Text

Mellla+ Risk Assessment, Attachment 6 of L-MT-10-003
	ML100280559
Person / Time
Site:	Monticello
Issue date:	11/30/2009
From:	; ERIN Engineering & Research
To:	; Office of Nuclear Reactor Regulation, Xcel Energy
References
	L-MT-10-003
	Download: ML100280559 (142)
	v • d • e

U Attachment 6 of L-MT-1 0-003 Monticello MELLLA+ Risk Assessment

MONTICELLO MELLLA+

RISK ASSESSMENT Preparedfor:

Xcel Energy Prepared by:

EW Engineeringand Research, Inc.

an SKF Group CoWmpy NOVEMBER 2009 Revision 2

Monticello MELLLA + Risk Assessment EXECUTIVE

SUMMARY

The proposed MELLLA+ operating region for Monticello has been reviewed to determine the net impact on the Monticello risk profile.

The existing Monticello Probabilistic Risk Assessment (PRA) is based on the EPU MELLLA operating region. The enclosed assessment of the MELLLA+ impacts on risk has been performed relative to the current PRA. The guidelines from the NRC (Regulatory Guide 1.174) are followed to assess the change in risk as characterized by core damage frequency (CDF) and Large Early Release Frequency (LERF) and to determine if the change in risk is anything but very low.

The scope of this report includes assessment of the risk impacts due to internal events (including internal flooding scenarios) using as the base reference model the MNGP Level 1 and Level 2 EPU MELLLA PRA average maintenance model (fault tree Risk-T&M-EPU.caf). The impact on external events risk is assessed using the analyses of the Monticello Individual Plant Examination of External Events (IPEEE) Submittal [10] and

'industry studies (e.g.,_NUREG/CR-6850). MELLLA+ has no impact on the risk associated with accidents initiated during shutdown conditions.

The best estimate of the risk increase for at-power internal events due to MELLLA+ is a deltaCDF of 7.36E-8. The best estimate at-power internal events LERF increase due to MELLLA+ is a delta LERF of I.62E-8.

Using the NRC guidelines established in Regulatory Guide 1.174 and the calculated results from the Level 1 and 2 PRA, the best estimate for the CDF risk increase (7.36E-8/yr) and the best estimate for the LERF increase (1.62E-8/yr) are both within Region III (i.e., changes that represent very small risk changes).

Based on these results, the proposed MNGP MELLLA+ operating region is acceptable on a risk basis.

C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment TABLE OF CONTENTS Section Paqe EX E C UT IVE S UMMA RY ........................................................................................................ I 1.0 INT RO DUC T IO N ..................................................................................................... 1-1 1.1 Ba ck g ro u n d ........................................................... .... ............................... 1-1 1.2 P R A Q u a lity ..... :...................................................................... ...................... 1-2 1.3 PRA Definitions and Acronym s .................................................................... 1-3 1.4 General Assumptions ..................................... 1-9 2 .0 S C O P E..................................................................................................................... 2 -1 3.0 ME T HO DO LO G Y .................................................................................................... 3-1 3 .1 A na lysis A pproach ........................................................................................ 3-1 3.2 P RA E lem ents A ssessed ............................................................................ 3-3 3.3 Inputs (P lant C hanges) ................................................................................. 3-4 3.4 Scoping Evaluation ...................................... 3-13 4.0 PRA CHANGES RELATED TO MELLLA+ CHANGES........................ 4-1 4.1 PRA Elements Potentially Affected by MELLLA+ ...................................... 4-1 4.2 Level 1 PRA .......................................... 4-45 4.3 Internal Fires Induced R isk ................................................................. ........ 4-48 4 .4 S eism ic R isk ........................................................................................ . . 4-4 9 4.5 Other External Events Risk :.... ............ .. . ............... 4-50

-4 .6 S hutd ow n R isk ............................................... ............................................. 4-5 1 4.7 Radionuclide Release (Level 2 PRA) ....................................................... 4-52 5 .0 C O NC LU S IO NS .... ..................................................... .......................................... 5-1 5.1. Level 1 PRA ..................... *...................... 5-2 5 .2 Le ve l 2 P RA .................................................................................................. 5 -2 5.3 . Fire Induced Risk ........................................ 5-2 5 .4 S e is m ic R is k ................................................................................................ 5 -3 5.5 O ther External Hazards .,............................................................................... 5-3 5 .6 S hutd ow n R isk ................................................................................... 5-3 5.7 Quantitative Bounds on Risk Change ......................................................... 5-3

.RE FE R E NC E S ......... ... ......... .......................................... R -1 Appendix A MONTICELLO PRA QUALITY Appendix B ROADMAP TO RS-001 REVIEW CRITERIA C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Section 1 INTRODUCTION Monticello is currently pursuing a License Amendment Request for operation using the MELLLA+ enhanced operating region. The expanded operating range is designed to enable plants that have pursued power uprates to be operated more efficiently. The proposed changes expand operating range flexibility but do not increase the licensed power level, operating pressure or the maximum core flow.

The purpose of this report is to:

(1) Identify any significant change in risk associated with MELLLA+ as measured by the Monticello PRA models (2) Provide the basis for the impacts on the risk model associated with MELLLA+

(3) Review the plant specific risk impacts of EPU and evaluate them at MELLLA+ conditions 1.1 -BACKGROUND The Monticello PRA is a state-of-the-technology tool developed consistent with current PRA methods and approaches. The MNGP model is developed and quantified using the CAFTA (part of the EPRI R&R Workstation) software.

The Monticello PRA is based on realistic assessments of system capability over the 24 hour-mission time of the PRA analysis. Therefore, PRA'success criteria may be different than the design basis assumptions used for licensing Monticello. This report examines the risk profile changes from this realistic perspective to identify changes in the risk profile on a best estimate basis that may result from postulated accidents, including severe accidents.

1-1 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment 1.2- PRA QUALITY The quality of the MNGP PRA models used in performing this risk assessment is manifested by the following:

Sufficient scope and level of detail in PRA

Active maintenance of the PRA models and inputs

Comprehensive Critical Reviews Scope and Level of Detail The MNGP PRA is of sufficient quality and scope for this application. The MNGP PRA modeling is highly detailed, including a wide variety of initiating events (e.g., transients, internal floods, LOCAs inside and outside containment, support system failure initiators), modeled systems, extensive level of detail, operator actions, and common cause events.

Maintenance of Model, Inputs, Documentation The MNGP PRA model and documentation has been updated to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data. The base reference model used in this risk assessment is the MNGP Level 1 and Level 2 EPU MELLLA PRA average maintenance model (fault tree Risk- T&MEPU.caf). This model includes EPU implemented and planned plant modifications yet to be implemented (but will be implemented prior to MELLLA+

implementation), as well as other outstanding plant modifications that have been implemented or planned for implementation in the near future (refer to Reference [19]

and Appendix A).

1-2 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment The Level 1 and Level 2 MNGP PRA analyses were originally developed and submitted to the NRC in February 1992 as the Monticello Individual Plant Examination- (IPE)

Submittal. The MNGP PRA submittal and the subsequent NRC approval are described in Section 14.01 of the MNGP USAR.

Critical Reviews The Monticello internal events received a formal industry PRA Peer Review in October 1997. All of the "A" and "B" priority comments from the 1997 peer review have been addressed by MNGP and incorporated into the current MNGP PRA model as appropriate.

Three comparisons to the ASME PRA Standard have also been performed over the past five years.,

Summary In summary, it is found that the Monticello Level 1 and Level 2 PRAs provide the necessary-and sufficient scope and level of detail to allow the calculation of CDF and LERF changes due to MELLLA+. Refer to Appendix A for further details regarding the

.quality of the MNGP PRA.

1.3 PRA DEFINITIONS AND ACRONYMS Definitions The following PRA terms are used in this study:

CDF - Core Damage Frequency (CDF) is a risk measure for calculating the frequency of a severe core damage event at a nuclear facility. Core damage is the end state of the Level 1 PRA. A core damage event may be defined. in the MNGP PRA by one or more of the following:

- Maximum core temperature greater than 2200 degrees Fahrenheit, 1-3 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment RPV water level at 1/3 core height and decreasing, Containment failure induced loss of injection, CDF is calculated in units of events per year.

With respect -to analyzing MAAP thermal hydraulic runs, very short spikes (e.g., seconds or a couple minutes) above 2200F are not automatically declared core damage. The case is typically re-run and re-analyzed carefully.

LERF - Large Early' Release Frequency (LERF) is a risk measure for calculating the frequency of an offsite radionuclide release that is HIGH in fission product magnitude and EARLY in release timing. A HIGH magnitude release is defined as a radionuclide release of sufficient magnitude to have the potential to cause early fatalities (e.g., greater than 10% Cesium Iodide contribution to release). An EARLY timing release is defined as the time prior to that where minimal offsite protective measures have been implemented (e.g., less than 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months from accident initiation). LERF is calculated in units of events per year.

Initiating Event - Any event that causes/requires a scram/manual shutdown (e.g., Turbine Trip, MSIV Closure) and requires- the initiation of mitigation systems to reach a safe and stable state. An initiating event is modeled in the PRA to represent-the primary transient event that can lead to a core damage

..event given failure of adequate mitigation systems (i.e., adequate with respect to the transient in question).

Internal Events - Those initiating events caused by failures internal to the

..system boundaries. Examples include Turbine Trip, MSIV Closure, Loss of an AC Bus, Loss of Offsite Power, and internal floods.

External Events - Those initiating events caused by failures external to the system boundaries. Examples include fires, seismic events, and tornadoes.

HEP -. Human Error Probability (HEP) is the probabilistic estimate that the operating crew fails to perform a specific action (either properly or within the necessary time frame) to support accident mitigation. The HEP is calculated using, industry methodologies and considers a number of performance shaping factors such as:

- training of the operating crew,

- availability of adequate procedures,

- time required to perform action

- time available to perform action

- stress level while performing action 1-4 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment HRA - Human Reliability Analysis (HRA) is the systematic process used to evaluate operator actions and quantify human error probabilities.

MAAP - The Modular Accident Analysis Package (MAAP) is an industry

.recognized thermal hydraulic code used to evaluate design basis and beyond design basis accidents. MAAP can be used to evaluate thermal hydraulic profiles within the primary system (e.g., RPV pressure, boildown timing) prior to core damage. MAAP also can be used to'evaluate post core damage phenomena such as RPV breach, containment mitigation, and offsite radionuclide release magnitude and timing.

Level 1 PRA - The Level 1 PRA is the evaluation of accident scenarios that begin with an initiating event and progress to core damage. Core damage is the end state for the Level 1 PRA. The Level 1 PRA focuses on the capability of plant systems to mitigate a core damage event.

Level 2 PRA - The Level 2 PRA is a continuation of the Level 1 PRA evaluation. The Level 2 PRA begins with the accident scenarios that have progressed to core damage and evaluates the potential for offsite radionuclide releases. Offsite radionuclide release is the end state for the Level 2 PRA.

The Level 2 PRA focuses on the capability -of -plant: systems (including

.containment structures) to prevent a core damage event to result in an offsite release.

RAW - The Risk Achievement Worth (RAW) is the calculated increase in a risk measure (e.g., CDF or LERF) given that a specific system, component, operator action, etc. is assumed to fail (i.e., failure probability of 1.0). RAW is presented as a ratio of the risk measure given the component is failed divided by the risk measure given the component is assigned its base failure probability.

FV - The Fussell-Vesely (FV) importance is a measure of the contribution of a specific system, component, operator action, etc. to the overall risk. F-V is presented as the percentage of the overall risk to which the component failure contributes. In other words, the F-V importance represents the overall decrease in risk if the component is guaranteed to successfully operate as designed (i.e., failure probability of 0.0).

Acronyms The following acronyms are used in this study:

1-5 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment ABA Amplitude Based Algorithm.

AC Alternating Current ACRS Advisory Committee on Reactor Safeguards ADS Automatic Depressurization System AOP Abnormal Operating Procedure APRM Average Power Range Monitor ARI Alternate Rod Insertion ARTS APRM / RBM Technical Specifications ASEP Accident Sequence Evaluation Program ASME American Society of Mechanical Engineers ATWS Anticipated Transient Without Scram BHEP Base Human Error Probability BIIT Boron Injection Initiation Temperature BOC Break Outside Containment BOP Balance of Plant BSP Backup Stability Protection BWR Boiling Water Reactor BWROG Boiling Water Reactor Owners Group CCF Common Cause Failure CDF Core Damage Frequency CHR Containment Heat Removal CLTP Current Licensed Thermal Power CRDH Control Rod Drive Hydraulics CS Core Spray CST Condensate Storage Tank CSW Condensate Service Water CTS Condensate Transfer System DBA Design Basis Accident DC Direct Current DFP Diesel Driven Fire Pump DHR Decay Heat Removal DSS-CD Detect and Suppress Solution - Confirmation Density DW Drywell ECCS Emergency Core Cooling System ED Emergency Depressurization EDG Emergency Diesel Generator EOOS Equipment Out of Service EOP Emergency Operating Procedure EPRI Electric Power Research Institute EPU Extended Power Uprate 1-6 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment FB Flow Biased FIV Flow Induced Vibration FIVE Fire-Induced Vulnerability Evaluation FPS Fire Protection System FSAR Final SafetyAnalysis Report FV Fussell-Vesely (risk importance measure)

FW Feedwater FWLC Feedwater Level Control GE General Electric GRA Growth Rate Algorithm HCTL Heat Capacity Temperature Limit HEP Human Error Probability HP High Pressure HPCI High Pressure Coolant Injection HRA Human Reliability Analysis HX' Heat Exchanger I&C Instrumentation and Control ICF Increased Core Flow IORV Inadvertently Opened Relief.Valve IPE Individual Plant Evaluation IPEEE Individual Plant Evaluation of External Events ISLOCA Interfacing Systems LOCA Li Level 1 (PRA)

L2 Level 2 (PRA)

LERF Large Early Release Frequency LHGR Linear Heat Generation Rate LLOCA Large LOCA LOCA Loss of Coolant Accident LOOP Loss of Offsite Power LP Low Pressure LPCI Low Pressure Coolant Injection MAAP .Modular Accident Analysis Program MCPR Minimum Critical Power Ratio MCR Main Control Room MELLLA Maximum Extended Load Line Limit Analysis MELLLA+ Maximum Extended Load Line Limit Analysis Plus MFLCPR Maximum Fraction of Limiting Critical Power Ratio MLOCA Medium LOCA MNGP Monticello Nuclear Generating Plant MSCWLL Minimum Steam Cooling Water Level Limit 1-7. C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment MSIV Main Steam Isolation Valve MSL Main Steam Line MWt Megawatt (thermal)

NEI Nuclear Energy Institute NPSH Net Positive Suction Head NRC Nuclear Regulatory Commission MELLLA Maximum Extended Load Line Limit Analysis NSSS Nuclear Steam Supply System NTSP Nominal Trip Setpoint OLMCPR Operating Limit for Minimum Critical Power Ratio OOS Out Of Service PCPL Primary Containment Pressure Limit PCT Peak Clad Temperature PRA Probabilistic Risk Assessment (alternative term for PSA)

PSA Probabilistic Safety Assessment (alternative term for PRA)

PSSA Probabilistic Shutdown Safety Assessment RAW Risk Achievement Worth (risk importance measure)

RBCCW Reactor Building Closed Cooling Water RBM Rod Block Monitor RCIC Reactor Core Isolation Cooling RHR Residual Heat Removal RHRSW RHR Service Water RPS Reactor Protection System RPT Recirculation Pump Trip RPV Reactor Pressure Vessel RWCU Reactor Water Clean-Up SAMG Severe Accident Management Guidelines SBO Station Blackout SDC Shutdown Cooling SLCS Standby Liquid Control System SLO Single Loop Operation.

SLOCA Small LOCA SMA Seismic Margins Analysis SORV Stuck Open Relief Valve SPC Suppression Pool Cooling SRV Safety Relief Valve SRVOOS Safety Relief Valve Out of Service SSC Systems, Structures, and Components STP Simulated Thermal Power 1-8 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment SV Safety Valve TAF Top of Active Fuel TLO Two Loop Operation TRC Time Reliability Correlation TRM Technical Requirements Manual TS Technical Specification USAR Updated Safety Analysis Report VB Vacuum Breaker MNGP Monticello Nuclear Generating Plant WW Wetwell 1.4' GENERAL ASSUMPTIONS The MNGP MELLLA+ risk evaluation includes a limited number of general assumptions, as follows:

This analysis is based on all the inputs provided by Xcel in support of this assessment. For systems where no hardware or procedural changes have been identified, the risk evaluation is performed assuming no impact as a result of MELLLA+.

° The plant and procedural changes identified by Xcel are assumed to, reflect the as-built, as-operated plant after MELLLA+ is fully implemented.

Replacement of components with enhanced like components does not result in any supportable significant increase in the long-term failure probability for the components.

The PRA success criteria are different than the success criteria used for design basis accident evaluations. The PRA success criteria assume that systems that can realistically perform a mitigation function (e.g.,.

main condenser or containment venting for-decay heat removal) are credited in the PRA model. In addition, the PRA success criteria are based on the availability of a discrete number of systems or trains (e.g.,

number of pumps for RPV makeup).

1-9 C495070003-8976-1 2/21/09

Monticello MELLLA + Risk Assessment Section 2 SCOPE The scope of this risk assessment for the proposed MELLLA+ operating region at Monticello addresses the following plant risk contributors:

Level 1 Internal Events At-Power (CDF)

Level 2 Internal Events At-Power (LERF)

External Events At-Power

- Seismic Events

- Internal Fires

- Other External Events Shutdown Assessment The scope of this report includes assessment of the risk impacts due to internal events (including internal flooding scenarios) using as the base reference model the MNGP Level 1 and Level 2 EPU MELLLA PRA average maintenance model (fault tree Risk-T&M-EPU.caf).. The. Level 1 PRA risk metric used in this risk assessment is Core Damage Frequency (CDF). Level 2 PRA sequences resulting in the PRA Large-Early release category comprise the LERF risk measure used in this risk assessment The impact on external events risk is assessed using the analyses of the Monticello Individual Plant Examination of External Events (IPEEE) Submittal [10] and industry studies (e.g., NUREG/CR-6850).

MELLLA+" has no impact on the risk associated with accidents initiated during shutdown conditions.

As discussed in Section 3, all PRA elements are reviewed to ensure that identified MELLLA+ plant changes that could affect the risk profile are addressed. The information input to this process consisted of preliminary design, procedural, and training information 2-1 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment provided by Xcel. The final design, analytical calculations, and procedural changes had not been completed prior to this risk assessment.

2-2 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Section 3 METHODOLOGY This section of the report addresses the following:

e Analysis approach used in this risk assessment (Section 3.1)

Identification of principal elements of the risk assessment that may be affected by MELLLA+ and associated plant changes (Section 3.2)

Plant changes used as input to the risk evaluation process (Section 3.3)

Scoping assessment (Section 3.4) 3.1 ANALYSIS APPROACH The purpose of this analysis is to assess the plant-specific risk impact (relative to the EPU MELLLA risk profile) associated with MELLLA+ implementation. This analysis is performed consistent with approved guidance documents (e.g., RG 1.174 [24], NEDC-33006P [8], NEDC-32424P-A [13], NEDC-32523P-A [14], and NEDC-33004P-A [23]).

All of the seven PRA topics identified in NEDC-33004P are addressed in this analysis as they apply to the MELLLA+ risk impact. This risk assessment also considers the RAIs on the MNGP EPU LAR (References [19] and [20])* and integrates those issues as appropriate into this analysis.

In addition, Matrix 13 of the NRC Review Standard for Extended Power Uprates (RS-001) is used as the template for the approach to this MELLLA+ risk assessment.[16] Refer to Appendix B for a roadmap of the RS-001 Matrix 13 risk assessment criteria and where in this MELLLA+ risk assessment report the issues are discussed.

3-1 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment The approach used to examine risk profile changes is further described in the following subsections.

3.1.1 Identify PRA Elements This task is to identify the key PRA elements to be assessed as part of this analysis for potential impacts associated with plant changes. The identification of the PRA elements uses the NEI PRA Peer Review Guidelines.[4] Section 3.2 summarizes the PRA elements assessed in this risk assessment.

3.1.2 Gather Input The input required for this assessment is the identification of any plant hardware modifications, procedural or operational changes that are to be considered part of the proposed MELLLA+ operating region. This includes changes such as instrument setpoint changes, added equipment, and procedural modifications.

3.1.3 Scoping Evaluation This task is to perform a scoping evaluation by reviewing the plant input against the key PRA elements. The purpose is to identify those items that require further quantitative analysis and to screen out those items that are judged to have negligible or no impact on plant risk as modeled by the MNGP PRA.

3.1.4 Qualitative Results The result of this task is a summary which dispositions all the risk assessment elements regardingthe effects of the proposed MELLLA+. The disposition consists of three Qualitative Disposition Categories:

3-2 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Category A: Potential PRA change. PRA modification desirable or necessary Category B: Minor perturbation, negligible impact on PRA, no PRA changes required Category C: No change A.short explanation providing the basis for the disposition is provided in Section 4.

3.1.5 Implement and Quantify Required PRA Chanqes This task is to identify the specific PRA model changes required to reflect the MELLLA+

condition, implement them, and quantify the PRA model. Section 4.1 summarizes the review of PRA analysis impacts associated with the increased power level. These effects and other effects related to plant or procedural changes are identified and documented in Section 4.

3.2 PRA ELEMENTS ASSESSED The PRA elements to be evaluated and assessed can be derived from a number of sources. The NEI PRA Peer Review Guidelines [4] provide a convenient division into "elements" to be examined.

Each of the major risk assessment elements .is examined in this evaluation. Most of the risk -assessment elements are anticipated to be unaffected by MELLLA+. The risk assessment elements addressed in this evaluation for impact due to MELLLA+ .(refer to Section 4 for impact evaluation) include the following:

Initiating Events

Systemic/Functional Success Criteria, e.g.:

- RPV Inventory Makeup

- Heat Load to the Suppression Pool

-. Time to Boildown 3-3 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Blowdown Loads RPV Overpressure Margin SRV Actuations SRV Capacity for ATWS

Accident Sequence Modeling

System Modeling

. Failure Data

Human Reliability Analysis

Structural Evaluations

Quantification

Containment Response (Level 2) 3-4 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment 3.3 INPUTS (PLANT CHANGES)

This section summarizes the plant changes due to MELLLA+. The plant changes are summarized in Table 3-1 and are discussed below.

3.3.1 Hardware Modifications There are no hardware modifications for MELLLA+ of any importance to the PRA. None of the systems credited in the MNGP PRA require any hardware modifications for MELLLA+.

Thermal-Hydraulic Stability Detection Modifications The MELLLA+ reactor operating domain requires an update to the plant software configuration, including the process computer and applicable operating procedures.

Core instabilities may occur in a BWR when the reactor is operated at a relatively high power-to-flow ratio and recirculation flow is reduced (e.g., trip of a recirculation pump or both recirculation pumps). Core instabilities are manifested by oscillations in reactor power. As long as the oscillations remain small, they tend to repeat on approximately a two second period. Under some conditions large power oscillations may grow and develop into random power pulses.

In addition to administrative controls to scram the plant if an exclusion zone of reactor operation is entered, MNGP employs OPRMs (Oscillation Power Range Monitors) and the DSS-CD (Detect and Suppress Solution - Confirmation Density) algorithm to automatically

.detect the inception of power oscillations and generate a power suppression trip signal prior to significant oscillation amplitude growth. For the current MELLLA condition the PBDA (Period Detection Based Algorithm) algorithm is the licensing basis for tripping the plant in response to thermal-hydraulic stability issues (ABA, Amplitude Based Algorithm, 3-5 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment and GRA, Growth Rate Algorithm are the backup, defense-in-depth, stability detection algorithms). The CDA (Confirmation Density Algorithm) algorithm is also employed at MNGP but is currently not connected to RPS. As part of MELLLA+, MNGP will employ the CDA algorithm as the primary detection function for a stability event instead of the PBDA (Period Detection Based Algorithm) algorithm. The CDA algorithm is designed to result in a faster trip, if necessary, than PBDA. The PBDA function and associated setpoints will be maintained for defense-in-depth (in addition to ABA and GRA).

With, the MELLLA+ condition, trip of a single recirculation pump could result in an automatic plant trip depending upon the operational conditions of the plant at the time of the pump trip. Operation at the MELLLA+ condition can be postulated to increase the

.frequency of a plant trip given the potential for operation at higher power-to-flow ratios at the time of a recirculation pump trip; however, the CDA trip is anticipatory in design and faster in response than PBDA such that the margin to MCPR (Minimum Critical Power Ratio) actually increases for MELLLA+ versus MELLLA.. Any such initiator frequency change would be speculative. No direct or significant impact on plant transient frequencies is indicated; however, a quantitative sensitivity case is investigated in this study to determine the impact on the.risk impact results if the frequency of transient initiators is conservatively postulated to increase due to the proposed changes.

Power oscillations during ATWS accidents have been analyzed generically in Reference

[8]. Boron injection and water level control strategies effectively mitigate an ATWS instability event. Based on Reference [8], MELLLA+ does not increase the probability of violating ATWS acceptance criteria. The MNGP plant-specific ATWS instability calculation (TR T0202) confirmed the conclusions of Reference [8].

3.3.2 Procedural Changes No changes to the MNGP EOPs/SAMGs or Abnormal Operating Procedures are required for MELLLA+.

3-6¸ C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Changes will be needed for all associated plant procedures, training -documents, the process computer, Main Control Room (MCR) displays, and MCR Simulator related to the APRM setpoint changes discussed below.

3-7 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 3-1

SUMMARY

OF MELLLA+ PLANT CHANGES AND ASSOCIATED POTENTIAL IMPACT ON PRA MELLLA+

Task Impacts Report Task Report Title PRA Discussion T0100 Reactor Heat Balance No The reactor heat balances developed in this task has no direct effect on the Monticello plant configuration or design operating margin. MELLLA+ does not change the reactor thermal power, operating pressure; steam flow, or feedwater flow.

No impact on PRA due to this MELLLA+ Task Report scope and results.

T0200 Reactor Core and Fuel No No fuel product line design changes or fuel design. limit changes are Performance necessary.as a consequence of MELLLA+. Also, there is no change to the average power density. as a result of MELLLA+. Final OLMCPR values greater than identified will result in MFLCPR margins less than design margins used. Various EOOS (equipment out of service) options that significantly increase the OLMCPR would likely necessitate fuel and core design changes to maintain desired MCPR margin requirements. Such issues have no direct impact on the PRA models or assumptions.

No impact on PRA due to this MELLLA+ Task Report scope and results.

T0201 . Power/Flow Map No!T The power/flow map is used as input to subsequent MELLLA+ safety analysis tasks. Any direct effect on other Systems, Structures or Components (SSC) and design features are discussed separately in other Task Reports. No NRC approved computer codes are needed to develop the MELLLA+ reactor operating domain power/flow map.

The MELLLA+ reactor operating domain requires an update to. the plant software configuration, including the process computer and applicable operating procedures. Such issues have no direct impact on the PRA models or assumptions.

One may postulate an increase in the frequencyof transient initiators due to changes in the plant software and break-in of the software. A quantitative sensitivity case is investigated in this study to determine the impact on the risk impact results.

3-8 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 3-1

SUMMARY

OF MELLLA+ PLANT CHANGES AND ASSOCIATED POTENTIAL IMPACT ON PRA MELLLA+

Task Impacts Report Task Report Title PRA Discussion T0202 Thermal-Hydraulic Stability Noý') The result of this evaluation confirms that MELLLA+ has no direct .impact on MNGP design operating margin. Backup stability protection (BSP) region boundaries will be provided on a cycle-specific basis for each fuel cycle.

These evaluations may show plant configuration impacts for the specific fuel cycles they are intended to cover. Single loop operation (SLO) requires implementation of certain DSS-CD setpoints different than two loop operation (TLO), which provides added protection against spurious plant trips and is administratively controlled for prompt implementation after entering SLO.

As part of MELLLA+, the MNGP thermal-hydraulic stability algorithm will employ the CDA (Confirmation Density Algorithm) algorithm as the primary detection function for a stability event instead of the PBDA (Period Detection Based Algorithm) algorithm. The PBDA function and associated setpoints will be used for defense in depth. The CDA trip is anticipatory in design and faster in response than PBDA such that the margin to MCPR (Minimum Critical Power Ratio) actually increases for MELLLA+ versus MELLLA.

With the MELLLA+ condition, trip of a single recirculation pump could .cause an automatic plant trip depending upon the operational conditions of the plant.

No direct or significant impact on plant transient frequencies is indicated; however, a quantitative sensitivity case is investigated in this study to determine the impact on the risk impact results if the frequency of transient initiators is conservatively *postulated to increase due to the proposed changes.

Power oscillations during ATWS accidents have been analyzed generically in Reference [8]. Boron injection and water level control strategies effectively mitigate an ATWS instability event. Based on Reference [8], MELLLA+ does not increase the probability of violating ATWS acceptance criteria. The MNGP plant-specific ATWS instability calculation (TR T0202) confirmed the conclusions of Reference [8].

3-9¸ C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 3-1

SUMMARY

OF MELLLA+ PLANT CHANGES AND ASSOCIATED POTENTIAL IMPACT ON PRA MELLLA+

Task Impacts Report Task Report Title PRA Discussion T0304 Reactor Internal Pressure No There is no direct impact on plant configuration or impact on design operating Differences & Fuel Lift Evaluation margins. MELLLA+ implementation will have no impact on operation in the increased core flow (ICF) portion or MELLLA region of the power-flow map.

SRV OOS has no impact on Acoustic and Flow induced loads as the key parameter of sub-cooling conditions for the loads remains unchanged., ARTS has no impact on reactor internal pressure differences.. Single loop operation is not allowed in the MELLLA+ region of the power-flow map. MELLLA+

operation will therefore not impact the basis for single loop operation.

No impact on PRA due to this MELLLA+ Task Report scope and results.

T0306 Steam Dryer/Separator No There is no direct impact on plant configuration or impact on design operating Performance . margins. The moisture content of steam leaving the RPV is not expected to exceed the current performance evaluation value of (< 0.5 wt%) and the carry under of the water leaving the separators may change slightly. Such issues have no direct impact on the PRA models or assumptions.

No impact on PRA due to this MELLLA+ Task Report scope and results.

T0313 RPV Flux Evaluation No There is no direct impact on plant configuration or impact on design operating margins. Flux calculation results are used in other Task Report calculations.

Such issues have no direct impact on the PRA models or assumptions.

No impact on PRA due to this MELLLA+ Task Report scope and results.

3410 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 3-1

SUMMARY

OF MELLLA+ PLANT CHANGES AND ASSOCIATED POTENTIAL IMPACT ON PRA MELLLA+

Task Impacts Report Task Report Title PRA Discussion T0400 Containment System Response No There is no direct impact on plant configuration or impact on design operating.

margins. MELLLA+ does not involve changes to the containment structure and does not involve changes to the reactor thermal power or operating pressure.

Because the sensible and decay heat do not change in the MELLLA+

operating domain, the long-term peak suppression pool temperature response does not change. Because the SRV setpoints and sensible and decay heat do not change in the MELLLA+ operating domain, the SRV loads do not change.

In the Short Term Containment Analysis and Dynamic Load Analysis, the currently licensed options (MELLL, ICF (105%), and SRVOOS) are not significantly affected by MELLLA+.

No impact on PRA due to this MELLLA+ Task Report scopeand results.

3-11 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 3-1

SUMMARY

OF MELLLA+ PLANT CHANGES AND ASSOCIATED POTENTIAL IMPACT ON PRA MELLLA+

Task Impacts Report Task Report Title PRA Discussion T0401 Sub-Compartment (Annulus) No The annulus pressurization under MELLLA+ conditions by failure of a nozzle Pressurization Loads or safe end is calculated to be 41.7 psi which is less than the design of 58 psid, therefore MELLLA+ does not affect the design of the RPV support pedestal and ring truss connections. At the bounding minimum recirculation, pump speed operating point the annulus pressurization is calculated to be 42.3 psi which is less than the design of 58 psid.

The shield bricks around the reactor recirculation inlet and outlet piping have been replaced with shield doors to allow easier access for inspection of the pipe Welds that are located within the biological shield wall opening. At MELLLA+ conditions there, is a 12.3 psi margin in the design of the Recirculation Piping Penetration Biological Shield Wall Steel Doors during postulated nozzle or safe end failure event.

The potential for missiles has been eliminated by removing all of. the shield bricks from the bioshield wall penetrations.

No impact on PRA due to this MELLLA+ Task Report scope and results.

3-12 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 3-1

SUMMARY

OF MELLLA+ PLANT CHANGES AND ASSOCIATED POTENTIAL IMPACT ON PRA MELLLA+

Task Impacts Report Task Report Title PRA Discussion T0407 ECCS-LOCA SAFER/GESTR No All 10CFR50.46 acceptance criteria for the application of theý GEl 4 fuel in the MELLLA+ region are met.

The LHGR set-down has been increased to 12.3% in the MELLLA+ region so that the peak clad temperature (PCT) results are bounded by the limiting EPU PCT result. The CLTP at MELLLA core flow condition is preserved as the basis for Licensing Basis PCT, thus, preserving a comparable measure of margin to the 2200°F Acceptance Criterion limit throughout the expanded operating domain.

The Licensing Basis PCT, established by the EPU evaluation at CLTP power

/ MELLLA flow, is unaffected by MELLLA+ and it remains 2140'F for GE14 fuel.

Recirculation drive flow mismatch limits remain acceptable in the MELLLA+

domain.

The ECCS-LOCA analysis has demonstrated that temporary plant operation with three SRV OOS remains acceptable at MELLLA+ conditions.

No impact on PRA due to this MELLLA+ Task Report scope and results.

r3-13 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 3-1

SUMMARY

OF MELLLA+ PLANT CHANGES AND ASSOCIATED POTENTIAL IMPACT ON PRA MELLLA+

Task Impacts Report, Task Report Title PRA Discussion T0506 TS Instrument Setpoints No(') The CDA algorithm will replace PBDA as the primary detection function for. a stability event (the PBDA function and associated setpoints will be used for defense in depth); refer to earlier discussion in this table for Task Report T0202.

The APRM Flow Biased (FB) Simulated Thermal Power (STP) High Scram at

high Recirc flow rate setpoint has a new nominal trip setpoint (NTSP) for MELLLA+ conditions.

The APRM FB STP Rod Block at high Recirc flow rate setpoint has a new NTSP for MELLLA+ conditions.

The instrumentation for the .above changed setpoint functions needs to be recalibrated for revised NTSPs. Changes will be needed for all associated plant procedures, training documents, the process computer, Main Control Room (MCR) displays, and MCR Simulator.

These changes remain within design limits. No reduction in design operating margins occurs due to these changes.

Operation at MELLLA+ conditions does not require changes to the TS RBM trip or enable setpoints. Operation at MELLLA+ conditions requires changes to the TLO APRM flow biased rod block and scram TS and TRM setpoints.

The changes to the flow biased TLO scram line is maintained with approximately the same margin between the MELLLA+ operating region and the APRM trip as exists for MELLLA.

One may postulate an increase in the frequency of transient initiators due to changes in setpoints and software. A quantitative sensitivity case is investigated in this study to determine the impact on the risk impact results..

3-1'4 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 3-1

SUMMARY

OF MELLLA+ PLANT CHANGES AND ASSOCIATED POTENTIAL IMPACT ON PRA MELLLA+

Task Impacts Report Task Report Title PRA Discussion T0609 Standby Liquid Control System No MELLLA+ does not impose changes to the SLC system or success criteria:

Minimum weight of neutron absorber required for injection for reactor cold shutdown remains unchanged.

Minimum solution volume/concentration required for Injection remains unchanged

Minimum required boron injection rate requirements remains unchanged

Minimum allowable flow rate requirements for the SLCS pump remains unchanged

Instrumentation and setpoints remain unchanged

Design flow rate, BHP and NPSH requirements for the SLCS pump remain unchanged No impact on PRA due to this MELLLA+ Task Report scope and results.

T0900 Transient Analysis No There is no direct impact on plant configuration or impact on design operating margins.

MELLLA+ has no impact on the ASME overpressure relief required.

MELLLA+ has non-significant impact on other transient analysis results. No success criteria or scenario timings are impacted by MELLLA+.

No impact on PRA due to this MELLLA+ Task Report scope and results.

3-15 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 3-1

SUMMARY

OF MELLLA+ PLANT CHANGES AND ASSOCIATED POTENTIAL IMPACT ON PRA MELLLA+

Task T

Impacts Report Task Report Title PRA Discussion T0902 Anticipated Transients Without Yes There is no direct impact on plant configuration; however, using the licensing Scram basis code ODYN, in order to achieve RPV peak pressure results below the ASME Service Level C limit of 1500 psig, no SRV OOS is allowed at MELLLA+, compared to 1 SRV OOS for MELLLA. The more realistic TRACG calculations show that 1 SRV OOS is acceptable for the MELLLA+ condition.

The base case quantification in the risk assessment assumes that 0 SRVs OOS are allowed (consistent with the licensing basis code ODYN) for an ATWS'scenario.

Review of the MELLLA and MELLLA+ ATWS Task Reports shows that the assessed ATWS power is approximately 10% higher for the MELLLA+

condition (until SLC is injected as the alternate reactivity control). This potential increase in ATWS power does not impact the injection systems credited for initial level/power control in the PRA. The only impacts for the PRA modeling are shorter operator action times for ATWS level/power control in the PRA and potential increased SRV cycling.

Power oscillations during ATWS accidents have been analyzed generically in Reference [8]. Boron injection and water level control strategies effectively mitigate an ATWS instability event. Based on Reference [8], MELLLA+ does not increase the probability of violating ATWS acceptance criteria. The MNGP plant-specific ATWS instability calculation (TR T0202) confirmed the conclusions of Reference [8]. Failure to inject SLC and to control water level are already included in the MNGP PRA as failures that lead to core damage during an ATWS scenario.

3-16 - C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Notes to Table 3-1:

(1) No direct impact on PRA is expected or identified. However, a quantitative sensitivity case is performed to address sensitivity of results to postulated change in transient initiating event frequency due to a break-in period associated with changes in software and setpoints.

3-17 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment 3.3.3 Setpoint Changes Operation at MELLLA+ conditions requires changes. to the two loop operation (TLO)

APRM flow biased rod block and scram TS and TRM setpoints. The changes to the flow biased TLO scram line is maintained with approximately the same margin between the MELLLA+ operating region and the APRM trip as exists for MELLLA.

The APRM Flow Biased (FB) Simulated. Thermal Power (STP) High Scram at high Recirc flow rate setpoint has a new nominal trip setpoint (NTSP) for MELLLA+ conditions.

The APRM FB STP Rod Block at high Recirc flow rate setpoint has a new NTSP for MELLLA+ conditions.

The instrumentation for the above changed setpoint functions needs to be recalibrated for revised NTSPs. .Changes will be needed for-all associated plant .procedures, training documents, the process computer, Main Control Room (MCR) displays, and MCR Simulator.

These changes remain within design limits. No reduction in design operating -margins occurs due to these changes.

3.3.4 Plant Operating Conditions MELLLA+ does not change the reactor thermal power, operating pressure, steam flow, or feedwater flow.

MELLLA+ also does not change the operating conditions of systems modeled in the PRA.

3-18 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment 3.4 SCOPING EVALUATION The scoping evaluation examines the hardware, procedural, setpoint, and operating condition changes to identify the potential PRA impacts that need to be considered in this risk assessment. The scoping evaluation conclusions reached are discussed in the following subsections.

3.4.1 Hardware Changes The hardware and software changes required to support MELLLA+ (see Section 3.3.1) were reviewed and determined not to result in new accident types or increased frequency of challenges to plant response. There are no hardware changes of note to the plant (physical changes to the plant are limited to MCR displays and plant computer changes).

No changes to system or component response -times other than the faster response time for an instability trip due to use of CDA as the primary detection algorithm (refer to Section 3.3.1). This response time change has no impact on initiating event frequencies or PRA accident mitigation modeling.

No change to the PRA in this risk assessment is necessary related to hardware and software changes. Such modifications are adjustments to maintain plant reliable operation and margins. Although equipment reliability as reflected in failure rates can be theoretically postulated to behave as a "bathtub" curve (i.e., the beginning and end of life

.phases being associated with higher failure -rates than the steady-state period),. no

.significant impact on the long-term average of initiating event frequencies, or equipment reliability during the 24 hr. PRA mission time due to the replacement/modification of plant components is anticipated, nor is such a quantification supportable at this time. If any degradation were to occur as a result of MELLLA+ implementation, existing plant monitoring programs would address any such issues.

3-19 C495070003-8976-12/21/09

Monticello MELLLA +'Risk Assessment No direct or significant impact on plant transient frequencies is indicated; however, a quantitative sensitivity case is investigated in this study to determine the impact on the risk impact results if the frequency of transient initiators is conservatively postulated to increase due to the proposed changes.

3.4.2 Procedure Changes The procedure changes related to MELLLA+ were reviewed (see Section 3.3.2) and all such changes have no direct impact on the PRA .(no changes to EOPs/SAMGs or Abnormal Operating Procedures). No change to the PRA in this risk assessment is necessary related to procedure changes.

3.4.3 Setpoint Changes Setpoint- changes for MELLLA+ have no direct impact on the PRA, ..These changes remain within design limits. No reduction in design operating margins occurs due to these changes.

No direct or significant impact on plant transient frequencies is indicated; however, a quantitative sensitivity case is investigated in this study to determine the impact on the risk impact results if-the frequency of transient initiators is conservatively postulated to increase due to the proposed changes.

3.4.4 Normal Plant Operational Changes No plant configuration or operational changes are required for MELLLA+ that would have any direct impact on the PRA. No change to the PRA in this risk assessment is necessary related to procedure changes.

3-20 C495070003-8976-1 2/21/09

Monticello MELLLA + Risk Assessment No direct-or significant impact on plant transient frequencies is indicated; however, a quantitative sensitivity case is investigated in this study to determine the impact on the risk impact results if the frequency of transient initiators is conservatively postulated to increase due to the proposed changes (refer to.Sections 3.3.1 and 5.7-1).

3-21 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Section 4.

PRA CHANGES RELATED TO MELLLA+

Section 3 has examined the plant changes (hardware, procedural, setpoint, and operational) that are part of MELLLA+. Section 4 examines these changes to identify MNGP PRA modeling changes necessary to quantify the risk impact of MELLLA+. This section discusses the following:

Individual PRA elements potentially affected (Section 4.1)

" Level 1 PRA (Section 4.2)

" Internal Fires Induced Risk (Section 4.3)

Seismic Risk (Section 4.4)

Other External Hazards Risk (Section 4.5)

Shutdown Risk (Section 4.6)

. Radionuclide Release - Level 2 PRA (Section 4.7) 4.1 PRA ELEMENTS POTENTIALLY AFFECTED BY MELLLA+

A review of the PRA elements has been performed to identify potential effects associated with MELLLA+. The result of this task is a summary which dispositions all PRA elements regarding the effects of MELLLA+. The disposition consists of three Qualitative Disposition Categories.

Category A: Potential PRA change, PRA modification desirable or necessary Category B: Minor perturbation, negligible impact on PRA, no PRA changes required Category C: No change Table 4.1-1 summarizes the results from this review. Based on Table 4.1-1, only a small number of the PRA elements are found to be potentially influenced by MELLLA+.

4-1 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment The following PRA elements are discussed in Table 4.1-1 to summarize whether they may be affected by MELLLA+.

Initiating Events

Systemic/Functional Success Criteria, e.g.:

- RPV Inventory Makeup

- Heat Load to the Suppression Pool

- Time to Boildown

- Blowdown Loads

- RPV Overpressure Margin

- SRV Actuations

- SRV Capacity for ATWS

Accident Sequence Modeling

System Modeling

Failure Data

Human Reliability Analysis

Structural Evaluations

Quantification

Containment Response (Level 2) 4.1.1 Initiating Events The evaluation has examined whether there may be increases in the frequency of the initiating events or whether there may be new types of initiating events introduced into the risk profile.

The MNGP PRA program encompasses an effectively exhaustive list of hazards and accident types (i.e., from simple non-isolation transients, e.g., Turbine Trip w/Bypass, to ATWS scenarios to internal fires to hurricanes to toxic releases to draindown events during 4-2 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment refueling activities, and numerous others). Extensive and unique changes to the plant would have to be implemented to result in new previously unidentified accidents; this is not the case for MELLLA+.

The MNGP PRA initiating events can be categorized into the following:

Internal Event Initiators

- Transients

- LOOP

- LOCAs

- Support System Failures 0 Internal Floods

External Events Internal Events The plant and procedural changes for MELLLA+ core operating range expansion does not result in any new transient initiators, nor is there anticipated any direct significant impact on internal event initiator frequencies due to MELLLA+.

Setpoint changes are established to maintain margin and operational flexibility. The minor setpoint changes are not expected to result in a direct or significant impact on internal events initiating event frequencies.

The applicability of generic and plant specific data used to derive initiating event frequencies remains applicable for the MNGP MELLLA+ risk assessment. The modifications and plant configuration changes for MELLLA+ do not warrant any changes to the MNGP PRA initiating event frequencies. The MNGP MELLLA+ implementation is not expected to have a material effect on component or system reliability as equipment operating limits, conditions, and/or ratings are not exceeded. New trains of equipment are 4-3 C495070003-8976-1 2/21/09

Monticello MELLLA + Risk Assessment not being added or removed. Support system dependencies are not being altered. MNGP will: continue to evaluate equipment degradation and reliability using existing plant monitoring programs. Consequently, no significant impact on the long-term average of initiating event frequencies is anticipated.

With the MELLLA+ condition, trip of a single recirculation pump could result in an automatic plant trip depending upon the operational conditions of the plant at the time of the pump trip. Operation at the MELLLA+ condition.may be postulated to increase the frequency-of a plant trip given the potential for operation at higher power-to-flow ratios at the time of a recirculation pump trip; however, the CDA trip is anticipatory in design and faster in response than PBDA such that the margin to MCPR (Minimum Critical Power Ratio) actually increases for MELLLA+ versus MELLLA. Any such initiator frequency change would be speculative. No direct or significant impact on plant transient frequencies is indicated; however, a quantitative sensitivity case is investigated in this study to determine the impact on the risk impact results if the frequency of transient initiators is conservatively postulated to increase due to the proposed changes.

No changes to RCS piping inspection scopes or frequencies are being made for MELLLA+. In addition, MELLLA+ does not involve any changes to the RPV operating temperature and pressure or to feedwater flow. As such, no impacts on LOCA frequencies can be postulated.

The MELLLA+ operating range expansion has no impact on the probability of scram failure.

Internal Flood Initiators No changes to pipe inspection scopes or frequencies are being made for MELLLA+. In addition, MELLLA+ does not involve any changes to the flow characteristics or piping 4-4 C495070003-8976-12/21/09

Monticello MELLLA+ .Risk Assessment boundaries of any fluid bearing system in the plant. As such, no impacts on internal flooding initiator frequencies due to MELLLA+ are postulated.

External Event Initiators The frequencies of external event initiators (e.g., seismic events, extreme winds, fires) are not linked to reactor power/operation issues; as such, no impact on external event initiator frequencies due to MELLLA+ can be postulated.

4.1.2 Success Criteria The success criteria for the Monticello PRA are based on realistic evaluations of system capability over the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time of the PRA analysis. These success criteria therefore may be different than the design basis assumptions used for licensing Monticello. This report examines the risk profile changes caused by MELLLA+--from a realistic perspective to identify changes in the risk profile that may result from severe accidents on a best estimate basis. The following subsections discuss different aspects of the success criteria as used in the PRA. MELLLA+ task reports were also used to assist in assessing impacts on success criteria.

4.1.2.1 Timing The MELLLA+ operating region is postulated to result in higher potential-ATWS power, thus reducing operator action timings during ATWS scenarios. The reduction in timings can impact the human error probability calculations. See HRA discussion in Section 4.1.6.

4-5 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment 4.1.2.2 RPV Inventory Makeup Requirements The PRA success criteria for RPV makeup remains the same for MELLLA+ as for the MELLLA condition.

The plant changes for MELLLA+ do not involve changes to injection systems and does not change the rated reactor power level or operating pressure. As such, the injection system success criteria for non-ATWS scenarios are unchanged for MELLLA+.

.The MELLLA+ operating region is postulated to result in higher potential ATWS power, thus reducing operator action timings. Review of the MELLLA and MELLLA+ ATWS Task Reports shows that the assessed ATWS power is approximately 10% higher for the MELLLA+ condition (until SLC is injected as the alternate reactivity control). This increase in potential ATWS power does not impact the injection systems credited for initial level/power control in the PRA. The only impact relates to shorter operator action times for ATWS level/power control in the PRA. See HRA discussion in Section 4.1.6.

4.1.2.3 Heat Load to the Pool The plant changes for MELLLA+ do not involve changes to containment heat removal systems and does not change the rated reactor power level. As such, the heat load to the suppression pool and the containment heat removal success criteria for non-ATWS scenarios are unchanged for MELLLA+.

The MELLLA+ operating region is postulated to result in higher potential ATWS power (10%-higher for the MELLLA+ condition until SLC injection is completed, as discussed previously). The PRA models containment heat removal for mitigated ATWS scenarios (i.e., ATWS scenarios without level/power control are modeled as leading directly to containment failure and core damage; thus, RHR is not applicable to unmitigated ATWS scenarios). The MELLLA+ condition has no impact on the success criteria for 4-6 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment containment heat removal options for mitigated ATWS scenarios given that the long-term containment response is non-significantly affected by MELLLA+. The only impact relates to shorter operator action times for initiation of RHR SPC. See HRA discussion in Section 4.1.6.

4.1.2.4 Blowdown Loads The containment analyses for LOCA under MELLLA+ conditions indicate that dynamic loads on containment remain acceptable.

4.1.2.5 RPV Overpressure Margin The RPV dome operating pressure will not be increased as a result of MELLLA+;

however, the MELLLA+ operating region is postulated to result in higher potential ATWS power (approximately 10% higher for the MELLLA+ condition until SLC injection is completed).

The MNGP MELLLA PRA requires two (2) SRVs to open for initial pressure control during a transient. The MELLLA+ condition has no impact on this success criterion.

The MNGP MELLLA PRA does not require any SRVs for initial RPV overpressure control for LOCA initiators. This success criterion also remains unchanged for MELLLA+.

The MNGP EPU MELLLA PRA uses a success criterion of 7 of 8 SRVs required for RPV initial overpressure protection during an isolation ATWS scenario (e.g., MSIV Closure ATWS).. The license-based ODYN software calculations performed for the MELLLA+

condition require all SRVs to be functional, no SRVs can be out .of service, to maintain the RPV pressure spike below the ASME Service Level C limit of 1500 psig during an isolation ATWS event; such as an MSIV Closure ATWS (refer to MELLLA+ Task Report 0902, "ATWS'). Isolation ATWS scenario (e.g., MSIV Closure ATWS) calculations performed using the TRACG software are also documented in MELLLA+ Task Report 0902. The

.4-7 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment TRACG software calculations showed that. SRV can be OOS for an isolation ATWS scenario (e.g., MSIV Closure ATWS) and the RPV pressure spike remains below the ASME Service Level C limit.

4.1.2.6 SRV Actuations Given the MELLLA+ operating region is postulated to result in higher potential ATWS power (10% higher for the MELLLA+ condition until SLC injection is' completed, as discussed previously), this risk assessment reasonably assumes an associated increase in the number of SRV cycles during the ATWS response (MELLLA vs MELLLA+ condition). As such, one may postulate an increase in the probability of a stuck open relief valve during an ATWS scenario due to an increase in the number of SRV cycles (i.e., the stuck open relief valve probability is estimated as a failure rate per cycle x no. of SRV cycles).

The stuck open relief valve probability during ATWS response used in the MNGP EPU MELLLA PRA is 2.26E-2 (basic event XVR-ATWS-C). This stuck open relief valve

-probability may be modified using different approaches to consider the effect of a postulated increase in valve cycles. The following three approaches are considered:

1. The upper bound approach would be to increase the stuck open relief valve probability by a factor equal to the increase in potential ATWS power (i.e., a factor of 1.1). This approach assumes that the stuck open relief valve probability is linearly related to the number of SRV cycles, and that the number of cycles is linearly related to the potential ATWS power increase.

2. A less conservative approach to the upper bound approach would be to assume that the stuck open relief valve probability is linearly related to the number of SRV cycles, BUT the number of cycles is not necessarily directly related to the potential ATWS power increase. In this case, the postulated increase in SRV cycles. due to MELLLA+ would be determined by thermal hydraulic calculations (e.g., ODYN or TRACG runs).

4-8 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment

3. The lower bound approach would be to assume that the stuck open relief valve probability is dominated by, the initial cycle and that subsequent cycles have a much lower failure rate. In this approach the base stuck open -relief valve probability could be assumed to be insignificantly changed by a postulated increase in the number of SRV cycles.

Approach #1 is used here to modify the PRA stuck open relief valve probability.

Therefore, the MNGP EPU MELLLA PRA stuck open relief valve probability given the potential ATWS power is increased 10% from 2.26E-2 to 2.49E-02.

4.1.2.7 RPV Emergency Depressurization The PRA success criteria for RPV emergency depressurization remains the same for MELLLA+ as for the MELLLA condition.

The plant changes for MELLLA+ do not involve changes to ADS and does not change the rated reactor power, level or operating pressure. As such, the RPV emergency depressurization success criteria for non-ATWS scenarios are unchanged for MELLLA+.

The MELLLA+ operating region is postulated to result in higher potential ATWS power (10% higher for the MELLLA+ condition until SLC injection is completed, as discussed previously). This increase in potential ATWS power does not impact. the RPV emergency depressurization success criteria in the PRA but does impact the operator action response time (see HRA discussion in Section 4.1.6).

4.1.2.8 Success Criteria Summary The Level 1 and Level 2 MNGP PRAs have developed success criteria for the key safety functions. Tables 4.1-2 through 10 summarize these safety functions and the minimum success criteria under the current MELLLA condition and that required under the MELLLA+ condition:

4-9 C495070003-8976-12/21109

Monticello MELLLA + Risk Assessment

General Transients (Table 4.1-2)

IORV, Transient w/SORV (Table 4.1-3)

Small LOCA (Table 4.1-4)

Medium LOCA (Table 4.1-5)

Large LOCA (Table 4.1-6)

ATWS Events (Table 4.1-7)

Internal Floods (Table 4.1-8)

ISLOCA, Breaks Outside Containment (Table 4.1-9)

Level 2 (Table 4.1-10)

The only Level 1 PRA success criteria impact due to MELLLA+ is:

8 of 8 SRVs are required for the MELLLA+ condition for RPV initial overpressure protection during an isolation ATWS scenario (7 of 8 SRVs were required for the MELLLA condition) using the license-based ODYN software. The 8/8 SRVs required success criterion change is applied in this risk assessment for the base case risk calculation (refer to Figure 4.1-1). The realistic TRACG results that show 7 of 8 SRVs are sufficient is addressed in a best estimate sensitivity calculation (refer to Section 5.7-1).

There are no changes in transient (non-ATWS) or LOCA success criteria. The only change in success criteria across the entire PRA is the ATWS RPV. overpressure protection success criterion mentioned above.

No changes in success criteria have been identified with regard to the Level 2 PRA (refer to Section 4.1.9).

4.1.3 Accident Sequence Modeling The MELLLA+ condition does not change the plant configuration and operation in a manner such that new accident sequences or changes to existing accident scenario 4-10 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment progressions result. A slight exception is the reduction in available operator response time for ATWS scenarios and the associated impact on operator action HEPs (this aspect is addressed in the Human Reliability Analysis section).

4.1.4 System Modeling The MNGP plant changes associated with the MELLLA+ condition do not result in the need to. change any system fault trees to address changes -in standby or operational configurations, or the addition of new equipment.

Changes were made to the SRV fault tree logic for the base case risk quantification to address the Level 1 PRA success criterion change for ATWS RPV overpressure protection for MELLLA+ (refer to Section 4.1.2.8). The fault tree logic was adjusted as follows:

" SRV fault tree gate X028 revised from a 2-out-of-8 "K/N" logic gate to an "OR" gate, such that failure of any single SRV to open will result in RPV overpressurization."

" .SRV CCFTO (common cause failure to open) basic events removed from under SRV fault tree gate TEOVERPAT (SRVs Fail to Prevent Overpressure during ATWS) as they are not applicable given just a single SRV failure is assumed to fail this function for the MELLLA+ condition.

4.1.5 Failure Rate Data The MELLLA+ change will not involve changing any plant equipment in a way that will impact component failure rates used in the PRA.

Although equipment reliability as reflected in failure rates can be theoretically postulated to behave as a "bathtub" curve (i.e., the beginning and end of life phases being associated with higher failure rates than the steady-state period), no significant impact on the long-term average of initiating event frequencies, or equipment reliability during the 24 hr. PRA 4-11 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment mission time due to the replacement/modification .of plant components is anticipated, nor is such a quantification supportable at this time. If any degradation were to occur as a result of MELLLA+ implementation, existing plant monitoring programs would address any such issues.

4.1.6 Human Reliability Analysis MELLLA+ does not institute changes in automatic safety responses. After the applicable automatic responses have occurred, post-initiator operator actions that may be required remain the same for the MELLLA and the MELLLA+ condition. No new operator actions are required as a result of MELLLA+. No significant changes are to be made to the Control Room for MELLLA+ that would impact the MNGP PRA human reliability analysis (HRA).

The Monticello risk profile, like other plants, is dependent on the operating crew actions for successful accident mitigation. The success of these actions is in turn dependent on a number of performance shaping factors. The performance shaping factor that is principally influenced by MELLLA+ is the time available within which to detect, diagnose, and perform required actions.

The MELLLA+ operating region is postulated to result in higher potential ATWS power, thus reducing operator action timings in ATWS scenarios. Review of the MELLLA and MELLLA+ ATWS Task Reports shows that the potential ATWS power is approximately 10% higher for the MELLLA+ condition (until SLC is injected as the alternate reactivity control).

Discussion of Impact on Human Error Probabilities Table 4.1-11 summarizes the assessment of the operator actions explicitly reviewed in support of this analysis (both Level 1 and Level 2 PRA operator actions considered).

4-12 . C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Given that MELLLA+ impacts only ATWS scenario timings, the operator actions identified here for re-assessment are actions-in ATWS scenarios.

As .can be. seen in Table 4.1-11, the changes in timing are estimated to result in changes to some HEPs. The changes in allowable operator action timings were made here by reducing the allowable action time by 10% (reflective of the increase in potential ATWS power for the MELLLA+ icondition versus MELLLA). The HEPs were then recalculated using the same human reliability analysis techniques (HRA) as used in the MNGP PRA.

Section 5 summarizes the increase in the CDF and LERF associated with these HEP changes (in addition to other-model changes).

Note that- these timing changes are with respect to accident sequences modeled in a realistic manner, which allow longer time frames than design basis assumptions.

4.1.7 Structural Evaluations MELLLA+ does not involve any changes to piping systems, the RPV, or the containment structure or capability.

4.1.8 Quantification No changes in the MNGP PRA quantification process (e.g., truncation limit, etc.) due to MELLLA+ have been identified (nor were any anticipated). Small changes in the quantification results (accident sequence frequencies) were realized as a result of HEP and modeling changes made to reflect the MELLLA+.

4-13 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment.

4.1.9 Level 2 PRA Analysis Given the minor change in Level 1 CDF results, minor changes in the Level 2 release frequencies can be anticipated. Such changes are directly attributable to the changes in the Level 1 PRA.

The accident sequence modeling in the Level 2 PRA is not impacted by MELLLA+. No modeling or success criteria changes are required in the post core damage Level 2 sequences due to MELLLA+. ThetLevel 2 functions.are either conservatively based or are driven by accident phenomena. Refer to Table 4.1-10.

The MELLLA+ condition has no direct or significant impact on Level 2 PRA -safety functions, such as containment isolation, challenges to the ultimate. containment strength and ex-vessel debris cooling:

Containment Isolation: Containment isolation is demanded early in an accident scenario before extreme containment conditions manifest.

MELLLA+ has no impact on the failure probabilities of containment isolation signals or containment isolation valves.

Quasi-Static Pressure/Temperature Loading: Primary containment integrity is challenged as the containment pressurizes and temperatures increase. Containment failure can occur in a variety of locations and due to different mechanisms (e.g., high temperature seal failure, structural failure, penetration failure, drywell head lift, etc.). MELLLA+ does not involve any changes to the containment structure or capability.

Containment Dynamic Loading: These challenges include un-mitigated ATWS, LOCA loads and energetic phenomena post core damage (see bullet below). Un-mitigated (inadequate level/power control, SLC failure)

ATWS scenarios are modeled in the PRA as leading directly to a containment failure, this is a standard PRA modeling approach and is not changed due to MELLLA+. MELLLA+ LOCA dynamic loads on the containment have been calculated to be within safety and design limits.

Energqetic Phenomena: A variety of severe challenges to the primary containment post core damage have been identified in the MNGP PRA and in industry studies and guidelines. These energetic phenomena may 4-14 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment manifest at the time of the onset of core damage, the time of core slump into the lower RPV head, the time of RPV melt-through, or after core debris falls to the drywell floor and migrates. These energetic phenomena include (among others): in-vessel steam explosions, hydrogen deflagration, ex-vessel steam explosions, direct containment heating, core-concrete interaction, and drywell shell melt-through. The likelihood of each of these phenomena, and the required conditions, are based on industry generic studies and are not influenced by MELLLA+. This is a standard PRA industry practice.

Debris Coolingq: Debris cooling requirements are based on generic industry studies. . These are approximate injection flow rates to halt the progression of the core melt. The MELLLA+ condition would not impact these success criteria.

In addition, MELLLA+ has no impact on the PRA radionuclide release categorization.

MELLLA+ has no impact on radionuclide release magnitude. While the timing of ATWS scenarios can see a minor impact (e.g., reduction of 10%), this postulated timing reduction has no impact on the release timing categorization of ATWS severe accidents because all ATWS releases are assigned the earliest release categorization ("Early") in the PRA.

4-15 C495070003-8976-12/21/09

.Monticello MELLLA + Risk Assessment Table 4.1-1 REVIEW OF PRA ELEMENTS FOR POTENTIAL RISK MODEL EFFECTS Disposition PRA Element Category Basis Initiating Events B No new initiators or increased frequencies of existing initiators are anticipated to result from MELLLA+. However, quantitative sensitivity case that increases the Turbine Trip frequency is performed.

Success Criteria B RPV overpressure margin (number of SRVs/SVs required) during an ATWS impacted by MELLLA+.

Thus MELLLA PRA requires 7 of 8 SRVs for an isolation ATWS scenario. The MELLLA+ license-based ODYN calculations show 8 of 8 SRVs required; but the more realistic TRACG calculations show 7 of .8 is sufficient.

Conservative base case quantification will assume the license-based ODYN results apply, Accident Sequences C No changes in the accident sequence structure (Structure, Progression) result from MELLLA+.

The ATWS accident progression is slightly modified in timing. These changes are incorporated in the Human Reliability Analysis (HRA).

System Analysis C No new system failure modes or significant changes due to MELLLA+.

Data C No change to component failure rates.

Human Reliability A The MELLLA+ operating region is postulated to Analysis result in higher potential ATWS power, thus reducing operator action timings. See discussion of operator actions in Section 4.1.6.

.4-16 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table 4.1-1 (Continued)

REVIEW OF PRA ELEMENTS FOR POTENTIAL RISK MODEL EFFECTS Disposition PRA Elements Category Basis St ructural C No change's in the structural analyses are identified that would adversely impact the PRA models.

Quantification C No changes in PRA quantification process (e.g.,

truncationlimit, flag settings, etc.) due to MELLLA+. However, changes in the calculated CDF and LERF results occur to the other model changes.

Level 2 C The MELLLA+ condition has no direct or significant impact on Level 2 PRA safety functions,.

accident sequence progression, or release categorization. However, changes in the calculated LERF result occurs to the Level 1 PRA model changes..

Notes to Table 4.1-1:

Category A: Potential PRA change, PRA modification desirable or necessary .

Category B: Minor perturbation, negligible impact on PRA, no PRA changes required Category C: No change 4-17 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table 4.1-2

`KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: GENERAL TRANSIENTS Minimum Systems Required Safety Function MELLLA MELLLA+(B)

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Turbine bypass(10 ) Same Control (Overpressure) or 2 of 8 SRVs(9)

Primary System Pressure All SVs/SRVs must reclose Same Control (SRVs reclose) (by definition) 1 1 Same(3,11 )

High Pressure Injection 1 FW pump &1 Cond. pumpu )'0 )

or HPCI(11 )

or 11 RCIC( )

or CRDH(3)

_RP Emergency Depressurization. .. I of 8 SRVs 2 .

1. .. Same 2. .

(2/8 SRVs required for FPS and CSW injection sources) 1 LPCI pump(1 3) Same(1 3)

Low Pressure Injection or 1

1 Core Spray pump( 3) or 1 Condensate pump(2) 1 CRDH pump at nominal flow for Same(3'4 )

Alternate Injection late injection (3) or RHRSWA crosstie to LPCI(4) or Condensate Service Water (CSW) Injection(4 )

or FPS crosstie to LPCI(4) 4-18 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table 4.1-2 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: GENERAL TRANSIENTS Minimum Systems Required Safety Function MELLLA MELLLA+(e)

Main Condenser( )

14 ..Same(1 4)

Containment Heat Removal or 1 RHR Hx Loop(6)' (14) or Containment Venting(7)' (14) 4-19 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Notes to Table 4.1-2:

(1) One FW pump injecting, with one condensate pump providing suction, is a success for high pressure injection for a transient. FW operation in the short-term does not require. hotwell make-up; but the model requires hotwell makeup for the long-term.

I (2) One condensate pump injecting is a success for low pressure injection for a transient. Operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(3) CRDH injection flow rate at MNGP is sufficiently large that it can be used as a the sole early injection source for non-LOCA and non-ATWS scenarios if a second CRDH pump is started in a timely manner, or the flow of a single pump is enhanced (via CRDH flow enhancement procedures) in a timely manner.

MNGP EPU MELLLA MAAP runs MNGPEPU5e - MNGPEPU5h show that "enhanced. CRDH" is sufficient for high pressure makeup for transients for the MELLLA condition. Nominal CRDH flow with 2 pumps is also successful as the only injection source for a transient for the EPU as long as the second pump is started in a timely manner (refer to MNGP EPU MELLLA MAAP runs MNGPEPU5b and MNGPEPU5d); except for the case in which the RPV remains at pressure (refer to MNGP EPU MELLLA MAAP runs MNGPEPU5a and MNGPEPU5c).

Later in accident sequences, many hours into the event after other injection sources have operated for some time (and have failed for some reason); CRDH is also a success but only requires one pump at nominal flow. Refer to additional clarification in Reference [20] related to RAI #4.

The MELLLA+ configuration does not impact the RPV makeup success criteria.

(4) The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core when the RPV is at approximately 100 psi. Two (2) SRVs are required toopen to support RPV

.depressurization in the PRA for this alignment. . Fire protection for alternate injection .requires manual alignment. Any one of the following FPS pumping sources is a success: diesel fire pump, electric fire pump, screen wash fire pump, or pumper truck (longer term option).

Like FPS, Condensate Service Water RPV injection alignment also requires 2 SRVs for success in the PRA. CSW alignment also requires manual actions for alignment.

RHRSW A crosstie to LPCI provides significant flow and only requires a single SRV. Like FPS and CSW alignments, RHRSW crosstie also requires manual actions for alignment.

The MELLLA+ configuration does not impact the RPV makeup success criteria.

(5) <Not used.>

(6) 1 RHR pump, 1 RHR heat exchanger and 1 RHRSW pump are required for success.

(7) By design and EOPs, emergency containment venting is a success in the PRA for the containment heat removal function. The PRA credits the hard-pipe, wetwell, and drywell vent paths for containment heat removal.

(8) The. success criteria for the MELLLA+ configuration are based on MELLLA+ Task Reports and/or engineering judgment.

4-20 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment (9) I.

MNGP EPU MELLLA MAAP runs MNGPEPUla and MNGPEPUla_a also show that two SRVs are required for initial RPV overpressure protection during an isolation transient (e.g., MSIV Closure) for

the MELLLA configuration. The MELLLA+.configuration does not impact this success criterion.

(10) By plant design the MNGP turbine bypass is sufficient for RPV overpressure protection during a transient with the condenser heat removal path available.

(11) FW/Condensate, HPCI, and RCIC, by design, have more than enough capacity to provide coolant makeup at the MELLLA and the MELLLA+ conditions for a transient initiator.

(12) MAAP run MNGPEPUla shows that 1 SRV is sufficient for RPV Emergency Depressurization for the EPU configuration for a transient initiator.

The MELLLA+ configuration does not impact this success criterion.

(13) LPCI,.Core Spray, and Condensate, by design, have more than enough capacity to provide coolant makeup for the MELLLA and MELLLA+ conditions for a transient initiator (Refer to MELLLA+ Task Report T0900, "Transient Analysis")..

(14) By plant design, the main condenser, RHR system, and emergency containment vent are successful for the MELLLA condition. Also refer to EPU MELLLA MNGPEPU3 MAAP run that shows that 1 loop of SPC is effective for 24 hrs. The PRA credits RHR suppression pool cooling, shutdown cooling, and drywell spray modes. The MELLLA+ configuration does not impact this success criterion.

4-21 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 4.1-3 KEY SAFETY FUNCTIONS AND MINIMUMSYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: IORV or TRANSIENT w/SORV Minimum Systems Required Safety.. Function

.MELLLA M ' MELLLA+ (8)

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure n/a Same Control (Overpressure) (addressed by SORV)

Primary System Pressure n/a Same Control (SRVs reclose) (SRV stuck-open) (by definition)

High Pressure Injection 1 FW pump & 1 Cond. pump(") 0 )

1 11 Same(3, 11) or 11 HPCI( )

or CRDH3)*

RPV Emergency Depressurization n/a Same (performed by SORV at t=O)( 9 )

1 LPCI pump 10 )................. Same(10 ) -

Low Pressure Injection or 0 1 Core Spray pump(' )

or 1 Condensate pump(2)-

Alternate Injection 1 CRDH pump at nominal flow for Same(3'4 )

late injection(3) or RHRSWA crosstie to LPCI(4) or Condensate Service Water (CSW) Injection(4) or FPS crosstie to LPCI(4)

Main Condenser(1 2) Same(12)

Containment Heat Removal or 1 RHR Hx Loop(6)' (12) or Containment Venting(7)' (12)

4-22 .4-22C495070003-8976-1 2/21 /09

Monticello MELLLA +,Risk Assessment Notes to Table 4.1-3:

(1) One.FW pump injecting, with one condensate pump providing suction, is a success for high pressure injection for a transient w/SORV. FW operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(2) One condensate pump injecting is a success for low pressure injection for a transient w/SORV.

Operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(3) CRDH injection flow rate at MNGP is sufficiently large .that it can be used as a the sole early injection source for non-LOCA and non-ATWS scenarios if a second CRDH pump is started in a timely manner, or the flow of a single pump is enhanced (via CRDH flow enhancement procedures) in a timely manner.

MNGP EPU MELLLA MAAP runs MNGPEPU5e - MNGPEPU5h show that "enhanced CRDH" is sufficient for high pressure makeup for transients for the MELLLA condition. Nominal CRDH flow with 2 pumps is also successful as the only injection source for a transient for the EPU as long as the second pump is started in a timely manner (refer to MNGP EPU MELLLA MAAP runs MNGPEPU5b and MNGPEPU5d); except for the case in which the RPV remains at pressure (refer to MNGP EPU MELLLA MAAP runs MNGPEPU5a and MNGPEPU5c).

Later in accident sequences, many hours into the event after other injection sources have operated for some time (and have failed for some reason); CRDH is also a success but only requires one pump at nominal flow. Refer to additional clarification in Reference [20] related to RAI #4.

The MELLLA+ configuration does not impact the RPV makeup success criteria.

(4) The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core when the RPV is at approximately 100 psi. Two (2) SRVs are required to open to support RPV

-.- depressurization in the PRA for.-this alignment. Fire. protection for- alternate injection requires.

manual alignment. Any one of the following FPS pumping sources is a success: diesel fire pump,

electric fire pump, screen wash fire pump, or pumper truck (longer term option).

Like FPS, Condensate Service Water RPV injection alignment also requires 2 SRVs for success in the PRA. CSW alignment also requires manual actions for alignment.

RHRSW A crosstie to LPCI provides significant flow and only requires a single SRV. Like FPS and CSW alignments, RHRSW crosstie also requires manual actions for alignment.

The MELLLA+ configuration does not impact the RPV makeup success criteria.

(5) <Not used.>

(6) 1 RHR pump, 1 RHR heat exchanger and 1 RHRSW pump are required for success.

(7) By design and EOPs, emergency containment venting is a success in the PRA for the containment

-heat removal function. The PRA credits the hard-pipe, wetwell, and drywell vent paths for containment heat removal.

(8) The success criteria for the MELLLA+ configuration are based on MELLLA+ Task Reports and/or engineering judgment.

4-23 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment (9) EPU MELLLA MAAP run MNGPEPUla shows that 1 SRV is sufficient for RPV Emergency Depressurization for the EPU configuration for a transient initiator. The MELLLA+ configuration does not impact this success criterion (10) LPCI, Core Spray, and Condensate, by design, have more than enough capacity to provide coolant makeup for the MELLLA and MELLLA+ conditions for a transient initiator (Refer to MELLLA+ Task Report T0900, "Transient Analysis").

(11) FW/Condensate and HPCI have more than enough capacity to provide coolant makeup at the IVMELLLA and the MELLLA+ conditions for a transient initiator. However, the RCIC system is not credited in the PRA for IORV/SORV scenarios because level will dip.below TAF, causing the operators to initiate RPV emergency depressurization per the EOPs.

(12) By plant design, the main condenser, RHR system, and emergency containment vent are successful for the MELLLA condition. Also refer to EPU MELLLA MNGPEPU3 MAAP run that shows that 1 loop of.SPC is effective for 24 hrs. The PRA credits RHR suppression pool cooling, shutdown cooling, and drywell spray modes. The MELLLA+ configuration does not impact this success criterion.

4-24 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table 4.1-4 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: SMALL LOCA Minimum Systems Required Safety Function MELLLA MELLLA+(7) "

Reactivity Control All control rods inserted (RPS Same

, electrical and mechanical (by definition) success)

Primary System Pressure Control Not required Same (Overpressure)

Vapor Suppression Not required Same 1 )'(3) Same(3,4)

High Pressure Injection 1 FW pump & 1 Cond. pump~

or HPCI( 3' (4)

RPV Emergency 1 of 8 SRVs(9) Same(9)

Depressurization Low Pressure Injection 1 LPCI pump(6) Same(6) or 6

).

1 Core Spray pump(

or 1 Condensate pump(2), (6)

Alternate Injection RHRSW A crosstie to LPCI(5) Same(5)"

or 5

FPS crosstie to LPCI( )

Main Condenser(8) Same(8 )

Containment Heat Removal or 1 RHR Hx Loop(8) or Containment Venting(8) 4-25 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Notes to Table 4.1-4:

(1)) One FW pump injecting, with one condensate pump providing suction, is a success for high pressure injection for a SLOCA scenario. FW operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(2) One condensate pump injecting is a success for low pressure injection for a SLOCA. Operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(3) FW/Condensate and HPCI have more than enough capacity to provide coolant makeup at the EPU MELLLA condition for a SLOCA scenario. Refer to MNGP EPU MELLLA MAAP run MNGPEPU3 which shows that HPCI can function as the only injection source for a SLOCA for the EPU condition throughout the PRA 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time. The MELLLA+ condition has no impact on this success criterion.

(4) CRDH flow is not sufficient for early or late coolant makeup for LOCA scenarios. This is true for MELLLA and MELLLA+.

(5) FPS crosstie and RHRSW crosstie are the only alternate LP systems of sufficient capacity for a SLOCA. CSW is not of sufficient capacity.

The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core when the RPV is at approximately 100 psi. Two (2) SRVs are required to open to support RPV depressurization in the PRA for this alignment. Fire protection for alternate injection requires manual alignment. Any one of the following FPS pumping sources is a success: diesel fire pump, electric fire pump, screen wash fire pump, or pumper truck (longer term option).

RHRSW A crosstie to LPCI provides significant flow and only requires a single SRV. Like FPS, RHRSW crosstie also requires manual actions for alignment.

The MELLLA+ configuration does not impact the RPV makeup success criteria.

(6) LPCI, Core Spray, and Condensate have more than enough capacity to provide coolant makeup at the MELLLA condition for a small LOCA. Refer to MNGP EPU MELLLA MAAP run MNGPEPU4 which shows the one LPCI train is sufficient for a MLOCA. The MELLLA+ configuration does not impact the RPV makeup success criteria.

(7) The success criteria for the MELLLA+ configuration are based on MELLLA+ Task Reports and/or engineering judgment.

(8) By plant design, the main condenser, RHR system, and emergency containment vent are successful for the MELLLA condition. Also refer to EPU MELLLA MNGPEPU3 MAAP run that shows that 1 loop of SPC is effective for 24 hrs. The PRA credits RHR suppression pool cooling, shutdown cooling, and drywell spray modes. The MELLLA+ configuration does not impact this success criterion.

(9) EPU MELLLA MAAP run MNGPEPUla shows that 1 SRV is sufficient for RPV Emergency Depressurization for the EPU configuration for a transient initiator. EPU MELLLA MAAP run MNGPEPU6a shows the I SRV is also sufficient for. a MLOCA for RPV Emergency Depressurization. Using reasonable judgment, a SLOCA also requires only 1 SRV for RPV Emergency Depressurization. The MELLLA+ configuration does not impact this success criterion.

4-26 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table 4.1-5 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: MEDIUM LOCA Minimum Systems Required Safety Function MELILLA MELLLA+1e1 Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Not required Same Control (Overpressure)

Vapor Suppression Not required Same High Pressure Injection HPCIl 1 ) Same(1'3)

(3)

RPV Emergency 1 of 8 SRVs (9) Same,(29)

Depressurization or HPCI initially available (.2)

Low Pressure Injection 1 LPCI pump(5) Same(4'5 )

or 1 Core Spray pump (5)

(4)

-Alternate (Late) Injection RHRSWA. crosstie to LPCl(6 ) Same(6) or FPS crosstie to LPCI(6)

Containment Heat Removal 1 RHR Hx Loop(7) Same 4-27 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Notes to Table 4.1-5:

(1) Refer to MNGP EPU MELLLA MAAP run MNGPEPU4 which shows the HPCI is sufficient for a MLOCA for the EPU until the RPV sufficiently depressurizes so that LPCI or CS can provide low pressure RPV makeup. The MELLLA+ configuration does not impact the RPV makeup success criteria.

(2) HPCI .operation in combination with the MLOCA will act as the method for RPV depressurization

(refer to MNGP EPU MELLLA MAAP run MNGPEPU4). The MELLLA+ configuration does not impact the RPV makeup success criteria.

(3) *FW is not credited because it assumed that the MLOCA may be in a recirculation loop, thus preventing flow from reaching the core.

(4) Condensate is not credited because it is assumed that the MLOCA will deplete the hotwell before sufficient hotwell makeup can be aligned.

(5) LPCI and Core Spray have more than enough capacity to provide coolant makeup at the MELLLA condition for a MLOCA. Refer to MNGP EPU MELLLA MAAP run MNGPEPU4 which shows the one LPCI train is sufficient for a MLOCA. The MELLLA+ configuration'does not impact the RPV makeup success criteria.

(6) FPS crosstie and RHRSW crosstie are the only alternate LP systems of sufficient capacity for a MLOCA. CSW is not of sufficient capacity. FPS and RHRSW crossties are only successful for late injection (after another injection source has already operated and failed). They are not successful as the only early injection source due to lack of available time in which to complete the manual alignments.

The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core when the RPV is at approximately 100 psi. Fire protection for alternate injection requires manual alignment: Any one of the following FPS pumping sources is a success: diesel fire pump, electric fire pump, screen wash fire pump, or pumper truck (longer term option).

Like FPS, RHRSW crosstie also requires manual actions for alignment.

The MELLLA+ configuration does not impact the RPV makeup success criteria.

(7) By plant design, the RHR system is successful for the MELLLA condition. Also refer to EPU MELLLA MNGPEPU3 MAAP run that shows that 1 loop of SPC is effective for.24 hrs. The PRA

.credits RHR suppression pool cooling and drywell spray modes for a MLOCA. The main condenser is not credited because the MSIVs will likely close due to accident signals. Shutdown cooling is also not credited for MLOCAs due to the potential break location in a recirculation loop.

Containment venting is conservatively assumed not successful as the sole decay heat removal mechanism for MLOCAs and LLOCAs due to potential NPSH limitations on continued LPCIor CS injection. The MELLLA+ configuration does not impact this success criterion.

(8) The success criteria for the MELLLA+ configuration are based on MELLLA+ Task Reports and/or engineering judgment.

(9) EPU MELLLA MAAP run MNGPEPU6a shows the 1 SRV is also sufficient for a MLOCA for RPV

-Emergency Depressurization. The MELLLA+ configuration does not impact this success criterion.

4-28 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 4.1-6 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: LARGE LOCA Minimum Systems Required

. Safety Function MELLLA " MELLLA+(6 ý Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Not required Same Control (Overpressure)

Vapor Suppression. <6 WW-DW vacuum breakers Same(i) 1 stuck open is acceptable( )

High Pressure Injection N/A(2) Same(2)*

RPV Emergency Not required Same Depressurization Low Pressure Injection 1 LPCI pump(3) Same(3) or ' (3) 1 Core Spray pump Alternate Injection RHRSW'A Crosstie to LPCI(4) Same(4) or FPS crosstie to LPCI(4)

Containment Heat Removal 1 RHR Hx Loop (5) Same 4-29 C495070003-8976-12121/09

Monticello MELLLA+ Risk Assessment Notes to Table 4.1-6:

'(1) Six (6) of eight (8) stuck open WW-DW vacuum breakers will lead to sufficient suppression pool.

bypass to result in containment overpressurization. This condition is assumed to lead to core damage due to loss of potential injection sources. The MELLLA+ configuration does not impact this success criterion.

(2) The LLOCA initiator results in rapid depressurization of the RPV, precluding the use of the FW, HPCI, and RCIC high pressure injection systems. In addition, the CRDH system is of inadequate flow rate to keep up with the inventory loss. The MELLLA+ configuration does not impact this success criterion.

(3) LPCI and Core Spray have more than enough capacity to provide coolant makeup at the MELLLA condition for Large LOCAs. Refer to MNGP EPU MELLLA MAAP run MNGPEPU4 which shows 1 LPCI pump is sufficient. The MELLLA+ configuration does not impact the RPV makeup success criteria.

(4) Insufficient time is available during a LLOCA to align FPS or RHRSW crossties for use as the sole early injection source. However, FPS and RHRSW crossties are credited for late injection after another injection source has operated and subsequently failed for some reason. The MELLLA+.

configuration does not impact the.RPV, makeup success criteria.

(5) By plant design, the RHR system is successful for the MELLLA condition for containment heat removal.: The PRA credits RHR suppression pool cooling and drywell spray modes for a LLOCA.

The main condenser is not credited because the MSIVs will likely close due to accident signals.

Shutdown cooling is also not credited for LLOCAs due to the potential break location in a recirculation loop. Containment venting is conservatively assumed not successful as the sole decay heat removal mechanism for MLOCAs and LLOCAs due to potential NPSH limitations on continued LPCI or CS injection. The MELLLA+ configuration does not impact this success criterion.

- (6)1 ýThe success criteria for the MELLLA+, configuration are based on MELLLA+ Task Reports. and/or, engineering judgment.

4-30 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 4.1-7 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: AT1WS Minimum Systems Required Safety Function MELLLA MELLLA+I8 I 1 9)

Reactivity Control ARI(1) Same(*

or; 1 of 2:SLC trains(9)

Primary System Pressure Turbine bypass(2) Turbine bypass(2)

Control (Overpressure) or; or;. 1

7 of 8 SRVs(10 ) 8 of 8 SRVs(11 ) / 7 of 8 SRVs(1 )

and and RPT (2) RPT(2)

Primary System Pressure Not modeled Same Control (SRVs reclose)

High Pressure Injection 1 FW pump & 1 Cond. pump (3) Same(3)

- or HPCI(3)

RPV Emergency 3 of 8 SRVs(4) Same(4)

Depressurization Low Pressure Injection I LPCI pump(5) Same(5) or 5 1 Core Spray pump( )

Alternate Injection N/A(6) Same(6)

Containment Heat Removal Main Condenser(7) Same(7) or 1 RHR Hx Loop(7) or MVW/DW Venting(7) 4-31 C495070003-8976-1 2/21/09

Monticello MELLLA+/- Risk Assessment Notes to Table 4.1-7:

(1)' Alternate Rod Insertion (ARI) is a successful reactivity control measure only for electrical scram failures. This success criterion remains applicable to the MELLLA+ condition.

(2) The Recirculation Pump Trip (RPT) must actuate as designed and trip both. recirculation pumps for initial RPV pressure control during an isolation ATWS (e.g., MSIV Closure ATWS). If turbine bypass remains available then RPT is not needed for initial pressure control. This success criterion remains applicable to the MELLLA+ condition.

(3) By plant design and the EOPs, FW and HPCI are successful for high pressure makeup during an ATWS for the MELLLA condition (refer to MNGP EPU MELLLA+ MAAP runs MNGPEPU7b and MNGPEPU7c). This is true for the MELLLA+ condition, as well (refer to MNGP MELLLA+ Task Report 0902, "ATWS").

(4) The MNGP EPU MELLLA PRA uses 3 SRVs as the success criterion for RPV emergency depressurization during an ATWS (refer .to MNGP EPU MELLLA MAAP run MNGPEPU7a). This success criterion remains applicable, to the MELLLA+ configuration (refer to MNGP MELLLA+ Task Report 0902, "ATWS").

(5) By plant design and the EOPs, LPCI and Core Spray are successful for low pressure makeup during an ATWS (refer to MNGP EPU MELLLA MAAP run MNGPEPU7a). This is true for the MELLLA+

condition, as well (refer to MNGP MELLLA+ Task Report 0902, "ATWS").

(6) Alternate low pressure injection systems are not credited because it is assumed that insufficient time is available to perform the alignments during an ATWS.

(7) The main condenser, RHR system and emergency containment vent options are successful for the MELLLA condition for containment heat removal during a mitigated ATWS scenario (i.e., with-successful SLC injection and level/power control), refer to MNGP EPU MELLLA MAAP run

.MNGPEPU7a..,

The MNGP. EPU PRA,credits the RHR.suppression pool cooling.mode for an ATWS. The EOPs do not direct use of SDC during an ATWS.

The MELLLA+ condition has no impact on the success criteria for containment heat removal options for mitigated ATWS scenarios given that the long-term containment response is non-significantly affected by MELLLA+.. The only impact relates to shorter operator action times for initiation of RHR SPC. See HRA discussion in Section 4.1.6.

(8) The success criteria for the MELLLA+ configuration are based on MELLLA+ Task Reports and/or engineering judgment.

(9) One SLC train is sufficient for reactivity control for both the MELLLA and MELLLA+ conditions (refer to MELLLA and MELLLA+ Task Reports T0902, "ATWS").

(10) 'Based on EPU Task Report ATWS analysis, 7 of 8 SRVs arerequired for the MELLLA condition for RPV initial overpressure protection during an ATWS scenario.

(11) The license-based ODYN software calculations performed for the MELLLA+ condition require all SRVs to be functional, no SRVs can be out of service, to maintain the RPV pressure spike below the ASME Service Level C limit of 1500 psig during an isolation ATWS event, such as an MSIV Closure ATWS (refer to MELLLA+ Task Report 0902, "ATWS"). Isolation ATWS scenario (e.g.,

MSIV Closure ATWS) calculations performed using the TRACG software are also documented in MELLLA+ Task Report 0902. The TRACG software calculations showed that 1 SRV can be OOS for an isolation ATWS scenario (e.g., MSIV Closure ATWS) and the RPV pressure spike remains below the ASME Service Level C limit.

4-32 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment The 8/8 SRVs required success criterion change for isolation ATWS scenarios is applied in this risk assessment for the base case risk calculation. The realistic TRACG results that show 7 of 8 SRVs are sufficient is addressed in a best estimate sensitivity calculation (refer to Section 5.7-1).

4-33 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 4.1-8 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: INTERNAL FLOODS Safety Function MELLLA Minimum Systems Required MELLLA+(")

' ]

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Turbine bypass(10 ) Same Control (Overpressure) or 2 of 8 SRVs(9)

Primary System Pressure All SVs/SRVs must reclose Same Control (SRVs reclose) (by definition)

High Pressure Injection 1 FW pump & 1 Cond. pump(1 )'01 ) Same(31 1 )

or HPCI* 11 )

or RCIC(11 )

or CRDH(3)

RPV Emergency ... 1 of 8 SRVs(12 ). Same 1( 2) _

Depressurization (2/8 SRVs required for FPS and CSW injection sources) 1 LPCI pump(1 3) Same(1 3)

Low Pressure Injection or 1 1 Core Spray pump( 3) or 1 Condensate pump(2)

'Alternate Injection 1 CRDH pump at nominal flow for Same(3'4 )

late injection(3) or RHRSW A crosstie to LPCI(4) or Condensate Service Water (CSW) Injection(4) or FPS crosstie to LPCI(4) 4-34 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table 4.1-8

, KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: INTERNAL FLOODS Safety Function c [Minimum

.. Systems Required MELLLA+181 MELLLA 4

Main Condenser (1 ) Same(1. 4)

-Containment Heat Removal or 1 RHR Hx Loop (6).(14) or Containment Venting(7)' (14) 4-35 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment.

Notes to Table 4.1-8:

(1) One FW pump injecting, with one condensate pump providing suction, is a success for high pressure injection for a transient (which is how an internal flood scenario behaves, other than the flood impacts on mitigation equipment). FW operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(2) One condensate pump injecting is a success for low pressure injection for a transient. Operation in

,the-short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(3). CRDH injection flow rate at MNGP is sufficiently large that it can be used as a the sole early injection source for non-LOCA and non-ATVVS scenarios if a second CRDH pump is started in a timely manner, or the flow of a single pump is enhanced (via CRDH flow enhancement procedures) in a timely. manner.

MNGP EPU MELLLA MAAP runs MNGPEPU5e - MNGPEPU5h show that "enhanced CRDH" is sufficient for high pressure makeup for transients for the MELLLA condition. Nominal CRDH flow with 2 pumps is also successful as the only injection source for a transient for the EPU as long as the second pump is started in a timely manner (refer to MNGP EPU MELLLA MAAP runs MNGPEPU5b and MNGPEPU5d); except for the case in which the RPV remains at pressure (refer to MNGP EPU MELLLA MAAP runs MNGPEPU5a and MNGPEPU5c).

Later in accident sequences, many hours into the event after other injection sources have operated for some time (and have failed for some reason); CRDH is also a success but only requires one pump at nominal flow. Refer to additional clarification in Reference [20] related to RAI #4.

The MELLLA+ configuration does not impact the RPV makeup success criteria.

(4) The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core

.when the RPV is at approximately 100 psi. Two (2) SRVs. are-required to open to support RPV depressurization in the PRA for this alignment. Fire protection for alternate injection requires manual alignment. Any one of the following FPS pumping sources is a success: diesel fire pump, electric fire pump, screen wash fire pump, or pumper truck (longer term option).

Like FPS, Condensate Service Water RPV injection alignment also requires 2 SRVs for success in the PRA. CSW alignment also requires manual actions for alignment.

RHRSW A crosstie to LPCI provides significant flow and only requires a single SRV. Like FPS and CSW alignments, RHRSW crosstie also requires manual actions for alignment.

The MELLLA+ configuration does not impact the RPV makeup success criteria.

(5) <Not used.>

(6) 1 RHR pump, 1 RHR heat exchanger and 1 RHRSW pump are required for success.

(7) By design and EOPs, emergency containment venting is a success in the PRA for the containment

,heat removal function. The PRA credits the hard-pipe, wetwell, and drywell vent paths for containment heat removal.

(8) The success criteria for the MELLLA+ configuration are based on MELLLA+ Task Reports and/or engineering judgment.

4-36 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment (9) MNGP EPU MELLLA MAAP runs MNGPEPUla and MNGPEPUla_a also show that two SRVs are required for initial RPV overpressure protection during an isolation transient (e.g., MSIV Closure) for the MELLLA configuration. The MELLLA+ configuration does not impact this success criterion.

(10) By plant design the MNGP turbine bypass is sufficient for RPV overpressure protection during a.

transient with the condenser heat removal path available..

(11) FW/Condensate, HPCI, and RCIC, by design, have more than enough capacity to provide coolant makeup at the MELLLA and the MELLLA+ conditions for a transient initiator.

(12) MAAP run MNGPEPUla shows that 1 SRV is sufficient for RPV Emergency Depressurization for the EPU configuration for a transient initiator.

The MELLLA+ configuration does not impact this success criterion.

(13) LPCI,. Core Spray, and Condensate, by design, have more than enough capacity to provide coolant

- makeup for the MELLLA and MELLLA+ conditions for a transient initiator (Refer to MELLLA+ Task Report T0900, "Transient Analysis").

(14) By plant design, the main condenser, RHR system, and emergency containment vent are successful for the MELLLA condition. Also refer to EPU MELLLA MNGPEPU3 MAAP run that shows that 1 loop of SPC is effective for 24 hrs. The PRA credits RHR suppression pool cooling, shutdown cooling, and drywell spray modes. The MELLLA+ configuration does not impact this success criterion.

4-37 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 4.1-9 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: ISLOCA, BOC Minimum Systems Required Safety Function j MELLLA MELLLA+ 5 )'

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Not required Same Control (Overpressure)

Vapor Suppression Not required' Same High Pressure Injection N/A(1) Same(1 )

RPV Emergency Not required Same Depressurization Low Pressure Injection 1 LPCI pump (2) Same(2) or 1 Core Spray pump(2)

External Injection Sources RHRSW A crosstie to LPCI(3) Same(3) or Condensate Service Water (CSW) Injection(3) or FPS crosstie to LPCI(3)

Containment Heat Removal N/A(4) Same(4) 4-38 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Notes to Table 4.1-9:

(1). Break outside containment initiators result in rapid depressurization of the RPV, precluding the use of the FW, HPCI, and RCIC high pressure injection systems. In addition, the CRDH system is of inadequate flow rate to keep up with the inventory loss.

(2) LPCI and Core Spray have more than enough capacity to provide coolant makeup at the MELLLA

condition for Large LOCAs (ISLOCA and Break outside Containment scenarios are modeled as large LOCA size breaks in the PRA). Refer to MNGP EPU MELLLA MAAP run MNGPEPU4 which shows 1 LPCI pump is sufficient. The MELLLA+ configuration does not impact the RPV makeup success criteria.

(3) If a break outside containment is not isolated, reactor water inventory'will continue to be discharged outside the drywell which will eventually deplete the suppression pool and disable low pressure injection via loss of suction and flooding. Consequently, external injection from a virtually unlimited supply and external pump is needed for long term core cooling. The MNGP credits FPS, RHRSW,.

. and CWS alternate injection sources. These systems draw from the river and have a virtually infinite.

source of water.

The MELLLA+ configuration does not impact the RPV makeup success criteria.

(4) Decay heat removal active systems are not required for unisolated breaks outside containment, since the decay heat is carried out of containment via the break.

(5) The success criteria for the MELLLA+ configuration are based on MELLLA+ Task Reports and/or engineering judgment.

4-39 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table 4.1-10 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS: LEVEL 2 (LERF) PRA Safety Functions MELLLA [

Minimum Systems Required

.MELLLA+(3)

Containment Isolation Containment penetrations >2" dia. Same isolated (by definition)

RPV.Depressurization post- 1 of 8 SRVs Same core damage (assumed same as Level 1 PRA).

Arrest Core Melt 1 LPCI pump (3) Same(3 )

Progression In-Vessel or pump (3) 1 Core Spray or 1 Condensate pump(3) or 3 FPS crosstie( )

or RHRSW crosstie(3)

Combustible Gas.Venting Inerted containment with no oxygen Same intrusion during the accident (by definition) or Combustible gas purge / vent Containment Remains Intact Containment Isolation Same at RPV Breach and (by definition)

No early containment failure modes (e.g., steam explosions) compromise containment integrity Ex-vessel Debris Coolability 1 LPCI pump(3) Same(3) or 1 Core Spray pump(3) or 1 Condensate pump(3) or DW Sprays(3) or FPS crosstie(3) or RHRSW crosstie(3)

Containment Heat Removal 1 RHR Hx Loop(1 ) Same or Containment Venting(2) 4-40 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table 4.1-10 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS: LEVEL 2 (LERF) PRA Minimum Systems Required Safety Functions MELLLA MELLLA+(3)

Fission Product Scrubbing No failure in DW Same or (by definition)

For WW airspace failure: no SP bypass (i.e., no WW-DW vacuum breakers stuck open and no SRV tail pipe failures) 4-41 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Notes to Table 4.1-10:

(1) 1 RHR pump, 1 RHR. heat exchanger and 1 RHRSW pump are required for suppression pool

cooling or DW Sprays for Level 2 containment heat removal for post-core damage accidents proceeding with an initially intact containment. The MELLLA+ condition would not impact these success criteria.*

(2) Containment venting is also a success for Level 2 containment heat removal for post-core damage accidents proceeding with an initially intact containment. The wetwell and drywell vents, and the hard-piped vent are credited. The MELLLA+ condition would not impact these success criteria.

(3) Debris cooling requirements are based on generic industry studies. These are approximate injection

flow rates to-halt the progression of the core melt. The MELLLA+ condition would not impact these success criteria.

4-42 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 4.1-11 RE-ASSESSMENT OF OPERATOR ACTION HEPs POTENTIALLY IMPACTED BY MELLLA+

Allowable Action Time EPU EPU Action ID Action Description MELLLA MELLLA+ MELLLA HEP MELLLA+ HEP Comment ATWS-LNG-Y Fail to initiate ATWS when n/a n/a 8.00E-05 8.00E-05 Execution Error: HEP calculation not attempted directly influenced by available time window. Diagnosis contribution treated by a separate basic event.

ATWS-SHT-Y Operator fails to initiate ATWS <1 min. <1 min. 1.OOE+00 1.00E+00 ASEP Upper Bound TRC curve.

(short time available)

CRIT-DET-Y Fail to detect criticality issue - 30 min. 30 min. 1.18E-04 1.18E-04 Diagnosis Error: This action error applies long time available to ATWS scenarios in which the turbine is online. An indefinite, long time is available to the operator; the MELLLA PRA conservatively assumes 30 mins. available.

This timing assumption is not changed by MELLLA+. ASEP Lower Bound TRC.

curve.

DEP-02MN-Y Fail RPV depressurization 4.4 min. 4 min. 5.10E-01 1.o0E+00 This action used in isolation ATWS within 2 minutes scenarios (e.g., MSIV Closure ATWS) with failure of all HP injection. The MELLLA PRA estimates 4.4 min. available (diagnosis time of 1.4 min. and execution time of 3 min.).

The MELLLA+ risk assessment reduces the MELLLA time window for this action by an additional 10% to t=4 mins (diagnosis time of 1 min. and execution time of 3 min.). ASEP Lower Bound TRC curve.

LSBLCALTXY Operator fails to inject boron n/a n/a 6.30E-03 6.30E-03 Execution Error: HEP calculation not using CRDH directly influenced by available time window. Diagnosis contribution treated by a separate basic event.

4-43 4-43C495070003-8976-12/21/09.

Monticello MELLLA+ Risk Assessment Table 4.1-11 RE-ASSESSMENT OF OPERATOR ACTION HEPs POTENTIALLY IMPACTED BY MELLLA+

Allowable Action Time EPU EPU Action ID Action Description MELLLA MELLLA+ MELLLA HEP MELLLA+ HEP Comment RHR-DHR-AY Fail to align RHR for CHR - 21.8 min. 19.6 min. 2.19E-02 3.25E-02 This action is applicable to ATWS ATWS scenarios with HP injection and successful SLC. Time available to align SPC depends upon time of SLC injection and whether the initiator is an isolation event (MSIV closure). The pre-EPU PRA assumes that 25 minutes are available (diagnosis time of 20 mins. and execution time of 5 mins.).

This time is judged conservative. MNGP EPU MELLLA MAAP runs MNGPEPU7b, MNGPEPU7bx, MNGPEUP7c and MNGPEPU7cx show that with delayed SLC injection and no SPC initiation, critical impacts do not occur until about t=45 mins when the pool reaches 200F .and HPCI operability become an issue. Although the,

.25 min. time available estimate from the pre-EPU isjudged still appropriate for the.

EPU MELLLA condition, the EPU MELLLA risk assessment reduced this time available by 13% to t=21.8 mins (diagnosis time of 16.8 min. and execution time of 5 min.).

The MELLLA+ risk assessment reduces the MELLLA time window for this action by an additional 10%to t=19.6 mins (diagnosis time of 14.6 min. and execution time of 5 min.).- ASEP Median TRC curve.

4-44 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 4.1-11 RE-ASSESSMENT OF OPERATOR ACTION HEPs POTENTIALLY IMPACTED BY MELLLA+

Allowable Action Time EPU . EPU Action ID Action Description MELLLA MELLLA+ MELLLA HEP MELLLA+ HEP Comment SD-NOTRIPY Fail to prevent turbine trip while 4.4 min. 4 min. 2.27E-01 2.50E-01 This action is for bypassing the MSIV low shutting down level interlocks and is applicable to ATWS scenarios with the MSIVs open. The time available depends upon a number of factors, such as which HP systems are available and how long operators take to reduce level. The MELLLA PRA assumes the available diagnosis time is t=4.4 min.

The MELLLA+ risk assessment reduces the MELLLA time window for this action by an additional 10% to t=4 mins. ASEP Median TRC curve.

SLC-CRD--Y Fail to inject boron using n/a n/a 6.30E-03 6.30E-03 Execution Error: HEP calculation not CRDH p directly influenced by available time window. Diagnosis contribution treated by a separate basic event.

SLC-INI-LY Fail to initiate SLC - long time >1 hr. >1 hr. 4.00E-04 4.00E-04 This action error applies to ATWS available scenarios in which the turbine is online. An indefinite, long time is available to the operator; the MELLLA PRA assumes > 1 hr. available. This timing assumption is not changed by MELLLA+. ASEP Lower Bound TRC curve. In addition, the HEP is dominated by execution error.

SLC-INI-SY Fail to initiate SLC - short time 11.8 min. 10.6 min. 6.17E-03 8.64E-03 The MELLLA+ risk assessment reduces available the MELLLA time window for this action by an additional 10% to t=10.6 mins. ASEP Lower Bound TRC curve.

SLC-LVL1-Y Fail to control reactor level (fail 8.7 min. 7.8 min. 1.53E-02 1.92E-02 The MELLLA+ risk assessment reduces SLC), given nominal conditions the MEELLLA time window for this action by an additional 10% to t=7.8 mins (diagnosis time of 7.3 min. and execution time of 0.5 min.). ASEP Lower Bound TRC curve.

4-45 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 4.1-11 RE-ASSESSMENT OF OPERATOR ACTION HEPs POTENTIALLY IMPACTED BY MELLLA+

Aliowable Action Time EPU EPU Action ID Action Description MELLLA MELLLA+ MELLLA HEP MELLLA+ HEP Comment SLC-LVL2-Y Fail to control reactor level (fail 11.8 min. 10.6 min. 1.97E-02 2.27E-02 The MELLLA+ risk assessment reduces SLC), given challenging the MELLLA time window for this action by conditions an additional 10% to t=10.6 mins (diagnosis time of 10.1 min. and execution time of 0.5 min.). ASEP Lower Bound TRC curve.

4-46 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Figure 4.1-1 EDITS TO ATWS OVERPRESSURIZATION FAULT TREE LOGIC (Base Case)

17 'III ~

.02 MELLLAEPU ZCm 02

....2 2 2¢i0 2000,

'0 22,,2 MELLLA+ EPU

...... ........02 2"2 "'

- ° [ 7...

222'.2.0,, 2 ' 220 20 4-47 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment 4.2 LEVEL 1 PRA Section 4.1 summarized possible effects of MELLLA+ by examining each of the PRA elements. This section examines possible MELLLA+ effects from the perspective of accident sequence progression. The dominant accident scenario types (classes) that can lead to core damage are examined with respect to the changes in the individual PRA elements discussed in Section 4.1.

Loss of Inventory Makeup Transients The following bullets summarize key issues:

0 MELLLA+ has no direct impact on transient initiating event frequencies.

MELLLA+ has no impact on success criteria.

MELLLA+ has no impact on accident sequence progression.

S.. MELLLA+ has no impact on transient accident sequence timing

MELLLA+ has no impact on component failure rates As such, no changes to the existing risk profile associated with loss of inventory makeup accidents result due to MELLLA+.

Station Blackout (SBO)

The following bullets summarize key issues:

MELLLA+ has no impact on the LOOP initiating event frequency.

MELLLA+ has no impact on success criteria.

4-48 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment

MELLLA+ has no impact on accident sequence progression.

MELLLA+ has no impact on LOOP/SBO accident sequence timing

MELLLA+ has no impact on component failure rates As such, no changes to the existing risk profile associated with station blackout accidents result due to MELLLA+.

Loss of Containment Heat Removal The following bullets summarize key issues:

0 MELLLA+ has no direct impact on initiating event frequencies.

MELLLA+ has no impact on success criteria.

MELLLA+ has no impact on accident sequence progression.

MELLLA+ has no impact on transient accident sequence timing

MELLLA+ has no impact on component failure rates

MELLLA+ does not involve any changes to the containment structure or capability.

As such, no changes to the existing risk profile associated with loss of containment heat removal accidents result due to MELLLA+.

LOCAs The following bullets summarize key issues:

MELLLA+ has no impact on LOCA initiating event frequencies.

MELLLA+ has no impact on success criteria.

4-49 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment

MELLLA+ has no impact on accident sequence progression.

MELLLA+ has no impact on LOCA accident sequence timing

MELLLA+ has no impact on component failure rates

The containment analyses for LOCA under MELLLA+ conditions indicate that dynamic loads on containment remain acceptable.

As such, no changes to the existing risk profile associated with LOCA accidents result due to MELLLA+. The same general conclusion applies to ISLOCA accidents and LOCA breaks outside containment.

ATWS The following bullets summarize key issues:

MELLLA+ has no direct impact on initiating event frequencies.

8 of 8 SRVs are required for the MELLLA+ condition for RPV initial, overpressure protection during an ATWS scenario (7 of 8 SRVs were required for the MELLLA condition).

The MELLLA+ operating region is postulated to result in higher potential ATWS power, thus reducing operator action timings in ATWS scenarios.

The MELLLA+ higher potential ATWS power can be postulated to increase the stuck open relief valve probability during an ATWS.

MELLLA+ has no impact on accident sequence progression.

MELLLA+ has no impact on component failure rates MELLLA+ does not involve any changes to the containment structure or capability.

4-50 .C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment As such, changes are expected to the existing risk profile associated with ATWS accidents due to MELLLA+.

4.3 INTERNAL FIRES INDUCED RISK Monticello does not currently maintain a fire PRA.

The Monticello plant risk due to internal fires was evaluated in 1995 as part of the MNGP Individual Plant Examination of External Events (IPEEE) Submittal. [10] EPRI FIVE Methodology and Fire PRA Implementation Guide screening approaches and data were used to perform the MNGP IPEEE fire PRA study. [5,6,7]

Consistent with the FIVE Methodology and the requests of the NRC IPEEE Program, the MNGP. IPEEE fire PRA is an analysis that identifies the most risk significant fire areas in the plant using a screening process and by calculating conservative core damage frequencies for fire scenarios. As such, the accident sequence frequencies calculated for the MNGP fire PRA are not a best estimate calculation of plant fire risk and are not acceptable for direct integration with the best estimate MNGP internal events PRA results for comparison with Regulatory Guide 1.174 acceptance guidelines.

MELLLA+ does not involve any plant changes that directly impact fire accident initiation or mitigation (i.e., no changes to fire protection systems, combustible loadings, or addition of new ignition sources). The only postulated impact on the internal fire risk profile would be due'to the potential ATWS impacts discussed previously. However, fire-initiated ATWS scenarios are a non-significant contributor to the plant risk profile.

NUREG/CR-6850, Volume 2, Section 2.5.1 (page 2-7) [22] provides the following

.directions for selecting components and accident scenarios to be examined in an internal fire PRA:

4-51 C495070003-8976-1 2/21/09

Monticello MELLLA +.Risk Assessment "The types of sequences that could generally be eliminated from the PRA include the following... Sequences associated with events that, while it is possible that the fire could cause the event, a low-frequency argument can be justified. Forexample, it can often be easily demonstratedthat anticipatedtransientwithout scram (A TWS) sequences do not need to be treated in the Fire PRA because fire-induced failures will almost certainly remove power from the control rods (resultingin a trip), ratherthan cause a "failure-to-scram"condition. Additionally, fire frequencies multiplied by the independent failure-to-scramprobabilitycan usually be argued to be small contributors to fire risk."

As can be seen from the NUREG/CR-6850 excerpt above, fire-induced ATWS contributors are generally acknowledged as non-significant contributors to the fire risk profile.

Based on this discussion, it is reasonably concluded that the risk contribution of fire initiated ATWS is non-significant and does not impact the decision-making for the proposed MELLLA+ change.

This fire risk impact assessment did not involve re-performing the MNGP IPEEE internal fire analysis. Similarly, plant walkdowns for internal fire risk issues were not re-performed in support of this assessment.

4.4 SEISMIC RISK Monticello does not currently maintain a seismic PRA.

The Monticello seismic risk analysis was performed as part of the Individual Plant

.Examination of External Events (IPEEE). [10] Monticello performed a seismic margins assessment (SMA) following the guidance of NUREG-1407 and EPRI NP-6041. The SMA is a deterministic evaluation process that does not calculate risk on a probabilistic basis. No core damage frequency sequences were quantified as part of the seismic risk evaluation.

4-52 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Based on a review of the Monticello IPEEE and the key general conclusions identified earlier in this assessment, the conclusions of the SMA are judged to be unaffected by MELLLA+. MELLLA+ has no impact on the seismic qualifications of systems, structures and components (SSCs). The only postulated impact on the seismic risk profile would be-due to the potential.ATWS impacts discussed previously. However,- seismic-initiated ATWS scenarios are a non-significant contributor to the plant risk profile.

The NUREG/CR-4551 study performed severe accident analysis risk assessments for five nuclear power plants, including Peach Bottom Atomic Power Station.: The Peach Bottom NUREG/CR-4551 analysis addressed both internal and external events, including seismic initiators. It is. reasonably assumed that the seismic ATWS risk portion of the Peach Bottom NUREG/CR-4551 analysis is generically applicable to Monticello due to the similarity of the plant design and systems.

The NUREG/CR-4551 Peach Bottom seismic analysis screened seismic-induced ATWS accident sequences as non-significant contributors (<1%) to the plant seismic CDF.

Based on this discussion, it is 'reasonably concluded that the risk contribution of seismically induced ATWS is non-significant and does not impact the decision-making for the proposed MELLLA+ change.

.This seismic impact assessment did not involve re-performing the MNGP IPEEE SMA.

Similarly, SMA plant walkdowns were not re-performed in support of this assessment.

4.5 OTHER EXTERNAL EVENTS RISK In addition to internal fires and seismic events, the MNGP IPEEE Submittal analyzed a variety of other external hazards:

High Winds/Tornadoes

External Floods 4-53 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment

Transportation and Nearby Facility Accidents,

Other External Hazards The MNGP IPEEE analysis of high winds, tornadoes, external floods, transportation accidents, nearby facility accidents, and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards.

Based upon this review, it was concluded that MNGP meets the applicable NRC Standard Review Plan requirements and therefore has an acceptably low risk with respect to these hazards.

Note that internal flooding scenarios are analyzed as internal events and already are included in the MGNP internal events at-power PRA used. in this MELLLA+ risk assessment.

4.6 SHUTDOWN RISK The following qualitative discussion applies to the shutdown conditions of Hot-Shutdown (Mode 3), Cold Shutdown (Mode 4), and Refueling (Mode 5). The MELLLA+ risk impact.

during the transitional periods such as at-power (Mode 1) to Hot Shutdown and Startup (Mode 2) to at-power is judged to be subsumed by the at-power Level 1 PRA. This is consistent with. the U.S. PRA industry, and with NRC Regulatory Guide 1.174 which states that not all .aspects of risk need to be addressed for every application. While higher. conditional risk states may be postulated during these transition periods, the short time frames involved produce an insignificant impact on the long-term annualized plant risk profile.

MELLLA+ has no impact on shutdown risk.

The following bullets summarize key issues:

4-54 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment S. MELLLA+ has no impact on initiating events at shutdown. MELLLA+

does not create any new shutdown risk initiating event categories nor does MELLLA+ increase the frequency of initiating events at shutdown (e.g., loss of SDC, inadvertent drain down)..

MELLLA+ does not involve any system or plant changes that would impact success criteria during shutdown.

MELLLA+ has no impact on the accident progression timings of accidents initiated at shutdown.

MELLLA+ has no impact on system or component failure rates or availabilities for equipment used during shutdown activities.

MELLLA+ has no impact on the scheduling of outage activities.

MELLLA+ has no impact on operator actions or shutdown related procedures or processes.

As such, no changes to the existing shutdown risk profile result due to MELLLA+.

4.7 RADIONUCLIDE RELEASE (LEVEL 2 PRA)

The Level 2 PRA calculates the containment response under postulated severe accident conditions and provides an assessment of the containment adequacy., In the process of modeling severe accidents (i.e., the MAAP code), the complex plant structure has been reduced to a simplified mathematical model which uses basic thermal hydraulic principles and experimentally derived correlations to calculate the radionuclide release timing and magnitude. [9]

The following aspects of the Level 2 analysis are briefly discussed with respect to impacts postulated due to MELLLA+:

o Level 1 input

*Accident Progression

Human Reliability Analysis 4-55 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment

Success Criteria

Containment Capability

Radionuclide Release Magnitude and Timing Level 1 Input The front-end evaluation (Level 1) involves the assessment of those scenarios that could lead to core damage. The subsequent treatment of mitigative actions and the inter-relationship with the containment after core damage is then treated in the Containment Event Tree (Level 2).

In the Monticello Level 1 PRA, accident sequences are postulated that lead to core damage and potentially challenge containment. The Monticello Level 1 PRA has identified discrete accident sequences that contribute to the core damage frequency and represent the spectrum of possible challenges to containment.

The Level 1 core damage sequences are also directly propagated through the Level 2 PRA containment event trees. Changes to the Level 1 PRA modeling directly impact the Level 2 PRA results. However, the percentage increase in total CDF due to MELLLA+ is not a direct translation to the percentage increase in total LERF. Therefore, the Level 2 at-power internal events PRA model is also requantified as part of this MELLLA+ risk assessment.

Accident Progression As discussed earlier in Section 4.1.3, MELLLA+ does not change the plant configuration and operation in a manner that produces new accident sequences or changes accident sequence progression phenomenon. This is particularly true in the case of the Level 2 post-core damage accident progression phenomena. MELLLA+ does not involve any plant changes that impact modeling of post-core damage accident progression.

4-56 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Therefore, no changes are made as part of this risk assessment to the Level 2 PRA accident- sequence models (either in structure or basic event phenomenon probabilities).

Human Reliability Analysis As discussed previously, the MELLLA+ operating region is postulated to result in higher potential ATWS power, thus reducing operator action timings in ATWS scenarios. These ATWS operator action adjustments for MELLLA+ are addressed in the Level 1 models.

ATWS core damage accidents that progress into the Level 2 PRA experience just one additional operator action of note - depressurize the RPV post-core damage and prior to vessel breach. The operator response time window for this action is defined with respect to the onset of core damage and defined by core melt progression issues, and not directly related to MELLLA+ ATWS timing issues.

Therefore, no changes are made as part of this risk assessment to Level 2 HEPs.

Success Criteria No changes. in success criteria have been identified with regard to the Level 2 containment evaluation (refer to Section 4.1.2.8 of this report). Therefore, no changes to Level 2' modeling with respect to success criteria are made as part of this risk assessment.

Containment Capability As discussed in Section 4.1.9 earlier in this report, no issues have been identified with respect to MELLLA+ that have any impact on the capacity of the MNGP containment as analyzed in the PRA.

4-57 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment The MNGP containment capacity with respect to severe accidents. is.:analyzed in the PRA using plant specific structural analyses as well as information from industry studies and experiments. The MNGP containment capacity is assessed in the Level 2 PRA with respect to following challenge categories [9]:

1) Pressure Induced Containment Challenge: Containment pressures may increase from normal operating pressure along a saturation curve to very high pressures (i.e., beyond 100 psi), during accidents involving:

Insufficient long term decay heat removal; and Inadequate reactivity control and consequential inadequate containment heat removal.

2). Temperature Induced Containment Challengee: Containment temperatures can rise without substantial pressure increases if containment pressure control measures (e.g., venting) are available.- In such cases, containment temperature may increase to -

above 1000OF with the containment at less than design pressure during accidents involving core melt progression.

3). Combined Pressure and Temperature Induced Containment Challenge: Containment pressures and temperatures can both rise during a severe accident due to molten debris effects following RPV failure and subsequent core concrete interaction. For instance:

Containment temperatures can rise from approximately 300OF at core melt initiation to above 1000 0 F in time frames on the order of 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months .

Additionally, containment pressure can rise due to non-condensible gas generation and RPV blowdown in the range of 40 psig to 100 psig over this same time frame.

4) Containment Dynamic Loading-: Postulated accident sequences cover a broad spectrum of events, including failure of the containment under degraded conditions for which the following may be present:

High suppression pool temperature with substantial continuous blowdown occurring (i.e., equivalent to greater than 6% power),

4-58 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment or

- High suppression pool water levels coupled with equivalent LOCA loads and the consequential hydrodynamic loads, or

- Other energetic events, such as steam explosion.

5) Containment Isolation: Containment isolationfailure during a core damage event is modeled as leading to large early releases -in the MNGP Level 2.

MELLLA+ does not involve any changes to the containment structure or capability, or the containment isolation system. Therefore, no changes to Level 2 modeling with respect to containment failure or containment isolation failure are made as part of this risk assessment.

Release Magnitude and Timinq The "Early" timing threshold is defined in the MNGP Level 2 PRA as a release from secondary' containment beginning at 0 to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after declaration of a General

- Emergency. The 0-6 hour time frame -is based-upopn..experience data concerning non-nuclear offsite. accident response and is conservatively (i.e., 0-4 hours is a justifiable "Early" range also used in industry BWR PRAs) assumed to include cases in which minimal offsite protection measures have been performed.

The "Large" magnitude threshold is defined in the MNGP Level 2 PRA as greater than 10% release of Csl inventory in the core. This is based on past industry studies that show once the average release fraction of CsI falls below approximately 0.1, the mean number, of prompt fatalities is very small, or zero, except for a few outliers that correspond to pessimistic assumptions.

This release categorization and bases is consistent with U.S. BWR PRA industry techniques. [4, 22]

4-59 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment As discussed in Section 4.1.9, MELLLA+ has no impact on the PRA radionuclide release categorization. MELLLA+ has no impact on radionuclide release magnitude.. While the timing of ATWS scenarios can see a minor impact (e.g., reduction of 10%), this postulated timing reduction has no impact on the release timing categorization of ATWS severe accidents .because all ATWS releases are assigned the earliest release categorization

("Early") in the PRA.

Therefore, no changes to Level 2 modeling with respect to accident sequence release categorizations are made as part of this risk assessment.

Level 2 Impact Summary Based on the above discussion, the impact of MELLLA+ on the MNGP Level 2 PRA results, independent of the Level 1 analysis, is judged to be minor. The only change in the

-Level 2 PRA is due to changes in the core damage accidents used as input to the Level 2-PRA quantification.

4-60 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Section 5 CONCLUSIONS The MELLLA+ planned implementation for Monticello has-been reviewed to determine

.the net impact on the Monticello risk profile. This examination involved the identification and review of plant and procedural changes, plus assessment of changes to the risk spectrum due to the MELLLA+ changes and associated plant response during postulated accidents.

This risk assessment has been performed using as the base model the Monticello EPU MELLLA PRA average maintenance model (fault tree Risk-T&M-EPU.caf). The 1995 MNGP IPEEE study is used to support the qualitative assessment of seismic, internal fires and other external events.

This section summarizes the risk -impacts of the MELLLA+ -implementation on the following areas:

S Level I1 Internal Events PRA

Level 2 PRA

Fire Induced Risk

Seismic Induced Risk

Other External Hazards

Shutdown Risk

.Guidelines from the NRC (Regulatory Guide 1.174) are followed. to assess the change in risk as characterized by core damage frequency (CDF) and Large Early Release Frequency (LERF) 5-1 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment 5.1 LEVEL 1 PRA Table 5.1-1 provides a summary of the PRA model changes incorporated as a result of the MELLLA+ evaluation. Table 5.1-1 provides the following information:

Basic event identification and description e Basic event probability in the MELLLA reference model

Revised probability for MELLLA+

A fault tree modeling structure change to the MNGP PRA was necessary to reflect the change to the SRV fault tree logic for RPV overpressure protection during an ATWS.

All other model changes were changes to basic event probabilities (e.g., human error probability).

The MELLLA+ base case results in an increase to the at-power internal events PRA CDF from the MELLLA reference model value of 5.58E-6/yr to 5.85E-6/yr, an increase of 2.6E-7/yr. This initial base estimate is conservative; refer to Section 5.7 for sensitivities and determination of the best-estimate of the -risk impact.

5.2 LEVEL 2 PRA The Level 2 PRA calculates the containment response under postulated severe accident conditions and provides an assessment of the containment adequacy.

The MELLLA+ base case results in an increase to the at-power internal events PRA LERF from the MELLLA reference model value of 3.64E-7/yr to 4.83E-7/yr, an increase of 1.2E-7/yr. This initial base estimate is conservative; refer 'to Section 5.7 for sensitivities and determination of the best estimate of the risk impact.

5-2. C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table 5.1-1 BASE CASE: MNGP PRA MODEL CHANGES TO RELECT MELLLA+

MELLLA MELLLA+

Change Parameter ID Model Element Description . Value Value Human Error RHR-DHR-AY Fail to align RHR for CHR - ATWS 2.19E-02 3.25E-02 Probability (HEP) SLC-INI-SY Fail to initiate SLC - short time available 6.17E-03 8.64E-03 Changes to address reduced SLC-LVL1-Y Fail to control reactor level (fail SLC), 1.53E-02 1.92E-02 timings .given nominal conditions SLC-LVL2-Y Fail to control reactor level (fail SLC), 1.97E-02 2.27E-02 given challenging conditions DEP-02MN-Y Fail RPV depressurization within 2 5.1OE-01 1.00E+00 minutes SD-NOTRIPY Fail to prevent turbine trip while 2.27E-01 2.50E-01 shutting down SORV XVR-ATWS-C One or more relief valve fails to close - 2.26E-02 2.49E-02 Probability -ATWS scenario "

RPV Fault Tree Gate

Fault tree gate X028 revised from a n/a n/a Overpressure X028 (refer to 2/8 gate' to an "OR" gate, such that Protection for Figure 4.1-1) failure of any single SRV to open will ATWS " - result in RPV overpressurization.

SRV CCF basic events removed as they are not applicable given just a single SRV failure is assumed to fail this function for the MELLLA+

condition.

5-3 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment 5.3 FIRE INDUCED RISK Theý risk contribution of fire initiated ATWS is non-significant and, does not impact the decision-making for the proposed MELLLA+ change (refer to Section 4.3 of this report).

5.4 SEISMIC RISK The risk -contribution of seismically induced ATWS is non-significant and does not impact the decision-making for the proposed MELLLA+ change (refer to Section 4.4 of this report).

5.5 OTHER EXTERNAL HAZARDS Based on review-of the Monticello IPEEE, MELLLA+ has no significant impact on the

... plant risk profile associated with tornadoes, external floods,.. transportation accidents, and other external hazards. Refer to Section 4.5 of this report for further discussion.

5.6 SHUTDOWN RISK MELLLA+ has no impact on shutdown risk (refer to Section 4.6 of this report).

5.7 QUANTITATIVE BOUNDS ON RISK CHANGE 5.7.1 Sensitivity Studies As discussed in previous sections, the initial base case results are judged conservative.

The conservative nature of the base case results are primarily due to the following two items: 1) assuming the design basis ODYN calculations that allow 0 SRVs OOS for isolation ATWS scenarios; and 2) conservative elements in the base MNGP PRA that become highlighted when 0 SRVs OOS for ATWS is assumed in the model.

5-4 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment One of the methods to provide valuable input into the'decision-making process is to perform sensitivity calculations for situations with different assumed conditions to bound the results.

These sensitivity studies investigate the impact on the at-power internal events CDF and LERF and determine the.best estimate case.for this risk assessment. Nine (9) quantitative sensitivity cases are performed and discussed below.

Sensitivity #1 This sensitivity case addresses the dominant modeled impact in the risk calculation, i.e.,

0 SRVs OOS for ATWS sceharios.

The ODYN software calculations performed for the.MELLLA+ condition require all SRVs to be functional, no SRVs can-be out of service, to-maintain the RPV pressure spike below the ASME Service Level C limit of 1500 psig during an isolation ATWS event, such as. an MSIV Closure ATWS (refer to MELLLA+ Task Report 0902, "ATWS").

' Isolation ATWS scenario (e.g. ,MSIV Closure ATWS) calcuIations performed using the TRACG software are also documented in MELLLA+ Task Report 0902. The TRACG software calculations showed that 1 SRV can be OOS for an isolation ATWS scenario (e.g., MSIV Closure ATWS) and the RPV pressure spike remains below the ASME Service Level C limit.

As discussed in MELLLA+ Task Report 0902, TRACG calculations are best-estimate calculations compared to the more conservative licensing basis ODYN calculations.

This sensitivity case is performed by reversing the changes in the MELLLA+ model described for "Fault Tree Gate X028" in Table 5.1-1. All other parameters are maintained the. same as the MELLLA+ base case. No changes to the MELLLA reference model are made for this sensitivity case.

.. 5-5 .C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #2 This sensitivity case addresses a non-significant conservative element in the MNGP PRA that is highlighted and becomes a significant contributor to the delta CDF and delta LERF when 0 SRVs OOS for ATWS scenarios is assumed in the MELLLA+ base case calculation. This conservative element is the pre-initiator error probability assumed for "failure to restore post-maintenance" for the SRVs. This out of service probability is modeled in the PRA for each SRV, in addition to the other failure mode for "SRV fails to open".

The value used. in the MNGP base model for the probability that an SRV may be inadvertently- improperly installed ..during an -outage- and exist in that inoperable configuration at-power is 8.1E-3 per SRV. This probability is judged an order of magnitude too high. Using the ASEP pre-initiator HEP method in the EPRI HRA Calculator software along with the following assumptions, a revised error rate of 3E-4 is calculated for use in this sensitivity case:

SRV is replaced or receives maintenance once per fuel cycle Opportunity exists to install/restore SRV incorrectly such that it is not functional in safety relief mode SRV inoperability cannot be detected until the subsequent refuel outage

ASEP methodology base human error probability (BHEP) is reasonably assumed to apply ASEP BHEP Recovery potential:

- No compelling status/signal in MCR of SRV inoperable status

- Post-maintenance test/calibration performed 5-6 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Independent verification of post-maintenance test/calibration not assumed

" Daily or shift checks do not apply This error rate change is made.to the following basic events in the MELLLA reference model and the MELLLA+-model (all other parameters are maintained the same):

XVR2-71AXZ, "SRV 2-71A Improperly Returned to Service".

XVR2-71 BXZ, "SRV 2-71 B Improperly Returned to Service"

XVR2-71CXZ, "SRV 2-71C Improperly Returned to Service"

XVR2-71 DXZ, "SRV 2-71 D Improperly Returned to Service"

XVR2-71 EXZ, "SRV 2-71 E Improperly Returned to Service"

XVR2-71 FXZ, "SRV 2-71 F Improperly Returned to Service"

XVR2-71GXZ, "SRV 2-71G Improperly Returned to Service"

XVR2-71HXZ, "SRV 2-71H Improperly Returned to Service" The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #3 This sensitivity case increases the Turbine Trip transient initiator frequency to investigate the impact on the delta risk calculations for postulated long-term increase in the frequency of plant transients due to operation in the proposed MELLLA+ region. The revision to the Turbine Trip frequency using an approach that assumes an additional turbine trip is experienced in the first year following start-up in the MELLLA+ condition and an additional 0.5 event in the second year. This approach postulates a trip in the first year specifically due to MELLLA+, and then assumes a 50% likelihood that plant corrections to address the root cause of the trip do not correct the issue and a trip occurs again. No such increases in frequency of transients are expected.

5-7, C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment The change in the long-term average of the Turbine Trip (IETURB-TRIP) frequency is calculated as follows for this sensitivity case:

Base long-term Turbine Trip frequency is 9.90E-1/yr"

.* 10 years is used as the "long-term" data period

End of 10 years does not reach the end-of-life portion of the bathtub curve

Revised Turbine Trip frequency for this sensitivity case is calculated as:

(10 x 0.99) + 1.0 + 0.5 = 1.14/yr 10 This change is made to the MELLLA+ model. All other parameters are maintained the

.-same as the MELLLA+ base case. No changes- to the MELLLA reference model are made for this sensitivity case.

The model changes made for this sensitivity case are summarized in Table5.7-1.

Sensitivity #4 This sensitivity case conservatively assumes that the potential impact on transient initiator frequencies is manifested in the MSIV Closure initiator frequency and .not the Turbine Trip frequency. The MNGP base MSIV Closure initiator frequency (IEMSIV) of 3.80E-2 is revised in this sensitivity case in the same manner as that discussed in Sensitivity Case #1:

(10 x 3.80E-2) + 1 + 0.5 = 1.88E-1/yr 10 5-8 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment This change isrmade to the MELLLA+ model. All other parameters are maintained the same as the MELLLA+ base case. No changes to the MELLLA reference model are made for this sensitivity case.

The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #5 This case addresses the sensitivity of a dominant contributor to the delta risk results -

the scram failure probability.

The MNGP base PRA uses the current industry accepted scram failure probabilities, based on NRC study NUREG-5500:

. LASCRAMMEC, "FAILURE-TO SCRAM (Mechanical)" = 2.1E-6/demand

LASCRAMRPS, "FAILURE TO SCRAM (RPS)" .= 3.8E-6/demand Prior to NRC study NUREG-5500, the.generic industry scram failure probabilities for a BWR PRA were significantly higher (1 E-5/demand for mechanical scram failure and 2E-5/demand for electrical scram failure), based on estimates from the Utility Working Group on ATWS circa 1980.

This sensitivity study conservatively uses these older higher scram failure probabilities for basic events LASCRAMMEC and LASCRAMRPS. These. basic event probability changes are made to both the MELLLA reference model and the MELLLA+ model (all other parameters are maintained the same).

The model changes made for this sensitivity case are summarized in Table 5.7-1.

5-9 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Sensitivity #6 This case addresses the sensitivity of the delta risk results to the ATWS operator action error rates.

This sensitivity case assumes no impact on the ATWS human error probabilities (i.e.,

the ATWS HEPs in the MELLLA PRA model are maintained unchanged in the MELLLA+ model). All other parameters are maintained the same as the MELLLA+

base case. No changes to the MELLLA reference model are made for this sensitivity case.

The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #7 Similar to Sensitivity Case #6, this case addresses the sensitivity of the delta risk results to the ATWS operator action error rates.

This sensitivity case assumes the ATWS human error probabilities in the MELLLA PRA

.,model are doubled for the MELLLA+ condition. All other parameters are maintained the same as the MELLLA+ base case. No changes to the MELLLA reference model are made for this sensitivity case.

The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #8 This sensitivity case combines the changes of Sensitivity Case #1 (best-estimate TRACG calculation) and Sensitivity Case #2 (refined SRV OOS probability). All other 5-10 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment parameters are maintained the same. The model changes made for this sensitivity case are summarized in Table 5.7-1.

This case is judged the best-estimate case of the MELLLA+ risk assessment quantification cases.

Sensitivity #9 This sensitivity case combines the changes of Sensitivity Case #1 (best-estimate TRACG calculation), Sensitivity Case #2 (refined SRV OOS probability), Sensitivity Case #3 (Turbine Trip frequency increase postulated) and Sensitivity Case #5 (higher scram failure probability). All other parameters are maintained the same. The model changes made for this sensitivity case are summarized in Table 5.7-1.

5.7.1..2 Sensitivity Results The results of the nine (9) sensitivity cases performed in support of this risk assessment are provided in Table 5.7-1. The results of the sensitivity cases are summarized below:

Base Case: The initial base case results yield a delta CDF in the RG 1.174 "very small" risk increase region and a delta LERF that exceeds the RG 1.174 "very small" threshold by a minor amount (entering the RG 1.174 "small" risk increase region). These base case results are conservative. The conservative nature of the base case results are primarily due to the following two items: 1) assuming the design basis ODYN calculations that allow 0 SRVs OOS for isolation ATWS scenarios; and 2) conservative elements in the base MNGP PRA that become highlighted when 0 SRVs OOS for ATWS is assumed in the model.

Sensitivity #1: This case shows that if the TRACG calculations for ATWS (as opposed to the more conservative licensing basis ODYN calculations) are used in the risk assessment to allow 1 SRV. OOS for an isolation ATWS scenario then both the delta CDF and the delta LERF results are lower than the conservative base case and both are in the "very small" risk increase region of RG 1.174.

5-11 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment

, Sensitivity #2: This case addresses the conservative failure probability used in the MNGP base PRA for an SRV being unavailable due to postulated maintenance errors during a previous outage. This conservative probability is not significant to the MNGP base PRA but becomes significant to the delta risk results in this study when 0 SRVs OOS is assumed required for isolation ATWS scenarios. This sensitivity case employs a more reasonable estimate using human reliability analysis techniques. This case shows that using a more realistic probability for SRVs being unavailable due to maintenance errors results in both the delta CDF and the delta LERF being lower than the conservative base case and both being in the "very small" risk increase region of RG 1.174.

Sensitivity #3: Operation in the MELLLA+ region and the associated plant changes have no direct impact on calculated initiating event frequencies. This sensitivity case postulates an increase in the transient initiating event frequency due to unknown causes due to operation in the MELLLA+ region. The Turbine Trip with bypass initiator frequency is adjusted in this case. This case results in the same conclusions as the conservative base case (i.e., delta CDF in the

.RG 1.174 "very small" risk-increase region and-delta LERF exceeds the RG 1.174 "very small" threshold by a minor amount).

Sensitivity #4: This case is the same as Sensitivity Case #3 except the MSIV Closure initiator frequency is adjusted in this case. This case results in the same -conclusions as the conservative base case (i.e.,

delta CDF in the RG 1.174 "very small" risk increase region and delta LERF exceeds the RG 1.174 "very small" threshold by a minor amount).

Sensitivity #5: As the postulated risk increases due to MELLLA+ relate primarily to ATWS scenarios, this case adjusts the failure to scram probabilities in the model. This conservative sensitivity employs the higher failure to scram probabilities used earlier in the PRA industry; This case results in higher delta risk results than the conservative base case. In this case, both the delta CDF and the delta LERF results are in the "small" risk increase region of RG 1.174. This conservative case shows that the even if the older obsolete industry scram failure probabilities were to be assumed, the delta risk results do not exceed the "small" risk region.

Sensitivity #6: The primary impact on the calculated delta risk results is due to an assumed increase in ATWS power due to MELLLA+.. The assumed increase in ATWS power is actually a potential condition 5-12 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment depending upon the reactor power flow condition at the time of a plant trip. This sensitivity investigates the impact on the calculated risk results if the no impact on operator action timings (and thus no change to operator error rates) is assumed for the ATWS scenarios in the model. This case results in the same conclusions as the conservative base case (i.e., delta CDF in the RG 1.174 'very small" risk increase region and delta LERF exceeds the RG 1.174 "very small" threshold by a minor amount).

Sensitivity #7: This case is analogous to Sensitivity Case #6, except in this case the impact on operator error rates is increased over that assumed in the base case. The base case quantification estimates an approximate 10% postulated increase in the ATWS power for MELLLA+ versus MELLLA. This -sensitivity case assumes a 20%

increase in ATWS power and adjusts the ATWS related HEPs accordingly. This case results in the same conclusions as the conservative base case (i.e., delta CDF in the RG 1.174 "very small".

risk increase region and delta LERF exceeds the RG 1.174 "very small" threshold by a minor amount).

Sensitivity #8 (Best Estimate Case): This case combines Sensitivities

1 and #2, addressing both- key conservative -issues in -the base quantification. This sensitivity uses the TRACG ATWS calculations that show 1 SRV OOS during an isolation (e.g., MSIV closure) ATWS scenario is sufficient to prevent RPV overpressurization. This sensitivity also uses a more realistic value for an SRV being.,

unavailable due to postulated maintenance errors in a previous outage. This case is the Best Estimate calculation in 'this risk assessment. This case results in both the delta CDF and the delta.

LERF being lower than the conservative base case and both being in the "very small" risk increase region of RG 1.174.

Sensitivity #9: This case combines the Best Estimate case (Sensitivity

8) with the conservative failure to scram probability of Sensitivity #5.

This case results in the same conclusions as the conservative base case (i.e., delta CDF in the RG 1.174 "very small" risk.increase region and delta LERF exceeds the RG 1.174 "very small" threshold by a minor amount).

5-13 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment 5.7.2 Results Summary A number of quantitative sensitivities were performed to investigate the impact on delta CDF and delta LERF results for the proposed MELLLA+ operating regime. Refer to Table 5.7-1 for a summary of the results.

The best estimate of the risk increase for at-power internal events due to MELLLA+ is a delta CDF of 7.36E-8. The best estimate at-power internal events LERF increase due to MELLLA+ is a delta LERF of 1.62E-8.

Using the NRC guidelines established in Regulatory Guide 1-.174 and the calculated results from the Level 1 and 2 PRA, the best estimate for the CDF risk increase (7.36E-8/yr) and the best estimate for the LERF increase (1.62E-8/yr) are both within Region III (i.e., changes that represent very small risk changes).

Based on these results, the proposed MNGP MELLLA+ operating regime is acceptable on a risk basis.

5-14 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table 5.7-1 RESULTS OF MNGP MELLLA+ PRA SENSITIVITY CASES

[Best MNGP MELLLA+ Estimate]

MELLLA Base Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Parameter ID PRA Case Case #1 Case #2 Case #3 Case #4 Case #5 Case #6 Case #7 Case #8 Case #9 MELLLA MELLLA+ MELLLA+ MELLLA+ MELLLA+ MELLLA+ MELLLA+ < MELL*LAM*EA, 11**LI MELLLA+ MELLLA+

ATWS HEPs(1) PRA Values Values Values Values Values Values PRA PR4A Values Values (TbI 4.1-11) (TbI 4.1-11) (TbI 4.1-11) (TbI 4.1-11) (TbI 4.1-11) (TbI 4.1-11) (TbI 4.1-11) (Tb, 4.-11 Values (mbI4.1-11) (Tbl 4.1-11)

SORV MELLLA+ MELLLA+ MELLLA+ MELLLA+ MELLLA+ MELLLA+ MELLLA+ MELLLA+ MELLLA+

1 21 Base Value Base Value Base Value Probability 2.26E-2 2.49E-2 Base Value Base Value Base Value Base Value Base Value Base Value SRVs Reuired 7/8 8/8, 8/8 8/8 8/8 8/8 8/8 8/8 7/8 SRV OOS 8.10E-3 MELLLA MELLLA ' MELLLA MELLLA MELLLA MELLLA MELLLA 1 41 PRA Value PRA Value PRA Value PRA Value Probability PRA Value PRA Value PRA Value Turbine Trip IE(5) 9.90E-1 MELLLA MELLLA MELLLA 1 14: MELLLA MELLLA MELLLA MELLLA MELLLA PRA Value PRA Value PRA Value , *. PRA Value PRA Value PRA Value PRA Value PRA Value MSIV Closure MELLLA MELLLA MELLLA MELLLA MELLLA MELLLA MELLLA MELLLA MELLLA.

E(6 3 E PRA Value PRA Value PRA Value PRA Value 1 PRA Value PRA Value PRA Value PRA Value. PRA Value Scram Failure 2.1E-6 (Mech) MELLLA . MELLLA MELLLA MELLLA MELLLA 1E-5, (*e*h) MELLA MELLLA MELLLA i1E-b(Mech)

Probabilities(7) 3.8E-6 (Elec) PRA Values PRA Values PRA Values PRA Values PRA Values 2E5 (cF I PRA Values PRA Values PRA Values :2E-5 (Elec) 5.66E-06 8.05E-06 577E065.65E-06 7.29E-06 CDF: 5.58E-06 5.85E-06 5.66E-06 5.93E-06(5.58E-6) (6.77E-6)(58E6 (6.75E-6)

(.7-)

(5.58E-6) delta CDF(9): 2.64E-07 .7.36E-08 8.06E-08(8 ) 3.43E-07 3.41E-07 1.29E-06(8 ) 1.87E-07 3.32E-07. 7.36E-08(8 ) 5.41 E-07 8 )

LERF: 3.64E-07 4.83E-07 3.80E-07 3.82E-07 ~ 5.10E-7 1E7 5.1E-07 1.43E-06 46F0 4.66E-07 1E7 5.18E-07 .3.78E-07 :9.94E-07

.4E-7 (3.62E-7) . .- (8.57E-7) (3.62E-7) (8.44E-7) delta LERF(9 ): 1.19E-07 1.62E-08 2.08E-08(8 ) 1.46E-07 1.46E-07 5.75E-07(8) 1.02E-07 1.54E-07 1.62E-08(s) 1.50E-07(s) 5-15 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Notes to Table 5.7-1:

(1) The ATWS HEPs are those shown in Table 5.1-1. Refer to Section 4.1.6 for discussion of adjustment to these HEPs for MELLLA+.

(2) The Stuck Open Relief Valve (SORV) probability in the MNGP PRA for an ATWS scenario is modeled with basic event XVR-ATWS-C.

Refer to Section 4.1.2.6 for discussion of adjustment to this value for MELLLA+.

(3) Refer to Section 4.1.2.5 for the discussion of the MELLLA+ impact on the number of SRVs required for ATWS overpressure protection and how the.MELLLA base PRA model is adjusted to reflect this issue. Refer to Section 5.7.1, Sensitivity Case #1, for discussion of the TRACG results and how the MELLLA+ PRA model is adjusted to reflect use of the TRACG results.

(4) The SRV OOS probability refers to the following pre-initiator HEPs in the MNGP PRA for SRVs not properly restored to operability post test/maintenance:

- XVR2-71AXZ, "SRV 2-71A Improperly Returned to Service"

- XVR2-71BXZ, "SRV 2-71B Improperly Returned to Service"

- XVR2-71CXZ, "SRV 2-71C Improperly Returned to Service"

- XVR2-71DXZ, "SRV 2-71D lmproperly Returned to Service"

- XVR2-71 EXZ, "SRV 2-71 E Improperly Returned to Service"

- XVR2-71 FXZ, "SRV 2-71 F Improperly Returned to Service"

- XVR2-71 GXZ, "SRV 2-71 G Improperly Returned to Service"

- XVR2-71HXZ, "SRV 2-71H Improperly Returned to Service" (5) The turbine trip initiating event frequency is modeled in the MNGP PRA with basic event IETURB-TRIP. Refer to Section 5.7.1, Sensitivity Case #3, for discussion of adjustment to this frequency~as a sensitivity case.

(6) The MSIV closure initiating event frequency is modeled in the MNGP PRA with basic event IEMSIV. Refer to Section 5.7.1 Sensitivity Case #4, for discussion of adjustment to this frequency as a sensitivity case.

(7) Scram failure is modeled in the MNGP PRA with the following two basic events: LASCRAMMEC, "Failure to Scram (Mechanical)", and LASCRAMRPS, "Failure to Scram (RPS)". Refer to Section 5.7.1, .Sensitivity Case #5, for discussion of adjustment to these parameters as a sensitivity case.

(8) The sensitivity case involved changes to the MELLLA base reference model, thus these delta risk calculations are with. respect to the revised MELLLA base CDF and LERF for this case (revised MELLLA base CDF and LERF shown in parenthetical).

(9) Delta risk results calculated using results with 3 decimal points; delta risk results rounded to.2 decimal points for summary in this table.

(1O)Shaded cellsshow those parameters adjusted for the sensitivity case.

5-16 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment t

10-5 10-13 10-5 10-4 CDF -- 0' 03 Best estimate of CDF cha'nge for MELLLA+

.Figure 5.7-1 MNGP MELLLA-+ Risk Assessment CDF Result Vers'us RGA1.174 Acceptance Guidelines* for Core Damage Frequency (CDF)

The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

5-17 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment t

-J 1-Q 10Q-7 10-6 10-5 LERF-10 03 Best estimate of LERF change for MELLLA+

Figure 5.7-2 MNGP MELLLA+ Risk Assessment LERF Result Versus RG 1.174 Acceptance Guidelines* for (LERF)

The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

5-18 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment REFERENCES

[1] Monticello Nuclear Generating Plant, "Monticello Individual Plant Examination (IPE) Submittal", February 1992.

[2] Monticello PRA Peer Review Certification Report, GE Document BWROG/PSA-9704, October 1997.

[3] Idaho National Engineering and Environmental Laboratory, Rates of Initiating.

Events at U.S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, February 1999.

[4] NEI, PRA Peer Review Guidelines, NEI 00-02, Rev. A3, 3/20/2000.

[5] Professional Loss Control, Inc., Fire-Induced Vulnerability Evaluation (FIVE),

EPRI TR-100370, April 1992.

[6] Letter from W.H. Rasin (NUMARC) to NUMARC Administrative Points of Contact, "Revision 1 to EPRI Final Report dated April 1992, TR-100370, 'Fire Induced Vulnerability Evaluation Methodology'", September 29, 1993.

[7] Science Applications International Corporation, Fire PRA Implementation Guide, EPRI TR-105928, Final Report, 1995.

[8]_. General Electric, Licensing Topical Report: General Electric- Boiling Water Reactor Maximum Extended Line Limit Analysis Plus, NEDC-33006P, Rev. 2,ý November 2005.

[9] MNGP PRA Document II.SMR.02.010, "Radioactive Release Frequency /

Containment Performance Event Trees".

[10] Monticello Nuclear Generating Plant, "Monticello Nuclear Plant Individual Plant Examination for External Events (IPEEE) Submittal", November 1995.

[11] U.S. Nuclear Regulatory Commission, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10CFR50.54(f)", Generic Letter 88-20, Supplement 4, June 28, 1991.

[12] U.S. Nuclear Regulatory Commission, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, NUREG-1407, June 1991.

[13] General Electric, Generic Guidelines for General Electric Boiling Water Reactor Extended Power Uprate, NEDC-32424P-A, February 1999.

R-1 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment

[14] General Electric, Generic Evaluations for General Electric Boiling Water Reactor Extended Power Uprate, NEDC-32523P-A, February 2000.

[15] Xcel letter to NRC, "License Amendment Request: Extended Power Uprate. L-MT-08-052, November 5, 2008.

[16] U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation Review Standard for Extended Power Uprates, RS-001, Rev. 0, December 2003.

[17] U.S. Nuclear Regulatory, Individual Plant Examination Program: Perspectives on Reactor Safety and Plant Performance, Parts 2-5, Vol. 2, NUREG-1560, December 1997.

[18] Sandia National Laboratories, Analysis of Core Damage Frequency: Peach Bottom, Unit 2. External Events, NUREG/CR-4550, Vol. 4, Rev. 1, Part 3, December 1990.

[19] Xcel Energy letter to NRC, "Response to NRC Probabilistic Risk Assessment (PRA) Branch Requests for Additional Information (RAIs) dated December 5, 2008 (TAC No. MD9990)", L-MT-09-002, February 4, 2009.

[20] Xcel Energy letter to NRC, "Monticello Extended Power Uprate: Response to NRC Probabilistic Risk Assessment (PRA) Branch Requests for Additional Information (RAIs) dated April 29, 2009 (TAC No. MD9990)", L-MT-09-029, May 29, 2009.

[21] EPRI, PSA Applications Guide, EPRI TR-105396, Final Report, August 1995.

[22] NUREG/CR-6850, EPRI Report 1011989, "Fire PRA Methodology for Nuclear Power Facilities", September 2005.

[23] General Electric, Constant Pressure Power Uprate, NEDC-33004P-A, Revision 4, July 2003.

[24] U.S. Nuclear Regulatory, RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis.

R-2 C495070003-8976-12/21/09

Appendix A MONTICELLO PRA QUALITY

Monticello MELLLA + Risk Assessment Appendix A MONTICELLO PRA QUALITY The quality of the Monticello PRA models used in performing this risk assessment is manifested by the following:

Level of detail in PRA

Maintenance of the PRA

Comprehensive Critical Reviews A.1 LEVEL OF DETAIL The Monticello PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events.

A.1.1 Initiatinq Events The Monticello at-power PRA explicitly models a large number of internal initiating events:

General transients

LOCAs

Support system failures

Internal Flooding events The initiating events explicitly modeled in the Monticello at-power PRA are summarized in Table A-I. The number of internal initiating events modeled in the Monticello at-power PRA is similar to the majority of U.S. BWR PRAs currently in use.

A-1 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table A-1 INITIATING EVENTS FOR MONTICELLO PRA Initiator ID Description IE_125VDC Loss of both divisions of 125V DC IE_125VDC1 Loss of division . 125V DC power IE_125VDC2 Loss of division lI 125V DC power IEAIR Loss of instrument air IEBUS13 Loss of electrical bus 13 IEBUS14 Loss of electrical bus 14 IEBUS15 Loss of electrical bus 15 IEBUS16 Loss of electrical bus 16 IECRDH Loss of CRDH IEDW-COOL Loss of drywell cooling IEFW Loss of feedwater IELLOCA Large LOCA initiating event

.IE_LOOP Loss of offsite power initiating event IEMLOCA Medium LOCA initiating event IEMSIV MSIV closure IERBCCW Loss of RBCCW IEREFLAB Break in both reference legs IEREFLEGA Break in 2-3-2A reference leg IEREFLEGB Break in 2-3-2B reference leg IESHUTDOWN Manual shutdown of reactor IE_SLOCA Small LOCA initiating event IESORV Relief valve spuriously fails open IESW Loss of service water IETURB-TRIP Turbine trip A-2 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table A-1 INITIATING EVENTS FOR MONTICELLO PRA Initiator ID Description IEVACUUM Loss of condenser vacuum IEXLOCA RPV rupture ISLOCA Interfacing Systems LOCA (numerous unique IEs)

Breaks Outside Containment LOCA Outside Containment (Numerous unique IEs)

Floods Internal Flooding initiators (numerous unique IEs)

A-3 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment A.1.2 System Models The Monticello at-power PRA explicitly models a large number of frontline and support systems that are credited in the accident sequence analyses. The Monticello systems are modeled in the Monticello at-power PRA using fault tree structures for the majority of the systems. The number and level of detail of plant systems modeled in the Monticello at-

.power PRA is consistent with industry practices.

A. 1.3 Operator Actions The Monticello at-power PRA explicitly models a large number of operator actions:

Pre-Initiator actions

Post-Initiator actions

Recovery Actions Over one hundred operator actions are explicitly modeled. Given the large number of actions modeled. in the Monticello at-power internal events PRA, a summary table of the individual actions modeled is not provided here.

The human error probabilities for the actions are modeled with accepted industry HRA techniques and include input based on discussion with plant operators, trainers, and other cognizant personnel.

The number of operator actions modeled in the Monticello at-power PRA, and the approach to their quantification is consistent with industry practices.

A.1.4 Common Cause Events The --Monticello at-power PRA explicitly models a large number of common cause A-4 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment component failures. Approximately two hundred common cause terms are included in the MNGP PRA. Given the large number of CCF terms modeled in the Monticello at-power internal events PRA, a summary table of them is not provided here. The number and level of detail of common cause component failures modeled in the Monticello at-power PRAis consistent with industry practices.

A.1.5 Level 2 PRA The Monticello Level 2 links the Level 1 PRA accident sequences and systems logic with Level 2 containment event tree sequence logic and systems logic.

The following aspects of the Level 2 model reflect the more than adequate level of detail and scope:

Dependencies from"Level 1 accidents are carried forward directly into the Level 2 by transfer of sequences to ensure that their effects on Level 2 response is accurately treated.

Virtually all phenomena identified by the NRC and industry for inclusion in BWR Mark I Level 2 analyses are treated explicitly within the model.

The model truncation is sufficiently low to be consistent with the NEI PRA Peer Review Guidelines for Risk-Informed Applications.

A.2 MAINTENANCE OF PRA MNGP IPE Submittal The Monticello PRA was originally developed in response to the NRC Individual Plant

.Examination (IPE) Program, per NRC Generic Letter 88-20. The Monticello IPE was submitted in February 1992. [1]

A-5 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment The Monticello IPE submittal and the related NRC Staff Evaluation Report (SER) dated May 26, 1994 have been reviewed to identify references to vulnerabilities, weaknesses, and review findings. The results of the review, including the disposition of each observation are documented in the Table A-2. These findings have been previously incorporated into the PRA model where applicable and do not involve material impacts to the EPU or MELLLA+ risk assessments.

MNGP PRA Maintenance/Update Processes The Monticello PRA model and documentation has been maintained living and is routinely and systematically updated to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data. Controlled processes are in place at MNGP to identify plant modifications that impact the PRA. FP-PE-PRA-02, PRA Guideline for Model Maintenance and Update and PEI-05.01.03, PRA Guideline- for Model Maintenance and Update, provide the processes and guidance for MNGP PRA model maintenance and periodic updates (refer to Reference [19]). In addition, plant changes and other relevant issues are assessed by the.PRA group, and

-non-periodic updates are performed by PRA personnel if an identified plant change is assessed to involve a change to a system credited in the PRA or to significantly impact the calculated risk profile. PRA personnel are advised of pertinent plant modifications per procedure.

The Monticello PRA has been updated multiple times since the original IPE. A RG 1.200 update to the MNGP PRA is in progress at this time but is not available for use at this.time (the conclusions of this study would not change).

The PRA models are routinely implemented and studied by plant PRA personnel in the performance of their duties.

Formal comprehensive model reviews are discussed in Section A.3.

I.A-6 C495070003-8976-1 2/21/09

Monticello MELLLA + Risk Assessment:*

.Table A-2

SUMMARY

OF DISPOSITION OF MNGP.IPE OBSERVATIONS Observation Disposition The IPE summary of major findings indicates that no new No disposition necessary.

or unusual means were discovered by which core damage or containment failure could occur. No vulnerabilities, including internal flooding vulnerabilities, were identified as part of the IPE process for Monticello.

No specific Unresolved Safety Issues or Generic Safety Issues were proposed for resolution as part of the IPE.

The demineralizer bypass valve may not open uporn a A modification to the demineralizer bypass valve was loss of instrument air. performed to assure faster operation of the valve upon loss of instrument air.

Modification to the bottled N2 supply for the SRV Modification of alternate N2 supply to drywell solenoid valves was considered in order to preclude pneumatics, including SRV solenoid valves, removed dependency on non-essential AC power. *dependency on AC power. The PRA model reflects this inthe current plant design.

Importance of reactor depressurization has been Depressurization is a critical task that is assigned an recommended for reinforcement inoperator training, associated Job Performance Measure in simulator scenarios. Also, the importance of depressurization is captured in EOP training.

The plant was encouraged to pursue relaxation of the The Drywell Spray Limit curve was modified subsequent drywell spray initiation limit through BWROG Severe to the IPE submittal to be consistent with restrictions that Accident Working Committee. are intended to maintain primary containment integrity and protect equipment located within the primary containment.

Procedures were drafted to upgrade steps to load shed The site Station Blackout procedureandother operating station batteries to extend battery life. Recommendations procedures provide guidance to preserve battery

.were made to develop alternate methods to supply capacity as well as provide alternate methods to support station essential battery chargers. battery charger operation using alternate power sources such as the # 13 Diesel Generator, the Security Diesel, or a portable generator.

Consider an AC independent means of decay heat Monticello has installed a Hard Pipe Vent and has removal in the form of the Hard Pipe Vent. procedures to implement its use.

Improve capability of manually aligned, backup low Procedures to provide makeup to the reactor vessel pressureinjection systems such as RHRSW through using low pressure alternate injection systems including LPCI, Condensate Service Water, and Service Water to RHRSW, Condensate Service Water, and Service Water the Hotwell. to the Hotwell have been developed and implemented.

Write a procedure for emergency replenishment of the A procedure was written and a fill pipe has been CSTs. fabricated to allow providing makeup water to~the CSTs from an alternate water source such as a tanker truck or the fire water system.

Remove the actions for mechanically bound CRDs to a Failure to scram actions have been optimized and...

contingency procedure inthe EOPs, so that the operator proceduralized to coordinate an effective reactor will focus on reactor shutdown with SLC. shutdown using SBLC if necessary. Alternate Rod Injection is a separate procedure.

Test the CRD boron injection hoses to show that they are CRD boron injection hoses have recently been replaced unlikely to fail due to collapse with SLC. based on shelf life considerations.

A-7 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Planned or Implemented Modifications The base reference model used in this risk assessment is the MNGP Level 1 and Level 2 at-power internal events EPU MELLLA PRA average maintenance model. (fault tree Risk-T&M-EPU.cat). This model is based on the MNGP 2005 PRA, model of record and includes the model modifications to reflect EPU plant modifications already implemented and EPU planned plant modifications. yet to be implemented, as well as other outstanding plant modifications that. have been implemented or planned for implementation in the near future.

Most of the EPU planned modifications are already implemented in the plant.

Outstanding EPU planned modifications include the BOP modifications and AC system conversion to 13.8 kV. -All of the EPU mods are currently scheduled for completion before MELLLA+ implementation, and are integrated as appropriate into the PRA model (as described in References [15] and [119]) used- in this MELLLA+ risk assessment.

In addition. to EPU plant modifications that are reflected in the PRA model, other planned or implemented plant modifications not represented in the MNGP -2005 PRA model (used as the starting point to develop the EPU Risk-T&M-EPU.caf PRA model)

'have been integrated into the PRA model, as described in Reference [19].

The MELLLA+ plant changes and their impacts are implemented into the PRA model as summarized in Table 5.1-1 of this report.

A.3 COMPREHENSIVE CRITICAL REVIEWS The Monticello PRA model has benefited from the following comprehensive technical reviews:

" NEI PRA Peer Review Process

" Recent assessments against the ASME PRA Standard A-8 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment NEI PRA Peer Review The Monticello internal events PRA received a formal industry PRA Peer .Review in October 1997. [2] The purpose of the PRA Peer Review process is to provide a method for establishing the technical quality of a PRA for the spectrum of potential risk-informed plant licensing applications for which the PRA may be used. The PRA Peer Review process uses a team composed of PRA and system analysts, each with significant expertise in both PRA development and PRA applications. This team provides both an objective review of the PRA technical elements and a subjective assessment, based on their PRA experience, regarding, the acceptability of the PRA elements. The team uses a set of checklists as a framework within which to evaluate the scope, comprehensiveness, completeness, and fidelity of the PRA products available.

--The --Monticello review team used the "BWROG PSA Peer Review -Certification Implementation Guidelines", Revision 3, January 1997.

The general scope of the implementation of the PRA Peer Review includes review of eleven main technical elements, using checklist tables (to cover the elements and sub-elements), for an at-power PRA including internal events, internal flooding, and containment performance, with focus on large early release frequency (LERF). The eleven technical elements are shown in Tables A-3 through A-5.

The comments from the 1997 MNGP PRA Peer Review were prioritized by the review team into four categories A-D based upon importance to the completeness of the

,model. All comments in Categories A and B (recommended actions and items for consideration) were identified by the review team to Monticello as priority items to be resolved in the next model update. The comments in Categories. C and D (good practices and editorial) were potential enhancements for consideration.

A-9 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Elements that received a summary grade of 3 included Initiating Events, Thermal Hydraulic Analysis, Systems Analysis,- Data Analysis, Human Reliability Analysis,

.Dependency Analysis, and Maintenance and Update Process. Technical elements are graded using a scale of 1 -to 4 (4 being the.highest grade and 3 being generally, comparable to Capability Category I of the 'current ASME PRA Standard). The remaining; elements: Accident Sequence Evaluation,. Structural Response, Quantification and Results Interpretation, and Containment Performance Analysis, received a summary grade of 2 with average grade no lower than 2.5 for any element.

'Subsequent to the assignment of these grades, all A and B priority peer review comments for all eleven elements have been addressed by, MNGP personnel and incorporated into the PRA model as appropriate.

Assessments Against ASME PRA Standard Consistent with, current industry-practices, -the 'MNGP has- been 'compared against the' ASME PRA Standard to identify areas of improvement. Three comparisons to the ASME PRA Standard have been performed in the past five years.

The first assessment against the ASME PRA Standard was performed in early 2004 by

.an. independent consultation, Applied Reliability' Engineering (ARE), Inc. That assessment compared the 2003 Monticello PRA model against a draft version of the ASME Standard and NRC draft Regulatory Guide DG-1122. Since that assessment, the MNGP PRA has evolved to include a much more extensive and detailed internal

.flooding analysis. Several other less significant model enhancements have occurred since the ARE, Inc. assessment, some of which were made to address insights from the assessment.

All open items identified in the 2004 Applied Reliability Engineering (ARE) Self Assessment of the 2003 version of the Monticello PRA model have been addressed and A-10 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment incorporated into the current model utilized for the MELLLA+ risk assessment, with the following exceptions:

An open item related to Human Reliability Analysis element in NEI 00-02 recommended that a sensitivity study be re-performed to identify any changes to the list of key pre-initiator operator actions identified in the IPE.

If any are found, it was recommended that the HRA analysis be re-performed using a more rigorous HRA approach, to reduce conservatism.

The EPU and MELLLA+ implementation have no impact on pre-initiator HEP values; therefore, even if values were modified for some pre-initiator HEPs, these same values would apply .to both the MELLLA risk quantification and the MELLLA+ risk quantification and thus a non-significant impact to the delta risk.estimates; as such, this item has no impact on the conclusion of the MELLLA+ risk assessment.

An open item recommends verifying data used to generate some initiating event frequencies has accounted for plant unavailability.. It is recognized that the elimination of non-operational time may result in moderate increases in calculated initiating event frequencies. Like the above item,

-any changes in' initiating event frequencies-to reflect -unavailability time would apply equally to both the MELLLA risk quantification and the MELLLA+ risk quantification and thus a non-significant impact to the delta risk estimates; as such, this item has no impact on the conclusion of the MELLLA+ risk assessment.

An open item recommended considering performance* of Bayesian updating for some additional events. Again, if this data enhancement was performed, it would apply equally to both the MELLLA risk quantification and the MELLLA+ risk quantification. .No impact on the conclusion of the MELLLA+ risk assessment would result.

Several recommendations were made to improve model documentation, conduct sensitivity studies and perform uncertainty analysis to meet enhanced capabilities- set forth in the ASME standard. These enhancements were intentionally deferred to be accomplished in preparation for Monticello's upcoming formal Reg. Guide 1.200 Peer Review, and will not result in any significant impact on the results of the MELLLA+ risk assessment.

In conclusion, all open items from the ARE, Inc. self-assessment have been incorporated into the PRA model or have no significant impact on the MELLLA+ risk assessment.

A-1 1 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment A self-assessment of the 2005 MNGP PRA against the ASME Standard was performed by Xcel PRA personnel in 2006. This assessment compared the model containing the updated detailed internal flooding analysis and plant improvements to the Standard.

This self-assessment identified several Supporting Requirements (SRs) that may be considered by a formal peer review to fall short of meeting Capability Category I1. A majority of these SRs are specifically related to uncertainty analysis and documentation deficiencies would not directly impact the MELLLA+ quantification results. The other SRs that were identified are related to the use of shorter mission times (< 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) for a limited number of components, human .actions related to inducing and terminating internal flooding, and comparison of quantification results with similar plants. None of these items are expected to impact the conclusions of the MELLLA+ assessment. Any such changes would apply equally to both the MELLLA risk quantification and the MELLLA+ risk quantification and thus a non-significant impact to the delta risk estimates; as- such;" these have no rimpact on- the- conclusion of the MELLLA+ -risk assessment.

The last comparison to the ASME standard was performed by Xcel personnel primarily to determine resource requirements anticipated to address gaps to Capability Category II of the standard in anticipation of a formal peer review. This self-assessment did not identify any items that were expected to impact the model in a significant and non-conservative direction, but were primarily directed toward enhancing documentation.

A.4 PRA QUALITY

SUMMARY

The quality of modeling and documentation of the Monticello PRA models has been demonstrated by the foregoing discussions on the following aspects:

Level of detail in PRA

Maintenance of the PRA A-12 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Comprehensive Critical Reviews The Monticello. Level 1 and Level 2 PRAs provide the necessary and sufficient scope and -level -ofdetail to allow the. calculation of CDF and LERF changes due to MELLLA+.

A-13 C495070003-8976-12/21/09

Monticello MELLLA+ Risk Assessment Table A-3 PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Initiating Events

Guidance Documents for Initiating Event Analysis Groupings Transient

- LOCA

- Support System/Special

- ISLOCA

- Break Outside Containment

- Internal Floods

Subsumed Events

Data

Documentation Accident Sequence Evaluation

Guidance on Development of Event Trees (Event Trees) .

Event Trees (Accident ScenarioEaluation)

- Transients

- SBO

- LOCA

- ATWS

- Special

- ISLOCA/BOC

.. - Internal Floods

Success Criteria and Bases

Interface with EOPs/AOPs

Accident Sequence Plant Damage States

Documentation Thermal Hydraulic Analysis Guidance Document

Best Estimate Calculations (e.g., MAAP)

Generic Assessments

FSAR

Room Heat Up Calculations Documentation A-14 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table A-3 (Continued)

PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT CERTIFICATION SUB-ELEMENTS *...

System Analysis *. System Analysis Guidance Document(s)

(Fault Trees)

System Models

- Structure of models

- Level of Detail

- Success Criteria

- Nomenclature

- Data (see Data Input)

- Dependencies (see Dependency Element).

- Assumptions Documentation of System Notebooks Data Analysis

Guidance

Component Failure Probabilities

System/Train Maintenance Unavailabilities common Cause Failure Probabilities C

unique Unavailabilities or Modeling Items U

- AC Recovery

. Scram System

- EDG Mission Time Repair and Recovery Model SORV

- LOOP Given Transient BOP Unavailability Pipe Rupture Failure Probability

Documentation Human Reliability Analysis

Guidance

Pre-Initiator Human Actions

- Identification

- Analysis

- Quantification

Post-Initiator Human Actions and Recovery

- Identification

- Analysis

- Quantification

Dependence among Actions '

Documentation A-15 AC495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table A-3 (Continued)

PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Dependencies

Guidance Document on Dependency Treatment

Intersystem Dependencies

Treatment of Human Interactions (see also HRA)

Treatment of Common Cause

Treatment of Spatial Dependencies

Walkdown Results

Documentation Structural Capability

Guidance

RPV Capability (pressure and temperature)

- ATWS Transient Containment (pressure and temperature)

" Reactor Building.......

Pipe Overpressurization for ISLOCA

Documentation Quantification/Results

Guidance Interpretation

Computer Code

Simplified Model (e.g., cutset model usage)

Dominant Sequences/Cutsets

Non-Dominant Sequences/Cutsets

Recovery Analysis.

Truncation

Uncertainty

. Results Summary A-16 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table A-4 PRA CERTIFICATION. TECHNICAL ELEMENTS FOR LEVEL 2 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Containment Performance Analysis

Guidance Document

Success Criteria LI/L2 Interface

Phenomena Considered

Important HEPs

Containment Capability Assessment*

End state Definition

LERF Definition*

CETs Documentation A-17 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table A-5 PRA CERTIFICATION TECHNICAL ELEMENTS FOR MAINTENANCE AND UPDATE PROCESS PRA ELEMENT CERTIFICATION SUB-E.LEMENTS PRA ELEMENT CERTIFICATION SUB-ELEMENTS Maintenance and Update Process

Guidance Document

Input - Monitoring and Collecting New Information

Model Control

. PRA Maintenance and Update Process

Evaluation of Results

Re-evaluation of Past PRA Applications

Documentation A-18 C495070003-8976-12/21/09

Appendix B ROADMAP TO RS-001. REVIEW CRITERIA

Monticello MELLLA+ Risk Assessment Appendix B ROADMAP TO RS-001 REVIEW CRITERIA This appendix is provided to assist the reader or reviewer in locating key aspects and issues documented in this risk assessment.

The NRC Review Standard for Extended Power Uprates (RS-001) is used as the template for this MELLLA+ risk assessment roadmap.[16] Table B-1 lists risk assessment aspects contained in RS-001 and summarizes where in this MELLLA+ risk assessment report that aspect of the risk analysis is discussed.

B-1 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table B-1 ROADMAP TO RS-001 REVIEW CRITERIA

Risk Assessment Aspect Treatment/Location in this Stud INTERNAL EVENTS RISK INFORMATION 1 Impact on initiating event modeling and No direct or significant impact on plant transient frequencies frequencies is indicated for MELLLA+; however, a quantitative sensitivity case is investigated in this study to determine the impact on the risk impact results if the frequency of transient initiators is conservatively postulated to increase due to the proposed changes.

Data used in the MNGP PRA for estimating initiating event frequencies remains applicable to the MELLLA+ condition.

No changes to other initiators due to MELLLA+

can be postulated.

Refer to Sections 3.3.1, 4.1.1 and 5.7.1.

2 Impact on component/system reliability and There are no hardware changes of note to the response times plant for MELLLA+; physical changes to the plant are limited to MCR displays and plant computer changes.

No changes to system or component response times other than the faster response time for a instability trip due to use of CDA as the primary detection algorithm (refer to Section 3.31). This response time change has no impact on initiating event frequencies or PRA accident mitigation modeling.

Refer to Section 3.4.1.

3 Impact on operator response times and MELLLA+ has the potential (given the initial associated error probabilities plant power-to-flow configuration at the time of a postulated plant trip) to reduce available response times for operator actions during ATWS scenarios. Refer to Section 4.1.6.

4 Impact on functional and system level success MELLLA+ has just a single potential success criteria criteria impact: license-based ODYN calculations show 8 of 8 SRVs required for RPV overpressure protection during ATWS scenarios with the RPV isolated from the main condenser (TRACG calculations show that 7 of 8 SRVs are sufficient).

Refer to Section 4.1.2.

B-2 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table B-1 ROADMAP TO RS-001 REVIEW CRITERIA 5

1Risk Assessment Aspect Impact on PRA from other issues (e.g.,

Treatment/Location in this Study No changes to the MNGP EOPs/SAMGs or procedure changes, maintenance practice Abnormal Operating Procedures are required for changes, operational changes, setpoint MELLLA+. Changes will be needed for all changes) associated plant procedures, training documents, the process computer, Main Control Room (MCR) displays, and MCR Simulator related to the APRM setpoint changes. No impact on the risk profile results from such issues. Refer to Section 3.3.2.

MELLLA+ does not involve any changes- to maintenance practices that would impact the PRA.

MELLLA+ requires setpoint changes related to the reactor power flow map and stability control.

These changes remain within design limits. No reduction in design operating margins occurs due to these changes. No impact on the risk profile results from such setpoint changes. Refer to Section 3.3.3.

Operation with the MELLLA+ expanded power-flow region has no direct impact on transient initiator frequencies, but a sensitivity case is quantified to assume an increase in transient initiator frequency. Refer to Sections 3.3.1 and 5.7.1.

6 Overall impact on CDF and LERF Best estimate risk quantification results in delta CDF and delta LERF risk results in the RG 1.174 "very small risk increase" range.

Refer to Executive Summary and Section 5.7.2.

Section 5.7.1 discusses quantitative sensitivity cases.

7 Discussion of risk impacts on internal events risk Refer to Sections 4.2 and 4.7 for impacts on the profile Level 1 and Level 2 PRA. Section 5.7.1

___discusses quantitative sensitivity cases.

8 Scope, level of detail, and quality of PRA used in The Monticello Level 1 and Level 2 PRAs the analysis provide the necessary and sufficient scope and level of detail to allow the calculation of CDF and LERF changes due to MELLLA+. Refer to Section 1.2 and Appendix Afor discussion.

B-3 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table B-1 ROADMAP TO RS-001 REVIEW CRITERIA

[479 Risk Assessment Aspect ..

Scope, level of detail and quality of thermal Treatment/Location in this Study No new PRA thermal hydraulic calculations are hydraulic analyses used in the analysis performed for the MELLLA+ risk assessment.

The few thermal hydraulic calculations that are used in the MELLLA+ risk assessment are those documented in the MNGP MELLLA+ Task Reports (e.g., ODYN and TRACG calculations in TR 0902, ATWS); such thermal hydraulic -

analyses are of sufficient quality for both the licensing basis calculations as well as for use in the risk assessment calculations.

10 Processes for ensuring internal events PRA FP-PE-PRA-02, PRA Guideline for Model adequately models the as-built, as-operated Maintenance and Update and PEI-05.01.03, plant PRA Guideline for Model Maintenance and Update, provide the processes and guidance for MNGP PRA model maintenance and periodic updates (refer to Appendix A.2).

11 Treatment of any vulnerabilities, weaknesses or A summary of vulnerabilities, weaknesses and review findings of the IPE Submittal review findings from the IPE Submittal was performed in response to RAIs to the MNGP EPU LAR and is documented in Reference [19].

That summary is not reproduced here in this report. Those impacts have been previously incorporated into the MNGP PRA model where

..... ....... ... . ... . ... ap plicable. . . .. .

- 12 Treatment of plant modifications or As documented in Reference [19], a review of improvements credited in the IPE Submittal but the Monticello IPE and supporting documents not implemented in the plant was performed to determine ifthere were any modifications or improvements credited in the IPE/PRA but not yet implemented. The key engineers involved with the IPE development were also consulted to determine ifthere is any recollection of cases where modifications or improvements were credited in the IPE/PRA but not implemented at the time of the IPE submittal.

No instances of credited, but not yet implemented capabilities were identified.

The PRA model used for the MELLLA+ risk assessment does not credit any capability that

.will not be available or supported by approved procedures at the time of implementation of MELLLA+. The reference PRA model used for this analysis is the PRA model reflective of the plant configuration that will exist at the time of the MELLLA+ implementation. Refer to Section 1.2 and Appendix A for discussion.

13 Treatment of findings from any independent Refer to discussions in Appendix A.3.

peer reviews B-4 C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table B-1 ROADMAP TO RS-001 REVIEW CRITERIA

[#.

14 Risk Assessment Aspect Justifications when risk impact exceeds RG Treatment/Location in this Study The best estimate risk calculations do not 1.174 guidelines ' exceed RG 1.174 guidelines. Refer to Section

,_ _._ _ 5.7.2.

EXTERNAL EVENTS RISK INFORMATION 15 Treatment of any vulnerabilities, weaknesses or A summary of vulnerabilities, weaknesses and review findings of the IPEEE Submittal review findings from the IPEEE Submittal was performed in response to RAls to the MNGP EPU LAR and is documented in Reference [19].

That summary is not reproduced here in this report.

No MNGP external events PRA models are quantified in support of this risk analysis.

MELLLA+ has a hon-significant impact on the external event risk profile. Refer to Sections 4.3

-4.5 and 5.3 - 5.5.

16 Treatment of plant modifications or The PRA model used for the MELLLA+ risk improvements credited in the IPEEE Submittal assessment does not credit any capability that but not implemented in the plant will not be available or supported by approved procedures at the time of implementation, of MELLLA+. The reference PRA model used for this analysis is the PRA model reflective of the plantconfiguration that will exist at the timeof the MELLLA+ implementation. Refer to Section 1.2 and Appendix A for discussion.

17 Discussion of risk impacts on external events MELLLA+ has a non-significant impact on the risk profile . external event risk profile. Refer to Sections 4.3

-4.5 and 5.3 - 5.5.

18 Scope, level of detail, and quality of external No MNGP external events PRA models are events PRA models used in the analysis quantified in support of this risk analysis.

MELLLA+ has a non-significant impact on the external event risk profile. Refer to Sections 4.3

-4.5 and 5.3 - 5.5.

19 Processes for ensuring external events PRA No MNGP external events PRA models are models used in the analysis adequately reflect quantified in support of this risk analysis.

the as-built, as-operated plant MELLLA+ has a non-significant impact on the external event risk profile. Refer to Sections 4.3

-4.5 and 5.3 - 5.5.

SHUTDOWN RISK INFORMATION 20 Impact on shutdown initiating events MELLLA+ has no impact on initiating events that

. apply to shutdown conditions. Refer to Section 4.6.

21 Impact on component/system reliability, and MELLLA+ has no impact on the reliability, response times- availability or response times of components and systems used during shutdown conditions.

Refer to Section 4.6.

B-5 - C495070003-8976-12/21/09

Monticello MELLLA + Risk Assessment Table B-1 ROADMAP.TO RS-001 REVIEW CRITERIA

[*1

. "Risk Assessment Aspect Treatment/Location in this Study 22 Impact on operator response times and MELLLA+ has no impact on operator response associated error probabilities times and associated error probabilities for operator actions that may be required during shutdown conditions. Refer to Section 4.6.

23 Impact on functional and system level success MELLLA+ has no impact on the success criteria criteria

for functions an systems used during shutdown

___. conditions. Refer to Section 4.6.

24 Impact on shutdown risk from other issues (e.g., MELLLA+ has no impact on shutdown procedure changes, maintenance practice operations or the shutdown risk profile. Refer to changes, operational changes;setpoint Section 4.6.

changes) 25 Discussion of risk impacts on shutdown risk MELLLA+ has no impact on shutdown profile operations or the shutdown risk profile. Refer to Section 4.6.

26 Discussion of shutdown risk management MELLLA+ has no impact on shutdown philosophies, processes, and controls operations or the shutdown risk profile. Refer to Section 4.6.

B-6 C495070003-8976-12/21/09

L-MT-10-003, Mellla+ Risk Assessment, Attachment 6 of L-MT-10-003

Contents

Text

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

Navigation menu

L-MT-10-003, Mellla+ Risk Assessment, Attachment 6 of L-MT-10-003

Text

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

Navigation menu

Search