c) The Callaway Plant used the NRC approved Fire Induced Vulnerability Evaluation (FIVE) to estimate the contribution of internal fire to the overall core damage frequency.

The plant was divided into 90 fire areas for the purpose of the FIVE study while a select number of fire areas were divided into fire compartments.

Although the FIVE definition of a fire area requires a two hour fire barrier, the Callaway analysis used three hour barriers to be consistent with 10 CFR 50 Appendix R requirements.

From the FIVE analysis, three fire areas and compartments exceed the FIVE Screening Threshold (1.OE-6) and thus constitute a fire vulnerability:

Fire Area C-27 (the Control Room, 2.65E-6 yr-1), Fire Area C-9 (safety-related AC switchgear room, 2.26E-6 yr-1), and Fire Area C-10 (safety-related AC switchgear room, 1.29E-6 yr-'). The severe accident management guidance (SAMG) efforts recommended by NEI 91-04 were developed to prevent and mitigate core damage and were sufficient to reduce the impact of a fire in these vulnerable areas.With the assumption that only the TDAFP is potentially available for decay heat removal and only the NCP (which is not dependent upon ESW or CCW) is potentially available for seal injection, the failure of either of them will result in core damage. The combined failure probability is on the order of 1E-2. Using the same guidance from the above flooding analysis, those fire areas and compartments with fire frequency greater than 1 E-3 will result a CDF of 1E-5 or greater and should be addressed for this application.

According to the Callaway FIVE analysis, there are 29 fire compartments whose fire frequencies are greater than 1E-3 as listed in Enclosure

3. To address the elevated fire risk due to the extended ESW CT, the fire compartments not related with ESW safety functions can be screened out. Fourteen fire compartments are "screened in" as fire risk significant for the application (which are indicated in bold in Enclosure 3): A-15 (TDAFP room, fire frequency 1.1 OE-3), A- 16 (CCW component rooms, fire frequency 1.70E-3), A- 17 (electrical penetration room B, fire frequency 1.90E-3), A- 18 (electrical penetration room A, fire frequency 1.20E-3), C-9 (ESF switchgear room 1, fire frequency 2.90E-3), C-10 (ESF switchgear room 2, fire frequency 3.20E-3), C-15 (battery and switchboard rooms train B, fire frequency 1.30E-03), C-16 (battery and switchboard rooms train A, fire frequency 2.60E-03), D-1 and D-2 (diesel generator building rooms, fire frequency 2.90E-2), ES-i and ES-2 (ESW pumphouse rooms, fire frequency 1.20E-3), and UHS-1 and UHS-2 (UHS cooling tower rooms, fire frequency 1.40E-3).

In addition, for conservatism, fire compartment A-1D (NCP pump room, fire frequency 8.50E-04) is also considered to be a fire risk significant area since it contains the Normal Charging Pump (used to establish the screening criteria above).

Enclosure 1 Page 7 of 11 Consistent with prior commitments for this amendment application, with the intent of minimizing the fire risk during the ESW CT extension, AmerenUE will institute fire watches on the protected ESW train as a compensatory measure. Prior to entering the extended ESW CTs, the Operations department will review the operational status of fire mitigation equipment to assure that important plant design features for mitigation of fires are available.

During the 14-day CTs, one-hour fire watches will be posted for protected train equipment in the TDAFP room (A-15, auxiliary building room A1331), CCW component rooms (A-16, auxiliary building rooms A1401, A1402, A1406, A1408), electrical penetration rooms (A-17 and A-18, auxiliary building rooms A1409 and A1410), ESF switchgear rooms (C-9 and C-10, control building rooms C3301 and C3302), battery and switchboard rooms (C-15 and C-16, control building rooms C3403-C3405, C3407-C341 1, C3413, and C3414), diesel generator rooms (D-1 and D-2, diesel generator building rooms D5201 and D5203), UHS cooling tower rooms (UHS-1 and UHS-2, rooms U301, U302, U304, U305, U306, and U307), ESW pumphouse rooms (ES-1 and ES-2, rooms U104 and U105), and NCP pump room (A-1D, auxiliary building room Al115). All other portions of the protected ESW train, except for the portion of the protected train inside containment or otherwise excluded by the Radiation Protection department, will be subject to fire watches on an 8-hour rotation.

With these compensatory measures, Callaway has high confidence that the elevated fire risk due to the extended ESW train outages will be effectively monitored and minimized for public safety and health protection.(d) The Callaway Plant's design conforms to the 1975 Standard Review Plan and no potential vulnerabilities from high winds and tornadoes, floods, and transportation and nearby facility accidents exist that have not been included in the original design basis analysis.All Seismic Category I structures including the ESW pumphouse and UHS cooling towers are designed to withstand the effects of a tornado and the most severe wind phenomena encountered.

Non-Category I structures are designed to preclude their collapse upon safety-related structures or components under loads imposed by the design basis tornado. Sufficient fill will be left on the protected train to provide protection against the design basis tornado.All Seismic Category I structures and the systems they house are designed to withstand the effects of natural phenomena, such as flooding and groundwater level. These structures are not protected above grade for flooding because there are no above-grade floods at the structure locations.

There are no hazards presented to the Callaway Plant either from barge traffic on the Missouri River or from the roads nearest the plant site. There are no aircraft hazards whose probability of occurrence is greater than 1 E-7 per year.There are no military bases, missile sites, or military firing ranges, manufacturing or chemical plants, pipelines or tank farms are located within 5 miles of the site. The Enclosure 1 Page 8 of 11 potential design basis accidents from nearby facility hazards have been evaluated and there are no onsite or offsite hazards which have an adverse effect on the plant structures.

Therefore, there are no elevated risks from high winds and tornadoes, floods, and transportation and nearby facility accidents that are significant for the extended ESW CTs.4. Question:

The NRC staff previously requested the licensee to address sources of uncertainty in the risk analyses which may be significant for this application.

In response, the licensee stated, without justification or basis, that the assumptions applied and the use of point estimates of mean values would not invalidate the risk analyses.

For the specific areas identified by the NRC staff as examples of key assumptions, the licensee identified the methodologies used in the risk analyses, but did not provide any assessment as to the impact of uncertainties associated with these assumptions on the application.

The purpose of this RAI was to request the licensee to review the important PRA assumptions and elements of the model which are especially relevant to the risk of the plant configuration with one service water header unavailable, to characterize the impact of these uncertainties, and to develop and present its basis as to why these sources of uncertainty do not adversely impact the results of the risk analyses relevant to the NRC staff decision to accept a 14-day extended CT. Please provide a more specific technical justification for your conclusions that the uncertainties do not affect the risk analyses.With regard specifically to equipment repair credit, please identify what equipment repairs are credited, the numerical value and basis for such credit, and the specific impact to the risk metrics for this application. (Note that the NRC staff position does not permit PRA credit for repair and restoration of any equipment subject to the extended CT to be used in the calculation of the risk metrics.)Response:

To identify sources of uncertainty that may be significant for the configuration that the Callaway Plant will operate in during the extended Completion Time, the re-generated core damage cutsets (refer to the response to question 2, above)were used to generate an Importance listing, in descending order of Risk Achievement Worth (RAW). Each PRA basic event having a RAW of> 2.0 was considered with regard to any uncertainty inherent in either the probability of, or PRA modeling related to, the event. The review was limited to uncertainty issues that could, in effect, increase the probability of the event, such that the risk metrics determined for this application would increase, potentially affecting the NRC staff's decision on this application.

Based on this review, the sources of uncertainty identified are listed in the table below, along with their associated impact on the core damage risk metrics for this application.

Enclosure 1 Page 9 of 11 Percentage Conditional Core Change in Damage Frequency ICCDP/ACDF (CCDF) With This' ICCDP With'lThis From the Values Potential Source of Uncertainty Applicable to Source of Source of' .ACbF With This, Reported in the this Application, and Corresponding Uncertainty Uncertainty , Sourc6 iof Uncertainty:

Response to RAJ, Sensitivity Addressed Addressed Addressed

1. 2 above Based on the compensatory measure of limiting access to and no work in the switchyard, and not entering the CT if inclement weather conditions are forecast, a 50 percent reduction in the switchyard and weather contributions to the LOOP frequency was credited.

If it is assumed 2.054E-04 6.255E-06 1.251 E-05 +43.0 that these measures are not effective, the LOOP frequency could be as high as the baseline value. As a sensitivity, the risk metrics were re-calculated with the LOOP frequency set to its baseline value.The baseline AC power recovery probabilities were not changed in the calculation of the risk metrics for this application.

Given the compensatory measures related to reducing LOOP risk via prohibiting switchyard access/work, it is possible that the mean LOOP 1.685E-04 4.841E-06 9.682E-06

+10.7 duration could increase, increasing the probability that AC power is not recovered within the various fixed timeframes of interest in the Callaway PRA model. As a sensitivity, the AC power failure-to-recover probabilities were increased by 25 percent.The Callaway PRA uses WCAP-10541, Rev. 2 for the RCP seal LOCA model. Later RCP seal LOCA models are available.

To address this 1.574E-04 4.416E-06 8.831 E-06 +0.9 source of uncertainty, the associated core uncovery probabilities, following loss of RCP seal cooling, were increased by 25 percent.To account for parametric uncertainty in the risk metric calculations performed for this application, an uncertainty analysis (using a Monte Carlo computational technique) was performed using Callaway's PRA workstation .software (WinNUJPRA).

The results of the uncertainty analysis are as follows:

Enclosure 1 Page 10 of 11 Confidence Conditional CDF 99.5 5.50E-004 99.0 4.93E-004 97.5 3.57E-004 95.0 2.82E-004 90.0 2.27E-004 80.0 1.80E-004 75.0 1.66E-004 70.0 1.54E-004 60.0 1.37E-004 50.0 1.22E-004 40.0 1.1OE-004 30.0 1.01E-004 25.0 9.54E-005 20.0 8.99E-005 10.0 7.79E-005 5.0 7.OOE-005 2.5 6.40E-005 1.0 5.77E-005 0.5 5.32E-005 Using the conditional CDF value for the 95 percent confidence level, the risk metrics of ICCDP and ACDF for this application are 9.19E-6 and 1.84E-5 yr-1, respectively.

Regarding equipment repair credit, no actual repair of mitigation equipment is credited in the Callaway PRA model. The results of the core damage re-solution, discussed in the response to question 2 above, were reviewed, and only one component recovery was noted, i.e., recovery of EFHV0059, a motor-operated valve that receives a close signal, on a safety injection signal (SIS) or loss of offsite power (LOOP) signal, to'prevent the"A" ESW train from running out. (Note that the "A" ESW train is the Operable ESW train in the risk calculation.

The "B" ESW train is the out-of-service train.) A scoping probability of 0.5 is used in the Callaway PRA for operator recovery (i.e., closure) of this valve, if it does not close automatically.

The RAW of this valve failure-to-reco'ver event, with the "B" ESW train out-of-service, is 1.00; thus, failure to recover this valve has no impact on the conditional CDF, or risk metrics (ICCDP, ACDF) determined therefrom.

No credit is given for repair or restoration of the ESW train assumed to be out of service (i.e., "B" train) for the extended Completion Time in either the loss of all service water initiating event frequency calculation, or for any accident sequence mitigation as modeled in the ESW fault trees. In the loss of all service water event tree quantification, service water recovery is questioned at two (2) and eight (8) hours after all service water (non-safety and essential service water) is lost. The service water recovery probabilities used in the Callaway PRA at two and eight hours were determined based on a review of the Enclosure 1 Page 11 of 11 loss of all service water initiator cutsets. In a small number of these cutsets, recovery of the "B" train of ESW is credited; however, other failures in these same cutsets would also be recoverable.

Therefore, the global service water (non-safety or ESW) recovery probabilities used in the loss of all service water event tree quantification for these timeframes would not appreciably change.A sensitivity evaluation was performed wherein the probabilities that hardware failures resulting in the loss of all service water are not recovered were set to 1.0. That is, no hardware failure recoveries, including those in the "B" ESW train, were credited.

The resulting conditional core damage frequency, with the "B" ESW train out of service, was determined to be 1.567E-4yr-1 which constitutes only a 0.19 percent increase in the conditional core damage frequency calculated for this application.

It may therefore be concluded that although recovery of the out-of-service ESW train is credited in the baseline calculation of the global service water recovery probabilities at two and eight hours following loss of all service water, removal of this credit, as demonstrated by the sensitivity evaluation, would not have an appreciable impact on the risk metrics determined for this application.

ULNRC-05500 May 6, 2008 Enclosure 2 ENCLOSURE 2 RG 1.200 GAP ASSESSMENT FINDINGS / OBSERVATIONS (F/Os)

Enclosure 2 Page 1 of 10 RG 1.200 GAP ASSESSMENT

-FINDINGS / OBSERVATIONS IE-6 B Open There was no evidence found that operating experience was reviewed with precursors in mind. If an event did not result in the generation of a trip or an LER, then it was not reviewed.

Interviews with operations and maintenance personnel would be one method to meet SR IE-A7. The current analysis does not meet Cat 2 SR IE-A7.Failure Modes and Effects Analyses (FMEAs) were used to determine the plant impact of failures for important support systems. Precursors found from operating experience should only confirm the results of the FMEAs (i.e., that failures of certain equipment can result in an initiator and failure of mitigating equipment), and should not change the results obtained from the FMEAs. The inclusion of precursor events could impact the initiating event frequencies for some non-support system initiators (e.g., reactor trip). However, it is unlikely there exist enough undiscovered precursors to significantly affect these frequencies.

The Callaway internal events and their frequencies were compared to those of the industry.

The results indicate no outliers for Callaway.

Therefore, this F/O should not impact the results of the PRA evaluation for the one-time-per-ESW-train Completion Time extension.

Uncertainty bounds on the IE frequencies do not impact the point estimates of CDF or LERF. Including The IE frequencies currently do not include any uncertainty uncertainty bounds on the IE frequencies would likely IE-7 B Opn bo.The IE frequencies centedo noto i eany uncertainty change an uncertainty analysis distribution.

However, it IE-7 B Open bounds. The IE frequencies need to have uncertainty is unlikely that such a change would preclude an bounds assigned to meet SR IE-C1, IE-Cla, and IE-C13. application.

Therefore, this F/O should not impact the results of the PRA evaluation for the one-time-per-ESW-train Completion Time extension.

Enclosure 2 Page 2 of 10 IE-8 B Open The Callaway PRA credits repair of hardware faults in the recovery of the loss of CCW and loss of SWS initiating events. The repair events, which include repair of CCF of pumps and valves, lack sufficient analysis or data. Crediting repair of components is not acceptable unless the probability of repair is justified through an adequate analysis or examination of data. The Callaway PRA does not meet SR IE-Clb, IE-C9, and SY-A22.This F/0 pertains to the methodology used in the determination of service water and component cooling water recovery probabilities, necessary for quantification of the loss of all service water and loss of component cooling water event trees, respectively.

For this application, only the F/O as it relates to service water would be germane. A sensitivity evaluation was performed, as discussed in the response to question 4, which showed that, even with no credit for recovery of hardware failures that result in the loss of all service water, there would be no appreciable impact on the risk metrics determined for this application.

Therefore, this F/O would not impact the results of the PRA evaluation for the one-time-per-ESW-train Completion Time extension.

The Callaway support system IE frequencies were compared to those of other WOG plants, using information in a WOG database, for an early Callaway There is no documentation of a comparison with generic PRA update. The frequencies were consistent.

In IE-12 B Open data sources for the support system initiating event fault tree addition, the cooling water support system initiators results. This comparison needs to be documented as part were compared to other WOG plants in WCAP-1 6464-of each update in order to meet SR IE-C10. NP, for MSPI purposes.

Callaway was not identified as an outlier. Therefore, this F/O would not impact the results of the PRA evaluation for the one-time-per-ESW-train Completion Time extension.

The Callaway treatment of ISLOCA addresses items a-d and may include item e but that is not clear. The ISLOCA In the Callaway PRA, an ISLOCA event is assumed to documentation is good for the evaluation of the high/low In coreCamage an LA early relase. No interfaces (ZZ-1 05) however the documentation of thereuticoedmganlreeryrlas.N IE-13 B Open iuanteifiacesn fZZr howevr thet dtocsmentmationofthe mitigation is credited.

Therefore, this F/O would not n quantification from that point on is minimal, is not impact the results of the PRA evaluation for the one-incorporated in the main model, and has not been revised or time-per-ESW-train Completion Time extension.

reexamined since the IPE submittal.

The ISLOCA model as it now stands does not meet SR IE-C12.

Enclosure 2 Page 3 of 10 AS-1 B Open Event Tree T(SW), function L2SW-M should evaluate the TDAFW pump with no functioning SW/ESW equipment.

The cutsets for this function include failures of the ESW pumps and human action failures for alignment of SW/ESW.Since the initiator fails all SW/ESW, the logic should not include these events. A similar situation exists for function L2Tls. Event Tree T(SW) function 01SW-M includes a FANDB operator error which does not belong in the function.A similar situation exists for functions 01C-M, 01CT1-M, and 01SW-M.Correction of these functions, which also addresses similar issues in F/Os AS-3, AS-7, SY-1, QU-3, and QU-4, would result in a small increase in the total baseline CDF (approx. 1%) for the Callaway PRA. However, the correction would actually reduce the CCDF for the PRA evaluation for the one-time-per-ESW-train Completion Time extension because of the elimination of the ESW dependency on these functions.

Therefore, these F/Os would not impact the results of the PRA evaluation for the one-time-Der-ESW-train Completion Time extension.

___ +AS-2 B Open Transfers between event trees may be used to reduce the size and complexity of individual event trees. DEFINE any transfers that are used and the method that is used to implement them in the qualitative definition of accident sequences and in their quantification.

USE a method for implementing an event tree transfer that preserves the dependencies that are part of the transferred sequence.These include functional, system, initiating event, operator, and spatial or environmental dependencies.

This requirement is not met. Many transfers such as seal LOCA and stuck open PORV transfer to a "psuedo event tree".These transfers are quantified using an OCL file that does not have a specific event tree. This introduces possibilities for error in the quantification since there is no event tree on which to base the evaluated functions, especially those that require preservation of dependencies.

The actual event tree for quantification of the RCP seal LOCA events was not found. An event tree Trcp appears to have been used, but this event tree has an event for recovery of CCW, which is not included in the .OCL files for the RCP seal LOCA events.This is a documentation issue. The transfer sequences have been extensively reviewed and no issues have been identified.

Therefore, this F/O would not impact the results of the PRA evaluation for the one-time-per-ESW-train Completion Time extension.

Enclosure 2 Page 4 of 10 AS-3 B Open The method of event tree analysis for support system initiators does not appear to correctly capture the failed dependencies in the mitigating systems for some support system IE's. A single basic event is used for the initiating event. House events are included in the fault trees to turn off the affected trains when a support system is not available.

It is not clear there are sufficient support systems modeled in the main feedwater and non-safety service water to fail these systems when their support systems are unavailable.

This may occur in Tsw, Tnk0l, and Tnk04. The cutsets for Tsw, Tnk0l, Tnk04, and Tccw should be checked to search for systems that would be failed by the loss of the initiator, and then modify the fault trees to include the appropriate house events to disable these systems.Reviews of the support system initiators reveals that this F/0 actually only pertains to T(SW). This issue was addressed in the response to F/O AS-i, above.The current Callaway PRA model utilizes the RCP seal LOCA model of WCAP-10541, in which the 21 gpm/pump seal LOCA has a probability of occurrence of AS-4 B Open The RCP seal LOCA model needs to be updated to reflect approximately 90%. The WOG2000 RCP seal LOCA the latest WOG model, which is approved by the NRC. model (documented in WCAP-1 5603), uses a probability of approximately 80% for the 21 gpm/pump seal LOCA.A sensitivity analysis, related to seal LOCA, is provided in the response to RAI #4 in ULNRC-05500 Enclosure 1.Elimination of these sequences would result in a small The MAAP results indicate there are*60 hours before core melt for the SGTR sequence with failure to isolate the SG. If reduction in the CCDF results (approx. 1%) for the PRA evaluation for the one-time-per-ESW-train Completion AS-6 B Open the MAAP analysis is correct, or the 3 Time extension.

Retaining these sequences in the screened.

If the MAAP analysis is not correct, or MAAP 3 results is slightly conservative.

Therefore, this F/O can not provide a correct representation of the sequence, would not impact the results of the PRA evaluation for MAAP 4 should be used. the one-time-per-ESW-train Completion Time extension.

Enclosure 2 Page 5 of 10 AS-7 I B Open Specific errors are as noted below: Function O1T1S in the SBO event tree contains basic events for MFW and SW as a backup source for water to SGs if the TDP fails. The problem occurs in the SECDEP fault tree, which asks for GMFX100, but does not have any logic to cancel the gate in SBO. There are no events in the MFX fault tree which will cancel it in the event of an SBO, either. Also, in MFW.lgc, gate GMFW413 -the SVC system will be failed by LOSP, but comes through the link in the SBO function.

Back-up sources of water to the SG are modeled at a high level, often only represented by an HEP. There needs to be either a) support systems developed which will be failed by LOSP or AC power, or b) house event logic to fail these for SBO.The AFW function on the TSW event tree -(L2SW-M) -has recovery factors for ESW as a suction source to the turbine driven AFW pump. (AL-XHE-FO-AFWESW).

ESW is failed by the initiator, but the IE is a basic event, not cutsets.Need to represent the initiator as a support system fault tree, OR need to include house events in the AFW function to fail the cross-tie to the ESW system after a Loss of ESW.In TSW event tree, function 01 SW-M has an event (AE-XHE-FO-MFWFLO) for failure of MFW as back up to AFW.MFW is unavailable after loss of SW. Need to include support systems for MFW or insert house events in fault tree to turn off MFW for loss of TSW.This issue was addressed in the response to F/O AS-i, above.

Enclosure 2 Page 6 of 10 SY-1 B Open For the Instrument Air System a single basic event is used and is based on generic data. The Callaway plant is not highly dependent upon IAS and the PRA loads on IAS also are supplied with N2 backup which is modeled. Modeling the IAS as a single basic is acceptable however, the MFW dependency on the IAS is not modeled and needs to be included since MFW is credited as a backup to AFW and is important.

The actuation system is modeled with a single event for each of the redundancies which is set to fail for scenarios in which the conditions are not present to generate the signal. The level of detail is acceptable for this use. The dependency of MFW on IAS needs to be included and the data associated with these single event failures need to be reviewed against current industry data and updated if necessary.

The applicability of the data to the Callaway configuration also needs to be justified.

One such source of data is NUREG/CR-5750.

The IAS consists of three compressors, two of which are cooled by ESW and one that is cooled by NSW. Parts of the MFW system and the condensate system are dependent on IAS. MFW and lAS are part of the modeled PRA function to cooldown and depressurize the RCS. This action occurs with successful secondary side cooling but failed primary high head injection for events with a primary leak. This dependency between ESW/NSW, IAS, and MFW has an insignificant affect on the PRA results, except for the T(SW) event. For this event, this issue was addressed in the response to F/O AS-i, above. Note that safety-related components using instrument air also have safety-related nitrogen accumulators to support their operation.

.+ + +SY-2 I B Open The Callaway PRA adequately models CCFs with the exception of battery chargers and breakers as noted in SR SY-B1 and B3. The quantification of all CCFs should be updated. CCFs should be added for Battery Chargers and Breakers.

The quantification of the CCFs should be done in accordance with NUREG/CR-5485.

The Battery Charger basic events are not risk significant in the Callaway PRA model. A Battery Charger CCF basic event is not expected to be risk significant.

Many of the breaker basic events are risk significant, so a breaker CCF basic event would also be expected to be risk significant and would probably slightly increase the baseline total CDF. However, because one train of ESW is assumed to be out of service for the PRA evaluation for the one-time-per-ESW-train Completion Time extension, CCF of the breakers between trains would not exist in the cutset solution.

CCF of the breakers in the same train would exist in the cutset solution.

However, the impact of such a CCF is essentially covered by the failure of the electrical bus.Therefore, this F/O should not impact the results of the PRA evaluation for the one-time-per-ESW-train Completion Time extension.

Enclosure 2 Page 7 of 10 DA-2 B Open Group estimations are based only on component type.Capability Category II requires grouping of components according to type (e.g., motor-operated pump, air-operated valve) and according to the characteristics of their usage to the extent supported by data: (a) mission type (e.g., standby, operating) (b) service condition (e.g., clean vs.untreated water, air) The level of grouping used in the latest data update uses a very fine grouping which leads to a smaller data pool for each different component.

Consideration should be given to collecting data on as large a group of components as possible to establish a meaningful collection of data. Grouping of the components as defined in SR DA-B1 and DA-B2 provides a more reasonable aggregation of data and results in a larger data pool to characterize the failure data.This finding relates to the fact that the original Callaway PRA grouped components only by type for parameter estimation (i.e., Capability Category I), and the data update, which updated failure rate data for the risk-significant components, used a very fine grouping (e.g., the two RHR pumps were a component group). The finding suggests that consideration be given to increasing the group size for plant-specific data collection.

To demonstrate that this finding would not have a significant impact on the risk metric results reported for this application, a sensitivity evaluation was performed.

The sensitivity evaluation increased basic event failure probabilities by 25 percent for the highest risk achievement worth (RAW) components for the configuration that the plant intends to operate in during the extended ESW Completion time, and for which the"fine" component grouping was used for plant-specific data collection.

The result of this evaluation showed that the conditional core damage frequency for the plant configuration in question increased by only 3.25 percent.Thus, while this finding represents a PRA model improvement opportunity, it does not represent an issue that would significantly impact the risk results reported for this application.

This requirement is not met at any Category.

The CaItegory Flooding was addressed explicitly in the one-time-per-y ESW-train Completion Time extension compensatory IF-2 B Open 1/11 screening quantitative criteria in the standard is 1 E-09/yar.ZZ-66 crenin crieri wa 1 -06yr.actions that have been delineated to reduce the 09/year. ZZ-466 screening criteria was 1 E-06/yr. possibility of flooding-induced core damage.If additional human failure events are required to support quantification of flood scenarios, PERFORM any human Flooding was addressed explicitly in the one-time-per-reliability analysis in accordance with the applicable ESW-train Completion Time extension compensatory IF-4 B Open requirements described in Tables 4.5.5-2(e) through Table actions that have been delineated to reduce the 4.5.5-2(h).

This requirement is not met. The HEP values used in ZZ-466 are not developed from a human reliability possibility of flooding-induced core damage.analysis.

Enclosure 2 Page 8 of 10 For each defined flood area and each flood source, Flooding was addressed explicitly in the one-time-per-IDENTIFY those automatic or operator responses that have ESW-train Completion Time extension compensatory IF-5 B Open the ability to terminate or contain the flood propagation.

actions that have been delineated to reduce the This requirement is not met. ZZ-466 treats operator possibility of flooding-induced core damage.response in a generic sense.For each flood scenario, REVIEW the LERF analysis to confirm applicability of the LERF sequences.

If appropriate LERF sequences do not exist, MODIFY the LERF analysis Flooding was addressed explicitly in the one-time-per-IF-6 B Open as necessary to account for any unique flood-induced ESW-train Completion Time extension compensatory scenarios or phenomena in accordance with the applicable actions that have been delineated to reduce the requirements described in para. 4.5.9. This requirement is possibility of flooding-induced core damage.not met. The internal flooding sequences are not considered in the LERF analysis.The "state-of-knowledge" correlation generally pertains to the data applied to equipment across trains. For example, an SBO cutset may contain the failure of the"A" and "B" EDGs. The failure data for both EDGs most likely is based on the same source of information.

The current quantification does not include an uncertainty Therefore, any uncertainty analysis should vary the calculation to account for the "state-of-knowledge" failure data for these components in the same manner QU-1 B Open correlation between event probabilities.

The structure exists (i.e., the data is not independent).

For the one-time-per-to perform this correlation within WinNUPRA but at the ESW-train Completion Time extension, one train of current time it has not been done. equipment will be out of service. Except in some minor circumstances (e.g., cutsets in which multiple breakers, in the same train, fail), the "state-of-knowledge" correlation does not apply. Therefore, this F/O should not impact the results of the PRA evaluation for the one-time-per-ESW-train Completion Time extension.

Some instances of incorrect transfer of sequence characteristics, incorrect logic, incorrect house event settings, and resultant cutsets were identified based on cutset reviews. The process is generally set up correctly but QU-3 B Open the overall process would benefit from revising the above.quantification process to account for the additional software capability currently available.

As a minimum, the top cutsets (500) need to be reviewed to make sure that the transfers, logic, house event setting are yielding realistic combinations.

Enclosure 2 Page 9 of 10 The IAS is correctly failed for LOSP, but remains available in all other cases. The IAS is cooled by SW and would be B Open unavailable after loss of all SW (T(SW)) and should be set to This issue was addressed in the response to F/O AS-i, QU-4 failed via a house event setting. The availability of IAS above.needs to be propagated correctly during the quantification process.In general the model integration process is adequately documented, however several of the areas do not meet the requirements.

Items b (records of the cutset review process), f (the accident sequences and their contributing This is a documentation issue. For the PRA evaluation cutsets), g (equipment or human actions that are the key for the one-time-per-ESW-train Completion Time B Open factors in causing the accidents to be non-dominant), and i extension application, accident sequences and cutsets QU-9 B pn (the uncertainty distribution for the total CDF) are notexnsoaplctncidtsqucsadctes adseithe uncertaintydocumentation.

Asfami thestotre nwere reviewed, and an uncertainty analysis is provided iesnetobaddressed inthedocumenation.

mt SR Qm these in the response to RAI #4 in ULNRC-05500 Enclosure 1.items need to be addressed to meet SIR QU-F2. If the quantification process and documentation are revised the list of information included in SR QU-F2 should be followed in the revision.QU- Key assumptions and key sources of uncertainty which This is a documentation issue. An uncertainty analysis 10 B Open influence the current quantification are not addressed in a is provided in the response to RAI #4 in ULNRC-05500 coherent manner in the documentation.

Enclosure 1.The quantitative definition used for significant cutset and significant accident sequence are documented and vary from the ASME definition.

The ASME definitions need to be applied or the Ameren definition needs to be justified.

QU- B Open Significant sequence:

ASME -aggregate 95% of total, This issue is has no impact on the one-time-per-ESW-11 individual sequence >1% Ameren -aggregate 88% of total, train Completion Time extension evaluation.

individual sequence >1% Significant cutset: ASME -aggregate 95% of total, individual cutset >1% Ameren -cutsets >1 E-6 Enclosure 2 Page 10 of 10 Probability of containment isolation failure leading to LERF does not contain a term to represent undetected, residual failures in containment structural integrity.

This has been Split fractions for SGTR and HPME were included in the estimated at 5E-3 in NUREG/CR-4550.

Failure of LERF analysis.

An undetected, residual failure to the containment isolation is derived by fault tree analysis of the containment would not be impacted by the one-time-per-LE-1 B Open containment isolation combinations on the penetration ESW-train Completion Time extension.

Therefore, this paths. There are three LERF split fractions with probabilities F/O would not impact the results of the PRA evaluation of 7.7E-4. If the 5E-3 was added to this, the split fraction for the one-time-per-ESW-train Completion Time would change, although LERF would not move significantly.

extension.

Split fractions for induced SGTR and HPME were not explicitly stated in the documentation available for review.The Level 2 analysis does not include uncertainty analysis nor are there sensitivity studies identified to examine the Core damage is the limiting risk metric for the one-time-LE-2 Open significant contributors to LERF. As a minimum, the per-ESW-train Completion Time extension application.

Uncertainty in the Level 1 sequences should be propagated Core damage uncertainty analysis is provided in the and sensitivity studies developed and evaluated for the response to RAI #4 in ULNRC-05500 Enclosure 1.important LERF scenarios.

ULNRC-05500 May 6, 2008 Enclosure 3 ENCLOSURE 3 RISK-SIGNIFICANT INTERNAL FLOODING AND FIRE AREAS / ROOMS Enclosure 3 Page 1 of 4 RISK SIGNIFICANT FIRE AREAS / ROOMS FOR ESW CT EXTENSION Fire Description Room Fire Fre 9 uency Compartment (yr-')A-1A Auxiliary Building 1974' CVCS, AFW 2.10E-03 A-1D NCP Room A1115 8.50E-04 A-2 ECCS A Pump Room 2.60E-03 A-3 Boric Acid Tank Rooms 1.40E-03 A-4 ECCS B Pump Room 2..80E-03 A-7 Boron Injection Tank and Pump Room 1.OOE-03 A-15 TDAFW Pump Room Al 331 1.10E-03 A-16 CCW Components Rooms A1401, A1402, A1406, 1.70E-03 Al 408 1.70E-03 A-17 Electrical Penetration Room B A1409 1.90E-03 A-18 Electrical Penetration Room A A1410 1.20E-03 A-20 CCW Surge Tank 2.30E-03 A-22 Control Room A/C 1.40E-03 A-27 Reactor Trip Switchgear Room 2.90E-03 C-6 HP Access Area 5.00E-03 C-9 ESF Switchgear Room 1 C3301 2.90E-03 C-10 ESF Switchgear Room 2 C3302 3.20E-03 C-1 3 Access Control 1.20E-03 C-14 Access Control 1.30E-03 C-15 Battery and Switchboard Rooms B C3403-3405, 3410, 3411 1.30E-03 C-16 Battery and Switchboard Rooms A C3407-3409, 3413, 3414 2.60E-03 Enclosure 3 Page 2 of 4 RISK SIGNIFICANT FIRE AREAS / ROOMS FOR ESW CT EXTENSION Fire Fire Frequency Compartment Description Room(yr CS CW/SW Pump House 1.00E-03 TB-1 Turbine Building and Communications Corridor 4.40E-02 Rooms D-1 Diesel Generator Building, East D5203 2.90E-02 D-2 Diesel Generator Building, West D5201 2.90E-02 ES-1 ESW Train A Pumphouse U104 1.20E-03 ES-2 ESW Train B Pumphouse U105 1.20E-03 UHS-1 UHS Cooling Tower, North U301, U302, U306 1.40E-03 UHS-2 UHS Cooling Tower, South U304, U305, U307 1.40E-03 MXTR Phase A,B,C Transformer and Auxiliary 2.40E-03 Transformer TBXTR Turbine Building Transformers 1.20E-03 Enclosure 3 Page 3 of 4 RISK SIGNIFICANT INTERNAL FLOODING AREAS / ROOMS FOR ESW CT EXTENSION Flood Source Flood ESW Flood Area including Description Room Frequency Contribution ESW (yr") (yr1)A-2 ESW ECCS Train A Pump A1111- 2.65E-05 2.65E-05 Rooms A1114 ECCS Train B Pump A1107- 2.65E-05 2.65E-05 Rooms A1110 A-13 ESW 1.63E-04 2.46E-06 A-14 ESW 1.42E-04 2.46E-06 A-22 ESW 1.01 E-05 3.08E-06 A-24 ESW North Pipe Penetration A1323 5.96E-05 1.10E-05 Room A-25 ESW South Pipe Penetration A1322 6.37E-04 1.10E-05 Room C-14 ESW 2.34E-05 2.46E-06 D-1 ESW 2.85E-05 6.09E-06 D-2 ESW 3.19E-05 6.09E-06 ES-1 ESW ESW Pumphouse Train A U104 3.30E-03 3.30E-03 ES-2 ESW ESW Pumphouse Train B U105 3.30E-03 3.30E-03 Enclosure 3 Page 4 of 4 RISK SIGNIFICANT INTERNAL FLOODING AREAS I ROOMS FOR ESW CT EXTENSION Flood Source Flood ESW Flood Area including Description Room Frequency Contribution ESW (yr"') (yr" 1)A1101-A1106, A1115-A1117, 1974' and 1988' A1120-A1125, SIX-A ESW levels of Auxiliary A1128-A1130, 1.70E-05 8.92E-06 Building A1201, A1202, A1205, A1407 TWO ESW 2.03E-05 7.95E-06 UHS-1 ESW UHS Cooling Tower U301, U302, 1.16E-02 1.1 6E-02 North U306 UHS-2 ESW UHS Cooling Tower U304, U305, 1.16E-02 1.1 6E-02 South U307 I ULNRC-05500 May 6, 2008 Enclosure 4 ENCLOSURE 4

SUMMARY

OF REGULATORY COMMITMENTS Enclosure 4 Page 1 of 4

SUMMARY

OF REGULATORY COMMITMENTS The following table identifies those actions committed to by AmerenUE in this document.

Any other statements in this submittal are provided for information purposes and are not considered to be commitments.

Please direct questions regarding these commitments to Mr. Scott Maglio, Assistant Manager -Regulatory Affairs, (573) 676-8719.COMMITMENT Due Date/Event The proposed changes to the Callaway Technical Specifications Prior to December 3, 2008.will be implemented prior to December 3, 2008.No PRA-modeled equipment, other than the affected ESW Administrative controls in place train and supported systems rendered inoperable by that ESW at time amendment is train being out of service, will be voluntarily taken out-of- implemented.

This is a Tier 2 service during the one-time extended Completion Time taken commitment.

See footnote 1.on each train. This commitment applies only to PRA-modeled equipment in the protected ESF train (ESF train not served by the inoperable ESW train). No work will be allowed on the protected (operable)

ESW train. No work will be allowed in the area of equipment in the protected ESF train (within 20 feet unless there is an intervening barrier) except for yard piping work and work in control building room 3101 where the underground piping enters the control building.Access to the switchyard will be limited to personnel with a Administrative controls in place demonstrable need (e.g., staff associated with the temporary at time amendment is DGs) and no work will be allowed in the switchyard that could implemented.

This is a Tier 2 cause a loss of offsite power (LOOP) event during the one-time commitment.

See footnote 2.extended Completion Time.The one-time extended Completion Time will not be entered if, Administrative controls in place prior to entry, inclement weather conditions are forecasted, i.e., at time amendment is work under the extended Completion Time will not be started if implemented.

This is a Tier 2 Severe Weather as defined in OTO-ZZ-00012 is forecasted to commitment.

See footnote 3.occur within 140 miles of the plant. National Weather Service reports will be monitored prior to and throughout each ESW train LCO outage.

Enclosure 4 Page 2 of 4 From EDP-ZZ-01 129 Appendix 2 for a DG or ESW outage, the following Tier 2 commitments are also added to the scope of this amendment request:* The turbine-driven auxiliary feedwater pump (TDAFP) will remain Operable.* The TDAFP pump room and associated valve rooms will be posted as restricted access.* The protected train motor-driven auxiliary feedwater pump (MDAFP) pump room and associated valve rooms will be posted as restricted access.* The condensate storage tank (CST) will be posted as restricted access.* No work will be allowed on the Security Diesel.Administrative controls in place at time amendment is implemented.

This is a Tier 2 commitment.

See footnote 4.The one-time extended Completion Time will be used such that the piping tie-in (new underground PE ESW piping to the rest of the system) will be performed with the normal service water system cooling the affected ESW train heat loads for as much of the 14-day Completion Time as possible.

However, this cooling of heat loads by the normal service water system may be unavailable for the entire one-time Completion Time extension.

During the portion of the extended Completion Time that normal service water is supplying the ESW loads, the normal service water to ESW supply and return cross-connect valves will be opened and power removed from the operators.

The ESW return to UHS valves will be closed and power removed from the operators during this portion of the extended Completion Time as well.Administrative controls in place at time amendment is implemented.

This is a Tier 2 commitment.

See footnote 5.

Enclosure 4 Page 3 of 4 Prior to entering the extended ESW Completion Times, the Operations department will review the operational status of fire protection (operability requirements are spelled out in FSAR Section 9.5.1.7) and flood mitigation (drains, watertight doors)equipment to assure that important plant design features, for mitigation of fires or floods that could impact the protected train, are available.

In addition, prior to entering the extended ESW CTs, a walkdown of the above ground portion of the protected ESW train will be performed for transient combustibles, except for the portion of the protected train inside containment or otherwise excluded by the Radiation Protection department.

This walkdown will also address the commitments made in response to RAI 3.(a) in ULNRC-05500.

Administrative controls in place at time amendment is implemented.

This is a Tier 2 commitment.

See footnote 6.One-hour and eight-hour fire and flood watches will be Administrative controls in place instituted on the protected ESW train as discussed in the at time amendment is response to RAI s 3.b and 3.c in ULNRC-05500.

The NCP implemented.

This is a Tier 2 will remain functional and its room will be posted as restricted commitment.

See footnote 6.access.Appropriate training will be provided to operations personnel Administrative controls in place on this TS change and the associated ESW modification, as at time amendment is well as the compensatory measures to be implemented during implemented.

This is a Tier 2 the one-time extended Completion Time. commitment.

See footnote 7.A temporary alternate power source consisting of diesel Equipment and administrative generators, with combined capacity equal to or greater than the controls in place at time capacity of either one of the installed emergency DGs, will be amendment is implemented.

This available as a backup power source. This temporary alternate is a Tier 2 commitment.

See AC source could power protected train loads in the unlikely footnote 8.event a loss of offsite power event occurred and the protected train's DG failed to start and run. Prior to the extended CT these temporary diesel generators will be load tested to provide a load equal to the continuous rating of the inoperable DG.After entering the extended CT, this source will be verified available every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and treated as protected equipment.

I 1. This commitment was originally discussed in ULNRC-05445 Attachment 1 (pages 13-14), then revised in the responses to RAI #4 and RAI #6.a in ULNRC-05476.

2. This commitment was originally discussed in ULNRC-05445 Attachment 1 (pages 13-14). LOOP frequency adjustments were discussed in the response to RAI #6.b in ULNRC-05476.

Temporary DGs as an alternate AC power source are discussed in the response to RAI #2.b in Enclosure 1 of ULNRC-05482.

3. This commitment was originally discussed in ULNRC-05445 Attachment 1 (pages 13-14). Severe Weather was defined in the response to RAI #6.d in ULNRC-05476.

Enclosure 4 Page 4 of 4 4. This commitment was originally discussed in the response to RAI #4 in ULNRC-05476.5. This commitment was originally discussed in ULNRC-05445 Attachment 1 (pages 6, 7, 13-14), then revised in the response to RAI #7.a in ULNRC-05476.

When the 'A' ESW train is out-of-service (OOS), valves EFHV0023, EFHV0025, EFHV0039, and EFHV0041 will be opened and power removed from the valve operators.

EFHV0037 (return to UHS) will be closed and power removed from the valve operator.When the 'B' ESW train is OOS, valves EFHV0024, EFHV0026, EFHV0040, and EFHV0042 will be opened and power removed from the valve operators.

EFHV0038 (return to UHS) will be closed and power removed from the valve operator.6. This commitment was originally discussed in the response to RAI #4 in ULNRC-05476. Additional clarification was provided in that RAI response with respect to fire and flood watches and walkdowns for transient combustibles to be performed prior to using the extended CT. This commitment is revised by the responses to RAIs 3.(a), 3.(b), and 3.(c) in Enclosure 1 of ULNRC-5500.

The pre-use walkdown will also assure there are no obvious mounting or seismic interaction issues (e.g., loose parts, missing hardware, etc.) for the following equipment:

ultimate heat sink (UHS) cooling tower fans and motor control centers, ESW self-cleaning strainers, diesel generator (D/G) intake Air Filters, and D/G intercooler heat exchangers.

Control building room 3101 is moved from the 1-hour fire and flood watch list to the 8-hour fire and flood watch list; however, the following rooms and buildings will now be subject to the 1-hour fire and flood watches when equipment in these locations is in the protected train:* Auxiliary building rooms 1101 through 1117, 1120 through 1125, 1128-1130, 1201, 1202, 1205, 1322, 1323, 1331, 1401, 1402, 1406, 1407, 1408, 1409, and 1410" Control building rooms 3301, 3302, 3403 through 3405, 3407 through 3411, 3413, and 3414* Diesel generator building rooms 5201 and 5203* ESW pumphouse rooms U104 and U105* UHS cooling tower rooms U301, U302, U304, U305, U306, and U307 All other portions of the protected ESW train will be subject to 8-hour fire and flood watches.7. This commitment was originally discussed in ULNRC-05445 Attachment 1 (page 13).8. Temporary DGs as an alternate AC power source are discussed in the response to RAI#2.b in Enclosure 1 of ULNRC-05482.