ML081010199

Identification of Risk Implications Due to Extended Power Uprate at Monticello

ML081010199
Person / Time
Site:	Monticello
Issue date:	03/31/2008
From:	Engineering & Research
To:	Office of Nuclear Reactor Regulation, Nuclear Management Co
References
L-MT-08-018, TAC MD5531
Download: ML081010199 (264)

Text

Enclosure 15 to L-MT-08-018 Identification of Risk Implications Due to Extended Power Uprate at Monticello

IDENTIFICATION OF RIS IMPLICATIONS DUE TO EXTENDED POWER UPRA T EAT MONTICELLO Preparedfor Nuclear Management Company (NMC)

Prepared by:

ERWI EEgineering and Research, Inc.

wn SKF Group Company MARCH 2008 Final

Monticello Extended Power UprateRisk Implications EXECUTIVE

SUMMARY

The Extended Power Uprate (EPU) project for Monticello has been reviewed to determine the net impact on the Monticello risk profile.

The existing Monticello Probabilistic Risk Assessment (PRA) is based on the current licensed thermal power (CLTP) level of 1775 MWt. Monticello is currently pursuing a 13% increase (i.e., Extended Power Uprate) of the CLTP to 2004 MWt.

The enclosed assessment of the power uprate impacts on risk has been performed relative to the current PRA. The guidelines from the NRC (Regulatory Guide 1.174) are followed to assess the change in risk as characterized by core damage frequency (CDF) and Large Early Release Frequency (LERF) and to determine if the change in risk is anything but very low.

The methodology consists of an examination of the important elements of the Monticello Probabilistic Risk Assessment (PRA) to assess the impact of the following EPU changes on the PRA elements:

• Hardware changes

• Procedural changes

• Set point'changes

• Power level change These changes are interpreted in terms of their PRA model effects, which can then be used to assess whether there are any resulting risk profile changes.

The scope of this report includes the complete risk contribution associated with the Extended Power Uprate at Monticello. Risk impacts due to internal events are assessed using the MNGP Level 1 and Level 2 PRA Model of Record (2005 Monticello PRA average maintenance model, fault tree Risk-T&M.cat). External events are evaluated C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications using the analyses of the Monticello Individual Plant Examination of External Events (IPEEE) Submittal. [10] The impacts on shutdown risk contributions are evaluated on a qualitative basis.

All commitments resulting from the MNGP IPE and IPEEE programs have been resolved.

The results of the PRA evaluation are the following:

• Detailed thermal hydraulic analyses of the plant response using the EPU configuration indicate slight reductions in the operator action "allowable" times for some actions.

" The reduced operator action "allowable" times resulted in minor increases in the assessed Human Error Probabilities (HEPs) in the PRA model, specifically in RPV water level control errors during failure to scram sequences.

• Only very small risk increases were identified for the changes associated with the EPU, those associated with: (1) slightly reduced times available for effective operator actions; and (2) minor changes in some functional success criteria in the PRA.

• The risk impact due to the implementation of the Extended Power Uprate is low and acceptable. The risk impact is in the "very small" category (i.e., Region III of the Regulatory Guide 1.174 Guidelines) for CDF and for LERF.

The EPU is estimated to increase the Monticello internal events PRA CDF from the base value of 7.32E-6/yr to 7.89E-6/yr, an increase of 5.67E-7 (7.8%). LERF increases from the base value of 3.64E-7/yr to 3.94E-7/yr, an increase of 3.OOE-8/yr (8.2%).

ii iiC495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications TABLE OF CONTENTS Section Page EXECUTIV E SUM M A RY ......................................................................................................... i 1.0 INTRO DUCTIO N ..................................................................................................... 1-1 1.1 Background ................................................................................................... 1-1 1.2 PRA Q uality .................................................................................................. 1-1 1.3 PRA Definitions and Acronym s .................................................................... 1-3 1.4 G eneral Assum ptions ................................................................................... 1-7 2.0 SCO PE ..................................................................................................................... 2-1 3.0 METHO DO LO GY .................................................................................................... 3-1 3.1 Analysis Approach ........................................................................................ 3-1 3.2 PRA Elem ents Assessed ............................................................................. 3-3 3.3 Inputs (Plant Changes) ................................................................................. 3-4 3.4 Scoping Evaluation ....................................................................................... 3-6 4.0 PRA C HA NG ES RELATED TO EPU C HA NG ES .................................................. 4-1 4.1 PRA Elem ents Potentially Affected by Pow er Uprate .................................. 4-1 4.2 Level 1 PRA ................................................................................................ 4-57 4.3 Internal Fires Induced Risk ......................................................................... 4-61 4.4 Seism ic Risk ............................................................................................... 4-64 4.5 O ther External Events Risk ........................................................................ 4-66 4.6 Shutdow n Risk ............................................................................................ 4-66 4.7 Radionuclide Release (Level 2 PRA) ......................................................... 4-69 5.0 CO NC LUSIO NS ...................................................................................................... 5-1 5.1 Level 1 PRA .................................................................................................. 5-2 5.2 Fire Induced Risk .......................................................................................... 5-3 5.3 Seism ic Risk ................................................................................................. 5-3 5.4 Other External Hazards ................................................................................ 5-3 5.5 Shutdow n Risk .............................................................................................. 5-8 5.6 Level 2 PRA .................................................................................................. 5-8 5.7 Q uantitative Bounds on Risk Change .......................................................... 5-8 REFERENC ES ................................................................................................................... R-1 iii iiiC495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications TABLE OF CONTENTS (cont'd)

APPENDIX A PRA QUANTIFICATION RESULTS APPENDIX B IMPACT OF EPU ON SHUTDOWN OPERATOR ACTION RESPONSE TIMES APPENDIX C MONTICELLO PRA QUALITY APPENDIX D HEP ASSESSMENTS APPENDIX E MONTICELLO EPU MAAP CALCULATIONS APPENDIX F COP SENSITIVITY iv ivC495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Section 1 INTRODUCTION Monticello is currently pursuing an increase in reactor power from the current licensed thermal power of 1775 MWth to 2004 MWth, an Extended Power Uprate (EPU) of 113%

CLTP. The purpose of this report is to:

(1) Identify any significant change in risk associated with the Extended Power Uprate (EPU) as measured by the Monticello PRA models; (2) Provide the basis for the impacts on the risk model associated with EPU

1.1 BACKGROUND

The Monticello PRA is a state-of-the-technology tool developed consistent with current PRA methods and approaches. The MNGP model is developed and quantified using the CAFTA (part of the EPRI R&R Workstation) software.

The Monticello PRA is based on realistic assessments of system capability over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time of the PRA analysis. Therefore, PRA success criteria may be different than the design basis assumptions used for licensing Monticello. This report examines the risk profile changes from this realistic perspective to identify changes in the risk profile on a best estimate basis that may result from postulated accidents, including severe accidents.

1.2 PRA QUALITY The quality of the MNGP PRA models used in performing the risk assessment for the MNGP EPU is manifested by the following:

• Sufficient scope and level of detail in PRA

• Active maintenance of the PRA models and inputs 1-1 C495070003-7740-03/27/08 1-1

Monticello Extended Power Uprate Risk Implications Comprehensive Critical Reviews Scope and Level of Detail The MNGP PRA is of sufficient quality and scope for this application. The MNGP PRA modeling is highly detailed, including a wide variety of initiating events (e.g., transients, internal floods, LOCAs inside and outside containment, support system failure initiators), modeled systems, extensive level of detail, operator actions, and common cause events.

Maintenance of Model, Inputs, Documentation The MNGP PRA model and documentation has been updated to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data. The current MNGP PRA model at the time of this analysis is 2005 Monticello PRA average maintenance model (fault tree Risk-T&M.caf). The Level 1 and Level 2 MNGP PRA analyses were originally developed and submitted to the NRC in February 1992 as the Monticello Individual Plant Examination (IPE)

Submittal. The MNGP PRA submittal and the subsequent NRC approval are described in Section 14.01 of the MNGP USAR.

Critical Reviews The Monticello internal events received a formal industry PRA Peer Review in October 1997. All of the "A" and "B" priority comments from the 1997 peer review have been addressed by MNGP and incorporated into the current MNGP PRA model as appropriate.

1-2 1-2 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Summary In summary, it is found that the Monticello Level 1 and Level .2 PRAs provide the necessary and sufficient scope and level of detail to allow the calculation of CDF and LERF changes due to the Extended Power Uprate (EPU). Refer to Appendix C for further details regarding the quality of the MNGP PRA.

1.3 PRA DEFINITIONS AND ACRONYMS Definitions The following PRA terms are used in this study:

CDF - Core Damage Frequency (CDF) is a risk measure for calculating the frequency of a severe core damage event at a nuclear facility. Core damage is the end state of the Level 1 PRA. A core damage event may be defined in the MNGP PRA by one or more of the following:

- Maximum core temperature greater than 2200 degrees Fahrenheit,

- RPV water level at 1/3 core height and decreasing,

- Containment failure induced loss of injection.

CDF is calculated in units of events per year.

With respect to analyzing MAAP thermal hydraulic runs, very short spikes (e.g., seconds or a couple minutes) above 2200F are not automatically declared core damage. The case is typically re-run and re-analyzed carefully.

LERF - Large Early Release Frequency (LERF) is a risk measure for calculating the frequency of an offsite radionuclide release that is HIGH in fission product magnitude and EARLY in release timing. A HIGH magnitude release is defined as a radionuclide release of sufficient magnitude to have the potential to cause early fatalities (e.g., greater than 10% Cesium Iodide contribution to release). An EARLY timing release is defined as the time prior to that where minimal offsite protective measures have been implemented (e.g., less than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> from accident initiation). LERF is calculated in units of events per year.

1-3 1-3 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Initiating Event - Any event that causes/requires a scram/manual shutdown (e.g., Turbine Trip, MSIV Closure) and requires the initiation of mitigation systems to reach a safe and stable state. An initiating event is modeled in the PRA to represent the primary transient event that can lead to a core damage event given failure of adequate mitigation systems (i.e., adequate with respect to the transient in question).

Internal Events - Those initiating events caused by failures internal to the system boundaries. Examples include Turbine Trip, MSIV Closure, Loss of an AC Bus, Loss of Offsite Power, and internal floods.

External Events - Those initiating events caused by failures external to the system boundaries. Examples include fires, seismic events, and tornadoes.

HEP - Human Error Probability (HEP) is the probabilistic estimate that the operating crew fails to perform a specific action (either properly or within the necessary time frame) to support accident mitigation. The HEP is calculated using industry methodologies and considers a number of performance shaping factors such as:

- training of the operating crew,

- availability of adequate procedures,

- time required to perform action

- time available to perform action

- stress level while performing action HRA - Human Reliability Analysis (HRA) is the systematic process used to evaluate operator actions and quantify human error probabilities.

MAAP - The Modular Accident Analysis Package (MAAP) is an industry recognized thermal hydraulic code used to evaluate design basis and beyond design basis accidents. MAAP can be used to evaluate thermal hydraulic profiles within the primary system (e.g., RPV pressure, boildown timing) prior to core damage. MAAP also can be used to evaluate post core damage phenomena such as RPV breach, containment mitigation, and offsite radionuclide release magnitude and timing.

Level 1 PRA - The Level 1 PRA is the evaluation of accident scenarios that begin with an initiating event and progress to core damage.. Core damage is the end state for the Level 1 PRA. The Level 1 PRA focuses on the capability of plant systems to mitigate a core damage event.

Level 2 PRA - The Level 2 PRA is a continuation of the Level 1 PRA evaluation. The Level 2 PRA begins with the accident scenarios that have progressed to core damage and evaluates the potential for offsite radionuclide 1-4 1-4 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications releases. Offsite radionuclide release is the end state for the Level 2 PRA.

The Level 2 PRA focuses on the capability of plant systems (including containment structures) to prevent a core damage event to result in an offsite release.

RAW - The Risk Achievement Worth (RAW) is the calculated increase in a risk measure (e.g., CDF or LERF) given that a specific system, component, operator action, etc. is assumed to fail (i.e., failure probability of 1.0). RAW is presented as a ratio of the risk measure given the component is failed divided by the risk measure given the component is assigned its base failure probability.

FV - The Fussell-Vesely (FV) importance is a measure of the contribution of a specific system, component, operator action, etc. to the overall risk. F-V is presented as the percentage of the overall risk to which the component failure contributes. In other words, the F-V importance represents the overall decrease in risk if the component is guaranteed to successfully operate as designed (i.e., failure probability of 0.0).

Acronyms The following acronyms are used in this study:

AC Alternating Current ACRS Advisory Committee on Reactor Safeguards ARI Alternate Rod Insertion ATWS Anticipated Transient Without Scram BIIT Boron Injection Initiation Temperature BOC Break Outside Containment BOP Balance of Plant BWR Boiling Water Reactor CDF Core Damage Frequency CLTP Current Licensed Thermal Power CPPU Constant Pressure Power Uprate CRDH Control Rod Drive Hydraulics CS Core Spray CST Condensate Storage Tank CSW Condensate Service Water CTS Condensate Transfer System DBA Design Basis Accident 1-5 1-5 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications DC Direct Current DFP Diesel Driven Fire Pump DHR Decay Heat Removal, DW Drywell ECCS Emergency Core Cooling System ED Emergency Depressurization EOP Emergency Operating Procedure EPRI Electric Power Research Institute EPU Extended Power Uprate FIVE Fire-Induced Vulnerability Evaluation FV Fussell-Vesely (risk importance measure)

FW Feedwater FWLC Feedwater Level Control GE General Electric HCLPF High Confidence Low Probability of Failure HCTL Heat Capacity Temperature Limit HEP Human Error Probability HP High Pressure HPCI High Pressure Coolant Injection HRA Human Reliability Analysis I&C Instrumentation and Control IORV Inadvertently Opened Relief Valve IPE Individual Plant Evaluation IPEEE Individual Plant Evaluation of External Events ISLOCA Interfacing Systems LOCA LERF Large Early Release Frequency LLOCA Large LOCA LOCA Loss of Coolant Accident LOOP Loss of Offsite Power LP Low Pressure LPCI Low Pressure Coolant Injection MAAP Modular Accident Analysis Program MLOCA Medium LOCA MSCWLL Minimum Steam Cooling Water Level Limit MSIV Main Steam Isolation Valve MSL Main Steam Line MWt Megawatt (thermal)

NEI Nuclear Energy Institute NMC Nuclear Management Company NPSH Net Positive Suction Head 1-6 1-6 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications NRC Nuclear Regulatory Commission NSSS Nuclear Steam Supply System OLTP Original Licensed Thermal Power OOS Out Of Service PCPL Primary Containment Pressure Limit PRA Probabilistic Risk Assessment (alternative term for PSA)

PSA Probabilistic Safety Assessment (alternative term for PRA)

PSSA Probabilistic Shutdown Safety Assessment RAW Risk Achievement Worth (risk importance measure)

RBCCW Reactor Building Closed Cooling Water RCIC Reactor Core Isolation Cooling RHR Residual Heat Removal RHRSW RHR Service Water RPS Reactor Protection System RPT Recirculation Pump Trip RPV Reactor Pressure Vessel RWCU Reactor Water Clean-Up SAMG Severe Accident Management Guidelines SBO Station Blackout SDC Shutdown Cooling SLOCA Small LOCA SMA Seismic Margins Analysis SORV Stuck Open Relief Valve SRV Safety Relief Valve SSC Systems, Structures, and Components SV Safety Valve TAF Top of Active Fuel VB Vacuum Breaker MNGP Monticello Nuclear Generating Plant WW Wetwell 1.4 GENERAL ASSUMPTIONS The Extended Power Uprate (EPU) risk evaluation includes a limited number of general assumptions as follows:

• The plant and procedural changes identified by NMC are assumed to reflect the as-built, as-operated plant after the Extended Power Uprate is fully implemented. The information provided by NMC (as well as the 1-7 1-7 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications MNGP EPU GE Task Reports) is used as input to the current Monticello PRA model to evaluate the risk impact of the power uprate. MNGP will uprate to the full EPU power level in two steps over the next few years.

The risk analysis documented in this report is performed for a one step increase to the full EPU power level; this analysis bounds the MNGP two step uprate process.

• This analysis is based on all the inputs provided by NMC in support of this assessment. For systems where no hardware or procedural changes have been identified, the risk evaluation is performed assuming no impact as a result of the EPU.

• Replacement of components with enhanced like components does not result in any supportable significant increase in the long-term failure probability for the components.

" The PRA success criteria are different than the success criteria used for design basis accident evaluations. The PRA success criteria assume that systems that can realistically perform a mitigation function (e.g.,

main condenser or containment venting for decay heat removal) are credited in the PRA model. In addition, the PRA success criteria are based on the availability of a discrete number of systems or trains (e.g.,

number of pumps for RPV makeup).

1-8 1-8 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Section 2 SCOPE The scope of this risk assessment for the Extended Power Uprate at Monticello addresses the following plant risk contributors:

• Level 1 Internal Events At-Power (CDF)

" Level 2 Internal Events At-Power (LERF)

• External Events At-Power

- Seismic Events

- Internal Fires

- Other External Events

• Shutdown Assessment Risk impacts due to internal events are assessed using the MNGP 2005 Monticello PRA average maintenance model (fault tree Risk-T&M.cat). Level 2 sequences resulting in the Large-Early release category comprise the LERF risk measure. External events are evaluated using the analyses of the Monticello Individual Plant Examination of External Events (IPEEE) Submittal. [10] The impacts on shutdown risk contributions are evaluated on a qualitative basis.

All commitments resulting from the MNGP IPE and IPEEE Programs have been resolved.

As discussed in Section 3, all PRA elements are reviewed to ensure that identified EPU plant, procedural, or training changes that could affect the risk profile are addressed. The information input to this process consisted of preliminary design, procedural, and training information provided by NMC. The final design, analytical calculations, and procedural changes had not been completed prior to this risk assessment.

2-1 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Section 3 METHODOLOGY This section of the report addresses the following:

• Analysis approach used in this risk assessment (Section 3.1)

• Identification of principal elements of the risk assessment that may be affected by the Extended Power Uprate and associated plant changes (Section 3.2)

• Plant changes used as input to the risk evaluation process (Section 3.3)

" Scoping assessment (Section 3.4) 3.1 ANALYSIS APPROACH The approach used to examine risk profile changes is described in the following subsections.

3.1.1 Identify PRA Elements This task is to identify the key PRA elements to be assessed as part of this analysis for potential impacts associated with plant changes. The identification of the PRA elements uses the NEI PRA Peer Review Guidelines.[4] Section 3.2 summarizes the PRA elements assessed for the Monticello EPU.

3.1.2 Gather Input The input required for this assessment is the identification of any plant hardware modifications, procedural or operational changes that are to be considered part of the 3-1 3-1 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Extended Power Uprate. This includes changes such as instrument setpoint changes, added equipment, and procedural modifications.

3.1.3 Scoping Evaluation This task is to perform a scoping evaluation by reviewing the plant input against the key PRA elements. The purpose is to identify those items that require further quantitative analysis and to screen out those items that are judged to have negligible or no impact on plant risk as modeled by the MNGP PRA.

3.1.4 Qualitative Results The result of this task is a summary which dispositions all the risk assessment elements regarding the effects of the Extended Power Uprate. The disposition consists of three Qualitative Disposition Categories:

Category A: Potential PRA change due to power uprate. PRA modification desirable or necessary Category B: Minor perturbation, negligible impact on PRA, no PRA changes required Category C: No change A short explanation providing the basis for the disposition is provided in Section 4.

3.1.5 Implement and Quantify Required PRA Changes This task is to identify the specific PRA model changes required to address the EPU, implement them, and quantify the model. The MNGP PRA elements were investigated with the aid of additional deterministic calculations performed in support of this analysis (see Appendix E). Section 4.1 summarizes the review of PRA analysis impacts 3-2 3-2 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications associated with the increased power level. These effects and other effects related to plant or procedural changes are identified and documented in Section 4.

3.2 PRA ELEMENTS ASSESSED The PRA elements to be evaluated and assessed can be derived from a number of sources. The NEI PRA Peer Review Guidelines [4] provide a convenient division into "elements" to be examined.

Each of the major risk assessment elements is examined in this evaluation. Most of the risk assessment elements are anticipated to be unaffected by the Extended Power Uprate. The risk assessment elements addressed in this evaluation for impact due to the EPU (refer to Section 4 for impact evaluation) include the following:

• Initiating Events

• Systemic/Functional Success Criteria, e.g.:

- RPV Inventory Makeup

- Heat Load to the Suppression Pool

- Time to Boildown

- Blowdown Loads

- RPV Overpressure Margin

- SRV Actuations

- SRV Capacity for ATWS

• Accident Sequence Modeling

• System Modeling

• Failure Data

• Human Reliability Analysis

• Structural Evaluations

" Quantification

• Containment Response (Level 2) 3-3 3-3 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications 3.3 INPUTS (PLANT CHANGES)

This section summarizes the inputs to the risk evaluation, which include hardware modifications, setpoint changes, procedural and operational changes associated with the Extended Power Uprate.

3.3.1 Hardware Modifications The hardware modifications associated with the Extended Power Uprate have been identified by NMC as input to this assessment. The hardware modifications to be implemented as part of the power uprate are included in an attachment to the License Amendment Request. At the time this assessment was completed, the onsite AC distribution system modifications for EPU were not finalized. The PRA impact for these modifications, if any, will be evaluated as part of the modification process.

3.3.2 Procedural Chanqes Slight adjustments to the MNGP EOPs/SAMGs will be made to be consistent with EPU operating conditions. In almost all respects, the EOPs/SAMGs are expected to remain unchanged because they are symptom-based; however, certain parameter thresholds and graphs are dependent upon power and decay heat levels and will require slight modifications. The specifics of any procedural changes associated with the Extended Power Uprate were not available prior to completion of this PRA evaluation.

Based on the GE EPU Evaluations [14], EOP variables that play a role in the PRA and which may require adjustment for the EPU include:

• Boron Injection Initiation Temperature (BIIT)

• Heat Capacity Temperature Limit (HCTL)

" Primary Containment Pressure Limit (PCPL) 3-4 3-4 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications These variables may require adjustment to reflect the change in power level, but will not be adjusted in a manner that involves a change in accident mitigation philosophy. The HCTL and PCPL relate to long-term scenarios, any changes in the scenario timings associated with EPU changes to these curves will be minor (e.g., changes on the order of 10 minutes over accident times greater than 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />) and would not significantly impact the human error probabilities in the PRA.

Any EPU related changes to the MNGP EOPs or SAMGs are considered minor perturbations to the already assessed EPG/SAG changes. Therefore, the EOP/SAMG changes as a result of the EPU will not influence the risk profile.

3.3.3 Setpoint Changes The RPV operating pressure and the operating temperature are not being changed as part of the Extended Power Uprate. Potential setpoint changes for the EPU may include:

• Turbine overspeed

• Turbine first stage pressure steam scram bypass Changes to the following setpoints are not anticipated for the EPU:

• RPT/ATWS high dome pressure

• RPV level trips/actuations

• MSL low pressure isolation

• MSL high flow trip (lb/hr)

• SRV setpoints 3-5 3-5 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Any EPU related changes to setpoints are not expected to significantly influence the EPU risk profile and are not expected to change the conclusions of this study. Refer to Section 4.1.2.6 regarding postulated minor increase in SORV probability.

3.3.4 Plant Operating Conditions The key plant operational modifications to be made in support of the EPU are:

• Increase in reactor thermal power from 1775 to 2004 MWt

• Feedwater/Condensate flow (and steam flow) rates will increase by approximately 13% over current licensed thermal power RPV pressure will remain unchanged for the EPU.

In addition, no significant changes in the operating conditions of the following systems are projected at this time:

• RCIC

• ECCS Systems

• Instrument Air

• Circulating Water

" Service Water

• RBCCW 3.4 SCOPING EVALUATION The scoping evaluation examines the hardware, procedural, setpoint, and operating condition changes to assess whether there are PRA impacts that need to be considered in addition to the increase in power level. These changes are also examined in Section 4 relative to the PRA elements that may be affected. The scoping evaluation conclusions reached are discussed in the following subsections.

3-6 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications 3.4.1 Hardware Changes The hardware changes required to support the EPU (see Section 3.3.1) were reviewed and determined not to result in new accident types or increased frequency of challenges to plant response. This assessment is based on review of the plant hardware modifications and engineering judgement based on knowledge of the PRA models. The majority of the changes are characterized by either:

• Replacement of components with enhanced like components

" Upgrade of existing components The MNGP PRA program encompasses an effectively exhaustive list of hazards and accident types (i.e., from simple non-isolation transients to ATWS scenarios to internal fires to seismic events, and numerous others). Sabotage and acts of war are outside the scope of the PRA program. Extensive and unique changes to the plant would have to be implemented to result in new previously unidentified accidents.

Extensive changes to plant equipment have been shown by operating experience to result in an increase in system unavailability or failure rate during the initial testing and break-in period. There may be some short term increase in such events at Monticello but the frequency and duration of such events can not be projected. Nevertheless, it is expected that a steady state condition equivalent to (or potentially better than) current plant performance would result within approximately one year of operation with the new equipment.

3.4.2 Procedure Changes Changes to the EOPs/SAMGs as a result of the EPU were not available prior to completion of the PRA evaluation. It is assumed that the procedural changes (e.g.,

modification to HCTL curve) have a minor impact on the PRA results. No changes to 3-7 3-7 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications the PRA are identified as a result of potential EOP/SAMG procedural changes. See Section 3.3.2.

3.4.3 Setpoint Changes None of the planned setpoint changes listed in Section 3.3.3 will result in any quantifiable impact to the PRA. Key setpoints that play a role in the PRA are planned to remain unchanged, such as:

• Main Steam SRV opening and closing setpoints

• RPV Level Setpoints (e.g., high level trips, level actuations)

• RPV pressure setpoint (e.g., RPT/ARI) 3.4.4 Normal Plant Operational Changes The Feedwater/Condensate flow rates will be increased to support the EPU, but this operational change is not expected to significantly impact component failure rates or initiating event frequencies used in the PRA. However, a sensitivity case is performed (refer to Section 5) that postulates significant increase in LOCA frequency due to increased erosion corrosion rates.

There are no significant systemic configuration changes as part of the EPU as far as additional trains of key equipment required to operate during plant operation.

3-8 3-8 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Section 4 PRA CHANGES RELATED TO EPU CHANGES Section 3 has examined the plant changes (hardware, procedural, setpoint, and operational) that are part of the Extended Power Uprate (EPU). Section 4 examines these changes to identify MNGP PRA modeling changes necessary to quantify the risk impact of the EPU. This section discusses the following:

• Individual PRA elements potentially affected by EPU (4.1)

" Level 1 PRA (4.2)

• Internal Fires Induced Risk (4.3)

" Seismic Risk (4.4)

• Other External Hazards Risk (4.5)

• Shutdown Risk (4.6)

" Radionuclide Release (Level 2 PRA) (4.7) 4.1 PRA ELEMENTS POTENTIALLY AFFECTED BY POWER UPRATE A review of the PRA elements has been performed to identify potential effects associated with the Extended Power Uprate. The result of this task is a summary which dispositions all PRA elements regarding the effects of the Extended Power Uprate. The disposition consists of three Qualitative Disposition Categories.

Category A: Potential PRA change due to power uprate. PRA modification desirable or necessary Category B: Minor perturbation, negligible impact on PRA, no PRA changes required Category C: No change 4-1 4-1 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-1 summarizes the results from this review. Based on Table 4.1-1, only a small number of the PRA elements are found to be potentially influenced by the power uprate.

The following PRA elements are discussed in Table 4.1-1 to summarize whether they may be affected by the Extended Power Uprate and the associated changes.

" Initiating Events

• Systemic/Functional Success Criteria, e.g.:

- RPV Inventory Makeup

- Heat Load to the Suppression Pool

- Time to Boildown

- Blowdown Loads

- RPV Overpressure Margin

- SRV Actuations

- SRV Capacity for ATWS

• Accident Sequence Modeling

• System Modeling

• Failure Data

" Human Reliability Analysis

• Structural Evaluations

• Quantification

• Containment Response (Level 2) 4.1.1 Initiatinq Events The evaluation has examined whether there may be increases in the frequency of the initiating events or whether there may be new types of initiating events introduced into the risk profile.

4-2 4-2 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications The MNGP PRA program encompasses an effectively exhaustive list of hazards and accident types (i.e., from simple non-isolation transients to ATWS scenarios to internal fires to hurricanes to toxic releases to draindown events during refueling activities, and numerous others). Extensive and unique changes to the plant would have to be implemented to result in new previously unidentified accidents; this is not the case for the MNGP EPU.

The MNGP PRA initiating events can be categorized into the following:

• Transients

• LOOP

• LOCAs

• Support System Failures

• Internal Floods

• External Events Transients The evaluation of the plant and procedural changes does not result in any new transient initiators, nor is there anticipated any direct significant impact on transient initiator frequencies due to the EPU.

However, a sensitivity quantification is performed that increases the Turbine Trip transient initiator frequency to bound the various changes to the BOP side of the plant (e.g., main turbine modifications).

LOOP No change in the Loss of Offsite Power initiating event frequency is expected. Currently MNGP has certain operating configurations/conditions that require power reductions to 4-3 4-3 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications maintain grid stability or to respond to grid voltage changes. The same or similar conditions and operations will exist for the EPU, and are not expected to have any grid related impact on the LOOP initiating event frequency. The EPU stability analysis did not find significant impacts on grid stability due to the MNGP power uprate.

LOCAs No significant changes to RPV operating pressure, inspection frequencies, or primary water chemistry are planned in support of the EPU; as such, no significant impact on LOCA frequencies due to the EPU can be postulated. It is anticipated that condensate and feedwater system pressures will be slightly higher due to pump replacement, particularly during system startup conditions. It is expected that this will result in a negligible impact on the frequency of LOCA initiators. However, a sensitivity case is analyzed that doubles the Large LOCA initiator frequency.

Support System Initiators No significant changes to support systems (e.g., Instrument Air, Service Water) are planned in support of the EPU; as such, no significant impact on support system initiating event frequencies due to the EPU are postulated.

Internal Flood Initiators No changes to pipe inspection scopes or frequencies are planned in support of the EPU; as such, no significant impact on internal flooding initiator frequencies due to the EPU are postulated.

4-4 4-4 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications External Event Initiators The frequency of external event initiators (e.g., seismic events, extreme winds, fires) is not linked to reactor power or operation; as such, no impact on external event initiator frequencies due to the EPU can be postulated.

4.1.2 Success Criteria The success criteria for the Monticello PRA are based on realistic evaluations of system capability over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time of the PRA analysis. These success criteria therefore may be different than the design basis assumptions used for licensing Monticello. This report examines the risk profile changes caused by EPU from a realistic perspective to identify changes in the risk profile that may result from severe accidents on a best estimate basis. The following subsections discuss different aspects of the success criteria as used in the PRA. Appendix E provides the deterministic calculations performed to support assessment of the impacts on success criteria and sequence timing. MNGP EPU task reports were also used to assist in assessing impacts on success criteria.

4.1.2.1 Timing Shorter times to boildown are likely on an absolute basis due to the increased power levels. The reduction in timings can impact the human error probability calculations, especially for short-term operator actions. See HRA discussion in Section 4.1.6.

4.1.2.2 RPV Inventory Makeup Requirements The PRA success criteria for RPV makeup remains the same for the post-uprate configuration; the one minor exception is CRDH. Both high pressure (e.g., FW, HPCI, and RCIC) and low pressure (e.g., LPCI, CS, and condensate) injection systems have more than adequate flow margin for the post-uprate configuration.

4-5 4-5 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications CRDH remains a viable RPV makeup source at high and low pressures in the post-EPU.

CRDH is a success in the CLTP PRA as the sole early injection source for transient and SORV scenarios if a second CRDH pump at nominal flow is initiated in a timely manner, or if enhanced flow actions for one CRDH pump are initiated in a timely manner.01 ) The MNGP CLTP PRA also credits CRDH late in accident scenarios when decay heat is less, and in such scenarios only a single CRDH pump at nominal flow is required.

The CRDH success criteria for the EPU condition are relatively unchanged. MNGP EPU MAAP runs MNGPEPU5e - MNGPEPU5i show that enhanced CRDH flow is sufficient for high pressure makeup for transient and SORV scenarios for the EPU condition. Nominal CRDH flow with 2 pumps is also successful as the only injection source for transients and SORV scenarios for the EPU (refer to MNGP EPU MAAP runs MNGPEPU5b and MNGPEPU5d); except for the case in which the RPV remains at pressure (refer to MNGP EPU MAAP runs MNGPEPU5a and MNGPEPU5c).

4.1.2.3 Heat Load to the Pool Energy to be absorbed by the pool during an isolation event or RPV depressurization increases for the EPU case relative to the CLTP. For non-ATWS scenarios, the RHR heat exchangers, the main condenser, and the containment vent all have capacities that exceed the increase in heat load due to extended power uprating. The heat removal capability margins are sufficiently large such that the changes in power level associated with EPU do not affect the success criteria for these systems.

Although a MNGP "successful vent initiation" MAAP run was not performed in support of this risk assessment, MAAP runs for other BWR plants show that once the containment vent is opened, per the EOPs, containment pressure decreases immediately and rapidly.

(1) Use of CRDH as an RPV injection source is an option identified in the EOPs. Various CRDH alignments can produce different flow rates into the RPV. OPS Manual Section C.5.3204 provide the instruction for use of CRDH as an RPV injection source. The first, and most simple action is to start a second pump. Addition action may be taken to further enhance ("or maximize") CRDH flow; these actions involve operator manipulations in the reactor building to open bypass valves.

4-6 4-6 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications The small percentage difference in decay heat level (i.e., CLTP vs. EPU) at the time of EOP vent initiation will not change this performance.

No changes to the above DHR systems to augment their capabilities for the EPU configuration are planned.

4.1.2.4 Blowdown Loads Dynamic loads would increase slightly because of the increased stored thermal energy.

This change would not quantitatively influence the PRA results. The containment analyses for LOCA under EPU conditions indicate that dynamic loads on containment remain acceptable.

4.1.2.5 RPV Overpressure Margin The RPV dome operating pressure will not be increased as a result of the power uprate.

However, the RPV pressure following a failure to scram is expected to increase slightly.

The current MNGP CLTP PRA requires two (2) SRVs to open for initial pressure control during a transient. Based on MAAP runs performed for this EPU risk assessment, this success criterion remains unchanged for the EPU. MNGP EPU MAAP runs MNGPEPUla and MNGPEPUla_a show that two SRVs are required for initial RPV overpressure protection during an isolation transient for the EPU configuration to maintain RPV pressure below the ASME service Level C RPV pressure of 1500 psig.

The current MNGP PRA does not require any SRVs for initial RPV overpressure control for LOCA initiators. This success criterion also remains unchanged for the EPU.

The CLTP PRA uses a success criterion of 6 of 8 SRVs required for RPV initial overpressure protection during an ATWS scenario. Based on EPU ATWS analysis, 7 of 8 4-7 4-7 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications SRVs are required for the uprated condition for RPV initial overpressure protection during an ATWS scenario.

4.1.2.6 SRV Actuations Given the power increase of the EPU, one may postulate that the probability of a stuck open relief valve given a transient initiator would increase due to an increase in the number of SRV cycles.

The stuck open relief valve probability following a plant trip and SRV challenge used in the MNGP PRA is 2E-3 for transient events (basic event XVRONESRVC) and 2E-2 for ATWS scenarios (basic event XVR-ATWS-C). The MNGP PRA base stuck open relief valve probabilities may be modified using different approaches to consider the effect of a postulated increase in valve cycles. The following three approaches are considered:

1. The upper bound approach would be to increase the stuck open relief valve probability by a factor equal to the increase in reactor power (i.e., a factor of 1.13 in the case of the MNGP 113% CLTP EPU). This approach assumes that the stuck open relief valve probability is linearly related to the number of SRV cycles, and that the number of cycles is linearly related to the reactor power increase.

2. A less conservative approach to the upper bound approach would be to assume that the stuck open relief valve probability is linearly related to the number of SRV cycles, BUT the number of cycles is not necessarily directly related to the reactor power increase. In this case the postulated increase in SRV cycles due to the EPU would be determined by thermal hydraulic calculations (e.g., MAAP runs).

3. The lower bound approach would be to assume that the stuck open relief valve probability is dominated by the initial cycle and that subsequent cycles have a much lower failure rate. In this approach the base stuck open relief valve probability could be assumed to be insignificantly changed by a postulated increase in the number of SRV cycles.

Approach #1 is used here to modify the MNGP PRA stuck open relief valve probability.

Therefore, the MNGP PRA base stuck open relief valve probability given a transient 4-8 4-8 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications initiator is increased 13% to 2.26E-3 to represent the EPU configuration, and the probability for ATWS scenarios is likewise increased 13% to 2.26E-2.

4.1.2.7 RPV Emergency Depressurization The current MNGP PRA requires one SRV for RPV emergency depressurization in transient scenarios. MAAP cases performed in support of this EPU risk assessment (e.g.,

MNGPEPU1a) show that this success criterion remains unchanged by the EPU.

The CLTP MNGP PRA also assumes that two (2) SRVs are required in those instances when alternative low pressure injection system alignments of FPS crosstie or CSW are used. This success criterion is also assessed as appropriate for the EPU.

4.1.2.8 Success Criteria Summary The Level 1 and Level 2 MNGP PRAs have developed success criteria for the key safety functions. Tables 4.1-2 through 10 summarize these safety functions and the minimum success criteria under the current power configuration and that required under the Extended Power Uprate configuration. Success criteria are summarized for the following:

• General Transients (Table 4.1-2)

• IORV, Transient w/SORV (Table 4.1-3)

• Small LOCA (Table 4.1-4)

• Medium LOCA (Table 4.1-5)

• Large LOCA (Table 4.1-6)

• ATWS Events (Table 4.1-7)

• Internal Floods (Table 4.1-8)

• ISLOCA, Breaks Outside Containment (Table 4.1-9)

• Level 2 (Table 4.1-10) 4-9 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications The PRA success criteria are affected by the increased boil off rate, the increased heat load to the suppression pool, and the increase in containment pressure and temperatures.

Selected MAAP runs demonstrate the significant margins associated with the installed systems. However, MAAP runs were not performed to verify success criteria for all PRA systems. For example, the high pressure and low pressure ECCS system success criteria is assumed in this assessment to remain the same for the EPU condition as for the CLTP condition based on the task analysis reports performed as part of the EPU program.

The Level 1 PRA success criteria impacts due to the EPU are as follows:

1. 7 of 8 SRVs are required for the EPU condition for RPV initial overpressure protection during an ATWS scenario.

2. CRDH as the only early injection source using 2 CRDH pumps at nominal flow now requires that the RPV be depressurized (the use of enhanced flow CRDH with a single CRDH pump is unchanged for the EPU).

These Level 1 PRA success criteria changes are addressed in the MNGP EPU risk assessment.

No changes in success criteria have been identified with regard to the Level 2 containment evaluation. The slight changes in accident progression timing and decay heat load have only minor or negligible impacts on Level 2 PRA safety functions, such as containment isolation, ex-vessel debris coolability, and challenges to the ultimate containment strength.

This assessment is consistent with GE's generic conclusions on this issue [15]:

"..CPPUis not expected to have a major impact on the PRA success criteria."

4-10 4-10 C495070003-7740-03/27108

Monticello Extended Power Uprate Risk Implications 4.1.3 Accident Sequence Modelincq The EPU does not change the plant configuration and operation in a manner such that new accident sequences or changes to existing accident scenario progressions result. A slight exception is the reduction in available accident progression timing for some scenarios and the associated impact on operator action HEPs (this aspect is addressed in the Human Reliability Analysis section).

This assessment for MNGP is consistent with GE's generic conclusions on this issue [14]:

"The basic BWR configuration, operation and response is unchanged by power uprate. Generic analyses have shown that the same transients are limiting... Plant-specific analyses demonstrate that the accidentprogressionis basicallyunchanged by the uprate."

4.1.4 System Modelinq The MNGP plant changes associated with the EPU do not result in the need to change any system fault trees to address changes in standby or operational configurations, or the addition of new equipment (refer to failure data discussion below regarding replacement of components with upgraded components).

Changes were made to the CRD and SRV fault tree logic to address the Level 1 PRA success criteria changes for EPU discussed in Section 4.1.2.8.

4.1.5 Failure Rate Data The majority of the hardware changes in support of the EPU may be characterized as either:

• Replacement of components with enhanced like components

• Upgrade of existing components 4-11 4-11 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Although equipment reliability as reflected in failure rates can be theoretically postulated to behave as a "bathtub" curve (i.e., the beginning and end of life phases being associated with higher failure rates than the steady-state period), no significant impact on the long-term average of initiating event frequencies, or equipment reliability during the 24 hr. PRA mission time due to the replacement/modification of plant components is anticipated, nor is such a quantification supportable at this time. If any degradation were to occur as a result of EPU implementation, existing plant monitoring programs would address any such issues. This assessment is consistent with GE's generic conclusions on this issue [15]:

"..CPPUis not expected to have a major effect on component or system reliability, as long as equipment operating limits, conditions, and/orratings are not exceeded."

No planned operational modifications as part of the MNGP EPU include operating equipment beyond design ratings. However, sensitivity cases that increase transient initiating event frequencies are quantified in this EPU risk analysis to bound the various changes to the BOP side of the plant (refer to Section 5.7 of this report).

4.1.6 Human Reliability Analysis The Monticello risk profile, like other plants, is dependent on the operating crew actions for successful accident mitigation. The success of these actions is in turn dependent on a number of performance shaping factors. The performance shaping factor that is principally influenced by the power uprate is the time available within which to detect, diagnose, and perform required actions. The higher power level results in reduced times available for some actions. To quantify the potential impact of this performance shaping factor, deterministic thermal hydraulic calculations using the MAAP computer code are used. Refer to Appendix E for a summary of MAAP cases performed to support the Monticello power uprate.

4-12 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Discussion of Impact on Human Error Probabilities The increased power level reduces the time available for some operator actions by small increments. The reduction in the available time is generally small compared with the total time available to detect, diagnose, and perform the actions.

Table 4.1-11 summarizes the assessment of the operator actions explicitly reviewed in support of this analysis (both Level 1 and Level 2 PRA operator actions considered).

The operator actions identified for explicit review were selected based on the following criteria:

1. F-V (with respect to CDF) importance measure >- 5E-3

2. RAW (with respect to CDF) importance measure Ž_2.0

3. F-V (with respect to LERF) importance measure _> 5E-3

4. RAW (with respect to LERF) importance measure Ž_2.0

5. Time critical (<_30 min. available) action These criteria have been used in past EPU risk assessments. If any of the above criteria are met for an operator action the action is maintained for explicit consideration in the EPU risk assessment. Potential HEP changes for operator actions screened out from explicit assessment in this EPU risk assessment will not have a significant impact on the quantitative results. Given that the EPU impacts on the significant HEPs modified for this study results in increasing the plant risk profile by about 7%, the non-significant HEPs if adjusted would be expected to impact the risk profile by a fraction of a percent.

In addition, of all the actions screened from further analysis, only a single action when conservatively increased to an error probability of 1.0 would result in an increase in CDF by _>1 E-6 or LERF by _>1 E-7. However, this one screened action, OIL-LOSS-Y, (related to failing to observe the need to address low fuel oil in the EDG day tank) has a long

(> 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />) allowable response time such that the HEP would not be significantly 4-13 4-13 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications impacted by the EPU (and indeed, the action timing is not directly related to RPV initial power level).

Approximately fifty operator actions were identified for explicit consideration regarding potential timing impacts due to the EPU. MAAP calculations for the MNGP CLTP and EPU configurations were performed to determine changes in allowable operator action timings. The human error probabilities (HEPs) were then re-calculated using the same human reliability analysis (HRA) methods used in the MNGP PRA. [2]

Refer to Appendix D for a summary of the operator action screening performed for this risk assessment.

As can be seen in Table 4.1-11, the changes in timing are estimated to result in changes to some HEPs. The changes in allowable operator action timings are not always directly linear with respect to the EPU power increase (i.e., a 13% power uprate does not always correspond to a 13% reduction in operator action timings):

• Allowable time windows for some actions are not impacted by the power uprate (e.g., timings based on battery life, timings based on internal flood rates, etc.)

• Allowable time windows for LOCAs may be driven more by the inventory loss than the decay heat.

• Allowable time windows for actions related directly to RCS boil-off time during non-LOCA events are also not necessarily linear with respect to the power uprate percentage. It is not uncommon that some actions have reductions many percentage points more than the uprate percentage. This is due to various factors, such as higher initial fuel temperature for the EPU providing more initial sensible heat to the RCS water in the early time frame after a plant trip than the CLTP condition, or more integrated fluid release out SRVs in the early time frame compared to the CLTP condition.

Section 5 summarizes the increase in the CDF and LERF associated with these HEP changes (in addition to other model changes).

4-14 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications The risk importance measures of these actions change slightly for the EPU but do not result in changing their relative significance to the MNGP risk profile. Using the FVCDF

> 5E-3 and RAWCDF > 2.0 as the criteria for risk significance of the operator actions, no post-initiator operator action HEP moved up past this risk significance test threshold for the EPU results. As such, no new risk significant operator actions resulted from this analysis.

The EPU SBO procedure will require the operator to manually switch HPCI suction from the torus back to the CST. According to the simulation, torus temperature may reach 170F in the last few minutes of the 4 hr coping period (HPCI operability is challenged at 170F). This action is already included in the EOPs, and it can be easily performed within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (3 MOVs and one knife switch manipulation, all in the control room), but it is included as a new time critical action given that the 170F temperature may be reached just before the 4 hr coping period for the EPU. However, this issue is not significant with respect to the PRA. The PRA does not use the 170F temperature limit for HPCI, but rather uses more realistic temperature challenge for HPCI (200F in the pool) and already includes an operator action to perform the suction transfer to the CST upon reaching 200F in the pool (the HEP for this action in the PRA, HPI-CSTS-Y, is not changed by the EPU - refer to Table 4.1-11).

No significant changes are to be made to the Control Room for the EPU that would impact the MNGP PRA human reliability analysis (HRA).

4.1.7 Structural Evaluations This assessment did not identify issues associated with postulated impacts from the EPU on the PRA modeling of structural (e.g., piping, vessel, containment) capacities.

This is consistent with GE's generic conclusions [14]:

4-15 4-15 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications "The RPV is analyzed for power uprate conditions.

Transients, accident conditions, increased fluence, and past operating history are considered to recertify the vessel.

Plant specific analyses at power uprate conditions demonstrates that containment integrity will be maintained.... no significant effect on LOCA probability.

Increase in flow rates is addressed by compliance with Generic Letter 89-08, Erosion/Corrosionin Piping..."

4.1.8 Quantification No changes in the MNGP PRA quantification process (e.g., truncation limit, etc.) due to the EPU have been identified (nor were any anticipated). Small changes in the quantification results (accident sequence frequencies) were realized as a result of HEP and modeling changes made to reflect the EPU.

4.1.9 Level 2 PRA Analysis Given the minor change in Level 1 CDF results, minor changes in the Level 2 release frequencies can be anticipated. Such changes are directly attributable to the change in the Turbine Trip initiating event frequency and the minor changes in short term accident sequence timing and the impact on HEPs. (Refer to Section 4.7 for additional discussion).

The accident sequence modeling in the Level 2 PRA is not impacted by the EPU.

No modeling or success criteria changes are required in the post core damage Level 2 sequences due to the EPU. The Level 2 functions are either conservatively based or are driven by accident phenomena. Refer to Table 4.1-10.

Fission product inventory in the reactor core is higher as a result of the increase in power due to the EPU. The increase in fission product inventory results in an increase in the total radioactivity available for release given a severe accident. However, this does not impact the definition or quantification of the LERF risk measure used in Regulatory Guide 1.174, and as the basis for this risk assessment. The MNGP PRA release categories are defined 4-16 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications based on the percentage (as a function of EOC inventories) of Csl released to the environment, which is consistent with most, if not all, industry PRAs. MAAP runs were performed for the Medium-Early and Large-Late release sequence types in the MNGP Level 2 PRA to show that these sequence types remain the same release categorizations and do not become LERF as a result of the EPU. Refer to Section 4.7 and Appendix E.

4-17 4-17 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-1 REVIEW OF PRA ELEMENTSFOR POTENTIAL RISK MODEL EFFECTS Disposition PRA Elements Category Basis Initiating Events B No new initiators or increased frequencies of existing initiators are anticipated to result from the MNGP EPU. However, quantitative sensitivity cases that increase the transient and LOCA frequencies are performed as part of this analysis.

Success Criteria B There are a number of potential effects that could alter success criteria. These are discussed in the text. They include the following:

• Time to boil down

• Heat Load to the Pool

• Blowdown Loads

• RPV Overpressure Margin (number of SRVs/SVs required)

Depressurization (number of SRVs required)

Accident Sequences C No changes in the accident sequence structure (Structure, Progression) result from the increase in power rating.

The accident progression is slightly modified in timing. These changes are incorporated in the Human Reliability Analysis (HRA).

System Analysis B No new system failure modes or significant changes in system failure probabilities due to the EPU.

Data C No change to component failure probabilities.

Human Reliability A The change in initial power level in turn results in Analysis decreases in the time available for operator actions. See discussion of operator actions in Section 4.1.6.

4-18 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-1 (Continued)

REVIEW OF PRA ELEMENTS FOR POTENTIAL RISK MODEL EFFECTS Disposition PRA Elements Category Basis Structural C No changes in the structural analyses are identified that would adversely impact the PRA models.

Quantification B No changes in PRA quantification process (e.g.,

truncation limit, flag settings, etc.) due to EPU.

However, a small number of changes are identified in the accident sequence quantification results. Individual basic event quantification effects are addressed under HRA.

Level 2 B Slight changes in accident progression timing result from the increased decay heat. However, the slight changes are negligible compared with the overall timing of the core melt accident progression.

4-19 4-19 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-2 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: GENERAL TRANSIENTS Minimum Systems Required Safety Function Current PRA Power EPU Power(8)

(CLTP) (113% CLTP)

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Turbine bypass Same(9), (0)

Control (Overpressure) or 2 of 8 SRVs(9)

Primary System Pressure All SVs/SRVs must reclose Same Control (SRVs reclose) (by definition)

High Pressure Injection 1 FW pump & 1 Cond. pump(1 ) Same(1")

or HPCI (except nominal CRDH flow w/2 or pumps now requires the RPV to RCIC be at reduced pressure to be or successful for the EPU)

CRDH (2 pumps at nominal flow or 1 pump at "enhanced" flow) (3)

RP Emergency Depressurization 1 of 8 SRVs Same(1 2)

(2/8 SRVs required for FPS and CSW injection sources) 1 LPCI pump Same(1 3)

Low Pressure Injection or 1 Core Spray pump or 1 Condensate pump(2) 1 CRDH pump at nominal flow Same(1 4)

Alternate Injection for late injection(3) or RHRSWA crosstie to LPCI(4) or Condensate Service Water (CSW) Injection(4) or FPS crosstie to LPCI(4) 4-20 4-20 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-2 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: GENERAL TRANSIENTS Minimum Systems Required Safety Function Current PRA Power EPU Power(8)

(CLTP) (113% CLTP)

Main Condenser Same(14)

Containment Heat Removal or 1 RHR Hx Loop(6) or 7

)

Containment Venting(

4-21 4-21 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes To Table 4.1-2:

(1) One FW pump injecting, with one condensate pump providing suction, is a success for high pressure injection for a transient. FW operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(2) One condensate pump injecting is a success for low pressure injection for a transient. Operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(3) CRDH injection flow rate at MNGP is sufficiently large that it can be used as a the sole early injection source for non-LOCA and non-ATWS scenarios if a second CRDH pump is started in a timely manner, or the flow of a single pump is enhanced (via CRDH flow enhancement procedures) in a timely manner.

Later in accident sequences, many hours into the event after other injection sources have operated for some time (and have failed for some reason), CRDH is also a success but only requires one pump at nominal flow.

(4) The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core when the RPV is at approximately 100 psi. Two (2) SRVs are required in the PRA for this alignment. Requires manual alignment. Any one of the following FPS pumping sources is a success: diesel fire pump, electric fire pump, screen wash fire pump, or pumper truck (longer term option).

Like FPS, Condensate Service Water RPV injection alignment also requires 2 SRVs for success in the PRA. CSW alignment also requires manual actions for alignment.

RHRSW A crosstie to LPCl provides significant flow and only requires a single SRV. Like FPS and CSW alignments, RHRSW crosstie also requires manual actions for alignment.

(5) <Not used.>

(6) 1 RHR pump, 1 RHR heat exchanger and 1 RHRSW pump are required for success.

(7) By design and EOPs, emergency containment venting is a success in the PRA for the containment heat removal function. The PRA credits the hard-pipe, wetwell, and drywell vent paths for containment heat removal.

(8) The success criteria applied for the power uprate configuration are based on MAAP calculations, GE calculations, or engineering judgement using conservative margins.

(9) The previous 112% re-rate study (refer to MNGP document II.SMN.96.001) determined that 2 SRVs are required to lift for isolation transients for successful RPV overprotection (to prevent the RPV from exceeding 1500 psi, Service Level C). The MNGP 2005 PRA currently models that 8/8 SRVs must fail to open (basic event XVR8SRVCCN88); the PRA documentation acknowledges this, appropriately stating that 2 SRVs are required but that adjustment to this basic event to make it 7 out of 8 fail to open would not change the already very low probability (which is overwhelmingly dominated by common cause failure, such that the probability of CCF of 7 SRVs to open is the same value as CCF of 8 SRVs to open).

MNGP EPU MAAP runs MNGPEPUla and MNGPEPUla_a also show that two SRVs are required for initial RPV overpressure protection during an isolation transient for the EPU configuration.

MNGP EPU MAAP run MNGPEPUlax shows that 1 SRV for the CLTP case is marginal (RPV pressure just below 1500 psi); so, the CLTP assumption requiring two is reasonable.

4-22 4-22 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications (10) By plant design the MNGP turbine bypass is sufficient for RPV overpressure protection during a transient with the condenser heat removal path available. (Refer to MNGP EPU transient analysis.)

(11) FW/Condensate, HPCI, and RCIC, by design, have more than enough capacity to provide coolant makeup at the EPU condition for a transient initiator.

Refer to MNGP EPU MAAP runs MNGPEPU5e - MNGPEPU5h that show that "enhanced CRDH" is sufficient for high pressure makeup for transients for the EPU condition. Nominal CRDH flow with 2 pumps is also successful as the only injection source for a transient for the EPU as long as the second pump is started in a timely manner (refer to MNGP EPU MAAP runs MNGPEPU5b and MNGPEPU5d); except for the case in which the RPV remains at pressure (refer to MNGP EPU MAAP runs MNGPEPU5a and MNGPEPU5c).

(12) MAAP run MNGPEPUla shows that 1 SRV is sufficient for RPV Emergency Depressurization for the EPU configuration for a transient initiator. The EPU risk assessment reasonably assumes the 2 SRV success criterion for use of the alternate low flow LP injection sources in the CLTP PRA remains appropriate for the EPU.

(13) LPCI, Core Spray, and Condensate, by design, have more than enough capacity to provide coolant makeup at the EPU condition. (Also refer to MAAP run MNGPEPUla) for a transient initiator.

(14) Engineering judgment.

By plant design, the main condenser, RHR system, and emergency containment vent remain successful for the EPU condition. Also refer to MNGPEPU3 MAAP run that shows that 1 loop of SPC is effective for 24 hrs. The PRA credits RHR suppression pool cooling, shutdown cooling, and drywell spray modes.

In addition, the MNGP EPU MAAP runs (e.g., MNGPEPU5e through MNGPEPU5h) that show the lower flow CRDH system injection option is a success as an early injection source for the EPU, supports the reasonable assumption that the alternative alignments remain a success for the EPU.

4-23 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-3 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: IORVor TRANSIENT w/SORV Minimum Systems Required Safety Function Current PRA Power EPU Power(8)

(CLTP) (113% CLTP)

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure n/a Same Control (Overpressure) (addressed by SORV)

Primary System Pressure n/a Same Control (SRVs reclose) (SRV stuck-open) (by definition)

High Pressure Injection 1 FW pump & 1 Cond. pump(1 ) Same(11 )

or HPCI (except nominal CRDH flow w/2 or pumps now requires the RPV to CRDH (2 pumps at nominal flow be at reduced pressure to be or 1 pump at "enhanced" flow) (3) successful for the EPU)

RPV Emergency Depressurization n/a Same(9)

(performed by SORV at t=O) 1 LPCI pump Same(10 )

Low Pressure Injection or 1 Core Spray pump or 1 Condensate pump(2) 1 CRDH pump at nominal flow Same(1 2)

Alternate Injection for late injection(3) or RHRSWA crosstie to LPCI(4) or Condensate Service Water (CSW) Injection(4) or FPS crosstie to LPCI(4)

Main Condenser Same(1 2)

Containment Heat Removal or 1 RHR Hx Loop(6) or Containment Venting(7) 4-24 4-24 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes To Table 4.1-3:

(1) One FW pump injecting, with one condensate pump providing suction, is a success for high pressure injection for a transient w/SORV. FW operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(2) One condensate pump injecting is a success for low pressure injection for a transient w/SORV.

Operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(3) CRDH injection flow rate at MNGP is sufficiently large that it can be used as a the sole early injection source for non-LOCA and non-ATWS scenarios if a second CRDH pump is started in a timely manner, or the flow of a single pump is enhanced (via CRDH flow enhancement procedures) in a timely manner.

Later in accident sequences, many hours into the event after other injection sources have operated for some time (and have failed for some reason), CRDH is also a success but only requires one pump at nominal flow.

(4) The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core when the RPV is at approximately 100 psi. Two (2) SRVs are required in the PRA for this alignment. Requires manual alignment. Any one of the following FPS pumping sources is a success: diesel fire pump, electric fire pump, screen wash fire pump, or pumper truck (longer term option).

Like FPS, Condensate Service Water RPV injection alignment also requires 2 SRVs for success in the PRA. CSW alignment also requires manual actions for alignment.

RHRSW A crosstie to LPCl provides significant flow and only requires a single SRV. Like FPS and CSW alignments, RHRSW crosstie also requires manual actions for alignment.

(5) <Not used.>

(6) 1 RHR pump, 1 RHR heat exchanger and 1 RHRSW pump are required for success.

(7) By design and EOPs, emergency containment venting is a success in the PRA for the containment heat removal function. The PRA credits the hard-pipe, wetwell, and drywell vent paths for containment heat removal.

(8) The success criteria applied for the power uprate configuration are based on MAAP calculations, GE calculations, or engineering judgment using conservative margins.

(9) MAAP run MNGPEPUla shows that 1 SRV is sufficient for RPV Emergency Depressurization for the EPU configuration for a transient initiator. Thus, the one SORV is considered a success for the RPV emergency depressurization function. The EPU risk assessment reasonably assumes the 2 SRV success criterion for use of the alternate low flow LP injection sources in the CLTP PRA remains appropriate for the EPU.

(10) LPCI, Core Spray, and Condensate, by design, have more than enough capacity to provide coolant makeup at the EPU condition for an SORV scenario.

(11) FW/Condensate, HPCI, and RCIC, by design, have more than enough capacity to provide coolant makeup at the EPU condition for a transient initiator. However, the RCIC system is not credited in the PRA for IORV/SORV scenarios because level will dip below TAF, causing the operators to initiate RPV emergency depressurization per the EOPs.

4-25 C495070003-7740-03127/08

Monticello Extended Power Uprate Risk Implications Refer to MNGP EPU MAAP runs MNGPEPU5e - MNGPEPU5h that show that "enhanced CRDH" is sufficient for high pressure makeup for transients for the EPU condition. Nominal CRDH flow with 2 pumps is also successful as the only injection source for a transient for the EPU as long as the second pump is started in a timely manner (refer to MNGP EPU MAAP runs MNGPEPU5b and MNGPEPU5d); except for the case in which the RPV remains at pressure (refer to MNGP EPU MAAP runs MNGPEPU5a and MNGPEPU5c).

(12) Engineering judgment.

By plant design, the main condenser, RHR system, and emergency containment vent options remain successful for the EPU condition. Also refer to MNGPEPU3 MAAP run that shows that 1 loop of SPC is effective for 24 hrs. The PRA credits RHR suppression pool cooling, shutdown cooling, and drywell spray modes.

In addition, the MNGP EPU MAAP runs (e.g., MNGPEPU5e through MNGPEPU5h) that show the lower flow CRDH system injection option is a success as an early injection source for the EPU, supports the reasonable assumption that the alternative alignments remain a success for the EPU.

4-26 4-26 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-4 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: SMALL LOCA Minimum Systems Required Safety Function Current PRA Power EPU Power(7)

(CLTP) (113% CLTP)

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Control Not required Same (Overpressure)

Vapor Suppression Not required Same High Pressure Injection 1 FW pump & 1 Cond. pump(1 ) Same(3) or HPCI (4)

RPV Emergency 1 of 8 SRVs Same (9)

Depressurization Low Pressure Injection 1 LPCI pump Same(6 )

or 1 Core Spray pump or 1 Condensate pump(2)

Alternate Injection RHRSW A crosstie to LPC1(5) Same(9) or 5 FPS crosstie to LPCI( )

Containment Heat Removal Main Condenser Same(8) or 1 RHR Hx Loop or Containment Venting 4-27 4-27 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes To Table 4.1-4:

(1) One FW pump injecting, with one condensate pump providing suction, is a success for high pressure injection for a SLOCA scenario. FW operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(2) One condensate pump injecting is a success for low pressure injection for a SLOCA. Operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(3) FW/Condensate and HPCI have more than enough capacity to provide coolant makeup at the EPU condition for a SLOCA scenario. Refer to MNGP EPU MAAP run MNGPEPU3 which shows that HPCI can function as the only injection source for a SLOCA for the EPU condition throughout the PRA 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time.

(4) CRDH flow is not sufficient for early or late coolant makeup for LOCA scenarios. This is true for CLTP and for EPU.

(5) FPS crosstie and RHRSW crosstie are the only alternate LP systems of sufficient capacity for a SLOCA. CSW is not of sufficient capacity.

The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core when the RPV is at approximately 100 psi. Two (2) SRVs are required in the PRA for this alignment. Requires manual alignment. Any one of the following FPS pumping sources is a success: diesel fire pump, electric fire pump, screen wash fire pump, or pumper truck (longer term option).

RHRSW A crosstie to LPCI provides significant flow and only requires a single SRV. Like FPS, RHRSW crosstie also requires manual actions for alignment.

(6) LPCI, Core Spray, and Condensate have more than enough capacity to provide coolant makeup at the EPU condition for a small LOCA. Refer to MNGP EPU MAAP run MNGPEPU4 which shows the one LPCI train is sufficient for a MLOCA.

(7) The success criteria applied for the power uprate configuration are based on MAAP calculations, GE calculations, or engineering judgement using conservative margins.

(8) By plant design, the main condenser, RHR system, and emergency containment vent options remain successful for the EPU condition. Also refer to MNGPEPU3 MAAP run that shows that 1 loop of SPC is effective for 24 hrs. The PRA credits RHR suppression pool cooling, shutdown cooling, and drywell spray modes.

(9) Engineering judgment.

4-28 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-5 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: MEDIUM LOCA Minimum Systems Required Safety Function Current PRA Power EPU Power(8)

(CLTP) (113% CLTP)

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Not required Same Control (Overpressure)

Vapor Suppression Not required Same High Pressure Injection HPCI Same(1 )

RPV Emergency 1 of 8 SRVs Same(2)

Depressurization or HPCI initially available(2)

Low Pressure Injection 1 LPCI pump Same(5) or 1 Core Spray pump (4)

Alternate (Late) Injection RHRSW A crosstie to LPCI(86 Same(9) or FPS crosstie to LPCI(6)

Containment Heat Removal 1 RHR Hx Loop Same(7) 4-29 4-29 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes To Table 4.1-5:

(1) Refer to MNGP EPU MAAP run MNGPEPU4 which shows the HPCI is sufficient for a MLOCA for the EPU until the RPV sufficiently depressurizes so that LPCI or CS can then take over.

(2) HPCI operation in combination with the MLOCA will act as the method for RPV depressurization.

(refer to MNGP EPU MAAP run MNGPEPU4).

(3) FW is not credited because it assumed that the MLOCA may be in a recirculation loop, thus preventing flow from reaching the core.

(4) Condensate is not credited because it is assumed that the MLOCA will deplete the hotwell before sufficient hotwell makeup can be aligned.

(5) LPCI and Core Spray have more than enough capacity to provide coolant makeup at the EPU condition for a MLOCA. Refer to MNGP EPU MAAP run MNGPEPU4 which shows the one LPCI train is sufficient for a MLOCA.

(6) FPS crosstie and RHRSW crosstie are the only alternate LP systems of sufficient capacity for a MLOCA. CSW is not of sufficient capacity. FPS and RHRSW crossties are only successful for late injection (after another injection source has already operated and failed). They are not successful as the only early injection source due to lack of available time in which to complete the manual alignments.

The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core when the RPV is at approximately 100 psi. Requires manual alignment. Any one of the following FPS pumping sources is a success: diesel fire pump, electric fire pump, screen wash fire pump, or pumper truck (longer term option).

Like FPS, RHRSW crosstie also requires manual actions for alignment.

(7) By plant design, the RHR system remains successful for the EPU condition. Also refer to MNGPEPU3 MAAP run that shows that 1 loop of SPC is effective for 24 hrs. The PRA credits RHR suppression pool cooling and drywell spray modes for a MLOCA. The main condenser is not credited because the MSIVs will likely close due to accident signals. Shutdown cooling is also not credited for MLOCAs due to the potential break location in a recirculation loop. Containment venting is conservatively assumed not successful as the sole decay heat removal mechanism for MLOCAs and LLOCAs due to potential NPSH limitations on continued LPCI or CS injection.

(8) The success criteria applied for the power uprate configuration are based on MAAP calculations, GE calculations, or engineering judgment using conservative margins.

(9) Engineering judgment.

4-30 4-30 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-6 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: LARGE LOCA Minimum Systems Required Safety Function Current PRA Power EPU Power(6)

(CLTP) 7 (113% CLTP)

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Not required Same Control (Overpressure)

Vapor Suppression < 6 NWW-DW vacuum breakers Same(7) 1 stuck open is acceptable( )

High Pressure Injection N/A141 Same RPV Emergency Not required Same Depressurization Low Pressure Injection 1 LPCI pump Same(3) or 1 Core Spray pump Alternate Injection RHRSW A crosstie to LPCI(4) Same(8) or FPS crosstie to LPCI(4)

Containment Heat Removal 1 RHR Hx Loop(5) Same(8) 4-31 4-31 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes To Table 4.1-6:

(1) Six (6) stuck open WW-DW vacuum breakers will lead to sufficient suppression pool bypass to result in containment overpressurization. This condition is assumed to lead to core damage due to loss of potential injection sources.

(2) The LLOCA initiator results in rapid depressurization of the RPV, precluding the use of the FW, HPCI, and RCIC high pressure injection systems. In addition, the CRDH system is of inadequate flow rate to keep up with the inventory loss.

(3) LPCI and Core Spray have more than enough capacity to provide coolant makeup at the EPU condition for Large LOCAs. Refer to MNGP EPU ECCS-LOCA analysis. MNGP MAAP runs MNGPEPU4 and MNGPEPU4ax show that LPCI is successful for LLOCA throughout the 24 hr PRA mission time.

(4) Insufficient time is available during a LLOCA to align FPS or RHRSW crossties for use as the sole early injection source. However, FPS and RHRSW crossties are credited for late injection after another injection source has operated and subsequently failed for some reason.

(5) By plant design, the RHR system remains successful for the EPU condition for containment heat removal. The PRA credits RHR suppression pool cooling and drywell spray modes for a LLOCA.

The main condenser is not credited because the MSIVs will likely close due to accident signals.

Shutdown cooling is also not credited for LLOCAs due to the potential break location in a recirculation loop. Containment venting is conservatively assumed not successful as the sole decay heat removal mechanism for MLOCAs and LLOCAs due to potential NPSH limitations on continued LPCI or CS injection.

(6) The success criteria applied for the power uprate configuration are based on MAAP calculations, GE calculations, or engineering judgment using conservative margins.

(7) No change in the number of VBs for success is made for the EPU (postulating one or two more VBs required to not stick open for the EPU would not significantly change the vapor suppression failure probability).

(8) Engineering judgment.

4-32 4-32 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-7 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: ATWS Minimum Systems Required Safety Function Current PRA Power EPU Power(8" (CLTP) (113% CLTP)

Reactivity Control ARI(1) Same or; (ARI and ADS Inhibit by 1 of 2 SLC trains definition)

Primary System Pressure Turbine bypass Turbine bypass Control (Overpressure) or; or; 6 of 8 SRVs 7 of 8 SRVs(1 °)

and and RPTm2) RpT-2)

Primary System Pressure Not modeled Same Control (SRVs reclose)

High Pressure Injection 1 FW pump & 1 Cond. pump Same(3) or HPCI RPV Emergency 3 of 8 SRVs Same(4)

Depressurization Low Pressure Injection 1 LPCI pump Same(5) or 1 Core Spray pump Alternate Injection N/A(6) Same Containment Heat Removal Main Condenser(7) Same(9) or 7 1 RHR Hx Loop( )

or WW/DW Venting(7) 4-33 4-33 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Notes To Table 4.1-7:

(1) Alternate Rod Insertion (ARI) is a successful reactivity control measure only for electrical scram failures.

(2) The Recirculation Pump Trip (RPT) must actuate as designed and trip both recirculation pumps for initial RPV pressure control during an isolation ATWS. Ifturbine bypass remains available then RPT is not needed for initial pressure control.

(3) By plant design and the EOPs, FW and HPCI are successful for high pressure makeup during an ATWS. This is true for the EPU condition, as well (refer to MNGP EPU MAAP runs MNGPEPU7b and MNGPEPU7c).

(4) The CLTP PRA uses 3 SRVs as the success criterion for RPV emergency depressurization during an ATWS. This success criterion remains applicable to the EPU condition (refer to MNGP EPU MAAP run MNGPEPU7a).

(5) By plant design and the EOPs, LPCI and Core Spray are successful for low pressure makeup during an ATWS. This is true for the EPU condition, as well (refer to MNGP EPU MAAP run MNGPEPU7a).

(6) Alternate low pressure injection systems are not credited because it is assumed that insufficient time is available to perform the alignments during an ATWS.

(7) The main condenser, RHR system and emergency containment vent options remain successful for the EPU condition for containment heat removal. The PRA credits the RHR suppression pool cooling mode for an ATWS. The EOPs do not direct use of SDC during an ATWS. Only the WW and DW paths are credited for containment venting during an ATWS, as it is uncertain whether the hard-pipe vent option is of sufficient capacity.

(8) The success criteria applied for the power uprate configuration are based on MAAP calculations or engineering judgement using conservative margins.

(9) Engineering judgment.

(10) Based on EPU ATWS analysis, 7 of 8 SRVs are required for the EPU condition for RPV initial overpressure protection during an ATWS scenario.

4-34 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-8 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: INTERNAL FLOODS Minimum Systems Required Safety Function Current PRA Power EPU Power(8)

(CLTP) (113% CLTP)

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Turbine bypass Same(9), (10)

Control (Overpressure) or 2 of 8 SRVs(9)

Primary System Pressure All SVs/SRVs must reclose Same Control (SRVs reclose) (by definition)

High Pressure Injection 1 FW pump & 1 Cond. pump(1 ) Same(11 )

or HPCI (except nominal CRDH flow w/2 or pumps now requires the RPV to RCIC be at reduced pressure to be or successful for the EPU)

CRDH (2 pumps at nominal flow or 1 pump at "enhanced" flow) (3)

RPV Emergency 1 of 8 SRVs Same(12)

Depressurization (2/8 SRVs required for FPS and CSW injection sources)

Low Pressure Injection 1 LPCI pump Same(13) or 1 Core Spray pump or 1 Condensate pump(2)

Alternate Injection 1 CRDH pump at nominal flow Same(14) for late injection(3) or RHRSWA crosstie to LPCI(4) or Condensate Service Water (CSW) Injection(4) or FPS crosstie to LPC1(4) 4-35 4-35 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-8 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: INTERNAL FLOODS Minimum Systems Required Safety Function Current PRA Power EPU Power"")

(CLTP) (113% CLTP)

Containment Heat Removal Main Condenser Same(14) or 1 RHR Hx Loop(6) or Containment Venting(7) 4-36 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Notes To Table 4.1-8:

(1) One FW pump injecting, with one condensate pump providing suction, is a success for high pressure injection for a transient type scenario (which is in general what an internal flood scenario is, other than the flood impacts on mitigation equipment). FW operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(2) One condensate pump injecting is a success for low pressure injection for a transient. Operation in the short-term does not require hotwell make-up; but the model requires hotwell makeup for the long-term.

(3) CRDH injection flow rate at MNGP is sufficiently large that it can be used as a the sole early injection source for non-LOCA and non-ATWS scenarios if a second CRDH pump is started in a timely manner, or the flow of a single pump is enhanced (via CRDH flow enhancement procedures) in a timely manner.

Later in accident sequences, many hours into the event after other injection sources have operated for some time (and have failed for some reason), CRDH is also a success but only requires one pump at nominal flow.

(4) The fire protection system alternate alignment is via LPCI and can provide 1000 gpm to the core when the RPV is at approximately 100 psi. Two (2) SRVs are required in the PRA for this alignment. Requires manual alignment. Any one of the following FPS pumping sources is a success: diesel fire pump, electric fire pump, screen wash fire pump, or pumper truck (longer term option).

Like FPS, Condensate Service Water RPV injection alignment also requires 2 SRVs for success in the PRA. CSW alignment also requires manual actions for alignment.

RHRSW A crosstie to LPCI provides significant flow and only requires a single SRV. Like FPS and CSW alignments, RHRSW crosstie also requires manual actions for alignment.

(5) <Not used.>

(6) 1 RHR pump, 1 RHR heat exchanger and 1 RHRSW pump are required for success.

(7) By design and EOPs, emergency containment venting is a success in the PRA for the containment heat removal function. The PRA credits the hard-pipe, wetwell, and drywell vent paths for containment heat removal.

(8) The success criteria applied for the power uprate configuration are based on MAAP calculations, GE calculations, or engineering judgment using conservative margins.

(9) The previous 112% re-rate study (refer to MNGP document I1.SMN.96.001) determined that 2 SRVs are required to lift for isolation transients for successful RPV overprotection (to prevent the RPV from exceeding 1500 psi, Service Level C). The MNGP 2005 PRA currently models that 8/8 SRVs must fail to open (basic event XVR8SRVCCN88); the PRA documentation acknowledges this, appropriately stating that 2 SRVs are required but that adjustment to this basic event to make it 7 out of 8 fail to open would not change the already very low probability (which is overwhelmingly dominated by common cause failure, such that the probability of CCF of 7 SRVs to open is the same value as CCF of 8 SRVs to open).

MNGP EPU MAAP runs MNGPEPUl1a and MNGPEPUla_a also show that two SRVs are required for initial RPV overpressure protection during an isolation transient for the EPU configuration.

4-37 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications MNGP EPU MAAP run MNGPEPUlax shows that 1 SRV for the CLTP case is marginal (RPV pressure just below 1500 psi); so, the CLTP assumption requiring two is reasonable.

(10) By plant design the MNGP turbine bypass is sufficient for RPV overpressure protection during a transient with the condenser heat removal path available. (Refer to MNGP EPU transient analysis.)

(11) FW/Condensate, HPCI, and RCIC, by design, have more than enough capacity to provide coolant makeup at the EPU condition for a transient initiator.

Refer to MNGP EPU MAAP runs MNGPEPU5e - MNGPEPU5h that show that "enhanced CRDH" is sufficient for high pressure makeup for transients for the EPU condition. Nominal CRDH flow with 2 pumps is also successful as the only injection source for a transient for the EPU as long as the second pump is started in a timely manner (refer to MNGP EPU MAAP runs MNGPEPU5b and MNGPEPU5d); except for the case in which the RPV remains at pressure (refer to MNGP EPU MAAP runs MNGPEPU5a and MNGPEPU5c).

(12) MAAP run MNGPEPU1a shows that 1 SRV is sufficient for RPV Emergency Depressurization for the EPU configuration for a transient initiator. The EPU risk assessment reasonably assumes the 2 SRV success criterion for use of the alternate low flow LP injection sources in the CLTP PRA remains appropriate for the EPU.

(13) LPCI, Core Spray, and Condensate, by design, have more than enough capacity to provide coolant makeup at the EPU condition. (Also refer to MAAP run MNGPEPU1a) for a transient initiator.

(14) Engineering judgment.

By plant design, the main condenser, RHR system and emergency containment vent options remain successful for the EPU condition. Also refer to MNGPEPU3 MAAP run that shows that 1 loop of SPC is effective for 24 hrs. The PRA credits RHR suppression pool cooling, shutdown cooling, and drywell spray modes.

In addition, the MNGP EPU MAAP runs (e.g., MNGPEPU5e through MNGPEPU5h) that show the lower flow CRDH system injection option is a success as an early injection source for the EPU, supports the reasonable assumption that the alternative alignments remain a success for the EPU.

4-38 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-9 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS (LEVEL 1) INITIATING EVENT: ISLOCA, BOC Minimum Systems Required Safety Function Current PRA Power EPU Power(5)

(CLTP) (113% CLTP)

Reactivity Control All control rods inserted (RPS Same electrical and mechanical (by definition) success)

Primary System Pressure Not required Same Control (Overpressure)

Vapor Suppression Not required Same High Pressure Injection N/A(1) Same RPV Emergency Not required Same Depressurization Low Pressure Injection 1 LPCI pump Same(2) or 1 Core Spray pump External Injection Sources RHRSW A crosstie to LPCI(3) Same(6 )

or Condensate Service Water (CSW) Injection(3) or FPS crosstie to LPCI(3)

Containment Heat Removal N/A(4) Same 4-39 4-39 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes To Table 4.1-9:

(1) Break outside containment initiators result in rapid depressurization of the RPV, precluding the use of the FW, HPCI, and RCIC high pressure injection systems. In addition, the CRDH system is of inadequate flow rate to keep up with the inventory loss.

(2) LPCI and Core Spray have more than enough capacity to provide coolant makeup at the EPU condition for Large LOCAs (ISLOCA and Break Outside Containment scenarios are modeled as large LOCA size breaks in the PRA). (Refer to MNGP EPU ECCS-LOCA analysis.)

(3) If a break outside containment is not isolated, reactor water inventory will continue to be discharged outside the drywell which will eventually deplete the suppression pool and disable low pressure injection via loss of suction and flooding. Consequently, external injection from a virtually unlimited supply and external pump is needed for long term core cooling. The MNGP credits FPS, RHRSW, and CWS alternate injection sources. These systems draw from the river and have a virtually infinite source of water.

(4) Decay heat removal active systems are not required for unisolated breaks outside containment, since the decay heat is carried out of containment via the break.

(5) The success criteria applied for the power uprate configuration are based on MAAP calculations, GE calculations, or engineering judgement using conservative margins.

(6) Engineering judgment.

4-40 4-40 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-10 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS: LEVEL 2 (LERF) PRA Minimum Systems Required Safety Functions Current PRA Power EPU Power(3)

(CLTP) (113% CLTP)

Containment Isolation Containment penetrations >2" dia. Same isolated (by definition)

RPV Depressurization post- 1 of 8 SRVs Same core damage (assumed same as Level 1 PRA)

Arrest Core Melt 1 LPCI pump Same(4)

Progression In-Vessel or 1 Core Spray pump or 1 Condensate pump or FPS crosstie or RHRSW crosstie Combustible Gas Venting Inerted containment with no oxygen Same intrusion during the accident (by definition) or Combustible gas purge / vent Containment Remains Intact Containment Isolation Same at RPV Breach and (by definition)

No early containment failure modes (e.g., steam explosions) compromise containment integrity Ex-vessel Debris Coolability 1 LPCI pump Same(4) or 1 Core Spray pump or 1 Condensate pump or DW Sprays or FPS crosstie or RHRSW crosstie 4-41 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-10 KEY SAFETY FUNCTIONS AND MINIMUM SYSTEM REQUIREMENTS FOR SUCCESS: LEVEL 2 (LERF) PRA Minimum Systems Required Safety Functions Current PRA Power EPU Power(3)

(CLTP) (113% CLTP)

Containment Heat Removal 1 RHR Hx Loop(1 ) Same(4) or Containment Venting(2)

Fission Product Scrubbing No failure in DW Same or (by definition)

For WW airspace failure: no SP bypass (i.e., no WW-DW vacuum breakers stuck open and no SRV tail pipe failures) 4-42 4-42 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes To Table 4.1-10:

(1) 1 RHR pump, 1 RHR heat exchanger and 1 RHRSW pump are required for suppression pool cooling or DW Sprays for Level 2 containment heat removal for post-core damage accidents proceeding with an initially intact containment.

(2) Containment venting is also a success for Level 2 containment heat removal for post-core damage accidents proceeding with an initially intact containment. The wetwell and drywell vents, and the hard-piped vent are credited.

(3) The Level 2 success criteria assessments for the power uprate configuration are made based on MAAP calculations, engineering judgment using conservative margins and industry studies.

(4) Engineering judgment.

4-43 4-43 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment 020-ISOL-M-Y Fail to isolate a medium or 20 min. 20 min. 3.00E-01 3.OOE-01 Based on time to equipment submergence large leak within 20 minutes due to internal flooding and not dependent on reactor power.

030-ISOL-M-Y Fail to isolate a medium or 30 min. 30 min. 3.OOE-02 3.OOE-02 Based on time to equipment submergence large leak within 30 minutes due to internal flooding and not dependent on reactor power.

030-ISOL-S-Y Fail to isolate a small leak 30 min. 30 min. 3.OOE-01 3.OOE-01 Based on time to equipment submergence within 30 minutes due to internal flooding and not dependent on reactor power.

060-ISOL-M-Y Fail to isolate a medium or 60 min. 60 min. 3.OOE-03 3.OOE-03 Based on time to equipment submergence large leak within 60 minutes due to internal flooding and not dependent on reactor power.

060-ISOL-S-Y Fail to isolate a small leak 60 min. 60 min. 3.OOE-02 3.OOE-02 Based on time to equipment submergence within 60 minutes due to internal flooding and not dependent on reactor power.

120-ISOL-S-Y Fail to isolate a small leak 120 min. 120 min. 3.OOE-03 3.OOE-03 Based on time to equipment submergence within 120 minutes due to internal flooding and not dependent on reactor power.

ALT-INJ-LY Fail to align FPS, RHRSW, n/a n/a 8.OOE-04 8.OOE-04 Execution Error: No impact on HEP, this CSW, or SW - hour available event is solely execution error (diagnosis TSC support error addressed by separate event).

ALT-POWER-Y Fail to align alternate power >4hrs >4hrs 5.OOE-03 5.OOE-03 Timing based on battery life and not directly supplies directly to MCC-44 on reactor power (action timing for this HEP does not explicitly credit the additional time until core damage after DC batteries deplete).

ASDS-DEP-Y Fail to implement 1 hr 50 min. 1.00E-02 1.OOE-02 MNGP EPU MAAP runs MNGPEPU8a and depressurization from ASDS MNGPEPU8ax show time window reduced panel to approximately 50 min. for EPU case.

Screening HEP not impacted by EPU.

ATWS-SHT-Y Operator fails to initiate ATWS <1 min. <1 min. 1.OOE+00 1.OOE+00 ASEP Upper Bound TRC curve.

_________ I (short time available) I I II 4-44 4-44 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power CLTP) (113% CLTP) Base HEP EPU HEP Comment CHR-DET--Y Fail to identify need for 8 hrs 6.8 hrs 1.00E-06 1.00E-06 Diagnosis Error: Timing based on time to containment heat removal SPfT = 200F for transients with no SPC.

MNGP EPU MAAP run MNGPEPU9 shows the time is t=6.8 hrs for EPU condition.

ASEP Lower Bound TRC curve, and 1E-6 HEP minimum threshold in MNGP PRA.

HEP unchanged.

CRD-LSBYPY Fail to restore CRDH after 25 min. 21 min 8.00E-02 1.23E-01 MNGP EPU MAAP runs MNGPEPU5d and LOSP and ECCS load shed MNGPEPU5dx show that the time available is reduced approximately 15% for the EPU (using times to maximize core temp). EPU diagnosis time is 11 min. and execution time is 10 min. ASEP Median TRC curve.

CRD-PUMP-Y Fail to start second CRDH 25 min. 21 min 9.OOE-03 1.40E-02 MNGP EPU MAAP runs MNGPEPU5d and pump from control room MNGPEPU5dx show that the time available is reduced approximately 15% for the EPU (using times to maximize core temp). EPU diagnosis time is 20 min. and execution time is 1 min. ASEP Median TRC curve.

CRD-VALV-Y Fail to maximize CRDH flow - 25 min. 21 min 4.00E-02 5.27E-02 MNGP EPU MAAP runs MNGPEPU5i and valves in RB MNGPEPU5ix show that the time available is reduced approximately 15% for the EPU (using times to maximize core temp). EPU diagnosis time is 14 min. and execution time is 7 min. ASEP Median TRC curve.

CRIT-DET-Y Fail to detect criticality issue - 30 min. 30 min. 1.18E-04 1.18E-04 Diagnosis Error: This action error applies long time available to ATWS scenarios in which the turbine is online. An indefinite, long time is available to the operator; the PRA conservatively assumes 30 mins. available. This timing assumption is not changed by the EPU.

ASEP Lower Bound TRC curve. Base PRA mistakenly used 40 min. for the HEP calculation; base HEP revised in this calculation to use the correct base value of 30 min.

4-45 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment CST-FILL-Y Fail to refill the CSTs >15 hrs <15 hrs 1.00E-03 1.OOE-03 Timing based on CST inventory depletion due to use for RPV coolant makeup long term. CLTP PRA assumes time available

>15 hrs, and 1 hr required for alignment.

EPU time available would be reduced, but would have to be reduced unrealistically (by 10 hrs or more) to change the CLTP HEP which is dominated by execution error. ASEP Median TRC curve.

DEP-02MN-Y Fail RPV depressurization 5 min. 4.4 min. 2.50E-01 5.10E-01 This action used in isolation ATWS within 2 minutes scenarios with failure of all HP injection.

The CLTP PRA estimates 5 minutes available (diagnosis time of 2 min. and execution time of 3 min.). MNGP EPU MAAP runs MNGPEPU7a and MNGPEPU7ax show that this timing is not reduced significantly (<10%) for the EPU, a 13% reduction is assumed inthe EPU risk assessment. EPU time available is estimated at 4.4 min. (diagnosis time of 1.4 min. and execution time of 3 min.). ASEP Lower Bound TRC curve. CLTP base PRA mistakenly used 3 min. diagnosis for the HEP calculation; base HEP revised in this calculation to use the correct base diagnosis time of 2 min.

DEP-12MN-Y Fail RPV depressurization 15 min. 13.1 min. 5.20E-03 9.84E-03 This action is applicable to MLOCA within 12 minutes scenarios with no HP injection available.

MNGP EPU MAAP runs MNGPEPU8b and MNGPEPU8bx indicate that the time is reduced 10-13% for the EPU, a 13%

reduction is assumed for the EPU. EPU time available estimated at 13.1 min (diagnosis time of 10.1 min. and execution time of 3 min.). ASEP Lower Bound TRC curve.

4-46 4-46 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power ýCLTP) (113% CLTP) Base HEP EPU HEP Comment DEP-50MN-Y Fail RPV depressurization 50 min. 42 min. 1.80E-04 1.90E-04 This action is applicable to non-LOCA and within 50 minutes non-ATWS scenarios with no HP injection available. MNGP EPU MAAP runs MNGPEPU8a and MNGPEPU8ax shows that this timing is reduced approximately 16% for the EPU. EPU time available estimated at 42 min. (diagnosis time is 39 min. and execution time of 3 min). ASEP Lower Bound TRC curve.

DEP-HOUR-Y Fail RPV depressurization >an 103 min. 103 min. 1.60E-04 1.60E-04 This action is applicable to non-LOCA and hour available non-ATWS scenarios with HP injection initially available, but RPV ED required later for other reasons (e.g., HCTL, HP injection failure). CLTP assumes a diagnosis time of 100 minutes, and an execution time of 3 mins. MNGP EPU MAAP runs MNGPEPU8c and MNGPEPU8d show that for scenarios requiring late RPV ED due to issues such as HCTL or HP injection failure significantly more than 100 mins. remain before core damage occurs. Thus, the CLTP time available for this action is unchanged for the EPU. ASEP Lower Bound TRC curve.

DEP-PD-Y Fail to depressurize reactor 2 hrs -2 hrs 1.OOE-01 1.OOE-01 Timing based on post-core damage after core damage, but before accident progression assumptions and time vessel penetration to RPV melt-through. Screening HEP not impacted by EPU.

DW-VENT-PRG Fail to prevent H2 burn failing < 30 min. < 30 min. 1.OOE+00 1.OOE+00 containment by vent/purge FLOODRB16Y Fail to flood RB within 1-6 1-6 hrs 1-6 hrs. 3.OOE-01 3.OOE-01 Timing based on internal flooding issues hours after torus leak and not directly on reactor power.

4-47 4-47 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment FW-CNTRL-Y Fail to control FW as high 15 min. 12 min. 4.60E-03 5.46E-03 The available action time is based on the pressure injection source time to reach TAF for an isolation transient following transient with loss of all HP injection. MNGP EPU MAAP run MNGPEPU8a show that this time is approximately t=12 min. for the EPU power level. EPU time available estimated at 12 mins (diagnosis time of 11 min. and execution time of 1 min.). ASEP Lower Bound TRC curve.

FW-REFLG-Y Fail to identify reference leg 7 min. 5.5 min. 4.OOE-02 6.94E-02 The time available is based on the time to leak reach TAF for a ref. leg break event with no high pressure injection. Time available for CLTP estimated at t=7 mins. MNGP EPU MAAP runs MNGPEPU6c, MNGPEPU6cx, MNGPEPUlb and MNGPEPUlbx indicate that this time frame is reduced approximately 20-22% due to the EPU.

EPU time available estimated at 5.5 mins.

(diagnosis time of 4.5 min. and execution time of 1 min.). ASEP Lower Bound TRC curve.

HPI-CSTS-Y Fail to defeat high torus level 1 hr 1 hr 3.OOE-03 3.OOE-03 This action applies to scenarios with pool suction transfer temperature reaching 200F and need to switch HPCI/RCIC suction to CST to prevent failure of pump due to overheating.

Timing of 1 hr. used in CLTP not based directly on reactor power, this time is not adjusted for the EPU. ASEP Lower Bound TRC curve.

4-48 4-48 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) 0113% CLTP) Base HEP EPU HEP Comment LEVEL-05-Y Fail to detect need for injection 30 min. 26 min. 5.OOE-02 1.00E+00 Diagnosis Error: Time available in CLTP within 5 minutes of compelling PRA based on time to core damage for signal SLOCA type scenarios with no HP injection, estimated at t=30 minutes and 25 minutes to execute the action (thus, 5 min.

diagnosis time). MNGP EPU MAAP runs MNGPEPU6c and MNGPEPU6cx show that this time frame is reduced to approximately t=26 mins (thus, 1 min.

diagnosis time). ASEP Lower Bound TRC curve.

LEVEL-25-Y Fail to detect need for injection 50 min. 42 min. 6.OOE-04 1.72E-03 Diagnosis Error: This action is applicable within 25 minutes of compelling to non-LOCA and non-ATWS scenarios signal with no HP injection available. The CLTP PRA estimates the available window at 50 minutes and 25 minutes to execute the action (thus, 25 min. diagnosis time).

MNGP EPU MAAP runs MNGPEPU8a and MNGPEPU8ax shows that this timing is reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

(diagnosis time is 17 min. and execution time of 25 min). ASEP Lower Bound TRC curve.

4-49 4-49 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment LEVEL-45-Y Fail to detect need for injection -1 hr -1 hr. 1.00E-05 1.OOE-05 Diagnosis Error: This action is applicable within 45 minutes of compelling to non-LOCA and non-ATWS scenarios signal with HP injection initially available, but RPV ED required later for other reasons (e.g.,

HCTL, HP injection failure). CLTP assumes diagnosis time available is 45 minutes, then an additional 25 minutes for execution (thus, total time available greater than 1 hr.) MNGP EPU MAAP runs MNGPEPU8c and MNGPEPU8d show that for scenarios requiring late RPV ED due to issues such as HCTL or HP injection failure that significantly more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> remains before core damage occurs. Thus, the CLTP diagnosis time for this action of 45 mins. is unchanged for the EPU. ASEP Lower Bound TRC curve.

L-LONG---Y Operator fails to inject boron >1 hr >1 hr 4.OOE-04 4.OOE-04 This action error applies to ATVVS using SBLC - long time scenarios in which the turbine is online. An available indefinite, long time is available to the operator; the PRA conservatively assumes

> 1 hr. available. This timing assumption would not be changed by the EPU. ASEP Lower Bound TRC curve. In addition, the HEP is dominated by execution error.

OIL-LOSS-HY Fail to identify need to address >1 hr >1 hr 1.O0E-01 1.OOE-01 Timing based on EDG fuel consumption loss of fuel flow to EDG day and not directly on reactor power.

tanks - high Screening HEP not impacted by EPU.

4-50 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment PUMPER-L-Y Fail to provide FPS supply from 6 hrs 6 hrs 1.00E-03 1.00E-03 The available time is estimated inthe CLTP fire pumper truck - hours PRA based on the time to core damage for available an SBO, with HPCI or RCIC initial operation but subsequent failure due to battery depletion. The CLTP PRA estimates that >6hrs are available before core damage insuch scenarios (t=6 hrs is used inthe CLTP PRA for this HEP).

MNGP EPU MAAP run MNGPEPU8c shows core damage occurs at t=6.6 hrs for such scenarios for the EPU. As such, the 6 hr available time for this action is not adjusted for the EPU. ASEP Median TRC curve. Dominated by execution error.

RCIC-MAN-Y Fail to manually operate RCIC n/a n/a 5.00E-02 5.00E-02 Execution Error: No impact on HEP, this event is solely execution error (diagnosis error addressed by separate event).

REC-EDG-30 Fail to recover EDG within 30 30 min. 30 min. 8.5E-01 8.5E-01 Timing based on industry data and minutes associated LOOP event tree modeling assumptions. Timing and probability not impacted by EPU.

REC-EDG-1 1/6 Fail to recover EDG within 11 11 hrs/ 11 hrs/ 7.3E-01 7.3E-01 Nominal times of 11 hrs and 6 hrs still hours, given failure to recover 6 hrs 6 hrs appropriate for EPU (see EPU MAAP run w/i 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> MNGPEPU8c). Existing recovery failure probability already high. Time frame is long and AC recovery curves flatten out at such lengthy time frames, such that any postulated change to this recovery probability would not have a significant impact on risk.

REC-EDG-12/11 Fail to recover EDG within 12 12 hrs / 11 hrs / 9.3E-01 1.OE+00 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 11 hrs 11 hrs t=12 hr time frame is reduced to w/i 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> approximately t=1 1 hrs for the EPU.

REC-EDG-16/12 Fail to recover EDG within 16 16 hrs / 16 hrs / 9.0E-01 8.5E-01 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 12 hrs 11 hrs t=1 2 hr time frame is reduced to w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> I I II_ Iapproximately t=1 1 hrs for the EPU.

4-51 4-51 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment REC-EDG-22/12 Fail to recover EDG within 22 22 hrs / 22 hrs / 7.3E-01 6.5E-01 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 12 hrs 11 hrs t=12 hr time frame is reduced to w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> approximately t=1 1 hrs for the EPU.

REC-EDG-3/50 Fail to recover EDG within 3 3 hrs /50 mins. 3 hrs /42 mins. 6.9E-01 6.6E-01 MNGP EPU MAAP runs MNGPEPU8a and hours, given failure to recover MNGPEPU8ax shows that this timing is w/i 50 minutes reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

REC-EDG-50/30 Fail to recover EDG within 50 50 min. / 42 min. / 9.1 E-01 9.4E-01 MNGP EPU MAAP runs MNGPEPU8a and minutes, given failure to 30 min. 30 min. MNGPEPU8ax shows that this timing is recover w/i 30 minutes reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

REC-EDG-6/3 Fail to recover EDG within 6 6 hrs / 6 hrs / 5.1 E-01 5.1 E-01 Nominal times of 6 hrs and 3 hrs still hours, given failure to recover 3 hrs 3 hrs judged reasonable for EPU.

w/i 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> REC-OSP-30 Fail to recover offsite power 30 min. 30 min. 6.8E-01 6.8E-01 Timing based on industry data and within 30 minutes associated LOOP event tree modeling assumptions. Timing and probability not impacted by EPU.

REC-OSP-10/6 Fail to recover OSP within 10 10 hrs / 10 hrs / 8.OE-01 8.OE-01 Nominal times of 10 hrs and 6 hrs still hours, given failure to recover 6 hrs 6 hrs judged reasonable for EPU.

w/i 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> REC-OSP-11/6 Fail to recover OSP within 11 11 hrs / 11 hrs/ 7.5E-01 7.5E-01 Nominal times of 11 hrs and 6 hrs still hours, given failure to recover 6 hrs 6 hrs appropriate for EPU (see EPU MAAP run w/i 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> MNGPEPU8c). Existing recovery failure probability already high. Time frame is long and AC recovery curves flatten out at such lengthy time frames, such that any postulated change to this recovery probability would not have a significant impact on risk.

REC-OSP-12/11 Fail to recover OSP within 12 12 hrs / 11 hrs / 9.2E-01 1.OE+00 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 11 hrs 11 hrs t=12 hr time frame is reduced to w/i 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> approximately t=1 1 hrs for the EPU.

REC-OSP-16/12 Fail to recover OSP within 16 16 hrs / 16 hrs / 8.OE-01 7.3E-01 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 12 hrs 11 hrs t=12 hr time frame is reduced to w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> approximately t=1 1 hrs for the EPU.

4-52 4-52 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment REC-OSP-22/12 Fail to recover OSP within 22 22 hrs / 22 hrs / 5.0E-01 4.5E-01 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 12 hrs 11 hrs t=12 hr time frame is reduced to w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> approximately t=W1 hrs for the EPU.

REC-OSP-29/30 Fail to recover OSP within 2.9 2.9 hrs / 2.9 hrs / 4.2E-01 4.2E-01 No change assumed for 2.9 hr post-core hours, given failure to recover 30 min. 30 min. damage progression time frame, time w/i 30 minutes reasonable.

REC-OSP-3/50 Fail to recover OSP within 3 3 hrs / 3 hrs / 4.3E-01 4.1 E-01 MNGP EPU MAAP runs MNGPEPU8a and hours, given failure to recover 50 mins. 42 mins. MNGPEPU8ax shows that this timing is w/i 50 minutes reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

REC-OSP-34/22 Fail to recover OSP within 34 34 hrs / 34 hrs / 5.E-01 5.OE-01 Existing recovery failure probability already hours, given failure to recover 22 hrs 22 hrs high. Time frame is long and AC recovery w/i 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> curves flatten out at such lengthy time frames, such that any postulated change to this recovery probability would not have a significant impact on risk.

REC-OSP-50/30 Fail to recover OSP within 50 50 min. / 42 min. 88.5E-01 9.0E-01 MNGP EPU MAAP runs MNGPEPU8a and minutes, given failure to 30 min. 30 min. MNGPEPU8ax shows that this timing is recover w/i 30 minutes reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

REC-OSP-6/3 Fail to recover OSP within 6 6 hrs / 3 hrs 6 hrs / 3 hrs 6.OE-01 6.OE-01 Nominal times of 6 hrs and 3 hrs still hours, given failure to recover judged reasonable for EPU.

w/i 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> 4-53 4-53 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power CLTP 113% CLTP) Base HEP EPU HEP Comment RHRCS-MANY Fail to manually operate 100 min. 100 min. 4.1OE-03 4.10E-03 This action is applicable to non-LOCA and equipment outside of control non-ATWS scenarios with HP injection room before core damage initially available, but RPV ED required later for other reasons (e.g., HCTL, HP injection failure). CLTP assumes time available is 100 minutes (diagnosis time of 90 min. and execution time of 10 min.). MNGP EPU MAAP runs MNGPEPU8c and MNGPEPU8d show that for scenarios requiring late RPV ED due to issues such as HCTL or HP injection failure that more than 100 mins. remain before core damage occurs. Thus, the CLTP time inthis action of 100 mins. is unchanged for the EPU.

ASEP Median TRC curve. Dominated by execution error.

RHR-DHR-AY Fail to align RHR for CHR - 25 min. 21.8 min. 1.40E-02 2.19E-02 This action is applicable to ATWS ATWS scenarios with HP injection and successful SLC. Time available to align SPC depends upon time of SLC injection and whether the initiator is an isolation event. CLTP PRA assumes that 25 minutes are available (diagnosis time of 20 mins. and execution time of 5 mins.). This time isjudged conservative. MNGP EPU runs MNGPEPU7b, MNGPEPU7bx, MNGPEUP7c and MNGPEPU7cx show that with delayed SLC injection and no SPC initiation, critical impacts do not occur until about t=45 mins when the pool reaches 200F and HPCI operability become an issue. Although the 25 min. time available estimate from the CLTP is judged still appropriate for the EPU, the EPU risk assessment reduces this time available by 13% to t=21.8 mins (diagnosis time of 16.8 min. and execution time of 5 min.). ASEP Median TRC curve.

4-54 4-54 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment RHR-DHR--Y Fail to align RHR for CHR, 8 hrs. 6.8 hrs 1.60E-05 1.60E-05 Execution Error: Time window same as for when attempted (non-ATWS) CHR-DET--Y; however, this is an execution error contribution, the low error rate is due to multiple applicable error recovery factors (long time frame, other operators, etc.).

The reduction intime available due to the EPU does not change the execution error rate. Diagnosis contribution treated by separate basic event CHR-DET--Y.

SD-NOTRIPY Fail to prevent turbine trip while 5 min. 4.4 min. 2.00E-01 2.27E-01 This action is for bypassing the MSIV level shutting down interlocks and is applicable to ATWS scenarios with the MSIVs open. The time available depends upon a number of factors, such as which HP systems are available and how long operators take to reduce level. The CLTP PRA assumes the available diagnosis time is t=5 min. The CLTP diagnosis time is reduced 13% for the EPU. ASEP Median TRC curve. Base PRA mistakenly selected 0.3 off the ASEP curve instead of the correct base value of 0.20; base HEP revised in this calculation to use the correct base HEP of 0.20.

SHED-DET-Y Fail to identify load shedding 30 min. 30 min. 1.00E-03 1.00E-03 Timing based on battery life and load as cause of system failure shedding impact. Timing and probability not impacted by EPU.

SLC-INI-LY Fail to initiate SLC - long time >1 hr >1 hr. 4.OOE-04 4.00E-04 This action error applies to ATWS available scenarios in which the turbine is online. An indefinite, long time is available to the operator; the PRA assumes > 1 hr.

available. This timing assumption is not changed by the EPU. ASEP Lower Bound TRC curve. In addition, the HEP is dominated by execution error.

4-55 4-55 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 4.1-11 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power CLTP) (113% CLTP) Base HEP EPU HEP Comment SLC-INI-SY Fail to initiate SLC - short time 13.5 min. 11.8 min. 4.40E-03 6.17E-03 Total time available reduced 13%. MNGP available EPU MAAP runs MNGPEPU7a, MNGPEPU7b, and MNGPEPU7c show that that such a time frame for SLC injection is successful for the EPU condition. ASEP Lower Bound TRC curve.

SLC-LVL1-Y Fail to control reactor level (fail 10 min. 8.7 min. 1.OOE-02 1.53E-02 Total time available reduced 13%. EPU SLC), given nominal conditions diagnosis time of 8.2 min. and execution time of 0.5 min. ASEP Lower Bound TRC curve.

SLC-LVL2-Y Fail to control reactor level (fail 13.5 min. 11.8 min. 1.30E-02 1.97E-02 Total time available reduced 13%. EPU SLC), given challenging diagnosis time of 11.3 min. and execution conditions time of 0.5 min. ASEP Lower Bound TRC curve.

VENT-CHR-Y Fail to align containment 8 hrs. 6.8 hrs 3.10E-05 3.68E-05 Timing based on time to SP/T = 200F for venting as means of CHR - transients with no SPC. MNGP EPU MAAP run MNGPEPU9 shows the time is t=6.8 hrs for EPU condition. ASEP Median TRC curve.

X-DEP-15-Y Operator fails to depressurize 15 min. 15 min. 5.20E-03 5.20E-03 This action is used in high pressure ATWS reactor within 15 minutes core damage scenarios. The CLTP PRA assumes 15 min. available (diagnosis time of 12 min. and execution time of 3 mins.).

The time available is based on post-accident progression modeling assumptions and not directly on core power. This time frame is not changed for the EPU. ASEP Lower Bound TRC curve.

4-56 4-56 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications 4.2 LEVEL 1 PRA Section 4.1 summarized possible effects of the EPU by examining each of the PRA elements. This section examines possible EPU effects from the perspective of accident sequence progression. The dominant accident scenario types (classes) that can lead to core damage are examined with respect to the changes in the individual PRA elements discussed in Section 4.1.

Loss of Inventory Makeup Transients Loss of inventory accidents (non-LOCA) are determined by the number of systems, their success criteria, and operator actions for responding to their demands. The following bullets summarize key issues:

" FW, Condensate, HPCI, RCIC and LP ECCS systems - all of these systems have substantial margin in their success criteria relative to the EPU power increase to match the coolant makeup flow required for postulated accidents.

• CRDH - CRDH remains a viable RPV makeup source at high and low pressures in the EPU. CRDH is a success in the CLTP PRA as the sole early injection source for transient and SORV scenarios, and is also successful late in accident scenarios. The CRDH success criteria for the EPU condition are relatively unchanged; the one exception is that early CRHD using two pumps at nominal flow requires the RPV to be depressurized for CRDH to be a success for the EPU. This model change is included in this EPU risk assessment.

• Alternative LP RPV Injection Systems - the CLTP PRA credits RHRSW crosstie, FPS crosstie, and Condensate Service Water (CSW) injection. The RHRSW and FPS alignments have the greater flow rate potential, but all require manual alignments. Their use is sequence specific. No changes are identified ,to the modeling of these systems for the EPU.

• The success criterion used in the CLTP PRA for the number of SRVs required to function to assure RPV emergency depressurization is a single (1) SRV. Based on the MAAP evaluations (e.g., MNGPEPUla),

4-57 4-57 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications the one (1) SRV success criterion remains adequate for the EPU condition.

Operator actions include emergency depressurization and system control and initiation.

The injection initiation/recovery and emergency depressurization timings are slightly impacted by the EPU. As such, changes to the existing risk profile associated with loss of inventory makeup accidents result.

ATWS Following a failure to scram coupled with additional failures, a higher power level and increase in suppression pool temperature would result for the EPU configuration compared with the current Monticello configuration (assuming similar failures).

The necessary relief capacity to prevent exceeding the Service Level C RPV pressure limit of 1500 psig is modeled in the current MNGP CLTP PRA as requiring 6 of 8 SRVs to open. As discussed earlier in Section 4.1.2.5, this PRA success criterion is assessed to be 7 of 8 SRVs required to open for the EPU condition.

The increased power level reduces the time available to perform operator actions. Refer to Table 4.1-11 for changes in ATWS related HEPs, as well as HEPs for other accident types. Given these ATWS HEP changes, changes to the existing risk profile associated with ATWS accidents result.

LOCAs The blowdown loads may be slightly higher because of the higher initial power. The Mark I Containment Loads Program and the Monticello specific containment loads program haveshown that these loads are acceptable for the CLTP. The GE task analyses confirm that the SSCs remain acceptable after EPU.

4-58 4-58 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications The success criteria for the systems to respond to a LOCA are discretized by system trains. Sufficient margin is available in these success criteria to allow adequate core cooling for EPU.

The allowable timings associated with operator actions for RPV emergency depressurization for SLOCAs and MLOCAs (LLOCAs never require emergency depressurization) are slightly impacted for the EPU. As' such, changes to the existing risk profile associated with LOCA accidents result.

SBO Station Blackout represents a unique subset of the loss of inventory accidents identified above. The station blackout scenario response is almost totally dominated by AC and DC power issues. In all other respects, SBO sequences are like the transients discussed above. Extended power uprate will not increase the loads on diesel-generators or batteries. As discussed earlier, the success criteria for mitigating systems is unchanged for the EPU.

The dominant operator action during SBO accidents is offsite AC recovery. The AC recovery failure probability is based on statistical analyses of recovery of offsite power following industry LOOP events and not on HEP calculations. Offsite AC recovery failure probabilities in the MNGP PRA are not impacted by the EPU.

However, a few operator actions are impacted by the reduced available timings of the EPU, and are propagated through the SBO accident sequences (refer to Table 4.1-11).

In addition, an accident sequence assumption in the CLTP related to the length of time that HPCI or RCIC can operate in long term scenarios before the pool heats up to the 200F challenge point for HPCI and RCIC is adjusted for'the EPU. The CLTP assumes that pool heatup to 200F during long-term SBO scenarios with HPCI or RCIC operating 4-59 4-59 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications (with batteries being charged) occurs at t=12 hrs. This time frame is reduced to t=11 hrs for the EPU condition (refer to Appendix E MAAP run MNGPEPU8d). This issue is addressed in the EPU risk assessment by requiring AC recovery for such sequences at t=11 hrs versus t=12 hrs (the risk impact is non-significant).

As such, minor changes to the existing risk profile associated with SBO accidents result.

Loss of Containment Heat Removal Sequences which involve the loss of containment heat removal (Class II accident sequences) are affected slightly in terms of the time to reach containment Primary Containment Pressure Limit (PCPL) or ultimate pressure, however the success criteria for the key systems (RHR, Main Condenser, and containment vent) in the loss of containment heat removal accident sequences are not affected.

Other systems (e.g., DW coolers, RWCU) are considered marginal or inadequate for containment heat removal even for the CLTP PRA. Such systems remain inadequate for the EPU PRA.

The time available to initiate containment heat removal measures is measured in many hours in the PRA for non-ATWS scenarios. The reduction in this very long time frame due to the EPU has no significant impact on the HEPs for containment heat removal initiation for non-ATWS scenarios. The time available for ATWS scenarios is assumed in the CLTP PRA to be less than an hour; timing reductions due to the EPU result in a measurable change in the HEP for containment heat removal alignment for ATWS scenarios (refer to Table 4.1-11).

The increased power level decreases the time to reach the EOP HCTL curve and requiring RPV emergency depressurization. These HEP changes will have a minor impact on the Class II accident sequences.

4-60 4-60 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Minor changes to the risk profile associated with Class II (loss of decay heat removal) accidents result.

4.3 INTERNAL FIRES INDUCED RISK The Monticello plant risk due to internal fires was evaluated in 1995 as part of the MNGP Individual Plant Examination of External Events ,(IPEEE) Submittal. [10] EPRI FIVE Methodology and Fire PRA Implementation Guide screening approaches and data were used to perform the MNGP IPEEE fire PRA study. [5,6,7]

Consistent with the FIVE Methodology and the requests of the NRC IPEEE Program, the MNGP IPEEE fire PRA is an analysis that identifies the most risk significant fire areas in the plant using a screening process and by, calculating conservative core damage frequencies for fire scenarios. As such, the accident sequence frequencies calculated for the MNGP fire PRA are not a best estimate calculation of plant fire risk and are not acceptable for integration with the best estimate MNGP internal events PRA results for comparison with Regulatory Guide 1.174 acceptance guidelines. The screening attributes of the fire PRA are summarized below.

4.3.1 Attributes of Fire PRA Fire PRAs are useful tools to identify design or procedural items that could be clear areas of focus for improving the safety of the plant. Fire PRAs use a structure and quantification technique similar to that used in the internal events PRA.

Historically, since less attention has been paid to fire PRAs, conservative modeling is common in a number of areas of the fire analysis to provide a "bounding" methodology for fires. This concept is contrary to the base internal events PRA which has had more 4-61 C495070003-7740-03/27/08 4-61

Monticello Extended Power Uprate Risk Implications analytical development and is judged to be closer to a realistic assessment (i.e., not conservative) of the plant.

There are a number of fire PRA topics involving technical inputs, data, and modeling that prevent the effective comparison of the calculated core damage frequency figure of merit between the internal events PRA and the fire PRA. These areas are identified as follows:

Initiating Events: The frequency of fires and their severity are generally conservatively overestimated. A revised NRC fire events database indicates the trend toward both lower frequency and less severe fires. This trend reflects the improved housekeeping, reduction in transient fire hazards, and other improved fire protection steps at nuclear utilities. The database used in the Monticello fire assessment used significantly older data that is not judged applicable. In addition, it reflects conservative judgments regarding fire severity.

System Response: Fire protection measures such a sprinklers, C02, fire brigades may be given minimal (conservative) credit in their ability to limit the spread of a fire. Therefore, the severity of the fire and its impact on requirements is exacerbated.

In addition, cable routings are typically characterized conservatively because of the lack of data regarding the routing of cables or the lack of the analytic modeling to represent the different routings. This leads to limited credit for balance of plant systems that are extremely important in CDF mitigation.

Sequences: Sequences may subsume a number of fire scenarios to reduce the analytic burden. The subsuming of initiators and sequences is done to envelope those sequences included. This causes additional conservatism.

Fire Modeling: Fire damage and fire propagation are conservatively characterized. Fire modeling presents bounding approaches regarding the fire immediate effects (e.g.,

4-62 4-62 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications all cables in a tray are always failed for a cable tray fire) and fire propagation.

HRA: There is little industry experience with crew actions under conditions of the types' of fires modeled in fire PRAs. This has led to conservative characterization of crew actions in fire PRAs. 1 Because the CDF is strongly correlated with crew actions, this conservatism has a profound influence on the calculated fire PRA results.

Level of Detail: The fire PRAs may have a reduced level of detail in the mitigation of the initiating event and consequential system damage.

Quality of Model: The peer review process for fire PRAs is less well developed than for internal events PRAs. For example, no industry standard, such as NEI 00-02, exists for the structured peer review of a fire PRA.

This may lead to less assurance of the realism of the model.

The fire PRA is subject to more modeling uncertainty than the internal events PRA evaluations. While the fire PRA is generally self-consistent within its calculational framework, the fire PRA calculated quantitative risk metric does not compare well with internal events PRAs because of the number of conservatisms that have been included in the fire PRA process. Therefore, the use of the fire PRA figure of merit as a reflection of CDF may be inappropriate. Any use of fire PRA results and insights should properly reflect consideration of the fact that the "state of the technology" in fire PRAs is less evolved than the internal events PRA.

Relative modeling uncertainty is expected to narrow substantially in the future as more experience is gained in the development and imp'lementation of methods and techniques for modeling fire accident progression and the underlying data.

Fire PRA risk is dominated by fire-induced equipment failures. As such, fire PRA results are less impacted by changes in operator actions timings than the internal events PRA 4-63 4-63 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications results. This can be seen in the fire risk results performed for the previous MNGP re-rate, as documented in Reference [8]. That study showed the percentage CDF increase for fire risk was estimated at approximately one-third the percentage increase for the internal events CDF increase. The re-rate analysis of Reference [8] was performed using the conservative fire screening quantifications from the MGNP IPEEE.

Like most sites in the U.S., MNGP does not currently maintain a fire PRA. Rather than re-perform the analyses from Reference [8] for this uprate, the general conclusions are used here to qualitatively estimate a percentage increase in the fire risk profile for MNGP.

It is estimated here that the MNGP fire PRA CDF would increase by approximately 2 to 3 percent due to the EPU (i.e., -Y of the internal events 7.8% increase) based on the general conclusions of Reference [8].

This fire impact assessment did not involve re-performing the MNGP IPEEE internal fires analyses. Similarly, plant walkdowns for internal fire risk issues were not re-performed in support of this assessment.

The impact of the EPU on the different aspects of fire risk modeling are assessed here with the approach above, and based on knowledge of fire PRA and the modifications for the EPU (e.g., no significant changes to fire protection systems, combustible loadings, etc.). Based on this assessment, it is concluded that no unique or significant impacts on fire risk result from the EPU.

4.4 SEISMIC RISK The Monticello seismic risk analysis was performed as part of the Individual Plant Examination of External Events (IPEEE). [10] Monticello performed a seismic margins assessment (SMA) following the guidance of NUREG-1407 and EPRI NP-6041. The 4-64 4-64 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications SMA is a deterministic evaluation process that does not calculate risk on a probabilistic basis. No core damage frequency sequences were quantified as part of the seismic risk evaluation.

Based on a review of the Monticello IPEEE and the key general conclusions identified earlier in this assessment, the conclusions of the SMA are judged to be unaffected by the EPU. The EPU has little or no impact on the seismic qualifications of the systems, structures and components (SSCs). Specifically, the power uprate results in additional thermal energy stored in the RPV, but the additional blowdown loads on the RPV and containment given a coincident seismic event, are judged not to alter the results of the SMA.

The decrease in time available for operator actions, and the associated increases in calculated HEPs, is judged to have a non-significant impact on seismic-induced risk.

Industry BWR seismic PRAs have typically shown (e.g., Peach Bottom NUREG-1150 study [18]; Limerick Generating Station Severe Accident Risk Assessment [19];

NUREG/CR-4448 [20]) that seismic risk is overwhelmingly dominated by seismic induced equipment and structural failures.

Based on the above discussion it is judged that the percentage increase in the MNGP seismic risk due to the EPU is much less than that calculated for internal events.

This seismic impact assessment did not involve re-performing the MNGP IPEEE SMA.

Similarly, SMA plant walkdowns were not re-performed in support of this assessment.

EPU equipment replacements are judged to be installed using anchorages that are similar to the existing equipment anchorages. Based on this assessment, it is concluded that no unique or significant impacts on seismic risk result from the EPU.

4-65 4-65 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications 4.5 OTHER EXTERNAL EVENTS RISK In addition to internal fires and seismic events, the MNGP IPEEE Submittal analyzed a variety of other external hazards:

• High Winds/Tornadoes

• External Floods

• Transportation and Nearby Facility Accidents

• Other External Hazards The MNGP IPEEE analysis of high winds, tornadoes, external floods, transportation accidents, nearby facility accidents, and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards.

Based upon this review, it was concluded that MNGP meets the applicable NRC Standard Review Plan requirements and therefore has an acceptably low risk with respect to these hazards.

Note that internal flooding scenarios are analyzed as internal events and already are included in the MGNP internal events at-power PRA used in this EPU risk assessment.

4.6 SHUTDOWN RISK The impact of the Extended Power Uprate (EPU) on shutdown risk is similar to the impact on the at-power Level 1 PRA. Based on the insights of the at-power PRA impact assessment, the areas of review appropriate to shutdown risk are the following:

• Initiating Events

• Success Criteria

• Human Reliability Analysis 4-66 4-66 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications I

The following qualitative discussion applies to the shutdown conditions of Hot Shutdown (Mode 3), Cold Shutdown (Mode 4), and Refueling (Mode 5). The EPU risk impact during the transitional periods such as at-power (Mode 1) to Hot Shutdown and Startup (Mode 2) to at-power are judged to be subsumed by theiat-power Level 1 PRA. This is consistent with the U.S. PRA industry, and with NRC Regulatory Guide 1.174 which states that not all aspects of risk need to be addressed for every application. While higher conditional risk states may be postulated during these transition periods, the short time frames involved produce an insignificant impact on the long-term annualized plant risk profile.

4.6.1 Shutdown Initiating Events Shutdown initiating events include the following major categories:

Loss of RCS Inventory

- Inadvertent Draindown

- LOCAs

• Loss of Decay Heat Removal (includes LOOP)

No new initiating events or increased potential for initiating events during shutdown (e.g., loss of DHR train) can be postulated due to the 113% EPU.

4.6.2 Shutdown Success Criteria The impact of the EPU on the success criteria during shutdown is similar to the Level 1 PRA. The increased power level decreases the time to boildown. However, because the reactor is already shutdown, the boildown times are much longer compared to the at-power PRA. Further discussion regarding boil down times is provided in Section 4.6.3 in the discussion of the impacts on shutdown operator action response times.

4-67 4-67 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications The increased decay heat loads associated with the EPU impacts the time when low capacity decay heat removal (DHR) systems can be considered successful alternate DHR systems. The EPU condition delays the time after shutdown when low capacity DHR systems may be used as an alternative to Shutdown Cooling (SDC). However, shutdown risk is dominated during the early time frame soon after shutdown when the decay heat level is high and, in this time frame, low capacity DHR alternatives are already not viable DHR systems.

Other success criteria are marginally impacted by the EPU. The EPU has a minor impact on shutdown RPV inventory makeup during loss of decay heat removal scenarios in shutdown because of the low decay heat level. The heat load to the suppression pool during loss of decay heat removal scenarios in shutdown (i.e., during shutdown phases with the RPV intact) is also lower because of the low decay heat level such that the margins for suppression pool cooling capacity are adequate for the EPU condition.

The EPU impact on the success criteria for blowdown loads, RPV overpressure margin, and SRV actuation is estimated to be negligible because of the low RPV pressure and low decay heat level during shutdown.

4.6.3 Shutdown HRA Impact Similar to the at-power Level 1 PRA, the decreased boildown time due to the EPU decreases the time available for operator actions. The significant, time critical operator actions impacted in the at-power Level 1 PRA are related to RPV depressurization, SLC injection, and SLC level control. These operator actions do not directly apply to shutdown conditions because the RPV is at low pressure and the reactor is subcritical.

The risk significant operator actions during shutdown conditions include recovering a failed DHR system or initiating alternate DHR systems. However, the longer boildown 4-68 4-68 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications times during shutdown results in the EPU having a minor impact on the shutdown HEPs associated with recovering or initiating DHR systems.

The calculations in Appendix B of this assessment show that the times available to perform loss of decay heat removal response actions during shutdown is many hours.

The reductions in these times due to the EPU are shown in Appendix B to be in the range of 10 to 15% (depending on time after shutdown and water level configuration).

Such small changes in already lengthy operator action response times result in negligible changes in human error probabilities.

4.6.4 Shutdown Risk Summary Based on a review of the potential impacts on initiating events, success criteria, and HRA, the 113% EPU is assessed to have a non-significant impact (delta CDF of roughly 2% per calculations in Appendix B) on shutdown risk.

This assessment is consistent with GE's generic conclusions on this issue [15]:

"The shutdown risks for BWR plants are generally low and the impact of CPPU on the CDF and LERF during shutdown is expected to be negligible."

4.7 RADIONUCLIDE RELEASE (LEVEL 2 PRA)

I The Level 2 PRA calculates the containment response under postulated severe accident conditions and provides an assessment of the containment adequacy. In the process of modeling severe accidents (i.e., the MAAP code), the complex plant structure has been reduced to a simplified mathematical model which uses basic thermal hydraulic principles and experimentally derived correlations to calculate the radionuclide release timing and magnitude. [9] Changes in plant response due to EPU 4-69 4-69 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications represent relatively small changes to the overall challenge to containment under severe accident conditions.

The following aspects of the Level 2 analysis are briefly discussed:

• Level 1 input

• Accident Progression

• Human Reliability Analysis

• Success Criteria

• Containment Capability

• Radionuclide Release Magnitude and Timing Level 1 Input The front-end evaluation (Level 1) involves the assessment of those scenarios that could lead to core damage. The subsequent treatment of mitigative actions and the inter-relationship with the containment after core damage is then treated in the Containment Event Tree (Level 2).

In the Monticello Level 1 PRA, accident sequences are postulated that lead to core damage and potentially challenge containment. The Monticello Level 1 PRA has identified discrete accident sequences that contribute to the core damage frequency and represent the spectrum of possible challenges to containment.

The Level 1 core damage sequences are also directly propagated through the Level 2 PRA containment event trees. Changes to the Level 1 PRA modeling directly impact the Level 2 PRA results. However, the percentage increase in total CDF due to the EPU is not a direct translation to the percentage increase in total LERF. For example, a change to loss of decay heat removal or long-term SBO core damage accidents would not impact the LERF results, as such accidents do not result in Level 2 LERF sequences.

4-70 4-70 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Therefore, the Level 2 at-power internal events PRA model is also requantified as part of this EPU risk assessment.

Accident Progression As discussed earlier in Section 4.1.3, the EPU does not change the plant configuration and operation in a manner that produces new accident sequences or changes accident sequence progression phenomenon. This is particularly! true in the case of the Level 2 post-core damage accident progression phenomena. The minor changes in decay heat levels and system configurations of the EPU will not impact significantly quantification and modeling of post-core damage accident progression.'

Therefore, no changes are made as part of this assessment to the Level 2 models (either in structure or basic event phenomenon probabilities) with respect to accident progression modeling.

Human Reliability Analysis Risk significant Level 2 operator actions are, in general, conditional repair and recovery actions given that the operator failed in the Level 1 time frame (e.g., failure to depressurize the RPV in Level 2 PRA given failure to depressurize in Level 1 PRA). Any changes in the conditional HEPs due to the power uprate (based on reduced time available) are judged to be small and would have a minor impact on the Level 2 quantification results.

Success Criteria No changes in success criteria have been identified with regard to the Level 2 containment evaluation. The slight changes in accident progression timing and decay heat load has a minor or negligible impact on Level 2 PRA safety functions, such as containment isolation, ex-vessel debris coolability and challenges to the ultimate 4-71 4-71 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications containment strength. (Refer to Section 4.1.2.8 of this report). Therefore, no changes to Level 2 modeling with respect to success criteria are made as part of this analysis.

Containment Capability As discussed in Section 4.1.7 earlier in this report, no issues have been identified with respect to the EPU that have any impact on the capacity of the MNGP containment as analyzed in the PRA.

The MNGP containment capacity with respect to severe accidents is analyzed in the PRA using plant specific structural analyses as well as information from industry studies and experiments. The MNGP containment capacity is assessed in the Level 2 with respect to following challenge categories [9]:

1) Pressure Induced Containment Challenge: Containment pressures may increase from normal operating pressure along a saturation curve to very high pressures (i.e., beyond 100 psi), during accidents involving:

- Insufficient long term decay heat removal; and

- Inadequate reactivity control and consequential inadequate containment heat removal.

2) Temperature Induced Containment Challenge: Containment temperatures can rise without substantial pressure increases if containment pressure control measures (e.g., venting) are available. In such cases, containment temperature may increase to above 1000OF with the containment at less than design pressure during accidents involving core melt progression.

3) Combined Pressure and Temperature Induced Containment Challenge: Containment pressures and temperatures can both rise during a severe accident due to molten debris effects following RPV failure and subsequent core concrete interaction. For instance:

- Containment temperatures can rise from approximately 300OF at core melt initiation to above 1000OF in time frames on the order of 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />.

4-72 4-72 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications

- Additionally, containment pressure can rise due to non-condensible gas generation and RPV bl'owdown in the range of 40 psig to 100 psig over this same time frame.

4) Containment Dynamic Loading: Postulated accident sequences cover a broad spectrum of events, including failure of the containment under degraded conditions for which the following may be present:

- High suppression pool temperature with substantial continuous blowdown occurring (i.e., equivalent to greater than 6% power),

or

- High suppression pool water levels coupled with equivalent LOCA loads and the consequential hydrodynamic loads, or

- Other energetic events, such as steam explosion.

5) Containment Isolation: Containment isolation failure during a core damage event is modeled as leading to large early releases in the MNGP Level 2.

The minor changes to the plant from the EPU have no impact on the definition of these containment loading profiles or the likelihood of containment isolation failure. The slightly higher decay heat levels associated with the EPU will result in minor reductions in times to reach loading challenges; however, the time frames are long (many hours) and the accident timing reductions of 10-15% due to the EPU have an insignificant impact on the Level 2 results.

For example, MAAP cases MNGPEPU9 and 9x (refer to Appendix E of this report) performed in support of this analysis shows that the time to reach the primary containment ultimate failure pressure (as assessed in the MNGP PRA) for a loss of all decay heat removal sequence is over 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> both for the CLTP condition and the EPU condition. Changes in such long time frames due to the EPU have no quantifiable impact on the Level 2 results.

4-73 4-73 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Release Magnitude and Timinq The following issues can substantially increase or decrease the ability to retain fission products or mitigate their release:

• Radionuclide removal processes

• Containment failure modes

• Phenomenology

• Accident sequence timings Each of these issues is considered and analyzed in the MNGP Level 2 PRA. [9]

The "Early" timing threshold is defined in the MNGP PRA as a release from secondary containment beginning at 0 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after declaration of a General Emergency. The 0-6 hour time frame is based upon experience data concerning non-nuclear offsite accident response and is conservatively (i.e., 0-4 hours is a justifiable "Early" range) assumed to include cases in which minimal offsite protection measures have been performed.

The "Large" magnitude threshold is defined in the MNGP Level 2 PRA as greater than 10% release of Csl inventory in the core. This is based on past industry studies that show once the average release fraction of Csl falls below approximately 0.1, the mean number of prompt fatalities is very small, or zero, except for a few outliers that correspond to pessimistic assumptions.

This release categorization and bases is consistent with U.S. BWR PRA industry techniques. [4, 22]

4-74 4-74 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications No modeling or success criteria changes are required in, the post core damage Level 2 sequences due to the EPU. The Level 2 functions are either conservatively based or are driven by accident phenomena. Refer to Table 4.1-10.

The MNGP plant changes for the EPU have no impact on the usage and appropriateness of this release categorization scheme., As discussed earlier, fission product inventory in the reactor core is higher as a result of the increase in power due to the EPU. The increase in fission product inventory results in an increase in the total radioactivity available for release given a severe accident. However, this does not impact the definition or quantification of the LERF risk measure used in Regulatory Guide 1.174, and as the basis for this risk assessment. The MNGP PRA release categories are defined based on the percentage (as a function of EOC inventories) of CsI released to the environment, which is consistent with most, if not all, industry PRAs.

The following release categorizations were considered for possible changes to LERF due to the EPU:

• Medium-Late

• Medium-Early

• Large-Late It can be postulated that the EPU could result in impacts on both the magnitude and timing of Medium-Late Level 2 PRA release sequences, such that they become LERF sequences. Review of theses sequences in the MNGP Level 2 PRA shows that all Medium-Late release sequences are long term release sequences with no potential to drop into the Early release category due to the EPU. The Medium-Late sequences in the MNGP Level 2 PRA begin to release in time frames greater than t=15 hrs, and in many cases greater than t=30 hrs. The 113% EPU does not reduce such sequence timings in a manner that would make them Early releases. As such, the MNGP EPU 4-75 4-75 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications does not cause Medium-Late sequences to become LERF. No MAAP runs are necessary for this assessment.

It can be postulated that the EPU could increase the magnitude of the release for Medium-Early Level 2 PRA release sequences such that they become LERF sequences. MAAP runs MNGPEPU10c, MNGPEPU10cx, MNGPEPU1Od and MNGPEPU10dx (refer to Appendix E) were performed to investigate if such a change would occur due to the EPU. These runs are for two typical Medium-Early scenarios. The results show that the Csl release percentage increases one to two percentage points for the EPU, but the magnitudes are still in the Medium category. As such, the MNGP EPU does not cause Medium-Early sequences to become LERF.

Similarly, it can be postulated that the EPU could decrease the timing of the release for Large-Late Level 2 PRA release sequences such that they become LERF sequences.

MAAP runs MNGPEPU10a, MNGPEPU1Oax, MNGPEPU10b and MNGPEPU10bx (refer to Appendix E) were performed to investigate if such a change would occur due to the EPU. Most Large-Late sequences release tens of hours after accident initiation, with no potential to become LERF sequences due to the EPU. However, there are a few Large-Late sequences in the MNGP Level 2 that begin releasing close to the Early time frame threshold. These MAAP runs are for the two fastest progressing Large-Late scenarios in the MNGP Level 2 PRA. The results show that the CsI release timings are reduced but not sufficiently to warrant their classification as LERF sequences. As such, the MNGP EPU does not cause Large-Late sequences to become LERF.

Level 2 Impact Summary Based on the above discussion, the impact of the EPU on the MNGP Level 2 PRA results, independent of the Level 1 analysis, is judged to be minor. The only change in the Level 2 is due to changes in the Level 1 cutset frequencies (due to the HEP changes discussed in Section 4.1.6) used as input to the Level 2 quantification.

4-76 4-76 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Section 5 CONCLUSIONS The Extended Power Uprate (EPU) for Monticello has been reviewed to determine the net impact on the risk profile associated with Monticello operation at an increase in power level to 2004 MWt. This examination involved the identification and review of plant and procedural changes, plus changes to the risk spectrum due to changes in the plant response.

The change in plant response, procedures, hardware, and setpoints associated with the increase in power have been investigated using the 2005 Monticello PRA average maintenance model (fault tree Risk-T&M.cat); the 1995 MNGP IPEEE study for seismic, internal fires and other external events; and a qualitative evaluation of shutdown events.

This section summarizes the risk impacts of the EPU implementation on the following areas:

• Level 1 Internal Events PRA

• Fire Induced Risk

• Seismic Induced Risk

• Internal Flooding Risk

• Shutdown Risk

• Level 2 PRA The review has indicated that small perturbations on individual inputs could be identified.

5-1 5-1 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Guidelines from the NRC (Regulatory Guide 1.174) are followed to assess the change in risk as characterized by core damage frequency (CDF) and Large Early Release Frequency (LERF) 5.1 LEVEL 1 PRA Qualitative engineering insights regarding the adequacy of procedures and systems to prevent postulated core damage scenarios are among the principal results of the Level 1 portion of the PRA. These insights deal with the adequacy of, or improvements to, Monticello procedures or systems (frontline or support) to accomplish their safety mission of preventing core damage. The severe accident scenarios that have been identified in the Level 1 PRA have been reviewed and the relatively small perturbations due to power uprate do not affect the scenario development or the qualitative insights.

Table 5.1-1 provides a summary of the PRA model changes incorporated as a result of the power uprate evaluation. Table 5.1-1 provides the following information:

o Basic event identification and description o Basic event probability in the current model

• Revised probability for EPU Two modeling structure changes to the MNGP PRA were necessary to reflect the EPU.

The first is the change to the SRV fault tree logic for RPV overpressure protection during an ATWS. The second modeling structure change was made to require the RPV to be at a depressurized state during transient and SORV scenarios to allow success of nominal flow CRD as the sole early injection source.

The results of the Level 1 PRA quantification for the MNGP EPU condition are summarized in Table 5.1-2 along side the CLTP MNGP PRA results as a function of initiating event type. The EPU is estimated to increase the Monticello internal events PRA CDF from the base value of 7.32E-6/yr to 7.89E-6/yr, an increase of 5.67E-7 5-2 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications (7.8%). As can be seen from Figure 5.1-2, the distribution of the EPU results remains virtually unchanged with respect to the base MNGP PRA, 5.2 FIRE INDUCED RISK Based on the results of the internal events PRA evaluation for a 113% power uprate and a review of the MNGP IPEEE, it is concluded that the effects on any increase in risk contribution associated with fire induced sequences is minor, estimated at a 2-3%

increase in fire CDF (refer to Section 4.3 of this report).

5.3 SEISMIC RISK Based on a review of the Monticello IPEEE, the conclusions of the MNGP seismic margins assessment (SMA) are judged to be unaffected by the EPU. The power uprate has little or no impact on the seismic qualifications of the systems, structures and components (SSCs). Specifically, the power uprate results in additional thermal energy stored in the RPV, but the additional blowdown loads on the RPV and containment given a coincident seismic event, are judged not to alter the results of the SMA. Refer to Section 4.4 of this report for further discussion.

5.4 OTHER EXTERNAL HAZARDS Based on review of the Monticello IPEEE, the power uprate has no significant impact on the plant risk profile associated with tornadoes, external floods, transportation accidents, and other external hazards. Refer to Section 4.5 of this report for further discussion.

5-3 5-3 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 5.1-1 MNGP PRA MODEL CHANGES TO RELECT EPU MNGP CLTP Change Parameter ID Model Element Description PRA Value°) EPU Value Human Error CRD-LSBYPY Fail to restore CRDH after LOSP and 8.OOE-02 1.23E-01 (21 Probability ECCS load shed (HEP) CRD-PUMP-Y Fail to start second CRDH pump from 9.OOE-03 1.40E-02(2)

Changes to control room address CRD-VALV-Y Fail to maximize CRDH flow - valves 4.OOE-02 5.27E-02(2) reduced timings in RB DEP-02MN-Y Fail RPV depressurization within 2 2.50E-01 5.10E-01(2) minutes DEP-12MN-Y Fail RPV depressurization within 12 5.20E-03 9.84E-03(2) minutes DEP-50MN-Y Fail RPV depressurization within 50 1.80E-04 1.90E-04(2) minutes FW-CNTRL-Y Fail to control FW as high pressure 4.60E-03 5.46E-03(2) injection source following transient FW-REFLG-Y Fail to identify reference leg leak 4.OOE-02 6.94E-0212) 2 LEVEL-05-Y Fail to detect need for injection within 5.OOE-02 1.0OE+00 1 5 minutes of compelling signal LEVEL-25-Y Fail to detect need for injection within 6.OOE-04 1.72E-03(2) 25 minutes of compelling signal RHR-DHR-AY Fail to align RHR for CHR - ATWS 1.40E-02 2.19E-02(2)

SD-NOTRIPY Fail to prevent turbine trip while 2.OOE-01 2.27E-01 (2) shutting down SLC-INI-SY Fail to initiate SLC - short time 4.40E-03 6.17E-03(2) available SLC-LVL1-Y Fail to control reactor level (fail SLC), 1.OOE-02 1.53E-0212) given nominal conditions

.SLC-LVL2-Y Fail to control reactor level (fail SLC), 1.30E-02 1.97E-02(2) given challenging conditions 2

VENT-CHR-Y Fail to align containment venting as 3. 1OE-05 3.68E-05 ()

means of CHR SORV XVRONESRVC SRV fails to reclose as pressure 2.OOE-03 2.26E-03""

Probability drops (Transient)

XVR-ATWS-C SRV fails to reclose as pressure 2.OOE-02 2.26E-027) drops (ATWS) 5-4 5-4 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 5.1-1 MNGP PRA MODEL CHANGES TO RELECT EPU

__MNGP CLTP Change Parameter ID Model Element Description PRA Value{1 ) EPU Value AC Recovery REC-EDG-12/11 Fail to recover EDG within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, 9.3E-01 1.0E+00(2)

Failure given failure to recover w/i 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> Probabilities REC-EDG-16/12 Fail to recover EDG within 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, 9.OE-01 8.5E-0112) given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-EDG-22/12 Fail to recover EDG within 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />, 7.3E-01 6.5E-01(2) given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-EDG-3/50 Fail to recover EDG within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 6.9E-01 6.6E-0112) given failure to recover w/i 50 minutes REC-EDG-50/30 Fail to recover EDG within 50 9.1E-01 9.4E-01(2 )

minutes, given failure to recover w/i 30 minutes REC-OSP-12/11 Fail to recover OSP within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, 9.2E-01 1.0E+00(21 given failure to recover w/i 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> REC-OSP-16/12 Fail to recover OSP within 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, 8.OE-01 7.3E-01(2) given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-OSP-22/12 Fail to recover OSP within 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />, 5.0E-01 4.5E-01(2) given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-OSP-3/50 Fail to recover OSP within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 4.3E-01 4.1 E-01(2) given failure to recover w/i 50 minutes REC-OSP-50/30 Fail to recover OSP within 50 8.5E-01 9.0E-01(2 )

minutes, given failure to recover w/i 30 minutes CRDH Nominal Fault Tree Gate <Fault tree gate DEP-50 added as an n/a n/a Flow for Early J01 8 input to CRDH Early "OR" gate .J01 8>

Injection Requires RPV Low Pressure RPV Fault Tree Gate <Fault tree gate X028 revised to n/a n/a Overpressure X028 model 2 or more random failures of Protection for SRVs to open during an ATWS:'

ATWS XVR8SRVCCN38 3 SRVs Fail to Open (Common 2.03E-06 1.16E-05(4)

Cause Failure) 5-5 5-5 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes to Table 5.1-1:

(1) The following minor basic event changes were made to the MNGP 2005 PRA model of record to prepare its use as the CLTP reference model for this analysis:

" CRIT-DET-Y value revised from 3.00E-05 to 1.18E-04 (base PRA mistakenly used 40 min. diagnosis time as basis for human error probability instead of correct 30 min.). The 1.18E-04 base CLTP value is not changed by the EPU.

" DEP-02MN-Y value revised from 1.OOE-01 to 2.50E-01 (base PRA mistakenly used 3 min. diagnosis time as basis for human error probability instead of correct 2 min.).

" SD-NOTRIPY value revised from 3.OOE-01 to 2.00E-01 (base PRA mistakenly selected 0.3 off time reliability curve instead of correct 0.2 value).

" REC-EDG-22/12 value revised from 0.63 to 0.73 (base PRA mistakenly calculated the conditional recovery probability of 0.63 instead of the correct value of 0.73).

" MPRE-EXIST-LKG, "Pre-Existing Primary Containment Leakage (20La)" added to the containment isolation fault tree at gate BREACH. This event represents the likelihood of a pre-existing containment leak at t=0.

This event was added to support the containment overpressure sensitivity.

These minor changes do not result in a significant change in the quantified risk result of the MNGP base PRA.

(2) Refer to Table 4.1-11.

(3) Refer to Section 4.1.2.6.

(4) Basic event XVR8SRVCCN38, "3 SRVs fail to Open (Common Cause Failure)", revised to a probability of 1.16E-05 to reflect that EPU requires this event to be 2 SRVs must fail to open to fail RPV initial overpressure protection during an ATWS (refer to Section 4.1.2.5). This probability is calculated using the random failure rate used in the MNGP PRA for an SRV failing to open (1.16E-4/demand) and the BETA common cause failure model with a 0.1 P3factor.

5-6 5-6 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table 5.1-2 MNGP CLTP CDF VS EPU CDF AS A FUNCTION OF INITIATING EVENT TYPE Percentage of CDF I

Initiating Event Type MNGP CLTP EPU Internal Floods 89.8% 87.1%

Turbine Trip 3.2% 4.0%

Manual Shutdown 2.3% 2.8%

LOCAs Inside Containment 2.1% 2.7%

Loss of Instrument Air 1.2% 1.3%

Other Transients 1.1% 1.9%

LOOP 0.3% 0.3%

Loss of AC or DC Bus 0.1% 0.1%

TOTAL CDF: 7.32E-06 , 7.89E-06 5-7 5-7 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications 5.5 SHUTDOWN RISK The impact of the Extended Power Uprate (EPU) on shutdown risk is similar to the impact on the at-power Level 1 PRA. Shutdown risk is affected by the increase in decay heat power. However, the lower power operating conditions during shutdown (e.g., lower decay heat level, lower RPV pressure) allow for additional margin for mitigation systems and operator actions. Based on a review of the potential impacts on initiating events, success criteria, and HRA, the EPU implementation is judged to have a minor impact (delta CDF -2%) on shutdown risk. Refer to Section 4.6 and Appendix B of this report for further discussion.

5.6 LEVEL 2 PRA The Level 2 PRA calculates the containment response under postulated severe accident conditions and provides an assessment of the containment adequacy. The EPU change in power represents a relatively small change to the overall challenge to containment under severe accident conditions.

The EPU is estimated to increase the Monticello at-power internal events LERF from the base value of 3.64E-7/yr to 3.94E-7/yr, an increase of 3.OOE-8/yr (8.2%).

5.7 QUANTITATIVE BOUNDS ON RISK CHANGE 5.7.1 Sensitivity Studies As discussed in the previous sections, the best estimate change in the MNGP risk profile due to the EPU is a 7.8% increase in CDF and an 8.2% increase in LERF. One of the methods to provide valuable input into the decision-making process is to perform sensitivity calculations for situations with different assumed conditions to bound the results.

5-8 5-8 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications These sensitivity studies investigate the impact on the at-power internal events CDF and LERF. As the change in CDF and LERF is minor, only conservative sensitivity cases (i.e., those that will increase the calculated risk increases) are analyzed here.

Nine (9) quantitative sensitivity cases are performed and discussed below.

Sensitivity #1 This sensitivity increases the Turbine Trip transient initiator frequency to bound the various changes to the BOP side of the plant (e.g., main turbine modifications). The revision to the Turbine Trip frequency using an approach that assumes an additional turbine trip is experienced in the first year following start-up in the EPU condition and an additional 0.5 event in the second year. The change in the long-term average of the Turbine Trip (IETURB-TRIP) frequency is calculated as follows for this sensitivity case:

0 Base long-term Turbine Trip frequency is 9.90E-1/yr

• 10 years is used as the "long-term"' data period End of 10 years does not reach the end-of-life portion of the bathtub curve Revised Turbine Trip frequency for this sensitivity case is calculated as:

(10 x 0.99) + 1.0 + 0.5 = 1.14/yr 10 All other parameters are maintained the same as the i EPU base case. The model changes made for this sensitivity case are summarized in Table 5.7-1.

5-9 5-9 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Sensitivity #2 This sensitivity case conservatively assumes that *the potential impact on transient initiator frequencies is manifested in the MSIV Closure initiator frequency and not the Turbine Trip frequency. The MNGP base MSIV Closure initiator frequency (IEMSIV) of 3.80E-2 is revised in this sensitivity case in the same manner as that discussed in Sensitivity Case #1:

(10 x 3.80E-2) + 1 + 0.5 = 1.88E-1/yr 10 All other parameters are maintained the same as the EPU base case. The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #3 The EPU base quantification does not modify the DBA LOCA frequency.

Acknowledging that the increased flow rates of the EPU can result in increased piping erosion/corrosion rates, this sensitivity case conservatively doubles the Large LOCA initiator (IELLOCA) frequency. All other parameters are maintained the same as the EPU base case. The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #4 This sensitivity case combines the changes of Sensitivity Case #1 with the changes of Sensitivity Case #3. All other parameters are maintained the same as the EPU base case. The model changes made for this sensitivity case are summarized in Table 5.7-1.

5-10 5-10 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Sensitivity #5 This sensitivity case combines the changes of Sensitivity Case #2 with the changes of Sensitivity Case #3. All other parameters are maintained the same as the EPU base case. The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #6 This sensitivity case conservatively assumes aligning a second CRDH pump with no enhanced valve positioning is not successful as an early injection source. This sensitivity is made by removing the fault tree gate J018, "1 OF 2 CRDH PUMPS NOT AVAILABLE (NOMINAL FLOW OPTION)", as an input to gate J017, "CRDH FLOW NOT SUFFICIENT FOR EARLY INJECTION (two pumps or enhanced flow path)".

All other parameters are the same as the EPU base case. The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #7 This sensitivity case combines the changes of Sensitivity Case #4 with the changes of Sensitivity Case #6. All other parameters are maintained the same as the EPU base case. The model changes made for this sensitivity case are summarized in Table 5.7-1.

Sensitivity #8 This sensitivity case investigates the impact of EPU containment overpressure credit on low pressure ECCS NPSH determination during DBA accidents. This sensitivity study is discussed in detail in Appendix F of this risk assessmeht.

5-11 5-11 C495070003-7740-03/27/08

Monticello ExtendedPower Uprate Risk Implications The results of the analysis in Appendix F are summarized in Table 5.7-1.

Sensitivity #9 This sensitivity case combines the changes of Sensitivity Case #7 with the changes of Sensitivity Case #8. All other parameters are maintained the same as the EPU base case. The model changes made for this sensitivity case are summarized in Table 5.7-1.

5.7.1.2 Sensitivity Results The results of the nine (9) sensitivity cases performed in support of this risk assessment are summarized in Table 5.7-1.

5.7.2 Results Summary The key result of the PRA evaluation is the following:

Minor risk increases were calculated for both CDF and LERF. The risk increase is primarily associated with reduced times available for certain operator actions.

The best estimate of the risk increase for at-power internal events due to the EPU is a delta CDF of 5.67E-7 (an increase of 7.8% over the base CLTP CDF of 7.32E-6/yr).

The best estimate at-power internal events LERF increase due to the EPU is a delta LERF of 3.OOE-8 (an increase of 8.2% over the base CLTP LERF of 3.64E-7/yr).

Using the NRC guidelines established in Regulatory Guide 1.174 and the calculated results from the Level 1 and 2 PRA, the best estimate for the CDF risk increase (5.67E-7/yr) and the best estimate for the LERF increase (3.OOE-8/yr) are both within Region III (i.e., changes that represent very small risk changes).

5-12 5-12 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications The quantitative sensitivity cases performed in this analysis show that both the delta CDF and the delta LERF remain within Region III (refer to Figures 5.7-1 and 5.7-2)

Based on these results, the proposed MNGP 113% Extended Power Uprate is acceptable on a risk basis.

5-13 5-13 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table 5.7-1 RESULTS OF MNGP EPU PRA SENSITIVITY CASES MNGPTT CLTP EPU Base Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Parameter ID PRA PRA Case #1 Case #2 Case #3 Case #4 Case #5 Case #6 Case #7 Case #8 Case #9 Base CLTP EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values Post-initiator HEPs Values (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11)

Turbine i IE Base CLTP Base CLTP 114 Base CLTP Base CLTP 1.14 Base CLTP Base CLTP 1.14 Base CLTP 1.14 rip (9.90E-1) (9.90E-1) Value Value Value Value Value Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP MSIV Closure IE (3.80E-2) (3.80E-2) Value 1.88E-01 Value Value 1.88E-01 Value Value Value Value LLOCA IE Base CLTP (1.64E-4) Base CLTP (1.64E-4) Base CLTP Value Base CLTP Value 3.28E-4 3.28E-4 3.28E-4 Base CLTP Value 3.28E-4 Base CLTP Value 3.28E-4 Nominal CRDH for Base CLTP Base EPU No CRDH No CRDH No CRDH Early Injection (Yes) (Yes, but Base EPU Base EPU Base EPU Base EPU Base EPU Nominal Nominal Base EPU Nominal LP RPV) Early Early Early LP ECCS NPSH Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Yes Yes Impact from DBA (No) (No) (No) (No) (No) (No) (No) (No) (No) (App. F) (App. F)

COP CDF: 7.32E-06 7.89E-06 7.94E-06 7.93E-06 7.94E-06 7.99E-06 7.98E-06 7.93E-06 8.04E-06 7.90E-06 8.05E-06 delta CDF: - 5.67E-07 6.15E-07 6.05E-07 6.22E-07 6.69E-07 6.60E-07 6.13E-07 7.17E-07 5.76E-07 7.26E-07 LERF: 3.64E-07 3.94E-07 4.07E-07 4.06E-07 3.97E-07 4.1OE-07 4.09E-07 3.94E-07 4.1OE-07 4.03E-07 4.19E-07 delta LERF: - 3.OOE-08 4.31E-08 4.24E-08 3.30E-08 4.62E-08 4.53E-08 3.03E-08 4.65E-08 3.90E-08 5.55E-08 5-14 5-14 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications t

105 10-1i5 0- CDF -J El Best estimate of CDF change for power uprate Figure 5.7-1 MNGP EPU Risk Assessment CDF Result Versus RG 1.174 Acceptance Guidelines* for Core Damage Frequency (CDF)

• The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

5-15 5-15 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications t

10.6 10-7 10_6 10-5 LERF-*

El Best estimate of LERF change for power uprate Figure 5.7-2 MNGP EPU Risk Assessment LERF Result Versus RG 1.174 Acceptance Guidelines* for (LERF)

• The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

5-16 5-16 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications REFERENCES

[1] Monticello Nuclear Generating Plant, "Monticello Individual Plant Examination (IPE) Submittal", February 1992.

[2] Swain, A.D., Accident Sequence Evaluation Program Human Reliability Analysis Procedure, NUREG/CR-4772, Final Report, February 1987.

[3] Idaho National Engineering and Environmental Laboratory, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, February 1999.

[4] NEI, PRA Peer Review Guidelines, NEI 00-02, Rev. A3, 3/20/2000.

[5] Professional Loss Control, Inc., Fire-Induced Vulnerability Evaluation (FIVE),

EPRI TR-100370, April 1992.

[6] Letter from W.H. Rasin (NUMARC) to NUMARC Administrative Points of Contact, "Revision 1 to EPRI Final Report dated April 1992, TR-100370, 'Fire Induced Vulnerability Evaluation Methodology' ", September 29, 1993.

[7] Science Applications International Corporation, Fire PRA Implementation Guide, EPRI TR-105928, Final Report, 1995.

[8] MNGP PRA Document I1.SMN.96.001, "Monticello Re-Rate PRA Evaluation".

[9] MNGP PRA Document II.SMR.02.010, "Radioactive Release Frequency /

Containment Performance Event Trees".

[10] Monticello Nuclear Generating Plant, "Monticello, Nuclear Plant Individual Plant Examination for External Events (IPEEE) Submittal", November 1995.

[11] U.S. Nuclear Regulatory Commission, "Individual, Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10CFR50.54(f)", Generic Letter 88-20, Supplement 4, June 28, 1991.

[12] U.S. Nuclear Regulatory Commission, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, NUREG-1407, June 1991.

[13] General Electric, Generic Guidelines for General;Electric Boiling Water Reactor Extended Power Uprate, NEDC-32424P-A, February 1999.

[14] General Electric, Generic Evaluations for General Electric Boiling Water Reactor Extended Power Uprate, NEDC-32523P-A, February 2000.

R-1 R-1 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications

[15] General Electric, Licensing Topical Report: Constant Pressure Power Uprate, NEDC-33004P-A, Rev. 4, July 2003.

[16] U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation Review Standard for Extended Power Uprates, RS-001, Draft, December 2002.

[17] U.S. Nuclear Regulatory, Individual Plant Examination Program: Perspectives on Reactor Safety and Plant Performance, Parts 2-5, Vol. 2, NUREG-1560, December 1997.

[18] Sandia National Laboratories, Analysis of Core Damaqe Frequency: Peach Bottom, Unit 2 External Events, NUREG/CR-4550, Vol. 4, Rev. 1, Part 3, December 1990.

[19] Philadelphia Electric Company, Limerick Generating Station Severe Accident Risk Assessment, April 1983.

[20] Sandia National Laboratories, Shutdown Decay Heat Removal Analysis, GE BWR3/Mark I Case Study, NUREG/CR-4448, December 1986.

[21] EPRI, PSA Applications Guide, EPRI TR-105396, Final Report, August 1995.

R-2 R-2 C495070003-7740-03/27/08

Appendix A MONTICELLO EPU PRA QUANTIFICATION RESULTS

Monticello Extended Power Uprate Risk Implications Appendix A PRA QUANTIFICATION RESULTS The quantification runs performed for the MNGP EPU risk assessment are summarized in Table A-I. These quantifications were performed using the EPRI R&R Workstation software (i.e., the PRA software used to develop, maintain, and quantify the MNGP PRA)

A-1 A-I C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table A-1 RESULTS OF MNGP EPU PRA SENSITIVITY CASES 1MNGP CLTP EPU Base Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Sensitivity Parameter ID PRA PRA Case #1 Case #2 Case #3 Case #4 Case #5 Case #6 Case #7 Case #8 Case #9 Post-Initiator HEPs Base CLTP Values EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values EPU Values (Tbi 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (Tbl 4.1-11) (TbI 4.1-11) (Tbl 4.1-11)

Turbine TriplE Base CLTP Base CLTP 1.14 Base (9.90E-1) (9.90E-1) V CLTP Base BaseCLTP Base CLTP Value Base CLTP Value 1.14 Base CLTP Value MSIV Closure IE Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP (3.80E-2) (3.80E-2) Value 1.88E-01 Value Value 1.88E-01 Value Value Value Value LLOCA IE Base CLTP (1.64E-4) Base CLTP (1.64E-4) Base CLTP Base CLTP 3.28E-4 3.28E-4 3.28E-4 Base CLTP 3.28E-4 Base CLTP 3.28E-4 Value Value Value Value Nominal CRDH for Base CLTP Base EPU NoCRDH No CRDH No CRDH Early Injection (Yes) (Yes, but Base EPU Base EPU Base EPU Base EPU Base EPU Nominal Nominal Base EPU Nominal LP RPV) Early Early Early

.LP ECCS NPSH Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Impact from DBA (No) (No) (No) (No) (No) (No) (No) Yes Yes F)

COP (No) (No) (App. F) (App.

CDF: 7.32E-06 7.89E-06 7.94E-06 7.93E-06 7.94E-06 7.99E-06 7.98E-06 7.93E-06 8.04E-06 7.90E-06 8.05E-06 delta CDF: 5.67E-07 6.15E-07 6.05E-07 6.22E-07 6.69E-07 6.60E-07 6.13E-07 7.17E-07 5.76E-07 7.26E-07 LERF: 3.64E-07 3.94E-07 4.07E-07 4.06E-07 3.97E-07 4.1OE-07 4.09E-07 3.94E-07 4.10E-07 4.03E-07 4.19E-07 delta LERF: 3.OOE-08 4.31 E-08 4.24E-08 3.30E-08 4.62E-08 4.53E-08 3.03E-08 4.65E-08 3.90E-08 5.55E-08 A-2 C495070003-7740-03/27/08

Appendix B IMPACT OF EPU ON SHUTDOWN OPERATOR ACTION RESPONSE TIMES

Monticello Extended Power Uprate Risk Implications Appendix B IMPACT OF EPU ON SHUTDOWN OPERATOR ACTION RESPONSE TIMES This appendix describes the thermal hydraulic analyses performed to support the assessment that the MNGP EPU has a negligible impact on human response times during plant shutdown accident scenarios.

B.1 INTRODUCTION The risk due to accidents during shutdown is strongly dependent upon the time available from the start of the event to the onset of core damage. As time elapses after shutdown, accidents leading to boiling of coolant within the RPV and consequential inventory losses take more time to evolve. The burden on plant systems decreases as well, introducing the chance of accident mitigation with non-safety, low capacity systems.

The effect of decreasing decay heat on the times to boil and core damage is accounted for in two ways. The first is the calculation of decay heat present at a particular point in the outage. The second takes into consideration the heat capacity of the water and structures in the system available to absorb decay heat before boiling and core damage occur. Both of these aspects are addressed in this appendix to support the assessment of the relationship of decay heat levels and times available in which to perform human actions to prevent core damage during shutdown accident scenarios.

B.2 ASSUMPTIONS The following assumptions were used in the calculation of the times to boil off the fuel coolant and reach core damage. These assumptions allow for some simplifications in the calculation, and also allow for an appropriate degree of conservatism in the results.

0 The time to boil and time to core damage calculations are appropriate for B-1 B-I C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications conditions of RPV vented and maintained at atmospheric pressure.

• The time to core damage is conservatively estimated by calculating the time to reach 2/3 core height, and then extrapolating the time to gap release based on decay heat level ratios by assuming that gap release occurs 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after 2/3 core height is reached one day after shutdown.

Gap release is the release of fission products in the fuel pin gap, which occurs immediately after failure of the fuel cladding and is the first radiological indication of core damage. This approach is based on calculations performed by Sandia and summarized in SECY-93-190. [B-4]

• There is no heat loss from the system to the surroundings via the water surface or through the vessel walls.

• The calculation of decay heat levels and times to boiling and core damage in this assessment conservatively do not include removal of spent fuel out of the core.

• The decay heat as a function of time after shutdown is derived from a curve fit to the ASB 9-2 Branch Technical Position methodology assuming 100% initial power and 16,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> of power operation.

B.3 DECAY HEAT LEVEL CALCULATION There are several methods available to calculate decay heat as a function of time after shutdown. The NRC has provided an acceptable method of calculating the decay heat rate in Branch Technical Position ASB 9-2 [B-1]. This method uses the following equation:

11 11 Ps = Po [ (1+K)(1/200) ZAnexp(-ants) - (1/200)ZAnexp[-an(ts + to))) (B-1) n=1 n=1 Where: PS = decay heat level (MBtu/hr)

Po = normal operating power (MBtu/hr) t = time after shutdown (seconds) to = operating history K = uncertainty factor B-2 B-2 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications 3 7

= 0.2 for t, < 103, 0.1 for 10 < ts <10 An, an = fit coefficients as specified in Reference B-1.

Other less complex formulas have been developed and provide reasonable estimates of decay heat rates. Reference B-2 provides the simplest of these, assuming an infinite power history:

Ps(t) = Po (0.0950) ts-0 26 (B-2) where Ps(t), Po and ts are as defined above. A comparison of Equation B-2 to Equation B-1, assuming 16,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> of power operation, shows that Equation B-2 underestimates the decay heat in the first day or two by 10-20%, and it overestimates the decay heat thereafter (by 10-75%). At 70 days after shutdown, the decay heat calculated by Equation B-2 is about 75% higher than that calculated using the ASB 9-2 method [B-l].

Another abbreviated formula is found in Reference B-3. This formula, called the Wigner-Way formula, also includes a factor for the power history:

Ps(t) = Po (0.0622) [ts-0 2 - (to + ts)-0 2] (B-3)

As with Equation B-1, to is the operating history in seconds, also assumed to be 16,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> for comparison purposes. Equation B-3 shows a better correlation late in the outage, but the first twenty to thirty days after shutdown are under predicted (by 10-20%

compared to the ASB 9-2 formula). A separate curve fit to the ASB 9-2 equation can be developed of the form:

Ps(t) = Po (0.02561) tS(hrs)-0.4 2 3 7 1 (B-4) where tS(hrs) is the time since shutdown in hours. This simple equation is considered to have an advantage over Equations B-2 and B-3 because it agrees with the ASB 9-2 data B-3 B-3 C495070003-7740-03/27108

Monticello Extended Power Uprate Risk Implications to within about 10% over the full time period of interest. Although the agreement is not quite as good as the Wigner-Way formula after about 40 days, the agreement at the critical earlier times is much better. Equation B-4 is often used in industry BWR PSSAs to support boil-off timing calculations.

Using Equation B-4, the decay heat level as a function of time after shutdown is given as:

MNGP CLTP: P s(t) = (1775 MWt) (3.4118E6 Btu/hr/ 1 MWt) (0.02561) tS(hrs)-042371 P s(t) = (1.55E8) t S(hr)- 0 .4237 1 Btu/hr (B-5a)

MNGP 113% CLTP: P s(t) = (2004 MWt) (3.4118E6 Btu/hr/1 MVft) (0.02561) tS(hrs)-0"42371 Ps(t) = (1.75E8) tS(hr_ 0- 42371 Btu/hr (B-5b)

B.4 RPV HEATUP AND BOILOFF CALCULATIONS Once the core decay heat rate has been calculated using Equation B-5, the times to fuel coolant boiling and core damage can be calculated using simple heat transfer formulas based on the volume of water available. The principal shutdown states are represented by the following water level configurations:

• normal level

• at the flange level

• reactor cavity flooded Nominal water volumes and associated heat capacities for use in this calculation are summarized in Table B-I.

Time to Boil B-4 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications The time required for the vessel water to reach the boiling temperature (given loss of coolant decay heat removal) is represented by the following equation:

tb = Ebol / Ps(t) hrs. (B-6) where:

tb = time to boil (hours)

Eboil = Ewater + Estruct Ewater = energy absorbed by heated water volume to reach saturation (MBtu)

Estruct = energy absorbed by fuel and clad (MBtu)

Ps(t) = decay heat level (MBtu/hr),

and Ewater = V/v * (hTsat - hTinit)

V = volume of water that heats up to the saturation temperature (ft3) v = specific volume of water at Tinit (assumed constant at 0.0167 ft3 /lbm over the temperature range of interest) hTsat = enthalpy of water at Tsat, 212°F (Btu/Ibm),

hTinit - enthalpy of water at the initial RPV temperature, Tinit (Btu/lbm),

and Estruct = MCps~tut (Tsat - Tinit)

MCpstruct = configuration specific structure heat capacity (Btu/°F - See Table B-i)

B-5 B-5 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Since the specific heat of water is 1.0 Btu/lbm0 F, the difference in the enthalpies in the Ewater expression above (hTsat - hTinit) is equivalent to the temperature difference in the Estrut expression (Tsat - Tinit). This allows the complete expression for Eboil to simplify to:

Eboil = [(V/v) + MCPSTRUCT] * [TsAT - Tinit] (B-7)

Substituting in the appropriate constant values, Equation B-7 can be rewritten as:

Eboil = C * [212 - Tinit] (B-8) where the constant C is calculated for each of the water volumes and structure capacities given in Table B-1. Thus, with the initial temperature, Tinh in OF and the decay heat load, P,(t) in Btu/hr, the time to reach saturation for the different configurations are given by Equations B-9 through B-13.

tb, 2/3 core height = 2.02E5 * (212- Tinit) / Ps(t) hours (B-9) tbTAF = 2.26E5 * (212 - Tinit) / Ps(t) hours (B-10) t b,Normal Level = 4.85E5 * (212 - Tinit) / Ps(t) hours (B-11) tb,FlangeLevel = 6.35E5 * (212 - Tinit) / Ps(t) hours (B-12) t b,Cavity Flooded = 1.85E6 * (212 - Tinit) / Ps(t) hours (B-13) where Ps(t) is the decay heat level (refer to Equation B-5) and Tinit is the initial water temperature (e.g., 140F early in the outage before cavity flooded and 1 0OF later in the outage after the cavity flooded).

B-6 B-6 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table B-1 NOMINAL WATER VOLUMES AND HEAT CAPACITIES FOR THE TIME TO BOIL AND TIME TO CORE DAMAGE CALCULATIONS Heat Capacity (Btu/°F) (1)

Water Volume Water Level (ft3) Water Structure 2/3 Core Height 3374 (3) 2.06E5 (2)

Top of Active Fuel 3769 (4) 2.26E5 (2)

Normal Level 8103 (5) 4.85E5 (2)

Flange Level 10608 (6) 6.35E5 (2)

Cavity Flooded 30965 (7) 1.85E6 (2)

B-7 B-7 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications NOTES TO TABLE B-1:

(1) The term heat capacity is used in Eq. B-8. The water heat capacity is defined as Volume/v (where v is the specific volume of water and is assumed constant at 0.0167 ft3/Ibm). Refer to text on preceding pages for further details.

(2) Structural heat capacities are conservatively not credited in this calculation.

(3) Calculated using RPV zone volumes from Reference [5]:

= TAFwatervolume - 1/3 (TAFwatervolume - BAFwatervolume)

= 3769 - 1/3 [(4733.4 - 964.0) - (2864.1 - 278.8)]

3

= 3374 ft (4) Calculated using RPV zone volumes from Reference [5]:

= TAFtotalvlume - TAFsolidvolume

= 4773.4 - 964.0 3

= 3769 ft (5) Calculated using RPV zone volumes from Reference [5]:

= RPVwatervoiume - [Water volume forZones Q, P, N, M]

= (13303.6 - 1390.3) - [(1305.22 + 1337.05 + 1070.18 + 206.96) - (0 + 79.38 + 18.72 + 11.15)]

3

= 8103 ft (6) Calculated using RPV zone volumes from Reference [5]:

= RPVwatervolume - Zone Q water volume

= (13303.6 - 1390.3) - [1305.22 - 0]

3

= 10608 ft (7) Calculated using References [7, 8 and 11] and assuming water level is one (1) ft. below refuel floor:

= Flangewateroume + Reactor Cavity water volume

= 10608 + [ 7 (18 ft)2 (20 ft)]

3

= 30965 ft B-8 B-8 C495070003-7740-03/27108

Monticello Extended Power Uprate Risk Implications Time to Uncover Fuel (Boil Off) and Core Damaqe The time to uncover the core due to boil off (due to loss of coolant decay heat removal) is the sum of the time required to bring the full heated water volume to saturation and the time to boil off an equivalent volume of water that lies above the core. This can be represented by an equation similar in format to the time to boil equation (Equation B-6):

tcu = Etotal/Ps (t) (B-14) where:

= time to uncover the core (hours)

Etotal = Eboil + Eboiloff Eboil = energy absorbed to reach saturation as defined for Equation B-6 (MBtu)

Eboiloff = energy absorbed by the water that vaporizes during boiloff (MBtu),,

and Eboiloff = Vb / Vsat * (hfg)

Vb = equivalent volume of water that must vaporize for the collapsed level to reach TAF (ft3)

Vsat = specific volume of water at saturation (Tsat = 212 0 F), or 0.0167 ft3/lbm hfg = heat of vaporization at 212°F and 14.7 psia, or 970.32 Btu/Ibm.

With constant values again assumed where appropriate, Equations B-15 through B-17 below provide the time to uncover the core for the different shutdown water level configurations:

B-9 B-9 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications tcu,Normal Level = [4.85E5 * (212 - minit) + 2.52E8] / Ps(t) hours (B-15) tcu,Flange Level = [6.35E5 * (212 - Tinit) + 3.97E8] / Ps(t) hours (B-16) tcu,CavityFlooded = [1.85E6 * (212- Tinit) + 1.58E9] / Ps(t) hours (B-17) where Ps(t) is the decay heat level (refer to Equation B-5)

This analysis assumes the initial bulk water temperatures is 140F for days 0 through 5; 120F for days 6 through 10; and 1OOF for days 11 and beyond.

The time to uncover the core with the existing power level (CLTP) is 10.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> (9.5 hrs for the 113% CLTP case) at one day into the outage from the flange level configuration. The available time greatly exceeds 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a couple days into the outage when the water level is flood up into the refueling cavity.

For the impact on shutdown human error probabilities, it is necessary to know the approximate time of core damage so that this time can be used as the maximum allowable time window rather than conservatively estimating the time to reach an uncovered core.

As stated in Section B.2, the time to core damage is estimated by incorporating the additional time available from boiloff from TAF down to 2/3. core height, and then extrapolating the time to gap release by assuming that gap release occurs 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after 2/3 core height is reached one day after shutdown. The resulting equation for core damage, tcd, is:

tc= + [2.3E7 + 0.5

• Ps(ld)] / Ps(t) hours (B-18) where:

2.3E7 represents the amount of decay heat required to boildown from TAF to 2/3 core height Ps(ld) is the decay heat 1 day after shutdown (refer to Eq. B-5)

Ps(t) is the decay heat as a function of time after shutdown (refer to Eq. B-5)

B-1 0 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications This equation for estimating the time to core damage during refueling incidents is the approach typically used in U.S. industry BWR PSSAs. This equation was developed in the BWR PSSA industry to reflect BWR fuel heatup timing estimates provided in NSAC-169 and SECY-93-190. [B-4,10] SECY-93-190 reports that fuel heatup calculations performed for Grand Gulf by Sandia show that at 4 days after shutdown approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> are available between reaching TAF and before fuel pin gap release occurs; and almost 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> is available at 15 days after shutdown.

Given the nature of shutdown risk, the time to core damage due to boil-off is not static but increases with increasing times after shutdown. An equation is used for ease of modeling shutdown incidents. Although one may use MAAP runs to estimate the time to core damage (as is done in the at-power PRA), it is not practical given that numerous different runs would be required for different times after shutdown.

Comparisons of the time to core damage due to boil off (given loss of coolant decay heat removal) for the normal and RPV flange water level configurations for the CLTP and the 113% CLTP cases are provided in Tables B-2 and B-3. For example, at one day into the outage from the flange level configuration, the time to core damage for the existing power level (CLTP) is 11.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> versus 10.5 hrs for the 113% CLTP case.

Information is not summarized for the flood-up configuration as the times to core damage are 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> and greater (much longer than the time frames typically considered in PRAs, and time frames at which changes in human error probabilities are negligible) after 2-3 days into the shutdown (i.e., the approximate time flood-up would have been completed).

B.5 EPU IMPACT ON SHUTDOWN RISK Imoact Due to Chanaes in HEPs B-1 1 B-li C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications The primary impact of the EPU on risk during shutdown operations is the decrease in allowable operator action times in responding to off-normal events.1 ) However, as can be seen from Tables B-2 and B-3, the reduction in times to core damage (i.e., 113% CLTP case compared to CLTP case) are on the order of 10-15%. Such small changes in already lengthy allowable operator response times result in negligible changes (<<1%) in calculated human error probabilities.

The allowable operator action timings to respond to loss of heat removal scenarios during shutdown operations are many hours long. Very early in an outage the times available for operator response to prevent core damage for loss of shutdown cooling events are 8-9 hours; later in an outage the times are dozens of hours. A reduction from 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> in allowable action timings would not result in any significant increase in human error probabilities for most operator actions using current human reliability analysis methods.

Decay Heat Curve Method Sensitivity Case As a sensitivity, the timing estimates were also calculated using the decay heat curve generated by GE for the MNGP EPU. The timings from the use of this decay heat curve are very similar to the calculations based on use of the decay heat curve of Eq. B-5 and the results are the same (i.e., the changes in allowable action times are 10-15%). For example, at one day into the outage from the flange level configuration, the time to core damage for the existing power level (CLTP) is 12.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> versus 10.9 hrs for the 113%

CLTP case (compared to 11.8 and 10.5, respectively when using the decay heat curve from Equation B-5). Like the calculations performed using the decay heat curve from Equation B-5, the available time before core damage using the GE-calculated decay heat curves for MNGP greatly exceeds 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a couple days into the outage when the water level is flood up into the refueling cavity.

(1) Another postulated impact is any changes to system success criteria during shutdown operations (specifically with respect to decay heat removal systems) that may result from the EPU. A postulated impact would be that the time into the outage at which B-12 B-i 2C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Impact Due to Changes in Offsite AC Recovery Failure Probabilities In addition to traditional human error probabilities, the offsite AC recovery failure probabilities can be influenced by changes in allowable timings. An approximate calculation is performed here to estimate the impact on shutdown risk due to changes in the offsite AC recovery failure probability. The calculation is described as follows:

A 30-day refueling outage is assumed and is divided into the following five (5) phases:

- Day 1 of the outage

- Day 2 of the outage

- Day 3 of the outage

- Days 4-28 of the outage

- Days 29-30 of the outage These phases are defined to address the higher decay heat in the beginning days (1-3) of the outage, the "flooded-up" days (4-28) in the middle of the outage when decay heat issues are not the main risk contributor, and the end of the outage (29-30) when the coolant level is lowered back down into the vessel.

The following initial water level configurations are assumed for the phases:

- Day 1 of the outage (NORMAL RPV LEVEL)

- Day 2 of the outage (RPV FLANGE LEVEL)

Day 3 of the outage (FLOODED UP)

Days 4-28 of the outage (FLOODED UP)

Days 29-30 of the outage (NORMAL)

A review of industry BWR PSSAs (Cooper, Dresden, Fermi, Quad Cities, LaSalle, WNP-2) was performed to assist in defining the contribution of LOOP/SBO accident scenarios to the CDF of each of the above general phases. Based on the review, the CDF contribution from LOOP/SBO scenarios is high (40%-90%) in the first few days of the outage when the decay heat is higher, it drops significantly (e.g., 20%-

40%) in the middle of the outage when decay heat is lower and the backup low capacity heat removal options would be sufficient to prevent coolant boiling would be extended a number of hours.

Such a postulated impact is judged to result in an insignificant change in shutdown risk (e.g., 1% or less change in shutdown CDF).

B-1 3 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications cavity is flooded (draindown events dominate these periods), and then it increases at the end of the outage when the coolant level is lowered back down into the vessel.

• The review of industry PSSAs also supported the estimation of the contributions to overall shutdown CDF during the different phases of the outage.

• Table 4-1 of NUREG/CR-6890 is used here to estimate changes in offsite AC recovery failure probabilities due to reductions in allowable timings. [B-6]

• The assessment is performed on a normalized CDF basis.

This calculation is summarized In Table B-4. As can be seen from Table B-4, the increase in shutdown CDF due to increases in AC power recovery failure probabilities due to the EPU is estimated at approximately 2%.

Summary Based on the above discussions and calculations, the qualitative conclusion of this assessment is that the MNGP EPU has an insignificant impact on shutdown risk. The impact is approximated as roughly a 2% increase in shutdown CDF.

B-14 B-i 4C495070003-7740-03127/08

Monticello Extended Power Uprate Risk Implications Table B-2 TIME TO CORE DAMAGE DUE TO BOIL OFF (Initial Water Level: Normal Level)

Days After Initial Water I Time to Core Damage (hrs.)

Shutdown Temperature CLTP 113% CLTP 1 140OF 8.2 7.3 5(1) 140OF 16.2 14.4 10(1) 120OF 22.3 19.9 15(1) 100OF 27.3 24.3 20(1) 100OF 30.8 27.5 25(1) 100°F 33.9 30.2 30 100OF 36.6 32.6 NOTE:

(1) This list of days after shutdown is summarized to show the increasing trend of time available. Thirty days is shown here to correspond with the current industry trend toward refueling outages on the order of a month in duration. Note that the days marked with the footnote are not directly applicable to a real outage schedule for this water level configuration (i.e., the first day or two the water level will be low, but then for the majority of the outage the water level will be at the spent fuel pool level, and then will be lowered again at the end of the outage).

B-1 5 B-i 5C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table B-3 TIME TO CORE DAMAGE DUE TO BOIL OFF (Initial Water Level: RPV Flange Level)

Days After Initial WaterT Time to Core Damage (hrs.)

Shutdown Temperature CLTP 113% CLTP 1 140OF 11.8 10.5 5(1) 140OF 23.3 20.8 10(1) 120OF 31.9 28.4 15(1) 100°F 38.6 34.4 20(1) 100°F 43.6 38.9 25(1) 100°F 48.0 42.7 30 100°F 51.8 46.1 NOTE:

(1) This list of days after shutdown is summarized to show the increasing trend of time available. Thirty days is shown here to correspond with the current industry trend toward refueling outages on the order of a month in duration. Note that the days marked with the footnote are not directly applicable to a real outage schedule for this water level configuration (i.e., the first day or two the water level will be low, but then for the majority of the outage the water level will be at the spent fuel pool level, and then will be lowered again at the end of the outage).

B-16 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table B-4 ESTIMATED IMPACT ON SHUTDOWN RISK DUE TO OFFSITE AC RECOVERY FAILURE PROBABILITY INCREASES DUE TO EPU Time to Core Damage (hrs)

Factor Increase Phase Phase in Offsite AC Contribution to Contribution to LOOP/SBO Recovery Overall S/D Initial Water Overall SD CDF Contribution to Failure CDF Outage Phase Level (CLTP)(1) Phase CDF(1) CLTP(2 ) 113% CLTP(2) Probability(3) (113% CLTP) (4)

Day 1 Normal 0.10 0.75 8.2 7.3 1.12 0.109 Day 2 RPV Flange 0.10 0.50 15.8 14.1 1.11 0.106 Day 3 Flooded 0.10 0.25 65.5 58.1 negligible 0.100 Days 4-28 Flooded 0.60 0.25 131.0 116.2 negligible 0.600 Days 29-30 Normal 0.10 0.50 36.6 32.6 negligible 0.100 Normalized CDF (CLTP): 1.00 Normalized CDF (113% CLTP): 1.02 B-17 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes to Table B-4:

(1) Approximated based on review of industry BWR PSSAs (Cooper, Dresden, Fermi, Quad Cities, LaSalle, WNP-2).

(2) Calculated using Eq. B-18.

(3) Based on use of generic offsite AC recovery failure probability information from NUREG/CR-6890. The integrated (i.e., integration of plant-centered, grid, and severe weather contributions) AC recovery failure data for shutdown conditions from Table 4-1 of NUREG/CR-6890 is used.

For example, at t=8.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> the NUREG/CR-6890 AC recovery failure probability is 6.35E-2 and at t=7.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> the failure probability is 7.14E-2 (a factor of 1.12 higher).

(4) Calculated as:

[ ( 1.0 - 4 h Column ) x 3 rd Column ] + [ 4h Column x 3 rd Column x 7th Column]

The first contribution is the non-LOOP portion of the phase CDF (i.e., the portion unaffected by changes in offsite AC recovery failure probabilities).

The second contribution is the LOOP portion of the phase CDF (i.e., the portion impacted by changes in offsite AC recovery failure probabilities).

B-1 8 B-I 8C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications REFERENCES

[B-i] USNRC, Branch Technical Position 9-2, "Residual Decay Heat Energy for Light-Water Reactors for Long-Term Cooling."

[B-2] M.M. EI-Wakil, Nuclear Heat Transport, International Textbook Company, 1971.

[B-3] K. Way, E. Wigner, "The Rate of Decay of Fission Products," (Phys. Rev., 73, 1948, pp. 1318-1330)

[B-4] USNRC, "Regulatory Approach to Shutdown and Low Power Operations,"

SECY-93-190, July 12, 1993,

Enclosure:

Draft Regulatory Analysis in Accordance with 10CFR50.109 dated February 1993.

[B-5] Monticello drawing NX-8290-168-1, Rev. A, "Reactor Primary Sys. Wts. &

Volumes."

[B-6] NUREG/CR-6890, Re-Evaluation of Station Blackout at Nuclear Power Plants:

1986-2004, Volume 1, December 2005.

[B-7] Monticello drawing NF-36510, Rev. H, "Area-3 Piping Drawings Section B-B".

[B-8] Monticello drawing NF-36063, Rev. A, "Equipment Location - Reactor Building Section B-B."

[B-9] Electric Power Research Institute, Safety Assessment of BWR Risk During Shutdown Operations, NSAC-175L, Final Report, August 1992.

[B-10] Electric Power Research Institute, Analysis of BWR Fuel Heatup During a Loss of Coolant While Refueling, NSAC-169, September 1991.

[B-11] Monticello drawing NF-36507, Rev. B, "Area-3 Piping Drawings Plan Below Elev.

1027' - 8"."

B-1 9 C495070003-7740-03/27/08

Appendix C MONTICELLO PRA QUALITY

Monticello Extended Power Uprate Risk Implications Appendix C MONTICELLO PRA QUALITY The quality of the Monticello PRA models used in performing the risk assessment for the Monticello EPU is manifested by the following:

• Level of detail in PRA

• Maintenance of the PRA

• Comprehensive Critical Reviews C.1 LEVEL OF DETAIL The Monticello PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events.

C. 1.1 Initiating Events The Monticello at-power PRA explicitly models a large number of internal initiating events:

• General transients

• LOCAs

• Support system failures

• Internal Flooding events The initiating events explicitly modeled in the Monticello at-power PRA are summarized in Table C-1. The number of internal initiating events modeled in the Monticello at-power PRA is similar to the majority of U.S. BWR PRAs currently in use.

C-1 c-iC495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table C-1 INITIATING EVENTS FOR MONTICELLO PRA Initiator ID Description IE_125VDC Loss of both divisions of 125V DC IE_125VDC1 Loss of division I 125V DC power IE_125VDC2 Loss of division II 125V DC power IEAIR Loss of instrument air IEBUS13 Loss of electrical bus 13 IEBUS14 Loss of electrical bus 14 IEBUS15 Loss of electrical bus 15 IEBUS16 Loss of electrical bus 16 IECRDH Loss of CRDH IEDW-COOL Loss of drywell cooling IEFW Loss of feedwater IELLOCA Large LOCA initiating event IELOOP Loss of offsite power initiating event IEMLOCA Medium LOCA initiating event IEMSIV MSIV closure IERBCCW Loss of RBCCW IEREFLAB Break in both reference legs IEREFLEGA Break in 2-3-2A reference leg IE_REFLEGB Break in 2-3-2B reference leg IESHUTDOWN Manual shutdown of reactor IESLOCA Small LOCA initiating event IESORV Relief valve spuriously fails open IESW Loss of service water IE_TURB-TRIP Turbine trip C-2 C-2 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table C-1 INITIATING EVENTS FOR MONTICELLO PRA Initiator ID Description IEVACUUM Loss of condenser vacuum IEXLOCA RPV rupture ISLOCA Interfacing Systems LOCA (numerous unique IEs)

Breaks Outside Containment LOCA Outside Containment (Numerous unique lEs)

Floods Internal Flooding initiators (numerous unique IEs)

C-3 C-3 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications C.1.2 System Models The Monticello at-power PRA explicitly models a large number of frontline and support systems that are credited in the accident sequence analyses. The Monticello systems are modeled in the Monticello at-power PRA using fault tree structures for the majority of the systems. The number and level of detail of plant systems modeled in the Monticello at-power PRA is consistent with industry practices.

C.1.3 Operator Actions The Monticello at-power PRA explicitly models a large number of operator actions:

• Pre-Initiator actions

" Post-Initiator actions

• Recovery Actions Over one hundred operator actions are explicitly modeled. Given the large number of actions modeled in the Monticello at-power internal events PRA, a summary table of the individual actions modeled is not provided here.

The human error probabilities for the actions are modeled with accepted industry HRA techniques and include input based on discussion with plant operators, trainers, and other cognizant personnel.

The number of operator actions modeled. in the Monticello at-power PRA, and the approach to their quantification is consistent with industry practices.

C. 1.4 Common Cause Events The Monticello at-power PRA explicitly models a large number of common cause C-4 C-4 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications component failures. Approximately two hundred common cause terms are included in the MNGP PRA. Given the large number of CCF terms modeled in the Monticello at-power internal events PRA, a summary table of them is not provided here. The number and level of detail of common cause component failures modeled in the Monticello at-power PRA is consistent with industry practices.

C.1.5 Level 2 PRA The Monticello Level 2 links the Level 1 PRA accident sequences and systems logic with Level 2 containment event tree sequence logic and systems logic.

The following aspects of the Level 2 model reflect the more than adequate level of detail and scope:

• Dependencies from Level 1 accidents are carried forward directly into the Level 2 by transfer of sequences to ensure that their effects on Level 2 response is accurately treated.

• Virtually all phenomena identified by the NRC and industry for inclusion in BWR Mark I Level 2 analyses are treated explicitly within the model.

" The model truncation is sufficiently low to be consistent with the NEI PRA Peer Review Guidelines for Risk-Informed Applications.

C.2 MAINTENANCE OF PRA The Monticello PRA model and documentation has been maintained living and is routinely updated to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data.

The Monticello PRA has been updated multiple times since the original IPE.

C-5 c-5 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications The PRA models are routinely implemented and studied by plant PRA personnel in the performance, of their duties.

Formal comprehensive model reviews are discussed in Section C.3.

C.3 COMPREHENSIVE CRITICAL REVIEWS The Monticello PRA model has benefited from the following comprehensive technical reviews:

• NEI PRA Peer Review Process

• Recent assessments against the ASME PRA Standard NEI PRA Peer Review The Monticello internal events PRA received a formal industry PRA Peer Review in October 1997. [C-1] The purpose of the PRA Peer Review process is to provide a method for establishing the technical quality of a PRA for the spectrum of potential risk-informed plant licensing applications for which the PRA may be used. The PRA Peer Review process uses a team composed of PRA and system analysts, each with significant expertise in both PRA development and PRA applications. This team provides both an objective review of the PRA technical elements and a subjective assessment, based on their PRA experience, regarding the acceptability of the PRA elements. The team uses a set of checklists as a framework within which to evaluate the scope, comprehensiveness, completeness, and fidelity of the PRA products available.

The Monticello review team used the "BWROG PSA Peer Review Certification Implementation Guidelines", Revision 3, January 1997.

The general scope of the implementation of the PRA Peer Review includes review of C-6 c-6 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications eleven main technical elements, using checklist tables (to cover the elements and sub-elements), for an at-power PRA including internal events, internal flooding, and containment performance, with focus on large early release frequency (LERF). The eleven technical elements are shown in Tables C-2 through C-4.

The comments from the PRA Peer Review were prioritized into four categories A-D based upon importance to the completeness of the model. All comments in Categories A and B (recommended actions and items for consideration) were identified to Monticello as priority items to be resolved in the next model update. The comments in Categories C and D (good practices and editorial) are potential enhancements and remain for consideration in future updates of the Level 1 and 2 PRA models.

All of the 'A' and 'B' priority PRA Peer Review comments have been addressed by MNGP and incorporated into the MNGP PRA model as appropriate.

Assessments Against ASME PRA Standard Consistent with current industry practices, the MNGP has been compared against the ASME PRA Standard a number of times in recent years to identify areas of improvement.

The first assessment against the ASME PRA Standard was performed by Applied Reliability Engineering (ARE), Inc. in early 2004. That assessment compared the 2003 Monticello PRA model to the ASME Standard and NRC draft Regulatory Guide DG-1122.

Since that assessment, the MNGP PRA has evolved to include a much more extensive and detailed internal flooding analysis. Several other less significant model enhancements have occurred since the ARE, Inc. assessment, some of which were made to address insights from the assessment.

C-7 c-7 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications A self-assessment of the 2005 MNGP PRA against the ASME Standard was performed by NMC PRA personnel in 2006. This assessment compared the model containing the updated detailed internal flooding analysis and plant improvements to the Standard.

In anticipation of an upcoming industry peer review of the MNGP PRA, another assessment of the MNGP PRA against the ASME Standard was performed in early 2007 with the intent of determining the resources necessary to apply to the current model in order to address gaps with respect to Capability Category II of the ASME PRA Standard and RG 1.200.

C.4 PRA QUALITY

SUMMARY

The quality of modeling and documentation of the Monticello PRA models has been demonstrated by the foregoing discussions on the following aspects:

• Level of detail in PRA

• Maintenance of the PRA

• Comprehensive Critical Reviews The Monticello Level 1 and Level 2 PRAs provide the necessary and sufficient scope and level of detail to allow the calculation of CDF and LERF changes due to the Extended Power Uprate for the full power internal events challenges.

C-8 c-8 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table C-2 PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT ] CERTIFICATION SUB-ELEMENTS Initiating Events

• Guidance Documents for Initiating Event Analysis Groupings

- Transient

- LOCA

- Support System/Special

- ISLOCA

- Break Outside Containment

- Internal Floods

• Subsumed Events

• Data

• Documentation Accident Sequence Evaluation

• Guidance on Development of Event Trees (Event Trees)

• Event Trees (Accident Scenario Evaluation)

- Transients

- SBO

- LOCA

- ATWS

- Special

- ISLOCA/BOC

- Internal Floods

• Success Criteria and Bases

• Interface with EOPs/AOPs

• Accident Sequence Plant Damage States

• Documentation Thermal Hydraulic Analysis

• Guidance Document

• Best Estimate Calculations (e.g., MAAP)

• Generic Assessments

• FSAR

• Room Heat Up Calculations Documentation C-9 C-9 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table C-2 (Continued)

PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT CERTIFICATION SUB-ELEMENTS System Analysis

• System Analysis Guidance Document(s)

(Fault Trees)

• System Models

- Structure of models

- Level of Detail

- Success Criteria

- Nomenclature

- Data (see Data Input)

- Dependencies (see Dependency Element)

- Assumptions

• Documentation of System Notebooks Data Analysis

• Guidance

• Component Failure Probabilities

• System/Train Maintenance Unavailabilities

• Common Cause Failure Probabilities

• Unique Unavailabilities or Modeling Items

- AC Recovery

- Scram System

- EDG Mission Time

- Repair and Recovery Model

- SORV

- LOOP Given Transient

- BOP Unavailability

- Pipe Rupture Failure Probability

• Documentation Human Reliability Analysis Guidance

• Pre-initiator Human Actions

- Identification

- Analysis

- Quantification Post-Initiator Human Actions and Recovery

- Identification

- Analysis

- Quantification

• Dependence among Actions

• Documentation C-1 0 C-i 0C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table C-2 (Continued)

PRA PEER REVIEW TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Dependencies

• Guidance Document on Dependency Treatment

• Intersystem Dependencies

• Treatment of Human Interactions (see also HRA)

• Treatment of Common Cause

• Treatment of Spatial Dependencies

• Walkdown Results

• Documentation Structural Capability

• Guidance

• RPV Capability (pressure and temperature)

- ATWS

- Transient

• Containment (pressure and temperature)

• Reactor Building

• Pipe Overpressurization for ISLOCA

• Documentation Quantification/Results Guidance Interpretation

• Computer Code

• Simplified Model (e.g., cutset model usage)

• Dominant Sequences/Cutsets

• Non-Dominant Sequences/Cutsets

• Recovery Analysis

• Truncation

• Uncertainty Results Summary C-1 1 C-li C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table C-3 PRA CERTIFICATION TECHNICAL ELEMENTS FOR LEVEL 2 PRA ELEMENT JCERTIFICATION SUB-ELEMENTS Containment Performance Analysis

• Guidance Document

• Success Criteria 1-L/1L2 Interface

• Phenomena Considered

• Important HEPs

• Containment Capability Assessment

• End state Definition

• LERF Definition

• CETs Documentation C-12 C-12C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table C-4 PRA CERTIFICATION TECHNICAL ELEMENTS FOR MAINTENANCE AND UPDATE PROCESS PRA ELEMENT CERTIFICATION SUB-ELEMENTS Maintenance and Update Process

• Guidance Document

• Input - Monitoring and Collecting New Information

• Model Control

• PRA Maintenance and Update Process

• Evaluation of Results

• Re-evaluation of Past PRA Applications Documentation C-1 3 C-i 3C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications REFERENCES

[C-1] Monticello PRA Peer Review Certification Report, GE Document BWROG/PSA-9704, October 1997.

C-14 C495070003-7740-03/27/08

Appendix D HEP ASSESSMENTS

Monticello Extended Power Uprate Risk Implications Appendix D HUMAN ERROR PROBABILITY (HEP) ASSESSMENTS The Monticello risk profile, like other plants, is dependent on the operating crew actions for successful accident mitigation. The success of these actions is in turn dependent on a number of performance shaping factors. The performance shaping factor that is principally influenced by the power uprate is the time available within which to detect, diagnose, and perform required actions. The higher power level results in reduced times available for some actions. To quantify the potential impact of this performance shaping factor, deterministic thermal hydraulic calculations using the MAAP computer code are used.

Not all operator actions in the MNGP PRA have a significant impact on the results. To minimize the resources required to requantify all operator actions in the PRA due to the EPU, a screening process was first performed to identify those operator actions that have an impact on the PRA results. This is consistent with past EPU risk assessments and is reasonable. Potential HEP changes for operator actions screened out from explicit assessment in this EPU risk assessment will not have a significant impact on the quantitative results. Given that the EPU impacts on the significant HEPs modified for this study results in increasing the plant risk profile by about 7%, the non-significant HEPs if adjusted would be expected to impact the risk profile by a fraction of a percent.

The screening process was performed against the following criteria:

6. F-V (with respect to CDF) importance measure >= 5E-3

7. RAW (with respect to CDF) importance measure >= 2.0

8. F-V (with respect to LERF) importance measure >= 5E-3

9. RAW (with respect to LERF) importance measure >= 2.0

10. Time critical (<=30 min. available) action D-1 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications These criteria have been used in past EPU risk assessments. If any of the above criteria are met for an operator action, the action is maintained for explicit consideration in the EPU risk assessment. The HEP screening process is summarized in Table D-1.

As can be seen from Table D-1, thirty-eight (38) operator actions of risk importance in the PRA were identified; and an additional seven (7) time critical HEPs (i.e., less than or equal to 30 minutes available for operator action, and not necessarily risk significant) were identified.

These operator actions were then investigated for changes in allowable operator action timings using the MAAP runs performed for this analysis (refer to Appendix E). The HEPs were then recalculated using the same human reliability analysis techniques (HRA) as used in the MNGP PRA.

The changes in allowable operator action timings are not always directly linear with respect to the EPU power increase (i.e., a 13% power uprate does not always correspond to a 13% reduction in operator action timings):

• Allowable time windows for some actions are not impacted by the power uprate (e.g., timings based on battery life, timings based on internal flood rates, etc.)

• Allowable time windows for LOCAs may be driven more by the inventory loss than the decay heat.

• Allowable time windows for actions related directly to RCS boil-off time during non-LOCA events are also not necessarily linear with respect to the power uprate percentage. It is not uncommon that some actions have reductions many percentage points more than the uprate percentage. This is due to various factors, such as higher initial fuel temperature for the EPU providing more initial sensible heat to the RCS water in the early time frame after a plant trip than the CLTP condition, or more integrated fluid release out SRVs in the early time frame compared to the CLTP condition.

D-2 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications The HEPs for the MNGP 2005 base (CLTP) PRA and for the EPU condition are summarized in Table D-2.

D-3 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment 020-ISOL-M-Y Fail to isolate a medium or large 8.42E-02 1.2 7.40E-02 1.17 20 min. PRA-CALC-04-007 leak within 20 minutes 030-ISOL-M-Y Fail to isolate a medium or large 3.73E-02 2.21 1.63E-02 1.53 30 min. PRA-CALC-04-007 leak within 30 minutes 030-ISOL-S-Y Fail to isolate a small leak within 30 1.04E-01 1.24 2.05E-02 1.05 30 min. PRA-CALC-04-007 minutes 060-ISOL-M-Y Fail to isolate a medium or large 4.92E-02 17.35 1.17E-01 39.86 60 min. PRA-CALC-04-007 leak within 60 minutes 060-ISOL-S-Y Fail to isolate a small leak within 60 1.62E-02 1.52 1.46E-02 1.47 60 min. PRA-CALC-04-007 minutes 120-ISOL-S-Y Fail to isolate a small leak within 6.90E-03 3.29 8.54E-03 3.84 120 min. PRA-CALC-04-007 120 minutes ALT-INJ-LY Fail to align FPS, RHRSW, CSW, 3.98E-03 6.98 2.1OE-03 3.63 n/a II.SMR.02.008 Execution error contribution, not or SW - hour available TSC time-based. Diagnosis support contribution treated by a separate basic event.

ALT-POWER-Y Fail to align alternate power 3.55E-02 8.07 7.28E-03 2.45 >4hrs PRA-CALC-04-040 Timing based on battery life.

supplies directly to MCC-44 ASDS-DEP-Y Fail to implement depressurization 1.40E-01 14.88 2.86E-02 3.83 1 hr PRA-CALC-04-015 from ASDS panel ATWS-SHT-Y Operator fails to initiate ATWS 1.13E-02 1.00 1.40E-01 1.00 <1 min. II.SMR.02.008 Specific timing not listed in (short time available) II.SMR.02.008, states short time available and HEP=1 assumed.

Diagnosis HEP of 1.0 occurs at 1 min., per ASEP Median and Lower Bound curves.

CHR-DET--Y Fail to identify need for 1.03E-02 10000 3.61 E-02 36100 10 hrs II.SMR.02.008 containment heat removal CRD-LSBYPY Fail to restore CRDH after LOSP 2.21 E-04 1.00 (<5E-3) (<2) 25 min. II.SMR.02.008 Diagnosis timing stated to be 15 and ECCS load shed minutes in II.SMR.02.008. 10 minutes assumed for execution.

CRD-PUMP-Y Fail to start second CRDH pump 6.31 E-03 1.69 1.44E-03 1.16 25 min. II.SMR.02.008 from control room CRD-VALV-Y Fail to maximize CRDH flow - 2.75E-02 1.66 7.32E-03 1.18 25 min. II.SMR.02.008 valves in RB CRIT-DET-Y Fail to detect criticality issue - long (<5E-3) (<2) 7.12E-05 3.37 30 min. II.SMR.02.008 time available D-4 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment CST-FILL-Y Fail to refill the CSTs 3.13E-03 4.13 3.23E-03 4.22 15 hrs PRA-CALC-04-041 DEP-02MN-Y Fail RPV depressurization within 2 1.57E-04 1.00 (<5E-3) (<2) 5 min. II.SMR.02.008 minutes DEP-12MN-Y Fail RPV depressurization within 9.20E-03 2.76 6.83E-03 2.31 15 min. II.SMR.02.008 12 minutes DEP-50MN-Y Fail RPV depressurization within 9.38E-03 53.1 1.1 5E-03 7.38 50 min. II.SMR.02.008 50 minutes DEP-HOUR-Y Fail RPV depressurization >an 2.60E-02 163.49 2.OOE-02 126.18 103 min. II.SMR.02.008 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> available DEP-PD-Y Fail to depressurize reactor after (<5E-3) (<2) 3.64E-02 1.32 2 hrs PRA-CALC-05-008 Assumed to be same time frame core damage, but before vessel as ALT-INJ-PD-Y.

penetration DW-VENT-PRG Fail to prevent H2 burn failing (<5E-3) (<2) 3.51 E-02 1 <30 min. I1.SMR.02.037 containment by vent/purge FLOODRB16Y Fail to flood RB within 1-6 hours 3.23E-02 1.08 2.54E-02 1.06 1-6 hrs PRA-CALC-04-021 after torus leak FW-CNTRL-Y Fail to control FW as high pressure 8.62E-02 19.65 5.90E-02 13.78 15 min. II.SMR.02.008 injection source following transient FW-REFLG-Y Fail to identify reference leg leak 5.33E-04 1.01 9.41 E-05 1.00 7 min. II.SMR.02.008 HPI-CSTS-Y Fail to defeat high torus level 2.04E-03 1.68 8.75E-03 3.91 1 hr II.SMR.02.008 suction transfer LEVEL-05-Y Fail to detect need for injection (<5E-3) (<2) 6.15E-05 1.00 5 min. II.SMR.02.008 within 5 minutes of compelling signal LEVEL-25-Y Fail to detect need for injection 2.43E-03 5.05 4.87E-05 1.08 25 min. II.SMR.02.008 within 25 minutes of compelling signal LEVEL-45-Y Fail to detect need for injection 3.92E-02 3870 2.31 E-03 231.61 45 min. II.SMR.02.008 within 45 minutes of compelling signal L-LONG---Y Operator fails to inject boron using (<5E-3) (<2) (<5E-3) (<2) >1 hr II.SMR.02.008 Turbine is online and not SBLC - long time available isolated from reactor. Many hours available to align SLC.

D-5 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS( 1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment OIL-LOSS-HY Fail to identify need to address loss 9.23E-02 1.83 6.94E-02 1.62 >1 hr PRA-CALC-05-005 of fuel flow to EDG day tanks - high PUMPER-L-Y Fail to provide FPS supply from fire 2.30E-04 1.23 1.76E-03 2.75 6 hrs PRA-CALC-04-042 pumper truck - hours available RCIC-MAN-Y Fail to manually operate RCIC 6.83E-02 2.30 9.86E-02 2.87 n/a PRA-CALC-04-039 Execution error contribution, not time-based. Diagnosis contribution treated by a separate basic event.

REC-EDG-30 Fail to recover EDG within 30 1.55E-01 1.03 1.10E-01 1.02 30 min. II.SMR.02.009 Timing basis is an industry data minutes / modeling preference - timing of this event not impacted by EPU.

REC-EDG-11/6 Fail to recover EDG within 11 1.45E-01 1.05 1.06E-01 1.04 11 hrs II.SMR.02.009 Nominal 6 hr reference point is hours, given failure to recover w/i 6 time to core damage inSBO, hours HPCI or RCIC running until battery failure at t=4hrs, then CD occurs at -t=6.3 hrs.

Nominal 11 hr. point is time to core damage for SBO w/extended HPCI or RCIC operation by allowing large RPV level swings, but batteries ultimately deplete int=6-8 hrs, and CD in -t=l 1hrs.

REC-EDG-16/12 Fail to recover EDG within 16 (<5E-3) (<2) 1.41E-02 1.00 16 hrs II.SMR.02.009 Nominal 12 hr reference point is hours, given failure to recover w/i time to 200F in pool with 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> extended HPCI/RCIC operation during SBO. Nominal 16 hr point is based on Level 2 PRA phenomena issues post RPV melt-through and leading to containment failure.

D-6 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment REC-EDG-3/50 Fail to recover EDG within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 1.55E-01 1.07 1.10E-01 1.00 3 hrs II.SMR.02.009 The nominal 50 min. reference given failure to recover w/i 50 time is the time to CD during an minutes SBO with no injection at t=O.

The nominal 3 hrs point is based on a SBO w/SORV scenario with HPCI operating but eventually runs out of steam power and CD occurs at t=3.3 hrs.

REC-EDG-50/30 Fail to recover EDG within 50 1.55E-01 1.02 1.10E-01 1.01 50 min. II.SMR.02.009 Nominal 30 min. reference point minutes, given failure to recover w/i is an industry data / modeling 30 minutes preference (not changed by EPU). The nominal 50 min.

point is the time to CD during an SBO with no injection at t=0.

REC-EDG-6/3 Fail to recover EDG within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, 1.55E-01 1.15 1.10E-01 1.11 6 hrs II.SMR.02.009 The nominal 3 hrs reference given failure to recover w/i 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> point is based on a SBO w/SORV scenario with HPCI operating but eventually runs out of steam power and CD occurs at t=3.3 hrs. Nominal 6 hr point is time to core damage in SBO, HPCI or RCIC running until battery failure at t=4hrs, then CD occurs at -t=6.3 hrs.

REC-OSP-30 Fail to recover offsite power within 2.17E-03 1 1.21E-01 1.06 30 min. II.SMR.02.009 Timing basis is an industry data 30 minutes / modeling preference - timing of this event not impacted by EPU.

C495070003-7740-04/1 6/01 D-7 D-7 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment REC-OSP-10/6 Fail to recover OSP within 10 (<5E-3) (<2) 2.61 E-02 1.01 10 hrs II.SMR.02.009 Nominal 6 hr reference point is hours, given failure to recover w/i 6 time to core damage in S130, hours HPCI or RCIC running until battery failure at t=4hrs, then CD occurs at -t=6.3 hrs.

Nominal 10 hr time is based on Level 2 containment flooding scenario in which DW vent not initiated, and containment fails at 10 hrs during flood process.

REC-OSP-1 1/6 Fail to recover OSP within 11 1.76E-03 1.00 5.27E-02 1.02 11 hrs II.SMR.02.009 Nominal 6 hr reference point is hours, given failure to recover w/i 6 time to core damage in SBO, hours HPCI or RCIC running until battery failure at t=4hrs, then CD occurs at -t=6.3 hrs.

Nominal 11 hr. point is time to core damage for SBO w/extended HPCI or RCIC operation by allowing large RPV level swings, but batteries ultimately deplete in t=6-8 hrs, and CD in-t=1 1hrs.

REC-OSP-12/11 Fail to recover OSP within 12 1.06E-04 1.00 9.91E-03 1.00 12 hrs II.SMR.02.009 Nominal 11 hr. reference point hours, given failure to recover w/i is time to core damage for SBO 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> w/extended HPCI or RCIC operation by allowing large RPV level swings, but batteries ultimately deplete in t=6-8 hrs, and CD in-t=11hrs. Nominal 12 hr point is time to 200F in pool with extended HPCI/RCIC operation during SBO.

C495070003-7740-0411 8/01 D-8 D-8 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment REC-OSP-16/12 Fail to recover OSP within 16 (<5E-3) (<2) 4.28E-02 1.01 16 hrs II.SMR.02.009 Nominal 12 hr reference point is hours, given failure to recover w/i time to 200F in pool with 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> extended HPCI/RCIC operation during SBO. Nominal 16 hr point is based on Level 2 PRA phenomena issues post RPV melt-through and leading to containment failure.

REC-OSP-22/12 Fail to recover OSP within 22 1.06E-04 1.00 9.91 E-03 1.01 22 hrs II.SMR.02.009 Nominal 12 hr reference point is hours, given failure to recover w/i time to 200F in pool with 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> extended HPCI/RCIC operation during SBO. Nominal 22 hr point is based on SBO with extended HPCI operation off the CST, but ultimately fails on low steam pressure and CD occurs at about t=22 hrs.

REC-OSP-29/30 Fail to recover OSP within 2.9 (<5E-3) (<2) 4.1 5E-02 1.06 2.9 hrs II.SMR.02.009 Nominal 30 min. reference point hours, given failure to recover w/i is an industry data / modeling 30 minutes preference (not changed by EPU). 2.9 hr time based on post-core damage accident progression issues.

REC-OSP-3/50 Fail to recover OSP within 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, 1.79E-03 1.00 7.92E-02 1.11 3 hrs II.SMR.02.009 The nominal 50 min. reference given failure to recover w/i 50 time is the time to CD during an minutes SBO with no injection at t=0.

The nominal 3 hrs is based on a SBO w/SORV scenario with HPCI operating but eventually runs out of steam power and CD occurs at t=3.3 hrs.

C495070003-7740-04/1 8/01 D-9 D-9 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment REC-OSP-34/22 Fail to recover OSP within 34 (<5E-3) (<2) 9.64E-03 1.01 34 hrs II.SMR.02.009 Nominal 22 hr point is based on hours, given failure to recover w/i S130 with extended HPCI 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> operation off the CST, but ultimately fails on low steam pressure and CD occurs at about t=22 hrs.

REC-OSP-50/30 Fail to recover OSP within 50 2.17E-03 1.00 1.21 E-01 1.02 50 min. II.SMR.02.009 Nominal 30 min. reference point minutes, given failure to recover w/i is an industry data / modeling 30 minutes preference (not changed by EPU). The nominal 50 min.

point is the time to CD during an SBO with no injection at t=0.

REC-OSP-6/3 Fail to recover OSP within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, 1.79E-03 1.00 7.88E-02 1.05 6 hrs II.SMR.02.001 The nominal 3 hrs reference given failure to recover w/i 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> point is based on a SBO w/SORV scenario with HPCI operating but eventually runs out of steam power and CD occurs at t=3.3 hrs. Nominal 6 hr point is time to core damage in SBO, HPCI or RCIC running until battery failure at t=4hrs, then CD occurs at -t=6.3 hrs.

RHRCS-MANY Fail to manually operate equipment 2.62E-01 64.57 6.51 E-02 16.82 100 min. II.SMR.02.008 outside of control room before core damage RHR-DHR-AY Fail to align RHR for CHR - ATWS 5.39E-03 1.38 1.84E-02 2.30 25 min. II.SMR.02.008 Diagnosis timing stated to be 20 minutes in II.SMR.02.008. 5 minutes assumed for execution.

RHR-DHR--Y Fail to align RHR for CHR, when 1.57E-03 98.89 5.85E-03 366.33 n/a II.SMR.02.008 Execution error contribution, not attempted (non-ATWS) time-based. Diagnosis contribution treated by a separate basic event.

SD-NOTRIPY Fail to prevent turbine trip while (<5E-3) (<2) 2.73E-04 1.00 5 min. IL.SMR.02.008 shutting down D-1 0 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment SHED-DET-Y Fail to identify load shedding as 1.17E-03 2.17 3.51 E-03 4.50 30 min. II.SMR.02.008 Timing based on battery life and cause of system failure load shedding impact, and not directly on reactor power.

SLC-INI-LY Fail to initiate SLC - long time 1.30E-04 1.32 1.63E-03 5.08 >1 hr II.SMR.02.008 Turbine is online and not available isolated from reactor. Many hours available to align SLC.

SLC-INI-SY Fail to initiate SLC - short time 1.67E-03 1.38 1.95E-02 5.41 13.5 min. II.SMR.02.008 available SLC-LVL1-Y Fail to control reactor level (fail 3.88E-03 1.38 4.51 E-02 5.46 10 min. II.SMR.02.008 Table 3.3-5 of MNGP IPE SLC), given nominal conditions Submittal (referenced by tI.SMR.02.008), and assuming a:

manipulation time of 0.5 mins.

SLC-LVL2-Y Fail to control reactor level (fail 7.00E-04 1.05 8.61 E-03 1.65 13.5 min. II.SMR.02.008 Timing not listed in SLC), given challenging conditions II.SMR.02.008. Time assumed to be same as SLC-INI-SY.

VENT-CHR-Y Fail to align containment venting as (<5E-3) (<2) 1.69E-04 6.45 10 hrs. II.SMR.02.008 Timing not listed in means of CHR II.SMR.02.008. Time assumed I I_ to be same as COND-CHR-Y.

X-DEP-15-Y Operator fails to depressurize (<5E-3) (<2) 6.31E-05 1.01 15 min. II.SMF.02.037 Referenced from time of core reactor within 15 minutes I I _____ I I damage.

< THRESHOLD FOR ACTIONS SCREENED FROM FURTHER ANALYSIS >

ALT-INJ-EY Fail to align FPS, RHRSW, CSW, (<5E-3) (<2) (<5E-3) (<2) n/a II.SMR.02.008 Execution error contribution, or SW within 25 minutes of attempt HEP calculation not directly influenced by available time window. Diagnosis contribution treated by a separate basic event.

ALT-INJ-MY Fail to align FPS, RHRSW, CSW, 2.18E-04 1.05 (<5E-3) (<2) 50 min. II.SMR.02.008 or SW - hour available ALT-INJ-PB-Y Fail to align injection before (<5E-3) (<2) (<5E-3) (<2) 8.5 hrs II.SMF.02.037 containment breach, given RPV breach D-1 1 C495070003-7740-04/1 8/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment ALT-INJ-PD-Y Fail to align injection before RPV (<5E-3) (<2) (<5E-3) (<2) 2 hrs I1.SMF.02.037 breach, given core damage ALT-OIL-Y Fail to align fuel oil supply from gas (<5E-3) (<2) (<5E-3) (<2) >1 hr PRA-CALC-05-005 powered pump ATWS-LNG-Y Fail to initiate ATWS when (<5E-3) (<2) (<5E-3) (<2) n/a II.SMR.02.008 Execution error contribution, attempted HEP calculation not directly influenced by available time window. Diagnosis contribution treated by a separate basic event.

C4H-BOOT-Y Fail to restore loads (boot needed) 1.03E-04 1.00 (<5E-3) (<2) n/a II.SMR.02.008 Execution error contribution, per C.4-H, given load shed HEP calculation not directly identified influenced by available time window. Diagnosis contribution treated by a separate basic event.

C4H-EASY-Y Fail to restore loads (simple CR 1.73E-05 1.00 (<5E-3) (<2) n/a II.SMR.02.008 Execution error contribution, action) per CA-H, given load shed HEP calculation not directly identified influenced by available time window. Diagnosis contribution treated by a separate basic event.

COND-CHR-Y Operator fails to maintain/establish (<5E-3) (<2) (<5E-3) (<2) n/a II.SMR.02.008 Execution error contribution, condenser vacuum HEP calculation not directly influenced by available time window. Diagnosis contribution treated by a separate basic event.

DC-CHARG-Y Fail to identify battery charger (<5E-3) (<2) (<5E-3) (<2) 45 min. II.SMR.02.008 failure, align swing charger DG13-BFD-Y Fail to identify DG13 as means of (<5E-3) (<2) (<5E-3) (<2) >4 hrs II.SMR.02.008 mitigation, implement backfeed FLOODRB12Y Fail to flood RB within 6-12 hours 1.53E-03 1.05 1.18E-03 1.04 6-12 hrs PRA-CALC-04-021 after torus leak D-1 2 C495070003-7740-04/18/01

Monticello Extended Power UprateRisk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment FLOODRB24Y Fail to flood RB to allow SRV (<5E-3) (<2) (<5E-3) (<2) >12 hrs PRA-CALC-04-021 operation (>12 hours available)

FW-DVRSN-Y Fail to identify FW check valve (<5E-3) (<2) (<5E-3) (<2) 50 min. IL.SMR.02.008 failure, manually isolate HPV-MAN-Y Operator fails to manually open (<5E-3) (<2) 3.19E-04 1.01 n/a PRA-CALC-04-044 - Execution error contribution, HPV HEP calculation not directly influenced by available time window. Diagnosis contribution treated by a separate basic event.

LSBLCALTXY Operator fails to inject boron using (<5E-3) (<2) (<5E-3) (<2) n/a IL.SMR.02.008 Execution error contribution, CRDH HEP calculation not directly influenced by available time window. Diagnosis contribution treated by a separate basic event.

OIL-LOSS-MY Fail to align power to non- (<5E-3) (<2) (<5E-3) (<2) >1 hr PRA-CALC-05-005 emergency MCC-31 before EDG fuel is depleted OIL-LOSS-Y Fail to identify need to address loss 5.63E-04 1.56 2.55E-04 1.25 >1 hr PRA-CALC-05-005 of fuel flow to EDG day tanks -

nominal OIL-SUPPLY-Y Fail to maintain oil inventory in (<5E-3) (<2) (<5E-3) (<2) >1 hr PRA-CALC-05-005 EDG fuel oil storage tank PUMPER-S-Y Fail to provide FPS supply from fire 1.41 E-05 1.00 (<5E-3) (<2) 50 min. PRA-CALC-04-042 pumper truck - 50 minutes available RCIC-BYP-Y Fail to bypass RCIC high exhaust (<5E-3) (<2) (<5E-3) (<2) > 4 hrs PRA-CALC-04-021 Time between time of core pressure interlock damage for loss of DHR-induced failure of RCIC due to reaching the RCIC high exhaust pressure interlock setpoint until the time of core damage. Ref.

PRA-CALC-04-021.

D-1 3 C495070003-7740-04/1 8/01

Monticello Extended Power UprateRisk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment R-DHR-PB-Y Fail to align RHR for DHR before (<5E-3) (<2) (<5E-3) (<2) 12 hrs I1.SMF.02.037 Time between time of core containment failure, given core damage for loss of DHR-damage induced SRV closure (t=-22 hrs) until loss of DHR-induced containment failure (t=-34hrs).

Ref. II.SMF.02.037.

REC-EDG-1 0/6 Fail to recover EDG within 10 (<5E-3) (<2) 3.11 E-04 1.00 10 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> REC-EDG-12/11 Fail to recover EDG within 12 (<5E-3) (<2) (<5E-3) (<2) 12 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to rec+B28over w/i 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> REC-EDG-15/12 Fail to recover EDG within 15 (<5E-3) (<2) (<5E-3) (<2) 15 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-EDG-17/12 Fail to recover EDG within 17 (<5E-3) (<2) (<5E-3) (<2) 17 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-EDG-19/12 Fail to recover EDG within 19 (<5E-3) (<2) (<5E-3) (<2) 19 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-EDG-2/30 Fail to recover EDG within 2.1 (<5E-3) (<2) (<5E-3) (<2) 2.1 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 30 minutes REC-EDG-22/12 Fail to recover EDG within 22 (<5E-3) (<2) (<5E-3) (<2) 22 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-EDG-24/22 Fail to recover EDG within 24 (<5E-3) (<2) (<5E-3) (<2) 24 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> REC-EDG-29/30 Fail to recover EDG within 2.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, (<5E-3) (<2) 2.90E-05 1.00 2.9 hrs II.SMR.02.009 given failure to recover w/i 30 minutes D-14 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment REC-EDG-34/22 Fail to recover EDG within 34 (<5E-3) (<2) 2.18E-03 (<2) 34 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> REC-EDG-35/22 Fail to recover EDG within 35 (<5E-3) (<2) (<5E-3) (<2) 35 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> REC-EDG-5/3 Fail to recover EDG within 5.3 (<5E-3) (<2) (<5E-3) (<2) 5.3 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> REC-EDG-9/6 Fail to recover EDG within 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, (<5E-3) (<2) (<5E-3) (<2) 9 hrs II.SMR.02.009 given failure to recover w/i 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> REC-OSP-15/12 Fail to recover OSP within 15 (<5E-3) (<2) (<5E-3) (<2) 15 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-OSP-17/12 Fail to recover OSP within 17 (<5E-3) (<2) (<5E-3) (<2) 17 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-OSP-19/12 Fail to recover OSP within 19 (<5E-3) (<2) (<5E-3) (<2) 19 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> REC-OSP-2/30 Fail to recover OSP within 2.1 (<5E-3) (<2) 9.93E-05 1.00 2.1 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 30 minutes REC-OSP-24/22 Fail to recover OSP within 24 (<5E-3) (<2) (<5E-3) (<2) 24 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> REC-OSP-35/22 Fail to recover OSP within 35 (<5E-3) (<2) (<5E-3) (<2) 35 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> REC-OSP-5/3 Fail to recover OSP within 5.3 (<5E-3) (<2) 3.79E-04 1.00 5.3 hrs II.SMR.02.009 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, given failure to recover w/i 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> REC-OSP-9/6 Fail to recover OSP within 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, (<5E-3) (<2) (<5E-3) (<2) 9 hrs li.SMR.02.009 given failure to recover w/i 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> D-1 5 C495070003-7740-04/18/01

Monticello Extended Power UprateRisk Implications Table D-1

SUMMARY

OF OPERATOR ACTION SCREENING PROCESS(1 )

Basis for Action Timing Allowable Operator RAW RAW Action Action ID Action Description FV (CDF) (CDF) FV (LERF) (LERF) Timing MNGP Reference Comment RHR-SDC--Y Fail to align RHR for DHR in SDC (<5E-3) (<2) (<5E-3) (<2) 10 hrs. II.SMR.02.008 Timing not listed in mode II.SMR.02.008. Time assumed

-to be same as COND-CHR-Y.

RHRSW-CHRY Fail to bypass load shed and start (<5E-3) (<2) (<5E-3) (<2) 10 hrs. II.SMR.02.008 Timing not listed in pump II.SMR.02.008. Time assumed to be same as COND-CHR-Y.

SBO-ALIGNY Fail to align HPCI/RCIC or load 1.40E-04 1.03 (<5E-3) (<2) 70 min. II.SMR.02.008 shed to prolong injection capabilities SBODETECTY Fail to determine need to address (<5E-3) (<2) (<5E-3) (<2) 5 hrs II.SMR.02.008 SBO within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> SLC-CRD-Y Fail to inject boron using CRDH (<5E-3) (<2) (<5E-3) (<2) n/a II.SMR.02.008 Execution error contribution, HEP calculation not directly influenced by available time window. Diagnosis contribution treated by a separate basic event.

(1) This operator action screening was performed using the 2005 Monticello PRA averagemaintenance model (fault tree Risk-T&M.caf).

C495070003-7740-04/1 8/01 D-1 66 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment 020-ISOL-M-Y Fail to isolate a medium or 20 min. 20 min. 3.OOE-01 3.00E-01 Based on time to equipment submergence large leak within 20 minutes due to internal flooding and not dependent on reactor power.

030-ISOL-M-Y Fail to isolate a medium or 30 min. 30 min. 3.00E-02 3.00E-02 Based on time to equipment submergence large leak within 30 minutes due to internal flooding and not dependent on reactor power.

030-ISOL-S-Y Fail to isolate a small leak 30 min. 30 min. 3.OOE-01 3.OOE-01 Based on time to equipment submergence within 30 minutes due to internal flooding and not dependent on reactor power.

060-ISOL-M-Y Fail to isolate a medium or 60 min. 60 min. 3.OOE-03 3.OOE-03 Based on time to equipment submergence large leak within 60 minutes due to internal flooding and not dependent on reactor power.

060-ISOL-S-Y Fail to isolate a small leak 60 min. 60 min. 3.OOE-02 3.OOE-02 Based on time to equipment submergence within 60 minutes due to internal flooding and not dependent on reactor power.

120-ISOL-S-Y Fail to isolate a small leak 120 min. 120 min. 3.OOE-03 3.OOE-03 Based on time to equipment submergence within 120 minutes due to internal flooding and not dependent on reactor power.

ALT-INJ-LY Fail to align FPS, RHRSW, n/a n/a 8.OOE-04 8.OOE-04 Execution Error: No impact on HEP, this CSW, or SW - hour available event is solely execution error (diagnosis TSC support error addressed by separate event).

ALT-POWER-Y Fail to align alternate power >4hrs >4hrs 5.OOE-03 5.OOE-03 Timing based on battery life and not directly supplies directly to MCC-44 on reactor power (action timing for this HEP does not explicitly credit the additional time until core damage after DC batteries deplete).

ASDS-DEP-Y Fail to implement 1 hr 50 min. 1.OOE-02 1.OOE-02 MNGP EPU MAAP runs MNGPEPU8a and depressurization from ASDS MNGPEPU8ax show time window reduced panel to approximately 50 min. for EPU case.

Screening HEP not impacted by EPU.

ATWS-SHT-Y Operator fails to initiate ATWS <1 min. <1 min. 1.OOE+00 1.OOE+00 ASEP Upper Bound TRC curve.

(short time available) I I111 C495070003-7740-04/1 8/01 D-1 7 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment CHR-DET--Y Fail to identify need for 8 hrs 6.8 hrs 1.OOE-06 1.00E-06 Diagnosis Error: Timing based on time to containment heat removal SP/T = 200F for transients with no SPC.

MNGP EPU MAAP run MNGPEPU9 shows the time is t=6.8 hrs for EPU condition.

ASEP Lower Bound TRC curve, and 1E-6 HEP minimum threshold in MNGP PRA.

HEP unchanged.

CRD-LSBYPY Fail to restore CRDH after 25 min. 21 min 8.00E-02 1.23E-01 MNGP EPU MAAP runs MNGPEPU5d and LOSP and ECCS load shed MNGPEPU5dx show that the time available is reduced approximately 15% for the EPU (using times to maximize core temp). EPU diagnosis time is 11 min. and execution time is 10 min. ASEP Median TRC curve.

CRD-PUMP-Y Fail to start second CRDH 25 min. 21 min 9.00E-03 1.40E-02 MNGP EPU MAAP runs MNGPEPU5d and pump from control room MNGPEPU5dx show that the time available is reduced approximately 15% for the EPU (using times to maximize core temp). EPU diagnosis time is 20 min. and execution time is 1 min. ASEP Median TRC curve.

CRD-VALV-Y Fail to maximize CRDH flow - 25 min. 21 min 4.00E-02 5.27E-02 MNGP EPU MAAP runs MNGPEPU5i and valves in RB MNGPEPU5ix show that the time available is reduced approximately 15% for the EPU (using times to maximize core temp). EPU diagnosis time is 14 min. and execution time is 7 min. ASEP Median TRC curve.

CRIT-DET-Y Fail to detect criticality issue - 30 min. 30 min. 1.1 8E-04 1.18E-04 Diagnosis Error: This action error applies long time available to ATWS scenarios in which the turbine is online. An indefinite, long time is available to the operator; the PRA conservatively assumes 30 mins. available. This timing assumption is not changed by the EPU.

ASEP Lower Bound TRC curve. Base PRA mistakenly used 40 min. for the HEP calculation; base HEP revised in this calculation to use the correct base value of 30 min.

D-1 8 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment CST-FILL-Y Fail to refill the CSTs >15 hrs <15 hrs 1.00E-03 1.00E-03 Timing based on CST inventory depletion due to use for RPV coolant makeup long term. CLTP PRA assumes time available

>15 hrs, and 1 hr required for alignment.

EPU time available would be reduced, but would have to be reduced unrealistically (by 10 hrs or more) to change the CLTP HEP which is dominated by execution error. ASEP Median TRC curve.

DEP-02MN-Y Fail RPV depressurization 5 min. 4.4 min. 2.50E-01 5.10E-01 This action used in isolation ATWS within 2 minutes scenarios with failure of all HP injection.

The CLTP PRA estimates 5 minutes available (diagnosis time of 2 min. and execution time of 3 min.). MNGP EPU MAAP runs MNGPEPU7a and MNGPEPU7ax show that this timing is not reduced significantly (<10%) for the EPU, a 13% reduction is assumed in the EPU risk assessment. EPU time available is estimated at 4.4 min. (diagnosis time of 1.4 min. and execution time of 3 min.). ASEP Lower Bound TRC curve. CLTP base PRA mistakenly used 3 min. diagnosis for the HEP calculation; base HEP revised in this calculation to use the correct base diagnosis time of 2 min.

DEP-1 2MN-Y Fail RPV depressurization 15 min. 13.1 min. 5.20E-03 9.84E-03 This action is applicable to MLOCA within 12 minutes scenarios with no HP injection available.

MNGP EPU MAAP runs MNGPEPU8b and MNGPEPU8bx indicate that the time is reduced 10-13% for the EPU, a 13%

reduction is assumed for the EPU. EPU time available estimated at 13.1 min (diagnosis time of 10.1 min. and execution time of 3 min.). ASEP Lower Bound TRC curve.

D-1 9 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment DEP-50MN-Y Fail RPV depressurization 50 min. 42 min. 1.80E-04 1.90E-04 This action is applicable to non-LOCA and within 50 minutes non-ATWS scenarios with no HP injection available. MNGP EPU MAAP runs MNGPEPU8a and MNGPEPU8ax shows that this timing is reduced approximately 16% for the EPU. EPU time available estimated at 42 min. (diagnosis time is 39 min. and execution time of 3 min). ASEP Lower Bound TRC curve.

DEP-HOUR-Y Fail RPV depressurization >an 103 min. 103 min. 1.60E-04 1.60E-04 This action is applicable to non-LOCA and hour available non-ATWS scenarios with HP injection initially available, but RPV ED required later for other reasons (e.g., HCTL, HP injection failure). CLTP assumes a diagnosis time of 100 minutes, and an execution time of 3 mins. MNGP EPU MAAP runs MNGPEPU8c and MNGPEPU8d show that for scenarios requiring late RPV ED due to issues such as HCTL or HP injection failure significantly more than 100 mins. remain before core damage occurs. Thus, the CLTP time available for this action is unchanged for the EPU. ASEP Lower Bound TRC curve.

DEP-PD-Y Fail to depressurize reactor 2 hrs -2 hrs 1.00E-01 1.O0E-01 Timing based on post-core damage after core damage, but before accident progression assumptions and time vessel penetration to RPV melt-through. Screening HEP not impacted by EPU.

DW-VENT-PRG Fail to prevent H2 burn failing < 30 min. < 30 min. 1.00E+00 1.00E+00 containment by vent/purge I FLOODRB16Y Fail to flood RB within 1-6 1-6 hrs 1-6 hrs. 3.OOE-01 3.OOE-01 Timing based on internal flooding issues hours after torus leak and not directly on reactor power.

D-20 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment FW-CNTRL-Y Fail to control FW as high 15 min. 12 min. 4.60E-03 5.46E-03 The available action time is based on the pressure injection source time to reach TAF for an isolation transient following transient with loss of all HP injection. MNGP EPU MAAP run MNGPEPU8a show that this time is approximately t=12 min. for the EPU power level. EPU time available estimated at 12 mins (diagnosis time of 11 min. and execution time of 1 min.). ASEP Lower Bound TRC curve.

FW-REFLG-Y Fail to identify reference leg 7 min. 5.5 min. 4.OOE-02 6.94E-02 The time available is based on the time to leak reach TAF for a ref. leg break event with no high pressure injection. Time available for CLTP estimated at t=7 mins. MNGP EPU MAAP runs MNGPEPU6c, MNGPEPU6cx, MNGPEPU1 b and MNGPEPU1 bx indicate that this time frame is reduced approximately 20-22% due to the EPU.

EPU time available estimated at 5.5 mins.

(diagnosis time of 4.5 min. and execution time of 1 min.). ASEP Lower Bound TRC curve.

HPI-CSTS-Y Fail to defeat high torus level 1 hr 1 hr 3.OOE-03 3.OOE-03 This action applies to scenarios with pool suction transfer temperature reaching 200F and need to switch HPCI/RCIC suction to CST to prevent failure of pump due to overheating.

Timing of 1 hr. used in CLTP not based directly on reactor power, this time is not adjusted for the EPU. ASEP Lower Bound TRC curve.

D-21 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment LEVEL-05-Y Fail to detect need for injection 30 min. 26 min. 5.OOE-02 1.OOE+00 Diagnosis Error: Time available in CLTP within 5 minutes of compelling PRA based on time to core damage for signal SLOCA type scenarios with no HP injection, estimated at t=30 minutes and 25 minutes to execute the action (thus, 5 min.

diagnosis time). MNGP EPU MAAP runs MNGPEPU6c and MNGPEPU6cx show that this time frame is reduced to approximately t=26 mins (thus, 1 min.

diagnosis time). ASEP Lower Bound TRC curve.

LEVEL-25-Y Fail to detect need for injection 50 min. 42 min. 6.00E-04 1.72E-03 Diagnosis Error: This action is applicable within 25 minutes of compelling to non-LOCA and non-ATWS scenarios signal with no HP injection available. The CLTP PRA estimates the available window at 50 minutes and 25 minutes to execute the action (thus, 25 min. diagnosis time).

MNGP EPU MAAP runs MNGPEPU8a and MNGPEPU8ax shows that this timing is reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

(diagnosis time is 17 min. and execution time of 25 min). ASEP Lower Bound TRC curve.

D-22 C495070003-7740-04/1 8/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) 0113% CLTP) Base HEP EPU HEP Comment LEVEL-45-Y Fail to detect need for injection -1 hr -1 hr. 1.OOE-05 1.OOE-05 Diagnosis Error: This action is applicable within 45 minutes of compelling to non-LOCA and non-ATWS scenarios signal with HP injection initially available, but RPV ED required later for other reasons (e.g.,

HCTL, HP injection failure). CLTP assumes diagnosis time available is 45 minutes, then an additional 25 minutes for execution (thus, total time available greater than 1 hr.) MNGP EPU MAAP runs MNGPEPU8c and MNGPEPU8d show that for scenarios requiring late RPV ED due to issues such as HCTL or HP injection failure that significantly more than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> remains before core damage occurs. Thus, the CLTP diagnosis time for this action of 45 mins. is unchanged for the EPU. ASEP Lower Bound TRC curve.

L-LONG---Y Operator fails to inject boron >1 hr >1 hr 4.OOE-04 4.OOE-04 This action error applies to ATWS using SBLC - long time scenarios in which the turbine is online. An available indefinite, long time is available to the operator; the PRA conservatively assumes

> 1 hr. available. This timing assumption would not be changed by the EPU. ASEP Lower Bound TRC curve. In addition, the HEP is dominated by execution error.

OIL-LOSS-HY Fail to identify need to address >1 hr >1 hr 1.O0E-01 1.00E-01 Timing based on EDG fuel consumption loss of fuel flow to EDG day and not directly on reactor power.

tanks - high I Screening HEP not impacted by EPU.

D-23 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment PUMPER-L-Y Fail to provide FPS supply from 6 hrs 6 hrs 1.00E-03 1.00E-03 The available time is estimated in the CLTP fire pumper truck - hours PRA based on the time to core damage for available an SBO, with HPCI or RCIC initial operation but subsequent failure due to battery depletion. The CLTP PRA estimates that >6hrs are available before core damage in such scenarios (t=6 hrs is used in the CLTP PRA for this HEP).

MNGP EPU MAAP run MNGPEPU8c shows core damage occurs at t=6.6 hrs for such scenarios for the EPU. As such, the 6 hr available time for this action is not adjusted for the EPU. ASEP Median TRC curve. Dominated by execution error.

RCIC-MAN-Y Fail to manually operate RCIC n/a n/a 5.00E-02 5.00E-02 Execution Error: No impact on HEP, this event is solely execution error (diagnosis error addressed by separate event).

REC-EDG-30 Fail to recover EDG within 30 30 min. 30 min. 8.5E-01 8.5E-01 Timing based on industry data and minutes associated LOOP event tree modeling assumptions. Timing and probability not impacted by EPU.

REC-EDG-1 1/6 Fail to recover EDG within 11 11 hrs / 11 hrs / 7.3E-01 7.3E-01 Nominal times of 11 hrs and 6 hrs still hours, given failure to recover 6 hrs 6 hrs appropriate for EPU (see EPU MAAP run w/i 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> MNGPEPU8c). Existing recovery failure probability already high. Time frame is long and AC recovery curves flatten out at such lengthy time frames, such that any postulated change to this recovery probability would not have a significant impact on risk.

REC-EDG-12/11 Fail to recover EDG within 12 12 hrs / 11 hrs / 9.3E-01 1.OE+00 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 11 hrs 11 hrs t=1 2 hr time frame is reduced to w/i 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> approximately t=W 1 hrs for the EPU.

REC-EDG-16/12 Fail to recover EDG within 16 16 hrs / 16 hrs / 9.OE-01 8.5E-01 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 12 hrs 11 hrs t=12 hr time frame is reduced to w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> approximately t=W 1 hrs for the EPU.

D-24 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment REC-EDG-22/12 Fail to recover EDG within 22 22 hrs / 22 hrs / 7.3E-01 6.5E-01 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 12 hrs 11 hrs t=12 hr time frame is reduced to w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> approximately t=1 1 hrs for the EPU.

REC-EDG-3/50 Fail to recover EDG within 3 3 hrs /50 mins. 3 hrs /42 mins. 6.9E-01 6.6E-01 MNGP EPU MAAP runs MNGPEPU8a and hours, given failure to recover MNGPEPU8ax shows that this timing is w/i 50 minutes reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

REC-EDG-50/30 Fail to recover EDG within 50 50 min. I 42 min. 9.1 E-01 9.4E-01 MNGP EPU MAAP runs MNGPEPU8a and minutes, given failure to 30 min. 30 min. MNGPEPU8ax shows that this timing is recover w/i 30 minutes reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

REC-EDG-6/3 Fail to recover EDG within 6 6 hrs / 6 hrs / 5.1 E-01 5.1E-01 Nominal times of 6 hrs and 3 hrs still hours, given failure to recover 3 hrs 3 hrs judged reasonable for EPU.

wli 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> REC-OSP-30 Fail to recover offsite power 30 min. 30 min. 6.8E-01 6.8E-01 Timing based on industry data and within 30 minutes associated LOOP event tree modeling assumptions. Timing and probability not impacted by EPU.

REC-OSP-10/6 Fail to recover OSP within 10 10 hrs / 10 hrs / 8.OE-01 8.OE-01 Nominal times of 10 hrs and 6 hrs still hours, given failure to recover 6 hrs 6 hrs judged reasonable for EPU.

w/i 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> REC-OSP-1 1/6 Fail to recover OSP within 11 11 hrs / 11 hrs / 7.5E-01 7.5E-01 Nominal times of 11 hrs and 6 hrs still hours, given failure to recover 6 hrs 6 hrs appropriate for EPU (see EPU MAAP run w/i 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> MNGPEPU8c). Existing recovery failure probability already high. Time frame is long and AC recovery curves flatten out at such lengthy time frames, such that any postulated change to this recovery probability would not have a significant impact on risk.

REC-OSP-12/11 Fail to recover OSP within 12 12 hrs / 11 hrs / 9.2E-01 1.OE+00 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 11 hrs 11 hrs t=12 hr time frame is reduced to w/i 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> approximately t=1 1 hrs for the EPU.

REC-OSP-16/12 Fail to recover OSP within 16 16 hrs / 16 hrs / 8.0E-01 7.3E-01 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 12 hrs 11 hrs t=12 hr time frame is reduced to w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> I I I approximately t=1 1 hrs for the EPU.

D-25 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (113% CLTP) Base HEP EPU HEP Comment REC-OSP-22/12 Fail to recover OSP within 22 22 hrs/ 22 hrs / 5.OE-01 4.5E-01 MAAP run MNGPEPU8d indicates that the hours, given failure to recover 12 hrs 11 hrs t=12 hr time frame is reduced to w/i 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> approximately t=1 1 hrs for the EPU.

REC-OSP-29/30 Fail to recover OSP within 2.9 2.9 hrs / 2.9 hrs / 4.2E-01 4.2E-01 No change assumed for 2.9 hr post-core hours, given failure to recover 30 min. 30 min. damage progression time frame, time w/i 30 minutes reasonable.

REC-OSP-3/50 Fail to recover OSP within 3 3 hrs / 3 hrs / 4.3E-01 4.1 E-01 MNGP EPU MAAP runs MNGPEPU8a and hours, given failure to recover 50 mins. 42 mins. MNGPEPU8ax shows that this timing is w/i 50 minutes reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

REC-OSP-34/22 Fail to recover OSP within 34 34 hrs/ 34 hrs / 5.OE-01 5.0E-01 Existing recovery failure probability already hours, given failure to recover 22 hrs 22 hrs high. Time frame is long and AC recovery w/i 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> curves flatten out at such lengthy time frames, such that any postulated change to this recovery probability would not have a significant impact on risk.

REC-OSP-50/30 Fail to recover OSP within 50 50 min. / 42 min. / 8.5E-01 9.OE-01 MNGP EPU MAAP runs MNGPEPU8a and minutes, given failure to 30 min. 30 min. MNGPEPU8ax shows that this timing is recover w/i 30 minutes reduced approximately 16% for the EPU.

EPU time available estimated at 42 min.

REC-OSP-6/3 Fail to recover OSP within 6 6 hrs / 3 hrs 6 hrs / 3 hrs 6.OE-01 6.OE-01 Nominal times of 6 hrs and 3 hrs still hours, given failure to recover judged reasonable for EPU.

w/i 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> D-26 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment RHRCS-MANY Fail to manually operate 100 min. 100 min. 4.1OE-03 4.10E-03 This action is applicable to non-LOCA and equipment outside of control non-ATWS scenarios with HP injection room before core damage initially available, but RPV ED required later for other reasons (e.g., HCTL, HP injection failure). CLTP assumes time available is 100 minutes (diagnosis time of 90 min. and execution time of 10 min.). MNGP EPU MAAP runs MNGPEPU8c and MNGPEPU8d show that for scenarios requiring late RPV ED due to issues such as HCTL or HP injection failure that more than 100 mins. remain before core damage occurs. Thus, the CLTP time in this action of 100 mins. is unchanged for the EPU.

ASEP Median TRC curve. Dominated by execution error.

RHR-DHR-AY Fail to align RHR for CHR - 25 min. 21.8 min. 1.40E-02 2.19E-02 This action is applicable to ATWS ATWS scenarios with HP injection and successful SLC. Time available to align SPC depends upon time of SLC injection and whether the initiator is an isolation event. CLTP PRA assumes that 25 minutes are available (diagnosis time of 20 mins. and execution time of 5 mins.). This time isjudged conservative. MNGP EPU runs MNGPEPU7b, MNGPEPU7bx, MNGPEUP7c and MNGPEPU7cx show that with delayed SLC injection and no SPC initiation, critical impacts do not occur until about t=45 mins when the pool reaches 200F and HPCI operability become an issue. Although the 25 min. time available estimate from the CLTP is judged still appropriate for the EPU, the EPU risk assessment reduces this time available by 13% to t=21.8 mins (diagnosis time of 16.8 min. and execution time of 5 min.). ASEP Median TRC curve.

D-27 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment RHR-DHR--Y Fail to align RHR for CHR, 8 hrs. 6.8 hrs 1.60E-05 1.60E-05 Execution Error: Time window same as for when attempted (non-ATWS) CHR-DET-Y; however, this is an execution error contribution, the low error rate is due to multiple applicable error recovery factors (long time frame, other operators, etc.).

The reduction in time available due to the EPU does not change the execution error rate. Diagnosis contribution treated by separate basic event CHR-DET--Y.

SD-NOTRIPY Fail to prevent turbine trip while 5 min. 4.4 min. 2.OOE-01 2.27E-01 This action is for bypassing the MSIV level shutting down interlocks and is applicable to ATWS scenarios with the MSIVs open. The time available depends upon a number of factors, such as which HP systems are available and how long operators take to reduce level. The CLTP PRA assumes the available diagnosis time is t=5 min. The CLTP diagnosis time is reduced 13% for the EPU. ASEP Median TRC curve. Base PRA mistakenly selected 0.3 off the ASEP curve instead of the correct base value of 0.20; base HEP revised in this calculation to use the correct base HEP of 0.20.

SHED-DET-Y Fail to identify load shedding 30 min. 30 min. 1.OOE-03 1.00E-03 Timing based on battery life and load as cause of system failure shedding impact. Timing and probability not impacted by EPU.

SLC-INI-LY Fail to initiate SLC - long time >1 hr >1 hr. 4.OOE-04 4.00E-04 This action error applies to ATWS available scenarios in which the turbine is online. An indefinite, long time is available to the operator; the PRA assumes > 1 hr.

available. This timing assumption is not changed by the EPU. ASEP Lower Bound TRC curve. In addition, the HEP is dominated by execution error.

D-28 C495070003-7740-04/18/01

Monticello Extended Power Uprate Risk Implications Table D-2 RE-ASSESSMENT OF KEY OPERATOR ACTION HEPs FOR THE EPU Allowable Action Time Current PRA EPU Power Action ID Action Description Power (CLTP) (113% CLTP) Base HEP EPU HEP Comment SLC-INI-SY Fail to initiate SLC - short time 13.5 min. 11.8 min. 4.40E-03 6.17E-03 Total time available reduced 13%. MNGP available EPU MAAP runs MNGPEPU7a, MNGPEPU7b, and MNGPEPU7c show that that such a time frame for SLC injection is successful for the EPU condition. ASEP Lower Bound TRC curve.

SLC-LVL1-Y Fail to control reactor level (fail 10 min. 8.7 min. 1.00E-02 1.53E-02 Total time available reduced 13%. EPU SLC), given nominal conditions diagnosis time of 8.2 min. and execution time of 0.5 min. ASEP Lower Bound TRC curve.

SLC-LVL2-Y Fail to control reactor level (fail 13.5 min. 11.8 min. 1.30E-02 1.97E-02 Total time available reduced 13%. EPU SLC), given challenging diagnosis time of 11.3 min. and execution conditions time of 0.5 min. ASEP Lower Bound TRC curve.

VENT-CHR-Y Fail to align containment 8 hrs. 6.8 hrs 3.10E-05 3.68E-05 Timing based on time to SP/T = 200F for venting as means of CHR transients with no SPC. MNGP EPU MAAP run MNGPEPU9 shows the time is t=6.8 hrs for EPU condition. ASEP Median TRC curve.

X-DEP-15-Y Operator fails to depressurize 15 min. 15 min. 5.20E-03 5.20E-03 This action is used in high pressure AIWS reactor within 15 minutes core damage scenarios. The CLTP PRA assumes 15 min. available (diagnosis time of 12 min. and execution time of 3 mins.).

The time available is based on post-accident progression modeling assumptions and not directly on core power. This time frame is not changed for the EPU. ASEP Lower Bound TRC curve.

D-29 C495070003-7740-04/18/01

Appendix E MNGP EPU MAAP CALCULATIONS

Monticello Extended Power Uprate Risk Implications Appendix E MNGP EPU MAAP CALCULATIONS The Modular Accident Analysis Package (MAAP) is used to calculate changes in the thermal hydraulic profile for specific issues (e.g., boildown timing) to support the MNGP EPU risk assessment.

MAAP is an industry recognized thermal hydraulics code used to evaluate design basis and beyond design basis accidents. MAAP (Version 4.0.6) and the latest MNGP MAAP parameter file (M0406_061907.par)have been used in this evaluation. The parameter file contains plant specific parameters representing the primary system and containment.

MAAP cases of various accident scenarios were defined and run to identify changes in timings and success criteria due to the EPU. A separate run was made for the CLTP power and for the EPU power level for each analyzed accident scenario. The pre-EPU version of each scenario is identified with an 'x' in the case identifier (e.g., Case MNGPEPUla is an EPU power run and Case MNGPEPUlax is the corresponding CLTP power run). A summary of the MAAP runs performed in support of this risk assessment is provided in Tables E-1 (Level 1 PRA runs) and Table E-2 (Level 2 PRA runs).

LOFW, SORV and RCIC In addition to performing MAAP runs to identify accident timing and success criteria changes for consideration in the EPU risk assessment, multiple MAAP runs were performed to address NUREG-0737 Item II.K.3.44 (adequate core cooling for LOFW with an additional single failure) for the MNGP EPU. These scenarios are identified here as cases MNGPEPU2a and MNGPEPU2b. These scenarios are Loss of Feedwater (LOFWV) initiated events with a SORV and RCIC as the initial high pressure injection source.

E-1 E-1 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Case MNGPEPU2a is designed to prevent RPV emergency depressurization. In this scenario, LOFW is the initiating event (no credit is given for FW coast down flow into the RPV). One (1) SRV sticks open during the initial pressure transient and remains stuck open throughout the run. RCIC is the only high pressure injection source and it auto initiates as designed. RCIC is not sufficient to prevent RPV level dipping below TAF; however, adequate core cooling is maintained throughout the sequence. When RPV pressure reduces sufficiently to the LP ECCS interlock pressure, one (1) train of LPCI auto injects into the RPV (RCIC subsequently trips on low steam pressure). LPCI flow into the RPV begins at t=25 mins. (pool temperature at this time is 11 OF).

Case MNGPEPU2b is similar to the case above except that RPV emergency depressurization is initiated at TAF using 2 SRVs. Like the previous case, RCIC is not sufficient to prevent level dipping below TAF; however, adequate core cooling is maintained throughout the sequence. After RPV depressurization at TAF, one (1) train of LPCI auto injects into the RPV. LPCI flow into the RPV begins at t=7 mins in this case (pool temperature at this time is 100F).

E-2 E-2 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4 ) Height(5 ) >2200 °F(l) MSCWLL(4) Run Comments MNGPEPU1a MSIV Closure, no HP injection, delayed o Verify 1 SRV sufficient for 13 min. 25 min. 32 min. 18 min. 5 hr. Max RPV pressure of ED, and 1 LPCI pump pressure control to prevent Max. temp. MSCWLL 1530 psia when only 1

" EPU power level exceeding RPV pressure of 1400°F SRV available.

• MSIV Closure at t=0 (FW coast down operability limits for Sensitivity case flow credited) Transients MNGPEPU1 aa shows

• Verify 1 SRV sufficient for success with 2 SRVs

" Only 1 SRV available for initial RPV ED for Transients available (max. RPV pressure transient press. of 1427 psia).

" No HP injection Thus, EPU requires 2

" Initiate Emergency RPV SRVs for RPV Depressurization (using only 1 SRV) Overpressure at MSCWLL Protection during

" Initiate 1 LPCI pump at LP interlock isolation transients.

" SPC w/1 RHR train initiated at pool RPV ED initiated at temp. 90F(3) t=18 (MSCWLL) min.

with 1 SRV. -Thus, one SRV sufficient for RPV ED for EPU for Transients and SLOCAs when LP ECCS available.

E-3 E-3 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF( 4') Height"') >2200 °F(l) MSCWLL(4) Run Comments MNGPEPU1ax Same as MNGPEPU1 a except Pre- <Same as case above> 16 min. 30 min. 36 min. 23 min. 5 hr. Max RPV Press 1443 EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL psia. Thus, one SRV of 1225°F sufficient for RPV Overpressure Protection for CLTP for transients with MSIV closure.

RPV ED initiated at t=23 min. (MSCWLL) with I SRV. Thus, one SRV sufficient for RPV ED for CLTP for Transients and SLOCAs when LP ECCS available.

E-4 E-4 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF (4) Height(5) >2200 OF(') MSCWLL(4) Run Comments MNGPEPU1 b LOFW, no HP injection, delayed ED, Verify 1 SRV sufficient fo& 7 min. 20 min. 26 min. 13 min. 5 hr. Same as Case and 1 LPCI pump pressure control to prevent Max. temp. MSCWLL MNGPEPU1 a except

" EPU power level exceeding RPV pressure of 1425°F LOFW at t=0 and

" LOFW at t=0 (no FW coast down flow operability limits for MSIVs initially open credited) Transients until then isolate on low credted)RPV water Level.

" MSIVs remain open until isolate on Verify 1 SRV sufficient for low RPV level RPV ED for Transients Max RPV Press 1068

" Only 1 SRV available for initial psia. Therefore, cases pressure transient MNGPEPUl1a and

• No HP injection MNGPEPUl1a_a bound

" Initiate Emergency RPV the RPV Overpressure Depressurization (using only 1 SRV) SRV success criteria at MSCWLL for Transients with MSIV closure for the

" Initiate 1 LPCI pump at LP interlock EPU c ondtin

• EPUI condition.

• SPC w/1 RHR train initiated at pool temp. 90°F (3) RPV ED initiated at t=13 min. (MSCWLL) with 1 SRV. Thus, one SRV sufficient for RPV ED for EPU for Transients and SLOCAs when LP ECCS available.

E-5 E-5 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4' Height(5 ) >2200 'F( 1 ) MSCWLL(4) Run Comments MNGPEPUlbx Same as MNGPEPUlb except Pre- <Same as case above> 9 min. 24 min. 30 min. 16 min. 5 hr. Max RPV Press 1068 EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL psia. Therefore, case of 1230'F MNGPEPU1 ax bounds the RPV Overpressure SRV success criteria for Transients with MSIV closure for the CLTP condition.

RPV ED initiated at t=16 min. (MSCWLL) with 1 SRV. Thus, one SRV sufficient for RPV ED for CLTP for Transients and SLOCAs when LP ECCS available.

MNGPEPU2 MSIV Closure, no initial HP injection, no

• Verify time allowable for 12 min. 35 min. 53 min. 18 min. 2.5 hr. RCIC initiated at t=45 RPV ED, and RCIC initiated late manual initiation of RCIC Max. temp. MSCWLL min. RCIC initiation

• EPU power level during Transient of 2060'F time iterated to

• MSIV Closure at t=0 (no FW coast determine latest time down flow credited) allowable for initiation in order to prevent core

• All SRVs/SVs available for initial damage.

pressure control

• No HP injection initially This case shows that

" No RPV ED RClC initiation can be

• Iterate to determine time when delayed for EPU until initiation of RCIC prevents core t=45 min. and prevent core damage for an damage MSIV Closure with loss

" SPC w/1 RHR train initiated at pool of all other injection 3

temp. 90'F( ) and no RPV ED.

E-6 E-6 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(41 Height(5 ) >2200 °F"1 ) MSCWLL(4) Run Comments MNGPEPU2x Same as MNGPEPU2 except Pre-EPU <Same as case above> 16 min. 43 min. 1.0 hr. 23 min. 2.5 hr. RCIC initiated at t=55 (CLTP) power of 1775 MWth. Max. temp. MSCWLL min. RCIC initiation of 1930'F time iterated to determine latest time allowable for initiation in order to prevent core damage.

This case shows that RCIC initiation can be delayed for CLTP until t=55 min. and prevent core damage for an MSIV Closure with loss of all other injection and no RPV ED.

E-7 E-7 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5 ) >2200 °F(1 ) MSCWLL(4) Run Comments MNGPEPU2a LOFW, SORV, RCIC for initial injection, Verify that RCIC and then 1 4 min. n/a n/a 6 min. 2.5 hr. RCIC auto initiates but no RPV ED, and 1 LPCI pump LPCI pump is sufficient to Max. temp. MSCWLL fails to maintain level

" EPU power level prevent core damage during at t=O such that level dips

• LOFW at t=0 (no FW coast down flow LOFW w/SORV below TAF. One (1)

LPCI pump injects credited) when RPV pressure

" MSIVs remain open until isolate on drops to the ECCS LP low RPV level interlock (RCIC

" All SRVs/SVs available for initial subsequently trips on pressure control low steam pressure).

" One (1) SORV Adequate core cooling

" Only HP injection is RCIC (auto -maintained throughout.

initiates) LPCI flow into vessel

" No RPV ED begins at t=25 mins.

• 1 LPCI pump injects at ECCS LP (SPIT at this time is interlock 110F).

• SPC w/1 RHR train initiated at pool (3) This case addresses temp. 9OF t3t Item I1.K.3.44 of NUREG-0737 (adequate core cooling for LOFW with an additional single failure) for EPU.

MNGPEPU2ax Same as MNGPEPU2a except Pre- <Same as case above> 4 min. n/a n/a 6 min. 2.5 hr. Same comment as for EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL Case MNGPEPU2a, at t=O except this case is for CLTP. LPCI flow into vessel for this case begins at t=16 mins.

(SP/T at this time is 105F).

E-8 E-8 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4 ) Height(5 ) >2200 °F(l) MSCWLL(4) Run Comments MNGPEPU2b LOFW, SORV, RCIC for initial injection, <Same as case above> 4 min. n/a n/a 5 min. 2.5 hr. Same comment as for RPV ED, and 1 LPCI pump Max. temp. MSCWLL Case MNGPEPU2a,

" EPU power level at t=O except this case

• LOFW at t=O (no FW coast down flow involves RPV ED at TAF.

credited)

• MSIVs remain open until RPV level LPCI flow into vessel reaches Li (low low) for this case begins at

" All SRVs/SVs available for initial t=7 mins. (SP/T at this pressure control time is 100F).

• One (1)SORV

• Only HP injection is RCIC (auto initiates)

• RPV ED at TAF with 2 additional SRVs

• 1 LPCI pump injects at ECCS LP interlock

" SPC w/1 RHR train initiated at pool temp. 9OF(3)

MNGPEPU2bx Same as MNGPEPU2b except Pre- <Same as case above> 4 min. n/a n/a 5 min. 2.5 hr. Same comment as for EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL Case MNGPEPU2b, at t=O except this case is for CLTP.

LPCI flow into vessel for this case begins at t=7 mins. (SPfIT at this time is 100F).

E-9 E-9 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL (2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5) >2200 °Ft 1) MSCWLL(4) Run Comments MNGPEPU3 Small Water Break LOCA and HPCI

• Verify that HPCI can function N/A N/A N/A N/A 24 hr. HPCI first auto initiates auto initiated as the only injection source at 30 sec.

" EPU power level for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> during SLOCA

" SLOCA (2" ID break in recirc suction

• Verify that 1 train of SPC is This case shows that line) at t=O sufficient for a non-ATWS HPCI can function as

" All SRVs/SVs available for initial scenario the only RPV injection pressure control source for a SLOCA for

" HPCI auto initiates 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the EPU condition.

• Control HPCI flow to constant 1500 gpm after the first auto restart, and SP/T=137F and then continues to auto cycle SP/P=1 66psi at t=24

" SPC w/1 RHR 3 train initiated at pool hrs.

)

temp. 90°F(

MNGPEPU3x Same as MNGPEPU3 except Pre-EPU <Same as case above> N/A N/A N/A N/A 24 hr. HPCI first auto initiates (CLTP) power of 1775 MWth. at 30 sec.

This case shows that HPCI can function as the only RPV injection source for a SLOCA for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the CLTP condition.

E-1I0 E-1 0C495070003-7740-03127/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(41 Height(5) >2200 °F( 1) MSCWLL(4) Run Comments MNGPEPU4 Med. Water Break LOCA, HPCI and 1

• Verify viability of LP injection 2 min. 13 min. 24 min. 2.5 min. 10 hr. HPCI first auto initiates LPCI pump for MLOCA with HPCI initial Max. temp. MSCWLL at 30 sec.

" EPU power *EUpwrevl(MLOCA level ET success injection and no RPV criterion)

ED of 2000'F min.

LPCI flow > 0 at t=19 2

• MLOCA .0873 ft (4" IDwater break in recirc suction line) at t=0 This case shows that

" HPCI auto initiates and auto cycles RPV ED is not needed

" No RPV Emergency Depressurization to allow LP ECCS for

" Initiate 1 LPCI pump at LP interlock MLOCA for EPU if at pool HPCl initially operates.

" SPC w/1 RHR 3 train initiated

)

temp. 90'F(

MNGPEPU4x Same as MNGPEPU4 except Pre-EPU <Same as case above> 2 min. 14 min. 20 min. 3 min. 10 hr. HPCI first auto initiates (CLTP) power of 1775 MWth. Max. temp. MSCWLL at 30 sec.

of 1475°F min.

This case shows that RPV ED is not needed to allow LP ECCS for MLOCA for CLTP if HPCI initially operates.

MNGPEPU4a Large Water Break LOCA, HPCI and 1

• Verify viability of LPCI 2 sec 21 sec N/A 2 sec. 10 hr LPCI flow > 0 at t=21 LPCI pump injection for LLOCA (LLOCA MSCWLL sec

" EPU power level ET success criterion)

" LLOCA 4.27 ft2 (28" ID water break in LPCI is a success for recirc suction line) at t=o LLOCA case

" No RPV Emergency Depressurization

" Initiate 1 LPCI pump at LP interlock SPC w/1 RHR 3 train initiated at pool temp. 90°F( )

MNGPEPU4ax Same as MNGPEPU4a except Pre- <Same as case above> 2 sec 30 sec. 20 min. 2 sec. 10 hr LPCI flow > 0 at t=21 EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL sec of 1475°F I E-1 1 E-1 IC495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4 1 Height(') >2200 °F(1) MSCWLL(4) Run Comments MNGPEPU5a MSIV Closure, SORV, and only CRDH Verify CRDH (Nominal flow, 17 min. N/A 1.3 hr. 27 min. 2.5 hr. Second CRDH pump (Nominal flow, with delayed start of 2nd 2 pumps) success criteria for Core MSCWLL initiated at t=1 min.

pump) available for injection early injection for a Transient Damage

" EPU power level with an SORV and no RPV CRDH (w/2 CRDH

" MSIV Closure at t=0 (no credit for FW ED pumps at nominal flow) coast down flow) not a success as the

" One (1) SORV only early injection source for EPU

" No injection other than 1 CRDH pump condition for transients (no enhanced flow) available at t=0 w/SORV and no RPV

" No RPV ED ED.

" Iterate to determine time when initiation of 2nd CRDH pump (no enhanced flow) prevents core damage

" SPC w/1 RHR 3 train initiated at pool temp. 90'F( )

MNGPEPU5ax Same as MNGPEPU5a except Pre- <Same as case above> 19 min. N/A 1.7 hr. 29 min. 2.5 hr. Second CRDH pump EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL initiated at t=40 min.

of 2160'F Two CRDH pumps at nominal flow is a success as the only early injection source for CLTP condition for transient w/SORV and no RPV ED, as long as 2 ndpump is initiated by t=40 min. CLTP PRA conservatively uses t=25 mins. based on a surrogate time of time to core damage for a SLOCA.

E-1 2 E-1 2C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5 ) >2200 'F( 1 ) MSCWLL(4) Run Comments MNGPEPU5b Same as MNGPEPU5a except RPV ED Verify CRDH (Nominal flow, 15 min. 34 min. 55 min. 23 min. 2.5 hr. Second CRDH pump (using only 1 additional SRV) at 2 pumps) success criteria for Max. temp. MSCWLL initiated at t=37 min.

MSCWLL. early injection for a Transient of 2040'F with an SORV and RPV ED Two CRDH pumps at nominal flow is a success as the only early injection source for EPU condition for transient w/SORV and RPV ED, as long as 2 nd pump is initiated by t=37 min. The time conservatively used in the CLTP base PRA for alignment of a second CRDH pump is more restrictive than this result.

MNGPEPU5bx Same as MNGPEPU5b except Pre- <Same as case above> 19 min. 43 min. 1.2 hr. 30 min. 2.5 hr. Second CRDH pump EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL initiated at t=57 min.

of 2150'F Two CRDH pumps at nominal flow is a success as the only early injection source for CLTP condition for transient w/SORV and RPV ED, as long as 2nd pump is initiated by t=57 min. The CLTP PRA conservatively uses t=25 mins. based on a surrogate time of time to core damage for a SLOCA.

E-1 3 E-1 3C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF 4 ) Height") >2200 oF(1 ) MSCWLL(4) Run Comments MNGPEPU5c MSIV Closure and only CRDH (Nominal Verify CRDH (Nominal flow, 17 min. N/A 1.3 hr. 26 min. 2.5 hr. Second CRDH pump flow, with delayed start of 2nd pump) 2 pumps) success criteria for Core MSCWLL initiated at t=1 min.

available for injection early injection for a Transient Damage

" EPU power level without an SORV and no CRDH (w/2 CRDH

" MSIV Closure at t=0 (no credit for FW RPV ED pumps at nominal flow) coast down flow) not a success as the

" No injection other than 1 CRDH pump only early injection (no enhanced flow) available at t=0 source for EPU condition for transients

" No RPV ED w/o SORV and no RPV

• Iterate to determine time when ED.

initiation of 2nd CRDH pump (no enhanced flow) prevents core damage

" SPC w/1 RHR 3 train initiated at pool

)

temp. 90'F(

MNGPEPU5cx Same as MNGPEPU5c except Pre- <Same as case above> 20 min. N/A 1.6 hr. 30 min. 2.5 hr. Second CRDH pump EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL initiated at t=43 min.

of 2165°F Two CRDH pumps at nominal flow is a success as the only early injection source for CLTP condition for transient w/o SORV and no RPV ED, as long as 2 ndpump is initiated by t=43 min.

The CLTP PRA conservatively uses t=25 mins. based on a surrogate time of time to core damage for a SLOCA.

E-14 E-1 4C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5) >2200 oF(l) MSCWLL(4) Run Comments MNGPEPU5d Same as MNGPEPU5c except RPV ED Verify CRDH (Nominal flow, 14 min. 29 min. 52 min. 23 min. 2.5 hr. Second CRDH pump (using only 2 SRVs) at MSCWLL. 2 pumps) success criteria for Max. temp. MSCWLL initiated at t=26 min.

early injection for a Transient of 2100°F without an SORV and RPV Two CRDH pumps at ED nominal flow is a success as the only early injection source for EPU condition for transient w/o SORV and RPV ED, as long as 2nd pump is initiated by t=26 min. The time conservatively used in the CLTP base PRA for alignment of a second CRDH pump is more restrictive than this result.

MNGPEPU5dx Same as MNGPEPU5d except Pre- <Same as case above> 20 min. 36 min. 1.0 hr. 29 min. 2.5 hr. Second CRDH pump EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL initiated at t=42 min.

of 21857F Two CRDH pumps at nominal flow is a success as the only early injection source for CLTP condition for transient w/o SORV and RPV ED, as long as 2nd pump is initiated by t=42 min. The CLTP PRA conservatively uses t=25 mins. based on a surrogate time of time to core damage for a SLOCA.

E-1 5 E-15 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL 2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF"4 ) Height"5 ) >2200 °F(l) MSCWLL(4) Run Comments MNGPEPU5e MSIV Closure, SORV and only CRDH

• Verify CRDH (Enhanced 15 min. N/A 1.2 hr. 23 min. 2.5 hr. Enhanced CRDH flow (Enhanced flow, 1 pump) available for flow, 1 pump) success Max. temp. MSCWLL initiated at t=43 min.

injection criteria for early injection for of 1960'F

• EPU power level a Transient with an SORV Enhanced CRDH flow (1

• MSIV Closure at t=0 (no credit for FW and no RPV ED CRDH pump) is a coast down flow) success as the only

" One (1) SORV early injection source for EPU condition for

" No injection other than 1 CRDH pump transient w/SORV and (no enhanced flow) available at t=0 no RPV ED, as long as

" No RPV ED flow enhancement is

• Iterate to determine time when initiated by t=43 min.

initiation of CRDH enhanced flow (still The time conservatively only one pump) prevents core used in the CLTP base damage PRA for alignment of

" SPC w/1 RHR train initiated at pool enhanced CRDH is more restrictive than this temp. 90'F(3 ) result.

MNGPEPU5ex Same as MNGPEPU5e except Pre- <Same as case above> 19 min. 63 min. 1.4 hr. 30 min. 2.5 hr. Enhanced CRDH flow EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL initiated at t=64 min.

of 2125'F Enhanced CRDH flow (1 CRDH pump) is a success as the only early injection source for CLTP condition for transient w/SORV and no RPV ED, as long as flow enhancement is initiated by t=64 min.

The CLTP PRA conservatively uses t=25 mins. based on a surrogate time of time to core damage for a SLOCA.

E-1 6 E-1 6C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to M ax Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description 5 Purpose TAF(j) Height" ) >2200 'F(l) MSCWLL(4) Run Comments MNGPEPU5f Same as MNGPEPU5e except RPV ED Verify CRDH (Enhanced 15 min. 34 min. 49 min. 23 min. 2.5 hr. Enhanced CRDH flow (using only 1 additional SRV) at flow, 1 pump) success Max. temp. MSCWLL initiated at t=41 min.

MSCWLL. criteria for early injection for of 1950'F a Transient with an SORV Enhanced CRDH flow (1 and RPV ED CRDH pump) is a success as the only early injection source for EPU condition for transient w/SORV and RPV ED, as long as flow enhancement is initiated by t=41 min. The time conservatively used in the CLTP base PRA for alignment of enhanced CRDH is more restrictive than this result.

MNGPEPU5fx Same as MNGPEPU5f except Pre-EPU <Same as case above> 19 min. 43 min. 1.1 hr. 30 min. 2.5 hr. Enhanced CRDH flow (CLTP) power of 1775 MWth. Max. temp. MSCWLL initiated at t=59 min.

of 2115°F Enhanced CRDH flow (1 CRDH pump) is a success as the only early injection source for CLTP condition for transient w/SORV and RPV ED, as long as flow enhancement is initiated by t=59 min. The CLTP PRA conservatively uses t=25 mins. based on a surrogate time of time to core damage for a SLOCA.

E-1 7 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5) >2200 °F(') MSCWLL(4) Run Comments MNGPEPU5g MSIV Closure and only CRDH

• Verify CRDH (Enhanced 14 min. N/A 1.2 hr. 22 min. 2.5 hr. Enhanced CRDH flow (Enhanced flow, 1 pump) available for flow, 1 pump) success Max. temp. MSCWLL initiated at t=44 min.

injection criteria for early injection for of 2075°F

" EPU power level a Transient without an SORV Enhanced CRDH flow

" MSIV Closure at t=O (no credit for FW and no RPV ED (1 CRDH pump) is a coast down flow) success as the only

• No No injection injectincedother flow)than 1 CRDH avaian pump l at t0 pfor early injection source (no enhanced flow) available at t0 EPU condition for transient w/o SORV

" No RPV ED and no RPV ED, as

• Iterate to determine time when long as flow initiation of CRDH enhanced flow (still enhancement is only one pump) prevents core initiated by t=44 min.

damage The time

• SPC w/1 RHR train initiated at pool conservatively used in tp9F(3 ) the CLTP base PRA for temp. 9alignment of enhanced CRDH is more restrictive than this result.

E-1 8 E-1 8C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(51 >2200 'F( 1 ) MSCWLL(41 Run Comments MNGPEPU5gx Same as MNGPEPU5g except Pre- <Same as case above> 20 min. 34 min. 1.4 hr. 30 min. 2.5 hr. Enhanced CRDH flow EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL initiated at t=64 min.

of 2085°F Enhanced CRDH flow (1 CRDH pump) is a success as the only early injection source for CLTP condition for transient w/o SORV and no RPV ED, as long as flow enhancement is initiated by t=64 min.

The CLTP PRA conservatively uses t=25 mins. based on a surrogate time of time to core damage for a SLOCA.

E-1 9 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4 ) Height(') >2200 'F(l) MSCWLL(4) Run Comments MNGPEPU5h Same as MNGPEPU5g except RPV ED Verify CRDH (Enhanced 14 min. 28 min. 45 min. 22 min. 2.5 hr. Enhanced CRDH flow (using only 2 SRVs) at MSCWLL. flow, 1 pump) success Max. temp. MSCWLL initiated at t=34 min.

criteria for early injection for of 2060'F a Transient without an SORV Enhanced CRDH flow and RPV ED at TAF (1 CRDH pump) is a success as the only early injection source for EPU condition for transient w/o SORV and RPV ED, as long as flow enhancement is initiated by t=34 min.

The time conservatively used in the CLTP base PRA for alignment of enhanced CRDH is more restrictive than this result.

E-20 E-20 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL1 21 Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5) >2200 'F 1l) MSCWLL(4) Run Comments MNGPEPU5hx Same as MNGPEPU5h except Pre- <Same as case above> 20 min. 36 min. 56 min. 30 min. 2.5 hr. Enhanced CRDH flow EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL initiated at t=47 min.

of 2090'F Enhanced CRDH flow (1 CRDH pump) is a success as the only early injection source for CLTP condition for transient w/o SORV and RPV ED, as long as flow enhancement is initiated by t=47 min.

The CLTP PRA conservatively uses t=25 mins. based on a surrogate time of time to core damage for a SLOCA.

E-21 E-2 1C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5) >2200 'F( 1 ) MSCWLL(4) Run Comments MNGPEPU5i Same as MNGPEPU5h except RPV ED Verify CRDH (Enhanced 14 min. 27 min. 47 min. 22 min. 2.5 hr. Enhanced CRDH flow (using only 3 SRVs) at MSCWLL. flow, 1 pump) success Max. temp. MSCWLL initiated at t=34 min.

criteria for early injection for of 1975°F a Transient without an SORV Enhanced CRDH flow and RPV ED at TAF (1 CRDH pump) is a success as the only early injection source for EPU condition for transient w/o SORV and RPV ED, as long as flow enhancement is initiated by t=30 min.

The time conservatively used in the CLTP base PRA for alignment of enhanced CRDH is more restrictive than this result.

E-22 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5) >2200 'F(l) MSCWLL(4) Run Comments MNGPEPU5ix Same as MNGPEPU5i except Pre-EPU <Same as case above> 20 min. 34 min. 55 min. 30 min. 2.5 hr. Enhanced CRDH flow (CLTP) power of 1775 MWTh. Max. temp. MSCWLL initiated at t=45 min.

of 2060'F Enhanced CRDH flow (1 CRDH pump) is a success as the only early injection source for EPU condition for transient w/o SORV and RPV ED, as long as flow enhancement is initiated by t=45 min.

The time conservatively used in the CLTP base PRA for alignment of enhanced CRDH is more restrictive than this result.

E-23 E-23 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5 ) >2200 'F(l) MSCWLL(4) Run Comments MNGPEPU6a Med. Water Break LOCA, No HP

• Verify time allowable for 1 min. 7 min. 10 min. 2 min. 5 hr. RPV ED initiated at t=7 injection, delayed RPV ED and 1 LPCI manual initiation of ADS Max. temp. MSCWLL min. (1/3 core height) pump during MLOCA with no HP of 1118'F with 1 SRV.

"EPU power level injection

" MLOCA .0873 ft2 (4" ID water break in at t=1f0 min.

recirc suction line) at t=0

" No HP injection This case shows that

" Iterate to determine time when manual RPV ED can initiation of Emergency RPV be delayed for EPU Depressurization (using only 1 SRV) until t=7 min. and is successful to prevent core damage prevent core damage

• Initiate 1 LPCI pump at LP interlock for a MLOCA with loss

" SPC w/1 RHR train initiated at pool of HP injection.

3

)

temp. 90°F(

MNGPEPU6ax Same as MNGPEPU6a except Pre- <Same as case above> 1 min. 8 min. 12 min. 2 min. 5 hr. RPV ED initiated at t=8 EPU (CLTP) power of 1775 MWth. Max. temp. MSCWLL min. (1/3 core height) of 1200°F with 1 SRV.

LPCI flow > 0 at t=11 min.

This case shows that manual RPV ED can be delayed for CLTP until t=8 min. and prevent core damage for a MLOCA with loss of HP injection.

E-24 E-24 C495070003-7740-03/27/08

Monticello ExtendedPower Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL1 21 Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF1 4 ) Height" 5

) >2200 'F( 1 ) MSCWLL(4) Run Comments MNGPEPU6b Med. Water Break LOCA, no injection

• Verify time to core damage for 85 sec. 7 min. 17 min. 117 sec. 5 hr. This case shows that and no RPV ED MLOCA w/o RPV injection and Core the time to core EPU power level w/o RPV ED Damage damage for a Med water break LOCA w/o

" MLOCA .0873 ft2 (4" ID water break in RPV injection and w/o recirc suction line) at t=0 RPV ED is t=17 min.

" No HP or LP injection for the EPU condition.

• No RPV ED

• SPC w/1 RHR 3 train initiated at pool temp. 9OoF( )

MNGPEPU6bx Same as MNGPEPU6b except Pre- <Same as case above> 97 sec. 8 min. 19 min. 126 sec. 5 hr. This case shows that EPU (CLTP) power of 1775 MWth. Core the time to core Damage damage for a Med water break LOCA w/o RPV injection and w/o RPV ED is t=19 min.

for the CLTP condition.

MNGPEPU6c Small Water Break LOCA, no injection

• Verify time to core damage for 4 min. 14 min. 26 min. 6 min. 5 hr. This case shows that and no RPV ED SLOCA w/o RPV injection and Core the time to core

• EPU power level w/o RPV ED Damage damage for a Small water break LOCA w/o

• SLOCA (2" ID water break in recirc RPV injection and w/o suction line) at t=0 RPV ED is t=26 min.

" No HP or LP injection for the EPU condition.

" No RPV ED

• SPC w/1 RHR train initiated at pool temp. 90'F(3 )

E-25 E-25 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to M ax Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4') Height(') >2200 'F( 1 ) MSCWLL(4) Run Comments MNGPEPU6cx Same as MNGPEPU6c except Pre- <Same as case above> 5 min. 16 min. 31 min. 7 min. 5 hr. This case shows that EPU (CLTP) power of 1775 MWth. Core the time to core Damage damage for a Small water break LOCA w/o RPV injection and w/o RPV ED is t=31 min.

for the CLTP condition.

MNGPEPU7a Isolation ATWS, No HP Injection, Level

• Verify 3 SRVs sufficient for 73 sec. 7.4 min. 13 min. 91 sec. 2.5 hr. SLC initiated at 12 min.

Control, delayed RPV ED, 1 SLC pump RPV ED during an isolation Max. temp. MSCWLL delayed, and 1 LPCI pump ATWS (success criteria) of 1315'F RPV ED initiated at

• EPU power level

• Verify time available to t=7.4 min. (1/3 core

" MSIV Closure ATWS at t=O (no FW initiate RPV ED during an height) with 3 SRVs coast down flow credited) isolation ATWS with no HP

• RPT (both pumps) at t=O injection TRVs (the current

• No HP injection CLTP PRA success

• RPV ED at 1/3 core height (using only criterion for such 3 SRVs) scenarios) is still

" Initiate I LPCI pump at LP interlock sufficient for the EPLI condition, and that and control level at TAF until SLC RPV ED can be injection completed delayed until

" SLC initiated at t=12 min approximately t=7.4

" Increase level to normal RPV level mins. during an after SLC achieves hot shutdown isolation ATWS with no

" SPC w/1 RHR train initiated at pool high pressure injection.

temp. 90'F(3)

E-26 E-26 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF (4) Height(5) >2200 'F(l) MSCWLL(4) Run Comments MNGPEPU7ax Same as MNGPEPU7a except: <Same as case above> 78 sec. 7.5 min. 13 min. 96 sec. 2.5 hr. SLC initiated at 13.5 Max. temp. MSCWLL min.

" Pre-EPU (CLTP) power of 1775 of 1205'F MWth, and RPV ED initiated at

" SLC initiated at t=1 3.5 min. (time t=7.5 min. (1/3 core used in CLTP base PRA) height) with 3 SRVs This case shows that 3 SRVs (the current CLTP PRA success criterion for such scenarios) is sufficient for the CLTP condition, and that RPV ED can be delayed until approximately t=7.5 mins. during an isolation ATWS with no high pressure injection.

E-27 E-27 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4' Height(5 ) >2200 'F(l) MSCWLL(4) Run Comments MNGPEPU7b Isolation ATWS, HPCI Injection, Level

• Determine time allowable for 73 sec. n/a n/a 91 sec. 2.5 hr. SLC initiated at 12 min.

Control at TAF, RPV ED, 1 SLC pump early SLC initiation action Max. temp. MSCWLL and 1 LPCI pump and no SPC

• Determine acceptable time at t=O RPV ED due to HCTL

• EPU power level frame for SPC initiation at t=16 min.

• MSIV Closure ATWS at t=0 (no FW coas during ATWSdon scenario fow cedied)SP/T=200F at t=50 coast down flow credited) mins. Differences in

• RPT (both pumps) at t=0 time to 200F between "All SVs/SRVs available for initial EPU and CLTP cases pressure transient due to number of HPCI

• HPCI auto initiates, and then control cycles occurring in level to TAF MAAP as the code

• SLC initiated at t=12 min controls level around TAF.

• RPV ED (using only 3 SRVs) when HCTL reached

• 1 LPCI pump when HPCI trips and continue to control level at TAF

" No RHR SPC or venting available MNGPEPU7bx Same as MNGPEPU7b except: <Same as case above> 80 sec. n/a n/a 96 sec. 2.5 hr. SLC initiated at 13.5 Max. temp. MSCWLL min.

• Pre-EPU (CLTP) power of 1775 at t=0 MVVth, and RPV ED due toHCTL

" SLC initiated at t=1 3.5 min. (time at t=17 min.

used in CLTP base PRA) SP/T=200F at t=46 mins. Differences in time to 200F between EPU and CLTP cases due to number of HPCI cycles occurring in MAAP as the code controls level around TAF E-28 E-28 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5 ) >2200 °F(l) MSCWLL(4) Run Comments MNGPEPU7c Isolation ATWS, HPCI Injection, Level

• Determine time allowable for 92 sec. n/a n/a 117 sec. 2.5 hr. SLC initiated at 12 min.

Control at normal, RPV ED, 1 SLC early SLC initiation action Max. temp. MSCWLL pump and 1 LPCI pump and no SPC

• Determine acceptable time at t=O RPV ED due to HCTL

• EPUI power level frame for SPC initiation at t=14 min.

• MSIV Closure ATWS at t=0 (no FW during ATWS scenario downmins. Differences in

" RPT (both pumps) at t=0 time to 200F between

• All SVs/SRVs available for initial EPU and CLTP cases pressure transient due to number of HPCI

• HPCI auto initiates, and then control cycles occurring in level at Normal MAAP as the code controls level around

• SLC initiated at t=12 min TAF

• RPV ED (using only 3 SRVs) when HCTL reached

" 1 LPCI pump when HPCI trips and continue to control level at Normal

• No RHR SPC or venting available MNGPEPU7cx Same as MNGPEPU7c except: <Same as case above> 105 sec. n/a n/a 144 sec. 2.5 hr. SLC initiated at 13.5 Max. temp. MSCWLL min.

" Pre-EPU (CLTP) power of 1775 at t=0 MVVth, and RPV ED due to HCTL

• SLC initiated at t=1 3.5 min. (time at t=1 5 min.

used in CLTP base PRA) SP/I=200F at t=44 mins. Differences in time to 200F between EPU and CLTP cases due to number of HPCI cycles occurring in MAAP as the code controls level around TAF E-29 E-29 C495070003-7740-03/27/08

Monticello ExtendedPower Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4 ) Height(') >2200 OF(1 ) MSCWLL(4) Run Comments MNGPEPU8a MSIV Closure, no injection and no RPV Verify time available to 12 min. 36 min. 50 min. 17 min. 2.5 hr. This case shows that ED control FW flow (operator Core MSCWLL the time to core

" EPU power level action FW-CNTRL-Y). HRA Damage damage for an isolation

" MSIV Closure at t=0 (no FW coast uses time to TAF for this transient w/o RPV d closucredated f5 taction, injection and w/o RPV down flow credited) ED is t=50 min. for the

" All SVs/SRVs available for initial

• Verify time to core damage EPU condition.

pressure transient for a loss of injection HP core

" No HP or LP injection damage transient

" No RPV ED

" SPC w/1 RHR train initiated at pool

- temp. 90°F (3)

MNGPEPU8ax Same as MNGPEPU8a except Pre- <Same as case above> 16 min. 43 min. 62 min. 23 min. 2.5 hr. This case shows that EPU (CLTP) power of 1775 MWth. Core MSCWLL the time to core Damage damage for an isolation transient w/o RPV injection and w/o RPV ED is t=62 min. for the CLTP condition.

MNGPEPU8b MSIV Closure, no injection and no RPV Verify time to core damage 12 min. 17 min. 30 min. 12 min. 2.5 hr. RPV ED initiated at ED for a loss of injection LP core Core MSCWLL t=12 min. (TAF) with 3

" EPU power level damage transient Damage SRVs.

" MSIV Closure at t=0 (no FW coast down flow credited) This case shows that

• All SVs/SRVs pressure available for initial transient the time to core damage transient for an isolation w/o RPV

" No HP or LP injection injection and w/RPV

" RPV ED (using only 3 SRVs) at TAF ED is t=30 min. for the

" SPC w/1 RHR train initiated at pool EPU condition.

temp. 90'F(3)

E-30 E-30 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time I Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4" Height(5 ) >2200 'F(l) MSCWLL(4) Run Comments MNGPEPU8bx Same as MNGPEPU8b except Pre- <Same as case above> 16 min. 21 min. 37 min. 17 min. 2.5 hr. RPV ED initiated at EPU (CLTP) power of 1775 MWth. Core MSCWLL t=16 min. (TAF) with 3 Damage SRVs.

This case shows that the time to core damage for an isolation transient w/o RPV injection and w/RPV ED is t=37 min. for the EPU condition.

MNGPEPU8c SBO, with RClC, no OSP recovery, and Verify time to core damage 5.3 hr. 6.1 hr. 6.6 hr. 5.6 hr. 10 hr. This case shows that no DFP injection alignment for SBO w/RCIC or HPCI and Core MSCWLL the time to core

" EPU power level battery failure at t=4 hrs, to Damage damage is t=6.6 hrs for

" SBO at t=0 (no FW coast down flow verify that OSP Recovery at the EPU for an SBO, credited) t=6 hrs is still appropriate for with initial RCIC or EPU HPCI, and battery

" All SVs/SRVs available for initial depletion at t=4hrs. If pressure transient RCIC were allowed to

" Only RCIC available for injection, auto cycle, the time to RCIC manual control to keep normal core damage would be RPV level longer as RCIC

" RCIC fails at t=4 hrs due to battery completes a vessel depletion filling cycle just before t=4 hrs As such, the assumption in the CLTP PRA for OSP recovery required at t=6 hrs for such scenarios is still bounded by the EPU.

E-31 E-3 1C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF( 41 Height(5) >2200 OF(1 ) MSCWLL(4) Run Comments MNGPEPU8cx Same as MNGPEPU8c except Pre- <Same as case above> 5.5 hr. 6.4 hr. 7.0 hr. 5.8 hr. 10 hr. This case shows that EPU (CLTP) power of 1775 MWth. Core MSCWLL the time to core Damage damage is t=7.0 hrs for the CLTP for an SBO, with initial RCIC or HPCI, and battery depletion at t=4 hrs.

The time to core damage may vary by approximately an hour depending upon RCIC level control; if RCIC were allowed to auto cycle and RCIC filled the vessel just prior to loss of DC at t=4hrs, then the time to core damage would be about an hour longer.

The assumption in the CLTP PRA is that OSP recovery is required at t=6 hrs for such scenarios.

E-32 E-32 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to. Exceeded or of Case ID MAAP Run Description Purpose TAF(41 Height(5) >2200 °F(l) MSCWLL(4) Run Comments MNGPEPU8d SBO, with RCIC long-term (batteries Verify time to core damage 9.6 hr. 10.6 hr. 11.1 hr. 6.1 hr. 15 hr. RCIC fails on high pool being charged), no OSP recovery, and for SBO w/RCIC or HPCI Core HCTL temperature subsequent RCIC failure on high pool long-term (batteries being Damage (SP/T=220F) at t=8.1 temperature charged), to verify that OSP hrs.

" EPU power level Recovery at t=12 hrs is still 9.9Whr

" SBO at t=0 (no FW coast down flow appropriate for EPU MSCWLL This case shows that credited) the time to core

" All SVs/SRVs available for initial damage is t=1 1.1 hrs pressure transient for the EPU for an cOnly RCC available for injection, SBO, w/RCIC or HPCI long-term (batteries suction from the pool only being charged) but

" RCIC manual control to keep normal subsequent failure on RPV level high pool temperature.

" No RPV ED

" RCIC fails when SP/T= 200F Although the time to core damage may be extended if RCIC were allowed to auto cycle, the EPU risk assessment assumes that level will be controlled manually.

As such, the assumption in the CLTP PRA for OSP recovery required at t=12 hrs is adjusted in the EPU risk assessment to t=1 1 hrs. for these sequences.

E-33 E-33 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) HeightP5 ) >2200 °F(l) MSCWLL(4 ) Run Comments MNGPEPU8dx Same as MNGPEPU8d except Pre- <Same as case above> 11.7 hr. 12.9 hr. 13.6 hr. 7.5 hr. 16 hr. RCIC fails on high pool EPU (CLTP) power of 1775 MWth. Core HCTL temperature Damage (SP/T=220F) at t=9.9 hrs.

12.1 hr.

MSCWLL This case shows that the time to core damage is t=1 3.6 hrs for the CLTP for an SBO, w/RClC or HPCI long-term (batteries being charged) but subsequent failure on high pool temperature.

Similar to comment in case MNGPEPU6cx, the time to core damage may vary by approximately an hour for this case depending upon the mode of RCIC level control.

The assumption in the CLTP PRA is that OSP recovery is required at t=1 2 hrs for such scenarios.

E-34 C495070003-7740-03/27/08 E-34

Monticello Extended Power UprateRisk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTLt 2); Time Time to 1/3 Core or Time to Exceeded orj of Case ID MAAP Run Description Purpose TAF14) Height(5) >2200 °F(l) MSCWLL (4) Run Comments MNGPEPU8e SBO, w/SORV and HPCI Verify time to core damage 3.2 hr. 4.6 hr. 4.9 hr. 3.4 hr. 5 hr. HPCI trips on low

" EPU power level for SBO w/HPCI and a Core MSCWLL steam pressure at

" SBO at t=O (no FW coast down flow SORV, to verify that OSP Damage t=2.8 hrs.

credited) Recovery at t=3 hrs is still

" All SVs/SRVs available for initial appropriate for EPU This case shows that pressure transient the time to damage core hrs is t=4.9 for

" Only HPCI available for injection, the EPU for an SBO, HPCI manual control to keep normal with HPCI and an RPV level SORV.

" One (1) SORV

" HPCI subsequently fails on low steam As such, the pressure assumption in the CLTP PRA for OSP recovery required at t=3 hrs for such scenarios is still bounded by the EPU.

The EPU actually stretches the time that HPCI operates before tripping on low steam pressure.

E-35 E-35 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4 ) Height(5 ) >2200 °F(l) MSCWLL(4) Run Comments MNGPEPU8ex Same as MNGPEPU8e except Pre- <Same as case above> 2.8 hr. 4.3 hr. 4.7 hr. 2.9 hr. 5 hr. HPCI trips on low EPU (CLTP) power of 1775 MWth. Core MSCWLL steam pressure at Damage tW1.9 hrs.

This case shows that the time to core damage is t=4.7 hrs for the CLTP for an SBO, with HPCI and an SORV.

Similar to comment in case MNGPEPU6cx, the time to core damage may vary by approximately 30-60 minutes in this case depending upon the mode of HPCI level control.

The assumption in the CLTP PRA is that OSP recovery is required at t=3 hrs for such scenarios.

E-36 E-36 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4 ) Height(5 ) >2200 °F(l) MSCWLL(4) Run Comments MNGPEPU9 Transient with loss of containment heat Identify time frames for N/A N/A N/A 6.6 hr. 48 hr. SPiT reaches 200F removal containment venting, RHR HCTL (HPCI, RCIC failure

" EPU power level SPC initiation, and ultimate point in PRA) at t=6.8

" MSIV Closure at t=O (no FW coast containment failure due to hrs.

down flow credited) overpressure

" All SVs/SRVs available for initial SW press at 31 hr. at pressure transient 75 psig in the 3W.

• HPCI only injection source initially

" RPV ED (using only 3 SRVs) on Containment failure (at HCTL 118 psia) occurs at

" 1 LPCl pump initiated at LP interlock t=43 hr.

• CRDH only injection source after SRVs re-close on high containment Very long time pressure (and RPV repressurizes) available to operators

• No RHR SPC or containment venting in which to align SPC available or initiate emergency containment vent in order to prevent loss of injection (either due to SRV re-closure, or high pool temperature) and containment overpressure failure.

Operator action (CHR-DET-Y) for initiation of SPC during transients based on time to SPrT=200F.

E-37 E-37 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-1 LEVEL 1 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Max Time to Reach Core Temp Time HCTL(2) Time Time to 1/3 Core or Time to Exceeded or of Case ID MAAP Run Description Purpose TAF(4) Height(5) >2200 'F(l) MSCWLL14) Run Comments MNGPEPU9x Same as MNGPEPU9 except Pre-EPU <Same as case above> N/A N/A N/A 7.7 hr. 48 hr. SPIT reaches 200F (CLTP) power of 1775 MWth. HCTL (HPCI, RCIC failure point in PRA) at t=8.0 hrs.

SRVs closed due to Hi DW press at 40 hr. at 75 psig in the DW.

Containment failure (at 118 psia) occurs after t=48 hrs (98 psia at t-48 hrs.).

Very long time available to operators in which to align SPC or initiate emergency containment vent in order to prevent loss of injection (either due to SRV re-closure, or high pool temperature) and containment overpressure failure.

Operator action (CHR-DET-Y) for initiation of SPC during transients based on time to SP/T=200F. MNGP CLTP base PRA assumes that time is approximately t=10hrs E-38 E-38 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-2 LEVEL 2 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Time to Max Csl Rel Csl Reach 1/3 Core Temp or Time HCTL1 2) from NG Rel RB Time Time to Core Time to >2200 Exceeded or Cont Rel to Env Decon of Case ID MAAP Run Description Purpose TAF141 Height(') 1 OF( ) MSCWLL 1 41

(%) (%) (%) Factor Run Comments MNGPEPU10a Large Late Release Verify that 33 min. 1.0 hr. 1.3 hr. 41 min. 7.9 87 5.9 1.3 40 hr. Performed using CLTP Scenario, Class ID, RPV EPU does not "no-inj-lowP.inp" MAAP MCSWLL breach, no DW injection, cause Large (curve risinc 4.0.4 input deck and then no DW shell failure, later Late release sharply at increasing Rx power to DW thermal failure(6) sequences to end of run EPU. This is one of the

• EPU power level become Large and will two fastest progressing EARLY exceed Csl Large/Late sequences

• MSIV Closure at t=O (LERF) LARGE (most Large/Late (no FW coast down Magnitude sequences begin to flow credited) threshold release many hours later).

• All SVs/SRVs shortly after available for initial end of run Csl release to pressure transient environment expected to

• No HP or LP injection exceed Csl 10% threshold for vessel injection or (LARGE magnitude in debris cooling MNGP PRA) soon after

" Delayed RPV ED end of run.

(using only 3 SRVs) at onset of core Cont. fails (and release damage from containment begins)

" DW fails when when DW/T >700F at TGDW>700°F t=8.9 hrs.

" Credit reactor building in reducing release Per MNGP EAL magnitudes procedure A.2-1 01, Rev.

" No SPC or venting 38, declaration of Gen.

Emergency would occur ir t=1-2 hrs for this sequence. Release to environment occurs 8 hrs after the declaration (LATE release in MNGP PRA).

Case shows that Large/Late releases do not become Large/Early for EPU.

E-39 E-39 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table E-2 LEVEL 2 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Time to Max Csl Rel Csl Reach 1/3 Core Temp or Time HCTL(2) from NG Rel RB Time Time to Core Time to >2200 Exceeded or Cont Rel to Env Decon of Case ID MAAP Run Description Purpose TAF(4) Height(5 ) oF(i) MSCWLL(4) (%) 0/(%) (%) Factor Run Comments MNGPEPU10ax Same as MNGPEPU10a <Same as case 38 min. 1.2 hr. 1.5 hr. 48 min. 4.1 87 2.9 1.4 40 hr. Performed using CLTP except Pre-EPU (CLTP) above> MCSWLL "no-inj-lowP.inp" MAAP power of 1775 MWth. (curve rising 4.0.4 input deck. This is sharply at one of the two fastest end of run progressing Large/Late and will sequences (most exceed Csl Large/Late sequences LARGE begin to release many Magnitude hours later).

threshold shortly after Csl release to end of run environment expected to exceed Csl 10% threshold (LARGE magnitude in MNGP PRA) soon after end of run.

Cont. fails (and release from containment begins) when DWFT >70OF at t=10.3 hrs.

Per MNGP EAL procedure A.2-1 01, Rev.

38, declaration of Gen.

Emergency would occur in t=1-2 hrs for this sequence. Release to environment occurs 9 hrs after the declaration (LATE release in MNGP PRA).

E-40 E-40 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-2 LEVEL 2 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Time to Max Csl Rel Csl Reach 1/3 Core Temp or Time HCTL1 2) from NG Rel RB Time Case ID MAAP Run Description Purpose Time to TAF (4)

Core Heig1ht(') Time °F(1) to >2200 Exceeded or MSCWLL (4) Cont

(%) Rel

(%) toCl%)

Env Decon Factor of Run Comments MNGPEPU10b Large Late Release

• Verify that 33 min. 1.0 hr. 1.3 hr. 41 min. 45 86 34 1.3 40 hr. Performed using CLTP Scenario, Class IA,RPV EPU does not MCSWLL "no-inj-highP.inp" MAAP breach, no DW injection, cause Large 4.0.4 input deck and then no DW shell failure, later Late release increasing Rx power to DW thermal failure sequences to EPU. This is one of the EPU power level become Large two fastest progressing MSEPUCpowere EARLY Large/Late sequences (no FW coast down (LERF) (most Large/Late flow credited) sequences begin to SAllSVs/SRVs; release many hours later).

available for initial pressure transient Csl release to

• No HP or LP injection environment is 34%

for vessel injection or (HIGH magnitude in debris cooling MNGP PRA).

• No RPV ED DWfaiIs when Cont. fails (and release TGDW>700OF from containment begins)

• Credit reactor building when DW/T >700F at in reducing release t=7.8 hrs.

magnitudes Per MNGP EAL

• No SPC or venting procedure A.2-1 01, Rev.

38, declaration of Gen.

Emergency would occur in t=1-2 hrs for this sequence. Release to environment occurs 7 hrs after the declaration (LATE release in MNGP PRA).

Case shows that Large/Late releases do not become Large/Early for EPU.

E-41 E-4 1C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-2 LEVEL 2 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Time to Max Csl Rel Csl Reach 1/3 Core Temp or Time HCTL(2) from NG Rel RB Time Time to Core Time to >2200 Exceeded or Cont Rel to Env Decon of Case ID MAAP Run Description Purpose TAF(4' Height(5 ) oF(1) MSCWLL1 4 ) (%) (%) (%) Factor Run Comments MNGPEPU10bx Same as MNGPEPU10b <Same as case 38 min. 1.2 hr. 1.5 hr. 48 min. 30 86 22 1.4 40 hr. Performed using CLTP except Pre-EPU (CLTP) above> MCSWLL "no-inj-highP.inp" MAAP power of 1775 MWth. 4.0.4 input deck. This is one of the two fastest progressing Large/Late sequences (most Large/Late sequences begin to release many hours later).

Csl release to environment is 22%

(LARGE magnitude in MNGP PRA).

Cont. fails (and release from containment begins) when DWIT >700F at t=8.9 hrs.

Per MNGP EAL procedure A.2-1 01, Rev.

38, declaration of Gen.

Emergency would occur in t=1-2 hrs for this sequence. Release to environment occurs 8 hrs after the declaration (LATE release in MNGP PRA).

E-42 E-42 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-2 LEVEL 2 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Time to Max CsI Rel CsI Reach 1/3 Core Temp or Time HCTL(2) from NG Rel RB Time Time to Core Time to >2200 Exceeded or Cont Rel to Env Decon of Case ID MAAP Run Description Purpose TAF(4) Height(5 ) oF( 1) MSCWLL1 41 (%) (%) (%) Factor Run Comments MNGPEPU10c Medium Early Release

• Verify that 12 min. 35 min. 49 min. 17 min. 7.1 66 4.2 1.7 40 hr. Performed using CLTP Scenario, Class ID,RPV EPU does not MCSWLL "none-lowP-dw-early.inp" breach DWshell cause Medium MAAP 4.0.4 input deck failure(6) Early release and then increasing Rx

• EPU power level sequences to power to EPU.

• MSIV Closure at t=0 become (no FW coast down LARGE Early Cont. fails (and release flow credited) (LERF) from containment begins)

• All SVs/SRVs when DW shell melt-thru available for initial occurs at t=3.7 hrs.

pressure transient

• No HP or LP injection Per MNGP EAL for vessel injection or procedure A.2-1 01, Rev.

debris cooling 38, declaration of Gen.

SDelayed RPV ED Emergency would occur in (using only 3 SRVs) t=1s-2 hrs for this at onset of core sequence. Release to damage environment occurs 3 SDW steel shell failure hrs after the declaration occurs 7 mins. after (EARLY release in MNGP RPV breach PRA).

• Credit reactor building Csl release to in reducing release environment is 4.2%

magnitudes (MEDIUM magnitude in

• No SPC or venting MNGP PRA).

Case shows that Medium/Early releases do not become Large/Early for EPU.

E-43 E-43 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Table E-2 LEVEL 2 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Time to Max Csl Rel Csl Reach 1/3 Core Temp or Time HCTL1 2) from NG Rel RB Time Time to Core Time to >2200 Exceeded or Cont Rel to Env Decon of Case ID MAAP Run Description Purpose TAF(4 ) Height(') oF( 1) MSCWLL1 41 (%) (%) (%) Factor Run Comments MNGPEPU10cx Same as MNGPEPU10c <Same as case 15 min. 43 min. 1.0 hr. 22 min. 6.2 63 3.0 2.0 40 hr. Performed using CLTP except Pre-EPU (CLTP) above> MCSWLL "none-lowP-dw-early.inp" power of 1775 MWth. MAAP 4.0.4 input deck.

Cont. fails (and release from containment begins) when DW shell melt-thru occurs at t=4.9 hrs.

Per MNGP EAL procedure A.2-1 01, Rev.

38, declaration of Gen.

Emergency would occur in t=1-2 hrs for this sequence. Release to environment occurs 4 hrs after the declaration (EARLY release in MNGP PRA).

CsI release to environment is 3.0%

(MEDIUM magnitude in MNGP PRA).

E-44 E-44 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-2 LEVEL 2 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Time to Max CsI Rel CsI Reach 1/3 Core Temp or Time HCTL(2) from NG Rel RB Time Case ID MAAP Run Description Purpose Time TAF(4)to Core Height(') Time °F(l) to >2200 Exceeded MSCWLL (4)or Cont

% Rel

%) to %Env Decon FC-tor of D... Coments MNGPEPU10d Medium Early Release

• Verify that 12 min. 35 min. 49 min. 17 min. 9.1 50 4.9 1.9 40 hr. Performed using CLTP Scenario, Class IA,RPV EPU does not MCSWLL "floodPB-highP-dw56.inp" breach, containment cause Medium MAAP 4.0.4 input deck flooding w/DW vent(6) Early release and then increasing Rx

• EPU power level sequences to power to EPU.

• MSIV Closure at t= become (no FW coast down LARGE Early Cont. fails (and release flow credited) (LERF) from containment begins)

SAllSVs/SRVs; when DW vent is initiated available for initial during containment pressure transient flooding at t=2.8 hrs.

• No HP or LP injection for vessel injection or Per MNGP EAL debris cooling procedure A.2-101, Rev.

• No RPV ED 38, declaration of Gen.

• Initiate containment Emergency would occur in flooding at time of t=1-2 hrs for this RPV breach sequence. Release to

• Initiate DW vent at 67 environment occurs 2 psi and maintain between 57-67 psi hrs after the declaration (EARLY release in MNGP

" Credit reactor building PRA).

in reducing release CsI release to magnitudes environment is 4.9%

" No SPC (MEDIUM magnitude in MNGP PRA).

Case shows that Medium/Early releases do not become Large/Early for EPU.

E-45 E-45 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table E-2 LEVEL 2 PRA MAAP RUNS FOR MONTICELLO EXTENDED POWER UPRATE Time to Time to Max Csl Rel Csl Reach 1/3 Core Temp or Time HCTL(2) from NG Rel RB Time Time to Core Time to >2200 Exceeded or Cont Rel to Env Decon of Case ID MAAP Run Description Purpose TAF(4) Height(5 ) oF(1) MSCWLL(4) (%) (%) (%) Factor Run Comments MNGPEPU10dx Same as MNGPEPU10d <Same as case 15 min. 43 min. 1.0 hr. 22 min. 5.8 35 3.3 1.7 40 hr. Performed using CLTP except Pre-EPU (CLTP) above> MCSWLL "floodPB-highP-dw56.inp" power of 1775 MWth. MAAP 4.0.4 input deck.

Cont. fails (and release from containment begins) when DW vent is initiated during containment flooding at t=3.7 hrs.

Per MNGP EAL procedure A.2-1 01, Rev.

38, declaration of Gen.

Emergency would occur in t=1-2 hrs for this sequence. Release to environment occurs 3 hrs after the declaration (EARLY release in MNGP PRA).

Csl release to environment is 3.3%

(MEDIUM magnitude in MNGP PRA).

E-46 E-46 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Notes to Tables E-1 and E-2:

(1) Core damage is defined in the MNGP PRA MAAP runs as 2200°F in the core (based on the MAAP variable TCRHOT).

(2) The suppression pool Heat Capacity Temperature Limit, HCTL, is one of the key parameters (along with low RPV water level) requiring RPV Emergency Depressurization per the EOPs.

(3) The MAAP parameter file initiates SPC no earlier than t=15 mins to account for various issues such as operator focus on other tasks. As such, the directives in these input decks that state SPC initiation at a pool temperature of 90F means that SPC initiation occurs at t=15 mins (i.e., the pool is assumed to start at 85F at t=O per the MNGP MAAP parameter file and it reaches 90F before t=1 5 mins for all isolation scenarios, thus SPC alignment occurs at the earliest allowed time point of t=15 mins.).

(4) The time to TAF (Top of Active Fuel, -126" at MNGP) shown in this table is based on the MAAP variable XWSH (water level in the shroud), and is indicative of level indication available to the operator. The same variable is used in this table for MSCWLL (Minimum Steam Cooling Water Level Limit, -149" at MNGP).

(5) The time to 1/3 core height in this table is based on the MAAP variable XWCOR (2-phase water level in the core).

(6) The Level 1 MAAP runs are performed using MNGP MAAP version 4.0.6 parameter file. The Level 2 MAAP release runs are performed using the MNGP MAAP Version 4.0.4 parameter file to be consistent with the MAAP runs for the release categorizations used by MNGP in the development of the Level 2 PRA release categorizations.

E-47 E-47 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications

< Print-outs of MAAP input decks and graphs contained in file

'7740-495 MNGP EPU AppE attch.pdf'>

E-48 E-48 C495070003-7740-03/27/08

Appendix F COP SENSITIVITY

Monticello Extended Power Uprate Risk Implications Appendix F COP SENSITIVITY This sensitivity study assesses the impact on plant risk if containment accident pressure is assumed not present (e.g., postulated pre-existing primary containment failure) during the postulated accident scenarios such that inadequate LP ECCS pump NPSH occurs.

F.1 RISK ASSESSMENT APPROACH This risk assessment is performed by modification and quantification of the at-power internal events MNGP EPU base PRA model, and using the risk assessment guidance of NRC RG 1.174.

The performance of the COP risk assessment is best described by the following major analytical steps:

" Assessment of NPSH calculations

" Estimation of pre-existing containment failure probability

• Analysis of relevant plant experience data

" Manipulation and quantification of PRA models

• Comparison to ACDF and ALERF RG 1.174 acceptance guidelines

" Performance of uncertainty and sensitivity analyses These steps are discussed below.

F.2 ASSESSMENT OF NPSH CALCULATIONS The purpose of this task is to develop an understanding of the MNGP EPU NPSH calculations that result in the need to credit containment accident pressure for DBA LOCA accident scenarios.

F-1 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications The NPSH calculations are reviewed to understand the scenarios of interest that require COP credit to determine how best to modify the PRA models.

Two general approaches to PRA modeling of COP credit exist depending upon the number and types of NPSH calculations available:

1. Use of sensitivity studies of DBA NPSH calculations

2. Use of NPSH results from Monte Carlo process The second approach is used here.

A Monte Carlo statistical analysis was performed by GE (using the SHEX code) of the containment response and associated NPSH calculations to produce a 95/95 result for the available NPSH in a given accident scenario. The 95/95 point represents the 95%

confidence level that the available NPSH is greater than the calculated Monte Carlo result with a 0.95 probability (or, that there is only a 0.05 probability that the available NPSH is lower than the 95/95 point).

The Monte Carlo NPSH results are used to define a single PRA basic event with a probability based on the Monte Carlo result. The basic event represents the probability that initial plant conditions (i.e., high initial suppression pool temperature, high UHS temperature, etc.) exist at the onset of the modeled DBA scenarios such that inadequate LP ECCS NPSH is available.

For the purpose of modeling the conditions of inadequate NPSH, the PRA is interested in the probability of the plant conditions such that NPSHa is less than NPSHr (i.e., the fraction of the NPSH spectrum below the NPSHr point). The 95/95 point for NPSHa from the Monte Carlo analysis is not directly usable (i.e., to use directly as a 0.05 probability basic event) in the PRA logic modeling unless it coincidentally equals NPSHr.

F-2 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications As the result of the Monte Carlo analysis is a single 95/95 NPSH point rather than a cumulative probability distribution as a function of NPSH, engineering judgment is used (based on review of the NPSH Monte Carlo results) to assign a basic event probability for each DBA LLOCA COP scenario (refer to Table F-1 for descriptions of these three scenarios) that initial plant conditions exist at the onset of the scenarios such that inadequate LP ECCS NPSH is available. The estimated probabilities are as follows:

" Scenario #1: 1.OE-1

• Scenario#2: 5.OE-1

" Scenario#3: 1.OE-1 For Scenario #1, the probability that plant conditions will result in inadequate NPSH is known to be some value higher than 5E-2 (i.e., because the 95/95 NPSHa point is below NPSHr). As the calculated NPSHa 95/95 point is comparatively close (1-2 ft.) to NPSHr in the short time frame modeled for Scenario #1, a nominal probability of 1 E-1 is estimated for this basic event. The same results apply to Scenario #3 (i.e., the calculated NPSHa 95/95 point is comparatively close to NPSHr).

For Scenario #2, the calculated NPSHa 95/95 point is much lower (by a factor of 2-3) than it is for Scenarios #1 and #3. As such, a nominal probability of 5E-1 is used for Scenario #2.

As shown later with a quantitative sensitivity case, exact values for the above probabilities are not necessary in showing that the COP risk impact is "very small".

The three scenarios are summarized in Table F-1. As can be seen from Table F-i, Scenarios #1 and #3 may be modeled together as a single scenario because the impact of LPCI Loop Select Logic single-failure does not change the conclusion that COP credit is required in approximately 7 mins. and that throttling LP ECCS will preclude the need F-3 F-3 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications for COP credit. Therefore, the scenario modeling in the PRA for the DBA LOCA is as follows:

Scenario #1 / #3: (Large LOCA Initiator) x (SPC Not Initiated Within t=10 min.) x (Containment Isolation fails at t=0) x (Operators Fail to Throttle LP ECCS Flow Within t=10 min.) x (Probability that Existing Plant Conditions Result in Inadequate NPSH) x (Probability that LP ECCS Pumps Fail Due to Inadequate NPSH)

• Scenario #2: (Large LOCA Initiator) x (One Division ECCS Available) x (SPC Not Initiated Within t=10 min.) x (Containment Isolation fails at t=0) x (Probability that Existing Plant Conditions Result in Inadequate NPSH) x (Probability that LP ECCS Pumps Fail Due to Inadequate NPSH)

The modeling of these scenarios in the PRA is discussed later in Section F.5 F.3 ESTIMATION OF PRE-EXISTING CONTAINMENT FAILURE PROBABILITY This task involves defining the size of a pre-existing containment failure pathway to be used in the analysis to defeat the COP credit, and then quantifying the probability of occurrence of the un-isolable pre-existing containment failure. The approach to this input parameter calculation will follow EPRI guidelines regarding calculation of pre-existing containment leakage probabilities in support of integrated leak rate test (ILRT) frequency extension LARs (i.e., EPRI Report 1009325, Risk Impact of Extended Integrated Leak Rate Testing Intervals, 2005). This is the same approach used in the Vermont Yankee EPU COP analyses presented to the ACRS in November and December 2005.

Containment failures that may be postulated to defeat the containment accident pressure credit include containment isolation system failures and pre-existing unisolable containment leakage pathways. The pre-existing containment failure may be one that only manifests as the containment pressurizes.

F-4 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Containment isolation system failures are already modeled in the MNGP PRA containment isolation fault tree used in the Level 2 PRA. These failures include failures on demand and failures of valves to remain closed during the standard 24-hr PRA mission time. A basic event for pre-existing containment leakage was added to the MNGP containment isolation fault tree (both in the pre-EPU and EPU base models) for this assessment.

The pre-existing containment leakage probability may be obtained from EPRI 1009325, Risk Impact of Assessment of Extended Integrated Leak Rate Testing Intervals. EPRI 1009325 provides a framework for assessing the risk impact for extending integrated leak rate test (ILRT) surveillance intervals. EPRI 1009325 includes a compilation of industry containment leakage events, from which an assessment was performed of the likelihood of a pre-existing unisolable containment leakage pathway.

A total of seventy-one (71) containment leakage or degraded liner events were compiled. Approximately half (32 of the 71 events) had identified leakage rates of less than or equal to 1La (i.e., the Technical Specification containment allowed leakage rate). None of the 71 events had identified leakage rates greater than 21La. EPRI 1009325 employed industry experts to review and categorize the industry events, and then various statistical methods were used to assess the data.

The EPRI 1009325 study uses 100La as a conservative estimate of the leakage size that would represent a large early release pathway consistent with the LERF risk measure, but estimated that leakages of 600La or greater are a more realistic representation of a large early release. The COP risk assessment for the Vermont Yankee Mark I BWR plant, presented to the ACRS in November and December 2005, determined a leakage size of 27La using the conservative 10CFR50, Appendix K containment analysis approach. Earlier ILRT industry guidance (NEI Interim Guidance) conservatively recommended use of 10La to represent "small" containment leakages and 35La to represent "large" containment leakages.

F-5 F-5 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications This analysis is not concerned per se about the size of a leakage pathway that would represent a LERF release, but rather a leakage size that would defeat the containment accident pressure credit. Given the low likelihood of such a leakage, the exact size is not key to this risk assessment, and no detailed calculation of the exact hole size is performed here. A sensitivity study discussed later assesses the sensitivity of the results to the pre-existing leakage size assumption.

Given the above, the base analysis here assumes 20La as the size of a pre-existing containment leakage pathway sufficient to defeat the containment accident pressure credit. Such a hole size does not realistically represent a LERF release (based on EPRI 1009325) and is also believed (based on the VY hole size estimate) to be on the low end of a hole size that would preclude containment accident pressure credit. The probability of a 20La pre-existing containment leakage at any given time at power is 1.88E-03.

This low likelihood of a significant pre-existing containment leakage path is consistent with MNGP primary containment performance experience. The MNGP primary containment performance experience shows MNGP containment leakages much less than 1La.

F.4 ANALYSIS OF RELEVANT PLANT EXPERIENCE DATA An unisolated primary containment is not the only determining factor in defeating low pressure ECCS pump NPSH. Variations in MNGP UHS and suppression pool water temperatures, suppression pool level and RHR heat exchanger "K" value were statistically analyzed. The purpose of this data assessment is to estimate realistic probabilities that UHS water temperature, suppression pool level and temperature, and heat exchanger effectiveness will exceed a given value, i.e. the probability of F-6 F-6 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications exceedance. These values are used as input into the Monte Carlo simulations of the available NPSH and in the risk assessment.

F.5 MANIPULATION AND QUANTIFICATION OF PRA MODELS This task is to make the necessary modifications to the PRA models to simulate the loss of low pressure ECCS pumps during a Large LOCA. Large LOCA initiated sequences in the PRA are modified as appropriate to mirror the DBA accident calculations requiring COP credit. Accident sequences involving Interfacing Systems LOCAs and other LOCAs Outside Containment are not adjusted in this risk assessment because such LOCAs result in deposition of decay heat directly outside the containment and not into the suppression pool.

PRA Model Modifications The modifications made to the MNGP PRA to model the COP credit for DBA LOCA scenarios are shown in Figure F-I. Pages 1 and 2 of Figure F-1 show the DBA LOCA COP credit scenario logic developed under a sub-tree that is input into the CS and LPCI fault tree logic. Page 3 of Figure F-1 shows the pre-existing containment leakage basic event added to the containment isolation fault tree. As can be seen in Figure F-i, the new logic is ANDed with the large LOCA initiator to ensure that the logic applies to large LOCA initiated accident sequences.

The basic event stating that SPC is not initiated within t=10 minutes is conservatively assigned a 1.0 probability, and reflects the assumption in the DBA LLOCA short-term scenario.

The two basic events that model the probability that plant conditions at the time of the DBA LOCA contribute to inadequate LP ECCS are based on the discussions in Section F.2.

F-7 F-7 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications The human error probability basic event for operator failure to throttle LP ECCS is calculated using the same human reliability analysis methodology (i.e., NUREG/CR-4772) used in the MNGP PRA:

• Per the plant EOPs and operator training, the operators will throttle ECCS flow as necessary per NPSH curves existing on the EOP flowcharts

• The time of the initial cue to the operators for the need to throttle ECCS flow is estimated at t=5 mins. for Scenarios 1 & 3. This is the point at which available head is nearing NPSHr and which flow fluctuations may be notable to the operator.

" The end of the available time window to the operator is conservatively estimated at t=10 mins. and is the time at which pump head collapse is assumed to occur. This time is judged conservative.

• Manipulating LP ECCS pump flow is a manual action performed at the main control panels in the control room. The time required to travel to the proper panel(s) and perform the flow manipulation is estimated at 1 min.

• Therefore, the available diagnosis time to the operator is (10 min. - 5 min.) - 1 min. = 4 mins.

• Using the MNGP PRA HRA Methodology (i.e., NUREG/CR-4772), the diagnosis error contribution for a diagnosis time frame of 4 mins. is 2.5E-1; and the manipulation error rate for performing the action is 5E-3. The total HEP for failure to throttle is 2.55E-1.

In conditions of inadequate NPSH, the pumps will experience surging and cavitation but will not necessarily fail. However, this analysis conservatively assumes the low pressure ECCS pumps fail with a probability of 1.0 given inadequate NPSH and failure to throttle.

The probability of an unisolated containment at the time of the accident is modeled using the MNGP containment isolation fault tree. The probability of the pre-existing leakage basic event is discussed previously in Section F.3 and is based on an assumed hole size of 20La.

F-8 F-8 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Scenario #2 involves failures that result in only one available ECCS division. Those failures are a LOOP combined with failure of one division of ECCS (the DBA single failure is assumed to be an EDG, but the PRA recognizes that it could also be a bus or ECCS equipment failures):

• The conditional probability of a LOOP given a LOCA initiator is 2.4E-2, based on USNRC Memorandum to Mark A. Cunningham, Chief from Alan S. Kuritzky, "Transmittal of Preliminary Staff and Contractor Comments on EPRI Expert Elicitation Meeting on the Probability of LOOP Given Large LOCA", June 14, 2002.

• Failure of one division of ECCS is modeled as failure of Division 1 "OR" Division 2 ECCS. Each division is modeled with an undeveloped basic event with a probability of 1 E-1. This 1 E-1 probability covers failure of one EDG (a contribution of approximately 5E-2), failure of the associated safety bus (a negligible contribution), and failures for one division of ECCS pumps and valves (a contribution of approximately 5E-3), and is judged conservative.

PRA Model Quantification The Level 1 (core damage) PRA is then quantified using the standard quantification techniques of the base PRA. The impact on the Level 2 LERF accident sequences are conservatively modeled here with the assumption that the COP credit failure scenarios lead directly to a LERF release. As such, the ALERF is assumed to equal the calculated ACDF.

The size of the assumed containment hole used in the pre-existing containment leakage basic event is conservatively small (i.e., BWR PRAs typically use a 2" diameter hole in the primary containment to represent the minimum size of a LERF release pathway, and a 2" diameter hole is much greater than the 20La equivalent hole size used in the base calculation). In addition, the location of the assumed containment leakage pathway has an impact on LERF. If the containment leakage pathway is assumed to exist in the F-9 F-9 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications wetwell airspace then the post-accident releases from the containment would be scrubbed by the suppression pool and thus not result in a LERF magnitude release.

This analysis conservatively assumes that the containment leakage pathway is such that, given a core damage event, the conditional probability of a LERF release is 1.0.

The impact of this conservative assumption on ALERF does not change the overall conclusion that the risk impact of COP credit is very small.

F.6 COMPARISON TO ACDF AND ALERF RG 1.174 ACCEPTANCE GUIDELINES The revised MNGP PRA models are quantified to determine the change in the base CDF. As discussed above in Section F.5, the change in LERF is assumed to equal the change in CDF.

The RG 1.174 ACDF and ALERF risk acceptance guidelines are summarized in Figures F-2 and F-3, respectively. The boundaries between regions are not necessarily interpreted by the NRC as definitive lines that determine the acceptance or non-acceptance of proposed license amendment requests; however, increasing delta risk is associated with increasing regulatory scrutiny and expectations of compensatory actions and other related risk mitigation strategies.

The risk impact results for EPU COP credit for DBA LOCAs is:

. ACDF = 9.OE-9

• ALERF = 9.OE-9 Both the change in CDF and the change in LERF fall within the RG 1.174 "very small" risk increase region.

These impacts are referenced with respect to the base modeling assumption that no COP credit is required for LP ECCS adequate NPSH during DBA LOCA scenarios. If F-10 F-i 0C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications the base model where revised to include modeling of the existing COP credit already allowed at MNGP, the change in risk for the additional COP credit required by the EPU would be even smaller.

F.7 UNCERTAINTY AND SENSITIVITY ANALYSES To provide additional information for the decision making process, this sensitivity risk assessment is supplemented by parametric uncertainty analysis and quantitative and qualitative sensitivity studies to assess the sensitivity of the calculated risk results.

Uncertainty is typically categorized into the following three types, consistent with PRA industry literature:

• Parametric

° Modeling

" Completeness Parametric uncertainties are those related to the values of the fundamental parameters of the PRA model, such as equipment failure rates, initiating event frequencies, and human error probabilities. Typical of standard industry practices, the parametric uncertainty aspect is assessed by performing a Monte Carlo parametric uncertainty propagation analysis. Probability distributions are assigned to each parameter value in the PRA, and a Monte Carlo sampling code is used to sample each parameter and propagate the parametric distributions through to the final results.

Modeling uncertainty is focused on the structure and assumptions inherent in the risk model. The structure of mathematical models used to represent scenarios and phenomena of interest is a source of uncertainty, due to the fact that models are a simplified representation of a real-world system. Model uncertainty is addressed here by the identification and quantification of focused sensitivity studies.

F-1 1 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Completeness uncertainty is primarily concerned with scope limitations. Scope limitations are addressed here by the qualitative assessment of the impact on the conclusions if external events and shutdown risk contributors are also considered.

F.7.1 PARAMETRIC UNCERTAINTY ANALYSIS The MNGP PRA is not currently constructed to allow parametric uncertainty analysis; as such, parametric uncertainty analysis was not performed. However, based on knowledge of the issues, the COP risk impact, and PRA parametric uncertainty assessments, the results of a parametric uncertainty analysis would not change the conclusion that the risk impact of COP credit for DBA LOCAs is "very small" per RG 1.174.

F.7.2 MODELING UNCERTAINTY ANALYSIS As stated previously, modeling uncertainty is concerned with the sensitivity of the results due to uncertainties in the structure and assumptions in the logic model. EPRI has developed a guideline for modeling uncertainty that takes the rational approach of identifying key sources of modeling uncertainty and .then performing appropriate sensitivity calculations. This approach is taken here.

j The modeling issues selected here for assessment are those related to the risk assessment of the containment accident pressure credit. This assessment does not involve investigating modeling uncertainty with regard to the overall base PRA. The modeling issues identified for sensitivity analysis are:

• Pre-existing containment leakage size and associated probability

• Calculation of containment isolation system failure

• Probability of plant conditions contributing to inadequate NPSH F-1 2 F-i 2C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications

• Large LOCA initiators in the PRA

• HEP for failure to throttle LP ECCS Sensitivity Case 1: Pre-Existing Containment Leakage Size/Probability The base case analysis assumes a pre-existing containment leakage pathway leakage size of 20La that would result in defeat of the necessary containment accident pressure credit.

A larger pre-existing leak size of 10OLa, consistent with the EPRI 1009325 recommended assumption for a "large" leak, is used in this sensitivity to defeat the necessary COP credit. From EPRI 1009325, the probability of a pre-existing 100La containment leakage pathway at any given time at power is 2.47E-04.

Sensitivity Case 2: Calculation of Containment Isolation System Failure The base case quantification uses the containment isolation system fault tree logic to represent failure of the containment isolation system. The fault tree specifically analyzes primary containment penetrations greater than 2" diameter. This modeling sensitivity case expands the scope of the containment isolation fault tree to include additional smaller lines as potential defeats of COP credit. This sensitivity is quantified by multiplying, by a factor of 10 the probability contribution in the containment isolation fault tree from isolation failures of penetration lines in response to a containment isolation signal.

F-1 3 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Sensitivity Case 3: Probability of Plant Conditions Contributing to Inadequate NPSH The basic event probabilities for the different scenarios that plant conditions at the time of the DBA LOCA contribute to inadequate LP ECCS are based on the discussions in Section F.2. As previously discussed, precise estimates of these probabilities are not necessary to show that the risk impact of COP credit for LP ECCS NPSH is very small.

This fact is shown by this sensitivity. This sensitivity is performed assuming that plant conditions (e.g., high initial suppression pool temperature, high UHS temperature, etc.)

contributing to inadequate NPSH exist 100% of the time.

Sensitivity Case 4: Large LOCA Initiators in the PRA The MNGP PRA has a single "Large LOCA" initiator in the PRA, and this initiator was used to represent the DBA LOCA scenarios. However, in addition to the "Large LOCA" initiator, the MNGP PRA also contains an initiator for "RPV Rupture" and LOCA-induced scenarios (i.e., Transient initiators with failure of SRVs to actuate). This sensitivity case includes the "RPV Rupture" initiator and the LOCA-induced scenarios in the COP credit risk assessment. The impact on the base results is negligible.

Sensitivity Case 5: LP ECCS Throttling HEP The base analysis uses a human error probability, HEP, of 2.55E-1 for failure to throttle LP ECCS to avoid pump failure due to inadequate NPSH. This HEP is based on the plant specific timings from the thermal hydraulic calculations and the human reliability analysis methodology used in the MNGP PRA. This sensitivity study conservatively assumes that the HEP for failure to throttle LP ECCS is 1.0.

F-14 F-i 4C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Summary of Modelina Uncertainty Results The results of these sensitivity studies are as follows:

Case ACDF ALERF Sensitivity Case 1 1.2E-9 1.2E-9 Sensitivity Case 2 1.4E-8 1.4E-8 Sensitivity Case 3 8.4E-8 8.4E-8 Sensitivity Case 4 9.0E-9 9.0E-9 Sensitivity Case 5 3.3E-8 3.3E-8 The above sensitivity studies do not change the base conclusions that the risk impact of COP credit for a DBA LOCA is "very small" per RG 1.174.

F.7.3 COMPLETENESS UNCERTAINTY ANALYSIS As stated previously, completeness uncertainty is addressed here by the qualitative assessment of the impact on the conclusions if special events, external events and shutdown risk contributors are also considered.

ATWS The risk impact of COP credit for low pressure ECCS pump NPSH during ATWS scenarios can be assessed with the following representative ATWS scenario:

" Initiator: Isolation event

" Failure to scram

• Successful RPV level/power control

• Containment isolation failure at t=0

• Only one division of ECCS available

• Operators fail to throttle ECCS pumps F-1 5 F-i 5C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications An isolation event is one that results in isolation of the RPV from the main condenser heat sink. Based on NUREG/CR-6928, the industry average frequency for such an event is approximately 2E-1/yr. Based on the various isolation initiating events (e.g.,

MSIV Closure, Loss of Condenser Vacuum, etc.) modeled in the MNGP PRA, the frequency of such an event at MNGP is approximately 3E-1/yr. The frequency of 3E-1/yr is used in this analysis.

The probability of scram failure in the MNGP PRA is 5.9E-6. This probability is consistent with other current BWR industry PRAs.

The sum of ARI, RPT, SLC, and operator level control and ADS inhibit action failures is generally in the range of 0.1 to 0.2 for industry BWR PRAs , which would result in a probability of successful level/power control in the 0.8 to 0.9 range. This analysis conservatively assumes the probability of successful level/power control is 1.0. Failure of level/power control would result in a scenario which would lead to core damage regardless of COP credit issues; therefore, such scenarios are not part of this assessment.

The probability of containment isolation failure at t=0 is approximately 2E-3.

As discussed earlier in the base case analysis of this risk assessment, the failure probability for one division of ECCS is approximately 5E-3.

The same human error probability of 2.55E-1 used in the base analysis for failure to throttle the ECCS pumps is assumed here.

The risk impact for such a scenario is calculated as:

3E-1 x 5.9E-6 x 1.0 x 2E-3 x 5E-3 x 2.55E-1 = 4.5E-12/yr F-16 F-i 6C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Even if this representative ATWS scenario were to require only that the containment be unisolated (i.e., failure of one division of ECCS not assumed and throttling not a success path), the accident sequence frequency would still be a non-significant 3.5E-9/yr.

Postulating this additional scenario would not change the conclusion that the risk impact of COP credit is "very small" per RG 1.174.

SBO The risk impact of COP credit for low pressure ECCS pump NPSH during SBO scenarios can be assessed with the following representative SBO scenario:

• Initiator: Loss of Offsite Power

• Failure of all EDGs

" One SBO capable injection source successfully operates

• Containment isolation failure at t=O

• Offsite AC power recovered at t=4hrs (the MNGP SBO coping period)

• Alignment of SPC at t=4hrs Note that the above is an extension of the SBO Rule sequence (i.e., MNGP does not require COP for the SBO 4-hr coping period).

Based on NUREG/CR-6928, the industry average frequency for loss of offsite power is approximately 4E-2/yr. The LOOP initiator frequency in the MNGP PRA is 2.28E-2/yr.

The frequency of 4E-2/yr is used in this analysis.

As discussed previously for the base case analysis, the failure probability of one EDG is approximately 5E-2. Failure of all EDGs is estimated here using a common cause failure approach and assuming a 5% failure of all EDGs given failure of one EDG. The F-17 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications 5% common cause failure probability is conservative (industry average is in the 2-3%

range). Therefore, the failure of all EDGs is estimated at 5E-2 x 0.05 = 2.5E-3.

This analysis assumes that the probability of a SBO capable injection source (e.g.,

RCIC) successfully operating for the SBO coping period is 1.0.

The probability of containment isolation failure at t=0 is approximately 2E-3.

Based on NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, the industry average exceedance probability for successfully recovering offsite AC at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> following a LOOP at power is approximately 0.84. Failure of AC power recovery would result in a scenario which would lead to core damage regardless of COP credit issues; therefore, such scenarios are not part of this assessment.

This analysis assumes that the probability of alignment of ECCS pumps to the suppression pool immediately following offsite AC recovery is 1.0. This assessment also assumes that throttling of the pumps will not prevent the inadequate NPSH condition and that the pumps fail with a probability of 1.0 once they are aligned to the pool.

This SBO scenario conservatively does not credit other injection systems (e.g., RCIC from the CST or DFP; alternate RPV injection sources) that would be available after 4 hrs when offsite AC power is recovered.

The risk impact for such a scenario is calculated as:

4E-2 x 2.5E-3 x 1.0 x 2E-3 x 0.84 x 1.0 = 1.7E-7/yr Postulating this additional scenario would not change the conclusion that the risk impact of COP credit is "very small" per RG 1.174 for the Core Damage Frequency risk metric.

F-1 8 F-i 8C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications The Large Early Release Frequency risk metric is just above the border of the "very small" and "small" region. Relaxation* of the excess conservatisms in the LERF modeling (e.g., recognizing that loss of. low pressure ECCS at t=4hrs does not directly result in a LERF release) would show that LERF risk metric is also clearly in the "very small" region of RG 1.174.

Seismic The change in plant risk due to seismic-induced large LOCA COP scenarios is non-significant and likely undetectable with current state of the technology seismic PRA.

The COP credit scenarios require one or more RHR pumps to be in operation (i.e., the PRA already models core damage accident sequences in which loss of all RHR pumps causes loss of LP ECCS - due to the need to initiate emergency containment venting) and the containment to fail.

A seismic event severe enough to fail the primary containment will also fail, with a much higher likelihood, the RHR system. Another aspect is in the modeling of like component failures in a seismic PRA. In a seismic PRA, like components located on the same elevation (e.g., RHR pumps) are commonly modeled as all failed given one fails. As such, if a seismic event fails an RHR pump (with some probability that varies depending upon the seismic magnitude), a seismic PRA will fail all the RHR pumps. As such, the likelihood of a seismic scenario that fails the containment yet fails only 2 or 3 out of the four RHR pumps is a very low likelihood scenario. As a final point on this issue, very high magnitude earthquakes become moot for this issue, as they would result in failure of key buildings and structures and lead directly to core damage.

As such, seismic issues do not impact the decision making for containment accident pressure credit.

F-1 9 C495070003-7740-03/27/08

Monticello Extended Power UprateRisk Implications Internal Fires COP credit for the DBA LOCA scenario is necessary, among other aspects, due to the large heat addition to the suppression pool during the blowdown. An internal fire induced large LOCA type scenario (i.e., a scenario with large heat addition to the suppression pool and no high pressure injection sources available) can be postulated as follows:

• Initiator: Fire in main control panel initiates ADS [OR] fire-induced isolation event with subsequent multiple stuck open relief valves

• Containment isolation failure at t=O

• Plant conditions at time of event contribute to inadequate NPSH

• Operators fail to throttle ECCS pumps The fire induced initiator can be estimated at 1 E-4/yr. A fire in the main control panel that initiates ADS is in the 1 E-6/yr to 1 E-4/yr range using current industry fire initiator techniques. A fire induced isolation transient with subsequent multiple SORVs would also be in the 1E-6/yr to 1E-4/yr range (i.e., the sum of all fire-induced isolation transients would be in the 1E-2/yr to 1E-1/yr range, and the probability of multiple SORVs given an isolation transient is approximately 1E-4 to 1E-3). Therefore, the sum of both these two fire scenarios is estimated at 1 E-4/yr.

The probability of containment isolation failure at t=O is approximately 2E-3. This analysis does not assume that this fire scenario also results in fire-induced containment isolation failure. A fire in the control room that causes both a fire-induced ADS actuation and fire-induced containment isolation failure would involve fires initiating in separate control panels at the same time (an extremely low likelihood scenario). A postulated fire scenario in which a fire initiates in one panel and then the operators fail to suppress the fire such that it spreads to multiple panels would be modeled in a fire F-20 F-20 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications PRA as a control room evacuation scenario and would lead to core damage with a high conditional probability regardless of COP credit impacts.

The same probability of 0.1 used for Scenario #1 for plant conditions at the time of the event that contribute to inadequate NPSH can be reasonably used here.

Likewise, the same human error probability of 2.55E-1 used in the analysis for failure to throttle the ECCS pumps can also be assumed here. Use of this HEP assumes that the timing for the need for COP credit in this scenario occurs as fast for this fire-induced SORV event as it does for the DBA LOCA.

The risk impact for such a scenario is calculated as: 1E-4 x 2E-3 x 1E-1 x 2.55E-1 =

5.1 E-9/yr Although not a DBA LOCA, postulating this additional scenario would not change the conclusion that the risk impact of COP credit for a DBA LOCA is "very small" per RG 1.174.

Other External Hazards In addition to seismic events and internal fires, the other following external hazard categories exist:

• High Winds/Tornadoes

• External Floods

• Transportation and Nearby Facility Accidents

• Other External Hazards The NRC IPEEE Program has generally determined that these other external hazard categories are not significant risk contributors. As such, these other external hazards F-21 F-2 1C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications are judged not to significantly impact the decision making for containment accident pressure credit.

Shutdown Risk The credit for containment accident pressure is not required for accident sequences occurring during shutdown. As such, shutdown risk does not influence the decision making for containment accident pressure credit.

F.8 COP RISK ASSESSMENT CONCLUSIONS The risk impact results for COP credit for LP ECCS NPSH for DBA LOCAs is:

• ACDF = 9.OE-9

" ALERF = 9.OE-9 Both the change in CDF and the change in LERF fall within the RG 1.174 "very small" risk increase region. These impacts are referenced with respect to the base modeling assumption that no COP credit is required for LP ECCS adequate NPSH during DBA LOCA scenarios. If the base model where revised to include modeling of any existing COP credit already allowed at the plant, the change in risk for the additional COP credit required by an EPU (or other LAR) would be even smaller.

Sensitivity studies show that even assuming plant conditions (e.g., high suppression pool temperature, high UHS temperature, etc.) contributing to inadequate NPSH exist 100% of the time results in a "very small" calculated risk impact.

The results for COP credit for DBA LOCA scenarios are orders of magnitude below the upper threshold of the RG 1.174 "very small" risk increase region. Even if COP credit were assumed required for DBA LOCAs, special events, and external events, the F-22 F-22 C495070003-7740-03127/08

Monticello Extended Power Uprate Risk Implications conservative and simplified calculations in this analysis shows that the overall impact (i.e., summing the impacts of COP credit for all such accidents) would still remain within the 'very small" risk increase region of RG 1.174 for Core Damage Frequency and just above the border of the "very small" and "small" region for Large Early Release Frequency. Relaxation of the excess conservatisms in the LERF modeling in this analysis (e.g., recognizing that loss of low pressure ECCS at t=4hrs does not result in a LERF release) would show that LERF risk metric is also clearly in the "very small" region even when COP credit impacts for DBA LOCAs, special events, and external events are summed.

F-23 F-23 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Table F-1 Summary of Understanding of MNGP DBA LLOCA NPSH Issues (Assuming no COP Exists)

@ t = 0min. @ t = 10 min.

DBA LP ECCS LP ECCS Time Time of LLOCA Single Pumps ECCS # Loops Pumps ECCS # Loops COP "Head Scenario IE Failure Injecting Throttled of SPC Injecting Throttled of SPC Required Collapse" Comment

1. 1 DBA LPCI Loop 6 No 0 n/a n/a n/a t=420 sec t=10 min. e Throttling LP ECCS prior to LOCA Select Logic (4 LPCI, (7 min.) t=-10 min. will restore adequate 2 CS) (judged NPSH (NPSHa conservative° Scenario #1 and #3 can be 2 ft. modeled together as need for below COP credit occurs at NPSHr) approximately same time, throttling will preclude need, and whether or not LPCI loop select logic fails does not impact this result

1. 2 DBA One Division 3 No 0 1 Yes 1 t-=8160 sec t=-13560 s

• Need for COP credit occurs in LOCA Emergency (2 LPCI, (1 CS) (1 RHR (135 miin.) (226 min.) late time frame AC I CS) pump, 1

• LP ECCS already throttled (i.e.,

Hx, 1 (NPSHa throttling LP ECCS does not RHRSW 6 ft. below preclude need for COP credit) pump) NPSHr)

1. 3 DBA Containment 6 No 0 2 Yes 2 t=440 sec t-10 min.

• Throttling LP ECCS prior to LOCA Isolation (4 LPCI, (2 CS) (2 RHR (7.3 min.) t=10 min. will restore adequate 2 CS) pumps (judged NPSH per loop, (NPSHa conservative° Scenario #1 and #3 can be I Hx per 2 ft. modeled together as need for loop, 2 below COP credit occurs at RHRSW NPSHr) approximately same time, throttling will preclude need, pumps and whether or not LPCI loop per Hx) select logic fails does not I_ I impact this result F-24 F-24 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Figure F-1 (1 of 3)

DBA LOCA Scenario Modifications Made to MNGP PRA for COP Sensitivity F-25 F-25 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Figure F-1 (2 of 3)

DBA LOCA Scenario Modifications Made to MNGP PRA for COP Sensitivity 2.40E-02 1.OOE-01 l.G0E-01 F-26 C495070003-7740-03/27/08 F-26

Monticello Extended Power Uprate Risk Implications Figure F-1 (3 of 3)

DBA LOCA Scenario Modifications Made to MNGP PRA for COP Sensitivity L------------

F-27 F-27 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Figure F-2 RG 1.174 Delta CDF Risk Acceptance Guidelines 0

io-10" gjio Re*:*i*

1 0-6 ..........

10-510- CDF 0 F-28 F-28 C495070003-7740-03/27/08

Monticello Extended Power Uprate Risk Implications Figure F-3 RG 1.174 Delta LERF Risk Acceptance Guidelines UJ 1Region 11 10-6 iO- LERF-*

F-29 F-29 C495070003-7740-03/27/08