ML21294A401
| ML21294A401 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 10/21/2021 |
| From: | Ameren Missouri, Union Electric Co |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML21294A393 | List:
|
| References | |
| ULNRC-06688 | |
| Download: ML21294A401 (36) | |
Text
ENCLOSURE 1 License Amendment Request Callaway Unit No. 1 Renewed Facility Operating License NPF-30 NRC Docket No. 50-483 Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" List of Revised Required Actions to Corresponding PRA Functions E1-1
1.0 INTRODUCTION
The purpose of this enclosure is to provide a mapping of identified in-scope Technical Specifications (TSs) statements to modeled (and surrogate) Probabilistic Risk Assessment (PRA) functions. This mapping provides the basis by which to quantify the increase in risk associated with extending the Completion Time for a given TS Action and to calculate a Risk-Informed Completion Time (RICT) for the RICT Program application.
Section 4.0, Item 2 of the U.S. Nuclear Regulatory Commission (NRC) Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) identifies the following necessary content:
The license amendment request (LAR) will provide identification of the TS Limiting Conditions for Operation (LCOs) and Required Actions to which the RMTS (or RICT for TSTF-505) will apply.
The LAR will provide a comparison of the TS functions to the PRA modeled functions of the structures, systems and components (SSCs) subject to those LCO actions.
The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions (i.e., 10 CFR 50.46 emergency core cooling system (ECCS) flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.
This enclosure provides confirmation that Callaway Plant, Unit No. 1 PRA models include the necessary scope of SSCs and their functions to address each proposed application of the RICT Program to the proposed scope of TS LCOs. The enclosure also provides the information requested by Section 4.0, Item 2 of Reference 1. The comparison includes each of the TS LCOs and associated Required Actions within the scope of the RICT Program. The Callaway PRA model has the capability to model directly, or using a bounding surrogate, the risk impact of entering each of the Actions associated with the TS LCOs that are in the scope of the RICT Program.
Table E1-1 below lists each TS LCO Condition to which the RICT Program is proposed to be applied and documents the following information regarding the TSs with the associated safety analyses, the analogous PRA functions and the results of the comparison:
Column Tech Spec
Description:
Lists all of the LCOs and condition statements within the scope of the RICT Program.
Column SSCs Covered by TS LCO Condition: The SSCs addressed by each action requirement.
Column Modeled in PRA?: Indicates whether the SSCs addressed by the TS LCO Condition are included in the PRA.
Column Function Covered by TS LCO Condition: A summary of the required functions from the design basis analyses.
E1-1
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Column Design Success Criteria: A summary of the success criteria from the design basis analyses.
Column PRA Success Criteria: The function success criteria modeled in the PRA.
Column Comments: Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09-A, Revision 0-A.
The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA models. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program (CRMP) tool for the RICT Program. Differences in success criteria typically arise due to the requirement in the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) PRA Standard to make PRAs realistic rather than bounding, whereas design basis criteria are necessarily conservative and bounding.
The use of realistic success criteria is necessary to conform to Capability Category II of the ASME/ANS PRA Standard as required by NEI 06-09-A (Reference 2).
Examples of calculated RICTs are provided in Table E1-2 for each individual Action to which the RICT Program is proposed to apply. These calculations assume the SSC in question is the only SSC out-of-service, and thus the values in Table E1-2 are representative examples only.
Following RICT Program implementation, RICT calculations will be based upon the actual real-time maintenance configuration of the plant and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09-A (Reference 2) and the NRC Safety Evaluation. Thus, in practice, RICT values may differ from the RICTs presented in Table E1-2.
For the purposes of the following information, the terms subsystem, train, and division are all considered interchangeable.
E1-2
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.3.1.B One Manual Two manual Reactor Trip Yes Reactor Trip One of two reactor Same 1 of 2 reactor trip switches used Reactor Trip Channels Initiation trip channels as surrogate for the channel channel inoperable. (Note 4) 3.3.1.D One Power Range Four Power Range Not Reactor Trip Two of four channels Same The function One Power Range Neutron Flux-High Neutron Flux-High explicitly Initiation Neutron Flux-High is not channel inoperable. sensors explicitly modeled in the PRA, one of the 2 reactor trip breakers will be used as a conservative surrogate in the RICT calculation.
(Notes 1 and 2) 3.3.1.E One channel Power Range Neutron Partially Reactor Trip Power Range Same The functions Power Range inoperable. Flux Rate - High Positive Initiation Neutron Flux Rate - Neutron Flux-High Positive Rate, Overtemperature High Positive Rate, 2 Rate, Overtemperature T, T, Overpower T. of 4 channels [2 Overpower T are not explicitly Pressurizer Pressure - seconds] modeled in PRA, one of the 2 High, SG Water Level Overtemperature T, reactor trip breakers will be Low-Low (Adverse and 2 of 4 channels used as a conservative Normal Containment Overpower T, 2 of 4 surrogate in the RICT Environment) channels calculation. Pressurizer Pressure and SG level are Pressurizer Pressure explicitly modeled.
- High, 2 of 4 channels (Notes 1 and 2)
SG Water Level Low-Low (Adverse and Normal Containment Environment) , 2 of 4 channels on 1 of 4 generators E1-3
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.3.1.K One channel RCPs (Undervoltage, Partially Reactor Trip RCP'UV/UFs,1 of 2 Same The functions RCP'UV/UFs, inoperable. Underfrequency) (per Initiation channels on 2 of 2 Pressurizer Water Level - High, bus), busses. RCS Flow- Low are not Pressurizer (Pressure Pressurizer Pressure explicitly modeled in the PRA,.,
Low, Water Level-High), Low, 2 of 4; one of the 2 reactor trip breakers will be used as a Reactor Coolant Flow- Pressurizer Water conservative surrogate in the Low (per loop) Level - High 2 of 3, RICT calculation. Pressurizer RCS Flow-Low 2 of pressure channels are explicitly 3 per loop modelled.
(Notes 1 and 2) 3.3.1.M One Low Fluid Oil Turbine Emergency Trip Not Reactor Trip Two of Three 1 of 2 for reactor The function Trip Turbine Pressure Turbine System (ETS) (three explicitly Initiation Electro-Hydraulic trip breakers Emergency Trip System is not Trip channel sensors) (EH) Fluid Pressure explicitly modeled in the PRA, inoperable switches one of the 2 reactor trip breakers will be used as a conservative surrogate in the RICT calculation.
(Notes 1 and 2) 3.3.1.P One train SI Input from ESFAS, Not Reactor Trip One of two trains 1 of 2 for The function SI Input from inoperable. Automatic Trip logic explicitly Initiation automatic trip ESFAS, Automatic Trip logic is signals (manual not explicitly modeled in the trip also credited) PRA, 1 of 2 modeled auto trip signals will be used as a conservative surrogate in the RICT calculation. (Note 3) 3.3.1.Q One RTB train Reactor Trip Breakers Yes Reactor Trip One of two RTBs Same (Note 5) inoperable. and Bypass Breakers Initiation open 3.3.1.U One trip RTB Undervoltage and Yes Reactor Trip One trip mechanism Same (Notes 3 and 4) mechanism Shunt Trip Mechanisms Initiation inoperable for one RTB.
E1-4
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.3.2.B One channel or Manual Initiation (Safety Partially ESF Actuation SI Function: Same Manual trip hand switches for SI train inoperable. Injection, Containment One of two SI and CIS-A are explicitly Spray, Containment Manual Initiation modeled. CS/CIS-B Function is Isolation (Phase A and B channels not explicitly modeled in the Isolation)) PRA. Hydraulic analysis has CS/CIS-B Function: been performed to show that Two of two CS success or failure of CS does Manual Initiation not impact which sequences channels contribute to LERF. CIS-B CIS-A Function: isolates the component cooling water system (CCW) to the One of two CIS-A components located within the Manual Initiation containment. CCW is a channels seismically designed closed loop system both inside and outside of the containment.
Penetrations associated with CCW (and therefore associated with CIS-B) have been screened from the PRA.
(Notes 1 and 2)
E1-5
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.3.2.C One train Automatic Actuation Partially ESF Actuation One of two trains Same Auto-signals for SI, switchover, inoperable. Logic and Actuation and CIS-A are explicitly Relays (Safety Injection, modeled. The functions Containment Spray, Containment Spray and Containment lsolation Containment Isolation - Phase (Phase A and B), B Isolation are not explicitly Automatic Switchover to modeled in PRA. Hydraulic Containment Sump) analysis has been performed to show that success or failure of CS does not impact which sequences contribute to LERF.
CIS-B isolates the component cooling water system (CCW) to the components located within the containment. CCW is a seismically designed closed loop system both inside and outside of the containment.
Penetrations associated with CCW (and therefore associated with CIS-B) have been screened from the PRA.
(Notes 1 and 2)
E1-6
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions 3.3.2.D One channel SI (Containment Partially ESF Actuation, SI (Containment Same Signals for containment inoperable. Pressure - High 1, Main Steam Pressure-High 1): 2 pressure high 1 & 2, pressurizer Pressurizer Pressure - Line Isolation of 3 (PZR Pressure pressure low, steamline Low, Steam Line Signal, Low): 2 of 4 (Steam pressure low, and SG Level low Pressure - Low), line pressure low): 2 are explicitly modeled. The Turbine trip Steam Line Isolation of 3 on 1 of 4 steam functions Steam Line Isolation -
and FWIS, lines Steam Line Pressure -
(Containment Pressure -
High 2, Steam Line AFW Pump Steam Line Isolation Negative Rate-High, Feedwater Pressure {Low, Negative Start, (Containment Isolation - SG Water Level-Low Rate - High}) PORV Pressure-High 2): 2 Low, and PORV Actuation-actuation of 3, Steam Line Pressurizer Pressure-High are Turbine Trip and not explicitly modeled in PRA, Feedwater Isolation (SG Pressure-Low, 2 of 3 on 1 of 4 steam lines and a failure of a reactor trip Water Level-Low Low Steam Line Pressure- breaker will be used as a
{Adverse and Normal conservative surrogate. Note, Containment}) Negative Rate-High, 2 of 3 on 1 of 4 steam the PRA does not Auxiliary Feedwater (SG lines model/distinguish between Water Level-Low Low normal and adverse
{Adverse and Normal Turbine Trip and containment environment.
Containment}) Feedwater Isolation (SG Water Level-Low RICT will not be applied to Automatic Pressurizer Low {Adverse and function 9b. - Automatic PORV Actuation - Pressurizer PORV Actuation, Normal Pressurizer Pressure - Containment}) 2 of 4 Pressurizer Pressure - High High channels on 1 of 4 (Notes 1 and 2).
generators Auxiliary Feedwater (SG Water Level-Low Low {Adverse and Normal Containment}) 2 of 4 channels on 1 of 4 generators Automatic Pressurizer PORV Actuation-Pressurizer Pressure
- High, 2 of 4 channels 3.3.2.F One channel or Steam Line Isolation Partially Manual Steam SLI Function: 1 of 2 SLI Function: 1 of 2 A channel of main steam train inoperable. Manual Initiation, Line Isolation, Control Room Control Room push isolation will be used as a pushbuttons buttons conservative surrogate for the Rx Trip, P-4 steam line isolation function.
ESFAS Interlocks Rx functions: Trips Rx Trip, P-4 E1-7
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition Trip, P4 (2 per train, 2 the main turbine, functions 1 of 2 The function Rx Trip, P-4 is not trains) Isolates MFW trains modeled in the PRA and will not with coincident be in the scope of RICT.
low Tavg, Prevents automatic reactuation of SI after a manual reset of SI, Allows arming of the steam dump valves and transfers the steam dump from the load rejection Tavg controller to the plant trip controller; and, Prevents opening of the MFW isolation valves if they were closed on SI or SG Water Level -
High High.
3.3.2.G One train Automatic Actuation Yes ESF Actuation One of two trains Same Signals for Automatic Actuation inoperable. Logic and Actuation Logic and Actuation Relays Relays (Steam Line (Steam Line Isolation, Turbine Isolation, Turbine Trip Trip and Feedwater Isolation, and Feedwater Isolation, Auxiliary Feedwater) are Auxiliary Feedwater) explicitly modeled.
(Notes 1 and 2)
E1-8
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.3.2.I One channel Turbine Trip and Not ESF Actuation, Two of four on one None The function Turbine Trip - SG inoperable. Feedwater Isolation (SG explicitly P-14: of four Steam Water Level-High High is not Water Level-High High - *Trips the main Generators explicitly modeled, but SG water P-14) turbine level high-high signals for MFW Isolation is modeled. Loss of the
- Trips the associated channel will be used MFW pumps as a conservative surrogate in (PAE01A/1B) the RICT calculation. Also note closing the that trip of the MFW pumps and pump closure of the pump discharge discharge valves is not explicitly modeled.
valves (Notes 1 and 2)
- Initiates feedwater isolation 3.3.2.J One channel Aux Feed, motor driven Not AFW Pump Two of four, one in None This function is not explicitly inoperable. pump start on Trip of all explicitly Start the same separation modeled but a conservative main feed pumps group from each surrogate representing auto feed pump actuation of MDAFPs (PRA credits signals from SG low level, LOOP and SI) has been selected in the RICT calculation.
(Notes 1 and 2) 3.3.2.K One channel Automatic Switchover to Yes ESF Actuation Two of four Same The function Automatic inoperable. Containment Sump - Switchover to Containment Refueling Water Storage Sump - Refueling Water Tank (RWST) Level-Low Storage Tank (RWST) Level-Low coincident with Low Low is explicitly modeled.
Safety Injection. (Notes 1 and 2)
E1-9
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.3.2.Q One train Automatic Actuation Partially ESF Actuation One of two trains Same The function Automatic inoperable. Logic and Actuation Actuation Logic and Actuation Relays (BOP ESFAS) Relays (BOP ESFAS) Steam (Auxiliary Feedwater and Generator Blowdown and Steam Generator Sample Line Isolation is not Blowdown and Sample explicitly modeled in the PRA, Line Isolation) but a conservative surrogate representing auto actuation of MDAFPs (PRA credits signals from SG low level, LOOP and SI) has been selected in the RICT calculation.
3.3.2.R One or both train(s) Loss of Offsite Power Partially ESF Actuation, One of two trains Same The function Loss of Offsite inoperable. (Auxiliary Feedwater and -Start of Power (Steam Generator Steam Generator TDAFP signal Blowdown and Sample Line Blowdown and Sample on LOOP Isolation) is not explicitly Line Isolation) modeled in the PRA, but a
-SGBSIS conservative surrogate signal on representing auto actuation of LOOP TDAFP (PRA credits signals from SG low level and UV) has been selected in the RICT calculation.
Note: RICT is only applicable to one train inoperable.
3.3.2.S One train Automatic Actuation Yes ESF Actuation One of two trains Same The functions Automatic inoperable. Logic and Actuation Actuation Logic and Actuation Relays (MSFIS) (Steam Relays (Steam Line Isolation, Line Isolation, Turbine Turbine Trip and Feedwater Trip and Feedwater Isolation) are explicitly modeled.
Isolation) (Notes 1 and 2)
E1-10
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.3.5.A One or more Degraded Voltage and Yes Diesel Two of four channels Same The function Degraded Voltage Functions with one Loss of voltage sensors Generator - per bus and Loss of voltage sensors on channel per bus on safety related 4 kV Loss of safety related 4 kV buses is inoperable. buses Voltage Start explicitly modeled.
as well as 4 kV Bus load shedding and initiating sequencing.
3.4.11.B One PORV Two PORVS and Yes RCS Two PORVs One PORV with (Note 6) inoperable for automatic actuation depressurization, One Centrifugal reasons other than circuitry once through Charging pump excessive seat core cooling OR Two PORVs leakage (feed and bleed with One SI pump Automatic pressure relief during inadvertent ECCS actuation 3.4.11.C One block valve Two PORV block valves Yes Isolate Two PORV Block Same inoperable. associated valves closable.
PORV 3.5.2.A One or more trains Two ECCS trains (ECCS Yes Emergency 3 ECCS subsystems Same inoperable. train consists of one make up to the between two trains Centrifugal Charging, RCS via such that at least AND one Safety Injection, and injection from 100% ECCS flow At least 100% of one Residual Heat the RWST to equivalent to a the ECCS flow Removal subsystem.) the cold legs, single operable equivalent to a and ECCS train is single OPERABLE recirculation available.
ECCS train from the available. containment sump.
E1-11
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.6.2.C One or more Containment Airlocks Not Containment One of two None The containment airlocks are containment air explicitly integrity containment air lock not modeled but their locks inoperable for doors closed. unavailability will be reasons other than conservatively analyzed as an Condition A or B. early containment failure in the RICT calculation.
3.6.3.A One or more Two active or passive Yes Containment One of two isolation Same Selected Cl valves are modeled penetration flow isolation devices on each boundary and devices per and can be used as a paths with one fluid penetration line minimization of penetration conservative surrogate of the containment RCS inventory failure.
isolation valve Loss inoperable except for containment purge valve leakage not within limit.
3.6.3.C One or more See LCO Condition 3.6.3.A.
penetration flow paths with one containment isolation valve inoperable.
3.6.6.A One containment Two Containment spray No Containment One of two trains None Containment sprays are not spray train trains pressure + modeled for success in the inoperable. temperature Level 1 PRA or in the LERF control and PRA. Hydraulic analysis has fission product been performed to show that retention from success or failure of CS does atmosphere not impact which sequences during a DBA contribute to LERF.
E1-12
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.6.6.C One containment Two Containment cooling No Containment One of two trains None Containment cooling is not cooling train trains pressure + modeled for success in the inoperable. temperature Level 1 PRA or in the LERF control PRA. Hydraulic analysis has been performed to show that success or failure of containment cooling does not impact which sequences contribute to LERF.
3.7.2.A One MSIV actuator Main Steam Isolation Not Isolate Main One MSIV closure None Actuators are not explicitly train inoperable. Valves (MSIVs) explicitly Steam Lines per steam modeled in PRA, but loss of the generator (one of associated signal train will be two actuator trains) used as a conservative surrogate in the RICT calculation.
3.7.2.B Two MSIV actuator See LCO Condition 3.7.2.A.
trains inoperable for different MSIVs when the inoperable actuator trains are not in the same separation group.
3.7.2.F One MSIV Main Steam Isolation Yes Isolate Main Closure of 3 of 4 Same inoperable in Valves (MSIVs) Steam Lines MSIVs MODE 1.
3.7.4.A One required ASD Automatic Steam Dump Yes Plant cooldown Bounded by SGTR Same line inoperable for Valves (ASDs) to RHR entry scenarios which reasons other than conditions require 2/4 ASDs excessive ASD seat available leakage.
E1-13
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.7.4.B Two required ASD Automatic Steam Dump Yes Plant cooldown Bounded by SGTR Same lines inoperable for Valves (ASDs) to RHR entry scenarios which reasons other than conditions require 2/4 ASDs excessive ASD seat available leakage.
3.7.5.A One steam supply TD AFW pump steam Yes Steam supply One of two trains of Same to turbine driven supply line and valves to TDAFP to steam supplies to AFW pump supply TDAFP inoperable. feedwater to steam generators to remove RCS decay heat 3.7.5.B One ESW supply to ESW supply line, Yes Safety related One of two trains of Same turbine driven AFW including valves, to AFW water supply to ESW supplies to pump inoperable. pumps TDAFP to TDAFP supply feedwater to steam generators to remove RCS decay heat 3.7.5.C One AFW train Three AFW trains each Yes Supply One of three AFW Same inoperable for comprised of one pump feedwater to (system AL) pump reasons other than (two containing a motor steam trains Condition A or B. driven AFW pump and generators to the other containing a remove RCS TDAFW pump), piping, decay heat valves, and controls E1-14
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.7.7.A One CCW train Two CCW trains Yes Heat sink for One of two CCW Same inoperable. comprised of two full removing (EG system) trains capacity pumps and process and available surge tank with operating heat associated valves, from safety piping, heat exchanger, related instrumentation and components controls. during a Design Basis Accident or transient 3.7.8.A One ESW train Two ESW trains Yes The Essential One of two ESW (EF Same inoperable. comprised of a self- Service Water system) pump trains cleaning strainer, prelube (ESW) System, available tank, one 100% capacity in conjunction pump, piping, valving, with the and instrumentation and Service Water pump room supply fan System, provides a source of heat rejection for safety-related loads, emergency makeup to the spent fuel pool and component cooling water systems, and is the backup water supply to the auxiliary feedwater system.
E1-15
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.7.9.A One cooling tower Two UHS Cooling tower Yes Ultimate heat One of two trains (2 One of two trains (Note 7) train inoperable. trains (2 cells per train) sink availability cells per train) (1 cell per train) are required to dissipate for ESW 30 for 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> PRA the heat contained in the day mission mission time.
ESW system. UHS time Cooling Tower Electrical Room Supply Fan must be operable per train 3.8.1.A One offsite circuit Two qualified circuits Yes Provide power One qualified circuit Same inoperable. between the offsite from offsite between the offsite transmission network transmission transmission and the onsite 1E AC network to network and the Electrical Power onsite Class onsite 1E AC Distribution System. one buses. Electrical Power Distribution System.
3.8.1.B One DG inoperable. Two EDGs capable of Yes Provide power 1 of 2 EDGs Same supplying onsite 1E AC to safety Electrical Power related buses Distribution System when offsite power to them is lost.
3.8.1.C Two offsite circuits Two qualified circuits Yes Provide power One qualified circuit Same inoperable. between the offsite from offsite between the offsite transmission network transmission transmission and the onsite 1E AC network to network and the Electrical Power onsite Class onsite 1E AC Distribution System. one buses. Electrical Power Distribution System.
E1-16
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.8.1.D One offsite circuit Two qualified circuits Yes Provide power One qualified circuit Same inoperable. between the offsite from offsite between the offsite transmission network transmission transmission AND and the onsite 1E AC network to network and the One DG inoperable. Electrical Power onsite Class onsite 1E AC Distribution System. one buses and Electrical Power Two EDGs capable of to provide Distribution System.
supplying onsite 1E AC power to safety 1 of 2 EDGs.
Electrical Power related buses Distribution System when offsite power to them is lost.
3.8.1.F One required One Load Shedder and Yes Required One of two LSELS Same LSELS inoperable. Emergency Load functions of available.
Sequencer per 4.16kV LSELS are Class 1E AC Bus initiating a DG start upon a detected undervoltage condition, tripping of the incoming offsite power upon a detected undervoltage or degraded voltage condition, shedding of nonessential loads, and proper sequencing of loads E1-17
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.8.4.A One DC electrical Two DC electrical power Yes Ensure One of two DC Same power subsystem subsystems each availability of electrical power inoperable. consisting of two DC required DC subsystems batteries, two battery power to shut available chargers, one swing down the battery charger, and all reactor and the associated control maintain it in a equipment and safe condition interconnecting cabling after an Anticipated Operational Occurrence (AOO) or a postulated DBA 3.8.7.A One required Two normal inverters and Yes Ensure the At least one of two Same inverter inoperable. one swing inverter per availability of Inverter trains train AC electrical available.
power for the One train of inverters systems consists of either two instrumentation normal or one required to normal and one shut down the swing inverter.
reactor and maintain it in a safe condition after an anticipated operational occurrence (AOO) or a postulated DBA.
E1-18
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.8.9.A One AC electrical Two AC electrical power Yes Ensure One of two AC Same power distribution distribution subsystems availability of electrical power subsystem with associated buses required AC distribution inoperable. and load centers power to shut subsystems energized to their proper down the voltages reactor and maintain it in a safe condition after an Anticipated Operational Occurrence or a postulated DBA E1-19
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-1: In Scope TS/LCO Conditions to Corresponding PRA Functions Function TS LCO Tech Spec SSCs Addressed by Modeled Addressed by Design Success PRA Success Comments Action Description TS LCO Condition in PRA TS LCO Criteria Criteria Condition 3.8.9.B One AC vital bus Two AC vital bus Yes Ensure One of two AC vital Same subsystem subsystems with availability of bus distribution inoperable. associated buses required AC subsystems energized to their proper vital bus voltage, each from its electrical associated normal power to shut source inverter or swing down the inverter, via inverted DC reactor and voltage or the alternate maintain it in a AC source (i.e., bypass safe condition constant voltage after an transformer). Anticipated Operational Occurrence or a postulated DBA 3.8.9.C One DC electrical Two DC electrical power Yes Ensure One of two DC Same power distribution distribution subsystems availability of electrical power subsystem with associated buses required DC distribution inoperable. energized to their power to shut subsystems proper voltage from down the either the associated reactor and battery or charger. maintain it in a safe condition after an Anticipated Operational Occurrence or a postulated DBA E1-20
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Notes:
- 1. The reactor protection system is segmented into four distinct but interconnected modules: field transmitters and process sensors, Signal Process Control and Protection System, Solid State Protection System (SSPS), and reactor trip switchgears. Field transmitters provide measurements of the unit parameters to the Signal Process Control and Protection System via separate, redundant channels. The Signal Process Control and Protection System forwards outputs to the SSPS, which consists of two redundant trains, to initiate a reactor trip or actuate Engineering Safety Functions.
- 2. Depending on the measured parameter, three or four instrumentation channels are provided to ensure protective action when required and to prevent inadvertent isolation resulting from instrumentation malfunctions. The output trip signal of each instrumentation channel initiates a trip logic. Failure of any one trip logic does not result in an inadvertent trip. Generally, if a parameter is used only for input to the protection circuits, three channels with a two-out-of-three logic are sufficient to provide the required reliability and redundancy. If a parameter is used for input to the SSPS and a control function, four channels with a two-out-of-four logic are sufficient.
- 3. Each instrumentation channel provides input to both trains of the SSPS, which initiates a reactor trip on one-out-of-two logic.
Each train of SSPS provides input to the Reactor Trip Breakers (RTBs) by de-energizing the RTB undervoltage coils, which trips open the RTBs, tripping the reactor. One-out-of-two open RTBs will trip the reactor.
- 4. Each RTB is equipped with a shunt trip device that is energized to trip the RTB open and an undervoltage coil device that is de-energized to trip the RTB open upon receipt of a manual reactor trip signal. Either device can trip the RTB open, thus providing a redundant and diverse trip mechanism. Two Manual Reactor Trip channels provide the signal from reactor trip switches located in the Main Control Room to the RTBs.
- 5. A trip breaker train consists of all trip breakers associated with a single Reactor Trip System logic train that are racked in, closed, and capable of supplying power to the Rod Control System.
- 6. PRA Success Criteria for feed and bleed cooling can be summarized as follows:
Two feed and bleed (F&B) decay heat removal success criteria are utilized in the Callaway PRA:
If any one (1) of the four (4) higher-head ECCS pumps (in the injection phase) provides flow for successful F&B decay heat removal, then both pressurizer power-operated relief valves (PORVs) must open. Because a medium head (approximately 1500 psia shutoff head) safety injection pump (SIP) is credited as a potential feed source, both PORVs must open for the bleed path to provide faster depressurization to reach the shutoff head of the pumps.
If one (1) of the two centrifugal charging pumps (CCPs) is required (in the injection phase) for successful F&B decay heat removal, then only one (1) pressurizer PORV must open. Because only high head (approximately 2500 psia shutoff head)
CCPs are credited as potential feed sources, only one PORV must open for the bleed path.
Each PZR PORV requires power from its respective DC division to perform its safety function for feed and bleed.
E1-21
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions
- 7. PRA Success Criteria for the number of required cells in an Ultimate Heat Sink (UHS) cooling tower train utilized in the Callaway PRA is as follows:
One cooling tower cell per train.
Thermal analysis has been performed to show that success of a single cooling tower cell per train provides sufficient heat dissipation from the ESW system to ensure the UHS pond temperature limit is not exceeded for the PRA mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
E1-22
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-2: RICT Estimates1,2,3 RICT Estimate Tech Spec LCO Condition (Days) (1,2) 3.3.1.B One Manual Reactor Trip channel inoperable 30.0 3.3.1.D One Power Range Neutron Flux-High channel inoperable 30.0 3.3.1.E One channel inoperable 30.0 3.3.1.K One channel inoperable 30.0 3.3.1.M One Low Fluid Oil Pressure Turbine Trip channel inoperable 30.0 3.3.1.P One train inoperable 30.0 3.3.1.Q One RTB train inoperable 30.0 3.3.1.U One trip mechanism inoperable for one RTB 30.0 3.3.2.B One channel or train inoperable 30.0 3.3.2.C One train inoperable 30.0 3.3.2.D One channel inoperable 30.0 3.3.2.F One channel or train inoperable. 30.0 3.3.2.G One train inoperable 30.0 3.3.2.I One channel inoperable 30.0 3.3.2.J One channel inoperable 30.0 3.3.2.K One channel inoperable 30.0 3.3.2.Q One train inoperable 30.0 3.3.2.R One or both train(s) inoperable 30.0 3.3.2.S One train inoperable 30.0 3.3.5.A One or more Functions with one channel per bus inoperable 30.0 3.4.11.B One PORV inoperable for reasons other than excessive seat leakage 30.0 3.4.11.C One block valve inoperable 30.0 One or more trains inoperable AND At least 100% of the ECCS flow equivalent 3.5.2.A 30.0 to a single OPERABLE ECCS train available.
One or more containment air locks inoperable for reasons other than Condition 3.6.2.C 4.9 A or B.
One or more penetration flow paths with one containment isolation valve 3.6.3.A 30.0 inoperable except for containment purge valve leakage not within limit.
One or more penetration flow paths with one containment isolation valve 3.6.3.C 30.0 inoperable.
3.7.2.A One MSIV actuator train inoperable 30.0 Two MSIV actuator trains inoperable for different MSIVs when the inoperable 3.7.2.B 30.0 actuator trains are not in the same separation group.
3.7.2.F One MSIV inoperable in MODE 1. 30.0 One required ASD line inoperable for reasons other than excessive ASD seat 3.7.4.A 30.0 leakage Two required ASD lines inoperable for reasons other than excessive ASD seat 3.7.4.B 30.0 leakage.
3.7.5.A One steam supply to turbine driven AFW pump inoperable. 30.0 3.7.5.B One ESW supply to turbine driven AFW pump inoperable. 30.0 3.7.5.C One AFW train inoperable for reasons other than Condition A or B. 30.0 3.7.7.A One CCW train inoperable 30.0 E1-23
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Table E1-2: RICT Estimates1,2,3 RICT Estimate Tech Spec LCO Condition (Days) (1,2) 3.7.8.A One ESW train inoperable 16.1 3.7.9.A One cooling tower train inoperable 30.0 3.8.1.A One offsite circuit inoperable 30.0 3.8.1.B One DG inoperable 30.0 3.8.1.C(2)
Two offsite circuits inoperable 1.1 3.8.1.D One offsite circuit inoperable AND One DG inoperable 21.8 3.8.1.F One required LSELS inoperable 30.0 3.8.4.A One DC electrical power subsystem inoperable 6.0 3.8.7.A One required inverter inoperable 5.7 3.8.9.A One AC electrical power distribution subsystem inoperable 4.4 3.8.9.B One AC vital bus subsystem inoperable 5.5 3.8.9.C One DC electrical power distribution subsystem inoperable 6.0 Notes to Table E1-2:
- 1. RICTs presented in Table E1-2 were calculated using the current federated PRA models. Following 4b implementation, the actual RICT values, applying the CRMP tool, will be calculated using the actual plant configuration and the current revision of the PRA model representing the as built, as-operated condition of the plant, as required by NEI 06-09-A, Revision 0-A and the NRC safety evaluation, and may differ from the RICTs presented in this table.
- 2. RICTs are based on the internal events, internal flood, and internal fire, seismic, and high winds PRA model calculations. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A, Revision 0-A. RICTs not capped at 30 days are rounded to nearest tenth of a day.
- 3. Per NEI 06-09-A, Revision 0-A, for plant configuration cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be entered.
2.0 ADDITIONAL JUSTIFICATION FOR SPECIFIC ACTIONS This section contains the additional technical justification for the list of Required Actions from Table 1, Conditions Requiring Additional Technical Justification, of TSTF-505, Revision 2.
Table 1, Conditions Requiring Additional Technical Justification, of TSTF-505 Revision 2 (ADAMS Accession No. ML18183A493) contains a list of required actions that may be proposed for inclusion in the RICT Program, but require additional technical justification to be provided by the licensee.
The following eight conditions are proposed to be included in the scope of the RICT program, but are identified in Table 1 as requiring additional justification:
Condition 3.3.1.D, One Power Range Neutron Flux - High channel inoperable Condition 3.3.1.Q, One RTB train inoperable Condition 3.5.2.A, One or more trains inoperable AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available Condition 3.6.2.C, One or more containment air locks inoperable for reasons other than Condition A or B E1-24
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Condition 3.6.6.A, One containment spray train inoperable Condition 3.6.6.C, One containment cooling train inoperable Condition 3.7.2.F, One MSIV inoperable in MODE 1 Condition 3.7.4.B, Two required ASD lines inoperable for reasons other than excessive ASD seat leakage.
As some of the TSs vary between the TSTF-505 and the site TS, the table in Attachment 5 provides a cross-reference between Table 1 of TSTF-505, Revision 2, and the Callaway Plant, Unit No. 1, LCOs in the scope of the proposed RICT Program.
2.1 TS 3.3.1 - Reactor Trip System (RTS) Instrumentation LCO: The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.
Condition D: One Power Range Neutron Flux - High channel inoperable As indicated in Table E1-1, the Power Range Neutron Flux - High channels are not explicitly modeled in the Callaway PRA. The PRA models these channels as only one of many inputs into the reactor trip signal. Therefore, the failure of 1 of 2 reactor trip breakers provides a bounding surrogate for any equipment failure that would place the site in 3.3.1 D. As described in Section 7.2.2.3.1, Neutron Flux, of the Callaway FSAR, Revision OL-25:
Four power range neutron flux channels are provided for overpower protection. An isolated auctioneered high signal is derived by auctioneering the four channels for automatic rod control (automatic rod insertion only - automatic rod withdrawal no longer available). If any channel fails in such a way as to produce a low output, that channel is incapable of proper overpower protection but will not cause control rod movement as automatic rod withdrawal is no longer available. Two-out-of-four overpower trip logic will ensure an overpower trip if needed, even with an independent failure in another channel.
In addition, channel deviation signals in the nuclear instrumentation system (NIS), will give an alarm if any neutron flux channel deviates significantly from the average of the flux signals.
Finally, an overpower signal from any one neutron flux intermediate or power range channel will block any rod withdrawal. The setpoints for these rod stops are below the reactor trip setpoints.
These alarms and actions signify periodic monitoring of spatial power distribution and imposition of compensatory limits and reduced power.
Therefore, TS 3.3.1 Condition D meets the requirements for inclusion in the RICT Program.
2.2 TS 3.3.1 - Reactor Trip System (RTS) Instrumentation LCO: The RTS instrumentation for each Function in Table 3.3.1-1 shall be OPERABLE.
Revised Condition Q: One RTB train inoperable.
E1-25
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions As indicated in Table E1-1 of Enclosure 1, the RTB trains are explicitly modeled in the Callaway PRA. The PRA Success Criterion is the same as the Design success criteria which is one of two RTBs open. The completion time and bypass time delineated in TSTF-411 are not changed by this submittal, only modified by the allowed use of a RICT. The commitments made with respect to actions when an RTB train is inoperable are still applicable when the RICT program is not being utilized as permitted by this submittal.
During normal operation the output from the SSPS is a voltage signal that energizes the undervoltage coils in the RTBs and bypass breakers, if in use. When the required logic matrix combination is completed, the SSPS output voltage signal is removed, the undervoltage coils are de-energized, the breaker trip lever is actuated by the de-energized undervoltage coil, and the RTBs and bypass breakers are tripped open. This allows the shutdown rods and control rods to fall into the core. In addition to the de-energization of the undervoltage coils, each reactor trip breaker is also equipped with an automatic shunt trip device that is energized to trip the breaker open upon receipt of a reactor trip signal from the SSPS. Either the undervoltage coil or the shunt trip mechanism is sufficient by itself, thus providing a diverse trip mechanism.
As documented in the Callaway FSAR Section 7.7.1.11.1, the ATWS Mitigation System Actuation Circuit (AMSAC) is designed to provide protections in the event of a failure within the RTS system to provide a reactor trip. The AMSAC signal will initiate an AFAS (MD and TD), a turbine trip as well as close the steam generator blowdown isolation valves and close the steam generator sample isolation valves.
Therefore, TS 3.3.1 Condition Q meets the requirements for inclusion in the RICT Program.
2.3 TS 3.5.2 - ECCS - Operating LCO: Two ECCS trains shall be OPERABLE.
Condition A: One or more trains inoperable AND at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available As indicated in Table E1-1, the ECCS trains are explicitly modeled in the Callaway PRA. The PRA success Criterion is the same as the Design Success Criteria which is, 3 ECCS subsystems between two trains such that at least 100% ECCS flow equivalent to a single operable ECCS train is available.
Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS.
Additionally, Callaway TS 3.5.2 Condition A requires, "One or more trains inoperable AND At least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available." With less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, LCO 3.0.3 would be entered. Therefore, Condition A 100% of the ECCS flow stipulation prevents an ECCS loss of function from occurring due to two ECCS trains being inoperable in Condition A.
TSTF-505, Rev. 2, Table 1 states: "Licensee must justify that one or more ECCS trains inoperable is not a condition in which all required trains or subsystems of a TS required system E1-26
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions are inoperable. Acceptable justification is TS Condition requiring 100% flow equivalent to a single ECCS train."
Therefore, TS 3.5.2 Condition A meets the requirements for inclusion in the RICT Program.
2.4 TS 3.6.2 - Containment Air Locks LCO: Two containment air locks shall be OPERABLE.
Condition C: One or more containment air locks inoperable for reasons other than Condition A or B.
As indicated in Table E1-1 of Enclosure 1, the containment air locks are not explicitly modeled in the Callaway PRA. Since the containment airlocks are not modeled, there are no explicit PRA Success Criteria. The Design Success Criterion is: One of two containment air lock doors closed.
Since the containment airlocks are not modeled, their unavailability will be conservatively analyzed as an early containment failure as a conservative surrogate in the RICT calculation.
Each containment air lock forms part of the containment pressure boundary. As part of the containment pressure boundary, the air lock safety function is related to control of the containment leakage rate resulting from a DBA. Thus, each air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.
Compliance with the remaining portions of LCO Condition 3.6.2 ensures that there is a physical barrier (i.e., closed door) and an acceptable overall leakage from containment. Thus, the function is still maintained. Required Action C.1 of LCO Condition 3.6.2 requires the condition to be assessed in accordance with TS 3.6.1, Containment Integrity (i.e., Initiate action to evaluate overall containment leakage rate per LCO 3.6.1 with a Completion Time of Immediately). If containment leakage exceeds LCO 3.6.1 limits and cannot be restored to OPERABLE within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the plant is taken to Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
Therefore, TS 3.6.2 Condition C meets the requirements for inclusion in the RICT Program.
2.5 TS 3.6.6 - Containment Spray and Cooling Systems LCO: Two containment spray trains and two containment cooling trains shall be OPERABLE.
Condition A: One containment spray train inoperable Condition C: One containment cooling train inoperable The Containment Spray and Containment Cooling systems provide containment atmosphere cooling to limit post-accident pressure and temperature in containment to less than the design values. Each train of Containment Spray consists of one pump, spray headers, nozzles, valves and associated piping. Each train of Containment Cooling consists of two fan coil units and associated ducting. Application of the RICT program to the referenced 3.6.6 A and C Conditions would require that one train remain operable and thus does not represent a loss of function during any proposed RICT application.
E1-27
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Containment sprays and Containment Cooling are not modeled for success in the Level 1 PRA or in the LERF PRA. Hydraulic analysis has been performed using MAAP to show that success or failure of Containment Spray and Containment Cooling does not impact which sequences contribute to LERF. While Containment Spray operation could impact the timing of swapping over to containment recirculation, the increased rate of RWST depletion is conservatively considered within the PRA model where appropriate.
The Callaway LERF model was developed using the guidance within WCAP-16341-P which is consistent with NUREG/CR-6595 Rev. 1. As stated within these and other documents (NUREG-1524, NUREG-1150, NUREG/CR-6338), Containment Cooling is not important for large, dry PWRs such as Callaway. These generic analyses were confirmed with Callaway-specific MAAP analysis. This plant specific work indicated that Containment Spray was only effective in fission product mitigation in a small subset of the core damage frequency progressing to LERF, and the majority of core damage frequency is associated with late containment failure. Current MAAP analyses without credit for Containment Spray and Cooling shows that containment does not fail early and thus LERF would not change due to any operation of either system.
As Containment Spray and Cooling trains are not modeled in the PRA, RICT application to these LCO's is dependent on the delta-risk indicated by the plant state at the time of LCO entry.
Mapping will be added to the CRM model which will allow operators to enter these LCO's and take the applicable equipment OOS, but where there is no direct delta-risk, the 30 day back stop would apply. If other equipment were OOS at the time, that delta-risk would be evaluated and a commensurate RICT would be applied. The hydraulic analyses discussed within this section would remain applicable to any RICT entry. The risk at the time of implementation of RICT would represent the likelihood of a core damage state to occur.
Therefore, TS 3.6.6 Conditions A and C meet the requirements for inclusion in the RICT Program.
2.6 TS 3.7.2 - Main Steam Isolation Valves (MSIVs), Main Steam Isolation Valve Bypass Valves (MSIVBVs), and Main Steam Low Point Drain Isolation Valves (MSLPDIVs)
LCO: The MSIV and its associated actuator trains, the MSIVBV, and the MSLPDIV in each of the four main steam lines shall be OPERABLE.
Condition F: One MSIV inoperable in MODE 1 As indicated in Table E1-1 of Enclosure 1, the MSIVs are explicitly modeled in the Callaway PRA. The Design Success Criteria is Closure of 3 of 4 MSIVs which matches the PRA success criteria.
The MSIVs isolate steam flow from the secondary side of the steam generators following a High Energy Line Break (HELB). MSIV closure terminates flow from the unaffected (intact) steam generators.
The design basis of the MSIVs is established by the containment analysis for the large steam line break (SLB) inside containment, discussed in FSAR Section 6.2.1.4 (Ref. 5). It is also affected by the accident analysis of the SLB events presented in the FSAR, Section 15.1.5. The design precludes the blowdown of more than one steam generator, assuming a single active component failure (e.g., the failure of one MSIV to close on demand). The postulated accidents E1-28
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions (including the main steam line break, the feed water line break, and the steam generator tube rupture) assume the MSIVs function to isolate the secondary system to ensure the primary success path for steamline and feedline isolation and for delivery of required auxiliary feedwater flow.
As described in FSAR Section 10.3.1, Revision OL-25, there is one MSIV on each of the four loops to the SGs. FSAR Section 15.1.5.2 provides information regarding an alternate method of preventing blowdown of more than one steam generator:
Steam release from more than one steam generator will be prevented by automatic trip of the isolation valves in the steamlines by low steamline pressure signals, high-high containment pressure signals, or by high negative steamline pressure rate signals.
Even with the failure of one valve, release is limited by main steam isolation valve closure for the other steam generators while the one generator blows down.
From FSAR 15.1.5.1 regarding MSIV's:
Isolation valves are provided in each steamline. For breaks down-stream of the isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location, no more than one steam generator would experience an uncontrolled blowdown, even if one of the isolation valves fails to close. A description of steamline isolation is included in FSAR Section 10.3. In the analysis, these valves are assumed to fully close within 17 seconds upon receipt of a steamline isolation signal following a large break in a steamline. The 17 seconds includes a 2 second signal processing delay assumption. Additionally, an engineering evaluation was completed to support an increase in the main steam isolation valve stroke delay up to 60 seconds for steam generator pressures below that which corresponds to the P-11 permissive set point. This evaluation demonstrated that the acceptance criteria continue to be met for this scenario. More information on this engineering evaluation can be found in Reference 6.
Therefore, TS 3.7.2 Condition F meets the requirements for inclusion in the RICT Program.
2.7 TS 3.7.4 - Atmospheric Steam Dump Valves (ASDs)
LCO: Four ASD lines shall be OPERABLE.
Condition B: Two required ASD lines inoperable for reasons other than excessive ASD seat leakage As indicated in Table E1-1 of Enclosure 1, the ASD lines are explicitly modeled in the Callaway PRA. The PRA success Criterion is the same as the Design Success Criteria which is two of four ASDs open.
Based on the design configuration, the TS markup for Condition 3.7.4.A.1 and B.1 are revised to include a note described in Table 1 (i.e., not applicable when more than two required SG PORV lines are inoperable.). The TS Bases are revised to describe the note and other editorial changes.
Revised TS and Bases pages are provided in Attachments 2, 3 and 4.
E1-29
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Therefore, TS 3.7.4 Condition B meets the requirements for inclusion in the RICT Program.
3.0 EVALUATION OF INSTRUMENTATION AND CONTROL SYSTEMS The following Instrumentation Technical Specifications Sections are included in the TSTF-505 application for the Callaway Plant, Unit No. 1.
The Callaway Plant, Unit No. 1, Technical Specifications 3.3, INSTRUMENTATION, LCOs were developed to assure that the Callaway Plant, Unit No. 1, facility maintains necessary redundancy and diversity. The reactor protection systems are designed in accordance with IEEE 279-1968. Furthermore, it is shown that the intent of the applicable criteria and codes at the time of construction, such as the GDCs referenced in Sections 1.2 and 1.5 of the Callaway Plant, Unit No. 1, Final Safety Analysis Report and IEEE 279-1971 (Ref. 7). The Engineered Safety Features Actuation System meets the single failure criterion as defined in Institute of Electrical and Electronics Engineers (IEEE) Standard 279-1971.
TSTF-505 (Reference 4) sets forth the following as guidance for what is to be included in this enclosure:
The description of proposed changes to the protective instrumentation and control features in TS Section 3.3, Instrumentation, should confirm that at least one redundant or diverse means (other automatic features or manual action) to accomplish the safety functions (for example, reactor trip, SI, containment isolation, etc.) remains available during use of the RICT, consistent with the defense-in-depth philosophy as specified in RG 1.174. (Note that for each application, the staff may selectively audit the licensing basis of the most risk-significant functions with proposed RICTs to verify that such diverse means exist.)
The following sections provide the justification that defense-in-depth is maintained for the applicable functions throughout the application of the RICT Program.
3.1 Reactor Trip System (RTS)
Reference:
TS 3.3.1, Reactor Trip System (RTS) Instrumentation The RTS design creates defense-in-depth due to the redundancy of the channels for each function.
Each function has multiple channels.
Each function will cause a reactor trip with 1/2, 2/3, or 2/4 channels tripped.
A bypassed channel does not trip. It reduces the number of total available channels by 1, e.g., from 2/4 to 2/3.
When applicable, if 1 channel in the function is out of service, then the 1 channel can be placed in trip, reducing the number of channels required to actuate the function; e.g., from 2/4 to 1/3.
The RTS also employs diversity in the number and variety of different inputs which will initiate a reactor trip. A given reactor trip will typically be accompanied by several diverse reactor trip inputs from the RTS.
E1-30
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Diverse inputs trip the reactor (FSAR Table 7.2-1).
Power range high neutron flux (low setting) - 2/4 Power range high neutron flux (high setting) - 2/4 Intermediate range high neutron flux - 1/2 Source range high high neutron flux - 1/2 Power range high positive neutron flux rate - 2/4 Overtemperature T - 2/4 Overpower T - 2/4 Pressurizer low pressure - 2/4 when above 10% reactor power Pressurizer high pressure - 2/4 Pressurizer high water level - 2/3 when above 10% reactor power Low reactor coolant flow - 2/3 in any loop when reactor power > 48%; 2/3 in any two loops when reactor power > 10%
Reactor coolant pump undervoltage - 1/2 in both busses when above 10% reactor power Reactor coolant pump underfrequency - 1/2 in both busses when above 10% reactor power Low-low steam generator water level - 2/4 in any loop Safety injection signal - coincident with actuation of safety injection Turbine trip (anticipatory)
-Low trip fluid pressure - 2/3
-Turbine stop - 4/4 Manual - 1/2 See FSAR Table 7.2-4 for accident assumptions.
3.2 Engineered Safety Features Actuation System (ESFAS)
Reference:
TS 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation The ESFAS design creates defense-in-depth due to the redundancy of the channels for each function.
Each function has multiple channels.
Each function will cause a reactor trip with 1/2, 2/3, or 2/4 tripped signals.
A bypassed channel does not trip. It reduces the number of total available channels by 1; e.g., from 2/4 to 2/3.
When applicable, if 1 channel in the function is out of service, then the 1 channel can be placed in trip, reducing the number of channels required to actuate the function; e.g., from 2/4 to 1/3.
E1-31
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Inputs create diverse equipment response (FSAR Table 7.3-1 and 7.3-2, FSAR Section 7.3.1, and TS Bases 3.3.2).
Safety Injection
- Manual - 1/2
- Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains
- Containment Pressure - High 1 - 2/3
- Pressurizer Pressure - Low - 2/4
- Steamline Pressure Low - 2/3 in one steam line Containment Spray
- Manual - 1/2 switches at 2/2 locations
- Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains
- Containment Pressure High 3 - 2/4 Containment Isolation (Phase A)
- Manual - 1/2
- Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains
- Any SI Signal Containment Isolation (Phase B)
- Manual - 1/2 switches at 2/2 locations
- Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains
- Containment Pressure High 3 - 2/4 Steamline Isolation
- Manual - 1/2
- Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains
- Automatic Actuation Logic and Actuation Relays (MSFIS) - 1/2 trains
- Containment Pressure High 2 - 2/3
- Steam Line Pressure Low - 2/3 in one steam line (Can be blocked with Pressurizer Pressure below 1970 psig)
- Steam Pressure Negative Rate High - 2/3 in one steamline (Interlocked when Steam Line Pressure Low is blocked below 1970 psig)
Turbine Trip and Feedwater Isolation
- Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains
- Automatic Actuation Logic and Actuation Relays (MSFIS) - 1/2 trains
- Steam Generator Water Level - High High (P-14) - 2/4 in one Steam Generator
- Any SI Signal
- SG Water Level Low Low (Adverse Containment Environment) - 2/4 per SG
- SG Water Level Low Low (Normal Containment Environment) - 2/4 per SG
- SG Water Level Low-Low Containment Pressure Environmental Allowance Modifier -
2/4 EAM Channels E1-32
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions Auxiliary Feedwater
- Manual - 1/pump
- Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains
- Automatic Actuation Logic and Actuation Relays (BOP ESFAS) - 1/2 trains
- SG Water Level Low Low (Adverse Containment Environment) - 2/4 per SG
- SG Water Level Low Low (Normal Containment Environment) - 2/4 per SG
- SG Water Level Low-Low Containment Pressure Environmental Allowance Modifier -
2/4 EAM Channels
- Any SI Signal
- Loss of Offsite Power - Starts Turbine Driven Aux Feed Pump - 1/2 trains
- Trip of all main feed pumps - Starts Motor Driven Aux Feed Pump - Two of four, one in the same separation group from each feed pump
- Auxiliary Feedwater Pump Suction Transfer on Suction Pressure - Low - 2/3 Automatic Switchover to Containment Sump
- Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains
- Refueling Water Storage Tank (RWST) Level Low Low Coincident with Safety Injection Signal present - 2/4 ESFAS Interlocks
- Reactor Trip, P 1 per train/2 trains
- Pressurizer Pressure, P 2/3 Automatic Pressurizer PORV Actuation
- Automatic Actuation Logic and Actuation Relays (SSPS) - 1/2 trains
- Pressurizer Pressure - High- 2/4 Steam Generator Blowdown and Sample Line Isolation
- Manual - 1 per MDAFW pump
- Automatic Actuation Logic and Actuation Relays (BOP ESFAS) - 1/2 trains
- Any SI Signal
- Loss of Offsite Power - SGBSIS (isolation signal) - 1/2 trains 3.3 Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation
Reference:
TS 3.3.5, Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation Each diesel generator has a starting control system, initiated either manually or automatically, which, when energized from the 125-VDC distribution bus of each diesel generators own ESF division, provides an independent emergency source of power in the event of a complete loss of offsite power with sufficient capacity to supply all of the electrical loads that are required for reactor safe shutdown either with or without a loss-of-coolant accident (LOCA)
(FSAR 8.3.1.1.2.2).
E1-33
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions The LOP DG Start Instrumentation design creates defense-in-depth due to the redundancy of the channels for each function.
Controls and circuitry for starting and loading each redundant diesel generator set are electrically and physically independent.
A diesel generator is started by any one of the following (FSAR 8.3.1.1.3):
- Receipt of a safety injection signal (SIS)
- Loss of voltage to the respective 4.16-kV Class 1E bus to which each generator is connected
- Manual - Remote switch actuation (main control room)
- Manual - Local switch actuation (diesel generator room)
- Emergency Manual - Local switch actuation (diesel generator room)
Diverse inputs start the diesel generators.
Manual Any SI Signal Loss of Power (LOP) signal on 4.16-kV Class 1E bus served by the diesel generator (1/2 bus). LOP signal is generated by:
- Degraded voltage relays if voltage is below 90% after a longer time delay (2/4 channels)
- Undervoltage relays if voltage is below 70% for a short time delay (2/4 channels)
E1-34
Enclosure 1 List of Revised Required Actions to Corresponding PRA Functions
4.0 REFERENCES
- 1. NRC Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, May 17, 2007 (ADAMS Accession No. ML071200238).
- 2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).
- 3. NUREG/CR-5500, Volume 2, Reliability Study: Westinghouse Reactor Protection System, 1984-1995, December 1998.
- 4. TSTF-505-A, Rev. 2, Technical Specifications Task Force Improved Standard Technical Specifications Change Traveler, November 2018.
- 5. Final Safety Analysis Report (FSAR) - Callaway Nuclear Power Plant, Unit 1, Revision OL-25.
- 6. SCP-07-19, Main Steam Isolation Valve (MSIV) Stroke Time Evaluation Phase 2 Report Revision 0, February 16, 2007.
- 7. Institute of Electrical and Electronics Engineers (IEEE) Standard 279-1971, Criteria for Protection Systems for Nuclear Power Generating Stations, June 3, 1971.
E1-35